[arXiv:2411.10023] "Model Inversion Attacks: A Survey of Approaches and Countermeasures"
See the code
A curated, cross-domain collection of research on model inversion attacks (MIAs), defenses, evaluation, and closely related data-reconstruction problems.
Please star or watch this repository to keep tracking the latest updates! Contributions are welcome!
[!IMPORTANT]
Our survey: Model Inversion Attacks: A Survey of Approaches and Countermeasures
Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han
Our survey provides a unified view of model inversion across image, text, and graph data, covering attack principles, threat models, defenses, datasets, evaluation metrics, practical deployment, and emerging foundation-model settings.
[!NOTE] We distinguish post-training model inversion from gradient inversion, training-data extraction, and other adjacent reconstruction problems. See Scope and labels.
If you find this repository helpful, please cite our survey:
@article{zhou2024model,
title={Model Inversion Attacks: A Survey of Approaches and Countermeasures},
author={Zhou, Zhanke and Zhu, Jianing and Yu, Fengfei and Li, Xuan and Peng, Xiong and Liu, Tongliang and Han, Bo},
journal={arXiv preprint arXiv:2411.10023},
year={2024}
}
A model inversion attack uses information exposed by a trained model—such as labels, confidence scores, embeddings, hidden representations, model parameters, or generated responses—to reconstruct private training information or sensitive characteristics represented by the model.
Each new entry should make the threat model explicit:
peer-reviewed, accepted, preprint, or withdrawn submission.We list gradient inversion, federated-learning reconstruction, training-data extraction, and inversion for interpretability as adjacent reconstruction when they do not match the post-training MIA threat model.
Broader privacy, trustworthy-ML, and gradient-inversion surveys are retained in the domain lists below when useful, but are not presented as MIA-specific surveys.
This status-checked index highlights recent work that cuts across the historical image/text/graph organization below.
Status labels: peer-reviewed, accepted, preprint, and withdrawn submission.
| Paper | Year / venue / status | Focus | Main contribution |
|---|---|---|---|
| ⭐ Model Inversion Attacks: A Survey of Approaches and Countermeasures | 2024, arXiv, our survey | Threat-model-aware synthesis | Organizes attacks and defenses by the interface observed, the knowledge and priors assumed, the reconstruction space, and the conditions under which each fails; covers image, text, and graph settings, evaluation, and deployment. |
| Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses | 2024, arXiv, preprint | Survey/toolbox | Cross-domain survey with an open-source MIA toolbox. |
| Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey | 2025, Artificial Intelligence Review 58:242, peer-reviewed | Survey | Reviews attacks, defenses, applications, datasets, metrics, and open problems. |
| MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense | 2024, arXiv, preprint | Benchmark/toolbox | Implements 16 attacks/defenses and nine evaluation protocols. |
| Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment | 2026, CVPR Findings, peer-reviewed | Evaluation | Identifies false positives caused by evaluation classifiers and proposes MLLM-based assessment. |
| An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline | 2025, arXiv, preprint | Practical assessment | Automates visual leakage assessment with four risk dimensions. |
| Paper | Year / venue / status | Access / prior | Main contribution |
|---|---|---|---|
| A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks | 2024, ECCV, peer-reviewed | White-box; GAN intermediate features | IF-GMI searches intermediate generator features under an L1-ball constraint. |
| Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment | 2024, ECCV, peer-reviewed | Black-box prediction vectors; StyleGAN | P2I directly aligns prediction vectors with StyleGAN W+ to reduce queries. |
| Pseudo-Private Data Guided Model Inversion Attacks | 2024, NeurIPS, peer-reviewed | White-box; public and pseudo-private images | Iteratively improves a generative prior with earlier reconstructions. |
| Model Inversion Attacks Through Target-Specific Conditional Diffusion Models | 2024, arXiv, preprint | Target-specific conditional diffusion | Diff-MI learns a diffusion prior guided by target predictions. |
| Single-Step Diffusion Model-Based Generative Model Inversion Attacks | 2025, ICLR submission, withdrawn submission | Distilled diffusion prior; classifier/CLIP | Replaces GAN priors with a single-step diffusion generator and studies CLIP leakage. |
| From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning | 2025, CVPR, peer-reviewed | Confidence scores; surrogate and generator | SMILE combines long-tailed surrogate training with query-efficient derivative-free search. |
| MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion | 2025, AISTATS, peer-reviewed | Gray-box; shadow model | Hybrid optimization and learned reconstruction for medical images. |
| ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration | 2025, ICLR, peer-reviewed | 3D feature interface | Reconstructs voxelized point clouds using occupancy and dispersion objectives. |
| DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion | 2026, IEEE TIFS 21:4275–4290, peer-reviewed | Face embeddings; fixed diffusion prior | Uses a reusable unconditional diffusion model without target-specific generator training. Final version of arXiv:2504.18015, previously listed here as Diffusion-Driven Universal Model Inversion Attack for Face Recognition. |
| Generative Model Inversion Through the Lens of the Manifold Hypothesis | 2025, NeurIPS, peer-reviewed | White-box; generative prior | Analyses inversion gradients as largely normal to the data manifold and proposes manifold-aligned attacks. |
| Model Inversion Attack Against Deep Hashing | 2025, arXiv, preprint | Black-box deep hashing; diffusion | Reconstructs retrieval images without private training hash codes. |
| Paper | Year / venue / status | Exposed interface | Main contribution |
|---|---|---|---|
| Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks | 2026, CVPR, peer-reviewed | VLM tokens and generated responses | Introduces token/sequence MIAs and SMI-AW for private visual training data. |
| Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI | 2025, USENIX Security, peer-reviewed | Black-box target; generative-AI prior | Studies data-free model extraction, membership inference, and model inversion. |
| DRAG: Data Reconstruction Attack using Guided Diffusion | 2025, ICML, peer-reviewed | CLIP/DINOv2 intermediate features | Uses guided latent diffusion to reconstruct inputs from deep foundation-model features. |
| CapRecover: A Cross-Modality Feature Inversion Attack Framework on Vision-Language Models | 2025, ACM MM, peer-reviewed | Intermediate visual features of a VLM | Recovers semantic content (labels, captions) directly from split-VLM features without image reconstruction. |
| LeakyCLIP: Extracting Training Data from CLIP | 2025, arXiv, preprint | CLIP image/text embeddings | Studies how much training data can be recovered from CLIP embeddings. |
| Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Model | 2025, CVPR Workshops (ABAW), peer-reviewed | Face-recognition embeddings | Adapts a face foundation model as the prior for reconstruction; the foundation model is the attacker's tool, not the target. |
The single-step diffusion work listed in the preceding section also evaluates privacy leakage in CLIP.
