Reducing information dependency does not cause training data privacy. Adversarially non-robust features do.
Authors: Rasmus Torp
Shailen Smith
Adam Breuer
Venue: ICLR 2026 Poster (2026)
Keywords: Privacy
model inversion attacks
extraction attacks
adversarial examples
memorization
training data
causal inference
causality
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We challenge the prevailing view that reducing information dependency (including rote memorization) causes training data privacy under model inversion attacks (MIAs), and we show that instead, adversarially non-robust features do.

Abstract: In this paper, we challenge the prevailing view that information dependency (including rote memorization) drives training data exposure to image reconstruction attacks. We show that extensive exposure can persist without rote memorization and is instead caused by a tunable connection to adversarial robustness. We begin by presenting three surprising results: (1) recent defenses that inhibit reconstruction by Model Inversion Attacks (MIAs), which evaluate leakage under an idealized attacker, do not reduce standard measures of information dependency (HSIC); (2) models that maximally memorize their training datasets remain robust to MIA reconstruction; and (3) models trained without seeing 97% of the training pixels, where recent information-theoretic bounds give arbitrarily strong privacy guarantees under standard assumptions, can still be devastatingly reconstructed by MIA. 

To explain these findings, we provide causal evidence that privacy under MIA arises from what the adversarial examples literature calls "non-robust" features (generalizable but imperceptible and unstable features). We further show that recent MIA defenses obtain their privacy improvements by unintentionally shifting models toward such features. To establish this causal relationship, we introduce **A**n**t**i **A**dversarial **T**raining (**AT-AT**), a training regime that intentionally learns non-robust features to obtain both superior reconstruction defense and higher accuracy than state-of-the-art defenses. Our results revise the prevailing understanding of training data exposure and reveal a new privacy-robustness tradeoff.

Published as a conference paper at ICLR 2026
REDUCING INFORMATION DEPENDENCY DOES NOT CAUSE TRAINING DATA PRIVACY. ADVERSARIALLY ROBUST FEATURES DO.
Rasmus Torp'
Shailen Smith'
Department of Computer Science
Department of Computer Science
Dartmouth College
Dartmouth College
rasmus thomus.torp... wwtpggraaattttu.ee........
shailen. k. smith www.artoouutt..cooooo edu
Adam Breuer
Department of Computer Science & Department of Government
Dartmouth College
adam. www..rreuur@ddrtoutt....
ABSTRACT
In this paper, we challenge the prevailing view that information dependency (including rote memorization) drives training data exposure to image reconstruction attacks. We show that extensive exposure can persist without rote memorization and is instead caused by tunable connection adversarial robustness. We begin by presenting three surprising results: (1) recent reconstruction by Model Inversion Attacks (MIAs), which evaluate leakage under an idealized attacker, do not reduce standard measures of information dependency (HSIC); (2) models that maximally memorize their training datasets remain robust to MIA reconstruction; and (3) models trained without seeing 97% of the training pixels, where recent information-thhorrtiec bounds give arbitrarily strong privacy guarantees under standard assumptions, can still be devastatingly reconstructed by MIA.
defenses that inhibit reconstruction
To explain these findings, we provide causal evidence that privacy under MIA arises from what the adversarial examples literature calls "non-robust" features (generalizable but imperceptible and unstable features). We further show that re- cent MIA defenses obtain their privacy improvements by unintentionally shifting models toward such features. To establish this causal relationship, we introduce Anti Adversarial Training (AT-AT MT), a training regime that intentionally learns non-robust features to obtain both superior reconstruction defense and higher ac- curacy than state-of-the-as defenses. Our results revise the prevailing understand- ing of training data exposure and reveal rrbbacy-oouusiness tradeoff.
INTRODUCTION
foundational goal of contemporary machine learning is learn generalizable model parameters without encoding the private training dataset in a manner that exposes it leakage. However, a rapidly expanding class of practical privacy attacks has demonstrated reconstruction of private training data in variety of learning settings and model architectures. Recent variants of training data privacy attacks apply not only to CNNs (Struppek et al., 2022: Carlini et al., 2022; Mehnaz al., 2022; Yeom al., 2018; Shokri et al., 2017), but also LLMSs (Shi et al., 2024; Nasr al., 2023; Carlini et al., 2021) and diffusion models (Carlini et al., 2023).
Across this attack landscape, model inversion attacks (MIAs) have emerged as mainstream tool for studying and evaluating training data exposure, particularly in the high-resolution image classifica-
Equul contribution.
'Breuer Lab gratefully acknowledges the support of the OpenAT Cybersecurity Grant. Replication code is available htts://github.co wwwpihhhhhcoooH.e.. calelcooo//uaeeeeee http://AiiiAdvvearraalaaaaaae

---

Published as a conference paper at ICLR 2026
tion domain. Unlike more conservative attacks that merely probe for the presence of some exposed training examples, MIAs test the degree to which a powerful attacker armed with white-box model access and significant computational and data resources reconstruct information from the train- ing examples. While early MIAs applied SGD to directly optimize reconstructions of individual training examples (Fredrikson et al., 2015), contemporary MIAs use sophisticated gradient tech- niques and external data to attempt to infer the full set of class-level characteristics for each class in the target model's training data (Qiu et al., 2024; Struppek al., 2022; Haim al., 2022).
However, while MIAs lower-bound the extent to which contemporary vision models expose their training data to reconstruction, they do not explain what aspect of a model encodes this vulnerability, or how to prevent it. This raises a fundamental question:
What properties of learned representations encode vulnerability to training data leakage and reconstruction, and how can they be controlled?
Understanding these properties has far-reaching implications for learning that extend beyond the privacy domain. For example, influential recent work conjectures that obtaining stronger learning performance may require more extensive model-to-traiee toreel--ttrrinnn---ee data dependencies, including rote mem- orization and exposure of the training set, not only for vanilla CNNs (Brown al., 2021; Feldman, 2020), but also for recent paradigms including LLMs (Du et al., 2025; Tirumala et al., 2022), diffu- sion (e.g., Shah al., 2025; Carlini et al., 2023), and self-supervised learning (Wang al., 2024).
The prevailing 'training data information An influential recent line of algorithms has obtained practically performant defenses against high- resolution MIA image reconstruction. Their practical performance is widely attributed to their rea- sonable theoretic hypothesis that training data privacy leakage arises from direct and excessive in- formation dependency between training inputs and the model's internal representations or outputs (Dibbo al., 2024; Peng et al., 2022; Wang et al., 2020). To mitigate this hypothesized dependency, Mutual Information Defense (MID) (Wang et al., 2020) introduces regularizer that reduces mutual information between the training examples and intermediate feature representations, arguing that this "limit[s] the redundant information about the model input contained in the prediction" so that MIAs cannot "exploit this correlation." Building on this idea, the popular BiDO algorithm (Peng et al., 2022) penalizes kernel-based information dependency measure (HSIC) between training examples and intermediate embeddings, arguing that this "limits redundant information propagated from the inputs to the latent representations that can be exploited by the [MIA] adversary."
preendency-ttainning data reconstruction' theory.
The same hypothesis appears again in SCA (Dibbo et al., 2024), which argues that the relevant MIA training data reconstruction vulnerability is reduced by directly "jettison(ing] unnecessary private information in the input image," c.g. by sparse-coding training images before they are seen by the model, and by also "jettison[ingl... unnecessary private information from downstream layers" to attempt to preclude high-fidelity memorization of the inputs, rather than disincentivizing it via the loss function as in Peng et al. (2022) and Wang et al. (2020).
Similarly, the highly performant Transfer Learning (TL-DMI) approach (Ho et al., 2024) advances a main hypothesis that "by reducing the number of parameters fine-tuned with private dataset, [TL-- DMI] could reduce the amount of private information encoded in the model, making it more difficult for adversaries to reconstruct private training data." " This hypothesis is widely credited with the strong practical performance of TL-DMI, an approach that uses training data only for fine-tuning.
In sum, state-of-the-art privacy defenses advance a shared and intuitively reasonable theoretic argu- ment: they argue that they increase the generic privacy of their training data by reducing information dependency between training examples and the target model's s internal representations or outputs.
Our contribution I: Challenging the theoretic bases of MIA defenses.
In this paper, we challenge this foundational hypothesis. Specifically, we motivate our techniques by first presenting three surprising experiments that indicate that the information dependency view is inadequate to explain MIA reconstruction vulnerability:
1. We show that recent defenses that successfully inhibit reconstruction by MIAs do not reduce the approximation of information dependency, HSIC, used in MIA research. In fact, when we modify defenses such that they do reduce HSIC, they cease provide effective reconstruction defense.
2

