Pith. sign in

REVIEW 4 major objections 5 minor 55 references

A GAN-based attack, PFO, reconstructs private images from split inference with higher fidelity than previous attacks across resolutions, model depths, and out-of-distribution settings.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

PFO improves GAN-based split-inference reconstruction via progressive intermediate-feature optimization, but its quantitative claims rest on internally inconsistent metric tables.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Plausible attack method, but the reported PSNR/MSE pairs are mutually inconsistent, so the SOTA claim rests on numbers that don't add up. the 4 major comments →

arxiv 2508.20613 v1 pith:SNHE2IXN submitted 2025-08-28 cs.CV cs.CR

Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization

Yixiang Qiu , Yanhan Liu , Hongyao Yu , Hao Fang , Bin Chen , Shu-Tao Xia , Ke Xu This is my paper
classification cs.CV cs.CR
keywords split inferencedata reconstruction attackGAN priorprogressive feature optimizationStyleGAN2privacy leakageout-of-distribution
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Split inference is supposed to protect user privacy by sending only intermediate features to the cloud, but this paper argues that those features can be inverted into near-identical copies of the user's input. It introduces PFO, a data reconstruction attack that uses a pre-trained StyleGAN2 generator as a natural-image prior and optimizes that generator's latent code and internal block features one level at a time, with an L1-ball constraint keeping each step near its starting point. In experiments on face datasets, PFO beats four prior attacks (rMLE, LM, IN, GLASS) on all four reconstruction metrics at all three split points, and it keeps the lead in high-resolution (224x224 and 256x256) settings, out-of-distribution settings, against deeper models such as ResNet-152 and CLIP-RN50, and in black-box and defended settings. If the claim holds, split inference's privacy guarantee is materially weaker than previously demonstrated, and defenses such as NoPeek, DISCO, and Siamese Defense would need to be redesigned.

Core claim

The paper's central claim is that PFO outperforms all existing data reconstruction attacks on split inference, on every reported metric and every split point. The mechanism is to treat the StyleGAN2 generator not as a black box but as a sequence of blocks: first select a good latent starting point, then optimize the extended latent vector and the feature map after each block in turn, so coarse image structure is fixed before fine detail. An L1-ball constraint around each initial feature prevents the optimization from leaving the natural-image manifold. The authors report that this yields substantially higher PSNR/SSIM and lower MSE/LPIPS than rMLE, LM, IN, and GLASS, including in out-of-dist

What carries the argument

The generator of a pre-trained StyleGAN2 is disassembled into hierarchical blocks. PFO first selects a starting latent by matching the target feature with MSE plus KL and total-variation regularization, then optimizes the extended W vector and each block's internal feature map in turn, while constraining both to an L1 ball centered on their initial values. This fixes coarse layout before fine details and keeps the optimization from drifting into unrealistic images.

Load-bearing premise

The method's reported advantage rests on hand-tuned bounds for how far each internal feature may move (the paper does not state their values) and on a pre-trained StyleGAN2 that can actually generate the target type of image; the paper's own out-of-distribution results show the advantage shrinks when that coverage weakens.

What would settle it

Re-run the main comparison with the L1-ball radii and block count varied over a reasonable range; if PSNR swings by several dB or the ranking against GLASS flips, the reported superiority is mostly hyperparameter tuning. Alternatively, point the same attack at a domain the StyleGAN2 prior cannot generate (for example medical or satellite imagery) and check whether PFO's margin over GLASS disappears at a deep split point.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A cloud provider or eavesdropper with white-box access to the client model can reconstruct recognizable faces from a shallow early split point; at Split Point 1 on ResNet-18, PFO reaches 33.1 dB PSNR and 0.945 SSIM.
  • The attack transfers to deeper models: against ResNet-152 and CLIP-RN50, PFO stays ahead of GLASS on all metrics, so model depth alone does not protect the intermediate features.
  • Out-of-distribution attack is possible: a StyleGAN2 trained on FFHQ reconstructs CelebA faces better than the prior GAN attack, though absolute quality drops compared with the matched-distribution setting.
  • Black-box attacks remain viable: replacing gradient descent with the CMA evolution strategy keeps PFO ahead of GLASS, so hiding model parameters is not a sufficient defense.
  • Current defenses are only partially effective: NoPeek degrades the attack, but PFO still reconstructs more than the baseline; DISCO and Siamese Defense barely slow it down.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper does not specify the L1-ball radii or the number of hierarchical blocks used in its experiments; since the ablation shows the constraint matters, the method's advantage may be sensitive to those unspecified hyperparameters.
  • The reliance on a StyleGAN2 prior trained on faces suggests the same approach would likely lose much of its edge on domains the prior cannot generate, a pattern visible in the paper's OOD tables and in its heterogeneous-data results.
  • The 20,000-iteration optimization cost makes the attack slow; a natural next step, which the paper only gestures at, is to distill the optimized trajectory into a feed-forward inverter that runs in one pass.
  • If the progressive feature optimization is doing the real work, the same recipe should transfer to other hierarchical generators and to other feature extractors, giving a testable extension beyond faces and CNNs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PFO, a GAN-based data reconstruction attack against split inference. The method optimizes a StyleGAN2 latent code and then progressively optimizes intermediate hierarchical features under L1-ball constraints. The authors claim state-of-the-art reconstruction performance across multiple split points, high-resolution settings, OOD scenarios, complex networks, defenses, black-box settings, and heterogeneous data, benchmarking against rMLE, LM, IN, and GLASS. The manuscript includes an algorithm pseudocode, several comparison tables, an ablation study, and visualizations.

