Pith. sign in

REVIEW 3 major objections 5 minor 196 references

Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey

T0 review · 3 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey maps model inversion attacks into three attack families and six defense families, with a maintained repository of papers, datasets, and metrics.

desk verdict A useful if imperfect map of the model inversion landscape; the taxonomy needs rework before the 'systematic' claim can stand. read the letter →

arxiv 2501.18934 v2 pith:GZ5GRRWQ submitted 2025-01-31 cs.CR

Wencheng Yang , Song Wang , Di Wu , Taotao Cai , Yanming Zhu , Shicheng Wei , Yiying Zhang , Xu Yang
show 2 more authors
Zhaohui Tang Yan Li
This is my paper · ORCID
classification cs.CR
keywords modelinversionattacksgradientgenerativeprivacy-preservingdeeplearningfederatedprivacydifferentialdefensesAIsecuritytaxonomysurvey
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a survey that tries to establish a structured map of model inversion attacks and defenses for deep learning. It proposes that attacks be understood through three families—gradient inversion, generative model-based, and optimisation-based—and defenses through six families, from feature perturbation to cryptographic encryption. The payoff, if the map is accurate, is that a researcher can place any attack or defense, see what has been tried, and identify undefended gaps across biometrics, healthcare, and finance. The survey also builds a continuously maintained public repository of papers, datasets, and evaluation metrics to support that work.

What carries the argument

The load-bearing object is the taxonomy itself. Gradient inversion attacks recover inputs from gradients shared during federated or distributed learning, for instance by optimizing dummy data until its gradient matches the real gradient; generative model-based attacks use GANs or diffusion models as priors to invert model outputs or intermediate features; optimisation-based attacks iteratively refine reconstructed inputs by matching gradients, outputs, or intermediate representations. The defense side splits into feature perturbation/obfuscation, gradient pruning, gradient perturbation/obfuscation, differential privacy, cryptographic encryption, and model/architecture enhancement. This classification carries the argument because it is what lets the survey compare roughly 180 selected papers across applications and data types and identify open problems such as the privacy-utility trade-off and the lack of standardized metrics.

What would settle it

Independently re-code the roughly 180 cited papers into the survey's three attack families and six defense families; if a substantial fraction of assignments require forcing or end up ambiguous—for instance, attacks that straddle gradient inversion and optimisation-based families—then the taxonomy's claim to be a clean unifying framework is falsified.

Watch

Extended reading notes

Core claim

Model inversion (MI) attacks are attempts to reconstruct private training data from a trained model's parameters, outputs, or intermediate representations, and this survey's central claim is that the field can be organized into a single structured map. On the attack side the map has three families: gradient inversion, generative model-based, and optimisation-based attacks. On the defense side it has six families: feature perturbation/obfuscation, gradient pruning, gradient perturbation/obfuscation, differential privacy, cryptographic encryption, and model/architecture enhancement. The survey applies this map across biometrics, healthcare, and finance, across images, audio, and text/tabular data, and across evaluation metrics and datasets, and it packages the result as a continuously maintained public repository of papers, datasets, and metrics for both new and experienced researchers.

Load-bearing premise

The survey's authority depends on its reading of the roughly 180 selected papers being accurate and its three attack categories cleanly separating the field; if many primary works are mischaracterized or the categories overlap too much, the map loses its value.

Editorial extensions

If this is right

  • A researcher encountering a new MI attack can place it in one of the three attack families and compare it directly with the methods summarized in the survey.
  • A practitioner in biometrics, healthcare, or finance can use the repository to locate relevant attack studies, datasets, and evaluation metrics before designing or selecting defenses.
  • The defense taxonomy makes explicit that every family trades off privacy, utility, and computation, and that most defenses have not been tested on resource-constrained IoT or edge devices.
  • The survey's stated future directions—realistic threat models, scalable and generalizable defenses, standardized metrics, and domain-specific approaches—become a concrete research agenda if the taxonomy is accepted.
  • Work on emerging generative AI (large language models, diffusion models) can be positioned in the same map, because the survey reviews embedding inversion, activation inversion, and diffusion-model extraction as part of the MI landscape.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Going beyond the paper, the three attack families are not cleanly disjoint—the survey itself notes optimisation-based attacks overlap with gradient inversion and generative methods—so a useful next step would be a formal hierarchy in which an attack can occupy multiple leaves, with a test showing every recent method has a unique path.
  • The paper's observation that evaluation metrics vary widely suggests an experiment it does not run: re-evaluate a fixed set of attacks and defenses under all metrics listed in the survey on a shared dataset, and measure how often method rankings change; high rank instability would confirm the need for standardization.
  • If the repository is maintained as promised, it could evolve from a resource list into a living benchmark; a natural extension, which the paper calls for but does not build, is a leaderboard tied to a single realistic threat model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This manuscript is a survey of deep-learning model inversion (MI) attacks and defenses. It proposes a taxonomy of MI attacks into gradient inversion attacks, generative model-based attacks, and optimisation-based attacks, with a separate miscellaneous section; reviews defenses under six headings (feature perturbation/obfuscation, gradient pruning, gradient perturbation/obfuscation, differential privacy, cryptographic encryption, and model/architecture enhancement); presents evaluation metrics and datasets; discusses MI in biometrics, healthcare, finance, and emerging generative/foundation models; and introduces a GitHub repository of papers, datasets, and metrics. The paper also compares itself with previous surveys in Table 1 and offers future research directions in Section 7.

Significance. The survey addresses a timely and active area, and if taken as a reliable map it would be a genuinely useful resource. Its strengths are breadth (about 180 papers), the consolidated metric and dataset sections, the comparison with prior surveys, the timely coverage of LLM and diffusion-model inversion, and the public repository. However, the claimed systematic attack taxonomy is the paper's first stated contribution, and as written it is not mutually exclusive or consistently applied; this affects the central value of the survey. There is also a concrete technical error in an evaluation-metric formula. These problems are fixable without changing the scope of the paper, so a major revision is appropriate rather than rejection.

major comments (3)
  1. [Section 3 (taxonomy), especially 3.1, 3.3, and 3.5] The central taxonomy is internally inconsistent. Section 3.3 states that optimisation-based attacks "cover aspects of gradient inversion attacks and generative model-based attacks," and Section 3.5 repeats this characterisation. LOMMA is presented in Section 3.1 as a gradient inversion attack and again in Section 3.3 as an optimisation-based attack; GGI, which uses a pre-trained generator, is placed in Section 3.1; and BREP-MI, a label-only method without a generative model, is placed in Section 3.2. Section 3.4 then introduces methods that "do not fit into those well-defined categories," which is hard to reconcile with Section 3.3's claim that optimisation-based attacks cover the other categories. With overlapping categories and methods assigned to multiple categories, the "systematic taxonomy" claimed in the Abstract and Section 1.2 is not established. Please either make the categories orthogonal—for example, separating the optimisation mechanism from the adversary's information source and the use of a generative prior—or assign each method to exactly one category with an explicit decision rule, and update Figure 2 and Table 2 accordingly.
  2. [Section 5, Eq. (11)] The formula for Absolute Variation Distance (AVD) is incorrect as printed. The first term is the norm of the product |∇v_source|·|∇v_target|, which is not a distance measure and does not compare the two gradient maps; it can be zero when either gradient is zero even if the images differ arbitrarily. The textual description says AVD compares similarity by analyzing spatial gradients, so the intended expression is presumably || |∇v_source| − |∇v_target| || + || |∇2v_source| − |∇2v_target| ||. Because a survey is used as a reference for evaluation metrics, an incorrect metric formula is a substantive error that should be corrected.
  3. [Section 4 (defense taxonomy)] The defense taxonomy also has category overlap. Section 4.1 is titled "Feature Perturbation/Obfuscation," yet it contains Sparse-coding Architecture, an architectural defense, while Section 4.6 is devoted to "Model/Architecture Enhancement." Section 4.7 then adds "Miscellaneous MI Defenses" even though the section opening states that defenses are divided into six categories. This undercuts the systematic organization of the defense review. Please either move Sparse-coding Architecture to Section 4.6, or state a placement criterion that explains why it belongs under feature perturbation.
minor comments (5)
  1. [Section 1.3] The literature selection methodology would be more auditable if it reported the number of papers excluded at each filtering stage and the specific quality criteria applied; the current description moves from "about 500" retrieved to "approximately 180" selected without intermediate counts.
  2. [Section 3.4] DeepInversion is placed in Miscellaneous because it "does not fit" the earlier categories, but its optimization over internal feature statistics could plausibly fit the optimisation-based category; please clarify the placement criterion for the miscellaneous section.
  3. [Section 1.2] The paper states that the authors generate abbreviations where the original works do not provide them; these newly coined abbreviations should be marked as such in the text so readers do not attribute them to the primary sources.
  4. [Section 6] The AT&T dataset entry has no citation; please add the original source or state that the dataset is publicly available without a canonical reference.
  5. [General] There are several typos, including "catergory" in Section 3.3 and "itchallenging" in Section 7.5; a careful proofreading pass is recommended.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: a literature-survey paper with no derivation chain that could reduce to its inputs.

