Understanding Deep Image Representations by Inverting Them
Not on the map. Why?
Abstract (arXiv)
Image representations, from SIFT and Bag of Visual Words to Convolutional Neural Networks (CNNs), are a crucial component of almost any image understanding system. Nevertheless, our understanding of them remains limited. In this paper we conduct a direct analysis of the visual information contained in representations by asking the following question: given an encoding of an image, to which extent is it possible to reconstruct the image itself? To answer this question we contribute a general framework to invert representations. We show that this method can invert representations such as HOG and SIFT more accurately than recent alternatives while being applicable to CNNs too. We then use this technique to study the inverse of recent state-of-the-art CNN image representations for the first time. Among our findings, we show that several layers in CNNs retain photographically accurate information about the image, with different degrees of geometric and photometric invariance.
Key facts. Cited by 403 papers in the map (data through 14 Oct 2026). First posted on arXiv 26 Nov 2014.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 78; 2022: 91; 2023: 84; 2024: 65; 2025: 50; 2026: 35.
403 papers.
Sort:
By area:
- 2021PARE: Part Attention Regressor for 3D Human Body Estimationcited by 337
- 2023DreamSim: Learning New Dimensions of Human Visual Similarity using Synthetic Datacited by 337
- 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
- 2022Splicing ViT Features for Semantic Appearance Transfercited by 209
- 2023Text-To-4D Dynamic Scene Generationcited by 205
- 2023Interpreting CLIP's Image Representation via Text-Based Decompositioncited by 196
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
- 2022Fake it till you make it: Learning transferable representations from synthetic ImageNet clonescited by 172
- 2022From Attribution Maps to Human-Understandable Explanations through Concept Relevance Propagationcited by 141
- 2023Squeeze, Recover and Relabel: Dataset Condensation at ImageNet Scale From A New Perspectivecited by 138
- 2022Natural Language Descriptions of Deep Visual Featurescited by 137
- 2022Reconstructing Training Data from Trained Neural Networkscited by 133
38 more
- 2023Similarity of Neural Network Models: A Survey of Functional and Representational Measurescited by 131
- 2022Toward Transparent AI: A Survey on Interpreting the Inner Structures of Deep Neural Networkscited by 129
- 2023Space-Time Diffusion Features for Zero-Shot Text-Driven Motion Transfercited by 124
- 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 118
- 2021Salient ImageNet: How to discover spurious features in Deep Learning?cited by 114
- 2021Guided Integrated Gradients: An Adaptive Path Method for Removing Noisecited by 102
- 2023Wider and Deeper LLM Networks are Fairer LLM Evaluatorscited by 94
- 2022What do Vision Transformers Learn? A Visual Explorationcited by 76
- 2022Variational Model Inversion Attackscited by 75
- 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
- 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
- 2022On scientific understanding with artificial intelligencecited by 70
- 2023Language Model Inversioncited by 68
- 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
- 2024SelfIE: Self-Interpretation of Large Language Model Embeddingscited by 67
- 2021Contrastive Model Inversion for Data-Free Knowledge Distillationcited by 66
- 2021High Fidelity Visualization of What Your Self-Supervised Representation Knows Aboutcited by 66
- 2024A Multimodal Automated Interpretability Agentcited by 63
- 2025Universal Sparse Autoencoders: Interpretable Cross-Model Concept Alignmentcited by 62
- 2022Visual Recognition with Deep Nearest Centroidscited by 59
- 2023CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Modelscited by 55
- 2024Learning by Reconstruction Produces Uninformative Features For Perceptioncited by 55
- 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
- 2022GradViT: Gradient Inversion of Vision Transformerscited by 53
- 2024Explainable and Interpretable Multimodal Large Language Models: A Comprehensive Surveycited by 52
