Model Inversion in Split Learning for Personalized LLMs: New Insights from Information Bottleneck Theory

Haojin Zhu; Shaofeng Li; Tian Dong; Yan Meng; Yunmeng Shu

REVIEW 5 major objections 5 minor 1 cited by

Model Inversion in Split Learning for Personalized LLMs: New Insights from Information Bottleneck Theory

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read In split learning for personalized LLMs, the intermediate hidden states sent to the server can be inverted to recover users' private text with 38%-75% fidelity, over 60% better than prior attacks.

desk verdict First credible inversion attack on intermediate hidden states in split-learned LLMs, with large empirical gains, but the headline numbers assume a same-distribution auxiliary corpus and should be read as an in-distribution upper bound. read the letter →

arxiv 2501.05965 v1 pith:56B4FAAJ submitted 2025-01-10 cs.LG

Yunmeng Shu , Shaofeng Li , Tian Dong , Yan Meng , Haojin Zhu This is my paper · ORCID

classification cs.LG

keywords LargelanguagemodelEdgecomputingSplitlearningPrivacyinversionattackInformationbottlenecktheoryRepresentationHiddenstateleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that split learning—a common way to personalize large language models on edge devices by sending intermediate hidden states to a server—can leak users' private text. The authors propose RevertLM, a two-stage attack that first projects the sparse hidden representation into the embedding space and then uses a generative decoder to regenerate the original words. In experiments with GPT2-XL and T5 as victim models and two text datasets, the attack recovers 38%-75% of the semantics, with over 60% improvement over prior embedding-inversion methods. The paper also uses mutual information to show that, contrary to the classical information-bottleneck picture, transformer hidden states do not monotonically lose input information with depth, so deeper layers are not automatically safer.

What carries the argument

The load-bearing object is the two-stage inversion pipeline. Stage one, the information purification module, uses a linear projection (the best variant tested) to map the transmitted hidden vector from the victim model's representation space into the embedding space of the attack generator; this counteracts the sparsity of post-transformer-block states. Stage two is an autoregressive decoder-only generator, GPT2-XL, trained with a sequence cross-entropy loss, which converts the purified embedding into a token sequence. The design is motivated by a mutual-information analysis: $I(x;h)$ measured between input text and hidden state does not monotonically decline across transformer blocks, and it correlates with inversion accuracy, so the choice of split point is a privacy-relevant variable.

What would settle it

Train the attack with an auxiliary corpus deliberately drawn from a very different distribution than the victim's private text (for example, Wikipedia as auxiliary against personal chat messages as target). If the recovery metrics stay at the reported 38%-75% level, the similar-distribution condition is not load-bearing; if they collapse to near chance, the paper's own threat model bounds the attack.

Watch

Extended reading notes

Core claim

The central claim is that in split learning for personalized LLMs, an honest-but-curious server can reconstruct user text from the intermediate representations it receives, even when those representations are post-decoder hidden states rather than input embeddings. Existing embedding-inversion attacks degrade sharply on these sparse, information-poor representations, so RevertLM splits the problem: a learned linear projection purifies the representation back into the embedding space, and an autoregressive GPT2-XL decoder then recovers the text. The paper reports ROUGE-L above 0.50 and cosine similarity around 0.90 for GPT2, and shows consistent gains over GEIA and Vec2Text on PersonaChat and Wikipedia data. The information-bottleneck analysis is offered as the explanation for why attack success varies with split point: mutual information between input and hidden state, and between hidden state and output, move together and are highest in middle blocks, while attention-layer representations invert much better than FFN-layer ones.

Load-bearing premise

The attack only works if the attacker has an auxiliary corpus whose distribution closely matches the victim's private text and knows the split model's structure; for rare or idiosyncratic personal data the purification and decoder training cannot be replicated.