full rationale

This paper is a survey of model inversion attacks and defenses. It derives no new mathematical results, fits no parameters, and makes no empirical prediction of its own; its claims are summaries and classifications of cited primary work. The abstract's 'systematic taxonomy' and 'comprehensive repository' are organizational contributions, not results derived from first principles, so there is no equation, fitted constant, or uniqueness theorem whose output is equivalent to an input by construction. The authors cite some of their own prior work (e.g., Yang et al. 2023 in the survey comparison and elsewhere) and appear in the reference list as authors of several biometrics-related papers, but none of these self-citations is load-bearing: the survey's central content is a description of external attack and defense papers, and the self-citations are used as ordinary literature references rather than to justify a derivation or forbid alternatives. The internal taxonomy overlap noted by a skeptical reader (e.g., Section 3.3 stating optimisation-based attacks 'cover' gradient inversion and generative model-based attacks, with LOMMA appearing in both Section 3.1 and Section 3.3) is a potential correctness or clarity issue about category boundaries, not a circularity: classifying a method in two places does not make the survey's claims equivalent to their own inputs. The paper's stated limitations (e.g., Section 7.5 acknowledging that existing open-source repositories 'each has its own limitation' while proposing its own repository) are ordinary statements of contribution and need, not circular reasoning. No passage was found in which a prediction reduces by construction to fitted data or to a self-citation chain.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

A survey has no fitted parameters and introduces no new entities. It rests on the trustworthiness of its secondary representation of primary literature and on the completeness of its search. No circularity or parameter fitting is present.

assumptions (2)
  • domain assumption The cited primary works are accurately represented and the survey's taxonomy correctly reflects the content of those works.
    The value of a survey depends on faithful summarization of the ~180 reviewed papers. Any systematic misrepresentation would invalidate the survey's conclusions.
  • domain assumption The literature search is sufficiently comprehensive that the final set of ~180 papers is representative of the field.
    The survey claims comprehensiveness; this rests on the search and selection methodology described in Section 1.3, which cannot be independently verified from the paper alone.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey." pith.science (2026). https://pith.science/paper/GZ5GRRWQ

@misc{pith2026250118934,
  author       = {Pith},
  title        = {Pith review of: Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GZ5GRRWQ}},
  note         = {Machine review of arXiv:2501.18934}
}
read the original abstract

The rapid adoption of deep learning in sensitive domains has brought tremendous benefits. However, this widespread adoption has also given rise to serious vulnerabilities, particularly model inversion (MI) attacks, posing a significant threat to the privacy and integrity of personal data. The increasing prevalence of these attacks in applications such as biometrics, healthcare, and finance has created an urgent need to understand their mechanisms, impacts, and defense methods. This survey aims to fill the gap in the literature by providing a structured and in-depth review of MI attacks and defense strategies. Our contributions include a systematic taxonomy of MI attacks, extensive research on attack techniques and defense mechanisms, and a discussion about the challenges and future research directions in this evolving field. By exploring the technical and ethical implications of MI attacks, this survey aims to offer insights into the impact of AI-powered systems on privacy, security, and trust. In conjunction with this survey, we have developed a comprehensive repository to support research on MI attacks and defenses. The repository includes state-of-the-art research papers, datasets, evaluation metrics, and other resources to meet the needs of both novice and experienced researchers interested in MI attacks and defenses, as well as the broader field of AI security and privacy. The repository will be continuously maintained to ensure its relevance and utility. It is accessible at https://github.com/overgter/Deep-Learning-Model-Inversion-Attacks-and-Defenses.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

196 extracted references · 49 canonical work pages

  1. [1]

    , Zhou , S

    barticle Antwi-Boasiako , E. , Zhou , S. , Liao , Y. , Dong , Y. : Privacy-preserving distributed deep learning via lwe-based certificateless additively homomorphic encryption (cahe) . Journal of Information Security and Applications 74 , 103462 ( 2023 ) barticle

    2023

  2. [2]

    , Azzedin , F

    barticle Al-Hejri , I. , Azzedin , F. , Almuhammadi , S. , Eltoweissy , M. : Lightweight secure and scalable scheme for data transmission in the internet of things . Arabian Journal for Science and Engineering 49 ( 9 ), 12919 -- 12934 ( 2024 ) barticle

    2024

  3. [3]

    , Kantarcioglu , M

    barticle Alufaisan , Y. , Kantarcioglu , M. , Zhou , Y. : Robust transparency against model inversion attacks . IEEE transactions on dependable and secure computing 18 ( 5 ), 2061 -- 2073 ( 2020 ) barticle

    2020

  4. [4]

    : Ensembles of pruned deep neural networks for accurate and privacy preservation in iot applications

    botherref Alhalabi , B. : Ensembles of pruned deep neural networks for accurate and privacy preservation in iot applications. Phd thesis, Birmingham City University (2023). http://www.open-access.bcu.ac.uk/15070/ botherref

    2023

  5. [5]

    , Mahmood , K

    bchapter Ahmad , S. , Mahmood , K. , Fuller , B. : Inverting biometric models with fewer samples: Incorporating the output of multiple models . In: 2022 IEEE International Joint Conference on Biometrics (IJCB) , pp. 1 -- 11 . IEEE , Piscataway, USA ( 2022 ) bchapter

    2022

  6. [6]

    , Tao , G

    bchapter An , S. , Tao , G. , Xu , Q. , Liu , Y. , Shen , G. , Yao , Y. , Xu , J. , Zhang , X. : Mirror: Model inversion for deep learning network with high fidelity . In: Proceedings of the 29th Network and Distributed System Security Symposium ( 2022 ). https://par.nsf.gov/servlets/purl/10376663 bchapter

    work page arXiv 2022

  7. [7]

    , Nasrabadi , N.M

    bbook Bishop , C.M. , Nasrabadi , N.M. : Pattern Recognition and Machine Learning vol. 4 . Springer , Cham, Switzerland ( 2006 ). https://link.springer.com/book/9780387310732 bbook

    arXiv 2006

  8. [8]

    , Abrahamyan , L

    botherref Chen , Y. , Abrahamyan , L. , Sahli , H. , Deligiannis , N. : Learned model compression for efficient and privacy-preserving federated learning. Authorea Preprints (2024) botherref

    2024

Show all 196 references
  1. [9]

    , Hayes , J

    bchapter Carlini , N. , Hayes , J. , Nasr , M. , Jagielski , M. , Sehwag , V. , Tramer , F. , Balle , B. , Ippolito , D. , Wallace , E. : Extracting training data from diffusion models . In: 32nd USENIX Security Symposium (USENIX Security 23) , pp. 5253 -- 5270 ( 2023 ). https...

    2023

  2. [10]

    , Jia , R

    botherref Chen , S. , Jia , R. , Qi , G.-J. : Improved techniques for model inversion attacks. https://openreview.net/forum?id=unRf7cz1o1 (2020) botherref

    2020

  3. [11]

    , Kahla , M

    bchapter Chen , S. , Kahla , M. , Jia , R. , Qi , G.-J. : Knowledge-enriched distributional model inversion attacks . In: Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 16178 -- 16187 ( 2021 ). http://openaccess.thecvf.com/content/ICCV2021/html/C...

    2021

  4. [12]

    , Lent , H

    botherref Chen , Y. , Lent , H. , Bjerva , J. : Text embedding inversion attacks on multilingual language models. arXiv preprint arXiv:2401.12192 (2024) botherref

    2024 arXiv

  5. [13]

    , Meerza , S.I.A

    bchapter Cui , Y. , Meerza , S.I.A. , Li , Z. , Liu , L. , Zhang , J. , Liu , J. : Recup-fl: Reconciling utility and privacy in federated learning via user-configurable privacy defense . In: Proceedings of the ACM Asia Conference on Computer and Communications Security , pp. 8...

    2023

  6. [14]

    , Yang , M

    botherref Chu , T. , Yang , M. , Laoutaris , N. , Markopoulou , A. : Priprune: Quantifying and preserving privacy in pruned federated learning (arXiv:2310.19958) (2023). arXiv:2310.19958 botherref

    2023 arXiv

  7. [15]

    , Zhang , J

    botherref Chen , Y. , Zhang , J. , Bi , Y. , Hu , X. , Hu , T. , Xue , Z. , Yi , R. , Liu , Y. , Tai , Y. : Image inversion: A survey from gans to diffusion and beyond (arXiv:2502.11974) (2025) 10.48550/arXiv.2502.11974 . arXiv:2502.11974 [cs] botherref

    2025 doi arXiv

  8. [16]

    , Breuer , A

    botherref Dibbo , S.V. , Breuer , A. , Moore , J. , Teti , M. : Improving robustness to model inversion attacks via sparse coding architectures. European Conference on Computer Vision (ECCV 2024) (2024) botherref

    2024

  9. [17]

    , Dong , W

    bchapter Deng , J. , Dong , W. , Socher , R. , Li , L.-J. , Li , K. , Fei-Fei , L. : Imagenet: A large-scale hierarchical image database . In: 2009 IEEE Conference on Computer Vision and Pattern Recognition , pp. 248 -- 255 . Ieee , Piscataway, USA ( 2009 ). https://ieeexplore...

    2009

  10. [18]

    : Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap

    bchapter Dibbo , S.V. : Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap . In: 2023 IEEE 36th Computer Security Foundations Symposium (CSF) , pp. 439 -- 456 . IEEE , Piscataway, USA ( 2023 ). https://ieeexplore.ieee.org/abstract/document/10221914...

