PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey

Wencheng Yang, Song Wang, Di Wu, Taotao Cai, Yanming Zhu, Shicheng Wei, Yiying Zhang, Xu Yang, Zhaohui Tang, Yan Li

arXiv:2501.18934v2cs.CR

TL;DR

Model inversion attacks threaten privacy in sensitive deep-learning applications, while existing surveys leave gaps in unified coverage of attacks, defenses, challenges, and future directions. This survey develops a structured taxonomy and comprehensive synthesis, finding that current defenses remain limited by scalability, generalizability, utility trade-offs, and simplified threat models.

  • Problem

    Existing surveys lack a unifying framework, comprehensive coverage of emerging challenges and future directions, and broad treatment beyond specific model inversion techniques.

  • Method

    The survey provides a structured taxonomy of model inversion attacks, reviews attack techniques and defenses across biometrics, healthcare, and finance, and discusses future research directions.

  • Results

    The survey finds that model inversion attacks can compromise privacy despite defenses, while generative and adaptive methods improve reconstruction or attack performance across challenging settings.

  • Takeaways & Limitations

    Robust model inversion defenses require better privacy–utility balance, scalable and generalizable approaches, realistic threat models, and responsible dissemination of sensitive findings.

  • Takeaways & Limitations

    Current defenses remain limited in scalability, generalizability, model utility, and evaluation under realistic adversarial threat models.

Abstract

from arXiv · show

The rapid adoption of deep learning in sensitive domains has brought tremendous benefits. However, this widespread adoption has also given rise to serious vulnerabilities, particularly model inversion (MI) attacks, posing a significant threat to the privacy and integrity of personal data. The increasing prevalence of these attacks in applications such as biometrics, healthcare, and finance has created an urgent need to understand their mechanisms, impacts, and defense methods. This survey aims to fill the gap in the literature by providing a structured and in-depth review of MI attacks and defense strategies. Our contributions include a systematic taxonomy of MI attacks, extensive research on attack techniques and defense mechanisms, and a discussion about the challenges and future research directions in this evolving field. By exploring the technical and ethical implications of MI attacks, this survey aims to offer insights into the impact of AI-powered systems on privacy, security, and trust. In conjunction with this survey, we have developed a comprehensive repository to support research on MI attacks and defenses. The repository includes state-of-the-art research papers, datasets, evaluation metrics, and other resources to meet the needs of both novice and experienced researchers interested in MI attacks and defenses, as well as the broader field of AI security and privacy. The repository will be continuously maintained to ensure its relevance and utility. It is accessible at https://github.com/overgter/Deep-Learning-Model-Inversion-Attacks-and-Defenses.

1 Introduction

Deep learning models can memorize sensitive training details, making model inversion attacks a serious privacy threat. This survey responds with an integrated taxonomy, defense review, future-research agenda, and research repository.

  • Motivation: Deep learning models may memorize training-data details, enabling indirect inferences that threaten privacy in sensitive applications.The risk arises from how models encode and retain information about training data.
  • Motivation: Model inversion attacks exploit relationships between inputs and learned model parameters to recover sensitive training information and undermine trust.They require limited access in some settings, such as model outputs or intermediate features.
  • Existing surveys: Existing surveys leave gaps by lacking a unifying framework, comprehensive future directions, and broad coverage beyond specific techniques such as gradient inversion.These limitations motivate a more integrated treatment of attacks and defenses.
  • Contributions: The survey develops a structured taxonomy spanning attack methodology, data type, and application domain, alongside a systematic review of attack strategies and practical case studies.Covered methodologies include gradient-based, generative-model-based, and optimisation-based attacks across domains such as biometrics, healthcare, and finance.
  • Contributions: The survey reviews feature or gradient perturbation, differential privacy, and cryptographic encryption as defenses intended to reduce leakage while preserving model effectiveness.The authors frame defense design as a balance between privacy protection and predictive utility.
  • Contributions: The work identifies open questions, proposes future research directions, and provides a maintained repository of papers, datasets, evaluation metrics, and related resources.The repository is intended for novice and experienced researchers studying MI attacks, defenses, and AI security and privacy.

