mlsanityData to 7 Oct 2026

Bounding Training Data Reconstruction in Private (Deep) Learning

arXiv 2201.12383 ↗First posted 28 Jan 2022cs.LG cs.CRcited by 43

Not on the map. Why?

Abstract (arXiv)

Differential privacy is widely accepted as the de facto method for preventing data leakage in ML, and conventional wisdom suggests that it offers strong protection against privacy attacks. However, existing semantic guarantees for DP focus on membership inference, which may overestimate the adversary's capabilities and is not applicable when membership status itself is non-sensitive. In this paper, we derive the first semantic guarantees for DP mechanisms against training data reconstruction attacks under a formal threat model. We show that two distinct privacy accounting methods -- Renyi differential privacy and Fisher information leakage -- both offer strong semantic protection against data reconstruction attacks.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). Builds on 19 of its 44 references that are in the map. First posted on arXiv 28 Jan 2022.

Builds on

19 of 44 references.

References · 19

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2016Gaussian Error Linear Units (GELUs)cited by 3,431
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2020Extracting Training Data from Large Language Modelscited by 2,144
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  7. 2017Renyi Differential Privacycited by 643
  8. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  9. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  10. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  11. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 234
  12. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
7 more
  1. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
  2. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 199
  3. 2022Reconstructing Training Data with Informed Adversariescited by 143
  4. 2020Tempered Sigmoid Activations for Deep Learning with Differential Privacycited by 121
  5. 2021Measuring Data Leakage in Machine-Learning Models with Fisher Informationcited by 31
  6. 2020Three Variants of Differential Privacy: Lossless Conversion and Applicationscited by 25
  7. 2019That which we call privatecited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 5; 2023: 15; 2024: 12; 2025: 6; 2026: 5.

43 papers.

Sort:

By area:

  1. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
  2. 2023Foundation Models and Fair Usecited by 112
  3. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  4. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 35
  5. 2024Privacy-Preserving Instructions for Aligning Large Language Modelscited by 34
  6. 2023Split-and-Denoise: Protect large language model inference with local differential privacycited by 30
  7. 2024Auditing f-Differential Privacy in One Runcited by 28
  8. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  9. 2023Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learningcited by 19
  10. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 19
  11. 2022Analyzing Privacy Leakage in Machine Learning via Multiple Hypothesis Testing: A Lesson From Fanocited by 16
  12. 2023Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacycited by 14
31 more
  1. 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Informationcited by 11
  2. 2023Information Flow Control in Machine Learning through Modular Model Architecturecited by 11
  3. 2023Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGDcited by 11
  4. 2022Privacy-Aware Compression for Federated Learning Through Numerical Mechanism Designcited by 6
  5. 2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
  6. 2024Data Reconstruction Attacks and Defenses: A Systematic Evaluationcited by 5
  7. 2024Differentially Private Representation Learning via Image Captioningcited by 5
  8. 2025Sequentially Auditing Differential Privacycited by 5
  9. 2024Training Data Reconstruction: Privacy due to Uncertainty?cited by 4
  10. 2022Measuring and Controlling Split Layer Privacy Leakage Using Fisher Informationcited by 3
  11. 2024Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approachcited by 3
  12. 2022Scaling Private Deep Learning with Low-Rank and Sparse Gradientscited by 2
  13. 2022How Do Input Attributes Impact the Privacy Loss in Differential Privacy?cited by 2
  14. 2024Implicit Bias in Noisy-SGD: With Applications to Differentially Private Trainingcited by 2
  15. 2024Privacy Amplification for the Gaussian Mechanism via Bounded Supportcited by 2
  16. 2025Machine Learning with Privacy for Protected Attributescited by 2
  17. 2024From Mean to Extreme: Formal Differential Privacy Bounds on the Success of Real-World Data Reconstruction Attackscited by 1
  18. 2024Visual Privacy Auditing with Diffusion Modelscited by 1
  19. 2025Empirical Calibration and Metric Differential Privacy in Language Modelscited by 1
  20. 2025Cocoon: A System Architecture for Differentially Private Training with Correlated Noisescited by 1
  21. 2023On the Query Complexity of Training Data Reconstruction in Private Learningcited by 0
  22. 2023Large-Scale Public Data Improves Differentially Private Image Generation Qualitycited by 0
  23. 2024Understanding Data Reconstruction Leakage in Federated Learning from a Theoretical Perspectivecited by 0
  24. 2024Impact of Privacy Parameters on Deep Learning Models for Image Classificationcited by 0
  25. 2025Training Set Reconstruction from Differentially Private Forests: How Effective is DP?cited by 0
  26. 2025On Reconstructing Training Data From Bayesian Posteriors and Trained Modelscited by 0
  27. 2026Phantoms and Disclosures: A Statistical Framework for Auditing Privacy in Synthetic Datacited by 0
  28. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0
  29. 2026Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encodingcited by 0
  30. 2026Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spotscited by 0
  31. 2026A Sharp Transition in Data Reconstruction under Differential Privacycited by 0