Pith. sign in

REVIEW 4 major objections 7 minor 59 references

How Breakable Is Privacy: Probing and Resisting Model Inversion Attacks in Collaborative Inference

T0 review · 4 major / 7 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a criterion, Dmia, claiming model-inversion attacks get harder as conditional entropy H(x|z) grows and easier as feature entropy H(z) and the average number of non-zero features δ(z) grow, then builds a defense…

desk verdict Solid defense, shaky theory: SiftFunnel's empirical gains are real, but the 'first theoretical criterion' overclaims. read the letter →

arxiv 2501.00824 v7 pith:ES3MP7M3 submitted 2025-01-01 cs.CR cs.ITmath.IT

Rongke Liu , Youwen Zhu , Dong Wang , Gaoning Pan , Xingyu He , Weizhi Meng This is my paper · ORCID
classification cs.CRcs.ITmath.IT
keywords modelinversionattackcollaborativeinferenceprivacy-preservingmachinelearningmutualinformationFano'sinequalityfeatureentropySiftFunnelbottleneck
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to answer a basic question: when is an edge model's transmitted feature vector actually hard to invert? It derives a criterion, Dmia, from Fano's inequality and a deterministic-encoder identity, and claims attack difficulty grows with conditional entropy of the input given the features and falls with feature entropy and the average count of non-zero feature entries, with mutual information equal to feature entropy. The authors validate the criterion with a neural mutual-information estimator and then build SiftFunnel, a training scheme that uses distance correlation, Pearson correlation, an $\ell^1$ penalty, and label smoothing to suppress redundant features. They report roughly 30% higher reconstruction error than the strongest baseline with about 3% accuracy loss and a nearly 20× smaller edge model. A sympathetic reader would care because this offers a theoretical handle on a vulnerability that has mostly been studied attack-by-attack.

What carries the argument

The load-bearing object is the scalar criterion Dmia ∝ H(x|z) / (H(z)^k1 · δ(z)^k2), with I(x;z) = H(z), where H(x|z) is the conditional entropy of the input given the transmitted feature, H(z) is the feature entropy, and δ(z) is the average number of non-zero elements in z. It is derived by modeling inversion as a Markov chain x → z → x* and applying Fano's inequality to lower-bound reconstruction error, together with the deterministic-encoder identity H(z|x) = 0. The criterion converts a vague intuition about 'too much information in features' into a testable ranking of attacks and defenses, and it directly guides SiftFunnel's loss terms: distance correlation to raise H(x|z), Pearson correlation and $\ell^1$ to lower H(z) and δ(z), and label smoothing to preserve task accuracy.

What would settle it

Train two edge models with equal I(x;z) but different δ(z), for example by pruning feature channels, and measure whether a generative model-inversion attack's reconstruction error rises as δ(z) falls; if reconstruction error stays flat while δ(z) halves, the criterion's predicted dependence on δ(z) is refuted.

Watch

Extended reading notes

Core claim

The central claim is that the difficulty of implementing a model inversion attack in collaborative inference is governed by four quantities: the mutual information I(x;z) between input and transmitted feature (which for a deterministic encoder equals H(z)), the conditional entropy H(x|z), the feature entropy H(z), and δ(z), the average number of non-zero elements in z. Concretely, Dmia ∝ H(x|z) / (H(z)^k1 · δ(z)^k2): increasing conditional entropy makes reconstruction harder, while increasing feature entropy or effective information volume makes it easier. The same bound applies to both maximum-likelihood and generative attacks, with δ(z) additionally controlling the separability and training convergence of generative attackers. The paper then claims the defense SiftFunnel instantiates this criterion: a funnel-shaped edge network with attention and channel compression, trained with distance correlation, Pearson correlation, $\ell^1$ regularization, and label smoothing, raises reconstruction error by about 30% over state-of-the-art defenses while sacrificing roughly 3% accuracy and cutting edge parameters almost 20-fold.

Load-bearing premise

The criterion's derivation assumes Fano's inequality, stated for exact recovery over a finite alphabet, still holds when reconstruction error is redefined as semantic or perceptual similarity; the paper asserts this bridge but does not prove it.