---

Published as a conference paper at ICLR 2026
2. We train models to perfectly rote-memorize the training data such that their data-to-model infor- mation dependencies are intuitively maximal (at least in one intuitive view of dependency), yet we show that such
cenffommation-deeeddeee models are robust to MIA reconstructions.
3. We train models without seeing >97% of each training image's pixels, such that information de- pendencies minimal (at least in one intuitive view of dependency). Recent information -hhoorreticc bounds give these >97% pixels arbitrarily strong privacy guarantees under standard assumptions. Yet, we show that this training data can still be devastatingly reconstructed in practice: deleting >97% of the training data yields no significant privacy increase against MIA reconstruction.
In sum, our motivating experiments formally show that the main theoretic approach in privacy/MIA defense is incorrect: reducing information dependency does not cause privacy as widely believed. SOTA defenses thus obtain their impressive performance by different theoretic mechanism.
Our contribution II: The privacy-robustees feature tradeoff.
To explain these results, we provide evidence that privacy under MIA arises instead from what the adversarial examples literature calls "non-robust" features (generalizable but imperceptible and unstable features), and recent MIA defenses obtain their privacy improvements by unintentionally shifting models toward such features. To accomplish this, we conduct the first systematic evalua- tion of the robustness privacy/MIA defenses to adversarial examples (Szegedy et al., 2014; 4; Ilyas et al., 2019). We find that all recent defenses that attempt to reduce information dependency (MID, BiDO, TL-DMI) obtain a reduction in privacy leakage under MIA that is directly proportional to a corresponding increase in their vulnerability adversarial examples.
We then explicitly test our hypothesis that these defenses' privacy leakage reduction (measured by AttAcc@ under PPA IF-GMI attacks) is linear function of their robust accuracy (or, equiva- lently, a linear function of their reliance on non-robust features). We find that we can almost perfectly predict each of these defenses' MIA robustness via simple linear function of their vulnerability to adversarial examples 0R95.. As such, we can compute the adversarial robustness cost of MIA privacy gain. For example, reducing MIA leakage by percentage point corresponds cally significant 0.31-5.4 percentage point decrease in robust accuracy, depending on the magnitude of the adversarial example chosen, where MIA leakage is measured via the standard AttAcc metric using a standard PPA attack.
statisti-
As such, MIA defenses unintentionally make a tradeoff: by shifting towards non-robust features, they increase privacy by stripping semantically meaningful information from the model, but this opens significant new vulnerabilities adversarial examples.
Our contribution III: Anti-Adversarial Training (AT-AT M))
If recent privacy/MIA defenses appear to work by unintentionally 'nonrobustifying" the model's feature space, then it stands to reason that we can causally induce superior defense performance by deliberately exploiting this mechanism. To establish this causal relationship, we introduce Anti Adversarial Training (AT-AT MT), a novel generic privacy/MIA defense training regime that bal- ances model accuracy with gradient steps that reverse standard adversarial training (Madry et al., 2017). Rather than promoting robustness to adversarial perturbations, AT-AT applies targeted gra- dient updates that suppress reliance on robust features. This compels the model to instead learn non-robust (but still generalizable) features that semantically meaningless to humans and thereby hinder visual reconstruction under MIA.
In a causal framework, we show that 'treating' standard ResNet- 152 with AT-AT's non-robust feature reward causes a reduction in reconstruction rate (AttAcc@1 1) from 84% to 6.5% (p<10-19).
We then show that our anti-aaversarial approach obtains superior MIA defense at higher levels of accuracy than baselines across the standard architectures, datasets, and reconstruction metrics the high-resolution MIA domain. As with other generic defenses, AT-AT's performance comes the cost of increased vulnerability to adversarial examples. However, in our case, this vulnerability cost a tunable parameter, offering a new design axis for private models.
Implications for private learning. Our results have four implications. First, among the most celebrated results in ML is the finding that adversarial examples do not reveal bugs, but rather non- robust features that are generalizable and discriminatory of the classes we want to learn, yet visually imperceptible humans (Ilyas et al., 2019). Our argument in this paper is that these properties
3

---

Published as a conference paper at ICLR 2026
make them ideal instruments for privacy- prreeccpreeeeiiing learning, where our goal is to classify accurately without encoding visually meaningful information that is vulnerable to visual reconstructions.
Second, eliminating training data information dependency does not guarantee privacy, as leakage can persist in its absence. Indeed, if recent work on learning performance is correct in suggesting that dependencies up and including rote memorization can confer accuracy benefits, then such benefits may be attainable without incurring all of the privacy risks is widely assumed to entail.
On the other hand, our results corroborate the recent idea that there may be inherent privacy vulnerability associated with robust learned representations. As such, robust models may be inher- ently privacy compromising, beyond any specific aspects of how they encode data. This intuition is consistent with recent works analyzing connections between privacy and robustness (see App. F.2).
Finally, our results suggest that the assumptions of recent theoretical privacy guarantees may be optimistic, rendering their protections practically inapplicable against recent MIAs.
EXPERIMENTAL SETUP, SCOPE, AND REPLICATION
The experiments throughout this paper focus on the white-box high-resolution vision setting that is central to contemporary empirical privacy and MIA research (see App. C for further scope de- tails). Specifically, our experiments evaluate the facial recognition setting the standard hi-res image MIA benchmark datasets (FaceScrub (Ng & Winkler, 2014), CelebA (Liu et al., 2015)) under the established benchmarks for hi-res white-box attacks (PPA (Struppek et al., 2022), plus recent, nigh-performance IF-GMI (Qiu et al., 2024) and PPDG (Peng et al., 2024)), on the standard high- resolution image architectures (ResNet-152, ResNet-18, DenseNet-169) that are the focus of recent experiments in the literature (Struppek et al., 2022; Qiu et al., 2024; Struppek et al., 2024; Ho et al., 2024: Koh et al., 2024; Liu Chen, 2024; Peng et al., 2022). Section 4 adds robustmess metries from four SOTA ad adversarial example attacks (Croce& & Hein, 2020a;b; Andriushchenko et al., 2020), each under various attack strengths c. App. F.3 gives experimental details for adversarial attacks. In App. I (Table 26b) we also consider an extra Stanford Dogs dataset ( (Khosla et al., 2011) for variety.
Defense Baselines: generic information defenses and gradient-suppressing defenses. As dis- cussed above, our main focus is on class of state-of-the-art generic defenses that seek to hinder re- construction via private information reduction. This includes MID (Wang et al., 2020), BiDO (Peng et al.. 2022), and the recent TL-DMI (Ho et al., 2024). For the sake of comparison. four main recent attack gradient suppressing MIA defenses, NegLS (Struppek et al., 2024), RoLSS, RoLSS-SSF (Koh et al., 2024), Trap-MIID (Liu & Chen, 2024). These defenses do not seek generic privacy, but rather seek to inhibit the gradient steps taken by modern MIAs during their optimization stages. See App. A for experimental details of target models, datasets, and defense baselines.
also add
Privacy Metrics. As in recent work, we measure privacy leakage via the main Attack Acc@) metric, which reports the accuracy of an external Inception-v3 model at guessing the identity of the attacker's s reconstructed image as its #1 guess. Where appropriate, we also report the similar Attack 5 metrie; L2-FaceNet Distance (the minimum fg-norm FaceNet embedding distance between the attacker's 's reconstruction and any training image in the attacked class); and the Average Evaluation Confidence of the external Inception-v3 model that the reconstructed image is from the respective original image's 's class. We also show qualitative reconstruction comparisons.
This yields 7 defenses x3 attacksx3 architecturesx3 3 datasets x (4 robustness+4 privacy metrics).
Replication code. https///gituub.co/BBreee aatss/Anii-AAdvesrriaaaiiiiiiii
Full replication codes for all experiments are available at
3 THREE EXPERIMENTE OVERTURN THE DEPENDENCY -> LEAKAGE VIEW
If training data exposure to MIA were explained by information deperneencl/memorization, then three intuitive hypotheses would hold: (1) Effective defenses would reduce information dependency metrics; (2) Models that fully rote-memorize the training data would be vulnerable to MIA; (3) Models trained without seeing 97.5% of each training image's 's pixels (i.e. where memorization is upper bounded at 2.5%) would be robust to MIA reconstruction. Our goal in this section is to show
4

