Awesome Model Inversion Attacks

A curated, cross-domain collection of research on model inversion attacks (MIAs), defenses, evaluation, and closely related data-reconstruction problems.

Please star or watch this repository to keep tracking the latest updates! Contributions are welcome!

Important

Our survey: Model Inversion Attacks: A Survey of Approaches and Countermeasures

Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han

Our survey provides a unified view of model inversion across image, text, and graph data, covering attack principles, threat models, defenses, datasets, evaluation metrics, practical deployment, and emerging foundation-model settings.

Read the paper · Download PDF · Jump to BibTeX

Note

We distinguish post-training model inversion from gradient inversion, training-data extraction, and other adjacent reconstruction problems. See Scope and labels.

News

• [Aug/2026] Synced the 2024–2026 index with the survey's revised reference list: ten works added, and the DiffMI entry updated to its published IEEE TIFS version.
• [Aug/2026] We refreshed the repository with recent work on foundation models and VLMs, diffusion priors, collaborative/split inference, defenses, and evaluation. See Recent papers (2024–2026).
• [Nov/2024] We released our survey, Model Inversion Attacks: A Survey of Approaches and Countermeasures. [arXiv]

Citation

If you find this repository helpful, please cite our survey:

@article{zhou2024model,
  title={Model Inversion Attacks: A Survey of Approaches and Countermeasures},
  author={Zhou, Zhanke and Zhu, Jianing and Yu, Fengfei and Li, Xuan and Peng, Xiong and Liu, Tongliang and Han, Bo},
  journal={arXiv preprint arXiv:2411.10023},
  year={2024}
}

Navigation

• Scope and labels
• Our survey
• Recent papers (2024–2026)
• Surveys and benchmarks
• Computer vision domain
• Graph learning domain
• Natural language processing domain
• Tools
• Contributing
• Others
• Related repositories
• Star History

Scope and labels

A model inversion attack uses information exposed by a trained model—such as labels, confidence scores, embeddings, hidden representations, model parameters, or generated responses—to reconstruct private training information or sensitive characteristics represented by the model.

Each new entry should make the threat model explicit:

• Access: white-box, score-based black-box, label-only, embedding/feature interface, or generated-response interface.
• Prior/resource: auxiliary data, surrogate model, GAN/StyleGAN prior, diffusion prior, or no auxiliary data.
• Target: class representative, identity, individual input, prompt/text, graph topology, or sensitive attribute.
• Status: peer-reviewed, accepted, preprint, or withdrawn submission.

We list gradient inversion, federated-learning reconstruction, training-data extraction, and inversion for interpretability as adjacent reconstruction when they do not match the post-training MIA threat model.

Surveys and benchmarks

• ⭐ [Our survey, arXiv 2024] Model Inversion Attacks: A Survey of Approaches and Countermeasures. A unified cross-domain survey of attacks, defenses, evaluation, deployment considerations, and open problems across image, text, and graph data.
• [2025, Artificial Intelligence Review] Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey. [paper]
• [2024, arXiv] Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses. [paper] [toolbox]
• [2024, arXiv preprint] MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense. [paper]
• [2023, IEEE CSF] SoK: Model Inversion Attack Landscape: Taxonomy, Challenges, and Future Roadmap. [paper]
• [2021, IEEE TKDE] Model Inversion Attacks: A Survey. [paper]

Broader privacy, trustworthy-ML, and gradient-inversion surveys are retained in the domain lists below when useful, but are not presented as MIA-specific surveys.

Recent papers (2024–2026)

This status-checked index highlights recent work that cuts across the historical image/text/graph organization below. Publication status was checked on 13 August 2026.

Status labels: peer-reviewed, accepted, preprint, and withdrawn submission.

Show the 2024–2026 paper index

Surveys, benchmarks, and evaluation

Paper	Year / venue / status	Focus	Main contribution
⭐ Model Inversion Attacks: A Survey of Approaches and Countermeasures	2024, arXiv, our survey	Threat-model-aware synthesis	Organizes attacks and defenses by the interface observed, the knowledge and priors assumed, the reconstruction space, and the conditions under which each fails; covers image, text, and graph settings, evaluation, and deployment.
Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses	2024, arXiv, preprint	Survey/toolbox	Cross-domain survey with an open-source MIA toolbox.
Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey	2025, Artificial Intelligence Review 58:242, peer-reviewed	Survey	Reviews attacks, defenses, applications, datasets, metrics, and open problems.
MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense	2024, arXiv, preprint	Benchmark/toolbox	Implements 16 attacks/defenses and nine evaluation protocols; the ICLR submission was withdrawn.
Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment	2026, CVPR Findings, peer-reviewed	Evaluation	Identifies false positives caused by evaluation classifiers and proposes MLLM-based assessment.
An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline	2025, arXiv, preprint	Practical assessment	Automates visual leakage assessment with four risk dimensions.