Editorial extensions

If this is right

  • Defenses no longer need direct mutual-information estimation: they can achieve the same privacy effect by cheaply pushing down H(z) and δ(z) and pushing up H(x|z), which is what SiftFunnel does.
  • Shallow edge models without skip connections already reduce I(x;z) with depth; adding skip connections preserves δ(z) and weakens privacy, so network topology is itself a privacy lever.
  • Compared with state-of-the-art defenses, a Dmia-guided funnel edge model raises reconstruction error by about 30%, cuts mutual information and δ(z) by at least 50%, and reduces edge parameters by almost 20× with comparable accuracy.
  • The criterion unifies existing defenses: IB methods lower I(x;z), perturbation methods raise H(x|z), and deeper-network methods reduce both I(x;z) and δ(z).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • As an editorial extension, if Dmia holds beyond the tested image datasets, it gives a deployment-time audit: measure H(z) and δ(z) with estimator-style tools instead of running expensive attacks, and treat rising δ(z) as an alarm.
  • As an editorial extension, the same loss recipe of distance correlation, Pearson correlation, l1, and label smoothing could transfer to split learning or semantic communication settings the paper does not test, since the criterion does not depend on a specific classifier architecture.
  • As an editorial extension, a natural stress test not in the paper is to adapt the attacker to also reduce distance correlation on auxiliary data; if that attack defeats SiftFunnel, the defense's advantage may rest partly on a fixed-threat assumption rather than on the information bound alone.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper studies model inversion attacks (MIAs) in collaborative inference (CI), where an edge device sends intermediate features to a cloud model, and makes two related contributions. First, it proposes Dmia, a 'difficulty criterion' (Eq. (7)) asserting that MIA difficulty grows with the conditional entropy H(x|z) and falls with the feature entropy H(z) and the mean number of nonzero features δ(z), with the identification I(x;z)=H(z) argued from the determinism of the feature mapping (Eq. (4)) and justified through Fano's inequality applied to the reconstruction error (Eqs. (5)-(6)). Second, it proposes SiftFunnel, a defense whose funnel-shaped edge model, attention modules, and loss terms (distance correlation, Pearson correlation, l1 sparsity, label smoothing with KL divergence) are designed to increase H(x|z) and reduce H(z) and δ(z). Experiments on CIFAR-10, FaceScrub, CelebA, and ChestX-ray, using CNN, ResNet-18, and VGG16 edge models and both MLE-based and Gen-based attacks, report that SiftFunnel approximately doubles the reconstruction MSE of the strongest IB baseline under Gen-based MIA on the CNN (0.0639 versus 0.035, Table 2) at roughly 2-3% accuracy loss, with a nearly 20x reduction in edge parameters; the ablation study in Table 5 attributes these gains to all major loss and architectural components.

Significance. If the analysis were fully rigorous, the paper would provide the first principled design criterion for MIA-resistant collaborative inference, and its empirical surface is genuinely valuable: four datasets, three edge architectures, two attack families, nine baselines, a gray-box attack setting, extensive ablations, latency measurements, and a public code release. The ablation study (Table 5) gives direct, falsifiable evidence that each component of SiftFunnel (funnel, attention, distance correlation, Pearson, l1, KL+LS) contributes to reconstruction error, and the consistent ~2-3% accuracy cost across datasets makes the usability-privacy-deployability trade-off credible. The paper also includes honest caveats, such as Section 4.3's acknowledgment of the gap in MLE-based MIA evaluation methods and Section 5.2's statement that the non-independence assumption is idealized. The theoretical contribution, however, is currently a heuristic: Eq.