- 2022Orchestra: Unsupervised Federated Learning via Globally Consistent Clusteringcited by 45
- 2021Categorical Foundations of Gradient-Based Learningcited by 44
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
- 2024Extracting Prompts by Inverting LLM Outputscited by 41
- 2021Towards General Deep Leakage in Federated Learningcited by 40
- 2022A Survey on Gradient Inversion: Attacks, Defenses and Future Directionscited by 40
- 2023DAP: A Dynamic Adversarial Patch for Evading Person Detectorscited by 40
- 2021Biometrics: Trust, but Verifycited by 39
- 2022On the Explainability of Natural Language Processing Deep Modelscited by 38
- 2022Compressed-VFL: Communication-Efficient Learning with Vertically Partitioned Datacited by 36
- 2021One-Class Classification: A Surveycited by 35
- 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
- 2022Explaining Deepfake Detection by Analysing Image Matchingcited by 34
50 most cited of 403 All 403 (JSON)
- 2026Discriminative Score Function: Turning Pretrained Models into Functional Generative Priors14 Oct 2026
- 2026Layer-wise Input Recoverability in Deep Neural Networks9 Oct 2026
- 2026SAGE: Efficient Protected Vision-Language Inference on Smart Glasses8 Oct 2026
- 2026Inverting Multi-Vector Visual Document Indices7 Oct 2026
- 2026Latent Information Sharing for Accelerating Federated Learning1 Oct 2026
- 2026Neuron Activation-based Computation of Logical Explanations for Deep Neural Networks12 Sep 2026
- 2026From Interpretability Methods to Interpretable Models4 Sep 2026
- 2026Defending Wearable VLMs Against Private Attribute Inference26 Aug 2026
- 2026On the Separation of Human and AI-Generated Images in CLIP Embedding Space26 Aug 2026
- 2026Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding24 Aug 2026
- 2026A Privacy Study of Sparse Collaborative Inference17 Aug 2026
- 2026UniDFKD: A Unified Semantic Prior Framework for Architecture-Agnostic Data-Free Knowledge Distillation10 Aug 2026
38 more
- 2026SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels4 Aug 2026
- 2026BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient Leakage27 Jul 2026
- 2026From Preimage Search To Source-Grounded Feature Inversion14 Jul 2026
- 2026Do You Remember? Toward Memory-Centric Multimodal AI7 Jul 2026
- 2026TrustCLIP: Learning Private Visual Features via Adversarial Reconstruction5 Jul 2026
- 2026Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression30 Jun 2026
- 2026Residual-Space Evolutionary Optimization via Flow-based Generative Models18 Jun 2026
- 2026When Generator Replay Degrades: Projected Rehearsal Orchestration for Heterogeneous Federated Class-Incremental Learning14 Jun 2026
- 2026Muon Learns More Robust and Transferable Features than Adam8 Jun 2026
- 2026Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models8 Jun 2026
- 2026RAM: Reachability Across Morphologies8 Jun 2026
- 2026Inverting the Generation Process of Denoising Diffusion Implicit Models: Empirical Evaluation and a Novel Method2 Jun 2026
- 2026Deep Dreams Are Made of This: Visualizing Monosemantic Features in Diffusion Models6 May 2026
- 2026Adjoint Inversion Reveals Holographic Superposition and Destructive Interference in CNN Classifiers30 Apr 2026
- 2026Med-CAM: Minimal Evidence for Explaining Medical Decision Making15 Apr 2026
- 2026From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal7 Apr 2026
- 2026From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera30 Mar 2026
- 2026Select, Hypothesize and Verify: Towards Verified Neuron Concept Interpretation26 Mar 2026
- 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspective25 Mar 2026
- 2026Show Me What You Don't Know: Efficient Sampling from Invariant Sets for Model Validation23 Mar 2026
- 2026ProxyImg: Towards Highly-Controllable Image Representation via Hierarchical Disentangled Proxy Embedding2 Feb 2026
- 2026Deep Models, Shallow Alignment: Uncovering the Granularity Mismatch in Neural Decoding29 Jan 2026
- 2026Multi-channel multi-speaker transformer for speech recognition6 Jan 2026
- 2025Disentangled representations via score-based variational autoencoders18 Dec 2025
- 2025MRD: Using Physically Based Differentiable Rendering to Probe Vision Models for 3D Scene Understanding13 Dec 2025