Image, 3D, and diffusion-prior attacks

Paper	Year / venue / status	Access / prior	Main contribution
A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks	2024, ECCV, peer-reviewed	White-box; GAN intermediate features	IF-GMI searches intermediate generator features under an L1-ball constraint.
Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment	2024, ECCV, peer-reviewed	Black-box prediction vectors; StyleGAN	P2I directly aligns prediction vectors with StyleGAN W+ to reduce queries.
Pseudo-Private Data Guided Model Inversion Attacks	2024, NeurIPS, peer-reviewed	White-box; public and pseudo-private images	Iteratively improves a generative prior with earlier reconstructions.
Model Inversion Attacks Through Target-Specific Conditional Diffusion Models	2024, arXiv, preprint	Target-specific conditional diffusion	Diff-MI learns a diffusion prior guided by target predictions.
Single-Step Diffusion Model-Based Generative Model Inversion Attacks	2025, ICLR submission, withdrawn submission	Distilled diffusion prior; classifier/CLIP	Replaces GAN priors with a single-step diffusion generator and studies CLIP leakage.
From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning	2025, CVPR, peer-reviewed	Confidence scores; surrogate and generator	SMILE combines long-tailed surrogate training with query-efficient derivative-free search.
MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion	2025, AISTATS, peer-reviewed	Gray-box; shadow model	Hybrid optimization and learned reconstruction for medical images.
ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration	2025, ICLR, peer-reviewed	3D feature interface	Reconstructs voxelized point clouds using occupancy and dispersion objectives.
DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion	2026, IEEE TIFS 21:4275–4290, peer-reviewed	Face embeddings; fixed diffusion prior	Uses a reusable unconditional diffusion model without target-specific generator training. Final version of arXiv:2504.18015, previously listed here as Diffusion-Driven Universal Model Inversion Attack for Face Recognition.
Generative Model Inversion Through the Lens of the Manifold Hypothesis	2025, NeurIPS, peer-reviewed	White-box; generative prior	Analyses inversion gradients as largely normal to the data manifold and proposes manifold-aligned attacks.
Model Inversion Attack Against Deep Hashing	2025, arXiv, preprint	Black-box deep hashing; diffusion	Reconstructs retrieval images without private training hash codes.

Foundation models and vision-language models

Paper	Year / venue / status	Exposed interface	Main contribution
Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks	2026, CVPR, peer-reviewed	VLM tokens and generated responses	Introduces token/sequence MIAs and SMI-AW for private visual training data.
Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI	2025, USENIX Security, peer-reviewed	Black-box target; generative-AI prior	Studies data-free model extraction, membership inference, and model inversion.
DRAG: Data Reconstruction Attack using Guided Diffusion	2025, ICML, peer-reviewed	CLIP/DINOv2 intermediate features	Uses guided latent diffusion to reconstruct inputs from deep foundation-model features.
CapRecover: A Cross-Modality Feature Inversion Attack Framework on Vision-Language Models	2025, ACM MM, peer-reviewed	Intermediate visual features of a VLM	Recovers semantic content (labels, captions) directly from split-VLM features without image reconstruction.
LeakyCLIP: Extracting Training Data from CLIP	2025, arXiv, preprint	CLIP image/text embeddings	Studies how much training data can be recovered from CLIP embeddings.
Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Model	2025, CVPR Workshops (ABAW), peer-reviewed	Face-recognition embeddings	Adapts a face foundation model as the prior for reconstruction; the foundation model is the attacker's tool, not the target.

The single-step diffusion work listed in the preceding section also evaluates privacy leakage in CLIP.