2 Fundamentals of MI Attacks

Model inversion attacks reconstruct sensitive input information by exploiting model parameters, outputs, or intermediate representations. Their operation depends on the targeted component and the adversary’s level of model access.

  • Deep Learning Models: Deep learning models use layered mathematical transformations to learn progressively abstract representations from input data.Each layer applies weights, biases, and an activation function to the preceding layer’s output.
  • Model Inversion Attacks: Model inversion attacks target parameters, outputs, or intermediate representations to reconstruct sensitive information about model inputs.The targeted component determines the attack’s optimization process.
  • Attacks Using Parameters: Gradient-based attacks iteratively optimize dummy inputs and labels so their gradients minimize the squared L2 difference from gradients computed on true training data.The recovered dummy data becomes increasingly similar to the true training data as the gradient discrepancy decreases.
  • Attacks Using Outputs or Intermediate Representations: Output- and representation-based attacks extract information from confidence scores or intermediate features, often without the iterative optimization used by gradient-based attacks.Intermediate representations can be analyzed to reconstruct input features.
  • Adversary Knowledge Scenarios: White-box, black-box, and gray-box attacks differ by whether adversaries have full, output-only, or partial access to the target model.White-box access includes architecture and parameters; black-box access is limited to API queries and outputs; gray-box access provides partial structural or format information.

3 Taxonomy of MI Attacks

The survey organizes MI attacks into gradient inversion, generative model-based, and optimisation-based strategies, emphasizing their mechanisms and applications. Gradient inversion attacks recover data from shared gradients and remain effective across challenging settings, including federated learning.

  • Taxonomy: MI attacks are classified into gradient inversion, generative model-based, and optimisation-based strategies.The taxonomy is designed to compare their operational mechanisms, strengths, limitations, and applications.
  • Gradient Inversion Attacks: Federated learning exchanges model parameters rather than raw data but remains vulnerable to gradient inversion attacks.Attackers can exploit gradients shared between clients and servers to reconstruct private inputs.
  • Broader Attack Settings: C2FMI and other approaches extend inversion to limited-access settings, while auxiliary-data methods can compromise privacy despite defenses.The cited work reports C2FMI outperforming some white-box attacks and adaptive inversion succeeding in vision and language tasks.
  • Gradient Inversion Attacks: Gradient inversion methods reconstruct client data by optimizing dummy inputs and labels until their gradients match communicated gradients.DLG and iDLG are basic examples of this gradient-matching approach.
  • Gradient Inversion Attacks: AGIC models multiple gradient updates across several epochs rather than relying only on a single mini-batch update.It estimates updates and assigns increasing weights to network layers to improve reconstruction quality.
  • Gradient Inversion Attacks: GI-NAS adaptively searches neural architectures instead of relying on fixed architectures or explicit prior knowledge.Experiments report advantages under high-resolution images, large batch sizes, and advanced defenses.

3.2 Generative Model-based Attacks

Generative model-based attacks use learned priors, latent representations, and model features to reconstruct sensitive data, including when model access is limited. The surveyed methods improve reconstruction quality, adaptability, or robustness across diverse attack settings.

