{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/privacy-leakage-on-dnns-a-survey-of-model","title":"Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses","arxiv_id":"2402.04013","date":"2024-02-06","proceeding":null,"authors":["Hao Fang","Yixiang Qiu","Hongyao Yu","Wenbo Yu","Jiawei Kong","Baoli Chong","Bin Chen","Xuan Wang","Shu-Tao Xia","Ke Xu"],"abstract":"Deep Neural Networks (DNNs) have revolutionized various domains with their exceptional performance across numerous applications. However, Model Inversion (MI) attacks, which disclose private information about the training dataset by abusing access to the trained models, have emerged as a formidable privacy threat. Given a trained network, these attacks enable adversaries to reconstruct high-fidelity data that closely aligns with the private training samples, posing significant privacy concerns. Despite the rapid advances in the field, we lack a comprehensive and systematic overview of existing MI attacks and defenses. To fill this gap, this paper thoroughly investigates this realm and presents a holistic survey. Firstly, our work briefly reviews early MI studies on traditional machine learning scenarios. We then elaborately analyze and compare numerous recent attacks and defenses on Deep Neural Networks (DNNs) across multiple modalities and learning tasks. By meticulously analyzing their distinctive features, we summarize and classify these methods into different categories and provide a novel taxonomy. Finally, this paper discusses promising research directions and presents potential solutions to open issues. To facilitate further study on MI attacks and defenses, we have implemented an open-source model inversion toolbox on GitHub (https://github.com/ffhibnese/Model-Inversion-Attack-ToolBox).","url_abs":"https://arxiv.org/abs/2402.04013v2","url_pdf":"https://arxiv.org/pdf/2402.04013v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"privacy-leakage-on-dnns-a-survey-of-model","repo_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2402.04013","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.04013"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ffhibnese/model-inversion-attack-toolbox","reach":{"status":"ok"}}],"summary":{"ran":2,"ran_honours":1,"ran_draft_wrong":2,"unverified":2},"by_repo_kind":{"official":{"samples":7,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"5ef80f92b298862d","entry":"dconv_bn_relu","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/models.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/models.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5ef80f92b298862d"}},{"code_sha256_prefix":"ad5dbf57f3ea2633","entry":"get_block","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/facenet.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/facenet.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ad5dbf57f3ea2633"}},{"code_sha256_prefix":"ea7941eb1ea8ffb2","entry":"get_blocks","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/facenet.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/facenet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ea7941eb1ea8ffb2"}},{"code_sha256_prefix":"c54fea429589425d","entry":"l2_norm","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/facenet.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/facenet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c54fea429589425d"}},{"code_sha256_prefix":"32a2722356ae35ea","entry":"noise_loss","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/losses.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/losses.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"32a2722356ae35ea"}},{"code_sha256_prefix":"8ceea87fe22a6f64","entry":"completion_network_loss","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/SecretGen/losses.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/SecretGen/losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8ceea87fe22a6f64"}},{"code_sha256_prefix":"d523e5f3e4572d9b","entry":"label_dict_to_pairs","repo":"ffhibnese/model-inversion-attack-toolbox","repo_kind":"official","path":"src/modelinversion/attack/attacker.py","file_url":"https://github.com/ffhibnese/model-inversion-attack-toolbox/blob/HEAD/src/modelinversion/attack/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d523e5f3e4572d9b"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}