Collaborative and split inference

Paper	Year / venue / status	Setting	Main contribution
PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks	2024, WACV, peer-reviewed	Collaborative inference defense	Privacy-aware pruning for resource-constrained edge deployment.
A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning	2024, arXiv, preprint	Passive split-learning server	FORA transfers representation preferences from public auxiliary data.
Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems	2025, CVPR, peer-reviewed	Split-inference defense	Relates conditional entropy to reconstruction error and proposes CEM.
Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization	2025, arXiv, preprint	Split inference; StyleGAN	Progressive feature optimization improves deep-cut and OOD reconstruction.
Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble	2025, DAC, peer-reviewed	Collaborative-inference defense	Selective ensembles confuse server-side reconstruction with low inference overhead.
What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs	2026, CVPR, peer-reviewed	Black-box feature interface	FIA-Flow learns from few image-feature pairs and performs one-step reconstruction.
SIMBA: Split Inference — Mechanisms, Benchmarks and Attacks	2024, ECCV, peer-reviewed	Split-inference benchmark	Systematizes split-inference mechanisms and attacks and benchmarks them under one protocol. Authors are Singh et al.
Passive Inference Attacks on Split Learning via Adversarial Regularization	2025, NDSS, peer-reviewed	Passive split-learning server	SDAR uses adversarial regularization to reconstruct client data without deviating from the protocol.
Prompt Inversion Attack against Collaborative Inference of Large Language Models	2025, arXiv, preprint	LLM inter-layer activations	Reconstructs prompts transmitted in collaborative LLM inference.

Defenses

Paper	Year / venue / status	Defense axis	Main contribution
On the Vulnerability of Skip Connections to Model Inversion Attacks	2024, ECCV, peer-reviewed	Architecture	Shows skip connections amplify leakage and proposes MI-resilient designs.
Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures	2024, ECCV, peer-reviewed	Architecture	Uses sparse-coding layers to limit irrelevant private information.
Trap-MID: Trapdoor-based Defense against Model Inversion Attacks	2024, NeurIPS, peer-reviewed	Misdirection/trapdoor	Makes inversion recover a trapdoor trigger instead of private samples.
Defending against Model Inversion Attacks via Random Erasing	2024, arXiv, preprint	Data-centric training	Random erasing reduces recoverable visual detail while retaining task utility.
Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks	2025, ICLR, peer-reviewed	Output post-processing	Reduces conditional mutual information without retraining the target model.
Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering	2026, KDD, peer-reviewed	Low-rank feature filtering	Final version of the work previously titled CALoR; combines confidence adaptation and low-rank filtering.
GRASP: Differentially Private Graph Reconstruction Defense with Structured Perturbation	2025, KDD, peer-reviewed	Graph embedding perturbation	Perturbs released node embeddings along structured directions, trading graph-reconstruction AUC against node accuracy.
Model Inversion Attacks Meet Cryptographic Fuzzy Extractors	2025, arXiv, preprint	Cryptographic biometric defense	Studies inversion against fuzzy extractors and proposes L2FE-Hash.

Text and embedding inversion

Paper	Year / venue / status	Interface	Main contribution
An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference	2024, EMNLP, peer-reviewed	Obfuscated embedding matrix	Recovers text from glide-reflection-obfuscated embeddings.
ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation	2025, ACL, peer-reviewed	Few-shot black-box embeddings	Cross-model alignment enables inversion with few paired samples.
ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks	2025, ACL, peer-reviewed	Embedding-service defense	Obfuscates embeddings for both classification and generation services.
PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration	2025, ACL, peer-reviewed	LLM inference defense	Removes private spans client-side and restores task information through privacy-aware vectors.
Stealing Training Data from Large Language Models in Decentralized Training through Activation Inversion Attack	2025, ACL, peer-reviewed	Activations exchanged in decentralized training	Recovers training text from intermediate activations passed between decentralized training participants.
Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation	2026, ACL, peer-reviewed	Noisy pooled embeddings	PPFT protects inference and private-domain fine-tuning without sending raw text.
An Invariant Latent Space Perspective on Language Model Inversion	2026, AAAI, peer-reviewed	Next-token distributions / logits	Casts language-model inversion as recovery in an invariant latent space shared across models.

Graph reconstruction

Paper	Year / venue / status	Interface	Main contribution
ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels	2025, arXiv, preprint	Feature explanations and privatized attributes	Denoises auxiliary node information and reconstructs graph topology.
GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning	2025, arXiv, preprint	Graph-unlearning residue	Reconstructs deleted nodes, edges, and neighborhoods; adjacent to classical MIA.

