Pith. sign in

REVIEW 5 major objections 6 minor 41 references

A compromised training toolchain can embed exact copies of private images into a model's weight matrix, lock them against gradient updates, and recover them pixel-for-pixel from the deployed model—even after quantization, pruning, and fine-

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:37 UTC pith:F72OWLFI

load-bearing objection Injection/extraction is trivially correct, but Eq. 4's dimensional assumption clashes with the stated 1,024-wide classifier layers, the capacity math is internally inconsistent, and the robustness evidence is qualitative—so the paper as written does not support its central claims. the 5 major comments →

arxiv 2607.27886 v2 pith:F72OWLFI submitted 2026-07-30 cs.CR

Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components

Jin-Seong Kim , Han-Ju Lee , Seok-Won Hong , Takeshi Takahashi , Chansu Han , Tomohiro Morikawa , Seok-Hwan Choi This is my paper
classification cs.CR
keywords training-time injection attackgradient lockingsupply chain attackmodel parameter steganographyprivacy leakagedata exfiltrationmodel inversionneural network security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

GradLock claims to close the persistence gap in training-time injection attacks. Its central idea is to treat a subset of a model's weights as 'data vaults': during initialization, private training samples are written directly into chosen rows of a classifier weight matrix and then frozen with a gradient mask, so the surrounding network trains normally while the payload sits untouched. Because the vault locations are derived from a stateless sine-based formula, the attacker can locate and read them after deployment without any metadata or access to the training environment. The result, if it holds, is a covert exfiltration channel that survives standard optimizations like quantization and pruning, which destroy earlier bit-level steganography, and that bypasses the fidelity limits of post-training model inversion attacks. The paper supports this with near-lossless reconstruction metrics (SSIM ≈ 1.0), sub-second extraction, and a user study in which 93.3% of participants failed to detect the malicious logic.

Core claim

GradLock's core claim is that direct parameter injection plus selective gradient locking yields a persistent, high-fidelity training-time attack. The adversary picks deterministic row indices using a sine function, writes each normalized, flattened image into one such row scaled by a small factor α, and masks gradients at those positions for every backward pass. Since the locked weights remain part of the forward computation, the model learns to accommodate them, and since they never receive updates, they retain the injected values 'subject only to negligible floating-point precision variances'. The authors report that this works on CNNs and Transformers, that SSIM stays ~1.0 across MNIST, I

What carries the argument

Selective gradient locking is the load-bearing mechanism: a binary mask M zeroes out gradients at injected positions during backpropagation, freezing those weights while keeping them active in the forward pass. This is paired with stateless deterministic indexing, which uses the sine of a linear index to scatter vault rows pseudo-randomly across the target layer, making the locations reproducible without stored metadata and resistant to simple pattern detectors. Payload injection writes a flattened, normalized sample scaled by α into one row; extraction divides by α and reshapes. The combination is what separates GradLock from earlier bit-level steganography: the payload is 'learned around'

Load-bearing premise

Each private image must fit entirely into one row of the target weight tensor, and the paper never demonstrates that a real VGG/ResNet/DenseNet classifier layer has a row wide enough for its 64×64 RGB images while also keeping accuracy intact.

What would settle it

Run GradLock's exact injection and locking procedure on a standard VGG-16 classification head with its natural input width for 64×64 images, without enlarging the hidden dimension; if the layer width is smaller than 12,288, the attack as written cannot store a full sample, and the near-lossless reconstruction numbers should not reproduce. More directly, check whether a 64×64 RGB sample can be read back from a layer of width 1,024: numerical overflow or reshaping failure would falsify the paper's stated configuration.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If GradLock works as claimed, a model trained with any compromised open-source toolchain can silently carry exact copies of private training samples, and shipping the model file is enough to exfiltrate them.
  • Standard deployment steps that are often assumed to sanitize models—8-bit quantization, 30% magnitude pruning, and 20 epochs of fine-tuning—would not destroy the payload; the paper shows structural identity survives them.
  • The attack transfers from CNNs to Vision Transformers and Swin Transformers, so it is not tied to a particular architecture family.
  • Because extraction takes under a second and requires no training-environment access, the attacker does not need ongoing presence in the victim's infrastructure.
  • The user study claims 93.3% of participants submitted the trained model without inspecting the malicious initialization routine, suggesting code audits do not catch this class of attack.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A testable extension: apply GradLock to larger images or higher-resolution tasks under the same reported settings; the requirement that each sample fit in a single weight row implies the attack's capacity and even feasibility collapse unless the target layer is unusually wide.
  • The paper's default hidden width of 1,024 is not reconciled with its 64×64 RGB images (12,288 values per sample); if the reported results used the stated settings, the target layer must have had an unreported large width, and it is an open question whether standard classifiers have such layers.
  • The robustness claims might not extend to defenses that alter the weight values themselves, such as weight averaging, knowledge distillation, or quantization-aware training, which the paper does not test.
  • The sine indexing's collision behavior is acknowledged as a regularizer that limits capacity; an adversary wanting more capacity would need to abandon the stateless property or use multiple layers.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes GradLock, a training-time data-injection attack. An adversary who distributes a malicious training toolchain embeds flattened, normalized private images into selected rows of a classifier's weight matrix during initialization, masks gradients for those rows so they remain fixed during training, and later reconstructs the images from the final model by reading the locked weights and rescaling. The paper claims near-lossless reconstruction (SSIM≈1.0), robustness to quantization/pruning/fine-tuning, stealthiness against statistical and human inspection, and superior efficiency over post-training model inversion attacks. Experiments are reported on MNIST, Imagenette, and CelebA with CNN and Transformer backbones, and a user study (n=30) is used to support feasibility.

