mlsanityData to 7 Oct 2026

Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks

arXiv 2310.06549 ↗First posted 10 Oct 2023cs.LG cs.CR cs.CVcited by 12

Not on the map. Why?

Abstract (arXiv)

Label smoothing -- using softened labels instead of hard ones -- is a widely adopted regularization method for deep learning, showing diverse benefits such as enhanced generalization and calibration. Its implications for preserving model privacy, however, have remained unexplored. To fill this gap, we investigate the impact of label smoothing on model inversion attacks (MIAs), which aim to generate class-representative samples by exploiting the knowledge encoded in a classifier, thereby inferring sensitive information about its training data. Through extensive analyses, we uncover that traditional label smoothing fosters MIAs, thereby increasing a model's privacy leakage. Even more, we reveal that smoothing with negative factors counters this trend, impeding the extraction of class-related information and leading to privacy preservation, beating state-of-the-art defenses. This establishes a practical and powerful novel way for enhancing model resilience against MIAs.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 48 of its 58 references that are in the map. First posted on arXiv 10 Oct 2023.

Builds on

48 of 58 references.

References · 48

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  5. 2023GPT-4 Technical Reportcited by 18,132
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  11. 2013Intriguing properties of neural networkscited by 5,114
  12. 2014Deep Learning Face Attributes in the Wildcited by 3,679
36 more
  1. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  2. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  3. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  7. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2019When Does Label Smoothing Help?cited by 985
  11. 2017VGGFace2: A dataset for recognising faces across pose and agecited by 911
  12. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  13. 2017One pixel attack for fooling deep neural networkscited by 579
  14. 2017Regularizing Neural Networks by Penalizing Confident Output Distributionscited by 461
  15. 2018Bag of Tricks for Image Classification with Convolutional Neural Networkscited by 430
  16. 2020Calibrating Deep Neural Networks using Focal Losscited by 353
  17. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  18. 2020Does label smoothing mitigate label noise?cited by 204
  19. 2016Towards better decoding and language model integration in sequence to sequence modelscited by 100
  20. 2022Variational Model Inversion Attackscited by 75
  21. 2021To Smooth or Not? When Label Smoothing Meets Noisy Labelscited by 70
  22. 2020Knowledge-Enriched Distributional Model Inversion Attackscited by 65
  23. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  24. 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 58
  25. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  26. 2020Improving Robustness to Model Inversion Attacks via Mutual Information Regularizationcited by 49
  27. 2023Re-thinking Model Inversion Attacks Against Deep Neural Networkscited by 39
  28. 2023Reinforcement Learning-Based Black-Box Model Inversion Attackscited by 33
  29. 2022Revisiting Label Smoothing and Knowledge Distillation Compatibility: What was Missing?cited by 32
  30. 2022Bilateral Dependency Optimization: Defending Against Model-inversion Attackscited by 30
  31. 2023Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Networkcited by 28
  32. 2021Face.evoLVe: A High-Performance Face Recognition Librarycited by 26
  33. 2021Learning to Break Deep Perceptual Hashing: The Use Case NeuralHashcited by 25
  34. 2022Does CLIP Know My Face?cited by 19
  35. 2021To Trust or Not To Trust Prediction Scores for Membership Inference Attackscited by 10
  36. 2023Class Attribute Inference Attacks: Inferring Sensitive Class Information by Diffusion-Based Attribute Manipulationscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 6; 2025: 3; 2026: 3.

12 papers.

  1. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  2. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  3. 2024MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defensecited by 5
  4. 2024Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filteringcited by 4
  5. 2024Trap-MID: Trapdoor-based Defense against Model Inversion Attackscited by 4
  6. 2024Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?cited by 2
  7. 2025Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessmentcited by 1
  8. 2025Generative Model Inversion Through the Lens of the Manifold Hypothesiscited by 1
  9. 2025Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attackscited by 0
  10. 2026ReproMIA: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attackscited by 0
  11. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0
  12. 2026Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matchingcited by 0