Significance. If the empirical results are correct, the work would be a meaningful step in showing that GAN-based intermediate-feature optimization transfers from model inversion to split-inference data reconstruction, and that it remains effective in high-resolution and OOD settings. The paper covers a wide range of scenarios and is generally clearly written. However, the central quantitative claim is currently not verifiable because the reported PSNR and MSE values are mutually inconsistent, and key algorithmic hyperparameters are missing. The relationship to the authors' prior ECCV 2024 paper is also not clarified, which affects the novelty assessment.

major comments (4)
  1. [Table I and Section IV-B] Table I (and all subsequent metric tables) reports PSNR/MSE pairs that cannot arise from any single normalization. For pixel values in [0,1], PSNR = 10·log10(1/MSE); the PFO row at Split Point 1 reports MSE=0.003, implying PSNR≈25.2 dB, not 33.103 dB. Using [0,255] would give PSNR≈73 dB. Similarly, GLASS at Split Point 1 (PSNR 29.340, MSE 0.007) implies PSNR≈21.5 dB if MSE is correct. These inconsistencies appear in every table, and Table VII even reports MSE > 1 for presumably normalized images. Since the paper's headline claim of outperforming all baselines rests on these numbers, the quantitative results as published are unverifiable. Please specify the exact metric definitions and normalization and correct the tables, or confirm the margins and rankings with consistent numbers.
  2. [Algorithm 1 and Section IV-A] Algorithm 1 depends on hyperparameters r[i], H, N, and on the choice of optimizer and its settings, but none of these are specified. Section IV-A gives only a global learning rate (1e-2) and 20,000 iterations, which does not determine N per block or the L1-ball radii. Since the progressive optimization is the core novelty and the ablations attribute up to 4 dB to it, the method cannot be reproduced or independently evaluated without these values. Also, the input line 'r[1 . . . L]' conflicts with the use of L as the loss and the loop bound H.
  3. [Section III-B and References [39]-[44]] The proposed progressive feature optimization closely resembles the intermediate-feature inversion method in the authors' own prior work [40] (ECCV 2024), which is cited only as a general use of GAN priors. The manuscript does not state what is genuinely new in PFO relative to [40]—whether it is the L1-ball constraint, the application to split inference, the black-box extension, or something else. Without a clear distinction, the novelty claim in Section I is not assessable.
  4. [Section IV-C and Tables II-VIII] After Table I, all comparisons are limited to GLASS. The abstract and Section I claim state-of-the-art performance 'in a range of scenarios,' but the OOD, high-resolution, complex-network, defense, black-box, and heterogeneous-data tables include no rMLE, LM, or IN results. If the strongest baseline is the only one retained, the paper cannot support the general claim of superiority over prior DRAs in those settings. Please either add the missing baselines or explicitly limit the claim to GLASS comparisons.
minor comments (5)
  1. [General] No standard deviations, confidence intervals, or repeated runs are reported. Optimization-based attacks are stochastic; single-run numbers make it hard to judge whether small differences (e.g., Table VI Split Point 3: 14.316 vs 13.378) are meaningful.
  2. [Algorithm 1] The variable 'L' is overloaded: it denotes both the loss function and an array bound for r[1...L]. Use a different symbol for one of them.
  3. [Section IV-D] The text says 'Table IV-D demonstrates...' but the referenced table is numbered Table VI. Please correct the cross-reference.
  4. [Section IV-B and Fig. 4] Typo: 'higher fidelity and realism thwan baselines' should read 'than baselines.' Also 'Notaly' in Section III-B should be 'Notably.'
  5. [Tables III-V] The captions state the resolutions (e.g., 224×224 and 256×256) but the evaluation-metrics paragraph does not specify whether PSNR/MSE are computed on the native resolution or after resizing to 256×256. Please clarify.

