mlsanityData to 14 Oct 2026

A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks

arXiv 2502.19070 ↗First posted 26 Feb 2025cs.LG cs.CRcited by 3

Not on the map. Why?

Abstract (arXiv)

Model Inversion (MI) attacks, which reconstruct the training dataset of neural networks, pose significant privacy concerns in machine learning. Recent MI attacks have managed to reconstruct realistic label-level private data, such as the general appearance of a target person from all training images labeled on him. Beyond label-level privacy, in this paper we show sample-level privacy, the private information of a single target sample, is also important but under-explored in the MI literature due to the limitations of existing evaluation metrics. To address this gap, this study introduces a novel metric tailored for training-sample analysis, namely, the Diversity and Distance Composite Score (DDCS), which evaluates the reconstruction fidelity of each training sample by encompassing various MI attack attributes. This, in turn, enhances the precision of sample-level privacy assessments. Leveraging DDCS as a new evaluative lens, we observe that many training samples remain resilient against even the most advanced MI attack. As such, we further propose a transfer learning framework that augments the generative capabilities of MI attackers through the integration of entropy loss and natural gradient descent. Extensive experiments verify the effectiveness of our framework on improving state-of-the-art MI attacks over various metrics including DDCS, coverage and FID. Finally, we demonstrate that DDCS can also be useful for MI defense, by identifying samples susceptible to MI attacks in an unsupervised manner.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 30 of its 45 references that are in the map. First posted on arXiv 26 Feb 2025.

Builds on

30 of 45 references.

References · 30

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  5. 2017Squeeze-and-Excitation Networkscited by 4,789
  6. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  7. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,588
  8. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,988
  9. 2015LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loopcited by 1,355
  10. 2020Training Generative Adversarial Networks with Limited Datacited by 1,186
  11. 2021Membership Inference Attacks From First Principlescited by 878
  12. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
18 more
  1. 2014New insights and perspectives on the natural gradient methodcited by 443
  2. 2020Reliable Fidelity and Diversity Metrics for Generative Modelscited by 434
  3. 2014One weird trick for parallelizing convolutional neural networkscited by 264
  4. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  5. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  6. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 108
  7. 2017The Riemannian Geometry of Deep Generative Modelscited by 82
  8. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  9. 2020Knowledge-Enriched Distributional Model Inversion Attackscited by 67
  10. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  11. 2021Exploiting Explanations for Model Inversion Attackscited by 49
  12. 2016UMDFaces: An Annotated Face Dataset for Training Deep Networkscited by 42
  13. 2021The Geometry of Deep Generative Image Models and its Applicationscited by 35
  14. 2021Bayesian Framework for Gradient Leakagecited by 34
  15. 2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
  16. 2023Controllable Inversion of Black-Box Face Recognition Models via Diffusioncited by 22
  17. 2023Boosting Model Inversion Attacks with Adversarial Examplescited by 8
  18. 2023Model Inversion Attack via Dynamic Memory Learningcited by 7

Built on by

Cited by year

Citing papers per year: 2025: 3.

3 papers.

  1. 2025Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacycited by 4
  2. 2025Toward Efficient Inference Attacks: Shadow Model Sharing via Mixture-of-Expertscited by 4
  3. 2025What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNscited by 2