Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey

1 Introduction

• Deep learning models may memorize sensitive training information, enabling model inversion attacks to reconstruct private data and undermine trust in biometric, healthcare, and financial systems.Attack success depends on model access, architecture, and input-output correlations, while defenses must balance privacy protection against predictive utility.Source: §1 · pp. 2–3

1.1 Existing Surveys on MI Attacks and Defenses

• Existing surveys address gradient inversion, attack taxonomies, defenses, and theoretical leakage bounds, but often lack unified coverage across paradigms, applications, challenges, and broader MI threats.This survey addresses those gaps through an integrated analysis of attacks, defenses, applications, data types, evaluation metrics, and future directions.Source: §1.1 · pp. 4–5

1.2 Contributions of This Work

• The survey contributes a structured taxonomy, an extensive defense review, future research directions, and a maintained repository of standardized methods, datasets, metrics, and research articles.The taxonomy organizes attacks by methodology, data type, and application domain; defenses include perturbation, differential privacy, and cryptographic encryption.Source: §1.2 · pp. 5–6

1.3 Literature Selection Methodology

• The literature selection combines searches across major digital libraries and conferences with Boolean queries, Population–Concept–Context scoping, duplicate removal, and explicit inclusion and exclusion criteria.Approximately 500 articles were retrieved, approximately 180 high-quality papers were selected, and the final corpus was organized into four research themes.Source: §1.3 · pp. 6–7

2 Fundamentals of MI Attacks

• The fundamentals section frames MI attacks as a privacy and security threat because model information can reveal sensitive training inputs and motivate robust defense design.It covers attack definitions, characteristics, exploited model components, and adversarial knowledge scenarios.Source: §2 · p. 7, §2.1 · p. 8

2.1.1 Deep Learning Models

• Deep learning models use interconnected neuron layers that apply successive mathematical transformations, with weights, biases, activations, composition, and decision functions producing predictions.Weights are iteratively updated through loss-guided optimization, and gradients indicate how weight changes affect the loss.Source: §2.1.1 · p. 8

2.1.2 MI Attacks on Deep Learning Models

• MI attacks reconstruct sensitive inputs by exploiting model parameters, outputs, or intermediate representations, with attack optimization varying according to the targeted component.Gradient-based attacks optimize dummy inputs and labels to minimize the L2 difference between dummy and real gradients, whereas output- or representation-based attacks can often extract information without explicit iterative optimization.Source: §2.1.2 · pp. 8–9

2.2 MI Attacks under Different Model Knowledge Scenarios

• Adversarial access determines the available information: white-box attackers access architecture, training algorithms, parameters, or activations; black-box attackers observe API outputs; gray-box attackers have partial structural knowledge.Black-box observations can include labels, probabilities, and logits, while gray-box access may reveal specific layers or output formats without parameters or training details.Source: §2.2 · p. 9

3 Taxonomy of MI Attacks

• The taxonomy classifies MI attacks into gradient inversion, generative model-based, and optimisation-based strategies with distinct mechanisms, applications, strengths, and limitations.The classification is presented as a structured framework for understanding evolving MI attacks.Source: §3 · pp. 9–10