Editorial extensions

If this is right

Split-learning deployments should treat intermediate representations as sensitive as the raw text, since they can be inverted without access to model weights.
Split-point choice becomes a security decision: attention-layer hidden states and middle blocks invert better than FFN layers, so transmitting only deep FFN representations would reduce risk.
Defenses for embedding inversion do not automatically protect hidden states; a two-stage purification-plus-generation attack transfers inversion to deeper layers.
Mutual-information measurements can serve as a privacy audit tool: layers where $I(x;h)$ is high are the ones where inversion succeeds.
The reported over-60% improvement over GEIA and Vec2Text holds on matching-distribution auxiliary data and standard conversational/Wikipedia benchmarks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the similar-distribution requirement is relaxed, the 38%-75% figures should be read as an upper bound; real attackers targeting idiosyncratic personal data will likely need stronger auxiliary signals or model-specific priors.
The same linear-projection trick could be turned into a defense: a trainable layer that maps representations into a 'purified' space with low mutual information before transmission could preserve utility while blocking inversion.
The model-specificity is untested: whether a purification module trained on GPT2-XL transfers to other decoder families (e.g., LLaMA-class models) is an open question; if it does not, the attack's generality is narrower than the paper's framing.
The mutual-information correlation suggests a practical audit metric for split-learning APIs: expose a rank of per-layer inversion risk so that application designers can pick split points with quantified leakage.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. This is the first paper I've seen that inverts intermediate hidden states, not embeddings, in split learning for LLMs. The two-stage design—purify the sparse representation back into embedding space, then run a generative decoder—is a sensible response to a real problem, and the gains in Tables 5 and 6 are large and internally consistent: ROUGE-L goes from 0.34 to 0.56 on PersonaChat and from 0.05 to 0.15 on Wiki against GEIA and Vec2Text. If those numbers survive scrutiny, this changes the threat model for edge-cloud personalized LLMs.

What is actually new: not the general idea that embeddings leak—GEIA and Vec2Text already showed that—but the finding that sparse intermediate representations can be purified back into embedding space with a learned projection, plus the mutual-information layer analysis that maps where leakage peaks. The MI analysis is used as motivation, not to fit the attack metrics, so there is no circularity problem. It does not, however, rigorously explain why the linear projection works; Table 4 shows it empirically, but no formal condition is given.

The soft spots are real but not fatal. The biggest one, and the stress-test note is right about it: Section 4.1.1 trains the attacker on the same dataset's training split, which is exactly the 'distribution similar to the training data' assumption in Section 3.1. For genuinely personalized edge-cloud text—idiosyncratic, rare, not publicly available—that assumption is likely false, so the 38%-75% range is best read as an in-distribution upper bound, not a demonstrated privacy break for personalized data. The paper should either include an out-of-distribution experiment (train on PersonaChat, attack on Wiki or on held-out personas) or soften the abstract.

Smaller issues: no code, no standard deviations or seeds, and unresolved table references like 'Table ??'. The 'linear projection with tester' variant in Table 4 is never explained. These are fixable and don't undermine the main direction.

Who this is for: security and privacy researchers working on split learning or representation inversion, and practitioners deploying personalized LLMs. It deserves a serious referee. I'd want code and variance before betting on the exact numbers, but the question and the method are worth refereeing. My recommendation: send it to review, with a request for code, error bars, and an out-of-distribution auxiliary-data experiment.

Referee Report

5 major / 5 minor

Summary. The paper proposes RevertLM, a two-stage model inversion attack against intermediate representations (hidden states) transmitted in split learning for LLMs. The first stage maps sparse intermediate representations into the embedding space using a linear projection or autoencoder ('information purification'), and the second stage uses a GPT2-XL decoder to generate text from the purified representation. The authors motivate the design with an information-bottleneck-style analysis of mutual information across transformer blocks. They evaluate RevertLM against GEIA and Vec2Text on PersonaChat and Wiki datasets with a T5 victim model, reporting ROUGE/BLEU/cosine improvements and claiming an over-60% improvement over the state of the art.