| Paper | Year / venue / status | Setting | Main contribution |
|---|---|---|---|
| PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks | 2024, WACV, peer-reviewed | Collaborative inference defense | Privacy-aware pruning for resource-constrained edge deployment. |
| A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning | 2024, arXiv, preprint | Passive split-learning server | FORA transfers representation preferences from public auxiliary data. |
| Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems | 2025, CVPR, peer-reviewed | Split-inference defense | Relates conditional entropy to reconstruction error and proposes CEM. |
| Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization | 2025, arXiv, preprint | Split inference; StyleGAN | Progressive feature optimization improves deep-cut and OOD reconstruction. |
| Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble | 2025, DAC, peer-reviewed | Collaborative-inference defense | Selective ensembles confuse server-side reconstruction with low inference overhead. |
| What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs | 2026, CVPR, peer-reviewed | Black-box feature interface | FIA-Flow learns from few image-feature pairs and performs one-step reconstruction. |
| SIMBA: Split Inference — Mechanisms, Benchmarks and Attacks | 2024, ECCV, peer-reviewed | Split-inference benchmark | Systematizes split-inference mechanisms and attacks and benchmarks them under one protocol. Authors are Singh et al. |
| Passive Inference Attacks on Split Learning via Adversarial Regularization | 2025, NDSS, peer-reviewed | Passive split-learning server | SDAR uses adversarial regularization to reconstruct client data without deviating from the protocol. |
| Prompt Inversion Attack against Collaborative Inference of Large Language Models | 2025, arXiv, preprint | LLM inter-layer activations | Reconstructs prompts transmitted in collaborative LLM inference. |
| Paper | Year / venue / status | Defense axis | Main contribution |
|---|---|---|---|
| On the Vulnerability of Skip Connections to Model Inversion Attacks | 2024, ECCV, peer-reviewed | Architecture | Shows skip connections amplify leakage and proposes MI-resilient designs. |
| Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures | 2024, ECCV, peer-reviewed | Architecture | Uses sparse-coding layers to limit irrelevant private information. |
| Trap-MID: Trapdoor-based Defense against Model Inversion Attacks | 2024, NeurIPS, peer-reviewed | Misdirection/trapdoor | Makes inversion recover a trapdoor trigger instead of private samples. |
| Defending against Model Inversion Attacks via Random Erasing | 2024, arXiv, preprint | Data-centric training | Random erasing reduces recoverable visual detail while retaining task utility. |
| Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks | 2025, ICLR, peer-reviewed | Output post-processing | Reduces conditional mutual information without retraining the target model. |
| Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering | 2026, KDD, peer-reviewed | Low-rank feature filtering | Final version of the work previously titled CALoR; combines confidence adaptation and low-rank filtering. |
| GRASP: Differentially Private Graph Reconstruction Defense with Structured Perturbation | 2025, KDD, peer-reviewed | Graph embedding perturbation | Perturbs released node embeddings along structured directions, trading graph-reconstruction AUC against node accuracy. |
| Model Inversion Attacks Meet Cryptographic Fuzzy Extractors | 2025, arXiv, preprint | Cryptographic biometric defense | Studies inversion against fuzzy extractors and proposes L2FE-Hash. |
| Paper | Year / venue / status | Interface | Main contribution |
|---|---|---|---|
| An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference | 2024, EMNLP, peer-reviewed | Obfuscated embedding matrix | Recovers text from glide-reflection-obfuscated embeddings. |
| ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation | 2025, ACL, peer-reviewed | Few-shot black-box embeddings | Cross-model alignment enables inversion with few paired samples. |
| ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks | 2025, ACL, peer-reviewed | Embedding-service defense | Obfuscates embeddings for both classification and generation services. |
| PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration | 2025, ACL, peer-reviewed | LLM inference defense | Removes private spans client-side and restores task information through privacy-aware vectors. |
| Stealing Training Data from Large Language Models in Decentralized Training through Activation Inversion Attack | 2025, ACL, peer-reviewed | Activations exchanged in decentralized training | Recovers training text from intermediate activations passed between decentralized training participants. |
| Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation | 2026, ACL, peer-reviewed | Noisy pooled embeddings | PPFT protects inference and private-domain fine-tuning without sending raw text. |
| An Invariant Latent Space Perspective on Language Model Inversion | 2026, AAAI, peer-reviewed | Next-token distributions / logits | Casts language-model inversion as recovery in an invariant latent space shared across models. |
| Paper | Year / venue / status | Interface | Main contribution |
|---|---|---|---|
| ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels | 2025, arXiv, preprint | Feature explanations and privatized attributes | Denoises auxiliary node information and reconstructs graph topology. |
| GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning | 2025, arXiv, preprint | Graph-unlearning residue | Reconstructs deleted nodes, edges, and neighborhoods; adjacent to classical MIA. |
These papers are useful context but should not be presented as classical post-training MIAs without qualification.
| Paper | Year / venue / status | Why adjacent |
|---|---|---|
| GRAIN: Exact Graph Reconstruction from Gradients | 2025, ICLR, peer-reviewed | Reconstructs graph structure and features from shared training gradients. |
| TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models | 2026, CVPR, peer-reviewed | Attacks concept erasure rather than private classifier training data. |
| DAGER: Exact Gradient Inversion for Large Language Models | 2024, NeurIPS, peer-reviewed | Reconstructs input text exactly from shared training gradients in federated learning, not from a released model. |
| MIMIC: Multimodal Inversion for Model Interpretation and Conceptualization | 2025, arXiv, preprint | Representation inversion for interpretation rather than a privacy attack. |
| Implicit Inversion Turns CLIP into a Decoder | 2025, OpenReview | Representation decoding/generation rather than private-data reconstruction. |
The entries below preserve the historical collection. For a status-checked cross-cutting view of recent work, use the 2024–2026 index.
[IEEE TIFS 2026] (embedding/feature) DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion [paper]
[CVPR 2026] (white-box) Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks [paper]
[CVPR 2026] (black-box) What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs [paper]
[KDD 2026] (embedding/feature (defense)) Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering [paper]
[NDSS 2025] CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling [paper] [code] [project]
[OpenReview 2025] (white-box) Single-Step Diffusion Model-Based Generative Model Inversion Attacks [paper]
[CVPR 2025] (black-box) From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning [paper]
[AISTATS 2025] (gray-box) MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion [paper]
[ICLR 2025] (embedding/feature) ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration [paper]
[NeurIPS 2025] (white-box) Generative Model Inversion Through the Lens of the Manifold Hypothesis [paper]
[arXiv 2025] (black-box) Model Inversion Attack Against Deep Hashing [paper]
[USENIX Security 2025] (black-box) Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI [paper]
[ICML 2025] (embedding/feature) DRAG: Data Reconstruction Attack using Guided Diffusion [paper]
[ACM MM 2025] (embedding/feature) CapRecover: A Cross-Modality Feature Inversion Attack Framework on Vision-Language Models [paper]
[arXiv 2025] (white-box) LeakyCLIP: Extracting Training Data from CLIP [paper]
[CVPR Workshops 2025] (black-box) Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Model [paper]
[CVPR 2025] (defense) Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems [paper]
[arXiv 2025] (embedding/feature) Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization [paper]
[DAC 2025] (defense) Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble [paper]
