model inversion attack

Model inversion attacks reconstruct training data from model parameters or prediction outputs. **Attack types**: **Class representative**: Reconstruct average input for a class - what does "face of person X" look like? **Training data recovery**: More direct reconstruction of actual training examples. **Gradient-based**: Use model gradients to infer training features. **Methods**: **Optimization**: Start from random input, optimize to maximize class probability, produces stereotypical class examples. **GAN-based**: Train generator to produce inputs model classifies with high confidence. **Gradient inversion**: From federated learning gradients, reconstruct training batch. **What's recoverable**: Visual features, text statistics, sensitive attributes that correlate with labels. **Defenses**: Differential privacy, gradient clipping and noise, limiting prediction API details, membership resistance training. **Real-world impact**: Face recognition models leaking face templates, medical models leaking patient features. **Evaluation**: Visual similarity, attribute recovery accuracy. **Vs membership inference**: MI detects presence, model inversion reconstructs content. Both privacy attacks but different threat models. Serious concern for models trained on sensitive data.