# Defending Model Inversion and Membership Inference Attacks via Prediction Purification

arXiv: https://arxiv.org/abs/2005.03915 · HTML: https://mlsanity.com/paper/2005.03915/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 May 2020.

## Built on by (most cited first, 30 of 34)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture](https://mlsanity.com/paper/2110.08324/) (2021)
- [Survey: Leakage and Privacy at Inference Time](https://mlsanity.com/paper/2107.01614/) (2021)
- [Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Models](https://mlsanity.com/paper/2201.09370/) (2022)
- [ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learning](https://mlsanity.com/paper/2205.04007/) (2022)
- [Evaluations of Machine Learning Privacy Defenses are Misleading](https://mlsanity.com/paper/2404.17399/) (2024)
- [Bilateral Dependency Optimization: Defending Against Model-inversion Attacks](https://mlsanity.com/paper/2206.05483/) (2022)
- [Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses](https://mlsanity.com/paper/2402.04013/) (2024)
- [Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Prediction](https://mlsanity.com/paper/2307.01610/) (2023)
- [One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy](https://mlsanity.com/paper/2203.06580/) (2022)
- [Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics](https://mlsanity.com/paper/2402.09225/) (2024)
- [Model Inversion Attacks: A Survey of Approaches and Countermeasures](https://mlsanity.com/paper/2411.10023/) (2024)
- [Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective](https://mlsanity.com/paper/2105.05381/) (2021)
- [On the utility and protection of optimization with differential privacy and classic regularization techniques](https://mlsanity.com/paper/2209.03175/) (2022)
- [SecretGen: Privacy Recovery on Pre-Trained Models via Distribution Discrimination](https://mlsanity.com/paper/2207.12263/) (2022)
- [Private, Efficient, and Accurate: Protecting Models Trained by Multi-party Learning with Differential Privacy](https://mlsanity.com/paper/2208.08662/) (2022)
- [MIAShield: Defending Membership Inference Attacks via Preemptive Exclusion of Members](https://mlsanity.com/paper/2203.00915/) (2022)
- [MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defense](https://mlsanity.com/paper/2410.05159/) (2024)
- [Trap-MID: Trapdoor-based Defense against Model Inversion Attacks](https://mlsanity.com/paper/2411.08460/) (2024)
- [Label-only Model Inversion Attack: The Attack that Requires the Least Information](https://mlsanity.com/paper/2203.06555/) (2022)
- [Introducing Model Inversion Attacks on Automatic Speaker Recognition](https://mlsanity.com/paper/2301.03206/) (2023)
- [Deep Learning Model Security: Threats and Defenses](https://mlsanity.com/paper/2412.08969/) (2024)
- [Privacy-preserving Generative Framework Against Membership Inference Attacks](https://mlsanity.com/paper/2202.05469/) (2022)
- [Preserving Privacy in Personalized Models for Distributed Mobile Services](https://mlsanity.com/paper/2101.05855/) (2021)
- [LDL: A Defense for Label-Based Membership Inference Attacks](https://mlsanity.com/paper/2212.01688/) (2022)
- [Inference Attacks Against Face Recognition Model without Classification Layers](https://mlsanity.com/paper/2401.13719/) (2024)
- [Towards a Game-theoretic Understanding of Explanation-based Membership Inference Attacks](https://mlsanity.com/paper/2404.07139/) (2024)
- [Graph Transductive Defense: a Two-Stage Defense for Graph Membership Inference Attacks](https://mlsanity.com/paper/2406.07917/) (2024)
- [Defending Against Neural Network Model Inversion Attacks via Data Poisoning](https://mlsanity.com/paper/2412.07575/) (2024)
- [PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks](https://mlsanity.com/paper/2512.12840/) (2025)

## Abstract (arXiv)

Neural networks are susceptible to data inference attacks such as the model inversion attack and the membership inference attack, where the attacker could infer the reconstruction and the membership of a data sample from the confidence scores predicted by the target classifier. In this paper, we propose a unified approach, namely purification framework, to defend data inference attacks. It purifies the confidence score vectors predicted by the target classifier by reducing their dispersion. The purifier can be further specialized in defending a particular attack via adversarial learning. We evaluate our approach on benchmark datasets and classifiers. We show that when the purifier is dedicated to one attack, it naturally defends the other one, which empirically demonstrates the connection between the two attacks. The purifier can effectively defend both attacks. For example, it can reduce the membership inference accuracy by up to 15% and increase the model inversion error by a factor of up to 4. Besides, it incurs less than 0.4% classification accuracy drop and less than 5.5% distortion to the confidence scores.