3.1 Gradient Inversion Attacks

• Federated learning still exposes private data because attackers can exploit shared gradients between clients and servers to reconstruct sensitive inputs, undermining its privacy benefits.An adaptive auxiliary-data method inverted gradients in both vision and language tasks despite differential privacy and gradient compression, indicating that these defenses may underestimate FL privacy risks.Source: §3.1 · pp. 10–11
• DLG and iDLG reconstruct client data by optimizing dummy inputs and labels until their generated gradients match communicated gradients, with iDLG differing in ground-truth label extraction.Both attacks target local FL data through communicated ∇W gradients. (Zhao et al., 2020)Source: §3.1 · p. 11
• AGIC models multiple gradient updates across epochs, improving realism and reconstruction quality while achieving up to a 50% PSNR improvement and operating five times faster than earlier simulation-based attacks.The method estimates updates and assigns increasing weights to neural-network layers, with evaluations on CIFAR-10, CIFAR-100, and ImageNet.Source: §3.1 · p. 11
• RGCIR improves reconstruction through cosine-based gradient comparison, input regularization, and total-variation denoising, while LOMMA revises optimization objectives and uses segmentation-adaptive augmentation to reduce MI overfitting.RGCIR recovers high-fidelity training data from large datasets including ImageNet, whereas LOMMA addresses suboptimal objectives and semantic failures in reconstructed images.Source: §3.1 · p. 12
• EGIA shows that gray-box adversaries can reconstruct private inputs by intercepting public gradients even when FL clients and servers are honest, while SGI recovers high-resolution images from complex models and large batches.SGI models feature coefficient variation, recovers labels with an evolutionary algorithm, and then performs stepwise inversion to improve convergence. (Liang et al., 2023; Ye et al., 2024)Source: §3.1 · p. 12
• GGI reduces high-dimensional search by optimizing low-dimensional latent vectors from a pretrained generator, improving reconstruction efficiency and restored-image quality.The approach replaces direct dummy-image optimization with generator-based latent optimization. (Zhu et al., 2024a)Source: §3.1 · p. 12
• GI-NAS adaptively searches neural architectures and outperforms many existing methods, particularly for high-resolution images, large batches, and advanced defenses.Unlike fixed-architecture approaches requiring explicit priors such as pretrained generators, GI-NAS exploits implicit prior knowledge to improve attack adaptability and generalization. (Yu et al., 2024)Source: §3.1 · pp. 12–13

Generative model-based attacks

• GAN-based MI attacks reconstruct sensitive inputs from model outputs or intermediate features by combining generators that match model representations with discriminators that assess realism.These attacks can operate in black-box scenarios and generate high-quality approximations of private data.Source: §3.2 · p. 13
• GMI (Zhang et al., 2020) uses GAN priors learned from public data, while VMI (Wang et al., 2021) adds variational inference to trade off reconstruction realism and target accuracy.VMI’s KL-divergence objective supports more realistic and diverse reconstructions of faces or medical images.Source: §3.2 · p. 13
• KEDMI uses soft-label-aware discrimination and distribution recovery to reconstruct class-conditional training distributions rather than individual samples.The many-to-one formulation improves attack success across datasets and architectures by preserving statistics relevant to target-model class inference.Source: §3.2 · pp. 13–14
• PLG-MI combines top-n pseudo-label selection and max-margin loss in a cGAN to improve reconstruction fidelity and attack success across models.The design decouples class-conditioned training and narrows optimization toward target-category subspaces.Source: §3.2 · p. 14
• IF-GMI (Qiu et al., 2024) optimizes GAN intermediate features alongside latent codes under L1-ball constraints, improving semantic realism and performance especially in OOD settings.MIRROR similarly improves fidelity by separately modeling StyleGAN styles and searching for label-consistent parameterizations.Source: §3.2 · p. 14

Black-box and label-only attacks

• PPA (Struppek et al., 2022) decouples image priors from target models, enabling one pretrained GAN to attack multiple targets and remain robust under distribution shifts.BREP-MI achieves high-fidelity label-only inversion using boundary exclusion, approaching white-box effectiveness with less model information.Source: §3.2 · p. 15
• C2FMI combines coarse inversion-network initialization with black-box refinement and can outperform some white-box attacks, while RLBMI improves black-box reconstruction using reinforcement-learning latent-space search.RLBMI uses confidence rewards and achieves higher accuracy with fewer queries than traditional black-box GAN methods.Source: §3.2 · p. 15
• LOKT (Nguyen et al., 2024) transfers knowledge from an opaque target through a target-assisted cGAN, exceeding existing label-only attacks by over 15% across benchmarks; SecretGen works without ground-truth tags in white- and black-box settings.SecretGen combines a cGAN, pseudo-tag predictor, and latent-vector selector and remains comparable or superior to methods using ground-truth labels.Source: §3.2 · p. 16

