Inverting Visual Representations with Convolutional Networks
Not on the map. Why?
Abstract (arXiv)
Feature representations, both hand-designed and learned ones, are often hard to analyze and interpret, even when they are extracted from visual data. We propose a new approach to study image representations by inverting them with an up-convolutional neural network. We apply the method to shallow representations (HOG, SIFT, LBP), as well as to deep networks. For shallow representations our approach provides significantly better reconstructions than existing methods, revealing that there is surprisingly rich information contained in these features. Inverting a deep network trained on ImageNet provides several insights into the properties of the feature representation learned by the network. Most strikingly, the colors and the rough contours of an image can be reconstructed from activations in higher network layers and even from the predicted class probabilities.
Key facts. Cited by 168 papers in the map (data through 7 Oct 2026). First posted on arXiv 9 Jun 2015.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 42; 2022: 32; 2023: 31; 2024: 26; 2025: 21; 2026: 16.
168 papers.
Sort:
By area:
- 2024Parameter-Efficient Fine-Tuning for Large Models: A Comprehensive Surveycited by 641
- 2021Few-shot Image Generation via Cross-domain Correspondencecited by 206
- 2021Projected GANs Converge Fastercited by 204
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
- 2023Squeeze, Recover and Relabel: Dataset Condensation at ImageNet Scale From A New Perspectivecited by 136
- 2021Salient ImageNet: How to discover spurious features in Deep Learning?cited by 114
- 2022What do Vision Transformers Learn? A Visual Explorationcited by 75
- 2023Language Model Inversioncited by 66
- 2022Rethinking Reconstruction Autoencoder-Based Out-of-Distribution Detectioncited by 59
- 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 58
- 2021Exploiting Explanations for Model Inversion Attackscited by 48
- 2022Is Geometry Enough for Matching in Visual Localization?cited by 48
38 more
- 2022Orchestra: Unsupervised Federated Learning via Globally Consistent Clusteringcited by 45
- 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
- 2024Extracting Prompts by Inverting LLM Outputscited by 40
- 2021Biometrics: Trust, but Verifycited by 39
- 2024Logits of API-Protected LLMs Leak Proprietary Informationcited by 38
- 2021Defining and Quantifying the Emergence of Sparse Concepts in DNNscited by 36
- 2022ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learningcited by 36
- 2021Video Autoencoder: self-supervised disentanglement of static 3D structure and motioncited by 34
- 2022Explaining Deepfake Detection by Analysing Image Matchingcited by 34
- 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
- 2023Does a Neural Network Really Encode Symbolic Concepts?cited by 27
- 2021Refining activation downsampling with SoftPoolcited by 26
- 2021Visual Explanations from Spiking Neural Networks using Interspike Intervalscited by 26
- 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
- 2023Privacy-preserving Adversarial Facial Featurescited by 24
- 2024Privacy-Preserving Face Recognition Using Trainable Feature Subtractioncited by 24
- 2021NinjaDesc: Content-Concealing Visual Descriptors via Adversarial Learningcited by 21
- 2023A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiencycited by 21
- 2022It's All In the Teacher: Zero-Shot Quantization Brought Closer to the Teachercited by 20
- 2023Strong but simple: A Baseline for Domain Generalized Dense Perception by CLIP-based Transfer Learningcited by 20
- 2021How Privacy-Preserving are Line Clouds? Recovering Scene Details from 3D Linescited by 19
- 2021Relation-aware Compositional Zero-shot Learning for Attribute-Object Pair Recognitioncited by 19
- 2022Quantifying the Knowledge in a DNN to Explain Knowledge Distillation for Classificationcited by 19
- 2021Interpretable deep-learning models to help achieve the Sustainable Development Goalscited by 18
