# Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Models

arXiv: https://arxiv.org/abs/2201.09370 · HTML: https://mlsanity.com/paper/2201.09370/

## Key facts

- Cited by 43 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 50 references that are in the map.
- First posted on arXiv 23 Jan 2022.

## Builds on (most cited first, 11 of 11)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016)
- [The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/1911.07135/) (2019)
- [Machine Learning for Integrating Data in Biology and Medicine: Principles, Practice, and Opportunities](https://mlsanity.com/paper/1807.00123/) (2018)
- [You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors](https://mlsanity.com/paper/1606.05893/) (2016)
- [Defending Model Inversion and Membership Inference Attacks via Prediction Purification](https://mlsanity.com/paper/2005.03915/) (2020)
- [Joint Item Recommendation and Attribute Inference: An Adaptive Graph Convolutional Network Approach](https://mlsanity.com/paper/2005.12021/) (2020)
- [GAMIN: An Adversarial Approach to Black-Box Model Inversion](https://mlsanity.com/paper/1909.11835/) (2019)
- [Network On Network for Tabular Data Classification in Real-world Applications](https://mlsanity.com/paper/2005.10114/) (2020)
- [On the Privacy Risks of Model Explanations](https://mlsanity.com/paper/1907.00164/) (2019)

## Built on by (most cited first, 30 of 43)

- [Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets](https://mlsanity.com/paper/2204.00032/) (2022)
- [Are Attribute Inference Attacks Just Imputation?](https://mlsanity.com/paper/2209.01292/) (2022)
- [No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML](https://mlsanity.com/paper/2310.07152/) (2023)
- [Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learning](https://mlsanity.com/paper/2304.13850/) (2023)
- [Purifier: Defending Data Inference Attacks via Transforming Confidence Scores](https://mlsanity.com/paper/2212.00612/) (2022)
- [The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape](https://mlsanity.com/paper/2405.03636/) (2024)
- [Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivity](https://mlsanity.com/paper/2405.17462/) (2024)
- [Model Inversion Attacks: A Survey of Approaches and Countermeasures](https://mlsanity.com/paper/2411.10023/) (2024)
- [Automated Profile Inference with Language Model Agents](https://mlsanity.com/paper/2505.12402/) (2025)
- [How Does a Deep Learning Model Architecture Impact Its Privacy? A Comprehensive Study of Privacy Attacks on CNNs and Transformers](https://mlsanity.com/paper/2210.11049/) (2022)
- [Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures](https://mlsanity.com/paper/2403.14772/) (2024)
- [Does Black-box Attribute Inference Attacks on Graph Neural Networks Constitute Privacy Risk?](https://mlsanity.com/paper/2306.00578/) (2023)
- [FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.04052/) (2022)
- [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023)
- [Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems](https://mlsanity.com/paper/2503.00383/) (2025)
- [Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning](https://mlsanity.com/paper/2310.03838/) (2023)
- [State-of-the-Art Approaches to Enhancing Privacy Preservation of Machine Learning Datasets: A Survey](https://mlsanity.com/paper/2404.16847/) (2024)
- [Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?](https://mlsanity.com/paper/2409.03741/) (2024)
- [Attribute Inference Attacks in Online Multiplayer Video Games: a Case Study on Dota2](https://mlsanity.com/paper/2210.09028/) (2022)
- [Analyzing Inference Privacy Risks Through Gradients in Machine Learning](https://mlsanity.com/paper/2408.16913/) (2024)
- [Privacy Evaluation Benchmarks for NLP Models](https://mlsanity.com/paper/2409.15868/) (2024)
- [TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models](https://mlsanity.com/paper/2411.09945/) (2024)
- [Disparate Privacy Vulnerability: Targeted Attribute Inference Attacks and Defenses](https://mlsanity.com/paper/2504.04033/) (2025)
- [Class Attribute Inference Attacks: Inferring Sensitive Class Information by Diffusion-Based Attribute Manipulations](https://mlsanity.com/paper/2303.09289/) (2023)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [FLARE: A Wireless Side-Channel Fingerprinting Attack on Federated Learning](https://mlsanity.com/paper/2512.10296/) (2025)
- [Privacy Protectability: An Information-theoretical Approach](https://mlsanity.com/paper/2305.15697/) (2023)
- [Membership inference attack with relative decision boundary distance](https://mlsanity.com/paper/2306.04109/) (2023)
- [When Machine Learning Models Leak: An Exploration of Synthetic Training Data](https://mlsanity.com/paper/2310.08775/) (2023)
- [Better Membership Inference Privacy Measurement through Discrepancy](https://mlsanity.com/paper/2405.15140/) (2024)

## Abstract (arXiv)

Increasing use of machine learning (ML) technologies in privacy-sensitive domains such as medical diagnoses, lifestyle predictions, and business decisions highlights the need to better understand if these ML technologies are introducing leakage of sensitive and proprietary training data. In this paper, we focus on model inversion attacks where the adversary knows non-sensitive attributes about records in the training data and aims to infer the value of a sensitive attribute unknown to the adversary, using only black-box access to the target classification model. We first devise a novel confidence score-based model inversion attribute inference attack that significantly outperforms the state-of-the-art. We then introduce a label-only model inversion attack that relies only on the model's predicted labels but still matches our confidence score-based attack in terms of attack effectiveness. We also extend our attacks to the scenario where some of the other (non-sensitive) attributes of a target record are unknown to the adversary. We evaluate our attacks on two types of machine learning models, decision tree and deep neural network, trained on three real datasets. Moreover, we empirically demonstrate the disparate vulnerability of model inversion attacks, i.e., specific groups in the training dataset (grouped by gender, race, etc.) could be more vulnerable to model inversion attacks.