  • Overview: Generative model-based attacks exploit GANs and learned representations to reconstruct sensitive inputs, including in black-box scenarios.These methods can recover high-quality approximations such as facial images from model outputs or intermediate features.
  • GAN-Based Inversion: GMI uses GANs trained on public data as informative priors to produce more realistic and semantically rich reconstructions.VMI extends this direction by formulating inversion as variational inference with an auxiliary-data prior.
  • GAN-Based Inversion: KEDMI trains a discriminator to distinguish both generated samples and soft labels supplied by the target model.It also recovers class-conditional training distributions rather than individual data points.
  • Black-Box Attacks: C2FMI uses a coarse phase to place reconstructions near the training-data distribution and a refinement phase for black-box optimization.The method is reported to outperform some white-box MI attacks and includes robustness analysis.
  • Black-Box Attacks: LOKT addresses label-only inversion by transferring knowledge from an opaque target model to an agent model.Its setting excludes confidence scores and other model information.
  • Feature and Memory-Based Methods: GIFD optimizes in an intermediate feature domain rather than only in a GAN latent space, increasing expressiveness and generality.DMMIA instead uses intra-class and inter-class prototype representations to generate varied discriminative outcomes.
  • Transformation Robustness: SIA-GAN learns to map scrambled images back to their originals, while some transformations such as block shuffling can hinder reconstruction.The findings indicate that scrambling does not provide uniformly established security.

3.3 Optimisation-based Attacks

Optimisation-based MI attacks reconstruct inputs by minimizing losses that align model outputs or internal representations with target criteria. They support both white-box and black-box settings through gradient, output, and related matching objectives.

  • Core Mechanism: Optimisation-based attacks iteratively minimize loss functions so reconstructed data aligns with model outputs or internal representations.The approach applies to white-box settings with gradients and black-box settings using predictions.
  • Gradient Matching: Gradient matching reconstructs inputs by minimizing the difference between observed gradients and gradients computed from reconstructed data.DLG, iDLG, and LOMMA are identified as examples.
  • Output Matching: Output matching reconstructs inputs whose model outputs resemble target outputs, including by matching confidence scores.The survey connects this mechanism to attacks recovering sensitive genomic information from classifier outputs.

3.4 Miscellaneous MI Attacks

The survey also covers MI attacks that fall outside its three principal categories, spanning pretrained-model synthesis, graph data, interpretability, label information, regularization, and ensembles. These methods show that inversion risks extend across architectures, data structures, and model signals.

  • Other Settings: DeepInversion synthesizes high-quality images from pretrained networks without access to original training data.It uses internal feature statistics stored in batch-normalization layers.
  • Other Settings: GraphMI addresses inversion against graph neural networks, where relational structure makes direct application of lattice-domain methods sub-optimal.The method targets privacy risks specific to graph data.
  • Explainable AI: Interpretability can increase inversion risk because spatial knowledge in image explanations can improve reconstruction efficiency.The cited work reports higher inversion performance for a multimodal transposition CNN than methods using target predictions alone.
  • Label and Auxiliary Information: SMI uses class information from victim-model outputs and labeled auxiliary data to generate more visually convincing and detailed inversion samples.Its design reduces reliance on prior target information.
  • Regularization: Traditional label smoothing may increase vulnerability to MI attacks, motivating the proposed LSMI approach.The survey describes this as an unintended privacy consequence of a regularization technique.
  • Ensemble Methods: EMI combines multiple trained models to infer the original training-data distribution and improve reconstruction quality over single-model inversion.The resulting samples display more distinguishable dataset features.

3.5 Summary

MI attacks comprise gradient inversion, generative model-based, and optimisation-based approaches, each using different information and facing distinct access, resource, or input constraints. Figure 4 illustrates the contrast between gradient inversion and generative model-based attacks.

  • Gradient inversion attacks reconstruct sensitive data from shared gradients, using methods such as DLG, iDLG, and AGIC.They can operate in white- or gray-box settings but require gradient access.
  • Generative model-based attacks reconstruct data by approximating distributions with GANs, model outputs, or intermediate features.GMI and VMI improve fidelity through latent spatial priors or probabilistic modeling and support white- and black-box settings.
  • Optimisation-based attacks iteratively refine reconstructions using loss functions that enforce consistency with outputs, gradients, or intermediate features.They combine gradient inversion accuracy with generative-method flexibility but require substantial computation and specific attack inputs.
  • Figure 4 provides a demonstrative comparison of gradient inversion and generative model-based attacks.