Significance. If fully substantiated, the paper would provide the first systematic demonstration that intermediate LLM representations in split learning are invertible, not just embeddings, and would quantify how inversion risk varies across transformer blocks. The head-to-head comparison against GEIA and Vec2Text on two datasets is the right experimental design, and the reported gains on ROUGE and BLEU are substantial. The mutual-information analysis is a useful addition, though it is used mainly as motivation rather than as a predictive model. However, the lack of code, variance reporting, and a clear evaluation under distribution shift leaves the strength and generality of the central privacy claim only partially established.

major comments (5)

[§3.1 and §4.1.1] The attacker model Φ is trained on an auxiliary dataset D_aux 'with a distribution similar to the training data' (§3.1), and §4.1.1 operationalizes this by using the training split of each dataset as auxiliary data and reporting performance on the same dataset's test split. This is an in-distribution evaluation: the attacker has a large sample from the exact distribution of the victim's private text, including the same PersonaChat personas. In the claimed personalized edge-cloud deployment, private text is precisely what is idiosyncratic and not publicly available, so an attacker without a similar-distribution corpus cannot train the purification and decoder modules as described. The reported 38%-75% recovery rates and the over-60% improvement over SOTA are therefore in-distribution upper bounds, not demonstrated privacy risks for genuinely personalized or out-of-distribution text. The authors should either add experiments with distribution shift (e.g., train on one set of users/personas and attack another, or train on a public corpus and attack private text) or explicitly re-scope the central claim.
[§4.2 and §4.4, Tables 3 and 4] The manuscript contains unresolved table references: the text in §4.2 refers to 'Table ??' and §4.4 refers to 'Table??', while captions are present. More substantively, Table 3 does not state which metric is being reported (presumably ROUGE-L, but this must be explicit), and Table 4 does not specify the dataset, victim model, split point, or training details for the purification variants. The unexplained variant 'Linear projection with tester' also needs a definition. These omissions prevent the reader from reproducing or interpreting the head-to-head comparison.
[§3.4.3, Step 1] Step 1 says the information purification module is pretrained 'with an auxiliary dataset of embeddings for the victim model with negligible size,' but no objective function or architectural details are given for this pretraining. The later loss in Eq. (3) only trains the adversary decoder, and Step 3 mentions joint fine-tuning, but the purification-stage loss and the exact role of the autoencoder are not specified. Without this, the core two-stage mechanism is under-specified and cannot be reimplemented from the text.
[§4.3, Figure 5] The claim that the base model achieves a ROUGE-L score of over 50% and cosine similarity of 90% 'regardless of the layer used as the partition point' is presented without standard deviations, number of seeds, or significance tests. Since attack training is stochastic and the reported improvements over baselines are sometimes modest (e.g., cosine similarity in Table 6), the absence of variance information makes it hard to assess whether the cross-layer and cross-method differences are reliable.
[Abstract, §5, Tables 5 and 6] The claim of 'over 60% improvement over the SOTA' is not qualified by metric or dataset. Concretely, on PersonaChat (Table 5), Base RevertLM improves ROUGE over GEIA by about 48%, while RevertLM improves it by about 67%; on Wiki (Table 6), the ROUGE improvement over GEIA is much larger, but cosine similarity improves by only about 2-4%. The blanket statement in the abstract and conclusion should be replaced with a precise statement of which metric and comparison justify the 60% figure.

minor comments (5)

[Abstract and §2.2] The abstract states this is 'the first' model inversion attack in split learning for LLMs; related work already includes UnSplit (§2.1) for split learning in general, so the novelty claim should be qualified to LLM-specific intermediate representations.
[§3.2] The text says that I(x,t) and I(t,y) are 'consistently positively correlated,' but no correlation coefficient or quantitative analysis is provided; Figure 3 appears to show non-monotonic behavior, and the axes and layer labels are not defined in the caption.
[§3.4.3, Eq. (3)] The perplexity formula following Eq. (3) is not numbered and is written inline; it should be a numbered equation with a clear definition of the conditioning variables, especially because the adversary decoder is autoregressive.
[Tables 5 and 6] The tables report only point estimates; adding standard deviations across random seeds would improve interpretability. Also, the baseline 'Base RevertLM' versus 'RevertLM' naming should be defined in the caption: presumably the latter includes linear purification, but this should be stated.
[§4.2] The sentence 'Representations from the attention layers exhibit performance similar to those processed through entire blocks' is supported by Table 3, but the metric used in the table is unspecified; clarify whether the numbers are ROUGE-L, BLEU, or cosine similarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported attack results are held-out test-set numbers compared against external baselines, and the information-bottleneck analysis is motivational rather than used to fit the attack outcomes.