[NDSS 2025] (embedding/feature) Passive Inference Attacks on Split Learning via Adversarial Regularization [paper]
[ICLR 2025] (defense) Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks [paper]
[arXiv 2025] (defense) Model Inversion Attacks Meet Cryptographic Fuzzy Extractors [paper]
[ICML 2024] (white-box) Sparse Model Inversion: Efficient Inversion of Vision Transformers for Data-Free Applications [paper] [code]
[CVPR 2024] Model Inversion Robustness: Can Transfer Learning Help? [paper] [code]
[ICLR 2024] Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks [paper] [code]
[ECCV 2024] (white-box) A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks [paper]
[ECCV 2024] (black-box) Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment [paper]
[NeurIPS 2024] (white-box) Pseudo-Private Data Guided Model Inversion Attacks [paper]
[arXiv 2024] (white-box) Model Inversion Attacks Through Target-Specific Conditional Diffusion Models [paper]
[WACV 2024] (defense) PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks [paper]
[arXiv 2024] (embedding/feature) A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning [paper]
[ECCV 2024] (benchmark) SIMBA: Split Inference — Mechanisms, Benchmarks and Attacks [paper]
[ECCV 2024] (defense) On the Vulnerability of Skip Connections to Model Inversion Attacks [paper]
[ECCV 2024] (defense) Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures [paper]
[NeurIPS 2024] (defense) Trap-MID: Trapdoor-based Defense against Model Inversion Attacks [paper]
[arXiv 2024] (defense) Defending against Model Inversion Attacks via Random Erasing [paper]
[IEEE TIFS 2024] (label-only black-box) Unstoppable Attack: Label-Only Model Inversion via Conditional Diffusion Model [paper]
[ICASSP 2023] (black-box) Sparse Black-Box Inversion Attack with Limited Information [paper] [code]
[IEEE Transactions on Information Forensics and Security 2023] A GAN-Based Defense Framework Against Model Inversion Attacks [paper]
[CVPR 2023] (black-box) Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack [paper] [code]
[AAAI 2023] (white-box) Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network [paper] [code]
[TDSC 2023] (black-box) C2FMI: Coarse-to-Fine Black-box Model Inversion Attack [paper] [code]
[TDSC 2023] (black-box) Boosting Model Inversion Attacks with Adversarial Examples [paper]
[CVPR 2023] (black-box) Reinforcement Learning-Based Black-Box Model Inversion Attacks [paper] [code]
[CVPR 2023] (white-box) Re-thinking Model Inversion Attacks Against Deep Neural Networks [paper] [code]
[AAAI 2023] (black-box (defense)) Purifier: Defending Data Inference Attacks via Transforming Confidence Scores [paper]
[ICML 2022] Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentations [paper]
[ICML 2022] (white-box) Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks [paper] [code]
[CVPR 2022] (black-box) Label-Only Model Inversion Attacks via Boundary Repulsion [paper] [code]
[CVPR 2022] (white-box (defense)) ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learning [paper] [code]
[KDD 2022] (white-box (defense)) Bilateral Dependency Optimization: Defending Against Model-inversion Attacks [paper] [code]
[USENIX Security 2022] (holistic risk assessment) ML-DOCTOR: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models [paper] [code]
[TIFS 2022] (white-box) Model Inversion Attack by Integration of Deep Generative Models: Privacy-Sensitive Face Generation From a Face Recognition System [paper]
[TIFS 2022] (black-box (defense)) One Parameter Defense—Defending Against Data Inference Attacks via Differential Privacy [paper]
[WACV 2022] (white-box) Reconstructing Training Data from Diverse ML Models by Ensemble Inversion [paper]
[ECCV 2022] (white-box) SecretGen: Privacy Recovery on Pre-trained Models via Distribution Discrimination [paper]
[WPES 2022] (black-box) UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning [paper] [code]
[NDSS 2022] (white-box & black-box) MIRROR: Model Inversion for Deep Learning Network with High Fidelity [paper] [code]
[SP 2022] (white-box) Reconstructing Training Data with Informed Adversaries [paper]
[BMVC 2022] (white-box) Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks [paper]
[NeurIPS 2022] (white-box) Reconstructing Training Data from Trained Neural Networks [paper]
[NeurIPS 2021] (white-box) Variational Model Inversion Attacks [paper] [code]
[ICCV 2021] (white-box) Exploiting Explanations for Model Inversion Attacks [paper]
[ICCV 2021] (white-box) Knowledge-Enriched Distributional Model Inversion Attacks [paper] [code]
[AAAI 2021] (white-box (defense)) Improving Robustness to Model Inversion Attacks via Mutual Information Regularization [paper]
[ICLR Workshop 2021] (black-box (defense)) Practical Defences Against Model Inversion Attacks for Split Neural Networks [paper] [code]
[ICDE 2021] (white-box) Feature inference attack on model predictions in vertical federated learning [paper] [code]
[DAC 2021] (black & white-box) PRID: Model Inversion Privacy Attacks in Hyperdimensional Learning Systems [paper]
[CSR Workshops 2021] (black-box (defense)) Defending Against Model Inversion Attack by Adversarial Examples [paper]
[ECML PKDD 2021] (black-box) Practical Black Box Model Inversion Attacks Against Neural Nets [paper]
[APSIPA 2021] (black-box) Model Inversion Attack against a Face Recognition System in a Black-Box Setting [paper]
[CCS 2021] Unleashing the tiger: Inference attacks on split learning [paper] [code]
[CVPR 2020] Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion [paper] [code]
[CVPR 2020] (white-box) The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks [paper] [code] [video]
[ICLR 2020] (white-box) Overlearning Reveals Sensitive Attributes [paper]
[APSIPA ASC 2020] (white-box) Deep Face Recognizer Privacy Attack: Model Inversion Initialization by a Deep Generative Adversarial Data Space Discriminator [paper]
[USENIX Security 2020] (black-box) Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning [paper]
[IoT-J 2020] (black-box) Attacking and Protecting Data Privacy in Edge-Cloud Collaborative Inference Systems [paper] [code]
[ECCV Workshop 2020] (black-box) Black-Box Face Recovery from Identity Features [paper]
[arXiv 2020] (white-box) MixCon: Adjusting the Separability of Data Representations for Harder Data Recovery [paper]
[Globecom 2020] (white-box (defense)) Privacy Preserving Facial Recognition Against Model Inversion Attacks [paper]
[Big Data 2020] (white-box (defense)) Broadening Differential Privacy for Deep Learning Against Model Inversion Attacks [paper]
[AdvML 2020] (metric) Evaluation Indicator for Model Inversion Attack [paper]
[arXiv 2020] Defending Model Inversion and Membership Inference Attacks via Prediction Purification [paper]
[arXiv 2019] (black-box) GAMIN: An Adversarial Approach to Black-Box Model Inversion [paper]
[ACSAC 2019] (black & white-box) Model Inversion Attacks Against Collaborative Inference [paper] [code]
[CCS 2019] (black-box) Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment [paper] [code]
[GLSVLSI 2019] (black-box (defense)) MLPrivacyGuard: Defeating Confidence Information based Model Inversion Attacks on Machine Learning Systems [paper]
[CVPR 2019] A Style-Based Generator Architecture for Generative Adversarial Networks [paper]
[arXiv 2019] (white-box) An Attack-Based Evaluation Method for Differentially Private Learning Against Model Inversion Attack [paper]
[CSF 2018] (white-box) Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting [paper]
[CCS 2017] (white-box) Machine Learning Models that Remember Too Much [paper] [code]
[PST 2017] (white-box) Model Inversion Attacks for Prediction Systems: Without knowledge of Non-Sensitive Attributes [paper]
[NeurIPS 2016] Generating Images with Perceptual Similarity Metrics based on Deep Networks [paper]
[CVPR 2016] Inverting visual representations with convolutional networks [paper]
[CSF 2016] (black & white-box) A Methodology for Formalizing Model-Inversion Attacks [paper]
[CVPR 2015] Understanding Deep Image Representations by Inverting Them [paper]
[IJCAI 2015] (white-box (defense)) Regression Model Fitting under Differential Privacy and Model Inversion Attack [paper] [code]
[CCS 2015] (black & white-box) Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures [paper] [code1] [code2] [code3] [code4]
[ICLR 2014] Intriguing properties of neural networks [paper]
[ICLR 2014] Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps [paper]
[USENIX Security 2014] (black & white-box) Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing [paper]
The entries below include both post-training graph inversion and adjacent graph-reconstruction settings. See each paper's threat model before comparing results.