Optimisation-based Attacks

• Optimisation-based attacks iteratively minimize designed losses, including gradient matching and output matching, using gradient descent or stochastic gradient descent for high-fidelity data recovery (Fang et al., 2024; Guo et al., 2024).These methods accommodate white-box attacks with accessible gradients and black-box attacks using only predictions.Source: §3.3 · p. 17

Gradient Matching

• Gradient matching reconstructs individual training data by minimizing differences between observed and reconstructed-input gradients, encompassing DLG, iDLG (Zhao et al., 2020), and LOMMA.The gradients may be shared during federated learning, enabling attackers to guide reconstruction.Source: §3.3 · pp. 17–18

Output Matching

• Output matching reconstructs inputs that produce target-model outputs by matching confidence scores, extending model inversion to varied settings (Guo et al., 2024).Adversarial access to linear classifiers was shown to expose sensitive genomic information in personalized medicine.Source: §3.3 · p. 18

DeepInversion

• DeepInversion synthesizes high-fidelity, contextually accurate images from pretrained networks without original training data by exploiting batch-normalization feature statistics.It supports data-free knowledge refinement, pruning, and continuous learning, offering an efficient alternative to GAN-based generation and earlier gradient-descent inversion.Source: §3.4 · p. 18

RL-GraphMI

• RL-GraphMI targets hard-label black-box inversion of graph neural networks using gradient estimation and reinforcement learning, while GraphMI combines projected gradients with graph autoencoders for sparse, topology-aware reconstruction (Zhang et al., 2022).Experiments found differential-private training and graph preprocessing insufficient against these graph privacy attacks.Source: §3.4 · p. 18

Explainable Artificial Intelligence (XAI)

• Interpretation-assisted inversion can reconstruct private images more effectively than prediction-only methods, and attention shifting can invert proxy-model interpretations even without access to the target model.The findings show that spatial knowledge exposed by XAI improves attack efficiency, creating a privacy–interpretability tradeoff.Source: §3.4 · pp. 18–19

Supervised Model Inversion (SMI)

• SMI uses victim-model outputs and labeled auxiliary data to learn pixel-level and data-to-category features, producing more convincing, detailed reconstructions while reducing reliance on prior target information.Auxiliary-dataset composition strongly affects reconstruction quality, whereas ground-truth labels are useful but not essential.Source: §3.4 · p. 19

Label Smoothing Model Inversion (LSMI)

• Traditional label smoothing can increase model-inversion vulnerability, whereas LSMI applies a negative factor to improve resilience, hinder category-information extraction, and outperform existing defenses (Struppek et al., 2023).Source: §3.4 · p. 19

Ensemble Model Inversion (EMI)

• EMI exploits multiple trained models to obtain richer distributional information and improve reconstruction quality, including high-quality data-free inversion without auxiliary datasets.The method highlights model diversity and adds constraints to improve prediction accuracy and reconstructed-sample activation.Source: §3.4 · p. 19

Gradient inversion attacks

• Gradient inversion attacks reconstruct sensitive data from shared gradients using methods such as DLG, iDLG, and AGIC, but require gradient access despite working in white- or gray-box settings.DLG and iDLG align fake with real gradients, while AGIC improves scalability and accuracy.Source: §3.5 · pp. 19–20

Generative model-based attacks

• Generative model-based attacks use GANs to approximate data distributions from model outputs or intermediate features, enabling effective white- and black-box reconstruction but requiring auxiliary data or pre-trained models.GMI and VMI improve fidelity through latent spatial priors or probabilistic modeling, increasing complexity and resource requirements.Source: §3.5 · p. 20

Optimisation-based attacks

• Optimisation-based attacks iteratively refine reconstructions with tailored loss functions that enforce consistency with outputs, gradients, or intermediate features.They combine the accuracy of gradient inversion with the flexibility of generative methods, but are computationally intensive and depend on specific attack inputs.Source: §3.5 · p. 20

3.6 MI in Different Applications

• Across these applications, MI attacks exploit learned representations in deep learning models to reconstruct private inputs, creating broad privacy and data-breach risks.The affected domains include biometrics, healthcare, and financial services.Source: §3.6 · p. 20