Significance. The idea of using gradient locking to protect an injected payload is a plausible route toward persistent, supply-chain-style data exfiltration, and the paper is clearly written with a reproducible artifact (code link provided). The comparison against post-training MI attacks is appropriate and the user study adds a practical dimension. However, the manuscript's central claims rest on a flawed geometric premise: the injection mechanism as defined in Eq. (4) requires the target weight row to be as wide as the flattened image, which conflicts with the reported classifier dimensions. The capacity analysis is internally inconsistent, and the robustness evaluation — the paper's key differentiating contribution — is presented only as qualitative images with no post-perturbation metrics. Because the near-lossless fidelity result is a direct consequence of the encoding/decoding construction, the paper does not currently demonstrate a viable attack on standard architectures. If the dimensional and capacity issues are resolved and quantitative robustness evidence is provided, the core idea could be valuable.

major comments (5)
  1. [§3.2.3, Eq. (4); §4.1] The injection requires each selected row of the target weight matrix to have width d=12,288 for 64×64 RGB inputs (4,096 for MNIST). Section 4.1 states the classifier has a fixed hidden dimension of 1,024 across all layers and targets the final FC layer. Standard final FC layers for the evaluated architectures have input widths ≤4,096, typically 512–1,024. Algorithm 1's precondition W∈R^{N_row×d} makes this an explicit assumption. No table reports actual target-layer shapes. Consequently, the attack as written cannot store a full-resolution RGB sample in the described standard classifier heads.
  2. [§3.2.3; Algorithm 1; Table 9] Capacity is internally inconsistent. Text states capacity=floor(|R|/d), but Eq. (4)/Algorithm 1 store one sample per selected row. Table 9 reports 146 images at ρ=0.5 with 48.98% locked weights. Under the row interpretation, a 1,024×1,024 layer gives ~501 rows and capacity ~501, not 146; under the parameter interpretation, 146×d parameters for d=4,096 require 598k locked params, or ~58% of a 1M-param layer, not 48.98%. For d=12,288 the discrepancy is larger. The reported numbers cannot all be true.
  3. [§4.3, Fig. 6] Robustness claims are supported only by qualitative visual inspection. No post-perturbation SSIM/ASR/LPIPS values, error bars, or comparisons to the LSB baseline are given. The text states 'core semantic features remain intact' and 'facial landmarks are preserved' without any quantitative backing. This is the paper's central claimed advantage; it needs actual measurements.
  4. [§4.2, Tables 2–3] Near-lossless fidelity is a mathematical identity, not an empirical result. Eq. (4) writes α·Flatten(x_i) into locked weights and Eq. (5) divides by α before reshaping; in the absence of post-training modification, reconstruction is exact by construction. Tables 2–3 therefore validate the implementation of the inverse transform, not the attack's robustness. The meaningful evaluation under perturbation is missing (see comment on §4.3).
  5. [Algorithm 1; §B.2] The injection loop writes W[R_i,:] = ... for all i in [0,|R|). Eq. (1) is shown in §B.2 to produce duplicate indices ('index collisions'). A later write then overwrites the payload of an earlier index, so duplicate collisions destroy previously injected samples. This contradicts §3.2.3's statement that every sample occupies exclusive storage and prevents collision. The algorithm must either skip duplicates or derive a unique index set; this is not described.
minor comments (6)
  1. [§4.7 vs Appendix C] The task is described as 'facial recognition training task' in §4.7 but as a 'binary classifier to identify a specific target person' and 'digital forensic tool' in Appendix C. Please reconcile.
  2. [Table 9] Define 'Locked Gradient (%)' precisely — fraction of unique locked rows/parameters? The column is used to infer capacity and should be unambiguous.
  3. [§3.2.1, Eq. (1)] For ρ=0 the denominator is zero; for small ρ the upper bound ⌊ρN_row⌋−1 can be negative. Specify the admissible range of ρ.
  4. [§4.6] 'KS-norm' is not defined; clarify whether it is the KS statistic against a Gaussian and how it differs from the two-sample D-statistic reported in the same paragraph.
  5. [Figure 6] The note that LSB is omitted due to catastrophic failure should be accompanied by at least a quantitative statement (e.g., SSIM=0 or a textual description of the measured failure) so the comparison is meaningful.
  6. [References] Several references (e.g., [2], [5], [20]) lack complete venue/publisher details; please complete the bibliography entries.

