Model Inversion Attacks

Model Inversion Attacks are privacy attacks that reconstruct private training data (or representative features) from a trained model — exploiting the model's predictions, gradients, or parameters to reverse-engineer the inputs it was trained on.

Model Inversion Methods

• Gradient-Based: Use gradient ascent to generate inputs that maximize the model's confidence for a target class.
• GAN-Based: Train a GAN to invert the model — the generator produces realistic training data reconstructions.
• White-Box: With full model access, directly optimize input to match internal representations of training data.
• API-Based: Query the model API repeatedly to reconstruct training data from confidence scores.

Why It Matters

• Patient Data: Medical models can leak patient features, violating HIPAA and privacy regulations.
• Trade Secrets: Semiconductor process models could reveal proprietary process parameters to attackers.
• Defense: Differential privacy, limiting prediction confidence, and model output perturbation mitigate inversion.

Model Inversion is reconstructing private data from the model — using a trained model as an oracle to recover sensitive information from its training data.