3.6.1 MI in Biometric Recognition Systems

• MI attacks reconstruct sensitive biometric data, potentially enabling authentication bypass, impersonation, and malicious misuse because biometric traits cannot be readily replaced like passwords (Yang et al., 2019a,b, 2022).These risks affect facial recognition, fingerprint authentication, and iris scanning in high-stakes environments, motivating research on MI defenses (Zhang et al., 2024; Ahmad et al., 2022; Huang et al., 2024; Khosravy et al., 2022, 2021; Yoshimura et al., 2021).Source: §3.6.1 · p. 21

3.6.2 MI in Healthcare Systems

• MI attacks on healthcare models may recover private health information, exposing medical records, imaging, and genetic data to identity theft, insurance fraud, discrimination, legal consequences, and loss of patient trust.Understanding and mitigating these attacks is vital for patient privacy and the ethical deployment of AI in healthcare (Ra et al., 2021; Pei et al., 2022; Wei et al., 2023; Dao and Nguyen, 2024; Hatamizadeh et al., 2023).Source: §3.6.2 · pp. 21–22

3.6.3 MI in Financial Systems

• MI attacks on financial models can infer private financial details and reconstruct transactions, enabling fraud, identity theft, unauthorized transactions, and damage to confidence in AI-based financial services.Financial institutions therefore need defensive measures to protect customer data and maintain model integrity.Source: §3.6.3 · p. 22

3.7 MI on Different Data Types

• MI attacks span visual, speech, language, and structured-data systems, reconstructing sensitive training data from learned parameters, features, or outputs.These vulnerabilities affect applications including biometrics, healthcare, and finance.Source: §3.7 · p. 22, Figure 5 · p. 23

3.7.1 MI on Images

• Image-based MI attacks recover visual training details, including personally identifiable information, from gradients or model outputs, motivating feature perturbation, cryptographic, and differential-privacy defenses.The cited defenses specifically target image reconstruction risks.Source: §3.7.1 · p. 22

3.7.2 MI on Audios

• Sliding model inversion reconstructs overlapping audio chunks and intermediate speech features, enabling voice extraction, speaker impersonation, and voice-protected command spoofing.Pizzi et al. (2023) applied the technique to automatic speech recognition systems.Source: §3.7.2 · p. 23

3.7.3 MI on Texts and Tabular Data

• DAGER accurately recovers entire batches of large-language-model input texts by exploiting low-rank self-attentive gradients and discrete token embeddings, improving speed, scalability, and reconstruction quality.Petrov et al. (2024) designed DAGER to address earlier attacks’ limited reconstruction of short text sequences.Source: §3.7.3 · p. 24
• Text Revealer reconstructs private training text in transformer classifiers by generating class-domain text with external data and GPT-2, then perturbing it using target-model feedback.Zhang et al. (2022) evaluated the attack across text datasets with varying sequence lengths.Source: §3.7.3 · p. 24
• TabLeak achieves over 90% reconstruction accuracy on private tabular data despite large batch sizes, challenging the security assumptions of FedSGD and FedAvg.Its mixed discrete and continuous features require techniques including soft-max relaxation and entropy-based uncertainty quantization.Source: §3.7.3 · p. 24

3.8 MI on Emerging Generative AI and Foundation Models

• Generative AI and foundation models are vulnerable to model inversion attacks that reconstruct sensitive text, image, and audio training data from learned representations or model outputs.These risks affect diffusion models, LLMs, and other foundation models, raising privacy, ethical, and security concerns.Source: §3.8 · p. 24

3.8.1 MI on LLMs

• Language-model inversion can recover inputs from embeddings or next-token probabilities, sometimes producing text similar to or identical to the original.Embedding inversion targets original inputs, while language-model predictions can contain substantial information about preceding text.Source: §3.8.1 · p. 25
• Multilingual LLMs are more vulnerable than monolingual models, while activation inversion exposes training-data leakage in decentralized training.The activation inversion attack trains a reconstruction model from public-data text labels and corresponding activations.Source: §3.8.1 · p. 25
• Split-learning attacks can reconstruct text from LLM representations, whereas Embedding Guard protects more than 95% of tokens from inversion while preserving downstream utility.The attack uses representation projection followed by generative text recovery; Eguard combines transformer projection networks with textual mutual-information optimization.Source: §3.8.1 · p. 25