- 2022Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentationscited by 18
- 2023Valid P-Value for Deep Learning-Driven Salient Regioncited by 17
- 2023DGC-GNN: Leveraging Geometry and Color Cues for Visual Descriptor-Free 2D-3D Matchingcited by 17
- 2021A Game-Theoretic Taxonomy of Visual Concepts in DNNscited by 16
- 2021Designing Counterfactual Generators using Deep Model Inversioncited by 15
- 2022Core Risk Minimization using Salient ImageNetcited by 15
- 2021Counterfactual Explanations for Oblique Decision Trees: Exact, Efficient Algorithmscited by 14
- 2022Revisiting Sparse Convolutional Model for Visual Recognitioncited by 13
- 2024What do we learn from inverting CLIP models?cited by 13
- 2021Interpreting Representation Quality of DNNs for 3D Point Cloud Processingcited by 12
- 2021Contrastive Feature Loss for Image Predictioncited by 12
- 2021Understanding Invariance via Feedforward Inversion of Discriminatively Trained Classifierscited by 11
- 2021Ex-Model: Continual Learning from a Stream of Trained Modelscited by 11
- 2022Measuring Representational Robustness of Neural Networks Through Shared Invariancescited by 11
50 most cited of 168 All 168 (JSON)
- 2026Inverting Multi-Vector Visual Document Indices7 Oct 2026
- 2026CANAL: Channel-Aware Noise Allocation for Differentially Private Feature Distillation in Medical Image Segmentation7 Sep 2026
- 2026Defending Wearable VLMs Against Private Attribute Inference26 Aug 2026
- 2026Misanthrope: A Privacy-Preserving Keypoint Detector24 Aug 2026
- 2026A Privacy Study of Sparse Collaborative Inference17 Aug 2026
- 2026From Preimage Search To Source-Grounded Feature Inversion14 Jul 2026
- 2026TrustCLIP: Learning Private Visual Features via Adversarial Reconstruction5 Jul 2026
- 2026Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression30 Jun 2026
- 2026RAM: Reachability Across Morphologies8 Jun 2026
- 2026Provable Sparse Inversion and Token Relabel Enhanced One-shot Federated Learning with ViTs11 May 2026
- 2026Adjoint Inversion Reveals Holographic Superposition and Destructive Interference in CNN Classifiers30 Apr 2026
- 2026Privacy-Preserving Structureless Visual Localization via Image Obfuscation13 Apr 2026
38 more
- 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspective25 Mar 2026
- 2026Show Me What You Don't Know: Efficient Sampling from Invariant Sets for Model Validation23 Mar 2026
- 2026ProxyFL: A Proxy-Guided Framework for Federated Semi-Supervised Learning24 Feb 2026
- 2026Safe Multi-Agent Deep Reinforcement Learning for Privacy-Aware Edge-Device Collaborative DNN Inference23 Feb 2026
- 2025Privacy-Aware Continual Self-Supervised Learning on Multi-Window Chest Computed Tomography for Domain-Shift Robustness31 Oct 2025
- 2025Rethinking Inference Placement for Deep Learning across Edge and Cloud Platforms: A Multi-Objective Optimization Perspective and Future Directions27 Oct 2025
- 2025OpenFLAME: Federated Visual Positioning System to Enable Large-Scale Augmented Reality Applications4 Oct 2025
- 2025Unraveling Hidden Representations: A Multi-Modal Layer Analysis for Better Synthetic Content Forensics1 Aug 2025
- 2025Rethinking the Privacy of Text Embeddings: A Reproducibility Study of "Text Embeddings Reveal (Almost) As Much As Text"10 Jul 2025
- 2025Better Language Model Inversion by Compactly Representing Next-Token Distributions20 Jun 2025
- 2025Image Reconstruction as a Tool for Feature Analysis9 Jun 2025
- 2025Anomaly Detection Based on Critical Paths for Deep Neural Networks20 May 2025
- 2025Securing Transfer-Learned Networks with Reverse Homomorphic Encryption20 May 2025
- 2025Does CLIP perceive art the same way we do?8 May 2025
- 2025PEEL the Layers and Find Yourself: Revisiting Inference-time Data Leakage for Residual Neural Networks8 Apr 2025
- 2025ColabSfM: Collaborative Structure-from-Motion by Point Cloud Registration21 Mar 2025
- 2025Revealing Unintentional Information Leakage in Low-Dimensional Facial Portrait Representations12 Mar 2025
- 2025ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration10 Mar 2025
