Model Inversion Papers, 2024–2026

This index highlights recent work that cuts across the image/text/graph organization in the main README. Publication status was checked on 8 August 2026.

Status labels: peer-reviewed, accepted, preprint, and withdrawn submission.

Surveys, benchmarks, and evaluation

Paper	Year / venue / status	Focus	Main contribution
Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses	2024, arXiv, preprint	Survey/toolbox	Cross-domain survey with an open-source MIA toolbox.
Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey	2025, Artificial Intelligence Review 58:242, peer-reviewed	Survey	Reviews attacks, defenses, applications, datasets, metrics, and open problems.
MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense	2024, arXiv, preprint	Benchmark/toolbox	Implements 16 attacks/defenses and nine evaluation protocols; the ICLR submission was withdrawn.
Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment	2026, CVPR Findings, peer-reviewed	Evaluation	Identifies false positives caused by evaluation classifiers and proposes MLLM-based assessment.
An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline	2025, arXiv, preprint	Practical assessment	Automates visual leakage assessment with four risk dimensions.

Image, 3D, and diffusion-prior attacks

Paper	Year / venue / status	Access / prior	Main contribution
A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks	2024, ECCV, peer-reviewed	White-box; GAN intermediate features	IF-GMI searches intermediate generator features under an L1-ball constraint.
Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment	2024, ECCV, peer-reviewed	Black-box prediction vectors; StyleGAN	P2I directly aligns prediction vectors with StyleGAN W+ to reduce queries.
Pseudo-Private Data Guided Model Inversion Attacks	2024, NeurIPS, peer-reviewed	White-box; public and pseudo-private images	Iteratively improves a generative prior with earlier reconstructions.
Model Inversion Attacks Through Target-Specific Conditional Diffusion Models	2024, arXiv, preprint	Target-specific conditional diffusion	Diff-MI learns a diffusion prior guided by target predictions.
Single-Step Diffusion Model-Based Generative Model Inversion Attacks	2025, ICLR submission, withdrawn submission	Distilled diffusion prior; classifier/CLIP	Replaces GAN priors with a single-step diffusion generator and studies CLIP leakage.
From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning	2025, CVPR, peer-reviewed	Confidence scores; surrogate and generator	SMILE combines long-tailed surrogate training with query-efficient derivative-free search.
MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion	2025, AISTATS, peer-reviewed	Gray-box; shadow model	Hybrid optimization and learned reconstruction for medical images.
ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration	2025, ICLR, peer-reviewed	3D feature interface	Reconstructs voxelized point clouds using occupancy and dispersion objectives.
Diffusion-Driven Universal Model Inversion Attack for Face Recognition	2025, arXiv, preprint	Face embeddings; fixed diffusion prior	Uses a reusable unconditional diffusion model without target-specific generator training.
Model Inversion Attack Against Deep Hashing	2025, arXiv, preprint	Black-box deep hashing; diffusion	Reconstructs retrieval images without private training hash codes.

Foundation models and vision-language models

Paper	Year / venue / status	Exposed interface	Main contribution
Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks	2026, CVPR, peer-reviewed	VLM tokens and generated responses	Introduces token/sequence MIAs and SMI-AW for private visual training data.
Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI	2025, USENIX Security, peer-reviewed	Black-box target; generative-AI prior	Studies data-free model extraction, membership inference, and model inversion.
DRAG: Data Reconstruction Attack using Guided Diffusion	2025, ICML, peer-reviewed	CLIP/DINOv2 intermediate features	Uses guided latent diffusion to reconstruct inputs from deep foundation-model features.

The single-step diffusion work listed in the preceding section also evaluates privacy leakage in CLIP.