major comments (4)
  1. [§4.2, Eq. (4)] The identity I(x;z)=H(z) relies on the assertion H(z|x)=0, which is valid only for discrete random variables under a deterministic mapping. For the continuous-valued images and intermediate features used throughout the experiments, the conditional differential entropy h(Z|X) diverges rather than equaling zero, and the associated mutual information is infinite unless a finite-precision model is assumed. The paper never states such a discretization, yet Section 6 reports finite MI values on a [0,1] scale (Tables 2-5) without specifying how the MINE estimates are normalized. This is load-bearing because Eq. (7) is the paper's central theoretical claim. Please either state explicitly that all information quantities in Section 4 are defined with respect to a fixed quantization of inputs and features, or rework the derivation in terms of differential entropies and explain how the finite estimates produced by MINE relate to the theoretical quantities.
  2. [§4.2, Eqs. (5)-(6)] The lower-bound derivation assumes Fano's inequality in its exact-recovery form, Pe log|X| ≥ H(X|Z) − H(Pe), and then extends it to perceptual similarity with a single sentence: 'the inequality merely requires a binary distinction between success and failure.' A binary success/failure event is not sufficient, because the bound contains |X|, whose value changes if X is replaced by a partition of the reconstruction space induced by a perceptual threshold; the paper provides no construction of such a partition, no bound on its cardinality, and no argument relating Pe to MSE/PSNR/SSIM. A charitable reading is that X is the finite set of 8-bit images, but then |X| is astronomically large, making the bound in Eq. (6) vacuous for any realistic H(x|z), so the inequality cannot order attack difficulties quantitatively in the image setting. A fixable route is to quantize the reconstruction space explicitly and derive a Fano bound for the quantized variable, or to present Eq. (7) explicitly as a heuristic criterion motivated by, rather than derived from, Fano's inequality.
  3. [§4.2, Eq. (7)] The δ(z) factor and the exponents k1 and k2 are introduced by assertion ('the difficulty of implementing both types of MIA is inversely proportional to...'), with no derivation from the Fano chain in Eqs. (5)-(6), and with k1 and k2 left unspecified; they are called proportionality constants but are never fitted or assigned values. Moreover, under Eq. (4) the 'four critical factors' are not independent: I(x;z)=H(z) and H(x|z)=H(x)−H(z), so the numerator and denominator of Eq. (7) are functions of the same quantity. The resulting formula Dmia ∝ (H(x)−H(z))/(H(z)^{k1} δ(z)^{k2}) makes no quantitative prediction until the exponents are fixed or fitted. Please either derive a bound that involves δ(z), or fit and test Eq. (7) quantitatively across the configurations in Section 6, or explicitly label Eq. (7) as a qualitative ranking heuristic. As written, the abstract's claim that Eq. (7) is a criterion with 'demonstrated validity' is stronger than the derivation supports.
  4. [§6.3, Tables 2-5] The empirical validation does not yet establish the quantitative claims. First, every metric is reported for a single run; the paper itself notes in Section 4.3 that MINE-based MI estimates are sensitive to batch size and sampling, so headline numbers such as 'increases reconstruction error by ~30%' and 'lowers mutual and effective information metrics by ≥50%' need multiple seeds and error bars. Second, the validation never estimates H(x|z) or H(z) separately from data, nor does it compare the predictions of Eq. (7) against measured attack difficulty across a varied set of defenses; instead, SiftFunnel's loss directly minimizes distance correlation, Pearson correlation, and the l1 norm, which are the very quantities the criterion names, so the observed agreement with Dmia is at least partly built into the construction. The ablation study (Table 5) argues that each loss term matters, which is good evidence, but it does not test the predicted functional form of Eq. (7); a sharper falsification would show that configurations raising H(z) or δ(z) while holding other factors fixed make attacks easier. Third, the reported MI values are stated to range over [0,1] (e.g., 0.9719 in Table 3), which is not what the DV-representation estimator in Eqs. (9)-(10) returns; the normalization must be specified for the relative reductions to be interpretable.
minor comments (7)
  1. [§4.2 (citation)] Fano's inequality is cited to [42] and [43], but [43] is Arrow's 1969 economics paper and is not a source for Fano's inequality; please cite Fano (1961) or a standard textbook such as Cover and Thomas.
  2. [§5.3 / §6.1 (cross-references)] The loss function is numbered (14), but Section 6.1 refers to 'parameters ... in Equation (15)', and Section 4.3 says 'used Equation (11) to train MINE' while the MINE estimator is Eq. (10); please correct the equation cross-references.
  3. [Throughout (typos and style)] Several typos and mechanical errors need cleanup: 'impiles' after Eq. (5); 'UA Vs' and 'Estimati-on-based' in Section 1; a duplicated sentence 'The final formulation of this optimization is as follows, with specific parameter settings.' in Section 5.3; and an incomplete phrase 'with negative values might drive correlations toward complete negative correlation' in Section 5.3.
  4. [Tables 2 and 3 (formatting)] In Tables 2 and 3, the AE-based rows contain two extra numbers ('0.0542 17.4852 0.8151' and '0.0143 23.2332 0.9488') that appear to be gray-box Gen-based MIA results but are not aligned with the column headers; please make the row/column mapping explicit and clarify in the captions which entries are gray-box versus black-box results.
  5. [Figure 2] Figure 2 is discussed in detail in Section 4.3 (parts (a)-(d)) but does not appear in the manuscript version provided for review; please ensure the figure is present in the submission, as it is the primary visual evidence for the depth and skip-connection claims.
  6. [Abstract and §6.3 (headline claim)] The abstract's 'increases reconstruction error by ~30%' claim needs an explicit baseline and configuration: versus the AE-based baseline it ranges from about 35% on FaceScrub (Table 4) to several-fold on ResNet-18 (Table 3), so the 30% figure is not directly traceable from the tables.
  7. [§5.3 (label smoothing)] The label-smoothing parameter α plays an important role in Eqs. (13)-(14), and the paper notes that LS can in some settings increase feature entropy; please state how α interacts with the KL divergence and whether α=0.35 was tuned per dataset or fixed, since Table 4 adjusts λ1-λ3 across datasets.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: Dmia is anchored in the external Fano inequality and independently probed by architecture experiments; only mild in-sample consistency concerns attach to the SiftFunnel validation.