Adjacent reconstruction problems

These papers are useful context but should not be presented as classical post-training MIAs without qualification.

Paper	Year / venue / status	Why adjacent
GRAIN: Exact Graph Reconstruction from Gradients	2025, ICLR, peer-reviewed	Reconstructs graph structure and features from shared training gradients.
TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models	2026, CVPR, peer-reviewed	Attacks concept erasure rather than private classifier training data.
DAGER: Exact Gradient Inversion for Large Language Models	2024, NeurIPS, peer-reviewed	Reconstructs input text exactly from shared training gradients in federated learning, not from a released model.
MIMIC: Multimodal Inversion for Model Interpretation and Conceptualization	2025, arXiv, preprint	Representation inversion for interpretation rather than a privacy attack.
Implicit Inversion Turns CLIP into a Decoder	2025, OpenReview	Representation decoding/generation rather than private-data reconstruction.

Maintenance notes

• Merge preprint and final versions into one lineage. In particular, arXiv:2410.05814 (CALoR) became the KDD 2026 paper Rank Matters, and arXiv:2504.18015 became the IEEE TIFS 2026 paper DiffMI — same authors, retitled, so it is one row rather than two.
• Do not label MIBench as an ICLR publication; it remains an arXiv preprint and its ICLR submission was withdrawn.
• Do not label Single-Step Diffusion Model-Based Generative Model Inversion Attacks as an accepted ICLR 2025 paper.
• Distinguish diffusion models used as attack priors from diffusion models that are themselves the attack target. The same distinction applies to face foundation models used as reconstruction priors.
• Gradient inversion in federated learning (GRAIN, DAGER) reconstructs from shared gradients rather than from a released model; it belongs under Adjacent reconstruction problems.

Computer vision domain

Show the complete computer-vision list

The entries below preserve the historical collection. For a status-checked cross-cutting view of recent work, use the 2024–2026 index.

• [NDSS 2025] CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling [paper] [code] [project]

• [ICML 2024] (white-box) Sparse Model Inversion: Efficient Inversion of Vision Transformers for Data-Free Applications [paper] [code]

• [CVPR 2024] Model Inversion Robustness: Can Transfer Learning Help? [paper] [code]

• [ICLR 2024] Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks [paper] [code]

• [ICASSP 2023] (black-box) Sparse Black-Box Inversion Attack with Limited Information [paper] [code]

• [IEEE Transactions on Information Forensics and Security 2023] A GAN-Based Defense Framework Against Model Inversion Attacks [paper]

• [CVPR 2023] (black-box) Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack [paper] [code]

• [AAAI 2023] (white-box) Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network [paper] [code]

• [TDSC 2023] (black-box) C2FMI: Coarse-to-Fine Black-box Model Inversion Attack [paper] [code]

• [TDSC 2023] (black-box) Boosting Model Inversion Attacks with Adversarial Examples [paper]

• [CVPR 2023] (black-box) Reinforcement Learning-Based Black-Box Model Inversion Attacks [paper] [code]

• [CVPR 2023] (white-box) Re-thinking Model Inversion Attacks Against Deep Neural Networks [paper] [code]

• [AAAI 2023] (black-box (defense)) Purifier: Defending Data Inference Attacks via Transforming Confidence Scores [paper]

• [IEEE TIFS 2024] (label-only black-box) Unstoppable Attack: Label-Only Model Inversion via Conditional Diffusion Model [paper]

• [ICML 2022] Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentations [paper]

• [ICML 2022] (white-box) Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks [paper] [code]

• [CVPR 2022] (black-box) Label-Only Model Inversion Attacks via Boundary Repulsion [paper] [code]

• [CVPR 2022] (white-box (defense)) ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learning [paper] [code]

• [KDD 2022] (white-box (defense)) Bilateral Dependency Optimization: Defending Against Model-inversion Attacks [paper] [code]

• [USENIX Security 2022] (holistic risk assessment) ML-DOCTOR: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models [paper] [code]

• [TIFS 2022] (white-box) Model Inversion Attack by Integration of Deep Generative Models: Privacy-Sensitive Face Generation From a Face Recognition System [paper]

• [TIFS 2022] (black-box (defense)) One Parameter Defense—Defending Against Data Inference Attacks via Differential Privacy [paper]

• [WACV 2022] (white-box) Reconstructing Training Data from Diverse ML Models by Ensemble Inversion [paper]

