mlsanityData to 7 Oct 2026

Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures

arXiv 2403.14772 ↗First posted 21 Mar 2024cs.CV cs.AI cs.CRcited by 8

Not on the map. Why?

Abstract (arXiv)

Recent model inversion attack algorithms permit adversaries to reconstruct a neural network's private and potentially sensitive training data by repeatedly querying the network. In this work, we develop a novel network architecture that leverages sparse-coding layers to obtain superior robustness to this class of attacks. Three decades of computer science research has studied sparse coding in the context of image denoising, object recognition, and adversarial misclassification settings, but to the best of our knowledge, its connection to state-of-the-art privacy vulnerabilities remains unstudied. In this work, we hypothesize that sparse coding architectures suggest an advantageous means to defend against model inversion attacks because they allow us to control the amount of irrelevant private information encoded by a network in a manner that is known to have little effect on classification accuracy. Specifically, compared to networks trained with a variety of state-of-the-art defenses, our sparse-coding architectures maintain comparable or higher classification accuracy while degrading state-of-the-art training data reconstructions by factors of 1.1 to 18.3 across a variety of reconstruction quality metrics (PSNR, SSIM, FID). This performance advantage holds across 5 datasets ranging from CelebA faces to medical images and CIFAR-10, and across various state-of-the-art SGD-based and GAN-based inversion attacks, including Plug-&-Play attacks. We provide a cluster-ready PyTorch codebase to promote research and standardize defense evaluations.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 56 of its 96 references that are in the map. First posted on arXiv 21 Mar 2024.

Builds on

56 of 96 references.

References · 56

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,841
  4. 2016Deep Learning with Differential Privacycited by 2,682
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  8. 2021Alias-Free Generative Adversarial Networkscited by 1,181
  9. 2019Towards Federated Learning at Scale: System Designcited by 826
  10. 2023Extracting Training Data from Diffusion Modelscited by 723
  11. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  12. 2018Split learning for health: Distributed deep learning without sharing raw patient datacited by 391
38 more
  1. 2020Label-Only Membership Inference Attackscited by 371
  2. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  3. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  4. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  5. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  6. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  7. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  8. 2020A Survey of Privacy Attacks in Machine Learningcited by 143
  9. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  10. 2022The Privacy Onion Effect: Memorization is Relativecited by 128
  11. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 117
  12. 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
  13. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  14. 2014Lazier Than Lazy Greedycited by 97
  15. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  16. 2022Variational Model Inversion Attackscited by 75
  17. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  18. 2020A Framework for Evaluating Gradient Leakage Attacks in Federated Learningcited by 63
  19. 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 58
  20. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  21. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  22. 2020Can We Use Split Learning on 1D CNN Models for Privacy Preserving Training?cited by 50
  23. 2020Improving Robustness to Model Inversion Attacks via Mutual Information Regularizationcited by 49
  24. 2021Exploiting Explanations for Model Inversion Attackscited by 48
  25. 2019How Can We Be So Dense? The Benefits of Using Highly Sparse Representationscited by 45
  26. 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
  27. 2022Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Modelscited by 42
  28. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  29. 2016You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviorscited by 34
  30. 2018Adversarial Defense by Stratified Convolutional Sparse Codingcited by 31
  31. 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 31
  32. 2021On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Modelscited by 30
  33. 2022Bilateral Dependency Optimization: Defending Against Model-inversion Attackscited by 30
  34. 2021Practical Defences Against Model Inversion Attacks for Split Neural Networkscited by 29
  35. 2020ES Attack: Model Stealing against Deep Neural Networks without Data Hurdlescited by 24
  36. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  37. 2019GAMIN: An Adversarial Approach to Black-Box Model Inversioncited by 19
  38. 2019The FAST Algorithm for Submodular Maximizationcited by 13

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 4; 2026: 3.

8 papers.

  1. 2025Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systemscited by 6
  2. 2024WARP-LCA: Efficient Convolutional Sparse Coding with Locally Competitive Algorithmcited by 2
  3. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  4. 2026Beyond Attack Success Rate: A Multi-Metric Evaluation of Adversarial Transferability in Medical Imaging Modelscited by 1
  5. 2026Do We Really Need Quantum Machine Learning?: A Multidimensional Empirical Studycited by 1
  6. 2025PC-MoE: Memory-Efficient and Privacy-Preserving Collaborative Training for Mixture-of-Experts LLMscited by 0
  7. 2025InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inferencecited by 0
  8. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0