---

Published as a conference paper at ICLR 2026
Table 1: HSIC(X, for defenses FaceScrub (ResNet-152). PPA AttAcc measures reconstruction.
Arch. Defense
TestAcct
AtlAcc@11 I1 HSIC(X, Zo)
HSICTX, Z1)
HISCCX, 22)
HSIC(X, 23)
NoDef
0.958
0.882
71.66
72.32
72.72
72.72
MID
0.950
0.391
71.52
72.57
72.84
61.98
ResNet-115 152
BiDO
0.928
0.780
73.68
73.68
73.68
73.63
TL-DMI
0.911
0.190
71.73
72.52
72.93
72.58
NegLS
0.906
0.160
71.64
72.33
72.29
73.63
RoLSS
0.886
0.474
72.09
72.30
29.69
61.92
Rol RoLSS-SSF
0.869
0.343
71.88
72.02
32.75
64.94
Trap-MID
0.926
0.401
69.80
71.88
72.62
69.28
0.940
0.815
2.159
1,256
9.310
71.81
experimentally that each of these hypotheses is false. Thus, the prevailing view that information dependency drives training data exposure to reconstruction is incomplete.
1. Effective defenses do not reduce information dependency metrics. First, we show that contem- porary defenses that are widely believed to work by reducing training-data-to- data--t--tttdeee dependency do not in fact reduce this dependency, and may in fact increase in some cases even according their own metrics. In the defense literature, the Hilbert-Schmidt Independence Criterion (HSIC) (Gretton al., 2005) is the standard dependency metric that can be computed for arbitrary model. De- fenses such as BiDO and BiDO+ (Peng et al., 2022; 2025) explicitly penalize (approximated) HSIC between inputs X and intermediate embeddings Zy:
HSIC(X, 2,) - [[([(X))( --
Where nonlinear feature transformations Φ, to are created such that ((X), (b(z,) are members of reproducing kernel Hilbert spaces, and 11 denotes the Hilbert-Schmidt norm.
We train all defenses described in Section then measure their average HSIC across the train at all standard intermediate embeddings Z; using the exact HSIC implementation from Peng et al. (2022). We then run standard PPA attacks test their leakage (AttAco@) @ 1) under MIA.
reports results (also see the additional results in App. D). Neither BiDO nor the defenses TL-DMI and NegLS that obtain the largest reductions in reconstruction (AttAcc @ 1) significantly decrease HSIC(X, Zz) according to the standard HSIC approximation used MIA.
HSIC Results: reducing HSIC does not cause privacy. Table
BiDO also allows users to directly manipulate the weight A on HSIC in its loss. We use this to experimentally lower HSIC by training a BiDO** model with a different A (see App. D.1). This experimental * 'HSIC treatment' model succeeds in lowering HSIC(X, Z,) compared to standard BiDO parameters, indicating significantly reduced information dependency, yet it obtains worse defense. In sum, reducing HSIC measured in MIA does not cause privacy under MIA.
model that fully rote-memorizes the dataset is not vulnerable to re- construction. Second, if training-dee -ata- to-model information dependency drives leakage, then a model that maximally memorizes should be maximally vulnera- ble. The seminal permuted-label setting of Zhang et al. (2017) provides clean test of this hypothesis: when training labels randomized, networks are known to achieve perfect training accuracy by rote- memoriznnn the entire training dataset without learning any meaningful features. Table 2 shows that MIAs completely fail this setting: reconstructions collapse, yielding high 1.2 reconstruction distance (note that other standard metries such AttAcc@) are not dell-defined in the permuted setting). Despite full rote memoriza- tion. leakage is minimal. This suggests that leakage is not driven by rote training data information dependency, but rather by some other property. See App. A.3.1 I for further details.
Table 2: results with and without label permutation.
Arch.
Labels
TrainAce
TestAce + L2-Face f
Not permuted
1.000
0.958
0.768
RN-152
Permuted
0.996
0.001
1.249
Not permuted
1.000
0.950
0.781
RN-18
Permuted
0.994
0.001
1.251
3. Unseen training data can still be reconstructed under MIA, contra recent theoretic bounds. Third, information dependennyymmemorizzioon drives privacy leakage then deleting the training data would prevent leakage (notwithstanding the effect accuracy). However, that models trained without seeing >97% the training data pixels, for which recent information- theoretic privacy results give arbitrarily large bounds against reconstruction under standard assump-
show
5

---

Published as a conference paper at ICLR 2026
Table 3: Unseen-Pixcll trained FaceScrub obtains very limited defense against reconstruction by PPA.
Arch.
Defense
Pix--deleted TestAce
AttAcc@1
AtfAccØ55
L2-Face
EvalConf
RN-18 RN-152
NoDet
0.958
0.881
0.982
0.781
0.859
NolDef-FarlyStop
0
0.917
0.634
0.875
0.852
0.607
TL-DMI
0
0.911
0.163
0.398
1.072
0.152
Unseen-Pixed
97.8
0.910
0.592
0.851
0.819
0.566
NoDef
0.950
0.903
0.985
0.778
0.884
NoDef-EarlyStop
0.890
0.620
0.877
0.840
0.596
TL-DMI
0
0.906
0.219
0.487
1.031
0.206
Unseen-Pixed
97.2
0.892
0.546
0.813
0.844
0.522
tions, can still be devastatingly reconstructed by MIAs. We construct a novel basso-based technique that deletes over 97% of the pixels in each training image prior to training (so they are completely unseen by the model), yet allows us to train models with test accuracy that is within a few points of the accuracy of vanilla model trained on uncensored images. Fig. 1 shows examples of pixel- deleted images used for training. App. E.2 describes our deletion technique.
Unseen pixel leakage is theoretically impossible under standard unbiasedness assumptions. A recent stream of theory research seeks information-theorrti privacy guarantees against image training data reconstruction by Lower-boundigg the variance of any unbiased estimator of the train set via, e.g., the Cramér- Rao bound and Fisher Information Loss (Hannun et al., 2021; ; Guo et al., 2022), the HCR bound (Guo et al., 2022; Chaudhuri et al., 2024). Interestingly, in the same unbiased estimator setting, our model trained on >97% pixel-deleted data enjoys perfect privacy guarantee (unbounded reconstruction variance) on these >97% deleted pixels (see App. E.3).
>97% Unseen-Pixels experiment. Table 3 compares PPA reconstructions on models trained on the >97% pixel-deleted training dataset versus various models trained the uncensored data, in- cluding a vanilla undefended model (NoDef) and SOTA MIA defense (TL-DMI). We also com- pare against an undefended model trained with accuracy comparable to our Unseen-Pixel model's accuracy, which is motivated by the common observation that less accurate models are naturally more robust to MIAs (see Struppek et (2024))-
to provide an extra baseline with
Inseen-Pixels results. Surprisingly, deleting >97% of the pixels before training fails to prevent MIA reconstructions. Table shows that PPA attacks on the Unseen-Pixels model still obtain reconstructions that are classified as their origi- class 550 of the time (per AttAcc@ 1). For compari- son, that means the Unseen-Pixels model trained on >97% censored data not significantly more private than an unde- fended model with about the same accuracy that is trained on uncensored data. More specifically,, is only marginally more private in terms of AttAcc@ 1, and marginally less private in terms of the L2 metric on RN-152. See addl. results in App. E. This also suggests that the assumptions of recent privacy bounds are overly optimistic, rendering their protections prac- tically inapplicable against recent attacks (see App. E.3).
Original Image
Pix-Deleted
MIA Resalt
Figure 1: Orig. & dixet-deleted im- ages (zoom in for 2.2% training pixels).
4 THE PRIVACY-ADVERSARUE EXAMPLE ROBUSTNESS TRADEOFF
Our goal in this section is to describe previously unobserved privacy-adversafy example robust- ness tradeoff that characterizes the performance of generic information dependency-based MIA de- fenses on the main architectures and datasets used to benchmark hi-res privacy attacks/defenses in recent work. We show that the defense performance obtained by the class of defenses widely be- lieved to work via information dependency reduction highly correlated with vulnerability to adver- sarial examples and non-robust feature bases. We accomplish this by presenting the first systematic tests of the robustness of MIA defenses to a very different attack vector: adversarial examples.
Tradeoff experiment setup. Following seminal work by Carlini al. (2019); Croce & Hein (2020b) and others, a scholarly consensus has emerged regarding the design principles necessary to ensure the rigor of experiments that measure robustness adversarial examples. We carefully

---

Published as a conference paper at ICLR 2026
Table 4: Leakage (AttAcc @ 1) clean/rroust accuracies under AutoAttack for various
Data Arch.
Defense
PPA-AttAcc@1 IF-AttAcc@1 TestAce
0.0311
0.0025
0.0005
10
Defenses that attempt to increase privacy generically by reducing information dependencymmmmoriaati
NoDEl
0.882
0.955
0.000
0.122
FaceScrub
RN-152
MID
BiDO
0.780
0.391
0.391
0.937
0.928
0,950
0.000
0.000
0.121
0.006
0,847
0.770
0,923
0.925
TL-DDM
0.190
0.420
0.911
0.000
0.000
0.000
U.867
NoDef
0.901
0.983
0,950
0.000
0.194
0.896
0.959
RN-18
MID
0.714
0.776
0.921
0.000
0.093
0.825
0,856
0.530
0.782
0,884
0.000
0.075
0.784
0.879
TL-DMI
0.240
0.515
0.906
0.000
0.000
0.003
81886
NoDel
0.497
0,838
0.000
0.050
0.675
0.8
MID
0.474
0.728
0.802
0.004
0.139
0.542
U.574
RN-152
BiDO
0.362
0.747
0.000
0.062
0.748
Celeb
TL-DMI
0.080
0.258
0,688
0.000
0.000
0.002
0.6-11
TL-DMI-5
0.281
0.661
0,814
0.000
0.000
0.119
0.799
NoDef
0.634
0.913
0.859
0.000
0.084
0.746
0
MID
0.386
0.550
0.737
0.003
0.168
0.452
0.464
RN- 18
BIDO
0.146
0.368
0.625
0.000
0.007
0.394
0,009
TL-DMI
0.153
0.439
0.752
0.000
0.000
0.028
TL-DMI-5
0.324
0.750
0.831
0.000
0.000
0.146
U.802
Defenses that suppress attack grudients
NegLS
0.160
0.147
0.906
0.000
0.048
0.769
0.905
RoLSS
0.474
0.522
0,886
0.000
0.009
0.744
0.882
FaceScrub
RN-152
Rol SS-
0.343
0.373
0.869
0.000
0.013
0.721
0.857
Trap-MID
0.401
0.000
0.000
0.000
N
0.649
0.932
0.929
0.000
0.215
0.854
RoLSS
0.858
0.979
0,950
0.000
0.002
0.819
0.945
RN-18
RoLSS-SSF
0.849
0.973
0,950
0.000
0.002
0.813
0,951
Trap-MID
0.735
0.918
0.928
0.000
0.000
0.530
0.914
NogLS
0.310
0.534
0.803
0.000
0.013
0.559
0.771
Celeb
RN-15-
RoLSS-SSF
RoLSS
0.039
0.046
0.044
0.045
0.428
0.537
0.000
0.000
0.000
0.000
0.086
0.042
0.530
0.406
Trap-MID
0.330
0.417
0,848
0.000
0.000
0.333
NegLS
0.667
0.953
0,538
0.000
0.100
0.711
RoLSS
0.506
0.724
0.830
0.000
0.069
0.701
0.813
RN-18
SSSS
0.519
0.000
0.080
0.723
Trap-MID
0.442
0.670
0.830
0.000
0.044
0.685
0.827
follow these design principles here (see App. F.I and F3). We report robust accuracy, i.e.,
worst-case accuracy adversarial examples across all four attacks in the standard AutoAttack ensemble (Croce Hein, 2020b): untargeted Auto-PGD; targeted DLR Auto-PGD (Croce & Hein, 2020b); targeted FAB (Croce & Hein, 2020a); and Square (Andriushchenko al., 2020). We find that all defenses have 0% robust accuracy under AutoAttack with default c=0.031 (=8/255), rendering comparisons uninformative. Thus we recompute attacks with a range of smaller perturbations: e (0.031, 0.0025, 0.0005, 10 10-5). This evaluates defenses' unintentional reliance on imperceptible 'non-robust features' of different magnitudes. App. F33 gives details.
Tradeoff raw results & estimating the privacy- adversarial robustness tradeoff. Table 4 presents re- sults, and Tables 11, 12, 13, in App. F.4 also report robust accuracies under each of AutoAttack's 's constituent attacks. Note that for all generic privacy defenses (MID, BiDO, TL-DMI,, less privacy leakage (lower AttAcc@) I) corresponds to worse robust accuracy under AutoAAtack (Table 4), particularly with smaller To obtain a princi- pled test of this tradeoff, we estimate OLS linear regres- sions of the following form. This allows itly test our hypothesis that these defenses" privacy leak- age reduction (AttAcc@) I under PPA or IF-GMI) a lin- ear function of their robust accuracy (or. equivalently, linear function of their reliance on non-robust features). We include clean test accuracy in the regression, as it has been widely observed that more accurate models leak more (Struppek et al., 2024; Ho al., 2024; Liu & Chen, 2024);
10
FaceScrub
NoDe
Observed taalage (ABAAcci9))
ResNet-152
BATO
0.7
ResNet-18
NIO
o.s
NoDa
NID
BIDO
0.4
NiD
0.3
BIDO
explic-
TL-ONI-S
TL-DNI
TL-Dom
R1 0.952
RMSE 0.050
BiDG
0.0
0.1 02 Predictad laakage (ABAAc
0.9 only
Figure 2: Obs. vs. Pred. leakage (PPA), pred. only via robust acc. weights.
Leakage A 1, = + TestAcc, 10 SLAC eytey (1)