[KDD 2025] (embedding/feature (defense)) GRASP: Differentially Private Graph Reconstruction Defense with Structured Perturbation [paper]
[arXiv 2025] (embedding/feature) ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels [paper]
[arXiv 2025] (black & white-box) GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning [paper]
[SecureComm 2023] (white-box) Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks [paper]
[ICML 2023] (white-box) On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximation [paper] [code]
[IJIS 2023] Defense Against Membership Inference Attack in Graph Neural Networks Through Graph Perturbation [paper]
[PETS 2023] Private Graph Extraction via Feature Explanations [paper]
[USENIX Security 2023] GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation [paper]
[IEEE TKDE 2023] (black-box) NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data [paper] [code]
[TKDE 2022] Model Inversion Attacks against Graph Neural Networks [paper]
[CCS 2022] Finding MNEMON: Reviving Memories of Node Embeddings [paper]
[arXiv 2022] Privacy and Transparency in Graph Machine Learning: A Unified Perspective [paper]
[arXiv 2022] Degree-Preserving Randomized Response for Graph Neural Networks under Local Differential Privacy [paper]
[arXiv 2022] Sok: Differential Privacy on Graph-Structured Data[paper]
[arXiv 2022] Differentially Private Graph Classification With GNNs [paper]
[IEEE S&P 2022] Model Stealing Attacks Against Inductive Graph Neural Networks [paper] [code]
[USENIX Security 2022] Inference Attacks Against Graph Neural Networks [paper] [code]
[WWW 2022] Learning Privacy-Preserving Graph Convolutional Network with Partially Observed Sensitive Attributes [paper]
[arXiv 2022] (black & white-box) A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability [paper]
[IJCAI 2022] (white-box) A Survey on Gradient Inversion: Attacks, Defenses and Future Directions [paper]
[arXiv 2021] Node-Level Membership Inference Attacks Against Graph Neural Networks [paper]
[IJCAI 2021] (white-box) GraphMI: Extracting Private Graph Data from Graph Neural Networks [paper] [code]
[ICML 2021] DeepWalking Backwards: From Node Embeddings Back to Graphs [paper] [code]
[USENIX Security 2021] Stealing Links from Graph Neural Networks [paper] [code]
[MobiQuitous 2020] Quantifying Privacy Leakage in Graph Embedding [paper] [code]
[arXiv 2020] (black & white-box) Reducing Risk of Model Inversion Using Privacy-Guided Training [paper]
This historical list includes embedding inversion, prompt inversion, memorization, and adjacent training-data extraction. The 2024–2026 index separates these interfaces and statuses.
[ACL 2026] (embedding/feature (defense)) Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation [paper]
[AAAI 2026] (black-box) An Invariant Latent Space Perspective on Language Model Inversion [paper]
[NeurIPS 2025] (black-box) Better Language Model Inversion by Compactly Representing Next-Token Distributions [paper] [code]
[arXiv 2025] (embedding/feature) Prompt Inversion Attack against Collaborative Inference of Large Language Models [paper]
[ACL 2025] (black-box) ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation [paper]
[ACL 2025] (embedding/feature (defense)) ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks [paper]
[ACL 2025] (defense) PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration [paper]
[ACL 2025] (embedding/feature) Stealing Training Data from Large Language Models in Decentralized Training through Activation Inversion Attack [paper]
[ACL 2024] (black-box) Text Embedding Inversion Security for Multilingual Language Models [paper] [code]
[ICLR 2024] (black-box) Language Model Inversion [paper] [code]
[arXiv 2024] (white-box) Do Membership Inference Attacks Work on Large Language Models? [paper]
[EMNLP 2024] (black-box) Extracting Prompts by Inverting LLM Outputs [paper] [code]
[ACL 2024] (black-box) Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries [paper]
[COLM 2024] Effective Prompt Extraction from Language Models [paper]
[EMNLP 2024] (embedding/feature) An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference [paper]
[EMNLP 2023] (black-box) Text Embeddings Reveal (Almost) As Much As Text [paper] [code]
[arXiv 2023] (white-box) Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Models [paper]
[ACL 2023] (black-box) Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence [paper] [code]
[SaTML 2023] (black-box) Model Inversion Attack with Least Information and an In-depth Analysis of its Disparate Vulnerability [paper]
[NAACL 2022] (white-box) Are Large Pre-Trained Language Models Leaking Your Personal Information? [paper] [code]
[NeurIPS 2022] (white-box) Recovering Private Text in Federated Learning of Language Models [paper] [code]
[ACL 2022] (white-box) Canary Extraction in Natural Language Understanding Models [paper]
[arXiv 2022] (white-box) Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformers [paper]
[arXiv 2022] (black-box) KART: Parameterization of Privacy Leakage Scenarios from Pre-trained Language Models [paper] [code]
[CEUR Workshop 2021] (black-box) Dataset Reconstruction Attack against Language Models [paper]
[EMNLP 2021] (white-box) TAG: Gradient Attack on Transformer-based Language Models [paper]
[USENIX Security 2021] (black-box) Extracting Training Data from Large Language Models [paper] [code]
[CCS 2020] (black & white-box) Information Leakage in Embedding Models [paper]
[S&P 2020] (black & white-box) Privacy Risks of General-Purpose Language Models [paper]
[USENIX Security 2019] The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks [paper]
[arXiv 2018] Towards Robust and Privacy-preserving Text Representations [paper]
[arXiv 2018] Privacy-preserving Neural Representations of Text [paper]
[arXiv 2018] Adversarial Removal of Demographic Attributes from Text Data [paper]
[NeurIPS 2017] Controllable Invariance through Adversarial Feature Learning [paper]
AIJack: Implementation of algorithms for AI security.
Privacy-Attacks-in-Machine-Learning: Membership Inference, Attribute Inference and Model Inversion attacks implemented using PyTorch.
ml-attack-framework: Universität des Saarlandes - Privacy Enhancing Technologies 2021 - Semester Project.
(Trail of Bits) PrivacyRaven [GitHub]
(TensorFlow) TensorFlow Privacy [GitHub]
(NUS Data Privacy and Trustworthy Machine Learning Lab) Machine Learning Privacy Meter [GitHub]
(IQT Labs/Lab 41) CypherCat (archive-only) [GitHub]
(IBM) Adversarial Robustness Toolbox (ART) [GitHub]
These papers affect interfaces also studied by model inversion research, but do not reconstruct private training information and are therefore listed separately.
Contributions are welcome through pull requests or issues. Please use official publisher, proceedings, OpenReview, ACL Anthology, PMLR, CVF/ECVA, USENIX, DOI, or arXiv links whenever possible.
