mlsanityData to 14 Oct 2026

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

arXiv 1911.07135 ↗First posted 17 Nov 2019cs.LG stat.MLcited by 246

Not on the map. Why?

Cited by 29 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

This paper studies model-inversion attacks, in which the access to a model is abused to infer information about the training data. Since its first introduction, such attacks have raised serious concerns given that training data usually contain privacy-sensitive information. Thus far, successful model-inversion attacks have only been demonstrated on simple models, such as linear regression and logistic regression. Previous attempts to invert neural networks, even the ones with simple architectures, have failed to produce convincing results. We present a novel attack method, termed the generative model-inversion attack, which can invert deep neural networks with high success rates. Rather than reconstructing private training data from scratch, we leverage partial public information, which can be very generic, to learn a distributional prior via generative adversarial networks (GANs) and use it to guide the inversion process. Moreover, we theoretically prove that a model's predictive power and its vulnerability to inversion attacks are indeed two sides of the same coin---highly predictive models are able to establish a strong correlation between features and labels, which coincides exactly with what an adversary exploits to mount the attacks. Our extensive experiments demonstrate that the proposed attack improves identification accuracy over the existing work by about 75% for reconstructing face images from a state-of-the-art face recognition classifier. We also show that differential privacy, in its canonical form, is of little avail to defend against our attacks.

Key facts. Cited by 246 papers in the map (data through 14 Oct 2026). First posted on arXiv 17 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 40; 2022: 42; 2023: 54; 2024: 49; 2025: 37; 2026: 24.

246 papers.

Sort:

By area:

  1. 2023Extracting Training Data from Diffusion Modelscited by 732
  2. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  3. 2023Towards Unbounded Machine Unlearningcited by 268
  4. 2022Reconstructing Training Data with Informed Adversariescited by 148
  5. 2021Graph Unlearningcited by 138
  6. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 136
  7. 2022Reconstructing Training Data from Trained Neural Networkscited by 133
  8. 2023ProPILE: Probing Privacy Leakage in Large Language Modelscited by 129
  9. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  10. 2022Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacycited by 100
  11. 2021Trustworthy AI: A Computational Perspectivecited by 93
  12. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 85
38 more
  1. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  2. 2022Variational Model Inversion Attackscited by 75
  3. 2022Federated Unlearning with Knowledge Distillationcited by 73
  4. 2021Contrastive Model Inversion for Data-Free Knowledge Distillationcited by 66
  5. 2024Building Guardrails for Large Language Modelscited by 65
  6. 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 60
  7. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 58
  8. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  9. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 54
  10. 2023FedFed: Feature Distillation against Data Heterogeneity in Federated Learningcited by 54
  11. 2021UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learningcited by 52
  12. 2021GraphMI: Extracting Private Graph Data from Graph Neural Networkscited by 50
  13. 2021Exploiting Explanations for Model Inversion Attackscited by 49
  14. 2022Are Attribute Inference Attacks Just Imputation?cited by 49
  15. 2022Bounding Training Data Reconstruction in Private (Deep) Learningcited by 46
  16. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 45
  17. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  18. 2022Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Modelscited by 43
  19. 2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 39
  20. 2023Re-thinking Model Inversion Attacks Against Deep Neural Networkscited by 39
  21. 2023SoK: Privacy-Preserving Data Synthesiscited by 38
  22. 2021GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learningcited by 36
  23. 2023Reinforcement Learning-Based Black-Box Model Inversion Attackscited by 33
  24. 2021DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregationcited by 31
  25. 2022Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformerscited by 31
  26. 2022Bilateral Dependency Optimization: Defending Against Model-inversion Attackscited by 30
  27. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  28. 2021Practical Defences Against Model Inversion Attacks for Split Neural Networkscited by 29
  29. 2023Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Networkcited by 28
  30. 2022Model Inversion Attacks against Graph Neural Networkscited by 26
  31. 2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26
  32. 2021Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Informationcited by 25
  33. 2023Selective Knowledge Sharing for Privacy-Preserving Federated Distillation without A Good Teachercited by 25
  34. 2021CAPE: Context-Aware Private Embeddings for Private Language Learningcited by 22
  35. 2022IOP-FL: Inside-Outside Personalization for Federated Medical Image Segmentationcited by 22
  36. 2023Have it your way: Individualized Privacy Assignment for DP-SGDcited by 21
  37. 2023A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiencycited by 21
  38. 2023Label-Only Model Inversion Attacks via Knowledge Transfercited by 21

50 most cited of 246 All 246 (JSON)