Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference

Jiahui Hu; Qiyuan Wang; Shuaifan Jin; Xiaoyi Pang; Yajie Zhou; Yiting Han; Yuanfan Zhang; Zhibo Wang

REVIEW 3 major objections 6 minor 39 references

Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read In collaborative inference of large vision-language models, the hidden states sent from edge to cloud are not privacy-preserving; an attack can reconstruct both the user's image and text with high fidelity.

desk verdict First solid multimodal hidden-state inversion attack for LVLMs; strong numbers, but the attack needs white-box front-end weights and the abstract skips that caveat. read the letter →

arxiv 2608.01020 v1 pith:2HK32FFX submitted 2026-08-02 cs.CR

Shuaifan Jin , Zhibo Wang , Qiyuan Wang , Yiting Han , Yajie Zhou , Yuanfan Zhang , Jiahui Hu , Xiaoyi Pang This is my paper

classification cs.CR

keywords collaborativeinferencelargevision-languagemodelsprivacyleakagehidden-stateinversionreconstructionattacksplitlearningmultimodal

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Collaborative inference splits a large vision-language model across an edge device and a cloud server, sending only intermediate hidden states to the cloud under the assumption that withholding raw inputs preserves privacy. This paper argues that assumption is false: deep-layer hidden states still carry identifiable, stable signatures of privacy-relevant visual semantics, as proven by a local recoverability theorem with a positive semantic–nuisance margin. The authors then present RASR, a coarse-to-fine reconstruction attack that maps hidden states back to images and text through modality-specific inverse paths, then refines both by matching re-encoded hidden states to the intercepted ones. Evaluations on two open LVLMs and five datasets show RASR reduces image reconstruction MSE by about 50% versus the strongest baseline and recovers up to 99% of text tokens. The implication is that a curious cloud server can recover user inputs with high fidelity, undermining the privacy guarantee of collaborative inference.

What carries the argument

The central object is the quotient-transverse semantic margin: the smallest singular value of the semantic-response matrix after projecting out nuisance-induced hidden-state variations (Eqs. 1–2, with the projector $\Pi^\perp_u$ and the matrix $S_s = \Pi^\perp_u J_c$). If this margin is positive, Theorem 1 guarantees a Lipschitz-stable local decoder from hidden states to semantic coordinates. The attack operationalizes this with two machinery components: (1) symmetric reconstruction branches that reverse the forward paths—visual hidden state $H_v$ is mapped to aligned visual tokens $\hat{V}$, then to visual features $\hat{Z}$, then to the reconstructed image $\hat{I}$; textual hidden state $

What would settle it

Attempt the RASR attack on an LVLM with a different cross-modal alignment module (e.g., a Q-Former or a deep non-linear projector) at the same partition depth, measuring both the semantic–nuisance margin and reconstruction accuracy; if the margin is non-positive or the token/image reconstruction falls to baseline levels, the generality of the privacy-leakage claim is falsified.

Watch

Extended reading notes

Core claim

The paper establishes, both theoretically and empirically, that privacy-relevant visual semantics remain recoverable from the intermediate hidden states of a large vision-language model after cross-modal alignment and propagation through the LLM backbone. The core theorem (Theorem 1) shows that under local regularity conditions and a positive semantic–nuisance separation margin, there exists a locally stable semantic decoder that maps hidden states back to the semantic coordinates of the original image. On top of this, the proposed RASR attack achieves strong multimodal reconstruction: it uses symmetric reconstruction branches that approximately reverse the forward visual and textual pipelin

Load-bearing premise

The attack only works when the adversary (the cloud) has full access to the edge's front-end weights—including the visual encoder and cross-modal aligner—so it can compute gradients and run the consistency-guided refinement; if those weights are closed or hidden, the demonstrated reconstruction cannot be executed.