3.8.2 MI on Diffusion Models

• Diffusion models can memorize and emit individual training images, and a generate-and-filter pipeline extracted over a thousand examples, indicating lower privacy than GANs.Extracted examples included people’s photographs and company trademark logos.Source: §3.8.2 · p. 26
• Diffusion-model priors improve inversion reconstruction through latent-space constraints, pixel-level refinement, group consistency, and spatial regularization.Reported methods can reconstruct images almost identically, improve high-resolution and large-batch recovery, and mitigate overfitting while producing more diverse concept combinations.Source: §3.8.2 · p. 26

4.1 Feature Perturbation/Obfuscation

• Feature perturbation and obfuscation distort representations through noise, transformations, synthetic samples, or crafted features while preserving model utility; Soteria improves privacy against DLG on MNIST and CIFAR10 with robustness and convergence guarantees.Other approaches include VRM, DCS2, ATS, Crafter, sparse-coding architectures, synthetic data, image augmentation, additive noise, privacy-guided training, and statistical features via knowledge distillation.Source: §4.1 · pp. 27–29

4.2 Gradient Pruning

• Gradient pruning selectively removes or compresses gradients to reduce MI leakage and communication costs while preserving performance; DGP strengthens privacy and significantly reduces communication cost in collaborative learning.PATROL combines privacy-oriented pruning, edge deployment, task-relevant features, Lipschitz regularization, and adversarial training, while pFGD and DGC target gradient-inversion risk and bandwidth efficiency.Source: §4.2 · pp. 29–30

4.3 Gradient Perturbation/Obfuscation

• Gradient perturbation and obfuscation mask shared updates through fragmentation, shuffling, aggregation, compression, amplitude perturbation, and quantization while retaining utility; autoencoder compression reduces communication by 4.1 times with nearly unchanged performance.GradPrivacy protects trained models using amplitude perturbation and deviation correction, while hybrid quantization improves robustness against iteration- and recursion-based gradient inversion attacks.Source: §4.3 · pp. 30–31

4.4 Differential Privacy

• Differential privacy limits reconstruction by adding calibrated noise to training, gradients, parameters, or outputs, but methods must balance privacy against utility; class- and subclass-level DP, augmented DP, healthcare DP, and local DP refine this balance.Local DP combines parameter sparsification, dynamic privacy budgets, Top-K communication optimization, and weighted aggregation, while healthcare DP reduces MI risk while maintaining high model accuracy.Source: §4.4 · pp. 32–33

4.5 Cryptographic Encryption

• Cryptographic defenses encrypt or hash gradients and training images to block reconstruction while preserving accuracy; CAHE reports 97.20% accuracy, with partial gradient sharing reaching 97.17% under upmost selection and 97.12% under random selection.Secure aggregation reduces key-establishment overhead by forming keys with client subsets, and perceptual hashing returns hashed rather than original images in adversarial scenarios.Source: §4.5 · p. 33

4.6 Model/Architecture Enhancement

• Model and architecture enhancements embed privacy into networks: PRECODE reduces attack success to 0% through variational random sampling, while SecCNN, RVE-PFL, and ResSFL improve resistance without sacrificing efficiency or utility.ResSFL combines attacker-aware training with a bottleneck layer, and SecCNN uses an upsampling layer and rank analysis without added computational cost.Source: §4.6 · p. 34