Collaborative and split inference

Paper	Year / venue / status	Setting	Main contribution
PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks	2024, WACV, peer-reviewed	Collaborative inference defense	Privacy-aware pruning for resource-constrained edge deployment.
A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning	2024, arXiv, preprint	Passive split-learning server	FORA transfers representation preferences from public auxiliary data.
Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems	2025, CVPR, peer-reviewed	Split-inference defense	Relates conditional entropy to reconstruction error and proposes CEM.
Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization	2025, arXiv, preprint	Split inference; StyleGAN	Progressive feature optimization improves deep-cut and OOD reconstruction.
Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble	2025, DAC, peer-reviewed	Collaborative-inference defense	Selective ensembles confuse server-side reconstruction with low inference overhead.
What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs	2026, CVPR, peer-reviewed	Black-box feature interface	FIA-Flow learns from few image-feature pairs and performs one-step reconstruction.
Prompt Inversion Attack against Collaborative Inference of Large Language Models	2025, arXiv, preprint	LLM inter-layer activations	Reconstructs prompts transmitted in collaborative LLM inference.

Defenses

Paper	Year / venue / status	Defense axis	Main contribution
On the Vulnerability of Skip Connections to Model Inversion Attacks	2024, ECCV, peer-reviewed	Architecture	Shows skip connections amplify leakage and proposes MI-resilient designs.
Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures	2024, ECCV, peer-reviewed	Architecture	Uses sparse-coding layers to limit irrelevant private information.
Trap-MID: Trapdoor-based Defense against Model Inversion Attacks	2024, NeurIPS, peer-reviewed	Misdirection/trapdoor	Makes inversion recover a trapdoor trigger instead of private samples.
Defending against Model Inversion Attacks via Random Erasing	2024, arXiv, preprint	Data-centric training	Random erasing reduces recoverable visual detail while retaining task utility.
Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks	2025, ICLR, peer-reviewed	Output post-processing	Reduces conditional mutual information without retraining the target model.
Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering	2026, KDD, peer-reviewed	Low-rank feature filtering	Final version of the work previously titled CALoR; combines confidence adaptation and low-rank filtering.
Model Inversion Attacks Meet Cryptographic Fuzzy Extractors	2025, arXiv, preprint	Cryptographic biometric defense	Studies inversion against fuzzy extractors and proposes L2FE-Hash.

Text and embedding inversion

Paper	Year / venue / status	Interface	Main contribution
An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference	2024, EMNLP, peer-reviewed	Obfuscated embedding matrix	Recovers text from glide-reflection-obfuscated embeddings.
ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation	2025, ACL, peer-reviewed	Few-shot black-box embeddings	Cross-model alignment enables inversion with few paired samples.
ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks	2025, ACL, peer-reviewed	Embedding-service defense	Obfuscates embeddings for both classification and generation services.
PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration	2025, ACL, peer-reviewed	LLM inference defense	Removes private spans client-side and restores task information through privacy-aware vectors.
Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation	2026, ACL, peer-reviewed	Noisy pooled embeddings	PPFT protects inference and private-domain fine-tuning without sending raw text.

Graph reconstruction

Paper	Year / venue / status	Interface	Main contribution
ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels	2025, arXiv, preprint	Feature explanations and privatized attributes	Denoises auxiliary node information and reconstructs graph topology.
GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning	2025, arXiv, preprint	Graph-unlearning residue	Reconstructs deleted nodes, edges, and neighborhoods; adjacent to classical MIA.

Adjacent reconstruction problems

These papers are useful context but should not be presented as classical post-training MIAs without qualification.

Paper	Year / venue / status	Why adjacent
GRAIN: Exact Graph Reconstruction from Gradients	2025, ICLR, peer-reviewed	Reconstructs graph structure and features from shared training gradients.
TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models	2026, CVPR, peer-reviewed	Attacks concept erasure rather than private classifier training data.
MIMIC: Multimodal Inversion for Model Interpretation and Conceptualization	2025, arXiv, preprint	Representation inversion for interpretation rather than a privacy attack.
Implicit Inversion Turns CLIP into a Decoder	2025, OpenReview	Representation decoding/generation rather than private-data reconstruction.

Maintenance notes

Merge preprint and final versions into one lineage. In particular, arXiv:2410.05814 (CALoR) became the KDD 2026 paper Rank Matters.
Do not label MIBench as an ICLR publication; it remains an arXiv preprint and its ICLR submission was withdrawn.
Do not label Single-Step Diffusion Model-Based Generative Model Inversion Attacks as an accepted ICLR 2025 paper.
Distinguish diffusion models used as attack priors from diffusion models that are themselves the attack target.

14 KiB Raw Blame History Unescape Escape