Editorial extensions

If this is right

If the claim holds, any collaborative LVLM inference system that exposes deep hidden states to a cloud with white-box access is open to high-fidelity reconstruction of both images and text by an honest-but-curious server.
The theoretical condition implies that privacy leakage is not an accident of specific models: it follows from a positive semantic–nuisance margin, which the paper measures as positive at all evaluated layers on two architectures.
RASR's speed (about 0.2–0.3 seconds per text token) suggests the attack is practical for real-time interception, not just offline analysis.
The results motivate representation-level defenses: mechanisms that reduce the semantic–nuisance margin, add calibrated noise to hidden states, or hide the front-end weights would be needed to restore privacy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The quotient semantic–nuisance margin could be adopted as a quantitative privacy-risk metric when choosing a split point: operators could measure it before deployment and prefer partition depths where the margin is smallest, thereby reducing recoverable semantics.
The attack assumes the adversary knows the visual prefix length and the exact partition layer; if the edge device obfuscates the token layout (e.g., by shuffling visual tokens or inserting dummy tokens), the symmetric reconstruction might degrade—a testable extension the paper does not explore.
The inversion idea may transfer to other modalities (audio, video) in multimodal models and to other split-inference protocols, since the theorem is phrased for general hidden-state mappings; adapting RASR to those settings is a natural next step.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The short version: this is the first paper I've seen that reconstructs both image and text from split-layer LVLM hidden states, and the results are strong enough to take seriously. The catch is in the threat model: the whole consistency-guided refinement stage requires the adversary to know and differentiate through the full front-end mapping, so the headline numbers don't carry over to closed-weight deployments.

What's actually new: prior work recovers text from unimodal LLM hidden states or images from unimodal vision encoders, and cross-modal attacks only get attributes or training data. This paper handles the multimodal case end to end, with a two-branch inverse architecture that mirrors the forward paths and a consistency refinement that re-encodes candidates through the front-end. The evaluation is honest: RQ1 measures linear decodability, Jacobian-vector products, and quotient margins across depths, and the measured margins stay positive. The ablation study is thorough, including the refinement budget and the effect of reconstructed-image guidance on text recovery. On the empirical side, the gains over INVERSE-TVM (about 50% MSE reduction) and over SIPIT on text are believable in direction, though I couldn't verify the exact numbers because no code or data are included.

Soft spots, in order of importance. First, the white-box front-end assumption is load-bearing. The refined image update (Eq. 15) and token search (Eq. 16) re-run Phi_{≤s} and backprop through it. Without open weights or a way to call and differentiate the front-end, the fine stage can't execute, and the reported 50% MSE gain and the jump from 96% to 99.5% token accuracy disappear. The threat model states this access, but the abstract and title don't, so the privacy warning overreaches. A black-box variant with only query access to the front-end would settle how much of the attack survives. Second, the main reconstruction tables have no error bars; the text evaluation uses only 120 test samples per dataset, which is small for claiming 99% token accuracy. Third, Theorem 1 is a standard constant-rank argument and the conclusion is nearly a restatement of the positive margin condition, but the paper is upfront about that, and the empirical margin measurements are the real evidence. Fourth, they don't compare against the two cross-modal baselines they cite (CapRecover and Adaptive Token-Weighted Model Inversion), though those target different outputs, so it's a minor gap.

Who this is for: anyone designing collaborative inference systems for LVLMs, and privacy researchers working on split learning. It's not a formal privacy proof or a systems paper; it's an attack paper with a conditional theoretical justification. I'd send it to review. A serious referee will want the code released and a black-box ablation, but the core finding, that deep LVLM hidden states leak both modalities when the front-end is available, is solid.

Referee Report

3 major / 6 minor

Summary. The paper investigates privacy leakage in collaborative inference of large vision-language models (LVLMs), where intermediate hidden states are transmitted from an edge device to a cloud backend. It first presents a theoretical analysis (Theorem 1) giving a sufficient condition under which selected visual semantic coordinates remain locally recoverable from hidden states. It then proposes RASR, a coarse-to-fine attack with a symmetric reconstruction stage and a hidden-state-consistency refinement stage, and evaluates it on Qwen3-VL-8B-Instruct and LLaVA-1.5-7B across several datasets. The experiments report consistent improvements over adapted baselines in both image reconstruction (about 50% MSE reduction) and text reconstruction (up to about 99% token accuracy), along with ablations and layer-depth analyses.