Suggested entry format:
Year | Paper | Domain | Target/observable | Access | Auxiliary data/prior |
Attack or defense | Venue/status | Paper URL | Code URL (optional)
Before submitting an entry:
188 followers · starred Jul 2023
[arXiv:2411.10023] "Model Inversion Attacks: A Survey of Approaches and Countermeasures"
See the code
A curated, cross-domain collection of research on model inversion attacks (MIAs), defenses, evaluation, and closely related data-reconstruction problems.
Please star or watch this repository to keep tracking the latest updates! Contributions are welcome!
[!IMPORTANT]
Our survey: Model Inversion Attacks: A Survey of Approaches and Countermeasures
Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han
Our survey provides a unified view of model inversion across image, text, and graph data, covering attack principles, threat models, defenses, datasets, evaluation metrics, practical deployment, and emerging foundation-model settings.
[!NOTE] We distinguish post-training model inversion from gradient inversion, training-data extraction, and other adjacent reconstruction problems. See Scope and labels.
If you find this repository helpful, please cite our survey:
@article{zhou2024model,
title={Model Inversion Attacks: A Survey of Approaches and Countermeasures},
author={Zhou, Zhanke and Zhu, Jianing and Yu, Fengfei and Li, Xuan and Peng, Xiong and Liu, Tongliang and Han, Bo},
journal={arXiv preprint arXiv:2411.10023},
year={2024}
}
A model inversion attack uses information exposed by a trained model—such as labels, confidence scores, embeddings, hidden representations, model parameters, or generated responses—to reconstruct private training information or sensitive characteristics represented by the model.
Each new entry should make the threat model explicit:
peer-reviewed, accepted, preprint, or withdrawn submission.We list gradient inversion, federated-learning reconstruction, training-data extraction, and inversion for interpretability as adjacent reconstruction when they do not match the post-training MIA threat model.
Broader privacy, trustworthy-ML, and gradient-inversion surveys are retained in the domain lists below when useful, but are not presented as MIA-specific surveys.
This status-checked index highlights recent work that cuts across the historical image/text/graph organization below.
Status labels: peer-reviewed, accepted, preprint, and withdrawn submission.
| Paper | Year / venue / status | Focus | Main contribution |
|---|---|---|---|
| ⭐ Model Inversion Attacks: A Survey of Approaches and Countermeasures | 2024, arXiv, our survey | Threat-model-aware synthesis | Organizes attacks and defenses by the interface observed, the knowledge and priors assumed, the reconstruction space, and the conditions under which each fails; covers image, text, and graph settings, evaluation, and deployment. |
| Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses | 2024, arXiv, preprint | Survey/toolbox | Cross-domain survey with an open-source MIA toolbox. |
| Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey | 2025, Artificial Intelligence Review 58:242, peer-reviewed | Survey | Reviews attacks, defenses, applications, datasets, metrics, and open problems. |
| MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense | 2024, arXiv, preprint | Benchmark/toolbox | Implements 16 attacks/defenses and nine evaluation protocols. |
| Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment | 2026, CVPR Findings, peer-reviewed | Evaluation | Identifies false positives caused by evaluation classifiers and proposes MLLM-based assessment. |
| An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline | 2025, arXiv, preprint | Practical assessment | Automates visual leakage assessment with four risk dimensions. |
| Paper | Year / venue / status | Access / prior | Main contribution |
|---|---|---|---|
| A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks | 2024, ECCV, peer-reviewed | White-box; GAN intermediate features | IF-GMI searches intermediate generator features under an L1-ball constraint. |
| Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment | 2024, ECCV, peer-reviewed | Black-box prediction vectors; StyleGAN | P2I directly aligns prediction vectors with StyleGAN W+ to reduce queries. |
| Pseudo-Private Data Guided Model Inversion Attacks | 2024, NeurIPS, peer-reviewed | White-box; public and pseudo-private images | Iteratively improves a generative prior with earlier reconstructions. |
| Model Inversion Attacks Through Target-Specific Conditional Diffusion Models | 2024, arXiv, preprint | Target-specific conditional diffusion | Diff-MI learns a diffusion prior guided by target predictions. |
| Single-Step Diffusion Model-Based Generative Model Inversion Attacks | 2025, ICLR submission, withdrawn submission | Distilled diffusion prior; classifier/CLIP | Replaces GAN priors with a single-step diffusion generator and studies CLIP leakage. |
| From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning | 2025, CVPR, peer-reviewed | Confidence scores; surrogate and generator | SMILE combines long-tailed surrogate training with query-efficient derivative-free search. |
| MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion | 2025, AISTATS, peer-reviewed | Gray-box; shadow model | Hybrid optimization and learned reconstruction for medical images. |
| ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration | 2025, ICLR, peer-reviewed | 3D feature interface | Reconstructs voxelized point clouds using occupancy and dispersion objectives. |
| DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion | 2026, IEEE TIFS 21:4275–4290, peer-reviewed | Face embeddings; fixed diffusion prior | Uses a reusable unconditional diffusion model without target-specific generator training. Final version of arXiv:2504.18015, previously listed here as Diffusion-Driven Universal Model Inversion Attack for Face Recognition. |
| Generative Model Inversion Through the Lens of the Manifold Hypothesis | 2025, NeurIPS, peer-reviewed | White-box; generative prior | Analyses inversion gradients as largely normal to the data manifold and proposes manifold-aligned attacks. |
| Model Inversion Attack Against Deep Hashing | 2025, arXiv, preprint | Black-box deep hashing; diffusion | Reconstructs retrieval images without private training hash codes. |
| Paper | Year / venue / status | Exposed interface | Main contribution |
|---|---|---|---|
| Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks | 2026, CVPR, peer-reviewed | VLM tokens and generated responses | Introduces token/sequence MIAs and SMI-AW for private visual training data. |
| Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI | 2025, USENIX Security, peer-reviewed | Black-box target; generative-AI prior | Studies data-free model extraction, membership inference, and model inversion. |
| DRAG: Data Reconstruction Attack using Guided Diffusion | 2025, ICML, peer-reviewed | CLIP/DINOv2 intermediate features | Uses guided latent diffusion to reconstruct inputs from deep foundation-model features. |
| CapRecover: A Cross-Modality Feature Inversion Attack Framework on Vision-Language Models | 2025, ACM MM, peer-reviewed | Intermediate visual features of a VLM | Recovers semantic content (labels, captions) directly from split-VLM features without image reconstruction. |
| LeakyCLIP: Extracting Training Data from CLIP | 2025, arXiv, preprint | CLIP image/text embeddings | Studies how much training data can be recovered from CLIP embeddings. |
| Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Model | 2025, CVPR Workshops (ABAW), peer-reviewed | Face-recognition embeddings | Adapts a face foundation model as the prior for reconstruction; the foundation model is the attacker's tool, not the target. |
The single-step diffusion work listed in the preceding section also evaluates privacy leakage in CLIP.