---

Published as a conference paper at ICLR 2026
Specification Invariance. To explore the stability of results, we careful to also estimate a total of 56 various specifications of this OLS model that explore alternate hypotheses, including alternative Beta regression variants with appropriate distributional assumptions and logit link (g(x)) to capture the fact that the response (AttAcc@1 under PPA or IF-GMI) is bounded in [0, 1]:
Lea LeakageAuscc@r Bela(uy0, (1 - 15))))
s(wz) B1 TestAccy++53 Acc, 0.0,00 j+ +Bg 0.0000 +B4 A00
Results. Fig. 2 plots fit and Table 5 presents a small selection of results (see App. G). We find that (1) leak- age (AttAcc@1 1 under both PPA vs. IF- GMI) is strongly and significantly corre- lated with robust accuracy at all levels of e (note 95% CT), with R2=00.93-0 mean abs. error of just 0.042-0.05. Con- trary to widespread belief, (2) clean test accuracy is only weakly or insignificuntly correlated with leakage after controlling
Table 5: OLS & Beta leakage (PPA AttAcc@ 1) regressions
+95% CI. OLS CIs use small-sample 10.978,13=22 12=2.110 160 with HC2 SEs; Beta uses Wald (+1.96EE) on the logit scale.
OLS 95% CT)
Beta (1 95% CTj
Test Acc.
-0.011 + 11.03
-0.192
0.000
2.299 1.596
12.827 = 3.939
and
0.0000
0.211 + 0.234
0.737 + 0.637
1-100
0.795 = 0,778
4.390 = 2.312
R
0.934 (adj.)
0.952 (pseudo) 0.042
MAE
0.047
for robust accuracy. Thus, at a high level, we almost perfectly predict defense's leakage just from knowing its robust accuracy (Fig. 2), and knowing its clean accuracy adds little to no addi- tional information that improves this prediction. Finally, as we hypothesized, this privacy-robustnes tradeoff does not hold for gradient-suppressing defenses, which (as expected) instead achieve their defense by various other means. Our results hold across all 56 OLS and Beta models, which show they are invariant to specification, PPA and IF-GMI attacks, different distributional assumptions, controls for dataset/architeectue,, various robust standard errors estimators, etc. App. G gives details.
The robustness cost of privacy gain. We can use these linear models to compute the cost of privacy. Per the Beta model, reducing PPA leakage (AttAce@) 1) by 1 percentage point (pp) corresponds to a significant 0.31 pp decrease in AutoAttack robust accuracy at e=0.0025, (95% CI: 0.24-0.45), significant 5.4 pp decrease at c=0.0005 (95% CI: 2.9-58.3), and a significant 0.91 pp decrease at c=10- (95% Cl: 0.60-1.93). These results highlight that form: the largest and mmaniust- non-robust features experience small but significant costs, while the 'medium" e0000 magnitude experiences disproportionately large and unstable costs.
tradeoffs are nonuni-
These results provide evidence that non-robust features were unknowingly correlated with privacy. Can non- non-robust features cause privacy through deliberate algorithmic design?
5 ANTI ADVERSARIAL TRAINING (AT-AT) MF
We now show how to exploit this mechanism to causally induce superior defense at higher accu- racy. To establish this causal relationship, we describe Anti Adversarial Training (AT-AT fir), a novel privacy/MIA defense training regime that balances model accuracy with gradient steps that reverse standard adversarial training. These steps allow us to causally 'treat' the learned feature ba- sis by intentionally shifting it towards non-robust (but still generalizable) features that are visually imperceptible to humans and thus unamenable to visual reconstruction under MIA.
For intuition, suppose that given iteration of SGD, we draw an image TYoda of class yoda..
Vanilla Training. Vanilla loss: ming E(g.y))~ [C(0, x, y)] just rewards accurate mappings clean images: Woda Yoda. It is well-known that this approach learns both robust and non-robust features.
Classic Adversarial Training (AT). Classic AT (Madry et al., 2017) replaces each clean training example z in the SGD-loop with the untargeted adversarial perturbation + ö that is most likely to flip the z's ss classified label. The AT loss function, maxses C(O, x + 6, v). then treats features that robust this perturbation as the 'signal' we seek to learn. For example, perturbation 8 might flip Yoda into Luke, i.e., (Ø + 5Luke) + L/=Lukk-/Yee Yoda. AT rewards learning Yoda features that robust to 8, i.e., rewards (Iyoda d - Yoda, and penalizes features in d that are non-robust.
Anti Adversarial Training (AT-AT n... At a high level, our goal is the opposite: AT-AT uses loss term that treats the visually meaningful image x the 'random noise' we seek to ignore,
8

---

Published as a conference paper at ICLR 2026
'non-robust' features exposed in perturbation ó the "sig- nal' we seek to learn. Thus, compared to classic AT, we optimize for the opposite mapping: (T + LLuee. More formally, seek minses [(0, z + 6, y'), where y # y. However, as a practical matter, it is infeasible to obtain competitive accuracy for challenging learning tasks like hi-res facial recognition using only non-robust features. Thus, adopt dual loss function that balances vanilla accuracy (incl. robust features) with non-robust features via user-chosen A:
and the heaprrcpppible--bb--eeeeeaaaiiie
AT-AT Objective: min ((..))>D(L((
A min L(0, x + o, y')] where y' # 4y óES
This AT-AT loss can be optimized similarly to a targeted variant of vanilla AT, Each SGD iteration draws train- ing image z and a target class y each U.RR. It then computes targeted adversarial perturbation ó (via, e.g., PGD) that causes the current training model M, to clas- sify z not as y, but as y', e.g.. "(ZYoda + L + Luke." Finally, it sums vanilla loss on y and anti-adversarial loss on y' The latter penalizes robust features in æ and re- wards non-robust ones exposed by perturbation 6.
Anti-Adversarial Training (AT-AT) MA
input Data D, Model M( for (x, y) E D do
vf Uniform (C Cyy)
Fadv
min
(2','' v/) PGD
x''x|llo
L x (a) + A La v')
vanilla VoLL
anti-adv.
0 return M
Causal effect of AT-AT loss term on privacy. We train 10 RN-152's on FaceScrub and randomly assign half 'control' x=0 (equal to Vanilla/NoDef) and half as 'treatment" A>0. Beta regression of AttAco@ on treatment shows that AT-AT's non-robust term causes reduction in reconstruction rate (PPA AttAcc@ 1) from 84% to 6.5% (a 77x reduction in leakage odds, p<10-16 ==38.0). See App. H.
EXPERIMENTS: AT-AT VS. GENERIC & GRADIENT DEFENSES
Our goal this section is show that AT-AT obtains superior reconstruction defense at higher accuracy versus both generic and gradient-suppene suppressing defenses. Fig. 4 on the following page compares AT-AT (red puints) to baselines in terms accuracy and privacy across all datasets under PPA, IF-GMI, and PPDG inversion attacks via all privacy metrics on ResNet-152.
Across all privacy metrics, data, and attacks, AT-AT obtains superior privacy higher levels of accuracy than the state-of-the-art baselines. In addition to Fig. 4 below, include full additional results on DenseNet-166 and ResNet-18 in App. L.2. We also provide full tables with confidence intervals in App. L.3. To demonstrate robustness across domains, we also report results the Stanford Dogs dataset in Table 26.
CONCLUSION
We present converging correlational and causal evidence that reducing information dependency (in- cluding rote memorization) does not cause training data privacy under MIAs, whereas adversarially non-robust features do. This result overtumss dominant assumption in MIA and privacy literature. We describe AT-AT, a novel training regime that deliberately learns non-robust features to obtain superior MIA defense, While our scope limited to hi-res image classification, our results raise timely questions of whether diffusion, where memorization is similarly thought to drive privacy vulnerabilities.
tradeoffs generalize to paradigms such as LLMs and
REPRODUCIBILITY STATEMENT
Our experiments were designed from the outset to be replicated. Full pushbutton cluster-ready repli- cation codes are available from our lab's GitHub https://githu..com/// httpaaua...ooeeeeaaaaeeeeeee Talhs/Annt-Avvesariia Training. All MIAs, MIA defense baselines, and adversarial example attacks were computed using their authors' code and identical parameters, except where explicitly noted in our paper (e.g., our additional BiDO parameter-tunce variants, which report with the exact parameter used be- low, alongside where we report the BiDO version that we ran with the authors' original parameters). Further experiment and replication details are provided in App. A.
Our code also provides a suite tools designed so that researchers can easily apply our experimental setups, evaluations, attacks, and defenses their research.

