Pith. sign in

REVIEW 3 major objections 7 minor 41 references

This paper claims that a compromised AI training pipeline can embed private training images directly into a model's weights, lock them against change, and later recover them pixel-perfectly from the final model—even after compression, pruni

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-07-31 23:35 UTC pith:F72OWLFI

load-bearing objection A sound steganographic codec whose one advertised edge over LSB—surviving quantization and pruning—is backed only by a qualitative figure and is mechanistically doubtful. the 3 major comments →

arxiv 2607.27886 v1 pith:F72OWLFI submitted 2026-07-30 cs.CR

Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components

Jin-Seong Kim , Han-Ju Lee , Seok-Won Hong , Takeshi Takahashi , Chansu Han , Tomohiro Morikawa , Seok-Hwan Choi This is my paper
classification cs.CR
keywords supply chain attacktraining-time data injectionweight steganographygradient lockingmodel inversion attackdata exfiltrationneural network privacypost-training robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

GradLock is a supply-chain attack that smuggles private training images into a neural network's weights during the training process itself. The attacker controls a seemingly benign training utility; the utility picks specific weight positions in the classifier layer using a deterministic sine-based formula, writes scaled copies of private images there, and masks those positions out of gradient updates so training never overwrites them. At the end, the victim shares the model, and the attacker—holding only the weight file—instantly reconstructs the images with near-perfect similarity (SSIM ≈ 1.0). The paper argues this works after standard deployment optimizations that destroy earlier bit-level steganography, and that a 30-person user study found almost no one inspects such utilities.

Core claim

The central claim is that selectively freezing a small, deterministically located fraction of a model's parameters during training creates 'data vaults' that are decoupled from the model's learning dynamics, letting an adversary inject arbitrary training samples that survive the entire optimization and later deployment-time transforms. On MNIST, Imagenette, and CelebA, across CNN and Transformer architectures, the authors report pixel-perfect recovery (SSIM ≈ 1.0, LPIPS ≈ 0) in under a second, with attack success bounded by the model's own classification accuracy. They show the approach remains extractable after INT8 quantization, 30% magnitude pruning, and 20 epochs of fine-tuning, in contr

What carries the argument

The mechanism has three parts: (1) a stateless, sine-based index function that selects scattered rows of the classifier weight matrix, so injection and extraction stay synchronized without sharing metadata or seeds; (2) a binary gradient mask applied during the backward pass that locks those positions only, leaving them active in the forward pass; and (3) a scaling factor α=0.01 that keeps injected values small to avoid disturbing optimization. Extraction is just a read of the locked weights at the known indices, rescaled by 1/α.

Load-bearing premise

The payload values, scaled down to 1% of their natural range, remain identifiable after INT8 quantization and 30% magnitude pruning—and the paper supports that only with a qualitative figure, not measured similarity scores.

What would settle it

Train a model with GradLock, then apply INT8 quantization and 30% magnitude pruning and measure SSIM/LPIPS/ASR on the extracted images; if the images become unrecognizable (SSIM near zero or ASR at chance), the central persistence claim is false.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the claim holds, deployment-stage optimizations (quantization, pruning, fine-tuning) cannot be relied on to sanitize compromised models; private data persists in shipped weights.
  • Model-sharing ecosystems become viable exfiltration channels even from restricted data environments, since the attacker needs only the final weight file.
  • Training-time attacks outperform post-training model inversion on high-dimensional data, so privacy defenses must move earlier in the pipeline, verifying initialization and gradient behavior.
  • Statistical weight audits may fail to flag GradLock models, since distributional differences stayed within run-to-run variance in the paper's experiments.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The sine-based indexing parameters (ρ, α) are effectively a shared secret between injection and extraction; a defender who applies a fixed random permutation to weights would destroy the location mapping without harming task accuracy, offering a lightweight countermeasure the paper does not test.
  • Because the payload is just scaled raw pixel values in arbitrary matrix rows, the same trick should embed non-image data (text, tabular records) in any sufficiently wide layer; the paper only demonstrates images.
  • The paper's robustness evidence after quantization and pruning is qualitative (Figure 6); if quantitative fidelity metrics were reported and they were low, the claimed advantage over LSB encoding would shrink, so this is the empirical hinge to watch.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes GradLock, a training-time injection attack that embeds private training samples into selected neural-network parameters and locks those parameters against gradient updates during training. The adversary, who supplies a malicious training toolchain, later extracts the embedded data from the released model without further access to the training environment. The attack uses a sine-based deterministic indexing scheme to select parameter rows, a scaling factor α to keep the injected values small, and a gradient mask to prevent updates to those rows. The paper reports near-perfect reconstruction (SSIM ≈ 1.0, LPIPS ≈ 0) on MNIST, Imagenette, and CelebA across several CNN and Transformer architectures, claims robustness to quantization, pruning, and fine-tuning, and presents a user study in which 93.3% of participants failed to detect the injected logic. The main comparison baselines are LSB-style parameter encoding and post-training model inversion attacks.