| Paper | Year / venue / status | Setting | Main contribution |
|---|---|---|---|
| PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks | 2024, WACV, peer-reviewed | Collaborative inference defense | Privacy-aware pruning for resource-constrained edge deployment. |
| A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning | 2024, arXiv, preprint | Passive split-learning server | FORA transfers representation preferences from public auxiliary data. |
| Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems | 2025, CVPR, peer-reviewed | Split-inference defense | Relates conditional entropy to reconstruction error and proposes CEM. |
| Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization | 2025, arXiv, preprint | Split inference; StyleGAN | Progressive feature optimization improves deep-cut and OOD reconstruction. |
| Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble | 2025, DAC, peer-reviewed | Collaborative-inference defense | Selective ensembles confuse server-side reconstruction with low inference overhead. |
| What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs | 2026, CVPR, peer-reviewed | Black-box feature interface | FIA-Flow learns from few image-feature pairs and performs one-step reconstruction. |
| SIMBA: Split Inference — Mechanisms, Benchmarks and Attacks | 2024, ECCV, peer-reviewed | Split-inference benchmark | Systematizes split-inference mechanisms and attacks and benchmarks them under one protocol. Authors are Singh et al. |
| Passive Inference Attacks on Split Learning via Adversarial Regularization | 2025, NDSS, peer-reviewed | Passive split-learning server | SDAR uses adversarial regularization to reconstruct client data without deviating from the protocol. |
| Prompt Inversion Attack against Collaborative Inference of Large Language Models | 2025, arXiv, preprint | LLM inter-layer activations | Reconstructs prompts transmitted in collaborative LLM inference. |
| Paper | Year / venue / status | Defense axis | Main contribution |
|---|---|---|---|
| On the Vulnerability of Skip Connections to Model Inversion Attacks | 2024, ECCV, peer-reviewed | Architecture | Shows skip connections amplify leakage and proposes MI-resilient designs. |
| Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures | 2024, ECCV, peer-reviewed | Architecture | Uses sparse-coding layers to limit irrelevant private information. |
| Trap-MID: Trapdoor-based Defense against Model Inversion Attacks | 2024, NeurIPS, peer-reviewed | Misdirection/trapdoor | Makes inversion recover a trapdoor trigger instead of private samples. |
| Defending against Model Inversion Attacks via Random Erasing | 2024, arXiv, preprint | Data-centric training | Random erasing reduces recoverable visual detail while retaining task utility. |
| Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks | 2025, ICLR, peer-reviewed | Output post-processing | Reduces conditional mutual information without retraining the target model. |
| Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering | 2026, KDD, peer-reviewed | Low-rank feature filtering | Final version of the work previously titled CALoR; combines confidence adaptation and low-rank filtering. |
| GRASP: Differentially Private Graph Reconstruction Defense with Structured Perturbation | 2025, KDD, peer-reviewed | Graph embedding perturbation | Perturbs released node embeddings along structured directions, trading graph-reconstruction AUC against node accuracy. |
| Model Inversion Attacks Meet Cryptographic Fuzzy Extractors | 2025, arXiv, preprint | Cryptographic biometric defense | Studies inversion against fuzzy extractors and proposes L2FE-Hash. |
| Paper | Year / venue / status | Interface | Main contribution |
|---|---|---|---|
| An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference | 2024, EMNLP, peer-reviewed | Obfuscated embedding matrix | Recovers text from glide-reflection-obfuscated embeddings. |
| ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation | 2025, ACL, peer-reviewed | Few-shot black-box embeddings | Cross-model alignment enables inversion with few paired samples. |
| ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks | 2025, ACL, peer-reviewed | Embedding-service defense | Obfuscates embeddings for both classification and generation services. |
| PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration | 2025, ACL, peer-reviewed | LLM inference defense | Removes private spans client-side and restores task information through privacy-aware vectors. |
| Stealing Training Data from Large Language Models in Decentralized Training through Activation Inversion Attack | 2025, ACL, peer-reviewed | Activations exchanged in decentralized training | Recovers training text from intermediate activations passed between decentralized training participants. |
| Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation | 2026, ACL, peer-reviewed | Noisy pooled embeddings | PPFT protects inference and private-domain fine-tuning without sending raw text. |
| An Invariant Latent Space Perspective on Language Model Inversion | 2026, AAAI, peer-reviewed | Next-token distributions / logits | Casts language-model inversion as recovery in an invariant latent space shared across models. |
| Paper | Year / venue / status | Interface | Main contribution |
|---|---|---|---|
| ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels | 2025, arXiv, preprint | Feature explanations and privatized attributes | Denoises auxiliary node information and reconstructs graph topology. |
| GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning | 2025, arXiv, preprint | Graph-unlearning residue | Reconstructs deleted nodes, edges, and neighborhoods; adjacent to classical MIA. |
These papers are useful context but should not be presented as classical post-training MIAs without qualification.
| Paper | Year / venue / status | Why adjacent |
|---|---|---|
| GRAIN: Exact Graph Reconstruction from Gradients | 2025, ICLR, peer-reviewed | Reconstructs graph structure and features from shared training gradients. |
| TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models | 2026, CVPR, peer-reviewed | Attacks concept erasure rather than private classifier training data. |
| DAGER: Exact Gradient Inversion for Large Language Models | 2024, NeurIPS, peer-reviewed | Reconstructs input text exactly from shared training gradients in federated learning, not from a released model. |
| MIMIC: Multimodal Inversion for Model Interpretation and Conceptualization | 2025, arXiv, preprint | Representation inversion for interpretation rather than a privacy attack. |
| Implicit Inversion Turns CLIP into a Decoder | 2025, OpenReview | Representation decoding/generation rather than private-data reconstruction. |
The entries below preserve the historical collection. For a status-checked cross-cutting view of recent work, use the 2024–2026 index.
[IEEE TIFS 2026] (embedding/feature) DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion [paper]
[CVPR 2026] (white-box) Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks [paper]
[CVPR 2026] (black-box) What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs [paper]
[KDD 2026] (embedding/feature (defense)) Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering [paper]
[NDSS 2025] CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling [paper] [code] [project]
[OpenReview 2025] (white-box) Single-Step Diffusion Model-Based Generative Model Inversion Attacks [paper]
[CVPR 2025] (black-box) From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning [paper]
[AISTATS 2025] (gray-box) MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion [paper]
[ICLR 2025] (embedding/feature) ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration [paper]
[NeurIPS 2025] (white-box) Generative Model Inversion Through the Lens of the Manifold Hypothesis [paper]
[arXiv 2025] (black-box) Model Inversion Attack Against Deep Hashing [paper]
[USENIX Security 2025] (black-box) Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI [paper]
[ICML 2025] (embedding/feature) DRAG: Data Reconstruction Attack using Guided Diffusion [paper]
[ACM MM 2025] (embedding/feature) CapRecover: A Cross-Modality Feature Inversion Attack Framework on Vision-Language Models [paper]
[arXiv 2025] (white-box) LeakyCLIP: Extracting Training Data from CLIP [paper]
[CVPR Workshops 2025] (black-box) Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Model [paper]
[CVPR 2025] (defense) Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems [paper]
[arXiv 2025] (embedding/feature) Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization [paper]
[DAC 2025] (defense) Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble [paper]