• [ECCV 2022] (white-box) SecretGen: Privacy Recovery on Pre-trained Models via Distribution Discrimination [paper]

• [WPES 2022] (black-box) UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning [paper] [code]

• [NDSS 2022] (white-box & black-box) MIRROR: Model Inversion for Deep Learning Network with High Fidelity [paper] [code]

• [SP 2022] (white-box) Reconstructing Training Data with Informed Adversaries [paper]

• [BMVC 2022] (white-box) Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks [paper]

• [NeurIPS 2022] (white-box) Reconstructing Training Data from Trained Neural Networks [paper]

• [NeurIPS 2021] (white-box) Variational Model Inversion Attacks [paper] [code]

• [ICCV 2021] (white-box) Exploiting Explanations for Model Inversion Attacks [paper]

• [ICCV 2021] (white-box) Knowledge-Enriched Distributional Model Inversion Attacks [paper] [code]

• [AAAI 2021] (white-box (defense)) Improving Robustness to Model Inversion Attacks via Mutual Information Regularization [paper]

• [ICLR Workshop 2021] (black-box (defense)) Practical Defences Against Model Inversion Attacks for Split Neural Networks [paper] [code]

• [ICDE 2021] (white-box) Feature inference attack on model predictions in vertical federated learning [paper] [code]

• [DAC 2021] (black & white-box) PRID: Model Inversion Privacy Attacks in Hyperdimensional Learning Systems [paper]

• [CSR Workshops 2021] (black-box (defense)) Defending Against Model Inversion Attack by Adversarial Examples [paper]

• [ECML PKDD 2021] (black-box) Practical Black Box Model Inversion Attacks Against Neural Nets [paper]

• [APSIPA 2021] (black-box) Model Inversion Attack against a Face Recognition System in a Black-Box Setting [paper]

• [CCS 2021] Unleashing the tiger: Inference attacks on split learning [paper] [code]

• [CSR 2021] Defending Against Model Inversion Attack by Adversarial Examples [paper]

• [CVPR 2020] Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion [paper] [code]

• [CVPR 2020] (white-box) The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks [paper] [code] [video]

• [ICLR 2020] (white-box) Overlearning Reveals Sensitive Attributes [paper]

• [APSIPA ASC 2020] (white-box) Deep Face Recognizer Privacy Attack: Model Inversion Initialization by a Deep Generative Adversarial Data Space Discriminator [paper]

• [USENIX Security 2020] (black-box) Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning [paper]

• [IoT-J 2020] (black-box) Attacking and Protecting Data Privacy in Edge-Cloud Collaborative Inference Systems [paper] [code]

• [ECCV Workshop 2020] (black-box) Black-Box Face Recovery from Identity Features [paper]

• [arXiv 2020] (white-box) MixCon: Adjusting the Separability of Data Representations for Harder Data Recovery [paper]

• [Globecom 2020] (white-box (defense)) Privacy Preserving Facial Recognition Against Model Inversion Attacks [paper]

• [Big Data 2020] (white-box (defense)) Broadening Differential Privacy for Deep Learning Against Model Inversion Attacks [paper]

• [AdvML 2020] (metric) Evaluation Indicator for Model Inversion Attack [paper]

• [CVPR 2020] The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks [paper]

• [AAAI 2020] (black & white-box) Improving Robustness to Model Inversion Attacks via Mutual Information Regularization [paper]

• [arXiv 2020] Defending Model Inversion and Membership Inference Attacks via Prediction Purification [paper]

• [arXiv 2019] (black-box) GAMIN: An Adversarial Approach to Black-Box Model Inversion [paper]

• [ACSAC 2019] Model Inversion Attacks Against Collaborative Inference [paper] [code]

• [CCS 2019] (black-box) Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment [paper] [code]

• [ACSAC 2019] (black & white-box) Model Inversion Attacks Against Collaborative Inference [paper]

• [GLSVLSI 2019] (black-box (defense)) MLPrivacyGuard: Defeating Confidence Information based Model Inversion Attacks on Machine Learning Systems [paper]

• [CVPR 2019] A Style-Based Generator Architecture for Generative Adversarial Networks [paper]

• [arXiv 2019] (white-box) An Attack-Based Evaluation Method for Differentially Private Learning Against Model Inversion Attack [paper]

• [CSF 2018] (white-box) Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting [paper]

• [CCS 2017] (white-box) Machine Learning Models that Remember Too Much [paper] [code]