Significance. If the robustness claims are substantiated, GradLock would demonstrate a training-time supply-chain attack that is more persistent than LSB-style parameter encoding and achieves exact data recovery with negligible extraction cost. The gradient-locking mechanism is simple, and the no-perturbation reconstruction is exact by construction, as the extraction formula (Eq. 5) is the inverse of the injection formula (Eq. 4). The paper includes ablation studies, statistical stealthiness analysis, a user study, and a public code link, which support reproducibility. However, the central advertised advantage over LSB encoding—robustness to post-training optimizations—is supported only by a qualitative figure, and there is an unaddressed inconsistency in the indexing scheme regarding collisions. The contribution is therefore promising but not yet fully verified.

major comments (3)
  1. [§4.3, Fig. 6] The paper's headline claim over LSB encoding is robustness to quantization, pruning, and fine-tuning, but this is supported only by the qualitative Figure 6. No SSIM, LPIPS, ASR, or confidence-gap values are reported after INT8 quantization, 30% magnitude pruning, or 20-epoch fine-tuning, and the LSB baseline is not shown under any of these transforms. This is load-bearing because the payload is scaled by α=0.01 (Eq. 4), so injected weights have small magnitudes and are prime candidates for removal by magnitude pruning. The section's own summary concedes that 'post-training optimizations inevitably degrade high-frequency details,' which is in tension with the abstract's 'pixel-perfect' language. Please provide numerical metrics for the injected set under each transformation, along with a direct LSB comparison, to substantiate the robustness advantage.
  2. [§3.2.1, §3.2.3, Appendix B.2, Algorithm 1] The sine-based indexing of Eq. (1) is acknowledged in Appendix B.2 to produce index collisions, yet §3.2.3 states that each data sample is mapped to a 'unique, non-overlapping segment,' and Algorithm 1 writes samples sequentially to rows R_i. If two indices i≠j collide, the second write overwrites the first, so not all injected samples can be recovered. The paper reports perfect reconstruction (SSIM=1.000, LPIPS=0.000) of 100 injected samples, which requires the first 100 indices to be collision-free or a deduplication step that is never described. This inconsistency affects capacity, fidelity, and reproducibility. The authors should clarify how collisions are handled, or correct the capacity claims if the method actually uses a subset of unique indices.
  3. [§4.2, Table 3, ASR claim] The text states that 'GradLock’s ASR is strictly bounded by the target model’s actual test accuracy.' Since extracted data are exact copies of training samples, ASR is the model's accuracy on those specific training instances, which is not necessarily equal to its test-set accuracy. The relationship may hold empirically, but the statement as written is not a strict bound. Please rephrase to reflect the actual mechanism, and report the clean training accuracy of the model on the injected samples if relevant.
minor comments (7)
  1. [Global] The manuscript retains a 'Conference’17, July 2017, Washington, DC, USA' template header and formatting artifacts; these should be removed for journal submission.
  2. [§4.2] The perfect fidelity scores (SSIM=1.000, LPIPS=0.000) under no perturbation are exact by construction because Eqs. (4) and (5) form an inverse pair. The paper should acknowledge this explicitly so readers do not interpret it as a learned capability.
  3. [§4.1, Evaluation Metric] The KNN distance metric is underspecified: the value of k and the space (pixel or feature) in which distances are computed are not stated. Tables 2 and 4 should include this information.
  4. [§3.2.3] The sentence 'the theoretical upper bound of embeddable instances is ⌊|R|/d⌋' appears inconsistent with Eq. (4), where one sample is written to one row of width d, giving a capacity of |R| samples. Please clarify what quantity is intended.
  5. [§4.3] The robustness experiments do not specify which dataset/model combination is used for the qualitative results in Fig. 6, nor the exact quantization scheme (e.g., per-tensor or per-channel). Providing protocol details would improve reproducibility.
  6. [§4.9, Table 8] The extraction times for GradLock and LSB are compared with end-to-end inversion times for MI attacks. These are not directly comparable because MI attacks include iterative optimization. The caption should clarify that the comparison is contextual, not a same-task benchmark.
  7. [§4.7] The user study uses 30 undergraduate seniors from one course. This is a small, non-representative sample; the paper appropriately calls the evidence preliminary, but the abstract's '93.3% of participants failed' framing overstates generality. Suggest softening.