Significance. If the results hold, the paper provides useful evidence that collaborative LVLM inference is not privacy-preserving by default, and it proposes a concrete attack that outperforms existing unimodal inversion methods. The empirical study is fairly extensive: two architectures, five datasets, multiple partition depths, and ablations of key components. The theoretical section is internally coherent and the paper is transparent about several limitations, explicitly stating that the experiments probe finite-dimensional proxies rather than establishing global guarantees. The main value is in the attack and the systematic empirical demonstration; the theoretical result is less substantive than the abstract suggests, and the attack's practical scope depends critically on white-box access to the front-end model.

major comments (3)

[IV-A, Theorem 1 and Condition (C3)] The proof is internally coherent, but Theorem 1 is largely a restatement of Condition (C3). The positive quotient margin gamma_0 = sigma_min(S_s) is exactly the condition that the semantic response J_c is injective modulo the nuisance response Im(J_u); the constant-rank theorem then supplies the local left inverse and the stability bound (6) is the corresponding linear-algebra estimate. Thus the theoretical contribution is a formalization of a sufficient condition rather than a substantive proof that privacy-relevant semantics are recoverable beyond what is assumed. The RQ1 measurements (Section VI-B) estimate finite-dimensional proxies on selected semantic/nuisance bases, not the actual C3 condition over natural-image neighborhoods. I recommend reframing the abstract and contributions to present Theorem 1 as making the needed margin explicit, and clearly stating that the condition is as
[III-B.2, Eqs. (14)-(16)] The fine stage of RASR requires access to and differentiation through the complete front-end mapping Phi_{<=s}, including the visual encoder, aligner, embedding layer, and first s transformer layers. Equations (15) and (16) regenerate hidden states by re-running Phi_{<=s} and backpropagating through it. Without access to these weights, the consistency-guided refinement cannot execute. Table VII shows Token Acc. increases from 96.16% without refinement to 99.47% with tau=0.85, and Fig. 5 shows that K=100 refinement substantially reduces hidden-state MSE. Since the abstract and title make a general privacy-leakage claim, the white-box requirement should be either tested in a black-box or query-only setting, or explicitly stated as a scope condition in the abstract. This is a load-bearing boundary of the reported attack efficacy.
[VI-C, Tables II-III] The headline quantitative comparisons do not report error bars or significance tests. The text evaluation uses only 120 evaluation samples per dataset, so a difference of a few EMR percentage points corresponds to only a handful of sequences; some of the smaller gaps in Table III may not be statistically robust. I recommend reporting multiple seeds or confidence intervals for the main tables, at least for the text results and the MSE reductions in Table II.

minor comments (6)

[V-B] The symbol R_text is used in the description of textual reconstruction but is not defined before use; please introduce it explicitly.
[Throughout] There are formatting inconsistencies: 'LLaV A' appears with a space in many places, 'figs. 2b/2c' is lowercase, and some inline symbols such as R_llm are inconsistently formatted. A careful proofreading pass is needed.
[VI-A.1] FEVER and MS MARCO texts are paired with unrelated VQAv2 images. Please clarify why this pairing does not affect the multimodal validity of the text-reconstruction results, and consider reporting text recovery on naturally paired VQAv2 questions as the primary multimodal setting.
[VI-D] The candidate-set size (8) and the visual refinement learning rates are fixed without sensitivity analysis. A short sweep or a sentence explaining the choice would strengthen the parameter analysis.
[VI-B] Table I reports attribute-probe accuracies without confidence intervals, while Fig. 3 includes bootstrap intervals. Adding intervals to Table I would improve comparability.
[Reproducibility] No code is released. Given the exact seed and fixed splits described in Section VI-A, providing code or a detailed reproduction recipe would greatly increase the value of the empirical results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the recoverability theorem is a standard sufficient-condition result, and the attack's gains are measured against independent baselines on held-out data.