full rationale

The paper's derivation chain is self-contained with respect to its central empirical claims. The two-stage attack (purification module plus generative decoder) is trained on auxiliary data and evaluated on held-out test splits of PersonaChat and Wiki, with comparisons to the external baselines GEIA and Vec2text. No parameter of the attack is fitted from the reported evaluation metrics, and no equation defining the attack reduces to the success metric by construction. The mutual-information analysis in Section 3.2 is used to motivate why deep representations are harder to invert and why a purification step is useful; it is not used as the training objective or as evidence for the quantitative attack scores. The auxiliary-data assumption (D_aux with a distribution similar to the training data) is a threat-model condition, not a circular step: the training and test splits are distinct, so the reported ROUGE/BLEU/cosine numbers are genuine generalization measurements under that assumption. The assumption does limit real-world transfer to genuinely idiosyncratic personalized data, but that is a scope limitation, not circularity. The paper contains no load-bearing self-citations, no imported uniqueness theorem, and no renaming of a known result as a new derivation. The 'over 60% improvement over SOTA' is computed directly against external methods and is therefore independently checkable.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

No new physical or conceptual entities are introduced. The central claim depends on two unreported hand-chosen components (MI discretization, projection design) and three domain assumptions about auxiliary data, shared vector space, and the validity of the MI proxy. The attack itself uses standard public models and datasets; the main obstacle to independent replication is the missing implementation details rather than a large set of fitted constants.

free parameters (2)

Discretization granularity for mutual information estimation = not reported
Section 3.2 says 'we utilize discretization to compute the mutual information' but does not specify the binning scheme; Figure 3 depends on this choice.
Architecture and dimension of the linear purification projection = not reported
Table 4 shows linear projection is the best purification module, but the exact dimension, normalization, and training setup are omitted, making the best configuration under-specified.

assumptions (4)

domain assumption Information bottleneck trend: I(x;h) decreases and I(h;y) increases with depth, motivating layer-dependent attack difficulty.
Section 3.2 invokes Shwartz-Ziv and Tishby [17] and presents Figure 3, but the paper itself notes the trend is not absolute; the premise is assumed rather than proven for transformer LLMs.
domain assumption Distributionally similar auxiliary data available to the attacker.
Section 3.1: 'the adversary leverages an auxiliary dataset D_aux with a distribution similar to the training data'; without this, all attack modules are untrainable.
ad hoc to paper Representations and embeddings share a vector space that a learned projection can bridge.
Section 3.4.2 frames representation-to-embedding purification as the key design choice; Table 4 tests variants but no geometric or information-theoretic guarantee is given.
domain assumption Discretized mutual information estimates are valid indicators of inversion vulnerability.
Section 3.2 uses discretization without specifying the estimator or validating that MI correlates with attack success across layers.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Model Inversion in Split Learning for Personalized LLMs: New Insights from Information Bottleneck Theory." pith.science (2026). https://pith.science/paper/56B4FAAJ

@misc{pith2026250105965,
  author       = {Pith},
  title        = {Pith review of: Model Inversion in Split Learning for Personalized LLMs: New Insights from Information Bottleneck Theory},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/56B4FAAJ}},
  note         = {Machine review of arXiv:2501.05965}
}

read the original abstract

Personalized Large Language Models (LLMs) have become increasingly prevalent, showcasing the impressive capabilities of models like GPT-4. This trend has also catalyzed extensive research on deploying LLMs on mobile devices. Feasible approaches for such edge-cloud deployment include using split learning. However, previous research has largely overlooked the privacy leakage associated with intermediate representations transmitted from devices to servers. This work is the first to identify model inversion attacks in the split learning framework for LLMs, emphasizing the necessity of secure defense. For the first time, we introduce mutual information entropy to understand the information propagation of Transformer-based LLMs and assess privacy attack performance for LLM blocks. To address the issue of representations being sparser and containing less information than embeddings, we propose a two-stage attack system in which the first part projects representations into the embedding space, and the second part uses a generative model to recover text from these embeddings. This design breaks down the complexity and achieves attack scores of 38%-75% in various scenarios, with an over 60% improvement over the SOTA. This work comprehensively highlights the potential privacy risks during the deployment of personalized LLMs on the edge side.

