Research map / Adversarial robustness and security / Attacks on text and graphs
Re-Thinking Model Inversion Attacks Against Deep Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace the cross-entropy identity loss with logit maximization | KEDMI · CelebA/CelebA/IR152 | Attack Acc: 80.53 $\pm$ 3.86 -> 92.47 $\pm$ 1.41 | Helped |
| Use model augmentation | KEDMI · CelebA/CelebA/IR152 | Attack Acc: 80.53 $\pm$ 3.86 -> 84.73 $\pm$ 3.76 | Helped |
| Combine logit maximization and model augmentation | KEDMI · CelebA/CelebA/face.evoLve | Attack Acc: 81.40 $\pm$ 3.25 -> 93.20 $\pm$ 0.85 | Helped |
| Combine logit maximization and model augmentation | GMI · CelebA/CelebA/IR152 | Attack Acc: 30.60 $\pm$ 6.54 -> 82.40 $\pm$ 4.37 | Helped |
| Combine logit maximization and model augmentation | VMI · CelebA/CelebA/ResNet-34 | Attack Acc: 59.96 $\pm$ 0.27 -> 74.90 $\pm$ 0.34 | Helped |
| Combine logit maximization and model augmentation | KEDMI · CelebA/FFHQ/IR152 | Attack Acc: 52.87 $\pm$ 4.96 -> 77.27 $\pm$ 2.01 | Helped |
| Increase the number of augmented models from 0 to 4 (ablation) | KEDMI + MA · CelebA/CelebA/IR152 | Attack Acc: 80.53 $\pm$ 3.86 -> 85.87 $\pm$ 2.63 | Helped |
| Use DenseNet121, DenseNet161, and DenseNet169 as augmented models instead of EfficientNet-B0/B1/B2 (ablation) | KEDMI + MA · CelebA/CelebA/IR152 | Attack Acc: 80.53 $\pm$ 3.86 -> 89.07 $\pm$ 3.32 | Helped |
| Use sampled p_reg instead of fixed p_reg (ablation) | KEDMI + LOM · CelebA/CelebA/face.evoLve | Attack Acc: 90.40 $\pm$ 1.68 -> 92.53 $\pm$ 1.51 | Helped |
| Clip latent code z to [-1, 1] (ablation) | KEDMI · CelebA/CelebA/IR152 | Attack Acc: 78.53 $\pm$ 3.45 -> 80.53 $\pm$ 3.86 | Helped |
| Use logit maximization without model augmentation | GMI · MNIST/MNIST/CNN(Conv3) | Attack Acc: 8.00 $\pm$ 1.52 -> 15.20 $\pm$ 15.12 | Helped |
| Use logit maximization without model augmentation | GMI · MNIST/MNIST/CNN(Conv3) | KNN Dist: 126.61 -> 161.90 | Hurt |
Closest papers by meaning
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.90)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.90)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.88)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.88)
- Pseudo-Private Data Guided Model Inversion Attacks (NeurIPS 2024 · similarity 0.86)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.