    2023

  11. [19]

    , Lu , L

    botherref Dai , C. , Lu , L. , Zhou , P. : Stealing training data from large language models in decentralized training through activation inversion attack (arXiv:2502.16086) (2025) 10.48550/arXiv.2502.16086 . arXiv:2502.16086 [cs] botherref

    2025 doi arXiv

  12. [20]

    , Nguyen , T.P

    botherref Dao , T.-N. , Nguyen , T.P. : Performance analysis of gradient inversion attack in federated learning with healthcare systems. REV Journal on Electronics and Communications 13(3–4) (2024) botherref

    2024

  13. [21]

    : The Concise Encyclopedia of Statistics

    bbook Dodge , Y. : The Concise Encyclopedia of Statistics . Springer , Cham, Switzerland ( 2008 ) bbook

    2008

  14. [22]

    , Zhang , L

    bchapter Ding , S. , Zhang , L. , Pan , M. , Yuan , X. : Patrol: Privacy-oriented pruning for collaborative inference against model inversion attacks . In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. 4716 -- 4725 ( 2024 ). https://ope...

    2024

  15. [23]

    , Chen , C

    botherref Fan , M. , Chen , C. , Wang , C. , Li , X. , Zhou , W. , Huang , J. : Refiner: Data refining against gradient leakage attacks in federated learning (arXiv:2212.02042) (2023). arXiv:2212.02042 botherref

    2023 arXiv

  16. [24]

    , Chen , B

    bchapter Fang , H. , Chen , B. , Wang , X. , Wang , Z. , Xia , S.-T. : Gifd: A generative gradient inversion method with feature domain optimization . In: Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 4967 -- 4976 ( 2023 ). http://openaccess.the...

    2023

  17. [25]

    , Jha , S

    bchapter Fredrikson , M. , Jha , S. , Ristenpart , T. : Model inversion attacks that exploit confidence information and basic countermeasures . In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pp. 1322 -- 1333 . ACM , Denver Colorado ...

    2015

  18. [26]

    , Liu , Y

    bchapter Fan , M. , Liu , Y. , Chen , C. , Wang , C. , Qiu , M. , Zhou , W. : Guardian: Guarding against gradient leakage with provable defense for federated learning . In: Proceedings of the 17th ACM International Conference on Web Search and Data Mining , pp. 190 -- 198 . AC...

    2024

  19. [27]

    , Lantz , E

    bchapter Fredrikson , M. , Lantz , E. , Jha , S. , Lin , S. , Page , D. , Ristenpart , T. : Privacy in pharmacogenetics: An End-to-End case study of personalized warfarin dosing . In: 23rd USENIX Security Symposium (USENIX Security 14) , pp. 17 -- 32 ( 2014 ). https://www.usen...

    2014

  20. [28]

    , Papaspyridis , K

    barticle Feretzakis , G. , Papaspyridis , K. , Gkoulalas-Divanis , A. , Verykios , V.S. : Privacy-preserving techniques in generative ai and large language models: A narrative review . Information 15 ( 11 ), 697 ( 2024 ) barticle

    2024

  21. [29]

    , Qiu , Y

    botherref Fang , H. , Qiu , Y. , Yu , H. , Yu , W. , Kong , J. , Chong , B. , Chen , B. , Wang , X. , Xia , S.-T. , Xu , K. : Privacy leakage on dnns: A survey of model inversion attacks and defenses. arXiv preprint arXiv:2402.04013 (2024) botherref

    2024 arXiv

  22. [30]

    , Bauermeister , H

    barticle Geiping , J. , Bauermeister , H. , Dröge , H. , Moeller , M. : Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems 33 , 16937 -- 16947 ( 2020 ) barticle

    2020

  23. [31]

    , Ezov , G

    botherref Goldsteen , A. , Ezov , G. , Farkash , A. : Reducing risk of model inversion using privacy-guided training. arXiv preprint arXiv:2006.15877 (2020) botherref

    2020 arXiv

  24. [32]

    , Guo , S

    bchapter Gao , W. , Guo , S. , Zhang , T. , Qiu , H. , Wen , Y. , Liu , Y. : Privacy-preserving collaborative learning with automatic transformation search . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 114 -- 123 ( 2021 ). http:/...

    2021

  25. [33]

    , Jiang , L

    barticle Gong , H. , Jiang , L. , Liu , X. , Wang , Y. , Gastro , O. , Wang , L. , Zhang , K. , Guo , Z. : Gradient leakage attacks in federated learning . Artificial Intelligence Review 56 ( S1 ), 1337 -- 1374 ( 2023 ) 10.1007/s10462-023-10550-z barticle

    2023 doi

  26. [34]

    , Karakolios , K

    bchapter Galloway , T. , Karakolios , K. , Ma , Z. , Perdisci , R. , Keromytis , A. , Antonakakis , M. : Practical attacks against dns reputation systems . In: 2024 IEEE Symposium on Security and Privacy (SP) , pp. 233 -- 233 . IEEE Computer Society , Piscataway, USA ( 2024 )....

    2024

  27. [35]

    : Deep learning

    botherref Goodfellow , I. : Deep learning. MIT press (2016) botherref

    2016

  28. [36]

    , Zeng , S

    botherref Guo , P. , Zeng , S. , Chen , W. , Zhang , X. , Ren , W. , Zhou , Y. , Qu , L. : A new federated learning framework against gradient inversion attacks (arXiv:2412.07187) (2024) 10.48550/arXiv.2412.07187 . arXiv:2412.07187 [cs] botherref

    2024 doi arXiv

  29. [37]

    , Zhang , X

    barticle Gao , W. , Zhang , X. , Guo , S. , Zhang , T. , Xiang , T. , Qiu , H. , Wen , Y. , Liu , Y. : Automatic transformation search against deep leakage from gradients . IEEE Transactions on Pattern Analysis and Machine Intelligence 45 ( 9 ), 10650 -- 10668 ( 2023 ) barticle

    2023

  30. [38]

    , Zhu , T

    botherref Gao , K. , Zhu , T. , Ye , D. , Zhou , W. : Defending against gradient inversion attacks in federated learning via statistical machine unlearning. Knowledge-Based Systems, 111983 (2024) botherref

    2024

  31. [39]

    , Choi , J

    bchapter Han , G. , Choi , J. , Lee , H. , Kim , J. : Reinforcement learning-based black-box model inversion attacks . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 20504 -- 20513 ( 2023 ). http://openaccess.thecvf.com/content/CVPR...

    2023

  32. [40]

    , Gupta , S

    barticle Huang , Y. , Gupta , S. , Song , Z. , Li , K. , Arora , S. : Evaluating gradient inversion attacks and defenses in federated learning . Advances in neural information processing systems 34 , 7232 -- 7241 ( 2021 ) barticle

    2021

  33. [41]

    , Hao , K.J

    bchapter Ho , S.-T. , Hao , K.J. , Chandrasegaran , K. , Nguyen , N.-B. , Cheung , N.-M. : Model inversion robustness: Can transfer learning help? In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 12183 -- 12193 ( 2024 ). https://opena...

    2024

  34. [42]

    , Hong , C

    botherref Huang , J. , Hong , C. , Chen , L.Y. , Roos , S. : Gradient inversion of federated diffusion models (arXiv:2405.20380) (2024) 10.48550/arXiv.2405.20380 . arXiv:2405.20380 [cs] botherref

    2024 doi arXiv

  35. [43]

    , Mattar , M

    bchapter Huang , G.B. , Mattar , M. , Berg , T. , Learned-Miller , E. : Labeled faces in the wild: A database forstudying face recognition in unconstrained environments . In: Workshop on Faces in’Real-Life’Images: Detection, Alignment, and Recognition ( 2008 ). https://inria.h...

    2008

  36. [44]

    , Meng , G

    barticle He , Y. , Meng , G. , Chen , K. , Hu , X. , He , J. : Towards security threats of deep learning systems: A survey . IEEE Transactions on Software Engineering 48 ( 5 ), 1743 -- 1770 ( 2020 ) barticle

    2020

  37. [45]

    , Ramsauer , H

    botherref Heusel , M. , Ramsauer , H. , Unterthiner , T. , Nessler , B. , Hochreiter , S. : Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems 30 (2017) botherref

    2017

  38. [46]

    : Models as personal data

    botherref Hung , J. : Models as personal data. Available at SSRN 4504856 (2023) botherref

    2023

  39. [47]

    , Wang , S

    bchapter Hu , H. , Wang , S. , Dong , T. , Xue , M. : Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning . In: 2024 IEEE Symposium on Security and Privacy (SP) , pp. 262 -- 262 . IEEE , Piscataway, USA ( 2024 ). https://www.computer.org/csd...

    2024

  40. [48]

    , Wang , Y

    botherref Huang , Y. , Wang , Y. , Li , J. , Yang , L. , Song , K. , Wang , L. : Adaptive hybrid masking strategy for privacy-preserving face recognition against model inversion attack. arXiv preprint arXiv:2403.10558 (2024) botherref

    2024 arXiv

  41. [49]

    , Yin , H

    barticle Hatamizadeh , A. , Yin , H. , Molchanov , P. , Myronenko , A. , Li , W. , Dogra , P. , Feng , A. , Flores , M.G. , Kautz , J. , Xu , D. , : Do gradient inversion attacks make federated learning unsafe? IEEE Transactions on Medical Imaging 42 ( 7 ), 2044 -- 2056 ( 2023...