[NDSS 2025] (embedding/feature) Passive Inference Attacks on Split Learning via Adversarial Regularization [paper]
[ICLR 2025] (defense) Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks [paper]
[arXiv 2025] (defense) Model Inversion Attacks Meet Cryptographic Fuzzy Extractors [paper]
[ICML 2024] (white-box) Sparse Model Inversion: Efficient Inversion of Vision Transformers for Data-Free Applications [paper] [code]
[CVPR 2024] Model Inversion Robustness: Can Transfer Learning Help? [paper] [code]
[ICLR 2024] Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks [paper] [code]
[ECCV 2024] (white-box) A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks [paper]
[ECCV 2024] (black-box) Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment [paper]
[NeurIPS 2024] (white-box) Pseudo-Private Data Guided Model Inversion Attacks [paper]
[arXiv 2024] (white-box) Model Inversion Attacks Through Target-Specific Conditional Diffusion Models [paper]
[WACV 2024] (defense) PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks [paper]
[arXiv 2024] (embedding/feature) A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning [paper]
[ECCV 2024] (benchmark) SIMBA: Split Inference — Mechanisms, Benchmarks and Attacks [paper]
[ECCV 2024] (defense) On the Vulnerability of Skip Connections to Model Inversion Attacks [paper]
[ECCV 2024] (defense) Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures [paper]
[NeurIPS 2024] (defense) Trap-MID: Trapdoor-based Defense against Model Inversion Attacks [paper]
[arXiv 2024] (defense) Defending against Model Inversion Attacks via Random Erasing [paper]
[IEEE TIFS 2024] (label-only black-box) Unstoppable Attack: Label-Only Model Inversion via Conditional Diffusion Model [paper]
[ICASSP 2023] (black-box) Sparse Black-Box Inversion Attack with Limited Information [paper] [code]
[IEEE Transactions on Information Forensics and Security 2023] A GAN-Based Defense Framework Against Model Inversion Attacks [paper]
[CVPR 2023] (black-box) Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack [paper] [code]
[AAAI 2023] (white-box) Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network [paper] [code]
[TDSC 2023] (black-box) C2FMI: Coarse-to-Fine Black-box Model Inversion Attack [paper] [code]
[TDSC 2023] (black-box) Boosting Model Inversion Attacks with Adversarial Examples [paper]
[CVPR 2023] (black-box) Reinforcement Learning-Based Black-Box Model Inversion Attacks [paper] [code]
[CVPR 2023] (white-box) Re-thinking Model Inversion Attacks Against Deep Neural Networks [paper] [code]
[AAAI 2023] (black-box (defense)) Purifier: Defending Data Inference Attacks via Transforming Confidence Scores [paper]
[ICML 2022] Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentations [paper]
[ICML 2022] (white-box) Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks [paper] [code]
[CVPR 2022] (black-box) Label-Only Model Inversion Attacks via Boundary Repulsion [paper] [code]
[CVPR 2022] (white-box (defense)) ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learning [paper] [code]
[KDD 2022] (white-box (defense)) Bilateral Dependency Optimization: Defending Against Model-inversion Attacks [paper] [code]
[USENIX Security 2022] (holistic risk assessment) ML-DOCTOR: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models [paper] [code]
[TIFS 2022] (white-box) Model Inversion Attack by Integration of Deep Generative Models: Privacy-Sensitive Face Generation From a Face Recognition System [paper]
[TIFS 2022] (black-box (defense)) One Parameter Defense—Defending Against Data Inference Attacks via Differential Privacy [paper]
[WACV 2022] (white-box) Reconstructing Training Data from Diverse ML Models by Ensemble Inversion [paper]
[ECCV 2022] (white-box) SecretGen: Privacy Recovery on Pre-trained Models via Distribution Discrimination [paper]
[WPES 2022] (black-box) UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning [paper] [code]
[NDSS 2022] (white-box & black-box) MIRROR: Model Inversion for Deep Learning Network with High Fidelity [paper] [code]
[SP 2022] (white-box) Reconstructing Training Data with Informed Adversaries [paper]
[BMVC 2022] (white-box) Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks [paper]
[NeurIPS 2022] (white-box) Reconstructing Training Data from Trained Neural Networks [paper]
[NeurIPS 2021] (white-box) Variational Model Inversion Attacks [paper] [code]
[ICCV 2021] (white-box) Exploiting Explanations for Model Inversion Attacks [paper]
[ICCV 2021] (white-box) Knowledge-Enriched Distributional Model Inversion Attacks [paper] [code]
[AAAI 2021] (white-box (defense)) Improving Robustness to Model Inversion Attacks via Mutual Information Regularization [paper]
[ICLR Workshop 2021] (black-box (defense)) Practical Defences Against Model Inversion Attacks for Split Neural Networks [paper] [code]
[ICDE 2021] (white-box) Feature inference attack on model predictions in vertical federated learning [paper] [code]
[DAC 2021] (black & white-box) PRID: Model Inversion Privacy Attacks in Hyperdimensional Learning Systems [paper]
[CSR Workshops 2021] (black-box (defense)) Defending Against Model Inversion Attack by Adversarial Examples [paper]
[ECML PKDD 2021] (black-box) Practical Black Box Model Inversion Attacks Against Neural Nets [paper]
[APSIPA 2021] (black-box) Model Inversion Attack against a Face Recognition System in a Black-Box Setting [paper]
[CCS 2021] Unleashing the tiger: Inference attacks on split learning [paper] [code]
[CVPR 2020] Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion [paper] [code]
[CVPR 2020] (white-box) The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks [paper] [code] [video]
[ICLR 2020] (white-box) Overlearning Reveals Sensitive Attributes [paper]
[APSIPA ASC 2020] (white-box) Deep Face Recognizer Privacy Attack: Model Inversion Initialization by a Deep Generative Adversarial Data Space Discriminator [paper]
[USENIX Security 2020] (black-box) Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning [paper]
[IoT-J 2020] (black-box) Attacking and Protecting Data Privacy in Edge-Cloud Collaborative Inference Systems [paper] [code]
[ECCV Workshop 2020] (black-box) Black-Box Face Recovery from Identity Features [paper]
[arXiv 2020] (white-box) MixCon: Adjusting the Separability of Data Representations for Harder Data Recovery [paper]
[Globecom 2020] (white-box (defense)) Privacy Preserving Facial Recognition Against Model Inversion Attacks [paper]
[Big Data 2020] (white-box (defense)) Broadening Differential Privacy for Deep Learning Against Model Inversion Attacks [paper]
[AdvML 2020] (metric) Evaluation Indicator for Model Inversion Attack [paper]
[arXiv 2020] Defending Model Inversion and Membership Inference Attacks via Prediction Purification [paper]
[arXiv 2019] (black-box) GAMIN: An Adversarial Approach to Black-Box Model Inversion [paper]
[ACSAC 2019] (black & white-box) Model Inversion Attacks Against Collaborative Inference [paper] [code]
[CCS 2019] (black-box) Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment [paper] [code]
[GLSVLSI 2019] (black-box (defense)) MLPrivacyGuard: Defeating Confidence Information based Model Inversion Attacks on Machine Learning Systems [paper]
[CVPR 2019] A Style-Based Generator Architecture for Generative Adversarial Networks [paper]
[arXiv 2019] (white-box) An Attack-Based Evaluation Method for Differentially Private Learning Against Model Inversion Attack [paper]
[CSF 2018] (white-box) Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting [paper]
[CCS 2017] (white-box) Machine Learning Models that Remember Too Much [paper] [code]
[PST 2017] (white-box) Model Inversion Attacks for Prediction Systems: Without knowledge of Non-Sensitive Attributes [paper]
[NeurIPS 2016] Generating Images with Perceptual Similarity Metrics based on Deep Networks [paper]
[CVPR 2016] Inverting visual representations with convolutional networks [paper]
[CSF 2016] (black & white-box) A Methodology for Formalizing Model-Inversion Attacks [paper]
[CVPR 2015] Understanding Deep Image Representations by Inverting Them [paper]
[IJCAI 2015] (white-box (defense)) Regression Model Fitting under Differential Privacy and Model Inversion Attack [paper] [code]
[CCS 2015] (black & white-box) Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures [paper] [code1] [code2] [code3] [code4]
[ICLR 2014] Intriguing properties of neural networks [paper]
[ICLR 2014] Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps [paper]
[USENIX Security 2014] (black & white-box) Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing [paper]
The entries below include both post-training graph inversion and adjacent graph-reconstruction settings. See each paper's threat model before comparing results.
