mlsanityData to 7 Oct 2026

Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks

arXiv 2201.12179 ↗First posted 28 Jan 2022cs.LG cs.AI cs.CVcited by 58

Not on the map. Why?

Abstract (arXiv)

Model inversion attacks (MIAs) aim to create synthetic images that reflect the class-wise characteristics from a target classifier's private training data by exploiting the model's learned knowledge. Previous research has developed generative MIAs that use generative adversarial networks (GANs) as image priors tailored to a specific target model. This makes the attacks time- and resource-consuming, inflexible, and susceptible to distributional shifts between datasets. To overcome these drawbacks, we present Plug & Play Attacks, which relax the dependency between the target model and image prior, and enable the use of a single GAN to attack a wide range of targets, requiring only minor adjustments to the attack. Moreover, we show that powerful MIAs are possible even with publicly available pre-trained GANs and under strong distributional shifts, for which previous approaches fail to produce meaningful results. Our extensive evaluation confirms the improved robustness and flexibility of Plug & Play Attacks and their ability to create high-quality images revealing sensitive class characteristics.

Key facts. Cited by 58 papers in the map (data through 7 Oct 2026). Builds on 38 of its 52 references that are in the map. First posted on arXiv 28 Jan 2022.

Builds on

38 of 52 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2016Densely Connected Convolutional Networkscited by 6,691
  6. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  10. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  11. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  12. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
26 more
  1. 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
  2. 2018Glow: Generative Flow with Invertible 1x1 Convolutionscited by 1,539
  3. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  4. 2020Training Generative Adversarial Networks with Limited Datacited by 1,184
  5. 2021Alias-Free Generative Adversarial Networkscited by 1,181
  6. 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,095
  7. 2019Improved Precision and Recall Metric for Assessing Generative Modelscited by 925
  8. 2017VGGFace2: A dataset for recognising faces across pose and agecited by 911
  9. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  10. 2017Poincar'e Embeddings for Learning Hierarchical Representationscited by 674
  11. 2020ResNeSt: Split-Attention Networkscited by 445
  12. 2020Reliable Fidelity and Diversity Metrics for Generative Modelscited by 425
  13. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 419
  14. 2020Label-Only Membership Inference Attackscited by 371
  15. 2018Invertible Residual Networkscited by 364
  16. 2018Why ReLU networks yield high-confidence predictions far away from the training data and how to mitigate the problemcited by 323
  17. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  18. 2015Inverting Visual Representations with Convolutional Networkscited by 168
  19. 2020Membership Leakage in Label-Only Exposurescited by 156
  20. 2018Poincar'e GloVe: Hyperbolic Word Embeddingscited by 155
  21. 2019Continuous Hierarchical Representations with Poincar'e Variational Auto-Encoderscited by 111
  22. 2022Variational Model Inversion Attackscited by 75
  23. 2020Knowledge-Enriched Distributional Model Inversion Attackscited by 65
  24. 2021Exploiting Explanations for Model Inversion Attackscited by 48
  25. 2019MintNet: Building Invertible Neural Networks with Masked Convolutionscited by 35
  26. 2018Inverting Supervised Representations with Autoregressive Neural Density Modelscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 4; 2023: 15; 2024: 22; 2025: 10; 2026: 7.

58 papers.

Sort:

By area:

  1. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  2. 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Modelscited by 36
  3. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  4. 2022Exploiting Cultural Biases via Homoglyphs in Text-to-Image Synthesiscited by 29
  5. 2023Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Networkcited by 28
  6. 2023Label-Only Model Inversion Attacks via Knowledge Transfercited by 21
  7. 2022Does CLIP Know My Face?cited by 19
  8. 2024A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attackscited by 17
  9. 2023On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximationcited by 16
  10. 2023Unstoppable Attack: Label-Only Model Inversion via Conditional Diffusion Modelcited by 14
  11. 2023Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attackscited by 12
  12. 2024Model Reconstruction Using Counterfactual Explanations: A Perspective From Polytope Theorycited by 12
38 more
  1. 2024Model Inversion Robustness: Can Transfer Learning Help?cited by 11
  2. 2024Improving Robustness to Model Inversion Attacks via Sparse Coding Architecturescited by 8
  3. 2024Model Inversion Attacks Through Target-Specific Conditional Diffusion Modelscited by 8
  4. 2024On the Vulnerability of Skip Connections to Model Inversion Attackscited by 8
  5. 2023Boosting Model Inversion Attacks with Adversarial Examplescited by 7
  6. 2023DANAA: Towards transferable attacks with double adversarial neuron attributioncited by 7
  7. 2023Model Inversion Attack via Dynamic Memory Learningcited by 6
  8. 2025Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systemscited by 6
  9. 2024Rethinking the impact of noisy labels in graph classification: A utility and privacy perspectivecited by 5
  10. 2024Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?cited by 5
  11. 2024MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defensecited by 5
  12. 2025SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmarkcited by 5
  13. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 4
  14. 2023Client-side Gradient Inversion Against Federated Learning from Poisoningcited by 4
  15. 2023Defending Our Privacy With Backdoorscited by 4
  16. 2023All Rivers Run to the Sea: Private Learning with Asymmetric Flowscited by 4
  17. 2024MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protectioncited by 4
  18. 2024Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filteringcited by 4
  19. 2024Trap-MID: Trapdoor-based Defense against Model Inversion Attackscited by 4
  20. 2025LeakyCLIP: Extracting Training Data from CLIPcited by 4
  21. 2025DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversioncited by 3
  22. 2023Class Attribute Inference Attacks: Inferring Sensitive Class Information by Diffusion-Based Attribute Manipulationscited by 2
  23. 2024Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignmentcited by 2
  24. 2024Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?cited by 2
  25. 2025Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defensescited by 2
  26. 2024Inference Attacks Against Face Recognition Model without Classification Layerscited by 1
  27. 2024LazyDP: Co-Designing Algorithm-Software for Scalable Training of Differentially Private Recommendation Modelscited by 1
  28. 2025Do Spikes Protect Privacy? Investigating Black-Box Model Inversion Attacks in Spiking Neural Networkscited by 1
  29. 2025Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessmentcited by 1
  30. 2025Inverting Black-Box Face Recognition Systems via Zero-Order Optimization in Eigenface Spacecited by 1
  31. 2025Generative Model Inversion Through the Lens of the Manifold Hypothesiscited by 1
  32. 2022Turning a Curse into a Blessing: Enabling In-Distribution-Data-Free Backdoor Removal via Stabilized Model Inversioncited by 0
  33. 2023Facial Data Minimization: Shallow Model as Your Privacy Filtercited by 0
  34. 2023Rethinking Model Inversion Attacks With Patch-Wise Reconstructioncited by 0
  35. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  36. 2024Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shiftcited by 0
  37. 2024Efficient Knowledge Deletion from Trained Models through Layer-wise Partial Machine Unlearningcited by 0
  38. 2024Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attackcited by 0

50 most cited of 58 All 58 (JSON)