3.6 MI in Different Applications

MI attacks threaten privacy in biometric, healthcare, and financial applications by reconstructing sensitive inputs from learned representations. These domains involve high-stakes data, including biological traits, medical records, and financial histories.

  • MI attacks can reconstruct private inputs in biometric recognition, healthcare, and financial systems, causing privacy and data breaches.
  • Table 2 compares gradient inversion and generative model-based attacks across multiple factors.
  • Biometric systems: Biometric systems process unique biological traits, so MI attacks can reconstruct sensitive facial images or fingerprints.Relevant deployments include border control, law enforcement, and secure access control.
  • Healthcare systems: Healthcare models process medical records, imaging, and genetic data, making MI mitigation vital for patient privacy and ethical deployment.Improper handling can also undermine patient trust and create legal consequences for providers.
  • Financial systems: Financial models use transaction, personal financial, and credit data that MI attacks may expose for fraud, identity theft, or related harms.

3.7 MI on Different Data Types

MI attacks affect images, audio, text, and tabular data across application domains by exploiting model parameters, features, outputs, or gradients. Research has developed specialized reconstruction methods for each data type.

  • MI attacks span biometric, healthcare, and financial applications that process image, audio, text, and tabular data.
  • Images: Image attacks reconstruct visual inputs using gradients or model outputs such as confidence scores.
  • Figure 5 depicts MI attacks across applications processing different data types.
  • Audio: Audio attacks can reconstruct spoken phrases and acoustic features, potentially exposing speaker identity or confidential information.
  • Text and tabular data: Text and tabular attacks infer private information from embeddings, labeling probabilities, gradients, or model outputs.Textual structure and context increase reconstruction risks when datasets contain private or domain-specific information.
  • Text and tabular data: DAGER targets large language models by exploiting low-rank self-attention gradients and the discrete nature of text.
  • Text and tabular data: Text Revealer reconstructs private transformer-classifier training data using external datasets, GPT-2, and feedback-driven perturbations.
  • Text and tabular data: TabLeak achieves over 90% reconstruction accuracy on private tabular data despite large batch sizes.This challenges security assumptions associated with FedSGD and FedAvg.

3.8 MI on Emerging Generative AI and Foundation Models

Generative AI and foundation models create new MI concerns because their complex outputs, embeddings, and representations can leak training or user data. Recent work examines inversion risks in LLMs, diffusion models, and split-learning systems.

  • The rise of diffusion models and LLMs has increased concern about MI attacks and data reconstruction from complex model outputs.
  • Foundation models: Unrestricted access to generative LLMs can expose them to malicious MI attacks across downstream NLP tasks.
  • Foundation models: Embedding inversion attacks restore original inputs from feature embeddings that may contain sensitive user information.
  • Foundation models: Multilingual models are more vulnerable to inversion attacks than monolingual models in black-box multilingual and cross-lingual settings.
  • Foundation models: A two-stage split-learning attack projects LLM representations into embedding space before using a generative model for reconstruction.The approach uses mutual information entropy to study information propagation in transformer-based LLMs.
  • Diffusion models: Diffusion models generate higher-quality images and are easier to scale and control than earlier GAN-based approaches.
  • Diffusion models: A two-stage fusion optimization scheme can reconstruct an image almost identical to the original by combining generative priors with pixel-level fine-tuning.

4 Defenses Against MI Attacks

The survey organizes MI defenses into six categories spanning feature and gradient protection, differential privacy, encryption, and model or architecture enhancement. These approaches aim to reduce sensitive information leakage while preserving model utility and computational efficiency, although distributed-learning defenses address varied risks and trade-offs.

