Research map / Adversarial robustness and security / Attacks on text and graphs
Understanding Reconstruction Attacks with the Neural Tangent Kernel and Dataset Distillation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Builds a stronger NTK-based dataset reconstruction attack that provably recovers the full training set in the infinite-width limit under MSE loss, empirically studies its dependence on NTK deviation, and shows it is equivalent to a variant of KIP dataset distillation (RKIP).
Problem
Dataset reconstruction attacks recover training data from trained network parameters, but there is little formal understanding of when and which datapoints are susceptible, and prior attacks are brittle and require convergence to a max-margin KKT point.
Approach
Reconstruct training images and dual parameters by matching the parameter change from initialization to the final parameters via the NTK-linearized solution (min-norm interpolant under MSE). In the infinite-width limit this loss is an MMD between kernel embeddings, so zero loss recovers the full training set; the loss is also shown equal to KIP under a different norm plus a variance term (RKIP).
Key results
- On MNIST Odd/Even, KIP reaches 91.53% infinite-width accuracy but only 55.62% for standard 4096-width finite networks, while RKIP stays near 89.61% (standard).
- Reconstruction quality correlates strongly with the kernel distance between initial and final finite-width NTK; smaller datasets and wider models yield lower kernel distance.
- Reconstruction is compatible with early stopping and cross-entropy loss; early stopping in general improves reconstruction quality.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RKIP instead of KIP for distilling 500 images to 20 | Dataset distillation · MNIST Odd/Even, linearized | test accuracy: $55.62 \pm 7.48$ -> $89.99 \pm 1.11$ | Helped |
| Use RKIP instead of KIP for distilling 500 images to 20 | Dataset distillation · CIFAR-10 Animal/Vehicle, standard | test accuracy: $35.26 \pm 5.67$ -> $72.23 \pm 3.61$ | Helped |
| Use RKIP instead of KIP for distilling 500 images to 20 | Dataset distillation · MNIST Odd/Even, infinite width | test accuracy: $91.53 \pm 0.57$ -> $91.44 \pm 0.48$ | No clear effect |
| Use RKIP instead of KIP for distilling 500 images to 20 | Dataset distillation · CIFAR-10 Animal/Vehicle, infinite width | test accuracy: $70.98 \pm 0.43$ -> $74.66 \pm 0.93$ | Helped |
| Use RKIP-finite rather than KIP | Dataset distillation · MNIST Odd/Even, standard | test accuracy: $57.42 \pm 8.41$ -> $88.45 \pm 0.89$ | Helped |
| Use RKIP-finite rather than KIP | Dataset distillation · CIFAR-10 Animal/Vehicle, standard | test accuracy: $35.26 \pm 5.67$ -> $71.96 \pm 1.14$ | Helped |
| Train the network with linearized rather than standard dynamics (ablation) | Reconstruction attack · MNIST Odd/Even | reconstruction quality | Helped |
| Increase model width (ablation) | Reconstruction attack · MNIST Odd/Even and CIFAR-10 Animal/Vehicle | number of images resolved | Helped |
| Use a smaller training set (ablation) | Reconstruction attack · MNIST Odd/Even and CIFAR-10 Animal/Vehicle | reconstruction quality | Helped |
| Train with more classes rather than binary classification (ablation) | Reconstruction attack · Multiclass MNIST/CIFAR-10 | reconstruction quality | Helped |
| Stop training early rather than train to convergence (ablation) | Reconstruction attack · MNIST Odd/Even and CIFAR-10 Animal/Vehicle | reconstruction quality | Helped |
| Remove the 20 most easily reconstructed images iteratively (ablation) | CIFAR-10 model · CIFAR-10 | test accuracy | No clear effect |
Surprising findings
- Early stopping improves reconstruction quality rather than harming it, contrary to the expectation that the attack needs convergence.
- RKIP shows almost no performance drop when transferred from infinite width to finite networks, while KIP drops sharply.
Limitations
- Requires access to the model initialization (or an earlier checkpoint), which limits practicality.
- Experiments restricted to two-layer MLPs on low-resolution images; deeper convolutional networks deviate from NTK theory and were not characterized; fine-tuning reconstructions have limited quality.
- Computing K_TT inverse for RKIP is infeasible for large datasets.
Experimental setup
Datasets: MNIST CIFAR-10 CIFAR-100 Caltech Birds Tiny-ImageNet ImageNet
Benchmarks: MNIST Odd/Even CIFAR-10 Animal/Vehicle
Metrics: squared L2 reconstruction distance (reconstruction curves) test accuracy on distilled data kernel distance
Baselines: KIP Haim et al. reconstruction attack
Builds on: Haim et al. dataset reconstruction attack (max-margin KKT) kernel inducing points (KIP) neural tangent kernel gradient leakage
Closest papers by meaning
- DRAG: Data Reconstruction Attack using Guided Diffusion (ICML 2025 · similarity 0.86)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.85)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.85)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.84)
- Towards Adversarially Robust Dataset Distillation by Curvature Regularization (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.