full rationale

The paper's central derivation chain is self-contained. Theorem 1 (Section IV-A) is a standard constant-rank/factorization argument: Condition (C3) is a Jacobian full-column-rank condition after nuisance projection, and the conclusion is the existence of a local left-inverse decoder. This is a genuine implication, not a restatement by definition: C3 is not defined as the existence of the decoder, and no equation of the theorem is substituted back into its own premise. The empirical RQ1 checks (Section VI-B) independently estimate rank and margins from the model's Jacobian and from attribute probes; these are not fitted parameters that are then reported as the attack's predictions. The RASR attack (Section V) is trained against ground-truth image/text losses (Eqs. 12-13) and evaluated on held-out splits against external baselines; the consistency-guided refinement (Eqs. 14-16) optimizes reconstructions to match the intercepted hidden states, which is the attack's objective, not a circular prediction. The white-box front-end assumption in the threat model is a scope limitation, not a circularity. The only self-citation ([23], FaceObfuscator) appears in related work and is not load-bearing. Hence no circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central theoretical claim depends on the local image parameterization G(c,u) and the positive margin condition, which are introduced specifically for this paper. The attack depends on the open-weight threat model and on hyperparameters selected through ablations. No new physical or conceptual entities are postulated.

free parameters (6)

confidence threshold tau = 0.85
Selected by sweeping tau across six dataset-model combinations (Table VII); higher thresholds increase runtime without consistent accuracy gains. The text refinement stage depends on it.
refinement step count K = 100
Chosen via Fig. 5 to balance hidden-state MSE reduction against runtime; beyond 100 there is no edge fidelity gain.
candidate set size = 8
Fixed in textual refinement (Section V-C) and used in Eq. (16); no ablation is shown, but it bounds the token search.
visual refinement learning rates = 4.5e-3 (Qwen), 1.4e-2 (LLaVA)
Per-model learning rates in Section VI-A; they affect the gradient update in Eq. (15).
semantic basis V_c = 9-dim CelebA basis or 16-dim CLIP-PC basis from 192 images
Used to estimate J_c via JVPs in Section VI-B; the measured margin is basis-dependent.
nuisance basis V_u = 16 right singular vectors of 960 augmented-image secants
Used to estimate J_u and the quotient margin; unmeasured nuisance directions could shrink the margin.

assumptions (5)

domain assumption Natural images can be locally parameterized by semantic coordinates c and nuisance coordinates u via a smooth map G(c,u) (Eq. 1).
The entire Theorem 1 is stated relative to this parameterization; no construction of G is given.
domain assumption The hidden-state map h_s is C^2 and J_u has constant rank in a neighborhood (Conditions C1-C2).
These regularity assumptions are needed for the constant-rank and factorization theorems; they are not verified exactly in experiments.
ad hoc to paper The quotient semantic margin gamma_0 = sigma_min(S_s) is positive (Condition C3).
This is the core sufficient condition; the theorem's conclusion is essentially a formal consequence of it. Empirically it is only estimated on selected proxy bases.
standard math Standard differential geometry results: the constant-rank theorem and the local factorization theorem.
Used in the proof of Theorem 1 to construct the local decoder phi_s.
domain assumption The adversary knows the target LVLM architecture and has access to the front-end parameters Phi_{<=s}.
Required for training the reconstructors and for the hidden-state consistency refinement in Eqs. (14)-(16). Flagged by the authors as feasible for open-weight models.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference." pith.science (2026). https://pith.science/paper/2HK32FFX

@misc{pith2026260801020,
  author       = {Pith},
  title        = {Pith review of: Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2HK32FFX}},
  note         = {Machine review of arXiv:2608.01020}
}

abstract

Collaborative inference deploys Large Vision-Language Models (LVLMs) by partitioning computation between edge devices and the cloud. While withholding raw inputs supposedly ensures privacy, transmitting intermediate hidden states exposes a critical attack surface. However, it remains unclear whether deep-layer LVLM hidden states retain recoverable private information, given that visual content has been projected into the language embedding space. To address this concern, we theoretically analyze LVLM hidden-state recoverability and show that, under regularity assumptions and a positive semantic--nuisance margin, privacy-relevant visual semantics remain identifiable and stably recoverable. Motivated by this analysis, we propose RASR, a novel coarse-to-fine multimodal reconstruction attack. RASR obtains initial image and text reconstructions through modality-specific inverse paths that follow their respective forward processing pipelines in reverse, and then uses hidden-state consistency to refine both reconstructions. Evaluations on Qwen3-VL-8B-Instruct and LLaVA-1.5-7B across five datasets demonstrate that RASR reduces image reconstruction MSE by $\sim$50\% compared to the strongest baselines, while achieving up to 99\% token accuracy for text recovery. These results show that privacy-sensitive visual and textual information can be recovered even from deep-layer LVLM hidden states, exposing the privacy risks of collaborative inference.