    2023

  42. [50]

    , Moustafa , N

    botherref Issa , W. , Moustafa , N. , Turnbull , B. , Choo , K.-K.R. : Rve-pfl: Robust variational encoder-based personalised federated learning against model inversion attacks. IEEE Transactions on Information Forensics and Security (2024) botherref

    2024

  43. [51]

    , Lyu , H

    botherref Jang , J. , Lyu , H. , Yang , H.J. : Patch-mi: Enhancing model inversion attacks via patch-based reconstruction. arXiv preprint arXiv:2312.07040 (2023) botherref

    2023 arXiv

  44. [52]

    , Wang , S

    barticle Jiang , Y. , Wang , S. , Valls , V. , Ko , B.J. , Lee , W.-H. , Leung , K.K. , Tassiulas , L. : Model pruning enables efficient federated learning on edge devices . IEEE Transactions on Neural Networks and Learning Systems 34 ( 12 ), 10374 -- 10386 ( 2022 ) barticle

    2022

  45. [53]

    : A style-based generator architecture for generative adversarial networks

    botherref Karras , T. : A style-based generator architecture for generative adversarial networks. arXiv preprint arXiv:1812.04948 (2019) botherref

    2019 arXiv

  46. [54]

    , Chen , S

    bchapter Kahla , M. , Chen , S. , Just , H.A. , Jia , R. : Label-only model inversion attacks via boundary repulsion . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 15045 -- 15053 ( 2022 ). http://openaccess.thecvf.com/content/CVPR...

    2022

  47. [55]

    , Finke , D

    bchapter Krall , A. , Finke , D. , Yang , H. : Gradient mechanism to preserve differential privacy and deter against model inversion attacks in healthcare analytics . In: 2020 42nd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC) , p...

    2020

  48. [56]

    , Hinton , G

    botherref Krizhevsky , A. , Hinton , G. : Learning multiple layers of features from tiny images (2009) botherref

    2009

  49. [57]

    , Nair , V

    barticle Krizhevsky , A. , Nair , V. , Hinton , G. : Cifar-10 (canadian institute for advanced research) . URL http://www. cs. toronto. edu/kriz/cifar. html 5 ( 4 ), 1 ( 2010 ) barticle

    2010

  50. [58]

    , Nakamura , K

    barticle Khosravy , M. , Nakamura , K. , Hirose , Y. , Nitta , N. , Babaguchi , N. : Model inversion attack: analysis under gray-box scenario on deep learning based face recognition system . KSII Transactions on Internet and Information Systems (TIIS) 15 ( 3 ), 1100 -- 1118 ( ...

    2021

  51. [59]

    , Nakamura , K

    barticle Khosravy , M. , Nakamura , K. , Hirose , Y. , Nitta , N. , Babaguchi , N. : Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from a face recognition system . IEEE Transactions on Information Forensics and Security 17 ,...

    2022

  52. [60]

    , Ziller , A

    barticle Kaissis , G. , Ziller , A. , Passerat-Palmbach , J. , Ryffel , T. , Usynin , D. , Trask , A. , Lima Jr , I. , Mancuso , J. , Jungmann , F. , Steinborn , M.-M. : End-to-end privacy preserving deep learning on multi-institutional medical imaging . Nature Machine Intelli...

    2021

  53. [61]

    , Chen , Y

    botherref Li , H. , Chen , Y. , Luo , J. , Wang , J. , Peng , H. , Kang , Y. , Zhang , X. , Hu , Q. , Chan , C. , Xu , Z. , Hooi , B. , Song , Y. : Privacy in large language models: Attacks, defenses and future directions (arXiv:2310.10383) (2024) 10.48550/arXiv.2310.10383 . a...

    2024 doi arXiv

  54. [62]

    , Dong , L

    barticle Lin , W. , Dong , L. , Xue , P. : Visual distortion gauge based on discrimination of noticeable contrast changes . IEEE transactions on circuits and systems for video technology 15 ( 7 ), 900 -- 909 ( 2005 ) barticle

    2005

  55. [63]

    : The mnist database of handwritten digits

    botherref LeCun , Y. : The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/ (1998) botherref

    1998

  56. [64]

    , Han , S

    bchapter Lin , Y. , Han , S. , Mao , H. , Wang , Y. , Dally , B. : Deep gradient compression: Reducing the communication bandwidth for distributed training . In: International Conference on Learning Representations ( 2018 ). https://openreview.net/forum?id=SkhQHMW0W bchapter

    2018

  57. [65]

    , Hao , Y

    barticle Li , O. , Hao , Y. , Wang , Z. , Zhu , B. , Wang , S. , Zhang , Z. , Feng , F. : Model inversion attacks through target-specific conditional diffusion models . http://arxiv.org/abs/2407.11424 ( arXiv:2407.11424 ) ( 2024 ) 10.48550/arXiv.2407.11424 . arXiv:2407.11424 [...

    2024 doi arXiv

  58. [66]

    , Li , B

    barticle Liu , H. , Li , B. , Gao , C. , Xie , P. , Zhao , C. : Privacy-encoded federated learning against gradient-based data reconstruction attacks . IEEE Transactions on Information Forensics and Security 18 , 5860 -- 5875 ( 2023 ) barticle

    2023

  59. [67]

    , Luo , P

    bchapter Liu , Z. , Luo , P. , Wang , X. , Tang , X. : Deep learning face attributes in the wild . In: Proceedings of the IEEE International Conference on Computer Vision , pp. 3730 -- 3738 ( 2015 ). http://openaccess.thecvf.com/content_iccv_2015/html/Liu_Deep_Learning_Face_IC...

    2015

  60. [68]

    , Li , Y

    botherref Liang , H. , Li , Y. , Zhang , C. , Liu , X. , Zhu , L. : Egia: An external gradient inversion attack in federated learning. IEEE Transactions on Information Forensics and Security (2023) botherref

    2023

  61. [69]

    , Rakin , A.S

    bchapter Li , J. , Rakin , A.S. , Chen , X. , He , Z. , Fan , D. , Chakrabarti , C. : Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2022

  62. [70]

    , Shen , Y.-C

    bchapter Liu , Y.-H. , Shen , Y.-C. , Chen , H.-W. , Chen , M.-S. : Construct a secure cnn against gradient inversion attack . In: Pacific-Asia Conference on Knowledge Discovery and Data Mining , pp. 250 -- 261 . Springer , Cham, Switzerland ( 2024 ) bchapter

    2024

  63. [71]

    , Wang , Z

    botherref Liu , S. , Wang , Z. , Lei , Q. : Data reconstruction attacks and defenses: A systematic evaluation. arXiv preprint arXiv:2402.09478 (2024) botherref

    2024 arXiv

  64. [72]

    , Wang , D

    botherref Liu , R. , Wang , D. , Ren , Y. , Wang , Z. , Guo , K. , Qin , Q. , Liu , X. : Unstoppable attack: Label-only model inversion via conditional diffusion model. IEEE Transactions on Information Forensics and Security (2024) botherref

    2024

  65. [73]

    , Xue , L

    bchapter Lu , J. , Xue , L. , Wan , W. , Li , M. , Zhang , L.Y. , Hu , S. : Preserving privacy of input features across all stages of collaborative learning . In: 2023 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainabl...

    2023

  66. [74]

    , Yu , P

    botherref Li , W. , Yu , P. , Cheng , Y. , Yan , J. , Zhang , Z. : Efficient and privacy-enhanced federated learning based on parameter degradation. IEEE Transactions on Services Computing, 1--16 (2024) 10.1109/TSC.2024.3399659 botherref

    2024

  67. [75]

    , Yao , H

    botherref Liu , T. , Yao , H. , Wu , T. , Qin , Z. , Lin , F. , Ren , K. , Chen , C. : Mitigating privacy risks in llm embeddings from embedding inversion (arXiv:2411.05034) (2024) 10.48550/arXiv.2411.05034 botherref

    2024 doi

  68. [76]

    , Zhu , C

    barticle Luo , Z. , Zhu , C. , Fang , L. , Kou , G. , Hou , R. , Wang , X. : An effective and practical gradient inversion attack . International Journal of Intelligent Systems 37 ( 11 ), 9373 -- 9389 ( 2022 ) barticle

    2022

  69. [77]

    , Zhang , J

    bchapter Li , Z. , Zhang , J. , Liu , L. , Liu , J. : Auditing privacy defenses in federated learning via generative gradient leakage . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 10132 -- 10142 ( 2022 ). http://openaccess.thecvf...

    2022

  70. [78]

    , Abolhasan , M

    botherref Makhdoom , I. , Abolhasan , M. , Lipman , J. , Shariati , N. , Franklin , D. , Piccardi , M. : Securing personally identifiable information: A survey of sota techniques, and a way forward. IEEE Access (2024) botherref

    2024

  71. [79]

    , Cortez , P

    barticle Moro , S. , Cortez , P. , Rita , P. : A data-driven approach to predict the success of bank telemarketing . Decision Support Systems 62 , 22 -- 31 ( 2014 ) barticle

    2014

  72. [80]

    : Threat models to machine unlearning (2024) botherref

    botherref Milner , L. : Threat models to machine unlearning (2024) botherref

    2024

  73. [81]

    , Kiya , H

    botherref MaungMaung , A. , Kiya , H. : Generative model-based attack on learnable image encryption for privacy-preserving deep learning (arXiv:2303.05036) (2023) 10.48550/arXiv.2303.05036 botherref

    2023 doi arXiv

  74. [82]

    , Kita , K

    bchapter Masuda , H. , Kita , K. , Koizumi , Y. , Takemasa , J. , Hasegawa , T. : Model fragmentation, shuffle and aggregation to mitigate model inversion in federated learning . In: 2021 IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN) , pp. 1 -- ...