- 2025Exploring specialization and sensitivity of convolutional neural networks in the context of simultaneous image augmentations5 Mar 2025
- 2025FedDyMem: Efficient Federated Learning with Dynamic Memory and Memory-Reduce for Unsupervised Image Anomaly Detection28 Feb 2025
- 2025VVRec: Reconstruction Attacks on DL-based Volumetric Video Upstreaming via Latent Diffusion Model with Gamma Distribution25 Feb 2025
- 2025Single-pass Detection of Jailbreaking Input in Large Language Models21 Feb 2025
- 2025IMPACTX: improving model performance by appropriately constraining the training with teacher explanations17 Feb 2025
- 2025Towards Privacy-aware Mental Health AI Models: Advances, Challenges, and Opportunities1 Feb 2025
- 2025A survey on Clustered Federated Learning: Taxonomy, Analysis and Applications29 Jan 2025
- 2024GeFL: Model-Agnostic Federated Learning with Generative Models24 Dec 2024
- 2024Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstruction11 Dec 2024
- 2024Understanding Transformer-based Vision Models through Inversion9 Dec 2024
- 2024Model Inversion Attacks: A Survey of Approaches and Countermeasures15 Nov 2024
- 2024Mitigating Paraphrase Attacks on Machine-Text Detectors via Paraphrase Inversion29 Oct 2024
- 2024EMWaveNet: Physically Explainable Neural Network Based on Electromagnetic Propagation for SAR Target Recognition13 Oct 2024
- 2024Deep Model Interpretation with Limited Data : A Coreset-based Approach1 Oct 2024
- 2024Obfuscation Based Privacy Preserving Representations are Recoverable Using Neighborhood Information17 Sep 2024
- 2024Fast John Ellipsoid Computation with Differential Privacy Optimization12 Aug 2024
- 2024PriPHiT: Privacy-Preserving Hierarchical Training of Deep Neural Networks9 Aug 2024
- 2024Improving Network Interpretability via Explanation Consistency Evaluation8 Aug 2024
- 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)20 Jul 2024
- 2024Weakly Supervised Test-Time Domain Adaptation for Object Detection8 Jul 2024
50 newest of 168 All 168 (JSON)
- 2024Parameter-Efficient Fine-Tuning for Large Models: A Comprehensive Surveycited by 641
- 2021Few-shot Image Generation via Cross-domain Correspondencecited by 206
- 2021Projected GANs Converge Fastercited by 204
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
- 2023Squeeze, Recover and Relabel: Dataset Condensation at ImageNet Scale From A New Perspectivecited by 136
- 2021Salient ImageNet: How to discover spurious features in Deep Learning?cited by 114
- 2022What do Vision Transformers Learn? A Visual Explorationcited by 75
- 2023Language Model Inversioncited by 66
- 2022Rethinking Reconstruction Autoencoder-Based Out-of-Distribution Detectioncited by 59
- 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 58
- 2021Exploiting Explanations for Model Inversion Attackscited by 48
- 2022Is Geometry Enough for Matching in Visual Localization?cited by 48
12 most cited of 158 All 158 (JSON)
- 2026Inverting Multi-Vector Visual Document Indices7 Oct 2026
- 2026CANAL: Channel-Aware Noise Allocation for Differentially Private Feature Distillation in Medical Image Segmentation7 Sep 2026
- 2026Defending Wearable VLMs Against Private Attribute Inference26 Aug 2026
- 2026Misanthrope: A Privacy-Preserving Keypoint Detector24 Aug 2026
- 2026A Privacy Study of Sparse Collaborative Inference17 Aug 2026
- 2026From Preimage Search To Source-Grounded Feature Inversion14 Jul 2026
- 2026Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression30 Jun 2026
- 2026RAM: Reachability Across Morphologies8 Jun 2026
- 2026Provable Sparse Inversion and Token Relabel Enhanced One-shot Federated Learning with ViTs11 May 2026
- 2026Adjoint Inversion Reveals Holographic Superposition and Destructive Interference in CNN Classifiers30 Apr 2026
- 2026Privacy-Preserving Structureless Visual Localization via Image Obfuscation13 Apr 2026
- 2026Show Me What You Don't Know: Efficient Sampling from Invariant Sets for Model Validation23 Mar 2026
12 newest of 158 All 158 (JSON)