---

Published as a conference paper at ICLR 2026
Original
NoDef
BiDo
Htl SS
ROLSS
NeeLS
Figure 3: PPA reconstructions on ResNet- 152. Images selected via max EvalConf. Full results in Fig. 6.
AttAcc
GeebA
FaseScrub
Celen4
Panofterbb
0.-
RC-AT
5100
0.-
NoCef
8000
Trap MRD
1.0
0.-
Tap-MID
so
ND
Noter
Neg15
0.0
RoLSS
AT-AT
0.0
NoDel
Privacy lealage: L2 dietance
AttAce
800
A1-22
-01-2
ReLSo
Trpp-WD
BS-4
1.2
RoLes
HegLa
Negiu
Rot 80 05F
1.
5100
TL-011
ReglU
8100
AT-A1
0.0
67-47
0.5
Roll SGFF
0.6
Pouss
Tu-cM
Negi--
NoDet
TL-001
0.5
MDD:
Regt8-
Trap-A00
MDD.
D0Ld
5100
0.-
201
R51S5
TL-Clt
Th -1-
XT:al
A1-AT
TL-ONI
6.-
hobelt
NoDe!
0.6
08 3:1 03 0.3
04
05
05 07 Dá 64 1. ae 61 04 03 94 05 0.6 0J 06 0. 1.5
Test accuracy (clean)
Test accuracy (clean)
AttAcc@6
Avg. evaluation model confidence
PaceBerub
FaceBorub
1.0
NoGel
1.0
0.-
Rouss
677
Hegis
Top MD
0.7
ReLSa
8A
0.4
000
Tra--6D
TC-0
0.2
Privacy Iaaloge: Avg. neelluatton model contidaace
Trap-MD
[o6.50 55P
Hoo
NegL:
AT-AT
1.0
Hope
B00
1.0
NeOw
0.5
Begls
Tup-UDD
8.-
0.7
Trap-ORD
0.5
MB0
MayLs
MD-A
Trp-MD
RoLoc Mo..o--00
a7:42
6.1
110-5--31
0.1
Poil 001.00-00
BoL:5
A1-A7
1.0
Rabel
8.0
8.7-
Uo
0.-
McDet
D044
ReASB
84-
0.4
Trap-M
Tap-MD
0.3
TL-O88-5
TL-OMI
8.1
0.1
ReLSo
HegLi
30 01 22 04 05 da 09 50 01 02 05 04 66 08 07
0.0 0. 1.0
08 02 03
05 de 04 89 8D 03 02 0. 04 25 08 Test accuracy (clean)
0. 69 1.0
Test accuracy (cleen)
Figure 4: AT-AT vs Baselines on 1N-152: Top: AttAAc@ & L2 Distance; Bottom: AttAcc@5 & EvalConf.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Martín Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318, October 2016. doi: 10. 11152976749.2978811 [cs, stat].
www.:orgg.bbb//.....ooo....... 607 00133. arXiv:1607.00133
Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. MIRROR: Model Inversion for Deep Learning Network with High Fi- delity. In Proceedings 2022 Network and Distributed System Security Symposium, San Diego, CA, USA, 2022. Internet Society. doi: 10.14722/ndss 215722//ndss2202222333333 2022.24335.
URL https://vni ndss - lesss-sympsiimm wwwpppppw.....ooppppopoooooopm http:///ocoooeettuuladadaldeeeda httpploodd//222-a-a222 prapapaaaa/222------ppp..p-.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square Attack: a query-efficient black-box adversarial attack via random search, July 2020. URL http:// http://xxxvv..gg/.e///
1912. 00049. arXiv:1912.0004: [cs].
Franziska Boenisch, Philip Sperl, and Konstantin Böttinger. Gradient Masking and the Un- derestimated Robustness Threats of Differential Privacy in Deep Learning, May 2021. URL
http://arxiv org/aaaaoo abs/ 2200.111.... 07985. arXiv:2105.07985 [es].
Vadim Borisov, Johannes Haug, and Gjergji Kasneci. CancelOut: Layer for Feature Selection in Deep Neural Networks. In Igor V. Tetko, Véra Kürková, Pavel Karpov, and Fabian Theis (eds.),
Artificial Neural Networks and Machine Learning- - ICANN 2019: Deep Learning, volume 11728, pp. 72-83. Springer International Publishing, Cham, 2019. ISBN 978-3-030-30483-6 978-3-030- 30484-3. doi:
URL http: / /link.i....... springer. com/10. 6. Series Title: Lecture Notes in Computer Science.
Gavin Brown, Mark Bun, Vitaly Feldman, Adam Smith, and Kunal Talwar. When is memorization of irrelevant training data necessary for high-accuracy lcarning? In Proceedings of the 53rd Annual
ACM SIGACT Symposium Theory of Computing, pp. 123-132, Virtual Italy, June 2021. ACM. URL https: ///l///////////// acm. org/
ISBN 978-1 978-1-4503-8853-9, doi: 10. 241144/3400325.3551111 1111111111/1101333011 31144//330032534551133333 3451131.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On Evaluating Adversarial Ro- bustness, February 2019. URL /aaxivv wwwg abs//////// 1902. 06705. arXiv:1902.06705 [cs].
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raf- fel. Extracting training data from large language models. In 30th USENIX Security Sympo- sium (USENIX Security 21), pp. 939133-24-3. URL httpt: //t::///wwwwww isseix.... org/ htr/ccoffeee cooofffeeneeeeeeeee usen wtwpuuseeissisiylllsee
USENIX Association, August 2021. ISBN 978-1-
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Mem- bership Inference Attacks From First Principles. In 2022 IEEE Symposium on Security and Pri- vicy (SP), pp. 1897-1914, May 2022. doi: 10. 00.119996442244.2222933334 //ieeexplore. i eeee. wttg//asttacc////ooo/oo// wwt.t/aattttttcct.tt/ooo/mmmcctt / 98.3649.
URL https: ISSN: 2375-1207.
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting Training Data from Diffusson Models, January 2023. URL http: / /aaxiv.vvvv..////////aaa///aavvv org/ abs///////// 3001. 10000..11 13186. arXiv:2301. 10..2.13111181 13188 [cs].
Kamalika Chaudhuri, Chuan Guo, Laurens van der Maaten, Saeed Mahloujifar, and Mark Tygert. Guarantees of confidentiality via wawemnerlle--haaama---- http://arxiv. org/ abs 244 02866. arXiv:2404.02866 [cs].
bounds, June 2024. URL.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-Emin Enrichhd Distributional Model Inversion Attacks. In 202/ IEEE/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada, October 2021. IEEE, doi: 10. 1099/ccv48922.201.011337 URL https:
//i //ieeexplore. feee .rg.e.org//eee wttpe//ro////ooooo/eeeee//e 9022/
11