- 2025VFMF: World Modeling by Forecasting Vision Foundation Model Features12 Dec 2025
- 2025Federated Domain Generalization with Latent Space Inversion11 Dec 2025
- 2025TIE: A Training-Inversion-Exclusion Framework for Visually Interpretable and Uncertainty-Guided Out-of-Distribution Detection28 Nov 2025
- 2025Space Explanations of Neural Network Classification27 Nov 2025
- 2025What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs19 Nov 2025
- 2025Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving18 Nov 2025
- 2025DenoGrad: A Gradient-Based Framework for Data Refinement in Tabular and Time-Series Learning13 Nov 2025
- 2025Understanding Multi-View Transformers28 Oct 2025
- 2025EXP-CAM: Explanation Generation and Circuit Discovery Using Classifier Activation Matching30 Sep 2025
- 2025Activation Matching for Explanation Generation27 Sep 2025
- 2025A Law of Data Reconstruction for Random Features (and Beyond)26 Sep 2025
- 2025Feature Space Analysis by Guided Diffusion Model9 Sep 2025
- 2025Representation Understanding via Activation Maximization10 Aug 2025
50 newest of 403 All 403 (JSON)
- 2022Fake it till you make it: Learning transferable representations from synthetic ImageNet clonescited by 172
- 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
- 2023A General Protocol to Probe Large Vision Models for 3D Physical Understandingcited by 32
- 2023Controllable Inversion of Black-Box Face Recognition Models via Diffusioncited by 22
- 2025From Image to Video: An Empirical Study of Diffusion Representationscited by 15
- 2025Cross-Frame Representation Alignment for Fine-Tuning Video Diffusion Modelscited by 12
- 2022Traditional Classification Neural Networks are Good Generators: They are Competitive with DDPMs and GANscited by 9
- 2024Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstructioncited by 5
- 2024Referee Can Play: An Alternative Approach to Conditional Generation via Model Inversioncited by 4
- 2023Compensation Sampling for Improved Convergence in Diffusion Modelscited by 1
- 2025HonestFace: Towards Honest Face Restoration with One-Step Diffusion Modelcited by 1
- 2025Feature Space Analysis by Guided Diffusion Modelcited by 0
12 most cited of 15 All 15 (JSON)
- 2026Inverting the Generation Process of Denoising Diffusion Implicit Models: Empirical Evaluation and a Novel Method2 Jun 2026
- 2026Deep Dreams Are Made of This: Visualizing Monosemantic Features in Diffusion Models6 May 2026
- 2025Disentangled representations via score-based variational autoencoders18 Dec 2025
- 2025Feature Space Analysis by Guided Diffusion Model9 Sep 2025
- 2025Cross-Frame Representation Alignment for Fine-Tuning Video Diffusion Models10 Jun 2025
- 2025HonestFace: Towards Honest Face Restoration with One-Step Diffusion Model24 May 2025
- 2025From Image to Video: An Empirical Study of Diffusion Representations10 Feb 2025
- 2024Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstruction11 Dec 2024
- 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning29 May 2024
- 2024Referee Can Play: An Alternative Approach to Conditional Generation via Model Inversion26 Feb 2024
- 2023Compensation Sampling for Improved Convergence in Diffusion Models11 Dec 2023
- 2023A General Protocol to Probe Large Vision Models for 3D Physical Understanding10 Oct 2023
12 newest of 15 All 15 (JSON)
- 2021Contrastive Model Inversion for Data-Free Knowledge Distillationcited by 66
- 2023Teacher-Student Architecture for Knowledge Distillation: A Surveycited by 26
- 2022Quantifying the Knowledge in a DNN to Explain Knowledge Distillation for Classificationcited by 19
- 2022Prompting to Distill: Boosting Data-Free Knowledge Distillation via Reinforced Promptcited by 8
- 2024Relation-Guided Adversarial Learning for Data-free Knowledge Transfercited by 6
- 2023Data-Free Distillation of Language Model by Text-to-Text Transfercited by 1
- 2026UniDFKD: A Unified Semantic Prior Framework for Architecture-Agnostic Data-Free Knowledge Distillationcited by 0
- 2026UniDFKD: A Unified Semantic Prior Framework for Architecture-Agnostic Data-Free Knowledge Distillation10 Aug 2026
- 2024Relation-Guided Adversarial Learning for Data-free Knowledge Transfer16 Dec 2024
- 2023Data-Free Distillation of Language Model by Text-to-Text Transfer3 Nov 2023