Circularity Check

0 steps flagged

No significant circularity: empirical attack evaluation with held-out test metrics; method is self-contained and no prediction reduces to a fitted input or self-citation chain.

full rationale

The paper is an empirical attack evaluation. The claimed reconstruction quality is measured on held-out test images from a private set, using standard metrics (PSNR, MSE, SSIM, LPIPS), and the method's hyperparameters (e.g., the L1-ball radii r[i] and block count H) are hand-set rather than fitted to the test data. The optimization objectives in Eq. (1) and Eq. (6) minimize the distance between the target intermediate representation and the representation of the reconstructed image; this is the standard DRA formulation, and no output quantity is fed back into the definition of the model or the metric. The only self-citation that could be relevant is [40], the authors' prior work on exploiting GAN intermediate features for model inversion; it is cited only as background (Section II-C, refs [39]-[44]), and the method section attributes the progressive-optimization intuition to external studies of GAN hierarchical semantics [26]-[29]. No uniqueness theorem or forced-choice argument is imported from self-citations. Therefore no step reduces by construction to its inputs. The PSNR/MSE numerical inconsistency noted in the skeptic headline, if real, is an internal-consistency or verifiability problem, not a circularity issue, because the metric columns are not used to define or fit the method.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central result rests on hand-tuned optimization hyperparameters, a strong white-box threat model, and the expressiveness of a pre-trained GAN prior. No new entities are introduced.

free parameters (4)
  • learning rate for optimization = 1e-2
    Used for all optimization-based attacks; no ablation or sensitivity analysis is provided.
  • TV weight alpha = 0.01 for PFO
    Chosen by hand; baseline TV weights differ (2.0 for rMLE, 1.5 for LM) without justification.
  • L1-ball radii r[i] = not reported
    Bound the allowed deviation of intermediate features and w vectors; no values or sensitivity analysis are given, making the method hard to reproduce.
  • Number of blocks H and internal iterations N = not reported
    Define the progressive optimization schedule; critical to the method but unspecified in the text.
axioms (4)
  • domain assumption White-box access to target model parameters and architecture
    Threat model in Section III-A; enables gradient computation through MC.
  • domain assumption StyleGAN2 pre-trained on public dataset is a sufficient image prior
    Used throughout the method; performance drops in OOD settings indicate this assumption is load-bearing.
  • domain assumption MSE between intermediate representations is an effective inversion objective
    Equations (3) and (6) define the attack objective; assumes feature-space distance correlates with image similarity.
  • domain assumption The client model MC is differentiable so gradients can flow from representation loss to generator inputs
    Required for the inner optimization in Algorithm 1.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization." pith.science (2026). https://pith.science/paper/SNHE2IXN

@misc{pith2026250820613,
  author       = {Pith},
  title        = {Pith review of: Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SNHE2IXN}},
  note         = {Machine review of arXiv:2508.20613}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The growing complexity of Deep Neural Networks (DNNs) has led to the adoption of Split Inference (SI), a collaborative paradigm that partitions computation between edge devices and the cloud to reduce latency and protect user privacy. However, recent advances in Data Reconstruction Attacks (DRAs) reveal that intermediate features exchanged in SI can be exploited to recover sensitive input data, posing significant privacy risks. Existing DRAs are typically effective only on shallow models and fail to fully leverage semantic priors, limiting their reconstruction quality and generalizability across datasets and model architectures. In this paper, we propose a novel GAN-based DRA framework with Progressive Feature Optimization (PFO), which decomposes the generator into hierarchical blocks and incrementally refines intermediate representations to enhance the semantic fidelity of reconstructed images. To stabilize the optimization and improve image realism, we introduce an L1-ball constraint during reconstruction. Extensive experiments show that our method outperforms prior attacks by a large margin, especially in high-resolution scenarios, out-of-distribution settings, and against deeper and more complex DNNs.