---

Published as a conference paper at ICLR 2026
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung- Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In 2020 IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1885-194,, 2020. doi: 10.19909CPP222220000000000
Francesco Croce and Matthias Hein. Minimally distorted Adversarial Examples with Fast Adaptive Boundary Attack. In Proceedings of the 37th International Conference on Machine Learning, pp. 2196-2205, PMLR, November 2020a. Otthttts: /tt.ttps:/pproceede /ttp///doocciieeeeeeeee ngs mlr prwss/v119/ croce20a. html. ISSN: 2640-3498.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the 37th International Conference on Ma- chine Learning, pp. 2206-2216. PMLR, November 2020b. URL https: /proceedings. mlr. waa.spres//e. http://1199ccceeeee html. ISSN: 2640-3498.
Sayanton V Dibbo, Adam Breuer, Juston Moore, and Michael Teti. Improving robustness model inversion attacks via sparse coding architectures. In European Conference on Computer Vision, pp. 117-136. Springer, 2024.
Vu Dinh and Lam Si Tung Ho. Consistent feature selection for neural networks via Adaptive Group Lasso, December 2021. URL http::/arxiv..t/ org/ abs6 00334. arXiv:2006.00334 [stat].
Vu C Dinh and Lam S Ho. Consistent feature selection for analytic deep neural networks. In Advances in Neural Information Processing Systems, volume 33, pp. 2420-2431, Curran Associates, Inc., 2020. URL httpp::/prroceeeingss neurips. cc/ wwcpapppaaailleeeeeeee Abstract .atsstaacthtt.... html.
Yupei Du, Philipp Mondorf, Silvia Casola, Yuekun Yao, Robert Litschko, and Barbara Plank. Rea- son to Rote: Rethinking Memorization in Reasoning, July 2025. URL abs/2507. 782.2. arXiv:2507.04782 [cs].
Logan Engstrom, Andrew llyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial Robustness as a Prior for Learned Representations, September 2019. URL http:/ arxiv...v. orgg abs /ab / 1906..9660.. 00945. 1XXx:11966000455 [stat].
Hao Fang, Bin Chen, Xuan Wang, Zhi Wang. and Shu-Tao Xia. Gifd: A generative gradient inver- sion method with feature domain optimization. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 4967-4976 2023.
Vitaly Feldman. Does learning require memorization? a short tale about long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pp. 954 959, Chicago IL USA, June 2020. ACM. ISBN 978- 978-1-450336679-1 doi: 10. 00.11445/357711333842999 URL ht https: : //l. acm. org /tgg/dodd /oii/ 100
33877777133333999 3384290.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model Inversion Attacks that Exploit Confi- dence Information and Basic Countermeasures. In Proceedings of the 22nd ACM SIGSAC Con- ference on Computer and Communications Security, pp. 1322-1333, Denver Colorado USA, Oc- tober 2015. ACM. ISBN 978-144503-3832-5. doi: 10. 1..114///11000328813661 URL https:
//dl. acm. org/ http//l....0111// 000...1111////111111 816677.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy to break privacy in federated learning? Advances neural information processing systems, 33: 13:16937-119444 2020.
Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf. Mcasuring Statisti- Dependence with Hillert-Schmidt Norms. In David Hutchison, Takeo Kanade, Josef Kit- tler, Jon M. Kleinberg, Friedemann Mattern, John C. Mitchell, Moni Naor, Oscar Nierstrasz, C. Pandu Rangan, Bernhard Steffen, Madhu Sudan, Demetri Terzopoulos, Dough Tygar, Moshe Y. Vardi, Gerhard Weikum, Sanjay Jain, Hans Urrich Simon, and Etsuji Tomita (eds.), Algorith- mic Learning Theory, volume 3734, pp. 63-77. Springer Berlin Heidelberg, Berlin, Heidel- berg, 2005. ISBN http:/ www.kk.ss.innne............e...e com 10. 1007 101111016118199111111111 7. Series Title: Lecture Notes in Computer Science.
977----500-316661-1 doi: 10.1007/11564089.7 URL
12

---

Published as a conference paper at ICLR 2026
Chuan Guo, Brian Karrer, Kamalika Chaudhuri, and Laurens der Maaten. Bounding Training Data Reconstruction in Private (Deep) Learning, June 2022. URL BtLLhttp///arxiii /bs/ 2201. 12383. arXiv:2201. 12383 [cs].
Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Trani. Reconstructing Training Data from Trained Neural Networks. In Advances in Neural Information Processing Systems, 2022.
Gyojin Han, Jaehyun Choi, Haeil Lee, and Junmo Kim. Reinforcement Learning-Band Based Black- Box Model Inversion Attacks. In 2023 IEEE/CVF Conference on Computer Vision and Par- tern Recognition (CVPR), pp. 20504-20513, Vancouver, BC, Canada, June 2023. IEEE. doi: 10.1 N0.11099xxp:52722.22222 202..01964 URL https: /ttet///eeeepprrree ieeeeeeeloreeeeeeeeee.eeeeeeeeee org/ document/ 10203595/.
Awni Hannun, Chuan Guo, and Laurens van der Maaten. Measuring data leakage in machine- learning models with Fisher information. In Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence, pp. 760-770. PMLR, December 2021. URL https://
proceedings ngs mlr, press/pss/vie / http///vv1/hhannn
html. ISSN: 2640-3498.
Jamie Hayes. Trade-offs
between membership privacy&aadversarially robust learn- URL https://wwe
ing. June 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for
Image Recognition, December 2015. URL /tap:://axiv... httg://b///11.....0
112.w:1512.03385.
Sy-Tuyen Ho, Koh Jun Hao, Keshigeyan Chandrasegaran, Ngoc-Bas Bao Nguyen, and Ngai-Man Che- ung. Model Inversion Robustness: Can Transfer Learning Help?, May 2024. URL http:
//arxivvorggg.o......a..o..ooooa abs 2405 05588. arXiv:2405.05588 [cs].
Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient version attacks and defenses in federated learning. Advances in neural information processing systems, 34:7232-7241, 2021.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial Examples Are Not Bugs, They Are Features, August 2019. URL http:
www.iv.org/abb....a..aooo.o 195. 02175. arXiv:1905.02175 [stat].
M J Jiménez-Navarro, M Martinez-Balllstteoos,
Brito, F Martinez-álvarez, and G Asencio- Cortes. Embedded feature selection for neural networks via learnable drop layer. Logic Journal of the IGPL, pp. jzac062, June 2024. ISSN 1367-0751, 1368-9894. doi: 10.1093/ jigpal/jzae062. URL https: https: /ttps////aaadmmc.c/cm oup. com haam/jigaal//dvancea aavaaccvaeeeeeeeeeeeaeeaaaaeeeaa http//aaaaaaaaaiaaacaeeeeeeaeeee article/ doi/10.1093 http:///aaaa/aaaeeee////e/e
Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-Only Model Inversion At- tacks via Boundary Repulsion. In 2022 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pp. 15025-15033, New Orleans, LA, USA, June 2022. IEEE, doi: 111100/cyrr5228822222044444 9878400/.
URL https: /ttes//eeeeeepreeeeee ieee. org/ document/
Tero Karras, Samuli Laine, and Timo Aila. A style- generator architecture for generative adversarial networks, 2019. URL tattps://arxisn http:///wwrg/a////aaa/aaa/as /111.1111.1 04948.
Tero Karras, Samuli Laine, Miik Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. An- alyzing and Improving the Image Quality of StyleGAN. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8107-8116, Seattle, WA, USA, June 2020. IEEE. ISBN 978-1-7281-7168-3 doi: (0.1009CCVPR22200222000000 / //ieeexplore, see org wwwpg///oo////////o/ooooooooot// 9156657//
URL https:
13

---

Published as a conference paper at ICLR 2026
Kacem Khaled, Gabriela Nicoleseu, and Felipe Gohring De Magalhães. Careful What You Wish For: on the Extraction of Adversarially Trained Models. In 2022 19th Annual International Conference Privacy, Security & Trust (PST), pp. 1-10, August 2022. doi: 10.1109/PST55800. 2022.9851981. URL https::t///..... /ttet:s:///eeeplorrreeeee wwweeeeeppeeeeeeee eee. org/ prg//oooe dttp//ot////////////// 9851 (18519811 981/
Aditya Khosla, Nityananda Jayadevaprakash, Bangpeng Yao, and Fei-Fei Li. Novel dataset for fine- grained image categorization: Stanford dogs. In Proc. CVPR workshop on fine-grained visual categorization (FGVC), volume 2, 2011.
Jun Hao Koh, Sy-Tuyen Ho, Ngoc-Bao Nguyen, and Ngai-man Cheung. On the Vulnerability of Skip Connections to Model Inversion Attacks, September 2024. URL http://///a// abs/2409 01696. arXiv:2409.016. 01669 [es].
Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt, and Thomas Dandres. Quantifying the Carbon Emissions of Machine Learning, November 2019. URL pettp://arxiv..rr/aaaae 1910. 09700. arXiv:1910009700 [es].
Ismael Lemhadri, Feng Ruan, Louis Abraham, and Robert Tibshirani. LassoNet: A Neural Net- work with Feature Sparsity, June 2021. URL http: at/parivvvv.o.///. hwtp://ggg/aaoaaeeee..oeee 12207.
arXiv:1907.12207
Yifeng Li, Yu Chen, and Wyeth W. Wasserman. Deep Feature Selection: Theory and Ap- plication to Identify Enhancers and Promoters. Journal of Computational Biology, 23::3222 doi: 10. 10.109/mm.2215.0015
336, May 2016. ISSN 1066-5277, 1557-8666.
URL http:
//www. www.eeitebbbbb.... com/ /tt////o111//////// 108./ cmb. 2015 0189.
Rongke Liu, Dong Wang, Yizhi Ren, Zhen Wang. Kaitian Guo, Qiangian Qin, and Xiaolei Liu. Unstoppable Attack: Label-Only Model Inversion Via Conditional Diffusion Model. 1EEE Transactions on Information Forensics and Security, 19:3958- 2024. ISSN 1556-6021. ieee org/ document/
doi: 101100099S.222233322200 URL 10458692/.
Zhen-Ting Liu and Shang-Tse Chen. Trap-MIID: Trapdoor-based defense against model inversion attacks. In The eiirth- Anmual Conference on Neural Information Processing Systems, 2024. URL https: htttps://openeevee....
Ziwei Liu, Ping Luo, Xiaogang Wang. and Xiaoou Tang. Deep Learning Face Attributes in the Wild. In 2015 IEEE International Conference on Computer Vision (ICCV), pp. 3730-3738, Santiago, Chile, December 2015. IEFE. ISBN 978-1-4673-8391-22 doi: 10. 10.1100/// URL. http:// /eeeeeeeepppppeeeeeeeeeeee ore. fee.. /ttpr///ccmmeet///1/10
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant Adversarial Attacks, September 2017. httht 706.00688 [stat].
/ //arxiv..rg/abiia...... /b7770/6 1706. 06083.
Shagufta Mehnaz, Sayanton V. Dibbo, Ehsanul Kabir, Ninghui Li, and Elisa Bertino. Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models. In 3/st USENIX Security Symposium (USENIX Security 22), pp. 4579 4596, Boston, MA, August 2022. USENIX Association. ISBN 978-1-9391133-1111 URL https:// //tp::::::ww usenix. org/ http://oofeeeeccceeeee htw.r//eeeeeeeeeeeeeeeeeeeeeeeee
Felipe A. Mejia, Paul Gamble, Zigfried Hampel-Arias, Michael Lomnitz, Nina Lopatina, Lucas Tindall, and Maria Alejandra Barrios. Robust or Private? Adversarial Training Makes Models More Vulnerable to Privacy Attacks, June 2019. URL http: /twp///arvvvvv/av///////.../..av org/ abs/19/6. 06449. arXiv:1906.0644 [cs].
Francesca Naretto, Anna Monreale, and Fosca Giannotti. Evaluating the privacy exposure of in- terpretable global explainers. In 2022 IEEE 4th International Conference on Cognitive Machine Intelligence (CogMI), pp. 13-19, 2022. doi: D0.10099C@MM154440200002000
Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ip- polito, Christopher A. Mhoquette-Choo Eric Wallace, Florian Tramèr, and Katherine Lee. Scal- able Extraction of Training Data from (Production) Language Models, November 2023. URL http::/ axii wwwoooggss........oo.... ablaab/s/00 2211 17035. arXiv:231 1. 1.13335 [cs].
14