Figures

Figures reproduced from arXiv: 2608.01020 by the authors.

**Figure 2.** Overview of the proposed reconstruction pipeline and the feature-space distributions of visual and textual hidden states. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Exact-JVP results over 100 evaluation inputs per [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Visual comparison across different methods. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Effect of the visual refinement budget K. TABLE VI: Effect of reconstructed image guidance on textual refinement on VQAv2 (%). Setting Qwen LLaVA Token Acc. EMR BERT-F1 Token Acc. EMR BERT-F1 w/o reconstructed image 99.78 98.33 99.89 99.70 98.33 99.89 with reconstructe…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 29 canonical work pages

[1]

Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack,

G. Chen, Z. Qin, M. Yanget al., “Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2904–2918

work page 2024
[2]

Language models are injective and hence invertible,

G. Nikolaou, T. Mencattini, D. Crisostomiet al., “Language models are injective and hence invertible,”arXiv preprint arXiv:2510.15511, 2025

arXiv 2025
[3]

Rep2text: Decoding full text from a single llm token representation,

H. Zhao, Z. He, F. Yanget al., “Rep2text: Decoding full text from a single llm token representation,”arXiv preprint arXiv:2511.06571, 2025

arXiv 2025
[4]

Inverting visual representations with convolutional networks,

A. Dosovitskiy and T. Brox, “Inverting visual representations with convolutional networks,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 4829–4837

work page 2016
[5]

Understanding Transformer-based Vision Models through Inversion

J. Rathjens, S. Reyhanian, D. Kappelet al., “Understanding transformer- based vision models through inversion,” 2025. [Online]. Available: https://arxiv.org/abs/2412.06534

work page Pith review arXiv 2025
[6]

Sparse model inversion: efficient inversion of vision transformers for data-free applications,

Z. Hu, Y . Wei, L. Shenet al., “Sparse model inversion: efficient inversion of vision transformers for data-free applications,” inProceedings of the 41st International Conference on Machine Learning, 2024, pp. 19 475– 19 490

work page 2024
[7]

A survey of attacks on large vi- sion–language models: Resources, advances, and future trends,

D. Liu, M. Yang, X. Quet al., “A survey of attacks on large vi- sion–language models: Resources, advances, and future trends,”IEEE Transactions on Neural Networks and Learning Systems, vol. 36, no. 11, pp. 19 525–19 545, 2025

work page 2025
[8]

Lvlm-ehub: A comprehensive evalu- ation benchmark for large vision-language models,

P. Xu, W. Shao, K. Zhanget al., “Lvlm-ehub: A comprehensive evalu- ation benchmark for large vision-language models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 47, no. 3, pp. 1877– 1893, 2025

work page 2025

Show all 39 references

[9]

A survey of state of the art large vision language models: Benchmark evaluations and challenges,

Z. Li, X. Wu, H. Duet al., “A survey of state of the art large vision language models: Benchmark evaluations and challenges,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2025, pp. 1587–1606

2025
[10]

Learning transferable visual models from natural language supervision,

A. Radford, J. W. Kim, C. Hallacyet al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning. PmLR, 2021, pp. 8748–8763

2021
[11]

Visual instruction tuning,

H. Liu, C. Li, Q. Wuet al., “Visual instruction tuning,”Advances in neural information processing systems, vol. 36, pp. 34 892–34 916, 2023

2023
[12]

Improved baselines with visual instruction tuning,

H. Liu, C. Li, Y . Liet al., “Improved baselines with visual instruction tuning,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 26 296–26 306