full rationale

The paper's central criterion, Eq. (7), is not equivalent to its inputs by construction. The derivation starts from the standard Fano lower bound (Eqs. (5)-(6)) applied to the Markov chain x->z->x*, and the resulting factors (H(x|z), H(z), delta(z)) are then combined into Dmia. No parameter of Dmia is fitted to attack data, and the formula is not a renamed definition of the attack metrics: MSE, PSNR, and SSIM are measured from actual MLE- and Gen-based attacks, independently of the entropy and sparsity quantities. Section 4.3 provides a genuinely independent probe of the criterion by training MINE on plain CNN and ResNet blocks and showing that architecture-driven reductions in I(x,z) and delta(z) are accompanied by reduced attack performance. The SiftFunnel experiments in Tables 2-5 are a defense evaluation rather than a test of the criterion; although Eq. (14) optimizes distance correlation, Pearson correlation, and l1 sparsity, which align with the Dmia factors, the reported attack outcomes are not the optimized objectives, so the success is not logically forced. Two non-circular weaknesses should be weighed elsewhere: Section 4.2's extension of Fano to 'semantic equivalence or perceptual similarity' is asserted rather than proved, and the continuous-image setting makes |X| and the deterministic-mapping entropy identity in Eq. (4) formally problematic. These are validity risks, not circular reductions; no self-citation chain or constructional equivalence is load-bearing.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

The criterion itself introduces no fitted constants beyond the unspecified k1 and k2, while SiftFunnel's empirical claims rely on tuned loss weights and architecture choices. The axioms are standard information theory plus domain assumptions about deterministic edge models and adversary data access. The only new quantity is delta(z), which is defined operationally but lacks a formal derivation.

free parameters (3)
  • k1, k2 (Dmia exponents) = unspecified
    Proportionality constants in the criterion formula Eq. (7); no values or fitting procedure are given, so the criterion is not quantitatively testable.
  • Loss weights lambda1, lambda2, lambda3, tau, and label smoothing alpha = CIFAR-10: lambda1=3.5, alpha=0.35, lambda2=0.8, lambda3=0.6; FaceScrub: lambda1=5.0, lambda2=0.1, lambda3=0.1…
    Hyperparameters tuned per dataset and attack setup; Tables 4 and 5 show they are adjusted, so the reported defense gains are conditional on these tuned values.
  • Funnel output channel count and edge/cloud split positions = varies by spatial size and architecture (e.g., channels set to 2 if spatial size unchanged, >10 if reduced; ResNet…
    Architecture decisions made by hand to balance accuracy and privacy; no principled criterion is given for selecting them.
assumptions (5)
  • domain assumption Deterministic edge mapping H(z|x)=0
    Invoked in Section 4.2 Eq. (4) to obtain I(x;z)=H(z); valid for standard deterministic neural network inference but breaks for stochastic feature extractors.
  • standard math Markov chain x -> z -> x* and Fano's inequality
    Used in Section 4.2 Eqs. (5)-(6) to lower-bound reconstruction error; standard information-theoretic result, but the extension to perceptual similarity is assumed.
  • ad hoc to paper Perceptual Fano extension
    Section 4.2 asserts Fano's inequality applies when Pe is redefined as semantic equivalence or perceptual similarity; no proof is given that the lower bound holds for perceptual metrics.
  • domain assumption MINE lower bound approximates I(x,z)
    Section 4.3 uses MINE on the training set to validate the criterion; MINE gives a lower bound with variance rather than exact mutual information, and estimator details are only partially specified.
  • domain assumption Adversary has lossless features and a matching auxiliary distribution
    Threat model in Section 3.1 assumes an adversary can train a Gen-based MIA on a closely matching data distribution and observes lossless transmission features, which shapes the reported attack strengths.
invented entities (1)
  • Effective information mean delta(z) independent evidence
    purpose: Average number of non-zero elements in transmitted features; used in Dmia as a causal factor and as a defense objective and evaluation metric.
    It is an operational statistic that anyone can compute from features, so it is reproducible, but it is not derived from first principles and is introduced specifically to support the criterion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of How Breakable Is Privacy: Probing and Resisting Model Inversion Attacks in Collaborative Inference." pith.science (2026). https://pith.science/paper/ES3MP7M3

