Model inversion attacks reconstruct training data from model parameters or prediction outputs. Attack types: Class representative: Reconstruct average input for a class - what does "face of person X" look like? Training data recovery: More direct reconstruction of actual training examples. Gradient-based: Use model gradients to infer training features. Methods: Optimization: Start from random input, optimize to maximize class probability, produces stereotypical class examples. GAN-based: Train generator to produce inputs model classifies with high confidence. Gradient inversion: From federated learning gradients, reconstruct training batch. What's recoverable: Visual features, text statistics, sensitive attributes that correlate with labels. Defenses: Differential privacy, gradient clipping and noise, limiting prediction API details, membership resistance training. Real-world impact: Face recognition models leaking face templates, medical models leaking patient features. Evaluation: Visual similarity, attribute recovery accuracy. Vs membership inference: MI detects presence, model inversion reconstructs content. Both privacy attacks but different threat models. Serious concern for models trained on sensitive data.