Figures

Figures reproduced from arXiv: 2501.05965 by the authors.

**Figure 2.** Visualization for embedding and representation [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** System of RevertLM connections. Our findings enrich the understanding of the internal information flow within the Transformer, providing a theoretical foundation for the further design of attack methods. 3.3 Threat Model We define the black-box attack knowledge in this scenario as follows: The attacker has access only to the transmitted representation and the server’s model structure, or the intermediate representa… view at source ↗

Figures from the paper (2 more)

**Figure 3.** Figure 3: Mutual Information across Transformer Blocks [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]

**Figure 5.** Figure 5: illustrates the attack performance across various blocks of the GPT2 model. Initially, as the block number increases, the inversion results improve. However, there is a subsequent decline followed by an increase in performance. This trend aligns with our analysis of mu…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey
cs.CR 2025-01 accept novelty 4.0 of 10

A structured literature review that taxonomizes model inversion attacks and defenses and provides a public resource repository.

Reference graph

Works this paper leans on

24 extracted references · 7 canonical work pages · cited by 1 Pith paper

[1]

[n. d.]. Reinforcement Learning-Based Black-Box Model In- version Attacks | IEEE Conference Publication | IEEE Xplore. https://ieeexplore.ieee.org/document/10203595

work page arXiv
[2]

Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlings- son, Alina Oprea, and Colin Raffel. 2021. Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

work page 2021
[3]

Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. 2021. Knowledge-Enriched Distributional Model Inversion Attacks. In 2021 IEEE/CVF International Con- ference on Computer Vision (ICCV) . 16158–16167. https://doi.org/10.1109/ ICCV48922.2021.01587

arXiv 2021
[4]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Jill Burstein, Christy...

doi:10.18653/v1/n 2019
[5]

Ercüment Çiçek

Ege Erdoğan, Alptekin Küpçü, and A. Ercüment Çiçek. 2022. UnSplit: Data- Oblivious Model Inversion, Model Stealing, and Label Inference Attacks against Split Learning. In Proceedings of the 21st Workshop on Privacy in the Electronic Society (WPES’22). Association for Computing Machinery, New York, NY, USA, 115–124. https://doi.org/10.1145/3559613.3563201

work page arXiv 2022
[6]

Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing. In Proceedings of the 23rd USENIX Conference on Security Symposium (SEC’14). USENIX Association, USA, 17–32

work page 2014
[7]

Kang Gu, Ehsanul Kabir, Neha Ramsurrun, Soroush Vosoughi, and Shagufta Mehnaz. 2023. Towards Sentence Level Inference Attack Against Pre-trained Language Models. Proceedings on Privacy Enhancing Technologies (2023)

work page 2023
[8]

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2021. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. https://doi.org/10.48550/arXiv. 2005.11401 arXiv:2005.11401 [cs]

arXiv doi:10.48550/arxiv.2005.11401 2021

Show all 24 references

[9]

Chin-Yew Lin. 2004. ROUGE: A Package for Automatic Evaluation of Summaries. In Text Summarization Branches Out. Association for Computational Linguistics, Barcelona, Spain, 74–81

2004
[10]

John Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander Rush. 2023. Text Embeddings Reveal (Almost) As Much As Text. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Houda Bouamor, Juan Pino, and Kalika Bali (Eds.). Association...

2023 doi
[11]

Morris, Wenting Zhao, Justin T

John X. Morris, Wenting Zhao, Justin T. Chiu, Vitaly Shmatikov, and Alexander M. Rush. 2023. Language Model Inversion. https://arxiv.org/abs/2311.13647v1

2023 arXiv
[12]

OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff ...

2024 arXiv
[13]

Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. Bleu: a Method for Automatic Evaluation of Machine Translation. In Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics , Pierre Isabelle, Eugene Charniak, and Dekang Lin (Eds...