2024
[13]

Llava-next: A strong zero- shot video understanding model,

Y . Zhang, B. Li, h. Liuet al., “Llava-next: A strong zero- shot video understanding model,” April 2024. [Online]. Available: https://llava-vl.github.io/blog/2024-04-30-llava-next-video/

2024
[14]

Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond,

J. Bai, S. Bai, S. Yanget al., “Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond,”arXiv preprint arXiv:2308.12966, 2023

2023 arXiv
[15]

Qwen2.5-vl technical report,

S. Bai, K. Chen, X. Liuet al., “Qwen2.5-vl technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2502.13923

2025 arXiv
[16]

Qwen3-vl technical report,

S. Bai, Y . Cai, R. Chenet al., “Qwen3-vl technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2511.21631

2025 arXiv
[17]

Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,

Y . Kang, J. Hauswald, C. Gaoet al., “Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,”ACM SIGARCH Computer Architecture News, vol. 45, no. 1, pp. 615–629, 2017

2017
[18]

Splitllm: Collaborative infer- ence of llms for model placement and throughput optimization,

A. Mudvari, Y . Jiang, and L. Tassiulas, “Splitllm: Collaborative infer- ence of llms for model placement and throughput optimization,”arXiv preprint arXiv:2410.10759, 2024

2024 arXiv
[19]

Model-distributed inference for large language models at the edge,

D. Macario, H. Seferoglu, and E. Koyuncu, “Model-distributed inference for large language models at the edge,” in2025 IEEE 31st International Symposium on Local and Metropolitan Area Networks (LANMAN), 2025, pp. 1–6

2025
[20]

Petals: Collaborative inference and fine-tuning of large models,

A. Borzunov, D. Baranchuk, T. Dettmerset al., “Petals: Collaborative inference and fine-tuning of large models,” inProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 3: System Demonstrations), D. Bollegala, R. Huang, and A. Ritter, ...

2023
[21]

Understanding deep image represen- tations by inverting them,

A. Mahendran and A. Vedaldi, “Understanding deep image represen- tations by inverting them,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2015, pp. 5188–5196

2015
[22]

The secret revealer: Generative model- inversion attacks against deep neural networks,

Y . Zhang, R. Jia, H. Peiet al., “The secret revealer: Generative model- inversion attacks against deep neural networks,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 253–261

2020
[23]

FaceObfuscator: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition,

S. Jin, H. Wang, Z. Wanget al., “FaceObfuscator: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition,” in33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 6849–6866. ...

2024
[24]

Gradvit: Gradient inversion of vision transformers,

A. Hatamizadeh, H. Yin, H. R. Rothet al., “Gradvit: Gradient inversion of vision transformers,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 021–10 030

2022
[25]

What do we learn from inverting clip models?

H. Kazemi, A. Chegini, J. Geipinget al., “What do we learn from inverting clip models?”arXiv preprint arXiv:2403.02580, 2024

2024 arXiv
[26]

Information leakage in embedding models,

C. Song and A. Raghunathan, “Information leakage in embedding models,” inProceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, pp. 377–390

2020
[27]

Privacy risks of general-purpose language models,

X. Pan, M. Zhang, S. Jiet al., “Privacy risks of general-purpose language models,” in2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 1314–1331

2020
[28]

Extracting prompts by inverting llm outputs,

C. Zhang, J. X. Morris, and V . Shmatikov, “Extracting prompts by inverting llm outputs,” inProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024, pp. 14 753– 14 777

2024
[29]

Text embeddings reveal (almost) as much as text,

J. Morris, V . Kuleshov, V . Shmatikovet al., “Text embeddings reveal (almost) as much as text,” inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023, pp. 12 448– 12 460

2023
[30]

Prompt inversion attack against collab- orative inference of large language models,

W. Qu, Y . Zhou, Y . Wuet al., “Prompt inversion attack against collab- orative inference of large language models,” in2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025, pp. 1695–1712

2025
[31]

Caprecover: A cross-modality feature inversion attack framework on vision language models,