    2021

  75. [83]

    , Song , C

    bchapter Melis , L. , Song , C. , De Cristofaro , E. , Shmatikov , V. : Exploiting unintended feature leakage in collaborative learning . In: 2019 IEEE Symposium on Security and Privacy (SP) , pp. 691 -- 706 . IEEE , Piscataway, USA ( 2019 ). https://ieeexplore.ieee.org/abstra...

    2019

  76. [84]

    , Tanaka , M

    barticle Madono , K. , Tanaka , M. , Onishi , M. , Ogawa , T. : Sia-gan: Scrambling inversion attack using generative adversarial network . IEEE Access 9 , 129385 -- 129393 ( 2021 ) barticle

    2021

  77. [85]

    , Zhao , W

    botherref Morris , J.X. , Zhao , W. , Chiu , J.T. , Shmatikov , V. , Rush , A.M. : Language model inversion (arXiv:2311.13647) (2023) 10.48550/arXiv.2311.13647 . arXiv:2311.13647 [cs] botherref

    2023 doi arXiv

  78. [86]

    , Chandrasegaran , K

    bchapter Nguyen , N.-B. , Chandrasegaran , K. , Abdollahzadeh , M. , Cheung , N.-M. : Re-thinking model inversion attacks against deep neural networks . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 16384 -- 16393 ( 2023 ) bchapter

    2023

  79. [87]

    , Chandrasegaran , K

    botherref Nguyen , B.-N. , Chandrasegaran , K. , Abdollahzadeh , M. , Cheung , N.-M.M. : Label-only model inversion attacks via knowledge transfer. Advances in Neural Information Processing Systems 36 (2024) botherref

    2024

  80. [88]

    : Enhancing data privacy in artificial intelligence (2024) botherref

    botherref Nguyen , K. : Enhancing data privacy in artificial intelligence (2024) botherref

    2024

  81. [89]

    , Wang , T

    bchapter Netzer , Y. , Wang , T. , Coates , A. , Bissacco , A. , Wu , B. , Ng , A.Y. : Reading digits in natural images with unsupervised feature learning . In: NIPS Workshop on Deep Learning and Unsupervised Feature Learning , vol. 2011 , p. 4 . Granada , London, UK ( 2011 )....

    2011

  82. [90]

    , Wang , X

    bchapter Niu , B. , Wang , X. , Zhang , L. , Guo , S. , Cao , J. , Li , F. : A sensitivity-aware and block-wise pruning method for privacy-preserving federated learning . In: GLOBECOM 2023-2023 IEEE Global Communications Conference , pp. 4259 -- 4264 . IEEE , Piscataway, USA (...

    2023

  83. [91]

    , Yang , W

    barticle Nguyen , T.P.V. , Yang , W. , Tang , Z. , Xia , X. , Mullens , A.B. , Dean , J.A. , Li , Y. : Lightweight federated learning for stis/hiv prediction . Scientific Reports 14 ( 1 ), 6560 ( 2024 ) barticle

    2024

  84. [92]

    , Zhang , B

    bchapter Noorbakhsh , S.L. , Zhang , B. , Hong , Y. , Wang , B. : Inf2Guard : An Information-Theoretic framework for learning Privacy-Preserving representations against inference attacks . In: 33rd USENIX Security Symposium (USENIX Security 24) , pp. 2405 -- 2422 ( 2024 ). htt...

    2024

  85. [93]

    , Dey , E

    bchapter Ovi , P.R. , Dey , E. , Roy , N. , Gangopadhyay , A. : Mixed quantization enabled federated learning to tackle gradient inversion attacks . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 5046 -- 5054 ( 2023 ) bchapter

    2023

  86. [94]

    , Boenisch , F

    botherref Pizzi , K. , Boenisch , F. , Sahin , U. , Böttinger , K. : Introducing model inversion attacks on automatic speaker recognition. arXiv preprint arXiv:2301.03206 (2023) botherref

    2023 arXiv

  87. [95]

    , Chen , Y

    bchapter Pang , S. , Chen , Y. , Deng , J. , Wu , J. , Bai , Y. , Xu , W. : Adversarial for good–defending training data privacy with adversarial attack wisdom . In: 2024 IEEE International Conference on Metaverse Computing, Networking, and Applications (MetaCom) , pp. 190 -- ...

    2024

  88. [96]

    , Dimitrov , D.I

    botherref Petrov , I. , Dimitrov , D.I. , Baader , M. , Müller , M.N. , Vechev , M. : Dager: Exact gradient inversion for large language models. arXiv preprint arXiv:2405.15586 (2024) botherref

    2024 arXiv

  89. [97]

    , Ding , J

    bchapter Prakash , P. , Ding , J. , Li , H. , Errapotu , S.M. , Pei , Q. , Pan , M. : Privacy preserving facial recognition against model inversion attacks . In: GLOBECOM 2020-2020 IEEE Global Communications Conference , pp. 1 -- 6 . IEEE , Piscataway, USA ( 2020 ) bchapter

    2020

  90. [98]

    , Li , Y

    barticle Pei , W. , Li , Y. , Siuly , S. , Wen , P. : A hybrid deep learning scheme for multi-channel sleep stage classification . Computers, Materials and Continua 71 ( 1 ), 889 -- 905 ( 2022 ) barticle

    2022

  91. [99]

    , Liu , F

    bchapter Peng , X. , Liu , F. , Zhang , J. , Lan , L. , Ye , J. , Liu , T. , Han , B. : Bilateral dependency optimization: Defending against model-inversion attacks . In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pp. 1358 -- 1367 . ...

    2022

  92. [100]

    , Satsangi , Y

    bbook Papadopoulos , G. , Satsangi , Y. , Eloul , S. , Pistoia , M. : In: Goharian , N. , Tonellotto , N. , He , Y. , Lipani , A. , McDonald , G. , Macdonald , C. , Ounis , I. (eds.) Absolute Variation Distance: An Inversion Attack Evaluation Metric for Federated Learning . Le...

    2024 doi

  93. [101]

    , Wiratunga , N

    bchapter Palihawadana , C. , Wiratunga , N. , Kalutarage , H. , Wijekoon , A. : Mitigating gradient inversion attacks in federated learning with frequency transformation . In: European Symposium on Research in Computer Security , pp. 750 -- 760 . Springer , Cham, Switzerland (...

    2023

  94. [102]

    , Yi , J

    bchapter Pengcheng , L. , Yi , J. , Zhang , L. : Query-efficient black-box attack by active learning . In: 2018 IEEE International Conference on Data Mining (ICDM) , pp. 1200 -- 1205 . IEEE , Piscataway, USA ( 2018 ). https://ieeexplore.ieee.org/abstract/document/8594968/ bchapter

    2018

  95. [103]

    , Zhang , M

    bchapter Pan , X. , Zhang , M. , Ji , S. , Yang , M. : Privacy risks of general-purpose language models . In: 2020 IEEE Symposium on Security and Privacy (SP) , pp. 1314 -- 1331 . IEEE , Piscataway, USA ( 2020 ) bchapter

    2020

  96. [104]

    , Chen , Y

    bchapter Qi , G. , Chen , Y. , Mao , X. , Hui , B. , Li , X. , Zhang , R. , Xue , H. : Model inversion attack via dynamic memory learning . In: Proceedings of the 31st ACM International Conference on Multimedia , pp. 5614 -- 5622 ( 2023 ) bchapter

    2023

  97. [105]

    , Fang , H

    bchapter Qiu , Y. , Fang , H. , Yu , H. , Chen , B. , Qiu , M. , Xia , S.-T. : A closer look at gan priors: Exploiting intermediate features for enhanced model inversion attacks . In: ECCV 2024 ( 2024 ). https://www.ecva.net/papers/eccv_2024/papers_ECCV/papers/04642.pdf bchapter

    2024

  98. [106]

    , Wang , H

    bchapter Qi , T. , Wang , H. , Huang , Y. : Towards the robustness of differentially private federated learning . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38 , pp. 19911 -- 19919 ( 2024 ). https://ojs.aaai.org/index.php/AAAI/article/view/29967 bchapter

    2024

  99. [107]

    , Yu , H

    botherref Qiu , Y. , Yu , H. , Fang , H. , Yu , W. , Chen , B. , Wang , X. , Xia , S.-T. , Xu , K. : Mibench: A comprehensive benchmark for model inversion attack and defense (arXiv:2410.05159) (2024) 10.48550/arXiv.2410.05159 . arXiv:2410.05159 [cs] botherref

    2024 doi arXiv

  100. [108]

    , Zhang , X

    botherref Qiu , P. , Zhang , X. , Ji , S. , Fu , C. , Yang , X. , Wang , T. : Hashvfl: Defending against data reconstruction attacks in vertical federated learning. IEEE Transactions on Information Forensics and Security (2024) botherref