---

Published as a conference paper at ICLR 2026
Hong- Wei Ng and Stefan Winkler. A data-driven approach to cleaning large face datasets. In 2014 IEEE International Conference on Image Processing (ICIP), pp. 343-347, October 2014. doi: 10.119//CIP:2004.70222 7025068/. ISSN: 2381-8549.
URL
ieee org/ document/
Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung- Label-Only Model Inversion Attacks via Knowledge Transfer. In Advances in Neural Information Processing Systems, 2023a.
Igoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung- Re-Thinking Model Inversion Attacks Against Deep Neural Networks. 2023 IEEE/CVF Con- ference Computer Vision and Pattern Recognition (CVPR), pp. 16384- 16393, Vancouver, BC, Canada, June 2023b. IEEE, ISBN 3-00---------
doi: 10. 1..1199/VVPP22222222......
URL httph:tt////mmm / wttpeeeeeepprrreeee ieeeooereeeeeee.....e...oo.eeeee
Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilat- eral Dependency Optimization: Defending Against Model-inversion Attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1358-1367, Washington DC USA, August 2022. ACM. ISBN 978-1-4503-9385-0, doi: 10. 10.1145/3534678. 3539376. URL https::tp...........m : / dl acm, www//ooiiooooooooooooooooooooooo 1 0. 45/453433333 3539376.
Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. Pseudo pouudo-pivvat data guided model inversion attacks. In The Thirty-eighth Annual Conference on Neural Information Process- ing Systems, 2024. URL https::tp///mmm /
fo worumm wtwp:mmmmddgpuaeeemm 6D2.
Xiong Peng, Feng Liu, Nannan Wang, Long Lan, Tongliang Liu, Yiu-ming Cheung, and Bo Han. Unknown-Aware Bilateral Dependency Optimization for Defending Against Model Inversion At- tacks. IEEE Transactions Pattern Analysis and Machine Intelligence, pp. 1-13, 2025. ISSN 1939-3539, doi: 10. 119.1T0AM..22.355555552.. Diccument11049950
htttttss: /tttps://eeeeppoorree wew.e.eeeeer...
URL https:
Yixiang Qiu, Hao Fang, Hongyao Yu, Bin Chen, MeiKang Qiu, and Shu-Tao Xia. A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks, September 2024. URL http:://// / //wp/aaavvvv////////////////.av. org//oog//oo.o..oooo /abs 2207 13863. arXiv:2407.13866
Yixiang Qiu, Hongyao Yu, Hao Fang, Tianqu Zhuang, Wenbo Yu, Bin Chen, Xuan Wang, Shu-Tao Xia, and Ke Xu. Mibench: A comprehensive framework for benchmarking model inversion attack and defense, 2025. URL https: http:/iivvrr//aaaa abs 05159.
Simone Scardapane, Danilo Comminiello, Amir Hussain, and Aurelio Uncini. Group sparse regularization for deep neural networks. Neurocomputing, 241:81-89, June 2017. ISSN 09252312. doi: 10. 10.10166j.ecccom22117....00 URL https:/ hatsss////iiiigguha elsevier. com/
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson. Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial Training for Free!, November 2019. URL org/ abs 904 12843. arXiv:1904. 1984.12843 [cs].
http:// /ttp:////rxivv/
Kulin Shah, Alkis Kalavasis, Adam R. Klivans, and Giannis Daras. Does Generation Require Memorization? Creative Diffusion Models using Ambient Diffusion, February 2025. URL
http::/arxiv.. wtt.://rgggbb/b/oeoooooooo 2502. 21278. arXiv:2502.21278 [cs].
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, 2024. URL https:// openreview n htt:://ommmnmttdt/ae/a
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference At- tacks Against Machine Learning Models. In 2017 IEEE Symposium Security and Privacy (SP), pp. 3-18, May 2017. doi: 10.1 109.....11..... URL https:/ attps://eeeexplore ieee. /ege/org/
document /798866// ISSN: 2375-1207.
15

---

Published as a conference paper at ICLR 2026
Reza Shokri, Martin Strobel, and Yair Zick. On the Privacy Risks of Model Explanations. In Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Sociery, pp. 231-241, Virtual Event USA, July 2021. ACM. ISBN 978- 1-4503-8473-3333 doi: 10. 10.114573461702.4442533. URL
httpps: d1 acm. o org doi / 11411145444 14/114/333 5/3461 702. .4 62533.
Liwei Song, Reza Shokri, and Prateek Mittal. Privacy Risks of Securing Machine Learning Models against Adversarial Examples. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 241-257, London United Kingdom, November 2019. ACM. ISBN 978- 978-1-4503-6647-9, doi: 10.1145/3319535.335222 0oi/100.1455
URL https: /dl. acm. org/
3354211.
Lukas Struppek. Dominik Hintersdorf, Antonio De Almeida Correia, Antonia Adler, and Kristian Kersting. Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks, June 2022. URL http: / war.aaivvvv.... www.w.ww.....o.....ooo.o..oooooo /ttp////......1.... arXiv:220..12179 [cs].
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks, July 2024. URL http: arxiv. org/ abs 2310. 06549. arXiv:2310.06444 [cs].
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks, February 2014. URL http:// //axiv.. org.orggaaaooo 2tgg/abs/3322 1t1.11111......... arXiv:1312.6199 [cs].
Robert Tibshirani. Regression Shrinkage and Selection Via the Lasso. Journal of the Royal Sta- fistical Society Series B: Statistical Methodology, 58 (8(1):267-288 January 1996. ISSN 1369- 7412, 1467-9868. doi: 1111111/22577-111111999666666669
URL https: /academic.
oup.
Kushal Tirumala, Aram H. Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization Without Overfitting: Analyzing the Training Dynamics of Large Language Models, November 2022. URL http: http://ww.rr//b////...1111
MxXiv:2005.1077 [cs].
Nurislam Tursynbek, Aleksandr Petiushko, and Ivan Oseledets. Robustness Threats of Differential Privacy, August 2021. URL
07828 arXiv:2012.07828
[es].
Kuan-Chiel Wang, Yan Fu, Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani, Variational Model Inversion Attacks, January 2022. URL arXiv:2201.100 10787 [cs].
Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving Robustness to Model Inversion Attacks via Mutual Information Regularization, September 2020. URL http::t/ax.....rg/////ooo 2009. 05241. arXiv:2009.0524) [cs].
Wenhao Wang, Muhammad Ahmad Kaleem, Adam Dziedzic, Michael Backes, Nicolas Papemot, and Franziska Boenisch. Memorization in Self-Supervised Learning Improves Downstream Gen- cralization, June 2024. URL http: /t:::///aze http://aaxvv...g....../ /240l 12233. a2X1v:2401.12233 [cs].
Jing Wen, Siu-Ming Yiu, and Lucas C.K. Hui. Defending Against Model Inversion Attack by Adversarial Examples. In 2021 IEEE International Conference Cyber Security and Re- silience (CSR), pp. 551-556, July 2021. doi: 10.1009CC23111162222.22277 / //ieeexplore.ee ieee org/ ottpe/e..o/ooccceee//////2/ docummett/9579455
URL https:
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training, January 2020. URL http: http//aaxvvv...///////.ee/..aav. how.vvorggaaaaae abs /200 2001 03994. arXiv:2001.033 103994 [cs].
Nathaniel Xu, Feng Liu, and Danica J. Sutherland. Learning representations for independence test- ing, 2025. URL https: /ttpss///aa/vvv// org/ abs 249..... 06880.000 90.
Ziqi Yang. Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. Neural Network Inversion in Adver- sarial Setting via Background Knowledge Aligmment. In Proceedings of the 2019 ACM SIGSAC Conference Computer and Communications Security, pp. 225-240, London United Kingdom, November 2019. ACM. doi: 00.1145/3319535.3344222 URL https: // /ddl. acm. org. /oi/ 10. 10.1144 10.1145/28 3311/331199 9535 93315533535365656631111 3354261.
16