@misc{pith2026250100824,
  author       = {Pith},
  title        = {Pith review of: How Breakable Is Privacy: Probing and Resisting Model Inversion Attacks in Collaborative Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ES3MP7M3}},
  note         = {Machine review of arXiv:2501.00824}
}
abstract

Collaborative inference (CI) improves computational efficiency for edge devices by transmitting intermediate features to cloud models. However, this process inevitably exposes feature representations to model inversion attacks (MIAs), enabling unauthorized data reconstruction. Despite extensive research, there is no established criterion for assessing the difficulty of MIA implementation, leaving a fundamental question unanswered: \textit{What factors truly and verifiably determine the attack's success in CI?} Moreover, existing defenses lack the theoretical foundation described above, making it challenging to regulate feature information effectively while ensuring privacy and minimizing computational overhead. These shortcomings introduce three key challenges: theoretical gap, methodological limitation, and practical constraint. To overcome these challenges, we propose the first theoretical criterion to assess MIA difficulty in CI, identifying mutual information, entropy, and effective information volume as key influencing factors. The validity of this criterion is demonstrated by using the mutual information neural estimator. Building on this insight, we propose SiftFunnel, a privacy-preserving framework to resist MIA while maintaining usability. Specifically, we incorporate linear and non-linear correlation constraints alongside label smoothing to suppress redundant information transmission, effectively balancing privacy and usability. To enhance deployability, the edge model adopts a funnel-shaped structure with attention mechanisms, strengthening privacy while reducing computational and storage burdens. Experiments show that, compared to state-of-the-art defense, SiftFunnel increases reconstruction error by $\sim$30\%, lowers mutual and effective information metrics by $\geq$50\%, and reduces edge burdens by almost $20\times$, while maintaining comparable usability.

Figures

Figures reproduced from arXiv: 2501.00824 by the authors.

Figure 1
Figure 1. Collaborative inference and the threat of model [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The impact of neural network depth on I(x, z), δ(z), as well as MLE & Gen-based MIA. evaluations—a topic warranting further exploration [20]. In our experiment and Section 6, we still evaluate MLE￾based MIA against various defenses and provide evidence demonstrating the effectiveness of our method in defending against such attacks. In conclusion, through theoretical analysis and experi￾mental validation, we proposed… view at source ↗
Figure 3
Figure 3. Overview of SiftFunnel. Specifically, the design is divided into two aspects: the architecture and the loss function [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: A visual evaluation of the attack effectiveness of two MIAs on CNN edge models protected by various defense [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Quantitative and visual evaluation of privacy and [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 47 canonical work pages

  1. [42]

    Query-efficient model inversion attacks: An information flow view,

    Y . Xu, B. Fang, M. Li, X. Liu, and Z. Tian, “Query-efficient model inversion attacks: An information flow view,” IEEE Transactions on Information Forensics and Security , vol. 20, pp. 1023–1036, 2025

    work page 2025

  2. [43]

    Classificatory notes on the production and transmis- sion of technological knowledge,

    K. J. Arrow, “Classificatory notes on the production and transmis- sion of technological knowledge,” The American Economic Review , vol. 59, no. 2, pp. 29–35, 1969

    work page 1969

  3. [1]

    Tinyml security: Explor- ing vulnerabilities in resource-constrained machine learning systems,

    J. Huckelberry, Y . Zhang, and A. Sansone, “Tinyml security: Explor- ing vulnerabilities in resource-constrained machine learning systems,” arXiv preprint arXiv:2411.07114 , 2024

    arXiv 2024

  4. [2]

    Collaborative inference for ai- empowered iot devices,

    N. Shlezinger and I. V . Baji ´c, “Collaborative inference for ai- empowered iot devices,” IEEE Internet of Things Magazine , vol. 5, no. 4, pp. 92–98, 2022

    work page 2022

  5. [3]

    Collaborative in- ference via ensembles on the edge,

    N. Shlezinger, E. Farhan, and H. Morgenstern, “Collaborative in- ference via ensembles on the edge,” in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 8478–8482

    work page 2021

  6. [4]

    Elastic collaborative edge intelligence for uav swarm: Architecture, challenges, and opportunities,

    Y . Qu, H. Sun, and C. Dong, “Elastic collaborative edge intelligence for uav swarm: Architecture, challenges, and opportunities,” IEEE Communications Magazine, vol. 62, no. 1, pp. 62–68, 2024

    work page 2024

  7. [5]

