Model Inversion Attack

The attack surface varies dramatically based on the adversary's access level. In a white-box setting, the attacker has full knowledge of the model's architecture, parameters, and gradients, enabling precise optimization against the loss surface. In a black-box setting, the attacker can only query the model and observe output confidence scores or labels. Black-box attacks rely on gradient estimation through repeated querying, making them less efficient but more realistic in deployed APIs and federated learning systems.

The primary leakage vector is the model's prediction confidence vector. An attacker formulates an optimization problem that searches the input space for a sample that maximizes the target class confidence. The objective function is typically:

• Maximum Likelihood Estimation: Find an input x that maximizes p(y_target | x)
• Gradient Ascent: Iteratively update a random input by following the gradient of the target class score This process reveals the model's internal prototype of a class, which often resembles a training sample.

In federated wireless learning, model inversion poses a severe threat during the gradient exchange phase. An honest-but-curious server can reconstruct a client's private RF training samples from shared gradients. The attack works by:

• Initializing a dummy input and label
• Computing dummy gradients and minimizing the L2 distance between dummy and true gradients
• Backpropagating this loss to update the dummy input until it converges to the original private data This is particularly dangerous for RF fingerprinting and automatic modulation classification models trained on sensitive signal intelligence.

Even models that only output hard labels (not confidence scores) are vulnerable. Decision-based model inversion reconstructs training data by probing the model's decision boundary. The attacker:

• Starts with a random sample from the target class
• Iteratively perturbs it while ensuring it remains classified correctly
• Uses boundary-tilting techniques to walk the sample toward regions of high training data density This exploits the fact that the decision boundary implicitly encodes the distribution of the training data manifold.

The primary defense is Differential Privacy (DP), which provides a mathematical guarantee against membership and property inference. By clipping gradient norms and adding calibrated Gaussian noise during training, DP bounds the influence of any single training sample on the final model. Key parameters:

• Epsilon (ε): Privacy budget; lower values (ε < 1) provide strong privacy but degrade utility
• Delta (δ): Probability of catastrophic privacy failure In federated settings, local differential privacy is applied client-side before gradient transmission, preventing the server from ever observing clean updates.

Architectural defenses limit the amount of training data information encoded in model outputs. Techniques include:

• Dimensionality reduction in the penultimate layer to create an information bottleneck
• Adversarial training where the model is jointly optimized to minimize classification loss while maximizing reconstruction error of an attacker's decoder network
• Dropout and activation pruning during inference to inject stochasticity
• Temperature scaling to flatten confidence scores, reducing the signal-to-noise ratio for gradient-based inversion These methods trade a small amount of accuracy for significant privacy gains.

A mathematical framework providing provable privacy guarantees by injecting calibrated noise into model updates or training data. In the context of model inversion, differential privacy acts as a primary defense by bounding the influence of any single training record on the model's output.

• Epsilon (ε) parameter quantifies the privacy loss budget
• Gaussian mechanism adds noise proportional to query sensitivity
• Directly limits the reconstruction fidelity achievable by inversion attacks

A related privacy attack where the adversary determines whether a specific data record was used in the model's training set. While model inversion reconstructs features, membership inference confirms presence.

• Exploits differences in model confidence between seen and unseen samples
• Often used as a precursor to more sophisticated inversion attacks
• Shadow model training is a common attack methodology

A cryptographic protocol ensuring the central server can only compute the sum of encrypted model updates without inspecting individual client contributions. This prevents an honest-but-curious server from performing inversion on individual gradients.

• Uses secret sharing to mask individual updates
• Protects against gradient leakage attacks
• Critical for cross-device federated learning deployments

A specific class of model inversion attack that reconstructs private training inputs directly from shared gradients in distributed learning. An attacker optimizes dummy inputs to produce gradients matching the observed update.

• Deep Leakage from Gradients (DLG) is a seminal attack method
• Particularly effective on high-dimensional inputs like images and RF spectrograms
• Defenses include gradient compression and perturbation

A model training failure mode where the network memorizes specific training examples rather than learning generalizable patterns. Overfitted models are highly vulnerable to model inversion attacks because their decision boundaries encode detailed information about individual training points.

• Manifests as a large gap between training and validation accuracy
• Regularization techniques like dropout and weight decay serve as mitigations
• Differential privacy training inherently combats overfitting

An attack variant where the adversary infers sensitive attributes of a target individual given partial knowledge of other features and access to the model's predictions. Unlike full reconstruction, this focuses on specific confidential variables.

• Exploits correlations learned by the model between public and private features
• Relevant in healthcare and financial federated learning scenarios
• Countered by fair representation learning and adversarial training