[KDD 2025] (embedding/feature (defense)) GRASP: Differentially Private Graph Reconstruction Defense with Structured Perturbation [paper]
[arXiv 2025] (embedding/feature) ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels [paper]
[arXiv 2025] (black & white-box) GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning [paper]
[SecureComm 2023] (white-box) Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks [paper]
[ICML 2023] (white-box) On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximation [paper] [code]
[IJIS 2023] Defense Against Membership Inference Attack in Graph Neural Networks Through Graph Perturbation [paper]
[PETS 2023] Private Graph Extraction via Feature Explanations [paper]
[USENIX Security 2023] GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation [paper]
[IEEE TKDE 2023] (black-box) NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data [paper] [code]
[TKDE 2022] Model Inversion Attacks against Graph Neural Networks [paper]
[CCS 2022] Finding MNEMON: Reviving Memories of Node Embeddings [paper]
[arXiv 2022] Privacy and Transparency in Graph Machine Learning: A Unified Perspective [paper]
[arXiv 2022] Degree-Preserving Randomized Response for Graph Neural Networks under Local Differential Privacy [paper]
[arXiv 2022] Sok: Differential Privacy on Graph-Structured Data[paper]
[arXiv 2022] Differentially Private Graph Classification With GNNs [paper]
[IEEE S&P 2022] Model Stealing Attacks Against Inductive Graph Neural Networks [paper] [code]
[USENIX Security 2022] Inference Attacks Against Graph Neural Networks [paper] [code]
[WWW 2022] Learning Privacy-Preserving Graph Convolutional Network with Partially Observed Sensitive Attributes [paper]
[arXiv 2022] (black & white-box) A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability [paper]
[IJCAI 2022] (white-box) A Survey on Gradient Inversion: Attacks, Defenses and Future Directions [paper]
[arXiv 2021] Node-Level Membership Inference Attacks Against Graph Neural Networks [paper]
[IJCAI 2021] (white-box) GraphMI: Extracting Private Graph Data from Graph Neural Networks [paper] [code]
[ICML 2021] DeepWalking Backwards: From Node Embeddings Back to Graphs [paper] [code]
[USENIX Security 2021] Stealing Links from Graph Neural Networks [paper] [code]
[MobiQuitous 2020] Quantifying Privacy Leakage in Graph Embedding [paper] [code]
[arXiv 2020] (black & white-box) Reducing Risk of Model Inversion Using Privacy-Guided Training [paper]
This historical list includes embedding inversion, prompt inversion, memorization, and adjacent training-data extraction. The 2024–2026 index separates these interfaces and statuses.
[ACL 2026] (embedding/feature (defense)) Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation [paper]
[AAAI 2026] (black-box) An Invariant Latent Space Perspective on Language Model Inversion [paper]
[NeurIPS 2025] (black-box) Better Language Model Inversion by Compactly Representing Next-Token Distributions [paper] [code]
[arXiv 2025] (embedding/feature) Prompt Inversion Attack against Collaborative Inference of Large Language Models [paper]
[ACL 2025] (black-box) ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation [paper]
[ACL 2025] (embedding/feature (defense)) ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks [paper]
[ACL 2025] (defense) PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration [paper]
[ACL 2025] (embedding/feature) Stealing Training Data from Large Language Models in Decentralized Training through Activation Inversion Attack [paper]
[ACL 2024] (black-box) Text Embedding Inversion Security for Multilingual Language Models [paper] [code]
[ICLR 2024] (black-box) Language Model Inversion [paper] [code]
[arXiv 2024] (white-box) Do Membership Inference Attacks Work on Large Language Models? [paper]
[EMNLP 2024] (black-box) Extracting Prompts by Inverting LLM Outputs [paper] [code]
[ACL 2024] (black-box) Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries [paper]
[COLM 2024] Effective Prompt Extraction from Language Models [paper]
[EMNLP 2024] (embedding/feature) An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference [paper]
[EMNLP 2023] (black-box) Text Embeddings Reveal (Almost) As Much As Text [paper] [code]
[arXiv 2023] (white-box) Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Models [paper]
[ACL 2023] (black-box) Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence [paper] [code]
[SaTML 2023] (black-box) Model Inversion Attack with Least Information and an In-depth Analysis of its Disparate Vulnerability [paper]
[NAACL 2022] (white-box) Are Large Pre-Trained Language Models Leaking Your Personal Information? [paper] [code]
[NeurIPS 2022] (white-box) Recovering Private Text in Federated Learning of Language Models [paper] [code]
[ACL 2022] (white-box) Canary Extraction in Natural Language Understanding Models [paper]
[arXiv 2022] (white-box) Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformers [paper]
[arXiv 2022] (black-box) KART: Parameterization of Privacy Leakage Scenarios from Pre-trained Language Models [paper] [code]
[CEUR Workshop 2021] (black-box) Dataset Reconstruction Attack against Language Models [paper]
[EMNLP 2021] (white-box) TAG: Gradient Attack on Transformer-based Language Models [paper]
[USENIX Security 2021] (black-box) Extracting Training Data from Large Language Models [paper] [code]
[CCS 2020] (black & white-box) Information Leakage in Embedding Models [paper]
[S&P 2020] (black & white-box) Privacy Risks of General-Purpose Language Models [paper]
[USENIX Security 2019] The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks [paper]
[arXiv 2018] Towards Robust and Privacy-preserving Text Representations [paper]
[arXiv 2018] Privacy-preserving Neural Representations of Text [paper]
[arXiv 2018] Adversarial Removal of Demographic Attributes from Text Data [paper]
[NeurIPS 2017] Controllable Invariance through Adversarial Feature Learning [paper]
AIJack: Implementation of algorithms for AI security.
Privacy-Attacks-in-Machine-Learning: Membership Inference, Attribute Inference and Model Inversion attacks implemented using PyTorch.
ml-attack-framework: Universität des Saarlandes - Privacy Enhancing Technologies 2021 - Semester Project.
(Trail of Bits) PrivacyRaven [GitHub]
(TensorFlow) TensorFlow Privacy [GitHub]
(NUS Data Privacy and Trustworthy Machine Learning Lab) Machine Learning Privacy Meter [GitHub]
(IQT Labs/Lab 41) CypherCat (archive-only) [GitHub]
(IBM) Adversarial Robustness Toolbox (ART) [GitHub]
These papers affect interfaces also studied by model inversion research, but do not reconstruct private training information and are therefore listed separately.
Contributions are welcome through pull requests or issues. Please use official publisher, proceedings, OpenReview, ACL Anthology, PMLR, CVF/ECVA, USENIX, DOI, or arXiv links whenever possible.
Suggested entry format:
Year | Paper | Domain | Target/observable | Access | Auxiliary data/prior |
Attack or defense | Venue/status | Paper URL | Code URL (optional)
Before submitting an entry:
188 followers · starred Jul 2023