Circularity Check

0 steps flagged

No significant circularity: the injection/extraction pair is an explicit inverse codec, and the paper's load-bearing claims are empirical or constructional rather than reductions to fitted inputs.

full rationale

GradLock's derivation chain is self-contained and non-circular. Equations (4) and (5) define an intentional encoder/decoder pair: the payload is written as W = alpha * Flatten(x) and recovered as x_hat = Reshape(W / alpha). This is a codec property, not a hidden reduction of a prediction to its input; the paper does not claim to infer private data from independent signals, it constructs an invertible embedding. The replication of near-perfect SSIM/LPIPS under no perturbation is therefore a consistency check of the codec, while the actual claimed contribution is persistence under post-training optimizations. That persistence claim is empirically asserted (Figure 6), though it is supported only qualitatively—no SSIM/LPIPS/ASR numbers are reported after INT8 quantization, 30% pruning, or 20-epoch fine-tuning. This is a correctness/evidence gap, not circularity, because the paper does not fit any parameter to force those outcomes. Hyperparameters alpha and rho are selected by ablations to preserve accuracy, not fitted to make reconstruction metrics pass. There are no load-bearing self-citations: references are to external prior attacks and baselines, and no uniqueness theorem from the authors is invoked to rule out alternatives. The claimed advantage over LSB encoding rests on unquantified robustness evidence, a serious empirical concern, but it does not reduce by the paper's own equations to its inputs. Overall, no circularity is present.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The central mechanism is a codec keyed by two hyperparameters (alpha, rho). No invented physical or conceptual entities; 'data vaults' is a metaphor for selected weight rows. Key assumptions are the adversary's code-execution/data-read capability and the unverified survival of small payload values through post-training optimization.

free parameters (3)
  • alpha (payload scale) = 0.01 (default)
    Chosen via ablation (Appendix B.1) to balance training stability and reconstruction; directly sets payload amplitude, and post-training quantization/pruning survivability depends on it.
  • rho (injection ratio) = 0.5 (default)
    Chosen via ablation (Section 4.5.2, Table 9) to limit accuracy drop to about 0.2% while providing capacity; defines the vault indices in Eq. 1.
  • classifier hidden dimension = 1024
    Fixed across all classifier layers to ensure sufficient capacity for data injection; this architecture modification affects the model's ability to absorb the payload without accuracy loss.
axioms (5)
  • domain assumption The adversary's toolchain can read the private training data and overwrite target weights before training.
    Threat model in Section 3.1.1; without this access there is no injection.
  • ad hoc to paper Post-training optimizations (INT8 quantization, 30% pruning, fine-tuning) do not destroy alpha-scaled payload values.
    Section 4.3 asserts persistence with only qualitative Figure 6; injected values are near-zero and likely pruned by magnitude pruning.
  • domain assumption The user does not use weight permutation, differential privacy, adversarial training, or runtime gradient monitoring.
    Section 3.1.1 assumes no advanced defenses; Section 5 concedes weight permutation breaks the scheme.
  • domain assumption The model can absorb fixed random rows in the classifier without meaningful accuracy loss on high-dimensional tasks.
    Accuracy-drop ablation is shown only for MNIST (Table 9); Imagenette and CelebA accuracy drops are not reported.
  • standard math Zeroed gradients leave parameter values unchanged under standard optimizers.
    Eq. 2 gradient masking; SGD/Adam updates are multiplied by the mask, so locked weights retain their initial injected values.