Figures

Figures reproduced from arXiv: 2508.20613 by Bin Chen, Hao Fang, Hongyao Yu, Ke Xu, Shu-Tao Xia, Yanhan Liu, Yixiang Qiu.

Figure 1
Figure 1. Figure 1: An overview of data reconstruction attacks on the [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of our proposed PFO method. guidance for z. λ and α are hyperparameters to determine the weight of regularization terms, respectively. To avoid unreal generation when using MSE loss, we introduce KL-based regularization [46] to constrain the z to ensure it conforms to the standard Gaussian distribution: R(z) = − 1 2 X k i=1 [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The split points in our experiments. blocks after the split point serve as the cloud model MS, respectively. Compared Baselines & Defenses. We benchmark our method against four prominent data reconstruction attacks (DRAs): regularized Maximum Likelihood Estimation (rMLE) [20], Likelihood Maximization (LM) [21], Inverse-Network (IN) [20], GLASS [23]. To further assess the robustness of our approach, we eval… view at source ↗
Figure 4
Figure 4. Figure 4: Visualization of different DRA methods under the split [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Visualization of heterogeneous data. Due to the limited paper length, we only present the evaluation results in the Split Point 1. As shown in Table VIII, our PFO method maintains the superior robustness against the three defenses, compared to the baseline. Notably, the DISCO and Siamese defenses are weak in resisting the current state-of-the-art DRAs, while the NoPeek still maintains effectiveness to some… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

55 extracted references · 33 canonical work pages · 1 internal anchor

  1. [1]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  2. [2]

    Session-aware information embedding for e- commerce product recommendation,

    C. Wu and M. Yan, “Session-aware information embedding for e- commerce product recommendation,” in Proceedings of the 2017 ACM on conference on information and knowledge management , 2017, pp. 2379–2382

    work page 2017

  3. [3]

    Thwarting longitudinal location exposure attacks in advertising ecosystem via edge computing,

    L. Yu, S. Zhang, L. Zhou, Y . Meng, S. Du, and H. Zhu, “Thwarting longitudinal location exposure attacks in advertising ecosystem via edge computing,” in 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS) . IEEE, 2022, pp. 470–480

    work page 2022

  4. [4]

    A hybrid approach to offloading mobile image classification,

    J. Hauswald, T. Manville, Q. Zheng, R. Dreslinski, C. Chakrabarti, and T. Mudge, “A hybrid approach to offloading mobile image classification,” in 2014 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2014, pp. 8375–8379

    work page 2014

  5. [5]

    Jointdnn: An efficient training and inference engine for intelligent mobile cloud computing services,

    A. E. Eshratifar, M. S. Abrishami, and M. Pedram, “Jointdnn: An efficient training and inference engine for intelligent mobile cloud computing services,” IEEE transactions on mobile computing , vol. 20, no. 2, pp. 565–576, 2019

    work page 2019

  6. [6]

    Auto-split: A general framework of collaborative edge-cloud ai,

    A. Banitalebi-Dehkordi, N. Vedula, J. Pei, F. Xia, L. Wang, and Y . Zhang, “Auto-split: A general framework of collaborative edge-cloud ai,” in Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining , 2021, pp. 2543–2553

    work page 2021

  7. [7]

    Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,

    Y . Kang, J. Hauswald, C. Gao, A. Rovinski, T. Mudge, J. Mars, and L. Tang, “Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,” ACM SIGARCH Computer Architecture News, vol. 45, no. 1, pp. 615–629, 2017

    work page 2017

  8. [8]

    Split computing and early exiting for deep learning applications: Survey and research challenges,

    Y . Matsubara, M. Levorato, and F. Restuccia, “Split computing and early exiting for deep learning applications: Survey and research challenges,” ACM Computing Surveys , vol. 55, no. 5, pp. 1–30, 2022

    2022

  9. [9]

    Two-phase split computing framework in edge–cloud continuum,

    H. Ko, B. Kim, Y . Kim, and S. Pack, “Two-phase split computing framework in edge–cloud continuum,” IEEE Internet of Things Journal , vol. 11, no. 12, pp. 21 741–21 749, 2024

    work page 2024

  10. [10]

    Privacy vulnerability of split computing to data-free model inversion attacks,

    X. Dong, H. Yin, J. M. Alvarez, J. Kautz, P. Molchanov, and H. Kung, “Privacy vulnerability of split computing to data-free model inversion attacks,” arXiv preprint arXiv:2107.06304 , 2021