  • Defense taxonomy: Six defense categories comprise feature perturbation/obfuscation, gradient pruning, gradient perturbation/obfuscation, differential privacy, cryptographic encryption, and model/architecture enhancement.The categories are presented as approaches intended to protect privacy while preserving model utility and computing efficiency.
  • Feature perturbation/obfuscation: Feature perturbation and obfuscation distort data representations through noise, feature transformations, or sensitive-information concealment while retaining underlying model utility.Examples include image enhancement, additive noise, privacy-guided training, statistical features, VRM, DCS2, ATS, Soteria, Crafter, sparse-coding architectures, and privacy-preserving synthetic data.
  • Feature perturbation/obfuscation: Soteria perturbs data representations embedded in gradients, and evaluations against DLG on MNIST and CIFAR10 demonstrate significantly improved privacy protection.The method targets gradient representations identified as a principal channel of privacy leakage in federated learning.
  • Model and data protection: Other surveyed defenses include feature crafting, sparse-coding architectures, and synthetic-data generation with privacy-preserving techniques to restrict reconstruction or attribute inference.Crafter directs adaptive attackers toward non-private priors, sparse coding enhances network robustness, and synthetic data is paired with privacy measures rather than applied directly to raw data.
  • Gradient pruning: Gradient pruning selectively removes or compresses transmitted gradients to improve privacy preservation and communication efficiency while preserving model performance.PATROL applies privacy-oriented pruning, edge deployment, and task-relevant feature selection to reduce leakage in collaborative inference; DGP addresses gradient-inversion risks in collaborative learning.

5 Evaluation Metrics in MI Attacks and Defenses

MI research uses metrics ranging from pixel-level reconstruction errors to perceptual, feature-distribution, structural, and leakage measures. These metrics evaluate reconstruction fidelity, perceptual similarity, data recovery, and privacy leakage from complementary perspectives.

  • Pixel-level metrics: MSE measures average squared reconstruction error, with lower values indicating reconstructed data closer to the original target.It is used for image reconstruction and attribute-inference evaluation where fidelity to the original data matters.
  • Pixel-level metrics: PSNR evaluates reconstruction quality by comparing maximum possible signal power with noise power, using MSE between original and reconstructed images.MAX denotes the maximum possible pixel value, such as 255 for 8-bit images.
  • Perceptual metrics: SSIM compares image luminance, contrast, and structural information as a perceptual alternative to traditional error measures such as MSE.Its formulation uses image means, variances, covariance, and stabilizing constants.
  • Distribution metrics: FID measures similarity between real and generated image feature distributions using the Wasserstein-2 distance.The metric compares feature means and covariance matrices, including the trace of the covariance-derived term.
  • Perceptual and feature metrics: FSIM evaluates human-perception-based similarity using phase congruency and gradient magnitude, while LPIPS compares representations in pretrained neural-network feature spaces.FSIM uses pixelwise phase-congruency and similarity terms; LPIPS captures semantic and perceptual nuances in visually complex reconstructions.
  • Leakage and recovery metrics: AVD compares reconstructed and original images through spatial gradients, whereas RDLV quantifies and compares leakage in federated gradient-inversion attacks.AVD uses first- and second-order spatial-gradient information; RDLV supports comparisons across clients and privacy-preserving configurations.

6 Datasets for MI Attack Research

MI studies use datasets spanning handwritten digits, fashion, natural objects, faces, medical images, skin lesions, banking records, and celebrity attributes. Their scales and modalities support evaluation across image reconstruction, identity, attribute, and tabular privacy settings.