2002
[14]

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2023. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer. arXiv:1910.10683

2023 arXiv
[15]

Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. SQuAD: 100,000+ Questions for Machine Comprehension of Text. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing , Jian Su, Kevin Duh, and Xavier Carreras (Eds.). Ass...

2016 doi
[16]

Andrew Michael Saxe, Yamini Bansal, Joel Dapello, Madhu Advani, Artemy Kolchinsky, Brendan Daniel Tracey, and David Daniel Cox. 2018. On the In- formation Bottleneck Theory of Deep Learning. In International Conference on Learning Representations. https://openreview.net/forum?...

2018
[17]

Ravid Shwartz-Ziv and Naftali Tishby. 2017. Opening the Black Box of Deep Neural Networks via Information. https://doi.org/10.48550/arXiv.1703.00810 arXiv:1703.00810 [cs]

2017 doi arXiv
[18]

Sotaro Takeshita, Simone Paolo Ponzetto, and Kai Eckert. 2024. ROUGE-K: Do Your Summaries Have Keywords? https://doi.org/10.48550/arXiv.2403.05186 arXiv:2403.05186 [cs]

2024 doi arXiv
[19]

Hall, Pavlos Papadopoulos, and Daniele Romanini

Tom Titcombe, Adam J. Hall, Pavlos Papadopoulos, and Daniele Romanini. 2021. Practical Defences Against Model Inversion Attacks for Split Neural Networks. https://doi.org/10.48550/arXiv.2104.05743 arXiv:2104.05743 [cs]

2021 doi arXiv
[20]

Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. 2018. GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks ...

2018 doi
[21]

Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Eric Sun, and Yue Zhang. 2023. A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly. https://doi.org/10.48550/arXiv.2312.02003 arXiv:2312.02003 [cs]

2023 doi arXiv
[22]

Saizheng Zhang, Emily Dinan, Jack Urbanek, Arthur Szlam, Douwe Kiela, and Jason Weston. 2018. Personalizing Dialogue Agents: I Have a Dog, Do You Have Pets Too?. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) ...

2018 doi
[23]

Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song
[2020]

In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 250–258. https://doi.org/10.1109/CVPR42600.2020.00033

2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

[n. d.]. Reinforcement Learning-Based Black-Box Model In- version Attacks | IEEE Conference Publication | IEEE Xplore. https://ieeexplore.ieee.org/document/10203595

work page arXiv

[2] [2]

Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlings- son, Alina Oprea, and Colin Raffel. 2021. Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

work page 2021

[3] [3]

Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. 2021. Knowledge-Enriched Distributional Model Inversion Attacks. In 2021 IEEE/CVF International Con- ference on Computer Vision (ICCV) . 16158–16167. https://doi.org/10.1109/ ICCV48922.2021.01587

arXiv 2021

[4] [4]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Jill Burstein, Christy...

doi:10.18653/v1/n 2019

[5] [5]

Ercüment Çiçek

Ege Erdoğan, Alptekin Küpçü, and A. Ercüment Çiçek. 2022. UnSplit: Data- Oblivious Model Inversion, Model Stealing, and Label Inference Attacks against Split Learning. In Proceedings of the 21st Workshop on Privacy in the Electronic Society (WPES’22). Association for Computing Machinery, New York, NY, USA, 115–124. https://doi.org/10.1145/3559613.3563201

work page arXiv 2022

[6] [6]

Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing. In Proceedings of the 23rd USENIX Conference on Security Symposium (SEC’14). USENIX Association, USA, 17–32

work page 2014

[7] [7]

Kang Gu, Ehsanul Kabir, Neha Ramsurrun, Soroush Vosoughi, and Shagufta Mehnaz. 2023. Towards Sentence Level Inference Attack Against Pre-trained Language Models. Proceedings on Privacy Enhancing Technologies (2023)

work page 2023

[8] [8]

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2021. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. https://doi.org/10.48550/arXiv. 2005.11401 arXiv:2005.11401 [cs]

arXiv doi:10.48550/arxiv.2005.11401 2021