• [PST 2017] (white-box) Model Inversion Attacks for Prediction Systems: Without knowledge of Non-Sensitive Attributes [paper]

• [NeurIPS 2016] Generating Images with Perceptual Similarity Metrics based on Deep Networks [paper]

• [CVPR 2016] Inverting visual representations with convolutional networks [paper]

• [CSF 2016] (black & white-box) A Methodology for Formalizing Model-Inversion Attacks [paper]

• [CVPR 2015] Understanding Deep Image Representations by Inverting Them [paper]

• [IJCAI 2015] (white-box (defense)) Regression Model Fitting under Differential Privacy and Model Inversion Attack [paper] [code]

• [CCS 2015] (black & white-box) Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures [paper] [code1] [code2] [code3] [code4]

• [ICLR 2014] Intriguing properties of neural networks [paper]

• [ICLR 2014] Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps [paper]

• [USENIX Security 2014] (black & white-box) Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing [paper]

Graph learning domain

Show the complete graph-learning list

The entries below include both post-training graph inversion and adjacent graph-reconstruction settings. See each paper's threat model before comparing results.

• [SecureComm 2023] (white-box) Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks [paper]

• [ICML 2023] (white-box) On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximation [paper] [code]

• [TKDE 2022] Model Inversion Attacks against Graph Neural Networks [paper]

• [IJIS 2022] Defense Against Membership Inference Attack in Graph Neural Networks Through Graph Perturbation [paper]

• [CCS 2022] Finding MNEMON: Reviving Memories of Node Embeddings [paper]

• [arXiv 2022] Privacy and Transparency in Graph Machine Learning: A Unified Perspective [paper]

• [arXiv 2022] Private Graph Extraction via Feature Explanations [paper]

• [arXiv 2022] Degree-Preserving Randomized Response for Graph Neural Networks under Local Differential Privacy [paper]

• [arXiv 2022] Sok: Differential Privacy on Graph-Structured Data[paper]

• [arXiv 2022] GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation [paper]

• [arXiv 2022] Differentially Private Graph Classification With GNNs [paper]

• [IEEE S&P 2022] Model Stealing Attacks Against Inductive Graph Neural Networks [paper] [code]

• [USENIX Security 2022] Inference Attacks Against Graph Neural Networks [paper] [code]

• [WWW 2022] Learning Privacy-Preserving Graph Convolutional Network with Partially Observed Sensitive Attributes [paper]

• [arXiv 2022] (black & white-box) A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability [paper]

• [arXiv 2021] Node-Level Membership Inference Attacks Against Graph Neural Networks [paper]

• [IJCAI 2021] (white-box) GraphMI: Extracting Private Graph Data from Graph Neural Networks [paper] [code]

• [ICML 2021] DeepWalking Backwards: From Node Embeddings Back to Graphs [paper] [code]

• [ICDE 2021] (black-box) NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data [paper] [code]

• [IJCAI 2021] (white-box) A Survey on Gradient Inversion: Attacks, Defenses and Future Directions [paper]

• [MobiQuitous 2020] Quantifying Privacy Leakage in Graph Embedding [paper] [code]

• [arXiv 2020] (black & white-box) Reducing Risk of Model Inversion Using Privacy-Guided Training [paper]

• [USENIX Security 2020] Stealing Links from Graph Neural Networks [paper] [code]

Natural language processing domain

Show the complete NLP list

This historical list includes embedding inversion, prompt inversion, memorization, and adjacent training-data extraction. The 2024–2026 index separates these interfaces and statuses.

• [NeurIPS 2025] (black-box) Better Language Model Inversion by Compactly Representing Next-Token Distributions [paper] [code]

• [ACL 2024] (black-box) Text Embedding Inversion Security for Multilingual Language Models [paper] [code]

• [ICLR 2024] (black-box) Language Model Inversion [paper] [code]

• [arXiv 2024] (white-box) Do Membership Inference Attacks Work on Large Language Models? [paper]

• [EMNLP 2024] (black-box) Extracting Prompts by Inverting LLM Outputs [paper] [code]

• [ACL 2024] (black-box) Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries [paper]

• [COLM 2024] Effective Prompt Extraction from Language Models [paper]

• [EMNLP 2023] (black-box) Text Embeddings Reveal (Almost) As Much As Text [paper] [code]

• [arXiv 2023] (white-box) Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Models [paper]