    Pith/arXiv arXiv 2021

  11. [11]

    Ensuring bidirectional privacy on wireless split inference systems,

    C.-C. Sa, L.-C. Cheng, H.-H. Chung, T.-C. Chiu, C.-Y . Wang, A.-C. Pang, and S.-T. Chen, “Ensuring bidirectional privacy on wireless split inference systems,” IEEE Wireless Communications , vol. 31, no. 5, pp. 134–141, 2024

    work page 2024

  12. [12]

    Privacy leakage on dnns: A survey of model inversion attacks and defenses,

    H. Fang, Y . Qiu, H. Yu, W. Yu, J. Kong, B. Chong, B. Chen, X. Wang, S.-T. Xia, and K. Xu, “Privacy leakage on dnns: A survey of model inversion attacks and defenses,” arXiv preprint arXiv:2402.04013 , 2024

    Pith/arXiv arXiv 2024

  13. [13]

    Mibench: A comprehensive benchmark for model inversion attack and defense,

    Y . Qiu, H. Yu, H. Fang, W. Yu, B. Chen, X. Wang, S.-T. Xia, and K. Xu, “Mibench: A comprehensive benchmark for model inversion attack and defense,” openreview, 2024

    work page 2024

  14. [15]

    MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defense

    Y . Qiu, H. Yu, H. Fang, T. Zhuang, W. Yu, B. Chen, X. Wang, S.-T. Xia, and K. Xu, “Mibench: A comprehensive framework for benchmarking model inversion attack and defense,” arXiv preprint arXiv:2410.05159 , 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  15. [16]

    Gi-nas: Boosting gradient inversion attacks through adaptive neural architecture search,

    W. Yu, H. Fang, B. Chen, X. Sui, C. Chen, H. Wu, S.-T. Xia, and K. Xu, “Gi-nas: Boosting gradient inversion attacks through adaptive neural architecture search,” IEEE Transactions on Information F orensics and Security , 2025

    work page 2025

  16. [17]

    Editable-deepsc: cross-modal editable semantic communication systems,

    W. Yu, B. Chen, Q. Zhang, and S.-T. Xia, “Editable-deepsc: cross-modal editable semantic communication systems,” in 2024 IEEE 99th V ehicular Technology Conference (VTC2024-Spring) . IEEE, 2024, pp. 1–5

    work page 2024

  17. [18]

    Editable-deepsc: Reliable cross-modal semantic communications for facial editing,

    B. Chen, W. Yu, Q. Zhang, T. Zhuang, Y . Jiang, and S.-T. Xia, “Editable-deepsc: Reliable cross-modal semantic communications for facial editing,” arXiv preprint arXiv:2411.15702 , 2024

    arXiv 2024

  18. [19]

    One perturbation is enough: On generating universal adversarial per- turbations against vision-language pre-training models,

    H. Fang, J. Kong, W. Yu, B. Chen, J. Li, H. Wu, S. Xia, and K. Xu, “One perturbation is enough: On generating universal adversarial per- turbations against vision-language pre-training models,” arXiv preprint arXiv:2406.05491, 2024

    arXiv 2024

  19. [20]

    Model inversion attacks against collaborative inference,

    Z. He, T. Zhang, and R. B. Lee, “Model inversion attacks against collaborative inference,” in Proceedings of the 35th annual computer security applications conference , 2019, pp. 148–162

    work page 2019

  20. [21]

    Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks,

    A. Singh, A. Chopra, E. Garza, E. Zhang, P. Vepakomma, V . Sharma, and R. Raskar, “Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 12 125–12 135

    work page 2021

  21. [22]

    Mea- suring data reconstruction defenses in collaborative inference systems,

    M. Yang, Z. Li, J. Wang, H. Hu, A. Ren, X. Xu, and W. Yi, “Mea- suring data reconstruction defenses in collaborative inference systems,” Advances in neural information processing systems , vol. 35, pp. 12 855– 12 867, 2022

    work page 2022

  22. [23]

    Gan you see me? enhanced data reconstruction attacks against split inference,

    Z. Li, M. Yang, Y . Liu, J. Wang, H. Hu, W. Yi, and X. Xu, “Gan you see me? enhanced data reconstruction attacks against split inference,” Advances in neural information processing systems , vol. 36, pp. 54 554– 54 566, 2023

    work page 2023

  23. [24]

