# Practical Defences Against Model Inversion Attacks for Split Neural Networks

arXiv: https://arxiv.org/abs/2104.05743 · HTML: https://mlsanity.com/paper/2104.05743/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 36 references that are in the map.
- First posted on arXiv 12 Apr 2021.

## Builds on (most cited first, 24 of 24)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Extracting Training Data from Large Language Models](https://mlsanity.com/paper/2012.07805/) (2020)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Certified Robustness to Adversarial Examples with Differential Privacy](https://mlsanity.com/paper/1802.03471/) (2018)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data](https://mlsanity.com/paper/1610.05755/) (2016)
- [FedML: A Research Library and Benchmark for Federated Machine Learning](https://mlsanity.com/paper/2007.13518/) (2020)
- [Scalable Private Learning with PATE](https://mlsanity.com/paper/1802.08908/) (2018)
- [The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/1911.07135/) (2019)
- [Stealing Hyperparameters in Machine Learning](https://mlsanity.com/paper/1802.05351/) (2018)
- [A generic framework for privacy preserving deep learning](https://mlsanity.com/paper/1811.04017/) (2018)
- [Can We Use Split Learning on 1D CNN Models for Privacy Preserving Training?](https://mlsanity.com/paper/2003.12365/) (2020)
- [SplitNN-driven Vertical Partitioning](https://mlsanity.com/paper/2008.04137/) (2020)
- [PyVertical: A Vertical Federated Learning Framework for Multi-headed SplitNN](https://mlsanity.com/paper/2104.00489/) (2021)
- [No Peek: A Survey of private distributed deep learning](https://mlsanity.com/paper/1812.03288/) (2018)
- [Privacy and Trust Redefined in Federated Machine Learning](https://mlsanity.com/paper/2103.15753/) (2021)
- [Asymmetric Private Set Intersection with Applications to Contact Tracing and Private Vertical Federated Machine Learning](https://mlsanity.com/paper/2011.09350/) (2020)
- [Evaluation of Inference Attack Models for Deep Learning on Medical Data](https://mlsanity.com/paper/2011.00177/) (2020)
- [A Distributed Trust Framework for Privacy-Preserving Machine Learning](https://mlsanity.com/paper/2006.02456/) (2020)

## Built on by (most cited first, 29 of 29)

- [Survey: Leakage and Privacy at Inference Time](https://mlsanity.com/paper/2107.01614/) (2021)
- [ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learning](https://mlsanity.com/paper/2205.04007/) (2022)
- [Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses](https://mlsanity.com/paper/2402.04013/) (2024)
- [ExPLoit: Extracting Private Labels in Split Learning](https://mlsanity.com/paper/2112.01299/) (2021)
- [Combined Federated and Split Learning in Edge Computing for Ubiquitous Intelligence in Internet of Things: State of the Art and Future Directions](https://mlsanity.com/paper/2207.09611/) (2022)
- [Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information](https://mlsanity.com/paper/2305.04146/) (2023)
- [Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks](https://mlsanity.com/paper/2107.06304/) (2021)
- [Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures](https://mlsanity.com/paper/2403.14772/) (2024)
- [Get your Foes Fooled: Proximal Gradient Split Learning for Defense against Model Inversion Attacks on IoMT data](https://mlsanity.com/paper/2201.04569/) (2022)
- [Split Without a Leak: Reducing Privacy Leakage in Split Learning](https://mlsanity.com/paper/2308.15783/) (2023)
- [Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems](https://mlsanity.com/paper/2503.00383/) (2025)
- [SFPrompt: Communication-Efficient Split Federated Fine-Tuning for Large Pre-Trained Models over Resource-Limited Devices](https://mlsanity.com/paper/2407.17533/) (2024)
- [A Hybrid Quantum Neural Network for Split Learning](https://mlsanity.com/paper/2409.16593/) (2024)
- [MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defense](https://mlsanity.com/paper/2410.05159/) (2024)
- [Analyzing the vulnerabilities in SplitFed Learning: Assessing the robustness against Data Poisoning Attacks](https://mlsanity.com/paper/2307.03197/) (2023)
- [Measuring and Controlling Split Layer Privacy Leakage Using Fisher Information](https://mlsanity.com/paper/2209.10119/) (2022)
- [DRAG: Data Reconstruction Attack using Guided Diffusion](https://mlsanity.com/paper/2509.11724/) (2025)
- [Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inference](https://mlsanity.com/paper/2309.04875/) (2023)
- [A Taxonomy of Attacks and Defenses in Split Learning](https://mlsanity.com/paper/2505.05872/) (2025)
- [P3SL: Personalized Privacy-Preserving Split Learning on Heterogeneous Edge Devices](https://mlsanity.com/paper/2507.17228/) (2025)
- [What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs](https://mlsanity.com/paper/2511.15316/) (2025)
- [Oops!... They Stole it Again: Attacks on Split Learning](https://mlsanity.com/paper/2508.10598/) (2025)
- [Privacy-Preserving Split Learning for Federated LLM Fine-Tuning](https://mlsanity.com/paper/2609.09794/) (2026)
- [Split Federated Learning on Micro-controllers: A Keyword Spotting Showcase](https://mlsanity.com/paper/2210.01961/) (2022)
- [GAN-based Vertical Federated Learning for Label Protection in Binary Classification](https://mlsanity.com/paper/2302.02245/) (2023)
- [Enhancing Privacy in ControlNet and Stable Diffusion via Split Learning](https://mlsanity.com/paper/2409.08503/) (2024)
- [Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization](https://mlsanity.com/paper/2508.20613/) (2025)
- [A Privacy Study of Sparse Collaborative Inference](https://mlsanity.com/paper/2608.16236/) (2026)
- [Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding](https://mlsanity.com/paper/2608.23382/) (2026)

## Abstract (arXiv)

We describe a threat model under which a split network-based federated learning system is susceptible to a model inversion attack by a malicious computational server. We demonstrate that the attack can be successfully performed with limited knowledge of the data distribution by the attacker. We propose a simple additive noise method to defend against model inversion, finding that the method can significantly reduce attack efficacy at an acceptable accuracy trade-off on MNIST. Furthermore, we show that NoPeekNN, an existing defensive method, protects different information from exposure, suggesting that a combined defence is necessary to fully protect private user data.