• [ACL 2023] (black-box) Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence [paper] [code]

• [SaTML 2023] (black-box) Model Inversion Attack with Least Information and an In-depth Analysis of its Disparate Vulnerability [paper]

• [NAACL 2022] (white-box) Are Large Pre-Trained Language Models Leaking Your Personal Information? [paper] [code]

• [NeurIPS 2022] (white-box) Recovering Private Text in Federated Learning of Language Models [paper] [code]

• [ACL 2022] (white-box) Canary Extraction in Natural Language Understanding Models [paper]

• [arXiv 2022] (white-box) Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformers [paper]

• [arXiv 2022] (black-box) KART: Parameterization of Privacy Leakage Scenarios from Pre-trained Language Models [paper] [code]

• [CEUR Workshop 2021] (black-box) Dataset Reconstruction Attack against Language Models [paper]

• [EMNLP 2021] (white-box) TAG: Gradient Attack on Transformer-based Language Models [paper]

• [CCS 2020] (black & white-box) Information Leakage in Embedding Models [paper]

• [S&P 2020] (black & white-box) Privacy Risks of General-Purpose Language Models [paper]

• [USENIX Security 2020] (black-box) Extracting Training Data from Large Language Models [paper] [code]

• [USENIX Security 2019] The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks [paper]

• [arXiv 2018] Towards Robust and Privacy-preserving Text Representations [paper]

• [arXiv 2018] Privacy-preserving Neural Representations of Text [paper]

• [arXiv 2018] Adversarial Removal of Demographic Attributes from Text Data [paper]

• [NeurIPS 2017] Controllable Invariance through Adversarial Feature Learning [paper]

• [arXiv 2015] Censoring Representations with an Adversary [paper]

Tools

• AIJack: Implementation of algorithms for AI security.

• Privacy-Attacks-in-Machine-Learning: Membership Inference, Attribute Inference and Model Inversion attacks implemented using PyTorch.

• ml-attack-framework: Universität des Saarlandes - Privacy Enhancing Technologies 2021 - Semester Project.

• (Trail of Bits) PrivacyRaven [GitHub]

• (TensorFlow) TensorFlow Privacy [GitHub]

• (NUS Data Privacy and Trustworthy Machine Learning Lab) Machine Learning Privacy Meter [GitHub]

• (IQT Labs/Lab 41) CypherCat (archive-only) [GitHub]

• (IBM) Adversarial Robustness Toolbox (ART) [GitHub]

Attacks against synthetic data

• [arXiv 2025] The DCR Delusion: Measuring the Privacy Risk of Synthetic Data. [paper]
• [arXiv 2023] A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Data [paper] [code]
• [USENIX 2022] Synthetic Data - Anonymisation of Groundhog Day [paper] [code]

Others

• [Blog 2020] Uncovering a model's secrets [blog1] [blog2]
• [Blog 2020] Attacks against Machine Learning Privacy (Part 1): Model Inversion Attacks with the IBM-ART Framework [blog]
• [Slides 2020] ML and DP [slides]

Related representation-space attacks (not model inversion)

These papers affect interfaces also studied by model inversion research, but do not reconstruct private training information and are therefore listed separately.

• [arXiv 2025] (black- and white-box) Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models. Exploits embedding-distribution bias to find universal suffixes that manipulate cosine similarity and bypass embedding-based safeguards. [paper]

Contributing

Contributions are welcome through pull requests or issues. Please use official publisher, proceedings, OpenReview, ACL Anthology, PMLR, CVF/ECVA, USENIX, DOI, or arXiv links whenever possible.

Suggested entry format:

Year | Paper | Domain | Target/observable | Access | Auxiliary data/prior |
Attack or defense | Venue/status | Paper URL | Code URL (optional)

Before submitting an entry:

1. Search this README for duplicate titles and earlier versions.
2. Merge a preprint and its final version into one lineage.
3. Verify the authors, exact title, venue, year, pages, DOI, URL, and current publication status.
4. State the exposed interface and recovered target instead of using only “white-box” or “black-box”.
5. Label gradient inversion, training-data extraction, interpretability-oriented inversion, and unlearning/concept-erasure inversion as adjacent reconstruction unless the paper studies the classical MIA threat model.
6. Add at most one original sentence describing the contribution; do not copy the abstract.

Related repositories

• awesome-ml-privacy-attacks [repo]

Star History