    A stealthy wrongdoer: Feature-oriented reconstruction attack against split learning,

    X. Xu, M. Yang, W. Yi, Z. Li, J. Wang, H. Hu, Y . Zhuang, and Y . Liu, “A stealthy wrongdoer: Feature-oriented reconstruction attack against split learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2024, pp. 12 130–12 139

    work page 2024

  24. [25]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 2002

    2002

  25. [26]

    Gan dissection: Visualizing and understanding gener- ative adversarial networks,

    D. Bau, J.-Y . Zhu, H. Strobelt, B. Zhou, J. B. Tenenbaum, W. T. Freeman, and A. Torralba, “Gan dissection: Visualizing and understanding gener- ative adversarial networks,” arXiv preprint arXiv:1811.10597 , 2018

    Pith/arXiv arXiv 2018

  26. [27]

    Interpreting the latent space of gans for semantic face editing,

    Y . Shen, J. Gu, X. Tang, and B. Zhou, “Interpreting the latent space of gans for semantic face editing,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 9243– 9252

    work page 2020

  27. [28]

    Pie: Portrait image embedding for semantic control,

    A. Tewari, M. Elgharib, M. B. R, F. Bernard, H.-P. Seidel, P. P ´erez, M. Zollh ¨ofer, and C. Theobalt, “Pie: Portrait image embedding for semantic control,” ACM Transactions on Graphics (TOG) , vol. 39, no. 6, pp. 1–14, 2020

    work page 2020

  28. [29]

    Intermediate layer optimization for inverse problems using deep generative models,

    G. Daras, J. Dean, A. Jalal, and A. G. Dimakis, “Intermediate layer optimization for inverse problems using deep generative models,” arXiv preprint arXiv:2102.07364, 2021

    Pith/arXiv arXiv 2021

  29. [30]

    Nonlinear total variation based noise removal algorithms,

    L. I. Rudin, S. Osher, and E. Fatemi, “Nonlinear total variation based noise removal algorithms,” Physica D: nonlinear phenomena , vol. 60, no. 1-4, pp. 259–268, 1992

    1992

  30. [31]

    A hybrid deep learning architecture for privacy-preserving mobile analytics,

    S. A. Osia, A. S. Shamsabadi, S. Sajadmanesh, A. Taheri, K. Katevas, H. R. Rabiee, N. D. Lane, and H. Haddadi, “A hybrid deep learning architecture for privacy-preserving mobile analytics,” IEEE Internet of Things Journal , vol. 7, no. 5, pp. 4505–4518, 2020

    work page 2020

  31. [32]

    Nopeek: Information leakage reduction to share activations in distributed deep learning,

    P. Vepakomma, A. Singh, O. Gupta, and R. Raskar, “Nopeek: Information leakage reduction to share activations in distributed deep learning,” in 2020 International Conference on Data Mining Workshops (ICDMW) . IEEE, 2020, pp. 933–942

    work page 2020

  32. [33]

    Generative adversarial nets,

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” Advances in neural information processing systems , vol. 27, 2014

    2014

  33. [34]

    Generative adversarial networks,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial networks,” Communications of the ACM , vol. 63, no. 11, pp. 139–144, 2020

    2020

  34. [35]

    Wasserstein generative ad- versarial networks,

    M. Arjovsky, S. Chintala, and L. Bottou, “Wasserstein generative ad- versarial networks,” in International conference on machine learning . PMLR, 2017, pp. 214–223

    2017

  35. [36]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 4401– 4410

    work page 2019

  36. [37]

    Analyzing and improving the image quality of stylegan,

    T. Karras, S. Laine, M. Aittala, J. Hellsten, J. Lehtinen, and T. Aila, “Analyzing and improving the image quality of stylegan,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 8110–8119

    work page 2020

  37. [38]

    Alias-free generative adversarial networks,

    T. Karras, M. Aittala, S. Laine, E. H ¨ark¨onen, J. Hellsten, J. Lehtinen, and T. Aila, “Alias-free generative adversarial networks,” Advances in neural information processing systems , vol. 34, pp. 852–863, 2021

    work page 2021

  38. [39]

    Gifd: A generative gradient inversion method with feature domain optimization,

    H. Fang, B. Chen, X. Wang, Z. Wang, and S.-T. Xia, “Gifd: A generative gradient inversion method with feature domain optimization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4967–4976

    work page 2023

  39. [40]