pith-pipeline@v1.3.0-daily-deepseek · 21036 in / 14540 out tokens · 149439 ms · 2026-07-31T23:35:19.381189+00:00 · methodology

0 comments
read the original abstract

Existing model inversion (MI) attacks predominantly rely on post-training optimization to recover private data from model outputs. However, these methods are fundamentally constrained by the target model's generalization bottleneck, often yielding generic features rather than specific identities, particularly on high-dimensional datasets. In this paper, we introduce GradLock, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters. Operating within a compromised supply chain context, GradLock leverages stateless deterministic indexing to establish isolated data vaults and employs dynamic gradient locking to prevent payload degradation during the optimization process. This mechanism allows the adversary to extract pixel-perfect data from the final model without retaining access to the training environment. Extensive experiments on MNIST, Imagenette, and CelebA demonstrate that GradLock achieves near-lossless reconstruction (SSIM ~ 1.0) and instant extraction (< 1.0s). Compared to existing training-time injection methods, our approach exhibits superior robustness against standard deployment optimizations, including quantization, pruning, and fine-tuning. Furthermore, a user deployment study reveals that 93.3% of participants failed to detect the malicious logic, highlighting a severe blind spot in the security of modern AI supply chains.

Figures

Figures reproduced from arXiv: 2607.27886 by Chansu Han, Han-Ju Lee, Jin-Seong Kim, Seok-Hwan Choi, Seok-Won Hong, Takeshi Takahashi, Tomohiro Morikawa.

Figure 1
Figure 1. Figure 1: Comparison of Training-time Data Injections: (a) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Representative examples of optimization-based model inversion attacks. Despite targeting simple digit classes, the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Illustration of three different environments con [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Overview of the GradLock framework. The adversary (a) distributes a malicious training toolchain, (b) the user trains and shares the resulting model, and (c) the adversary extracts the embedded training data. Inside the pipeline, the attack involves (b1) gradient locking, (b2) random data sampling, and (b3) data injection into model weights. ecosystem’s culture of model sharing (e.g., uploading to pub￾lic … view at source ↗
Figure 5
Figure 5. Figure 5: Visual comparison of reconstructed samples across [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Extraction results of GradLock under various post￾training optimizations. Note that the LSB baseline is omitted as it suffers from catastrophic failure under these perturba￾tions. results confirm that direct injection strategies effectively bypass the generalization bottleneck, ensuring high-quality data recovery after training. Quantitative Comparison of Attack Performance [PITH_FULL_IMAGE:figures/full_f… view at source ↗
Figure 7
Figure 7. Figure 7: Effect of 𝜌 on gradient locking and accuracy degra￾dation (%). 4.4 Generalizability to Transformer Architectures To evaluate architectural generalizability, we apply GradLock to Vision Transformer (ViT) and Swin Transformer (SwinT) [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Effect of Model Size on Accuracy training runs. For instance, the mean weight shifts only from 0.033 to 0.049 on MNIST and remains nearly unchanged on Imagenette (from 0.002 to -0.003). Furthermore, we evaluate the KS-norm to compare between the standard normal distribution and the weight distribution of the model. The results indicate that the KS-norm values for GradLock-attacked models are nearly identic… view at source ↗
Figure 9
Figure 9. Figure 9: Visual comparison of reconstructed samples across [PITH_FULL_IMAGE:figures/full_fig_p013_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Effect of normalization scale on training loss (left) and test accuracy drop rate (right). [PITH_FULL_IMAGE:figures/full_fig_p016_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 3 canonical work pages

  1. [1]

    AI Hub. 2024. Data Safety Zone. https://aihub.or.kr/intrcn/safetyzoneintrcn.do? currMenu=306. Operated by the Ministry of Science and ICT, Korea. Accessed: 2025-04-24

    2024

  2. [2]

    Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and X. Zhang. 2022. MIRROR: Model Inversion for Deep Learning Network with High Fidelity.Proceedings 2022 Network and Distributed System Security Symposium(2022). https://api.semanticscholar.org/CorpusID:247313542

    2022

  3. [3]

    Alex Birsan. 2021. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies. Black Hat USA

    2021

  4. [4]

    2023.Harnessing the Power of Secure Data Environments (SDEs) in Healthcare

    System C. 2023.Harnessing the Power of Secure Data Environments (SDEs) in Healthcare. https://www.systemc.com/harnessing-the-power-of-secure-data- environments-sdes-in-healthcare/ Accessed: 2025-04-25

    2023

  5. [5]

    Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. 2021. Knowledge-enriched dis- tributional model inversion attacks. InProceedings of the IEEE/CVF international conference on computer vision. 16178–16187

    2021

  6. [6]

    Youngwoo Cho, Beomsoo Kim, and Jaegul Choo. 2021. Stego Networks: Infor- mation Hiding on Deep Neural Networks. https://openreview.net/forum?id= 5tJMTHv0l8g

    2021

  7. [7]

    Department of Health and Social Care, UK. 2023. Secure Data En- vironment for NHS Health and Social Care Data: Policy Guidelines. https://www.gov.uk/government/publications/secure-data-environment- policy-guidelines/secure-data-environment-for-nhs-health-and-social-care- data-policy-guidelines Accessed: 2025-04-25

    2023

  8. [8]

    Shi Dong, Ping Wang, and Khushnood Abbas. 2021. A survey on deep learning and its applications.Computer Science Review40 (2021), 100379. doi:10.1016/j. cosrev.2021.100379

    arXiv 2021

  9. [9]

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015. Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communica- tions Security(Denver, Colorado, USA)(CCS ’15). Association for Computing Machinery, New York, NY, USA, 1322–1333. doi:10.1145/2810103.2813677

    arXiv 2015

  10. [10]

    Ben Goldacre and Jessica Morley. 2022. Better, broader, safer: using health data for research and analysis.UK Department of Health and Social Care(2022)

    2022

  11. [11]

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. 2022. Recon- structing training data from trained neural networks. InProceedings of the 36th International Conference on Neural Information Processing Systems(New Orleans, LA, USA)(NeurIPS ’22). Curran Associates Inc., Red Hook, NY, USA, Article 1665, 14 pages

    2022

  12. [12]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

    2016

  13. [13]

    Yingzhe He, Guozhu Meng, Kai Chen, Xingbo Hu, and Jinwen He. 2022. Towards Security Threats of Deep Learning Systems: A Survey.IEEE Transactions on Software Engineering48, 5 (2022), 1743–1770. doi:10.1109/TSE.2020.3034721

    arXiv 2022

  14. [14]

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger

  15. [15]

    Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021. Practical Blind Membership Inference Attack via Differen- tial Comparisons. InProceedings 2021 Network and Distributed System Security Symposium (NDSS 2021). Internet Society. doi:10.14722/ndss.2021.24293

    arXiv 2021

  16. [16]

    Piyush Jindal. 2024. Privacy-Preserving Data Analysis: Implications of Clean Rooms. doi:10.13140/RG.2.2.16845.65768

    arXiv 2024

  17. [17]

    Guobiao Li, Sheng Li, Meiling Li, Zhenxing Qian, and Xinpeng Zhang

  18. [18]

    Zeren Luo, Chuangwei Zhu, Lujie Fang, Guang Kou, Ruitao Hou, and Xianmin Wang. 2022. An effective and practical gradient inversion attack.International Journal of Intelligent Systems37 (08 2022). doi:10.1002/int.22997

    work page doi:10.1002/int.22997 2022

  19. [19]

    Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai- Man Cheung. 2023. Re-thinking model inversion attacks against deep neural networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 16384–16393

    2023

  20. [20]

    Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. 2025. Pseudo- private data guided model inversion attacks. InProceedings of the 38th Inter- national Conference on Neural Information Processing Systems(Vancouver, BC, Canada)(NeurIPS ’24). Curran Associates Inc., Red Hook, NY, USA, Article 1051, 38 pages

    2025

  21. [21]

    Yixiang Qiu, Hao Fang, Hongyao Yu, Bin Chen, MeiKang Qiu, and Shu-Tao Xia

  22. [22]