- 2023Teacher-Student Architecture for Knowledge Distillation: A Survey8 Aug 2023
- 2022Quantifying the Knowledge in a DNN to Explain Knowledge Distillation for Classification18 Aug 2022
- 2022Prompting to Distill: Boosting Data-Free Knowledge Distillation via Reinforced Prompt16 May 2022
- 2021Contrastive Model Inversion for Data-Free Knowledge Distillation18 May 2021
- 2025Universal Sparse Autoencoders: Interpretable Cross-Model Concept Alignmentcited by 62
- 2023Scale Alone Does not Improve Mechanistic Interpretability in Vision Modelscited by 18
- 2023Diffused Redundancy in Pre-trained Representationscited by 5
- 2025InverseScope: Scalable Activation Inversion for Interpreting Large Language Modelscited by 2
- 2025EXP-CAM: Explanation Generation and Circuit Discovery Using Classifier Activation Matchingcited by 0
- 2025EXP-CAM: Explanation Generation and Circuit Discovery Using Classifier Activation Matching30 Sep 2025
- 2025InverseScope: Scalable Activation Inversion for Interpreting Large Language Models9 Jun 2025
- 2025Universal Sparse Autoencoders: Interpretable Cross-Model Concept Alignment6 Feb 2025
- 2023Scale Alone Does not Improve Mechanistic Interpretability in Vision Models11 Jul 2023
- 2023Diffused Redundancy in Pre-trained Representations31 May 2023
- 2024Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometricscited by 13
- 2023CovarNav: Machine Unlearning via Model Inversion and Covariance Navigationcited by 2
- 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
- 2026Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Modelscited by 1
- 2024Defending Against Neural Network Model Inversion Attacks via Data Poisoningcited by 0
- 2026Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models8 Jun 2026
- 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspective25 Mar 2026
- 2024Defending Against Neural Network Model Inversion Attacks via Data Poisoning10 Dec 2024
- 2024Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics14 Feb 2024
- 2023CovarNav: Machine Unlearning via Model Inversion and Covariance Navigation21 Nov 2023
- 2024A Multimodal Automated Interpretability Agentcited by 63
- 2024A Multimodal Automated Interpretability Agent22 Apr 2024
- 2021PARE: Part Attention Regressor for 3D Human Body Estimationcited by 337
- 2023DreamSim: Learning New Dimensions of Human Visual Similarity using Synthetic Datacited by 337
- 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
- 2022Splicing ViT Features for Semantic Appearance Transfercited by 209
- 2023Text-To-4D Dynamic Scene Generationcited by 205
- 2023Interpreting CLIP's Image Representation via Text-Based Decompositioncited by 196
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
- 2022From Attribution Maps to Human-Understandable Explanations through Concept Relevance Propagationcited by 141
- 2023Squeeze, Recover and Relabel: Dataset Condensation at ImageNet Scale From A New Perspectivecited by 138
- 2022Natural Language Descriptions of Deep Visual Featurescited by 137
- 2022Reconstructing Training Data from Trained Neural Networkscited by 133
- 2023Similarity of Neural Network Models: A Survey of Functional and Representational Measurescited by 131
12 most cited of 363 All 363 (JSON)
- 2026Discriminative Score Function: Turning Pretrained Models into Functional Generative Priors14 Oct 2026
- 2026Layer-wise Input Recoverability in Deep Neural Networks9 Oct 2026
- 2026SAGE: Efficient Protected Vision-Language Inference on Smart Glasses8 Oct 2026
- 2026Inverting Multi-Vector Visual Document Indices7 Oct 2026
- 2026Latent Information Sharing for Accelerating Federated Learning1 Oct 2026
- 2026Neuron Activation-based Computation of Logical Explanations for Deep Neural Networks12 Sep 2026
- 2026From Interpretability Methods to Interpretable Models4 Sep 2026
- 2026Defending Wearable VLMs Against Private Attribute Inference26 Aug 2026
- 2026On the Separation of Human and AI-Generated Images in CLIP Embedding Space26 Aug 2026
- 2026Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding24 Aug 2026
- 2026A Privacy Study of Sparse Collaborative Inference17 Aug 2026
- 2026BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient Leakage27 Jul 2026
12 newest of 363 All 363 (JSON)