    A closer look at gan priors: Exploiting intermediate features for enhanced model inversion attacks,

    Y . Qiu, H. Fang, H. Yu, B. Chen, M. Qiu, and S.-T. Xia, “A closer look at gan priors: Exploiting intermediate features for enhanced model inversion attacks,” in European Conference on Computer Vision . Springer, 2024, pp. 109–126

    work page 2024

  40. [41]

    Calor: Towards comprehensive model inversion defense,

    H. Yu, Y . Qiu, H. Fang, B. Chen, S. Yu, B. Wang, S.-T. Xia, and K. Xu, “Calor: Towards comprehensive model inversion defense,”arXiv preprint arXiv:2410.05814, 2024

    arXiv 2024

  41. [42]

    Clip- guided generative networks for transferable targeted adversarial attacks,

    H. Fang, J. Kong, B. Chen, T. Dai, H. Wu, and S.-T. Xia, “Clip- guided generative networks for transferable targeted adversarial attacks,” in European Conference on Computer Vision . Springer, 2024, pp. 1–19

    work page 2024

  42. [43]

    Stealthy shield defense: A conditional mutual information-based approach against black-box model inversion attacks,

    T. Zhuang, H. Yu, Y . Qiu, H. Fang, B. Chen, and S.-T. Xia, “Stealthy shield defense: A conditional mutual information-based approach against black-box model inversion attacks,” in The Thirteenth International Conference on Learning Representations

    work page

  43. [44]

    Icas: Detecting training data from autoregressive image generative models,

    H. Yu, Y . Qiu, Y . Yang, H. Fang, T. Zhuang, J. Hong, B. Chen, H. Wu, and S.-T. Xia, “Icas: Detecting training data from autoregressive image generative models,” arXiv preprint arXiv:2507.05068 , 2025

    work page arXiv 2025

  44. [45]

    Image2stylegan: How to embed images into the stylegan latent space?

    R. Abdal, Y . Qin, and P. Wonka, “Image2stylegan: How to embed images into the stylegan latent space?” in Proceedings of the IEEE/CVF international conference on computer vision , 2019, pp. 4432–4441

    work page 2019

  45. [46]

    Auto-encoding variational bayes,

    D. P. Kingma, M. Welling et al. , “Auto-encoding variational bayes,” 2013

    2013

  46. [47]

    The cma evolution strategy: A tutorial,

    N. Hansen, “The cma evolution strategy: A tutorial,” arXiv preprint arXiv:1604.00772, 2016

    Pith/arXiv arXiv 2016

  47. [48]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al. , “Learning transferable visual models from natural language supervision,” in International con- ference on machine learning . PmLR, 2021, pp. 8748–8763

    work page 2021

  48. [49]

    Stylegan-xl: Scaling stylegan to large diverse datasets,

    A. Sauer, K. Schwarz, and A. Geiger, “Stylegan-xl: Scaling stylegan to large diverse datasets,” in ACM SIGGRAPH 2022 conference proceed- ings, 2022, pp. 1–10

    work page 2022

  49. [50]

    Deep learning face attributes in the wild,

    Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learning face attributes in the wild,” in Proceedings of the IEEE international conference on computer vision , 2015, pp. 3730–3738

    work page 2015

  50. [51]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  51. [52]

    Cinic-10 is not imagenet or cifar-10,

    L. N. Darlow, E. J. Crowley, A. Antoniou, and A. J. Storkey, “Cinic-10 is not imagenet or cifar-10,” arXiv preprint arXiv:1810.03505 , 2018

    Pith/arXiv arXiv 2018

  52. [53]

    Practical defences against model inversion attacks for split neural networks,

    T. Titcombe, A. J. Hall, P. Papadopoulos, and D. Romanini, “Practical defences against model inversion attacks for split neural networks,” arXiv preprint arXiv:2104.05743, 2021

    Pith/arXiv arXiv 2021

  53. [54]

    Image quality metrics: Psnr vs. ssim,

    A. Hore and D. Ziou, “Image quality metrics: Psnr vs. ssim,” in 2010 20th international conference on pattern recognition . IEEE, 2010, pp. 2366–2369

    2010

  54. [55]

    Image quality assessment: from error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” IEEE transactions on image processing , vol. 13, no. 4, pp. 600–612, 2004

    2004

  55. [56]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595

    2018

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.