Circularity Check

1 steps flagged

The near-lossless reconstruction (SSIM ≈ 1.0) is a definitional identity: Eq. (5) simply inverts Eq. (4), so perfect fidelity is hard-coded by construction rather than empirically demonstrated.

specific steps
  1. self definitional [Sec. 3.2.3–3.2.4, Eqs. (4)–(5); reported in Sec. 4.2, Table 2]
    "𝑊𝑟𝑖 ,1:𝑑←𝛼·Flatten(𝑥 𝑖 ),(4) ... ˆ𝑥𝑖 =Reshape(1 𝛼·𝑊 𝑟𝑖 ,1:𝑑)(5) ... they retain their injected values, subject only to negligible floating-point precision variances."

    The extraction operation is defined as the exact inverse of the injection operation. If the locked indices are unchanged, x̂_i = Reshape((1/α)·α·Flatten(x_i)) = x_i. Therefore the SSIM ≈ 1.000 and LPIPS ≈ 0.000 results in Table 2 are consequences of the equation pair, not empirical discoveries. The paper presents these metrics as evidence of the attack's fidelity, but they provide no information beyond the fact that the weights were overwritten with scaled copies of the samples and then read back. The claimed 'near-lossless reconstruction' reduces to its own input by construction.

full rationale

GradLock's central novelty is the gradient-locking mechanism that keeps injected weights fixed during training and preserves them through post-training operations. The fidelity of direct storage is tautological: Eq. (5) undoes Eq. (4). The paper reports SSIM = 1.000 for both LSB and GradLock, which confirms that both are direct encodings rather than learned reconstructions. This is the only load-bearing circular step found. The robustness claims against quantization, pruning, and fine-tuning are empirical claims; they do not reduce to an equation identity and are not backed by a self-citation chain. No load-bearing self-citations were found; the references are to external prior work. The capacity inconsistency (Eq. 4 requires d = 12,288 for 64×64 RGB, while the classifier width is fixed at 1,024, making Table 9's 146-image capacity irreconcilable) is a correctness and consistency risk, not circularity, and does not affect the circularity score. Because the headline fidelity metric is hard-coded by the injection/extraction equations while other contributions (persistence, stealth, deployment study) are independent, the appropriate circularity score is 6.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 0 invented entities

The core mechanism adds no new physical or mathematical entities; 'data vaults' are just frozen parameter indices. The load-bearing assumptions are behavioral (victim trust), architectural (layer width), and two tuned scalars (α, ρ).