K. Xiu and S. Q. Zhang, “Caprecover: A cross-modality feature inversion attack framework on vision language models,” inProceedings of the 33rd ACM International Conference on Multimedia, 2025, pp. 3808–3816

2025
[32]

Do vision-language models leak what they learn? adaptive token-weighted model inversion attacks,

N.-B. Nguyen, S.-T. Ho, K. J. Haoet al., “Do vision-language models leak what they learn? adaptive token-weighted model inversion attacks,”
[33]

Making the v in vqa matter: Elevating the role of image understanding in visual question answering,

Y . Goyal, T. Khot, D. Summers-Stayet al., “Making the v in vqa matter: Elevating the role of image understanding in visual question answering,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 6904–6913

2017
[34]

Deep learning face attributes in the wild,

Z. Liu, P. Luo, X. Wanget al., “Deep learning face attributes in the wild,” inProceedings of the IEEE international conference on computer vision, 2015, pp. 3730–3738

2015
[35]

Automated flower classification over a large number of classes,

M.-E. Nilsback and A. Zisserman, “Automated flower classification over a large number of classes,” in2008 Sixth Indian conference on computer vision, graphics & image processing. IEEE, 2008, pp. 722–729

2008
[36]

Fever: a large- scale dataset for fact extraction and verification,

J. Thorne, A. Vlachos, C. Christodoulopouloset al., “Fever: a large- scale dataset for fact extraction and verification,”arXiv preprint arXiv:1803.05355, 2018

2018 arXiv
[37]

Ms marco: A human- generated machine reading comprehension dataset,

T. Nguyen, M. Rosenberg, X. Songet al., “Ms marco: A human- generated machine reading comprehension dataset,” 2016

2016
[38]

Anycost gans for interactive image synthesis and editing,

J. Lin, R. Zhang, F. Ganzet al., “Anycost gans for interactive image synthesis and editing,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2021, pp. 14 986–14 996

2021
[2026]

Available: https://arxiv.org/abs/2508.04097

[Online]. Available: https://arxiv.org/abs/2508.04097

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack,

G. Chen, Z. Qin, M. Yanget al., “Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2904–2918

work page 2024

[2] [2]

Language models are injective and hence invertible,

G. Nikolaou, T. Mencattini, D. Crisostomiet al., “Language models are injective and hence invertible,”arXiv preprint arXiv:2510.15511, 2025

arXiv 2025

[3] [3]

Rep2text: Decoding full text from a single llm token representation,

H. Zhao, Z. He, F. Yanget al., “Rep2text: Decoding full text from a single llm token representation,”arXiv preprint arXiv:2511.06571, 2025

arXiv 2025

[4] [4]

Inverting visual representations with convolutional networks,

A. Dosovitskiy and T. Brox, “Inverting visual representations with convolutional networks,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 4829–4837

work page 2016

[5] [5]

Understanding Transformer-based Vision Models through Inversion

J. Rathjens, S. Reyhanian, D. Kappelet al., “Understanding transformer- based vision models through inversion,” 2025. [Online]. Available: https://arxiv.org/abs/2412.06534

work page Pith review arXiv 2025

[6] [6]

Sparse model inversion: efficient inversion of vision transformers for data-free applications,

Z. Hu, Y . Wei, L. Shenet al., “Sparse model inversion: efficient inversion of vision transformers for data-free applications,” inProceedings of the 41st International Conference on Machine Learning, 2024, pp. 19 475– 19 490

work page 2024

[7] [7]

A survey of attacks on large vi- sion–language models: Resources, advances, and future trends,

D. Liu, M. Yang, X. Quet al., “A survey of attacks on large vi- sion–language models: Resources, advances, and future trends,”IEEE Transactions on Neural Networks and Learning Systems, vol. 36, no. 11, pp. 19 525–19 545, 2025

work page 2025

[8] [8]

Lvlm-ehub: A comprehensive evalu- ation benchmark for large vision-language models,

P. Xu, W. Shao, K. Zhanget al., “Lvlm-ehub: A comprehensive evalu- ation benchmark for large vision-language models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 47, no. 3, pp. 1877– 1893, 2025

work page 2025