    A. S. Engineering and Architecture. (2024) Private cloud compute: A new frontier for ai privacy in the cloud. [Online]. Available: https://security.apple.com/blog/private-cloud-compute

    work page 2024

  8. [6]

    Model inversion attacks against collaborative inference,

    Z. He, T. Zhang, and R. B. Lee, “Model inversion attacks against collaborative inference,” in Proceedings of the 35th Annual Computer Security Applications Conference , 2019, pp. 148–162

    2019

Show all 59 references
  1. [7]

    Measuring data reconstruction defenses in collaborative inference systems,

    M. Yang, Z. Li, and J. Wang, “Measuring data reconstruction defenses in collaborative inference systems,” Advances in Neural Information Processing Systems, vol. 35, pp. 12 855–12 867, 2022

    2022

  2. [8]

    Ginver: Generative model inversion attacks against collaborative inference,

    Y . Yin, X. Zhang, and H. Zhang, “Ginver: Generative model inversion attacks against collaborative inference,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2122–2131

    2023

  3. [9]

    Member- ship inference attacks and generalization: A causal perspective,

    T. Baluta, S. Shen, S. Hitarth, S. Tople, and P. Saxena, “Member- ship inference attacks and generalization: A causal perspective,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 249–262

    2022

  4. [10]

    Neural network inversion in adversarial setting via background knowledge alignment,

    Z. Yang, J. Zhang, and E.-C. Chang, “Neural network inversion in adversarial setting via background knowledge alignment,” in Pro- ceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 225–240

    2019

  5. [11]

    The secret revealer: Generative model- inversion attacks against deep neural networks,

    Y . Zhang, R. Jia, and H. Pei, “The secret revealer: Generative model- inversion attacks against deep neural networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 253–261

    2020

  6. [12]

    Unstoppable attack: Label-only model inversion via conditional diffusion model,

    R. Liu, D. Wang, and Y . Ren, “Unstoppable attack: Label-only model inversion via conditional diffusion model,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 3958–3973, 2024

    2024

  7. [13]

    Privacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing,

    M. Fredrikson, E. Lantz, and S. Jha, “Privacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing,” in 23rd USENIX security symposium (USENIX Security 14) , 2014, pp. 17–32

    2014

  8. [14]

    Are your sensitive at- tributes private? novel model inversion attribute inference attacks on classification models,

    S. Mehnaz, S. V . Dibbo, and R. De Viti, “Are your sensitive at- tributes private? novel model inversion attribute inference attacks on classification models,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 4579–4596

    2022

  9. [15]

    Privacy-preserving autoencoder for col- laborative object detection,

    B. Azizian and I. V . Baji ´c, “Privacy-preserving autoencoder for col- laborative object detection,” IEEE Transactions on Image Processing, vol. 33, pp. 4937–4951, 2024

    2024

  10. [16]

    Attacking and protecting data privacy in edge–cloud collaborative inference systems,

    Z. He, T. Zhang, and R. B. Lee, “Attacking and protecting data privacy in edge–cloud collaborative inference systems,”IEEE Internet of Things Journal , vol. 8, no. 12, pp. 9706–9716, 2020

    2020

  11. [17]

    Privacy-preserving security in- ference towards cloud-edge collaborative using differential privacy,

    Y . Wang, X. Chen, and Q. Wang, “Privacy-preserving security in- ference towards cloud-edge collaborative using differential privacy,” arXiv preprint arXiv:2212.06428 , 2022

    2022 arXiv

  12. [18]

    Bilateral dependency optimization: Defending against model-inversion attacks,

    X. Peng, F. Liu, and J. Zhang, “Bilateral dependency optimization: Defending against model-inversion attacks,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 1358–1367

    2022

  13. [19]

    Privacy-preserving task-oriented semantic communications against model inversion attacks,

    Y . Wang, S. Guo, and Y . Deng, “Privacy-preserving task-oriented semantic communications against model inversion attacks,” IEEE Transactions on Wireless Communications, vol. 23, no. 8, pp. 10 150– 10 165, 2024

    2024

  14. [20]

    Patrol: Privacy-oriented pruning for collaborative inference against model inversion attacks,

    S. Ding, L. Zhang, and M. Pan, “Patrol: Privacy-oriented pruning for collaborative inference against model inversion attacks,” in Pro- ceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2024, pp. 4716–4725

    2024

  15. [21]

    Improving robustness to model inver- sion attacks via mutual information regularization,

    T. Wang, Y . Zhang, and R. Jia, “Improving robustness to model inver- sion attacks via mutual information regularization,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 13, 2021, pp. 11 666–11 673