    2024

  101. [109]

    , Deng , J

    botherref Ren , H. , Deng , J. , Xie , X. , Ma , X. , Ma , J. : Gradient leakage defense with key-lock module for federated learning (arXiv:2305.04095) (2023). arXiv:2305.04095 [cs] botherref

    2023 arXiv

  102. [110]

    , Garcia , S

    barticle Rigaki , M. , Garcia , S. : A survey of privacy attacks in machine learning . ACM Computing Surveys 56 ( 4 ), 1 -- 34 ( 2023 ) barticle

    2023

  103. [111]

    , Li , T

    barticle Ra , J.S. , Li , T. , Li , Y. : A novel spectral entropy-based index for assessing the depth of anaesthesia . Brain Informatics 8 ( 1 ), 10 ( 2021 ) 10.1186/s40708-021-00130-8 barticle

    2021 doi

  104. [112]

    , Boyapati , M

    barticle Shin , S. , Boyapati , M. , Suo , K. , Kang , K. , Son , J. : An empirical analysis of image augmentation against model inversion attack in federated learning . Cluster Computing 26 ( 1 ), 349 -- 366 ( 2023 ) barticle

    2023

  105. [113]

    , Wolf , P.-P

    bchapter Slokom , M. , Wolf , P.-P. , Larson , M. : Exploring privacy-preserving techniques on synthetic data as a defense against model inversion attacks . In: International Conference on Information Security , pp. 3 -- 23 . Springer , Cham, Switzerland ( 2023 ) bchapter

    2023

  106. [114]

    , Hintersdorf , D

    botherref Struppek , L. , Hintersdorf , D. , Correia , A.D.A. , Adler , A. , Kersting , K. : Plug & play attacks: Towards robust and flexible model inversion attacks (arXiv:2201.12179) (2022). arXiv:2201.12179 botherref

    2022 arXiv

  107. [115]

    , Hintersdorf , D

    botherref Struppek , L. , Hintersdorf , D. , Kersting , K. : Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks. arXiv preprint arXiv:2310.06549 (2023) botherref

    2023 arXiv

  108. [116]

    , Kotevska , O

    botherref Shi , Y. , Kotevska , O. , Reshniak , V. , Singh , A. , Raskar , R. : Dealing doubt: Unveiling threat models in gradient inversion attacks under federated learning, a survey and taxonomy. arXiv preprint arXiv:2405.10376 (2024) botherref

    2024 arXiv

  109. [117]

    , Li , S

    botherref Shu , Y. , Li , S. , Dong , T. , Meng , Y. , Zhu , H. : Model inversion in split learning for personalized llms: New insights from information bottleneck theory (arXiv:2501.05965) (2025) 10.48550/arXiv.2501.05965 . arXiv:2501.05965 [cs] botherref

    2025 doi arXiv

  110. [118]

    , Li , A

    bchapter Sun , J. , Li , A. , Wang , B. , Yang , H. , Li , H. , Chen , Y. : Soteria: Provable defense against privacy leakage in federated learning from representation perspective . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 931...

    2021

  111. [119]

    , Mäder , P

    bchapter Scheliga , D. , Mäder , P. , Seeland , M. : Precode-a generic model extension to prevent deep gradient leakage . In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. 1849 -- 1858 ( 2022 ). http://openaccess.thecvf.com/content/WACV...

    2022

  112. [120]

    , Mäder , P

    bchapter Scheliga , D. , Mäder , P. , Seeland , M. : Dropout is not all you need to prevent gradient leakage . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37 , pp. 9733 -- 9741 ( 2023 ). https://ojs.aaai.org/index.php/AAAI/article/view/26163 bchapter

    2023

  113. [121]

    , Sharma , P.K

    botherref Singh , S. , Sharma , P.K. , Moon , S.Y. , Park , J.H. : Advanced lightweight encryption algorithms for iot devices: survey, challenges and solutions. Journal of Ambient Intelligence and Humanized Computing, 1--18 (2024) botherref

    2024

  114. [122]

    , Stronati , M

    bchapter Shokri , R. , Stronati , M. , Song , C. , Shmatikov , V. : Membership inference attacks against machine learning models . In: 2017 IEEE Symposium on Security and Privacy (SP) , pp. 3 -- 18 . IEEE , Piscataway, USA ( 2017 ). https://ieeexplore.ieee.org/abstract/documen...

    2017

  115. [123]

    , Waghela , H

    botherref Sen , J. , Waghela , H. , Rakshit , S. : Privacy in federated learning. arXiv preprint arXiv:2408.08904 (2024) botherref

    2024 arXiv

  116. [124]

    , Cui , L

    botherref Tian , Z. , Cui , L. , Zhang , C. , Tan , S. , Yu , S. , Tian , Y. : The role of class information in model inversion attacks against image deep learning classifiers. IEEE Transactions on Dependable and Secure Computing (2023) botherref

    2023

  117. [125]

    : Assessing the viability of privacy, ethics, and utility in machine learning experiments via analysis of structured data

    botherref Thapa , B. : Assessing the viability of privacy, ethics, and utility in machine learning experiments via analysis of structured data. Phd thesis, Marymount University (2024) botherref

    2024

  118. [126]

    , Hall , A.J

    botherref Titcombe , T. , Hall , A.J. , Papadopoulos , P. , Romanini , D. : Practical defences against model inversion attacks for split neural networks (arXiv:2104.05743) (2021). arXiv:2104.05743 [cs] botherref

    2021 arXiv

  119. [127]

    , Nguyen , N.-B

    barticle Tran , V.-H. , Nguyen , N.-B. , Mai , S.T. , Vandierendonck , H. , Cheung , N.-m. : Defending against model inversion attacks via random erasing . http://arxiv.org/abs/2409.01062 ( arXiv:2409.01062 ) ( 2024 ) 10.48550/arXiv.2409.01062 . arXiv:2409.01062 [cs] barticle

    2024 doi arXiv

  120. [128]

    , Rosendahl , C

    barticle Tschandl , P. , Rosendahl , C. , Kittler , H. : The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions . Scientific data 5 ( 1 ), 1 -- 9 ( 2018 ) barticle

    2018

  121. [129]

    , Van Nguyen , T.P

    barticle Tang , Z. , Van Nguyen , T.P. , Yang , W. , Xia , X. , Chen , H. , Mullens , A.B. , Dean , J.A. , Osborne , S.R. , Li , Y. : High security and privacy protection model for sti/hiv risk prediction . DIGITAL HEALTH 10 , 20552076241298425 ( 2024 ) 10.1177/205520762412984...

    2024 doi

  122. [130]

    , Manickam , S

    barticle Ullah , H. , Manickam , S. , Obaidat , M. , Laghari , S.U.A. , Uddin , M. : Exploring the potential of metaverse technology in healthcare: Applications, challenges, and future directions . IEEE Access 11 , 69686 -- 69707 ( 2023 ) barticle

    2023

  123. [131]

    , Balunović , M

    bchapter Vero , M. , Balunović , M. , Dimitrov , D.I. , Vechev , M. : Tableak: tabular data leakage in federated learning . In: Proceedings of the 40th International Conference on Machine Learning . ICML’23 , vol. 202 , pp. 35051 -- 35083 . JMLR.org , Honolulu, Hawaii, USA ( 2...

    2023

  124. [132]

    , Binns , R

    barticle Veale , M. , Binns , R. , Edwards , L. : Algorithms that remember: model inversion attacks and data protection law . Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences 376 ( 2133 ), 20180083 ( 2018 ) 10.1098/rsta.2018.00...

    2018

  125. [133]

    , Scaman , K

    botherref Virmaux , A. , Scaman , K. : Lipschitz regularity of deep neural networks: analysis and efficient estimation. Advances in Neural Information Processing Systems 31 (2018) botherref

    2018

  126. [134]

    , Bai , J

    bchapter Wu , D. , Bai , J. , Song , Y. , Chen , J. , Zhou , W. , Xiang , Y. , Sajjanhar , A. : Fedinverse: Evaluating privacy leakage in federated learning . In: The Twelfth International Conference on Learning Representations ( 2024 ). https://openreview.net/forum?id=nTNgkEI...

    2024

  127. [135]

    , Bovik , A.C

    barticle Wang , Z. , Bovik , A.C. , Sheikh , H.R. , Simoncelli , E.P. : Image quality assessment: from error visibility to structural similarity . IEEE transactions on image processing 13 ( 4 ), 600 -- 612 ( 2004 ) barticle

    2004

  128. [136]

    , Chen , X

    bchapter Wu , R. , Chen , X. , Guo , C. , Weinberger , K.Q. : Learning to invert: Simple adaptive attacks for gradient inversion in federated learning . In: Uncertainty in Artificial Intelligence , pp. 2293 -- 2303 . PMLR , USA ( 2023 ) bchapter

    2023

  129. [137]

    , Du , H

    bchapter Wan , G. , Du , H. , Yuan , X. , Yang , J. , Chen , M. , Xu , J. : Enhancing privacy preservation in federated learning via learning rate perturbation . In: Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 4772 -- 4781 ( 2023 ). http://ope...