4.7 Miscellaneous MI Defenses

• TL-DMI uses transfer learning and Fisher-information analysis to limit layers encoding sensitive information, reducing MI success while preserving model utility without regularization-related performance losses.Extensive experiments describe TL-DMI as invulnerable to MI attacks and robust for privacy protection.Source: §4.7 · pp. 34–35
• BiDO reduces representation–input dependency while increasing representation–output dependency through BiDO-COCO and BiDO-HSIC, limiting MI attacks with minimal classification-accuracy impact.This design addresses the conflict between minimizing input–output dependency for privacy and maximizing it for accurate classification.Source: §4.7 · p. 35
• MID controls input information captured in predictions, reducing privacy-attribute reconstruction and outperforming traditional methods such as differential privacy across models and datasets (Wang et al., 2021).The passage characterizes MID as a theoretically sound alternative to traditional defenses.Source: §4.7 · p. 35

4.8 Summary

• Defense categories include feature and gradient perturbation, differential privacy, encryption, and model enhancements, targeting privacy while retaining accuracy, robustness, or communication efficiency.Examples include Crafter, Soteria, GradPrivacy, class-level DP, certificateless homomorphic encryption, secure aggregation, perceptual hashing, PRECODE, and ResSFL.Source: §4.8 · p. 35
• IoT and edge settings require lightweight defenses because privacy, utility, and computational costs remain difficult to balance, while most gradient-pruning methods lack real-device evaluation.DGC reduces gradient exchange by 99.9% while preserving accuracy; gradient pruning improves privacy and communication efficiency, but practical validation remains limited.Source: §4.8 · pp. 35–36

Pixel-based metrics

• Lower MSE indicates reconstructions closer to the original data, making it useful for image reconstruction and attribute inference tasks.MSE quantifies the average squared difference between reconstructed and target data; smaller values indicate better performance.Source: §5 · p. 36

Perceptual and signal-quality metrics

• LPIPS evaluates perceptual similarity through neural-network feature representations, while PSNR measures reconstruction fidelity relative to signal noise and SSIM compares luminance, contrast, and structure (Zhang et al., 2018; Lin et al., 2005; Wang et al., 2003, 2004).LPIPS is suited to visually complex reconstructions; PSNR uses maximum pixel value and MSE, whereas SSIM models structural information perceived by human vision.Source: §5 · pp. 36–37

Feature-based metrics

• FID compares real and generated image feature distributions using Wasserstein-2 distance, whereas FSIM combines phase congruency and gradient magnitude to capture perception-based image similarity (Shi et al., 2024).FID uses feature means and covariance matrices; FSIM evaluates perceptual features over image pixels.Source: §5 · pp. 37–38

Privacy-leakage metrics

• AVD evaluates recovery and information leakage by comparing spatial gradients of reconstructed and original images, while RDLV quantifies leakage in gradient inversion across clients and privacy configurations (Papadopoulos et al., 2024; Hatamizadeh et al., 2023).AVD uses second-order spatial gradients; RDLV compares original training images, reconstructions, and attack priors.Source: §5 · p. 38
• IIP measures image-specific disclosure by estimating whether a reconstructed image identifies its corresponding original among similar dataset images.It is determined from the proportion of exact matches between an original image and its closest reconstructed-set neighbor.Source: §5 · p. 38

Standard image benchmarks

• MNIST, F-MNIST, CIFAR-10, and CIFAR-100 provide standard grayscale and color image benchmarks with varied class counts, resolutions, and labeling structures.MNIST contains 60,000 training and 10,000 test 28x28 grayscale digit images; F-MNIST has 70,000 28x28 grayscale fashion images across 10 categories; CIFAR-10 has 60,000 32x32 color images across 10 classes; CIFAR-100 has 100 classes organized into 20 superclasses.Source: §6 · pp. 38–39

Face datasets

• Face-focused datasets support MI research from unconstrained recognition to high-resolution synthesis, including LFW, CelebA, FFHQ, and AT&T’s Database of Faces.LFW contains 13,233 images of 5,749 individuals; CelebA contains 202,599 images of 10,177 identities with 40 binary attributes; FFHQ contains 70,000 1024x1024 face images; AT&T contains 400 grayscale images of 40 subjects.Source: §6 · pp. 39–41