    2021

  16. [22]

    Not all features are equal: Discovering essential features for preserving prediction privacy,

    F. Mireshghallah, M. Taram, and A. Jalali, “Not all features are equal: Discovering essential features for preserving prediction privacy,” in Proceedings of the Web Conference 2021 , 2021, pp. 669–680

    2021

  17. [23]

    Side-channel attacks based on multi-loss regularized denoising autoencoder,

    F. Hu, J. Shen, and P. Vijayakumar, “Side-channel attacks based on multi-loss regularized denoising autoencoder,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 2051–2065, 2024

    2024

  18. [24]

    Mutual information neural estimation,

    M. I. Belghazi, A. Baratin, and S. Rajeshwar, “Mutual information neural estimation,” in International conference on machine learning . PMLR, 2018, pp. 531–540

    2018

  19. [25]

    Squeeze-and-excitation networks,

    J. Hu, L. Shen, and G. Sun, “Squeeze-and-excitation networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 7132–7141

    2018

  20. [26]

    Rotate to attend: Convolutional triplet attention module,

    D. Misra, T. Nalamada, and A. U. Arasanipalai, “Rotate to attend: Convolutional triplet attention module,” in 2021 IEEE Winter Confer- ence on Applications of Computer Vision (WACV) , 2021, pp. 3138– 3147

    2021

  21. [27]

    Cbam: Convolutional block attention module,

    S. Woo, J. Park, and J.-Y . Lee, “Cbam: Convolutional block attention module,” in Proceedings of the European conference on computer vision (ECCV), 2018, pp. 3–19

    2018

  22. [28]

    Passive inference attacks on split learn- ing via adversarial regularization,

    X. Zhu, X. Luo, and Y . Wu, “Passive inference attacks on split learn- ing via adversarial regularization,” arXiv preprint arXiv:2310.10483 , 2023

    2023 arXiv

  23. [29]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

    2015

  24. [30]

    Nonlinear total variation based noise removal algorithms,

    L. I. Rudin, S. Osher, and E. Fatemi, “Nonlinear total variation based noise removal algorithms,” Physica D: nonlinear phenomena, vol. 60, no. 1-4, pp. 259–268, 1992

    1992

  25. [31]

    Analysis and utilization of hidden information in model inversion attacks,

    Z. Zhang, X. Wang, and J. Huang, “Analysis and utilization of hidden information in model inversion attacks,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4449–4462, 2023

    2023

  26. [32]

    Medical image denoising using convolutional denoising autoencoders,

    L. Gondara, “Medical image denoising using convolutional denoising autoencoders,” in 2016 IEEE 16th international conference on data mining workshops (ICDMW) . IEEE, 2016, pp. 241–246

    2016

  27. [33]

    Be careful what you smooth for: Label smoothing can be a privacy shield but also a cat- alyst for model inversion attacks,

    L. Struppek, D. Hintersdorf, and K. Kersting, “Be careful what you smooth for: Label smoothing can be a privacy shield but also a cat- alyst for model inversion attacks,” arXiv preprint arXiv:2310.06549 , 2023

    2023 arXiv

  28. [34]

    Privascissors: Enhance the privacy of collaborative inference through the lens of mutual information,

    L. Duan, J. Sun, and Y . Chen, “Privascissors: Enhance the privacy of collaborative inference through the lens of mutual information,” arXiv preprint arXiv:2306.07973 , 2023

    2023 arXiv

  29. [35]

    Club: A contrastive log-ratio upper bound of mutual information,

    P. Cheng, W. Hao, and S. Dai, “Club: A contrastive log-ratio upper bound of mutual information,” inInternational conference on machine learning. PMLR, 2020, pp. 1779–1788

    2020

  30. [36]

    The limitations of adversarial training and the blind-spot attack,

    H. Zhang, H. Chen, Z. Song, D. Boning, I. S. Dhillon, and C.-J. Hsieh, “The limitations of adversarial training and the blind-spot attack,” arXiv preprint arXiv:1901.04684 , 2019

    1901 arXiv

  31. [37]

    {FaceObfuscator}: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition,

    S. Jin, H. Wang, and Z. Wang, “ {FaceObfuscator}: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 6849–6866

    2024

  32. [38]

    Deep residual learning for image recognition,

    K. He, X. Zhang, and S. Ren, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  33. [39]

    Sok: Model inversion attack landscape: Taxonomy, chal- lenges, and future roadmap,