free parameters (4)
  • α (scaling factor) = 0.01
    Chosen by ablation (Sec. 4.5.1, App. B.1) to balance training stability, accuracy, and survival of quantization; not derived from first principles.
  • ρ (gradient locking ratio) = 0.5
    Chosen by ablation (Sec. 4.5.2, Table 9) to keep accuracy drop around 0.2% while providing capacity for 146 images.
  • Classifier hidden dimension = 1,024
    Introduced in Sec. 4.1 to 'secure sufficient capacity'; this modifies the victim model and is not a standard architectural property.
  • Maximum parameter allocation = 60% of target layer
    Ad hoc conservative cap in Sec. 3.2.3 to preserve task accuracy; no derivation is provided.
axioms (6)
  • domain assumption Victim uses the supplied toolchain without inspection or modification.
    Threat model Sec. 3.1.1; without this, the injected initialization logic is never executed.
  • domain assumption No privacy defenses (DP, adversarial training) or runtime gradient instrumentation are in place.
    Threat model Sec. 3.1.1; any such defense could break the attack or detect the gradient masking.
  • ad hoc to paper The target weight matrix has width equal to the flattened sample dimension.
    Eq. 4 writes one full sample into one row W[r_i, 1:d]; this is required for the attack as written but is not satisfied by the reported standard architectures.
  • standard math Locked weights remain active in the forward pass while excluded from gradients.
    Eqs. 2–3 describe standard autograd masking; uncontroversial in isolation.
  • ad hoc to paper α=0.01 is simultaneously small enough to avoid training instability and large enough to survive INT8 quantization.
    Empirically tuned in Sec. 4.5 and App. B; no general guarantee or quantitative post-quantization fidelity is provided.
  • ad hoc to paper Duplicate indices from the sine formula act as a harmless regularizer rather than destroying payload samples.
    App. B.2 notes collisions; the paper does not quantify how many samples are overwritten by collisions.

pith-pipeline@v1.3.0-alltime-deepseek · 21128 in / 20307 out tokens · 227454 ms · 2026-08-03T01:37:54.269598+00:00 · methodology

0 comments
read the original abstract

Existing model inversion (MI) attacks predominantly rely on post-training optimization to recover private data from model outputs. However, these methods are fundamentally constrained by the target model's generalization bottleneck, often yielding generic features rather than specific identities, particularly on high-dimensional datasets. In this paper, we introduce GradLock, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters. Operating within a compromised supply chain context, GradLock leverages stateless deterministic indexing to establish isolated data vaults and employs dynamic gradient locking to prevent payload degradation during the optimization process. This mechanism allows the adversary to extract pixel-perfect data from the final model without retaining access to the training environment. Extensive experiments on MNIST, Imagenette, and CelebA demonstrate that GradLock achieves near-lossless reconstruction (SSIM ~ 1.0) and instant extraction (< 1.0s). Compared to existing training-time injection methods, our approach exhibits superior robustness against standard deployment optimizations, including quantization, pruning, and fine-tuning. Furthermore, a user deployment study reveals that 93.3% of participants failed to detect the malicious logic, highlighting a severe blind spot in the security of modern AI supply chains.

Figures

Figures reproduced from arXiv: 2607.27886 by Chansu Han, Han-Ju Lee, Jin-Seong Kim, Seok-Hwan Choi, Seok-Won Hong, Takeshi Takahashi, Tomohiro Morikawa.

Figure 1
Figure 1. Figure 1: Comparison of Training-time Data Injections: (a) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Representative examples of optimization-based model inversion attacks. Despite targeting simple digit classes, the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Illustration of three different environments con [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Overview of the GradLock framework. The adversary (a) distributes a malicious training toolchain, (b) the user trains and shares the resulting model, and (c) the adversary extracts the embedded training data. Inside the pipeline, the attack involves (b1) gradient locking, (b2) random data sampling, and (b3) data injection into model weights. ecosystem’s culture of model sharing (e.g., uploading to pub￾lic … view at source ↗
Figure 5
Figure 5. Figure 5: Visual comparison of reconstructed samples across [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Extraction results of GradLock under various post￾training optimizations. Note that the LSB baseline is omitted as it suffers from catastrophic failure under these perturba￾tions. results confirm that direct injection strategies effectively bypass the generalization bottleneck, ensuring high-quality data recovery after training. Quantitative Comparison of Attack Performance [PITH_FULL_IMAGE:figures/full_f… view at source ↗
Figure 7
Figure 7. Figure 7: Effect of 𝜌 on gradient locking and accuracy degra￾dation (%). 4.4 Generalizability to Transformer Architectures To evaluate architectural generalizability, we apply GradLock to Vision Transformer (ViT) and Swin Transformer (SwinT) [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Effect of Model Size on Accuracy training runs. For instance, the mean weight shifts only from 0.033 to 0.049 on MNIST and remains nearly unchanged on Imagenette (from 0.002 to -0.003). Furthermore, we evaluate the KS-norm to compare between the standard normal distribution and the weight distribution of the model. The results indicate that the KS-norm values for GradLock-attacked models are nearly identic… view at source ↗
Figure 9
Figure 9. Figure 9: Visual comparison of reconstructed samples across [PITH_FULL_IMAGE:figures/full_fig_p013_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Effect of normalization scale on training loss (left) and test accuracy drop rate (right). [PITH_FULL_IMAGE:figures/full_fig_p016_10.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 4 linked inside Pith

