# Evaluation of Inference Attack Models for Deep Learning on Medical Data

arXiv: https://arxiv.org/abs/2011.00177 · HTML: https://mlsanity.com/paper/2011.00177/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Oct 2020.

## Built on by (most cited first, 9 of 9)

- [Practical Defences Against Model Inversion Attacks for Split Neural Networks](https://mlsanity.com/paper/2104.05743/) (2021)
- [Get your Foes Fooled: Proximal Gradient Split Learning for Defense against Model Inversion Attacks on IoMT data](https://mlsanity.com/paper/2201.04569/) (2022)
- [Why patient data cannot be easily forgotten?](https://mlsanity.com/paper/2206.14541/) (2022)
- [Privacy-Preserving Deep Learning Model for Covid-19 Disease Detection](https://mlsanity.com/paper/2209.04445/) (2022)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [SoK: Security and Privacy Risks of Healthcare AI](https://mlsanity.com/paper/2409.07415/) (2024)
- [Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning](https://mlsanity.com/paper/2509.00027/) (2025)
- [White-box Membership Attack Against Machine Learning Based Retinopathy Classification](https://mlsanity.com/paper/2206.03584/) (2022)
- [Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare](https://mlsanity.com/paper/2606.28666/) (2026)

## Abstract (arXiv)

Deep learning has attracted broad interest in healthcare and medical communities. However, there has been little research into the privacy issues created by deep networks trained for medical applications. Recently developed inference attack algorithms indicate that images and text records can be reconstructed by malicious parties that have the ability to query deep networks. This gives rise to the concern that medical images and electronic health records containing sensitive patient information are vulnerable to these attacks. This paper aims to attract interest from researchers in the medical deep learning community to this important problem. We evaluate two prominent inference attack models, namely, attribute inference attack and model inversion attack. We show that they can reconstruct real-world medical images and clinical reports with high fidelity. We then investigate how to protect patients' privacy using defense mechanisms, such as label perturbation and model perturbation. We provide a comparison of attack results between the original and the medical deep learning models with defenses. The experimental evaluations show that our proposed defense approaches can effectively reduce the potential privacy leakage of medical deep learning from the inference attacks.