    S. V . Dibbo, “Sok: Model inversion attack landscape: Taxonomy, chal- lenges, and future roadmap,” in 2023 IEEE 36th Computer Security Foundations Symposium (CSF). IEEE, 2023, pp. 439–456

    2023

  34. [40]

    Text revealer: Private text reconstruction via model inversion attacks against transformers,

    R. Zhang, S. Hidano, and F. Koushanfar, “Text revealer: Private text reconstruction via model inversion attacks against transformers,” arXiv preprint arXiv:2209.10505 , 2022

    2022 arXiv

  35. [41]

    Pseudo label-guided model in- version attack via conditional generative adversarial network,

    X. Yuan, K. Chen, and J. Zhang, “Pseudo label-guided model in- version attack via conditional generative adversarial network,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 3, 2023, pp. 3349–3357

    2023

  36. [44]

    On the vulnerability of skip connections to model inversion attacks,

    K. J. Hao, S.-T. Ho, and N.-B. Nguyen, “On the vulnerability of skip connections to model inversion attacks,” in European Conference on Computer Vision. Springer, 2025, pp. 140–157

    2025

  37. [45]

    Asymptotic evaluation of certain markov process expectations for large time. iv,

    M. D. Donsker and S. S. Varadhan, “Asymptotic evaluation of certain markov process expectations for large time. iv,” Communications on pure and applied mathematics , vol. 36, no. 2, pp. 183–212, 1983

    1983

  38. [46]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” no. 0, 2009

    2009

  39. [47]

    Feature screening via distance corre- lation learning,

    R. Li, W. Zhong, and L. Zhu, “Feature screening via distance corre- lation learning,” Journal of the American Statistical Association , vol. 107, no. 499, pp. 1129–1139, 2012

    2012

  40. [48]

    Pearson correlation coefficient,

    I. Cohen, Y . Huang, and J. Chen, “Pearson correlation coefficient,” Noise reduction in speech processing , pp. 1–4, 2009

    2009

  41. [49]

    Model inversion robust- ness: Can transfer learning help?

    S.-T. Ho, K. J. Hao, and K. Chandrasegaran, “Model inversion robust- ness: Can transfer learning help?” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 12 183–12 193

    2024

  42. [50]

    Fisher information and stochastic complexity,

    J. J. Rissanen, “Fisher information and stochastic complexity,” IEEE transactions on information theory , vol. 42, no. 1, pp. 40–47, 1996

    1996

  43. [51]

    Inception-v4, inception- resnet and the impact of residual connections on learning,

    C. Szegedy, S. Ioffe, and V . Vanhoucke, “Inception-v4, inception- resnet and the impact of residual connections on learning,” in Pro- ceedings of the AAAI conference on artificial intelligence , vol. 31, no. 1, 2017

    2017

  44. [52]

    Kernel methods for measuring indepen- dence,

    A. Gretton and R. Herbrich, “Kernel methods for measuring indepen- dence,” Journal of Machine Learning Research , vol. 6, no. 70, pp. 2075–2129, 2005

    2005

  45. [53]

    Plug & play attacks: Towards robust and flexible model inversion attacks,

    L. Struppek, D. Hintersdorf, and A. De Almeida Correira, “Plug & play attacks: Towards robust and flexible model inversion attacks,” in Proceedings of the 39th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 162. PMLR, 17–23 Ju...

    2022

  46. [54]

    Measuring statistical de- pendence with hilbert-schmidt norms,

    A. Gretton, O. Bousquet, and A. Smola, “Measuring statistical de- pendence with hilbert-schmidt norms,” in International conference on algorithmic learning theory . Springer, 2005, pp. 63–77

    2005

  47. [55]

    A data-driven approach to cleaning large face datasets,

    H.-W. Ng and S. Winkler, “A data-driven approach to cleaning large face datasets,” in 2014 IEEE international conference on image processing (ICIP). IEEE, 2014, pp. 343–347

    2014

  48. [56]

    Deep learning face attributes in the wild,

    Z. Liu, P. Luo, and X. Wang, “Deep learning face attributes in the wild,” in Proceedings of the IEEE international conference on computer vision, 2015, pp. 3730–3738

    2015

  49. [57]

    Curated dataset for covid-19 posterior-anterior chest radiography images (x-rays),

    U. Sait, K. Lal, S. Prajapati, R. Bhaumik, T. Kumar, S. Sanjana, and K. Bhalla, “Curated dataset for covid-19 posterior-anterior chest radiography images (x-rays),” Mendeley Data, vol. 1, no. J, 2020

    2020

  50. [58]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  51. [59]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, and I. Goodfellow, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , 2016, pp. 308–318

    2016

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.