    2023

  130. [138]

    , Fu , Y

    barticle Wang , K.-C. , Fu , Y. , Li , K. , Khisti , A. , Zemel , R. , Makhzani , A. : Variational model inversion attacks . Advances in Neural Information Processing Systems 34 , 9706 -- 9719 ( 2021 ) barticle

    2021

  131. [139]

    , Guo , S

    botherref Wang , Y. , Guo , S. , Deng , Y. , Zhang , H. , Fang , Y. : Privacy-preserving task-oriented semantic communications against model inversion attacks. IEEE Transactions on Wireless Communications (2024) botherref

    2024

  132. [140]

    , Guo , S

    bchapter Wang , J. , Guo , S. , Xie , X. , Qi , H. : Protect privacy from gradient leakage attack in federated learning . In: IEEE INFOCOM 2022-IEEE Conference on Computer Communications , pp. 580 -- 589 . IEEE , Piscataway, USA ( 2022 ). https://ieeexplore.ieee.org/abstract/d...

    2022

  133. [141]

    , Hugh , E

    botherref Wang , F. , Hugh , E. , Li , B. : More than enough is too much: Adaptive defenses against gradient leakage in production federated learning. IEEE/ACM Transactions on Networking (2024) botherref

    2024

  134. [142]

    , Hayat , M

    bchapter Wu , J. , Hayat , M. , Zhou , M. , Harandi , M. : Concealing sensitive samples against gradient leakage in federated learning . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38 , pp. 21717 -- 21725 ( 2024 ). https://ojs.aaai.org/index.php/AA...

    2024

  135. [143]

    , Ji , Z

    botherref Wang , S. , Ji , Z. , Xiang , L. , Zhang , H. , Wang , X. , Zhou , C. , Li , B. : Crafter: Facial feature crafting against inversion-based identity theft on deep models. arXiv preprint arXiv:2401.07205 (2024) botherref

    2024 arXiv

  136. [144]

    , Kurz , D

    bchapter Wang , Q. , Kurz , D. : Reconstructing training data from diverse ml models by ensemble inversion . In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. 2909 -- 2917 ( 2022 ) bchapter

    2022

  137. [145]

    , Lee , J

    bchapter Wang , Z. , Lee , J. , Lei , Q. : Reconstructing training data from model gradient, provably . In: International Conference on Artificial Intelligence and Statistics , pp. 6595 -- 6612 . PMLR , USA ( 2023 ). https://proceedings.mlr.press/v206/wang23g.html bchapter

    2023

  138. [146]

    , Liu , Z

    barticle Wu , L. , Liu , Z. , Pu , B. , Wei , K. , Cao , H. , Yao , S. : Dggi: Deep generative gradient inversion with diffusion model . Information Fusion 113 , 102620 ( 2025 ) barticle

    2025

  139. [147]

    , Li , Y

    bbook Wei , S. , Li , Y. , Yang , W. : In: Li , Y. , Huang , Z. , Sharma , M. , Chen , L. , Zhou , R. (eds.) An Adaptive Feature Fusion Network for Alzheimer’s Disease Prediction . Lecture Notes in Computer Science , vol. 14305 , pp. 271 -- 282 . Springer , Singapore ( 2023 )....

    2023 doi

  140. [148]

    , Peng , Y

    bchapter Wang , X. , Peng , Y. , Lu , L. , Lu , Z. , Bagheri , M. , Summers , R.M. : Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases . In: Proceedings of the IEEE Conference on Compu...

    2017

  141. [149]

    , Simoncelli , E.P

    bchapter Wang , Z. , Simoncelli , E.P. , Bovik , A.C. : Multiscale structural similarity for image quality assessment . In: The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003 , vol. 2 , pp. 1398 -- 1402 . Ieee , Piscataway, USA ( 2003 ). https://ieeex...

    2003

  142. [150]

    , Si , C

    bchapter Wang , Y. , Si , C. , Wu , X. : Regression model fitting under differential privacy and model inversion attack . In: Twenty-fourth International Joint Conference on Artificial Intelligence ( 2015 ). https://www.ijcai.org/Proceedings/15/Papers/146.pdf bchapter

    2015

  143. [151]

    , Xu , H

    botherref Wan , Y. , Xu , H. , Liu , X. , Ren , J. , Fan , W. , Tang , J. : Defense against gradient leakage attacks via learning to obscure data (arXiv:2206.00769) (2022). arXiv:2206.00769 botherref

    2022 arXiv

  144. [152]

    , Yiu , S.-M

    bchapter Wen , J. , Yiu , S.-M. , Hui , L.C. : Defending against model inversion attack by adversarial examples . In: 2021 IEEE International Conference on Cyber Security and Resilience (CSR) , pp. 551 -- 556 . IEEE , Piscataway, USA ( 2021 ). https://ieeexplore.ieee.org/abstr...

    2021

  145. [153]

    , Zhang , Y

    bchapter Wang , T. , Zhang , Y. , Jia , R. : Improving robustness to model inversion attacks via mutual information regularization . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35 , pp. 11666 -- 11673 ( 2021 ) bchapter

    2021

  146. [154]

    , Hong , C

    bchapter Xu , J. , Hong , C. , Huang , J. , Chen , L.Y. , Decouchant , J. : Agic: Approximate gradient inversion attack on federated learning . In: 2022 41st International Symposium on Reliable Distributed Systems (SRDS) , pp. 12 -- 22 . IEEE , Piscataway, USA ( 2022 ) bchapter

    2022

  147. [155]

    , Hu , S

    bchapter Xue , L. , Hu , S. , Zhao , R. , Zhang , L.Y. , Hu , S. , Sun , L. , Yao , D. : Revisiting gradient pruning: A dual realization for defending against gradient attacks . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38 , pp. 6404 -- 6412 ( 20...

    2024

  148. [156]

    , Li , J

    bbook Xiao , D. , Li , J. , Li , M. : In: Luo , B. , Cheng , L. , Wu , Z.-G. , Li , H. , Li , C. (eds.) Privacy-Preserving Federated Compressed Learning Against Data Reconstruction Attacks Based on Secure Data . Communications in Computer and Information Science , vol. 1969 , ...

    1969 doi

  149. [157]

    , Rasul , K

    botherref Xiao , H. , Rasul , K. , Vollgraf , R. : Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms (arXiv:1708.07747) (2017) 10.48550/arXiv.1708.07747 . arXiv:1708.07747 [cs] botherref

    2017 doi arXiv

  150. [158]

    , Zhang , S

    bchapter Xu , Y. , Zhang , S. , Ding , Y. , Wang , Z. : Secure distributed machine learning client selection algorithm based on privacy leakage weight . In: 2024 5th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT) , pp. 790 -- 79...

    2024

  151. [159]

    , Chen , K

    bchapter Yuan , X. , Chen , K. , Zhang , J. , Zhang , W. , Yu , N. , Zhang , Y. : Pseudo label-guided model inversion attack via conditional generative adversarial network . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37 , pp. 3349 -- 3357 ( 2023 )...

    2023

  152. [160]

    , Fang , H

    botherref Yu , W. , Fang , H. , Chen , B. , Sui , X. , Chen , C. , Wu , H. , Xia , S.-T. , Xu , K. : Gi-nas: Boosting gradient inversion attacks through adaptive neural architecture search. arXiv preprint arXiv:2405.20725 (2024) botherref

    2024

  153. [161]

    , Feng , Y

    bchapter Yang , X. , Feng , Y. , Fang , W. , Shao , J. , Tang , X. , Xia , S.-T. , Lu , R. : An accuracy-lossless perturbation method for defending privacy attacks in federated learning . In: Proceedings of the ACM Web Conference 2022 , pp. 732 -- 742 . ACM , Virtual Event, Ly...

    2022

  154. [162]

    , Ge , M

    botherref Yang , H. , Ge , M. , Xue , D. , Xiang , K. , Li , H. , Lu , R. : Gradient leakage attacks in federated learning: Research frontiers, taxonomy and future directions. IEEE Network (2023) botherref

    2023

  155. [163]

    , Hang , S

    bchapter Yang , C. , Hang , S. , Ding , Y. , Li , C. , Liang , H. , Liu , Z. : Gradient leakage defense in federated learning using gradient perturbation-based dynamic clipping . In: 2024 IEEE International Conference on Web Services (ICWS) , pp. 178 -- 187 . IEEE , Piscataway...

    2024

  156. [164]

    , Luo , W

    barticle Ye , Z. , Luo , W. , Naseem , M.L. , Yang , X. , Shi , Y. , Jia , Y. : C2fmi: Corse-to-fine black-box model inversion attack . IEEE Transactions on Dependable and Secure Computing 21 ( 3 ), 1437 -- 1450 ( 2023 ) barticle

    2023

  157. [165]

    , Luo , W

    botherref Ye , Z. , Luo , W. , Zhou , Q. , Zhu , Z. , Shi , Y. , Jia , Y. : Gradient inversion attacks: Impact factors analyses and privacy enhancement. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024) botherref

    2024

  158. [166]

    , Luo , W

    bchapter Ye , Z. , Luo , W. , Zhou , Q. , Tang , Y. : High-fidelity gradient inversion in distributed learning . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38 , pp. 19983 -- 19991 ( 2024 ) bchapter

    2024

  159. [167]

    , Molchanov , P

    bchapter Yin , H. , Molchanov , P. , Alvarez , J.M. , Li , Z. , Mallya , A. , Hoiem , D. , Jha , N.K. , Kautz , J. : Dreaming to distill: Data-free knowledge transfer via deepinversion . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp...