  • Digit and fashion datasets: MNIST contains 60,000 training and 10,000 test images of handwritten digits represented as 28x28 grayscale pixels.It is widely used in MI-related research listed by the survey.
  • Digit and fashion datasets: F-MNIST contains 70,000 28x28 grayscale fashion-product images across 10 categories, split into 60,000 training and 10,000 test images.Each category contains 7,000 images.
  • Natural-image datasets: CIFAR-10 provides 60,000 32x32 color images across 10 classes, while CIFAR-100 provides 100 classes with 600 images per class and fine and coarse labels.CIFAR-10 has 50,000 training and 10,000 test images; CIFAR-100 has 500 training and 100 test images per class.
  • Face datasets: Face datasets include FFHQ, LFW, CelebA, and AT&T, covering high-resolution faces, unconstrained identities, celebrity attributes, and controlled grayscale subjects.FFHQ contains 70,000 1024x1024 face images; LFW contains 13,233 images of 5,749 individuals; CelebA contains 202,599 images with 40 attributes; AT&T contains 400 images of 40 subjects.
  • Medical datasets: ChestX-ray8 contains 108,948 frontal X-rays from 32,717 patients with eight disease labels, while LDC contains 8,000 training and 2,000 test skin-lesion images.These datasets support medical-image analysis, disease diagnosis, and lesion classification research.
  • Tabular and large-scale visual datasets: UBMD contains 41,188 instances with 17-dimensional banking data, SVHN contains 600,000 32x32 RGB digit images, and ImageNet contains over 14 million annotated images across more than 20,000 categories.The datasets broaden MI evaluation beyond faces and small grayscale images to tabular data, street-view digits, and large-scale object recognition.

7 Challenges and Future Research Directions

The survey identifies unresolved challenges in balancing privacy with utility, defining realistic threats, scaling defenses, and evaluating them across representative domains. It proposes adaptive defenses, realistic benchmarks, standardized metrics, open repositories, and responsible dissemination as future directions.

  • Balancing Privacy and Model Utility: Privacy-preserving defenses often reduce model utility, creating a persistent trade-off between privacy protection and predictive performance.The survey recommends adaptive, multi-objective approaches that minimize privacy leakage while preserving utility.
  • Defining Realistic Threat Models: Realistic threat models must capture architecture-specific vulnerabilities, adversary capabilities, heterogeneous data, and conditions beyond controlled laboratory settings.The survey highlights transformers, multimodal models, noisy data, and diverse deployment structures as underexplored factors.
  • Scalability and Generalizability of Defenses: Existing defenses face scalability and generalizability limits because computational demands and architecture-specific designs hinder deployment in large-scale or resource-constrained systems.Differential privacy and homomorphic encryption can be effective in controlled settings but may require substantial resources, while other defenses may not transfer across architectures.
  • Domain-Specific Challenges: Healthcare, finance, and edge-based IoT systems require domain-specific defenses that accommodate sensitive data formats, diagnostic utility, computation limits, and latency constraints.Healthcare involves tabular records and medical images, whereas IoT deployments may require lightweight encryption or pruning.
  • Evaluation and Reproducibility: Standardized metrics and representative datasets are needed to compare leakage, attack success, and defense robustness under realistic conditions.Common datasets such as CIFAR-10 and MNIST may not represent complexities in healthcare or finance.
  • Evaluation and Reproducibility: Open-source repositories and simulation environments can improve reproducibility, transparent comparison, and collaboration in MI research.The survey presents its repository of research papers, datasets, metrics, and related resources as a contribution addressing this need.
  • Responsible Research: Responsible dissemination and collaboration among technical, legal, and ethical experts are needed to reduce the risk that MI research enables malicious exploitation.The survey calls for clear publication guidelines while maintaining open research.

8 Conclusion

The survey synthesizes MI attacks, defenses, applications, and future directions through a structured taxonomy and broad review. It concludes that practical progress requires more scalable, generalizable, utility-preserving defenses and threat models that better reflect real-world adversaries.

  • Contributions: The survey provides a structured taxonomy of MI attacks and reviews defense mechanisms across biometrics, healthcare, finance, and other applications.Its overview spans diverse attack techniques, defense strategies, and application domains.
  • Limitations: Current defenses remain limited by scalability, generalizability, model-utility preservation, and simplified threat-model evaluations.These limitations constrain how well existing approaches reflect practical deployments and adversarial capabilities.
  • Future Directions: Future work should define realistic threat models, improve defense explainability, and address domain-specific challenges.The survey identifies these directions as steps toward more secure systems resilient to MI attacks.
Loading 2501.18934v2…