Large-scale visual data

• ImageNet supplies a large-scale object-recognition benchmark with over 14 million annotated images spanning more than 20,000 categories.Bounding boxes are provided for at least one million ImageNet images, supporting deep-learning training and benchmarking.Source: §6 · p. 40

Medical and tabular datasets

• Medical and financial datasets extend MI evaluation beyond ordinary images to chest radiographs, skin lesions, and bank-marketing records.ChestX-ray8 includes 108,948 X-rays from 32,717 patients and eight disease labels; LDC has 8,000 training and 2,000 test lesion images; UBMD contains 41,188 instances with 17-dimensional bank data.Source: §6 · p. 40

Street-digit data

• SVHN adds a large digit-classification benchmark of 600,000 32x32 RGB images cropped from house-number plates, including an additional 530,000-image training subset.The images retain nearby digits and other visual elements, increasing scene complexity relative to isolated digit datasets.Source: §6 · p. 41

7.1 Balancing Privacy and Model Utility

• Privacy-preserving defenses must reduce MI leakage without sacrificing model utility through adaptive, multi-objective, and interdisciplinary approaches.Promising directions include random erasing, adversarial noise, mutual information regularization, and mechanisms tailored to application-specific requirements.Source: §7.1 · p. 41

7.2 Defining Realistic Threat Models

• Realistic threat models should capture architecture-specific vulnerabilities, diverse attack vectors, adversary capabilities, noisy heterogeneous data, and evolving real-world deployments.This includes testing transformers, multimodal models, and GANs beyond controlled laboratory conditions (Zhang et al., 2022; Li et al., 2024; Ye et al., 2024; Wang et al., 2021; Chen et al., 2020).Source: §7.2 · pp. 41–42

7.3 Lack of Scalability and Generalizability of Defenses

• MI defenses remain difficult to scale and generalize because resource-intensive methods may fail across architectures or degrade utility on large datasets.Future work should investigate lightweight, architecture-independent mechanisms, including transfer-learning-based defenses and adversarial training.Source: §7.3 · p. 42

7.4 Domain-specific Challenges

• Domain-specific defenses must accommodate varying data formats, diagnostic accuracy requirements, device constraints, latency, and real-world usability across fields such as healthcare and IoT.For edge systems, lightweight encryption, secure transmission protocols, pruning, and scalable privacy-preserving techniques should protect data without overburdening resource-limited devices.Source: §7.4 · pp. 42–43

7.5 Lack of Standardized Metrics, Diverse Datasets and Open-course Repositories for MI Attacks and Defenses

• Standardized metrics, representative datasets, and open repositories are needed to enable fair, realistic, reproducible, and transparent evaluation of MI attacks and defenses.Future resources should quantify leakage and robustness consistently, include domain-specific and synthetic datasets, and support direct method comparison; this work contributes a comprehensive repository of papers, datasets, metrics, and related resources (Fredrikson et al., 2015; Huang et al., 2021; Qiu et al., 2024; Zhou et al., 2024b).Source: §7.5 · pp. 43–44

7.6 Legal and Ethical Considerations

• MI defense research must address legal compliance, transparency, accountability, fairness, and malicious misuse through responsible dissemination and collaboration among technical, legal, and ethical experts.Adaptive, globally relevant frameworks should protect data security while supporting open scientific collaboration, especially in high-stakes domains such as healthcare and finance (Veale et al., 2018; Nguyen, 2024; Thapa, 2024; Hung, 2023; Makhdoom et al., 2024).Source: §7.6 · pp. 44–45

• The survey organizes MI attacks by diverse techniques, reviews defenses, and examines applications in biometrics, healthcare, and finance.It emphasizes the importance of robust defenses for protecting sensitive data in deep learning systems.Source: §8 · p. 45
• Current defenses face scalability, generalizability, and model-utility limitations, and are often evaluated under simplified threat models that may miss real-world adversarial capabilities.These shortcomings motivate continued research into practical and adaptable defense mechanisms.Source: §8 · p. 45
• Future work should define realistic threat models, improve defense explainability, and address domain-specific challenges to build systems resilient to MI attacks.Source: §8 · p. 45