model inversion attacks

**Model Inversion Attacks** are **privacy attacks that reconstruct private training data (or representative features) from a trained model** — exploiting the model's predictions, gradients, or parameters to reverse-engineer the inputs it was trained on. **Model Inversion Methods** - **Gradient-Based**: Use gradient ascent to generate inputs that maximize the model's confidence for a target class. - **GAN-Based**: Train a GAN to invert the model — the generator produces realistic training data reconstructions. - **White-Box**: With full model access, directly optimize input to match internal representations of training data. - **API-Based**: Query the model API repeatedly to reconstruct training data from confidence scores. **Why It Matters** - **Patient Data**: Medical models can leak patient features, violating HIPAA and privacy regulations. - **Trade Secrets**: Semiconductor process models could reveal proprietary process parameters to attackers. - **Defense**: Differential privacy, limiting prediction confidence, and model output perturbation mitigate inversion. **Model Inversion** is **reconstructing private data from the model** — using a trained model as an oracle to recover sensitive information from its training data.