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. InProceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS)

    2019

  23. [23]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Mem- bership Inference Attacks Against Machine Learning Models. In2017 IEEE Sym- posium on Security and Privacy (SP). 3–18. doi:10.1109/SP.2017.41

    doi:10.1109/sp.2017.41 2017

  24. [24]

    Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556(2014)

    Pith/arXiv arXiv 2014

  25. [25]

    Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. 2017. Machine learning models that remember too much. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS). 587–601

    2017

  26. [26]

    Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. 2021. Variational model inversion attacks. InProceedings of the 35th International Conference on Neural Information Processing Systems (NeurIPS ’21). Curran Associates Inc., Red Hook, NY, USA, Article 743, 14 pages

    2021

  27. [27]

    Bovik, H.R

    Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity.IEEE Transactions on Image Processing13, 4 (2004), 600–612. doi:10.1109/TIP.2003.819861

    arXiv 2004

  28. [28]

    Wencheng Yang, Song Wang, Di Wu, Taotao Cai, Yanming Zhu, Shicheng Wei, Yiying Zhang, Xu Yang, Zhaohui Tang, and Yan Li. 2025. Deep learning model inversion attacks and defenses: a comprehensive survey.Artificial Intelligence Review58, 8 (2025), 242. doi:10.1007/s10462-025-11248-0

    work page doi:10.1007/s10462-025-11248-0 2025

  29. [29]

    Zipeng Ye, Wenjian Luo, Qi Zhou, and Yubo Tang. 2024. High-Fidelity Gradient Inversion in Distributed Learning.Proceedings of the AAAI Conference on Artificial Intelligence38, 18 (Mar. 2024), 19983–19991. doi:10.1609/aaai.v38i18.29975

    work page doi:10.1609/aaai.v38i18.29975 2024

  30. [30]

    Alvarez, Arun Mallya, Derek Hoiem, Niraj K

    Hongxu Yin, Pavlo Molchanov, Zhizhong Li, Jose M. Alvarez, Arun Mallya, Derek Hoiem, Niraj K. Jha, and Jan Kautz. 2020. Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). arXiv:1912.08795 [cs.LG] https://arxiv.org/abs/1912.08795

    Pith/arXiv arXiv 2020

  31. [31]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  32. [32]

    Zhang, R

    Y. Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song. 2020. The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, Los Alamitos, CA, USA, 250–258. doi:10.1109/CVPR42600. 2020.00033

    arXiv 2020

  33. [33]

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610(2020)

    Pith/arXiv arXiv 2020

  34. [34]

    Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han. 2024. Model Inversion Attacks: A Survey of Approaches and Counter- measures.arXiv preprint arXiv:2411.10023(2024)

    arXiv 2024

  35. [35]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep Leakage from Gradients. In Advances in Neural Information Processing Systems, H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (Eds.), Vol. 32. Cur- ran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2019/file/ 60a6c4002cc7b29142def8871531281a-Paper.pdf

    2019

  36. [36]

    Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel

  37. [2017]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 4700–4708

  38. [2018]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition. Don’t Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components Conference’17, July 2017, Washington, DC, USA Table 9: Effect of 𝜌 on gradient locking, storage capacity, and ...

    2017

  39. [2019]

    Information Security Application

    Smallworld with high risks: a study of security threats in the npm ecosystem. InProceedings of the 28th USENIX Conference on Security Symposium(Santa Clara, CA, USA)(SEC’19). USENIX Association, USA, 995–1010. A GradLock Training Procedure We formally describe the complete training and extraction proce- dure ofGradLockin Algorithm 1. The process is divide...

    2017

  40. [2023]

    arXiv:2307.03444 [cs.CR] https://arxiv.org/abs/2307.03444

    Towards Deep Network Steganography: From Networks to Networks. arXiv:2307.03444 [cs.CR] https://arxiv.org/abs/2307.03444

    Pith/arXiv arXiv

  41. [2024]

    InEuropean Conference on Computer Vision

    A closer look at gan priors: Exploiting intermediate features for enhanced model inversion attacks. InEuropean Conference on Computer Vision. Springer, 109–126