  1. [1]

    AI Hub. 2024. Data Safety Zone. https://aihub.or.kr/intrcn/safetyzoneintrcn.do? currMenu=306. Operated by the Ministry of Science and ICT, Korea. Accessed: 2025-04-24

    2024

  2. [2]

    Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and X. Zhang. 2022. MIRROR: Model Inversion for Deep Learning Network with High Fidelity.Proceedings 2022 Network and Distributed System Security Symposium(2022). https://api.semanticscholar.org/CorpusID:247313542

    2022

  3. [3]

    Alex Birsan. 2021. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies. Black Hat USA

    2021

  4. [4]

    2023.Harnessing the Power of Secure Data Environments (SDEs) in Healthcare

    System C. 2023.Harnessing the Power of Secure Data Environments (SDEs) in Healthcare. https://www.systemc.com/harnessing-the-power-of-secure-data- environments-sdes-in-healthcare/ Accessed: 2025-04-25

    2023

  5. [5]

    Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. 2021. Knowledge-enriched dis- tributional model inversion attacks. InProceedings of the IEEE/CVF international conference on computer vision. 16178–16187

    2021

  6. [6]

    Youngwoo Cho, Beomsoo Kim, and Jaegul Choo. 2021. Stego Networks: Infor- mation Hiding on Deep Neural Networks. https://openreview.net/forum?id= 5tJMTHv0l8g

    2021

  7. [7]

    Department of Health and Social Care, UK. 2023. Secure Data En- vironment for NHS Health and Social Care Data: Policy Guidelines. https://www.gov.uk/government/publications/secure-data-environment- policy-guidelines/secure-data-environment-for-nhs-health-and-social-care- data-policy-guidelines Accessed: 2025-04-25

    2023

  8. [8]

    Shi Dong, Ping Wang, and Khushnood Abbas. 2021. A survey on deep learning and its applications.Computer Science Review40 (2021), 100379. doi:10.1016/j. cosrev.2021.100379

    arXiv 2021

  9. [9]

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015. Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communica- tions Security(Denver, Colorado, USA)(CCS ’15). Association for Computing Machinery, New York, NY, USA, 1322–1333. doi:10.1145/2810103.2813677

    arXiv 2015

  10. [10]

    Ben Goldacre and Jessica Morley. 2022. Better, broader, safer: using health data for research and analysis.UK Department of Health and Social Care(2022)

    2022

  11. [11]

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. 2022. Recon- structing training data from trained neural networks. InProceedings of the 36th International Conference on Neural Information Processing Systems(New Orleans, LA, USA)(NeurIPS ’22). Curran Associates Inc., Red Hook, NY, USA, Article 1665, 14 pages

    2022

  12. [12]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

    2016

  13. [13]

    Yingzhe He, Guozhu Meng, Kai Chen, Xingbo Hu, and Jinwen He. 2022. Towards Security Threats of Deep Learning Systems: A Survey.IEEE Transactions on Software Engineering48, 5 (2022), 1743–1770. doi:10.1109/TSE.2020.3034721

    arXiv 2022

  14. [14]

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger

  15. [15]

    Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021. Practical Blind Membership Inference Attack via Differen- tial Comparisons. InProceedings 2021 Network and Distributed System Security Symposium (NDSS 2021). Internet Society. doi:10.14722/ndss.2021.24293

    arXiv 2021

  16. [16]

    Piyush Jindal. 2024. Privacy-Preserving Data Analysis: Implications of Clean Rooms. doi:10.13140/RG.2.2.16845.65768

    arXiv 2024

  17. [17]

    Guobiao Li, Sheng Li, Meiling Li, Zhenxing Qian, and Xinpeng Zhang

  18. [18]

    Zeren Luo, Chuangwei Zhu, Lujie Fang, Guang Kou, Ruitao Hou, and Xianmin Wang. 2022. An effective and practical gradient inversion attack.International Journal of Intelligent Systems37 (08 2022). doi:10.1002/int.22997

    doi:10.1002/int.22997 2022

  19. [19]

    Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai- Man Cheung. 2023. Re-thinking model inversion attacks against deep neural networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 16384–16393

    2023

  20. [20]

    Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. 2025. Pseudo- private data guided model inversion attacks. InProceedings of the 38th Inter- national Conference on Neural Information Processing Systems(Vancouver, BC, Canada)(NeurIPS ’24). Curran Associates Inc., Red Hook, NY, USA, Article 1051, 38 pages

    2025

  21. [21]

    Yixiang Qiu, Hao Fang, Hongyao Yu, Bin Chen, MeiKang Qiu, and Shu-Tao Xia

  22. [22]

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. InProceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS)

    2019

  23. [23]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Mem- bership Inference Attacks Against Machine Learning Models. In2017 IEEE Sym- posium on Security and Privacy (SP). 3–18. doi:10.1109/SP.2017.41

    doi:10.1109/sp.2017.41 2017

  24. [24]

    Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556(2014)

    Pith/arXiv arXiv 2014

  25. [25]

    Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. 2017. Machine learning models that remember too much. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS). 587–601

    2017

  26. [26]

    Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. 2021. Variational model inversion attacks. InProceedings of the 35th International Conference on Neural Information Processing Systems (NeurIPS ’21). Curran Associates Inc., Red Hook, NY, USA, Article 743, 14 pages

    2021

  27. [27]

    Bovik, H.R

    Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity.IEEE Transactions on Image Processing13, 4 (2004), 600–612. doi:10.1109/TIP.2003.819861

    arXiv 2004

  28. [28]

    Wencheng Yang, Song Wang, Di Wu, Taotao Cai, Yanming Zhu, Shicheng Wei, Yiying Zhang, Xu Yang, Zhaohui Tang, and Yan Li. 2025. Deep learning model inversion attacks and defenses: a comprehensive survey.Artificial Intelligence Review58, 8 (2025), 242. doi:10.1007/s10462-025-11248-0

    doi:10.1007/s10462-025-11248-0 2025

  29. [29]

    Zipeng Ye, Wenjian Luo, Qi Zhou, and Yubo Tang. 2024. High-Fidelity Gradient Inversion in Distributed Learning.Proceedings of the AAAI Conference on Artificial Intelligence38, 18 (Mar. 2024), 19983–19991. doi:10.1609/aaai.v38i18.29975

    doi:10.1609/aaai.v38i18.29975 2024

  30. [30]

    Alvarez, Arun Mallya, Derek Hoiem, Niraj K

    Hongxu Yin, Pavlo Molchanov, Zhizhong Li, Jose M. Alvarez, Arun Mallya, Derek Hoiem, Niraj K. Jha, and Jan Kautz. 2020. Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). arXiv:1912.08795 [cs.LG] https://arxiv.org/abs/1912.08795

    Pith/arXiv arXiv 2020

  31. [31]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  32. [32]

    Zhang, R

    Y. Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song. 2020. The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, Los Alamitos, CA, USA, 250–258. doi:10.1109/CVPR42600. 2020.00033

    arXiv 2020

  33. [33]

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610(2020)

    Pith/arXiv arXiv 2020

  34. [34]

    Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han. 2024. Model Inversion Attacks: A Survey of Approaches and Counter- measures.arXiv preprint arXiv:2411.10023(2024)

    arXiv 2024

  35. [35]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep Leakage from Gradients. In Advances in Neural Information Processing Systems, H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (Eds.), Vol. 32. Cur- ran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2019/file/ 60a6c4002cc7b29142def8871531281a-Paper.pdf

    2019

  36. [36]

    Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel

  37. [2017]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 4700–4708

  38. [2018]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition. 14 Don’t Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components CCS ’26, November 15–19, 2026, The Hague, Netherlands. Table 9: Effect of 𝜌 on gradient locking, storage ca...

    2026

  39. [2019]

    Information Security Application

    Smallworld with high risks: a study of security threats in the npm ecosystem. InProceedings of the 28th USENIX Conference on Security Symposium(Santa Clara, CA, USA)(SEC’19). USENIX Association, USA, 995–1010. A GradLock Training Procedure We formally describe the complete training and extraction proce- dure ofGradLockin Algorithm 1. The process is divide...

    2026

  40. [2023]

    arXiv:2307.03444 [cs.CR] https://arxiv.org/abs/2307.03444

    Towards Deep Network Steganography: From Networks to Networks. arXiv:2307.03444 [cs.CR] https://arxiv.org/abs/2307.03444

    Pith/arXiv arXiv

  41. [2024]

    InEuropean Conference on Computer Vision

    A closer look at gan priors: Exploiting intermediate features for enhanced model inversion attacks. InEuropean Conference on Computer Vision. Springer, 109–126