    2020

  160. [168]

    , Mallya , A

    bchapter Yin , H. , Mallya , A. , Vahdat , A. , Alvarez , J.M. , Kautz , J. , Molchanov , P. : See through gradients: Image batch recovery via gradinversion . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 16337 -- 16346 ( 2021 ). h...

    2021

  161. [169]

    , Nakamura , K

    bchapter Yoshimura , S. , Nakamura , K. , Nitta , N. , Babaguchi , N. : Model inversion attack against a face recognition system in a black-box setting . In: 2021 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) , pp. 1800 --...

    2021

  162. [170]

    , Qiu , Y

    botherref Yu , H. , Qiu , Y. , Fang , H. , Chen , B. , Yu , S. , Wang , B. , Xia , S.-T. , Xu , K. : Calor: Towards comprehensive model inversion defense (arXiv:2410.05814) (2024). arXiv:2410.05814 botherref

    2024

  163. [171]

    , Wang , S

    barticle Yang , W. , Wang , S. , Cui , H. , Tang , Z. , Li , Y. : A review of homomorphic encryption for privacy-preserving biometrics . Sensors 23 ( 7 ), 3566 ( 2023 ) barticle

    2023

  164. [172]

    , Wang , S

    barticle Yang , W. , Wang , S. , Hu , J. , Ibrahim , A. , Zheng , G. , Macedo , M. , Johnstone , M. , Valli , C. : A cancelable iris- and steganography-based user authentication system for the internet of things . Sensors 19 ( 13 ), 2985 ( 2019 ) 10.3390/s19132985 barticle

    2019 doi

  165. [173]

    , Wang , S

    barticle Yang , W. , Wang , S. , Hu , J. , Zheng , G. , Valli , C. : Security and accuracy of fingerprint-based biometrics: A review . Symmetry 11 ( 2 ), 141 ( 2019 ) 10.3390/sym11020141 barticle

    2019 doi

  166. [174]

    , Wang , S

    barticle Yang , W. , Wang , S. , Kang , J.J. , Johnstone , M.N. , Bedari , A. : A linear convolution-based cancelable fingerprint biometric authentication system . Computers & Security 114 , 102583 ( 2022 ) barticle

    2022

  167. [175]

    , Wu , F

    bbook Yuan , Z. , Wu , F. , Long , Y. , Xiao , C. , Li , B. : In: Avidan , S. , Brostow , G. , Cissé , M. , Farinella , G.M. , Hassner , T. (eds.) SecretGen: Privacy Recovery on Pre-trained Models via Distribution Discrimination . Lecture Notes in Computer Science , vol. 13665...

    2022 doi

  168. [176]

    , Yang , S

    barticle Yang , Z. , Yang , S. , Huang , Y. , Martínez , J.-F. , López , L. , Chen , Y. : Aaia: an efficient aggregation scheme against inverting attack for federated learning . International Journal of Information Security 22 ( 4 ), 919 -- 930 ( 2023 ) barticle

    2023

  169. [177]

    , Cheng , S

    botherref Zhang , K. , Cheng , S. , Shen , G. , Ribeiro , B. , An , S. , Chen , P.-Y. , Zhang , X. , Li , N. : Censor: Defense against gradient inversion via orthogonal subspace bayesian sampling. NDSS 2025 (2025) botherref

    2025

  170. [178]

    , Guo , S

    bchapter Zhang , R. , Guo , S. , Wang , J. , Xie , X. , Tao , D. : A survey on gradient inversion: Attacks, defenses and future directions . In: Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI-22) ( 2022 ). https://www.ijcai.org...

    2022

  171. [179]

    , Hidano , S

    botherref Zhang , R. , Hidano , S. , Koushanfar , F. : Text revealer: Private text reconstruction via model inversion attacks against transformers. arXiv preprint arXiv:2209.10505 (2022) botherref

    2022 arXiv

  172. [180]

    , Huang , L

    bchapter Zhu , H. , Huang , L. , Xie , Z. : Ggi: Generative gradient inversion attack in federated learning . In: 2024 6th International Conference on Data-driven Optimization of Complex Systems (DOCS) , pp. 379 -- 384 . IEEE , Piscataway, USA ( 2024 ) bchapter

    2024

  173. [181]

    , Huang , L

    botherref Zhu , H. , Huang , L. , Xie , Z. : Privacy attack in federated learning is not easy: An experimental study (arXiv:2409.19301) (2024). arXiv:2409.19301 botherref

    2024 arXiv

  174. [182]

    , Hou , C

    barticle Zhang , J. , Hou , C. , Yang , X. , Yang , X. , Yang , W. , Cui , H. : Advancing face detection efficiency: Utilizing classification networks for lowering false positive incidences . Array 22 , 100347 ( 2024 ) barticle

    2024

  175. [183]

    , Isola , P

    bchapter Zhang , R. , Isola , P. , Efros , A.A. , Shechtman , E. , Wang , O. : The unreasonable effectiveness of deep features as a perceptual metric . In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pp. 586 -- 595 ( 2018 ). http://openacces...

    2018

  176. [184]

    , Jia , R

    bchapter Zhang , Y. , Jia , R. , Pei , H. , Wang , W. , Li , B. , Song , D. : The secret revealer: Generative model-inversion attacks against deep neural networks . In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 253 -- 261 ( 2020 )....

    2020

  177. [185]

    , Liu , Z

    botherref Zhu , L. , Liu , Z. , Han , S. : Deep leakage from gradients. Advances in neural information processing systems 32 (2019) botherref

    2019

  178. [186]

    , Liu , Q

    barticle Zhang , Z. , Liu , Q. , Huang , Z. , Wang , H. , Lee , C.-K. , Chen , E. : Model inversion attacks against graph neural networks . IEEE Transactions on Knowledge and Data Engineering 35 ( 9 ), 8729 -- 8741 ( 2022 ) barticle

    2022

  179. [187]

    , Mopuri , K.R

    botherref Zhao , B. , Mopuri , K.R. , Bilen , H. : idlg: Improved deep leakage from gradients (arXiv:2001.02610) (2020). arXiv:2001.02610 botherref

    2020 arXiv

  180. [188]

    , Ma , J

    bchapter Zhang , Q. , Ma , J. , Xiao , Y. , Lou , J. , Xiong , L. : Broadening differential privacy for deep learning against model inversion attacks . In: 2020 IEEE International Conference on Big Data (Big Data) , pp. 1061 -- 1070 . IEEE , Piscataway, USA ( 2020 ) bchapter

    2020

  181. [189]

    , Shi , Y

    bchapter Zhu , Z. , Shi , Y. , Luo , J. , Wang , F. , Peng , C. , Fan , P. , Letaief , K.B. : Fedlp: Layer-wise pruning mechanism for communication-computation efficient federated learning . In: ICC 2023-IEEE International Conference on Communications , pp. 1250 -- 1255 . IEEE...

    2023

  182. [190]

    , Tianqing , Z

    barticle Zhang , Z. , Tianqing , Z. , Ren , W. , Xiong , P. , Choo , K.-K.R. : Preserving data privacy in federated learning through large gradient pruning . Computers & Security 125 , 103039 ( 2023 ) barticle

    2023

  183. [191]

    , Wei , X.-Y

    bchapter Zhang , X. , Wei , X.-Y. , Wu , J. , Zhang , T. , Zhang , Z. , Lei , Z. , Li , Q. : Compositional inversion for stable diffusion models . In: Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38 , pp. 7350 -- 7358 ( 2024 ). https://ojs.aaai.org/inde...

    2024

  184. [192]

    , Zhang , L

    barticle Zhang , L. , Zhang , L. , Mou , X. , Zhang , D. : Fsim: A feature similarity index for image quality assessment . IEEE transactions on Image Processing 20 ( 8 ), 2378 -- 2386 ( 2011 ) barticle

    2011

  185. [193]

    , Zhang , W

    bchapter Zhao , X. , Zhang , W. , Xiao , X. , Lim , B. : Exploiting explanations for model inversion attacks . In: Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 682 -- 692 ( 2021 ). http://openaccess.thecvf.com/content/ICCV2021/html/Zhao_Exploit...

    2021

  186. [194]

    , Zhu , T

    botherref Zhou , S. , Zhu , T. , Ye , D. , Zhou , W. , Zhao , W. : Inversion-guided defense: Detecting model stealing attacks by output inverting. IEEE Transactions on Information Forensics and Security (2024) botherref

    2024

  187. [195]

    , Zhu , J

    barticle Zhou , Z. , Zhu , J. , Yu , F. , Li , X. , Peng , X. , Liu , T. , Han , B. : Model inversion attacks: A survey of approaches and countermeasures . http://arxiv.org/abs/2411.10023 ( arXiv:2411.10023 ) ( 2024 ) 10.48550/arXiv.2411.10023 . arXiv:2411.10023 barticle

    2024 doi

  188. [196]

    write newline

    " write newline "" before.all 'output.state := FUNCTION string.to.integer 't := t text.length 'k := #1 'char.num := t char.num #1 substring 's := s is.num s "." = or char.num k = not and char.num #1 + 'char.num := while char.num #1 - 'char.num := t #1 char.num substring FUNCTI...

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.