---

Published as a conference paper at ICLR 2026
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy Risk in Machine Learn ing: Analyzing the Connection to Overfitting, May 2018. URL http:://aaaa org/ /bs/ 0109.01604 17Xiv:1709.01604.
Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network, February 2023. URL http: /awpvv..vvvv/..///////..///..a.. orq/ alss////////////// 2302.. 09814. arXiv:2302.09814 [cs].
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization, February 2017. URL http: http///axxvvvrrr/ abs/1611. 03530. arXiv: 1ee116111..0 1.03530 [es].
Huaqing Zhang, Jian Wang, Zhanquan Sun, Jacek M. Zurada, and Nikhil R. Pal. Feature Selec- tion for Neural Networks Using Group Lasso Regularization. IEEE Transactions on Knowl- edge and Data Engineering, 32(4)65596673, April 2020a. ISSN 1558-2191. doi: 10.1109/ TKDEE.211.28932660 URL https: // wee/eeeepppooo ieee. org./ocument/ /ett//613000 3832/ Parnumber=861388 Conference Name: IEEE Transactions on Knowledge and Data Engi- neering.
Yuan Zhang and Zhiqi Bu. Differentially Private Optimizers Can Learn Adversarially Robust Mod- els, November 2023. URL [cs].
orgoorg///oooo.o abs///b///// /22/22211122 08942. arXiv:2211.0894
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The Secret Re- vealer: Generative Model-Inversion Attacks Against Deep Neural Networks, April 2020b. URL http://arxiv.oxx wttp://.rrra/bb///////e/ 07115. arXiv: 1.000133 [es].
Lei Zhao, Qinghua Hu, and Wenwu Wang. Heterogeneous Feature Selection With Multi-Modal Deep Neural Networks and Sparse Group LASSO. IEEE Transactions on Multimedia, 17(11): 1936-1948, November 2015. ISSN 1941-0077. doi: 0.1109/TTM.201552477700 htteeeeeeepeeeeeeeeeeee ieee org/ www.meet//24422222
URL
Shuai Zhou, Tianqing Zhu, Dayong Ye, Xin Yu, and Wanlei Zhou. Boosting Model Inversion Attacks With Adversarial Examples. JEEE Transactions Dependable and Secure Compur- ing. 21(3):1551-1468 May 2024. ISSN 1941-0018. doi: 1L1109/TDDCC.2233328850000 URL
https:// ftttps://ieeexploreeee ieee..eee.. org/ Document//014455
Tianqing Zhu, Dayong Ye, Shuai Zhou, Bo Liu, and Wanlei Zhou. Label-only model inversion attacks: Attack with the least information. IEEE Transactions on Information Forensics and Security, 18:991-1005, 2023. doi: 10.
Tianqu Zhuang, Hongyao Yu, Yixiang Qiu, Hao Fang, Bin Chen, and Shu-Tao Xia. Stealthy shield defense: A conditional mutual information-basee approach against black-box model inversion attacks. In The Thirteenth International Conference on Learning Represenatiioss 2025. URL https: cpwneevieww.w.cc/////e net/ http://wwweee/oouuiieeeeeee /orr//oddmmddiiii
Hui Zou and Trevor Hastie.
Regularization and Variable Selection Via the Elastic Net. Journal of the Royal Statistical Society Series B: Statistical Methodology, 67(2):301-320, April 2005. ISSN 1369-7412, 1467-9868. doi: 1401)]4167788888 00000.0000000000.00 URL https: / /aaaemic..
oup com/ http./////ssssbaatiiei/////////e 67 2/tp////////3/////////
17

---

Published as a conference paper at ICLR 2026
A DEFERRED DETAILS OF EXPERIMENTS
A.1 TARGET MODEL. BASELINE DRFENSES
We consider two types of defense baselines. Our primary baselines are defenses that attempt to generically increase privacy by reducing information deppedensy/meeorrzatinn.. In each case, un- less otherwise mentioned, we set all parameters identically those used by their authors, and run defenses using the authors' replication codes:
No Defense (NoDef). We consider vanilla ResNet-152, ResNet-18, and DenseNet-169 baselines, trained without additional privacy defenses.
Mutual Information Defense (MID) (Wang et al., 2020). Inspired by previous informa- tion bottleneck research, MID introduces a regularizer that reduces training-data-to-mnn information dependency by penalizing (an approximation of) mutual information between training examples and the model's 's intermediate feature representations. We adapt the au- thors' original implementation to work with ResNet architectures; following previous work (see e.g. Struppek et al. (2024)), we add the information bottleneck layer between the aver- age pooling and final linear layer, and set the bottleneck size k 1024. Also following previous work, we set the regularization penalty 3 0.01. On FaceScrub MID models, we use a lower learning rate of 0.0001, as we found it to provide a stronger defense at similar accuracy to the typical learning rate of 0.001. We drop the last batch of the validation set to ensure compatibility with the authors' code.
Bilateral Dependency Optimization (BiDO) (Peng et al., 2022). BiDO introduces two regularizers, the first of which minimizes a kernel-based information dependency measure between inputs and intermediate embeddings (i.e. to penalize data-to-model information dependency), while the second maximizes the same dependency measure between inter- mediate embeddings and outputs (i.e. to reward accuracy). Following recent work (see e.g. Struppek et al. (2024); Peng et al. (2022)), we use the outputs of the four main ResNet blocks as the intermediate embeddings for the regularized loss. We drop the last batch of the validation set to ensure compatibility with the authors' code. We use the standard BiDO hyperparameters (y = (0.05, 0.5) both for our main results tables comparing baselines to AT-AT (Tables 23 and 25)) as well as in our adversarial robustness experiments (Tables 11, 12, 13, 14). See App. D for our additional analysis of other alternative BiDO hyperparameter values.
Transfer Learning Defense against Model Inversion (TL-DMI) (Ho et al., 2024). When training target models, defenses typically perform full fine-tuning on Pprie of a model pre- trained on some public dataset; TL-DMI instead fine-tunes only later layers of the target model, which is argued to reduce the number of parameters encoding sensitive information within the target model. We use the authors' original implementation with the minimal refactoring necessary to ensure compatibility with our codebase. We additionally remark that the authors of TL-DMI do not claim that the training data encoding that is relevant is necessarily rote- nemomeeer training data, though practitioners widely assume that this is so. However, we note that it is conceivable that this encoded information the authors measure and discuss was unknowingly the very same non-robust features that we find to be operative here.
TL-DMI-5. TL-DMI typically implemented for ResNets by freezing the first 6 layers of the network. While we find that this parameter choice works well in many cases, nonetheless find that it fails to obtain competitive test accuracy for on the CclebA dataset in certain cases (particularly when run on lower-capacity architectures like R8sNet-18). Therefore, to give TL-DMI the best opportunity to perform well, we also consider an ad- ditional variant, TL-DMI-5, which freezes just 5 layers. We report this additional baseline wherever it offers a performance improvement over the recommended 6-layer version.
We note that exclude the Sparse-Coding Architecture (SCA) defense (Dibbo et al., 2024) in our experiments, as it is not practical to run in the high-resolution scenario that is the focus of this work.
Second, for the sake of comparison, we also consider defenses that attempt to suppress gradients from MIAs, rather than increase generic privacy. Again, as above, we set all parameters identically to those used by their authors, and run defenses using the authors' replication codes:
18

---

Published as a conference paper at ICLR 2026
Negative Label Smoothing (NegLS) (Struppek et al., 2024). The NegLS defense em- ploys negative label smoothing to make the target model consistently overconfident in its predictions. This 'deliberate overconfidence' does not remove information about the train- ing data from the model. Instead, this overconfidence inhibits PPA attacks (and similar gradient-based GAN attacks, including IF-GMI) that rely on a smooth landscape of target model confidence scores to compute the gradient updates they use in their reconstruction steps. We use the authors' original implementation with the minimal refactoring necessary to ensure compatibility with our codebase.
Removal of Last Stage Skip-Connection (RoLSS) (Koh et al., 2024). To impede gradi- ent flow during optimization of PPA and other similar attacks (including IF- RoLSS proposes to remove the skip connection at the last stage of the target model. We use the skip-customized ResNet architectures provided in the RoLSS replication codes for RoLSS and RoLSS-SSF models. For the ResNet-18 RoLSS model on FaceScrub, we use a lower initial learning rate of 0.0001, as we found it to provide a stronger defense at similar accu- racy, compared to the typical learning rate of 0.001.
Skip-Connectinn Scaling Factor (RoLSS- (Koh et al., 2024). This variant of RoLSS weakens the weight of the last-layer skip connection instead of removing it completely. We use the standard scaling factor h = 0.2 (where h = corresponds to an unchanged model, non-SSF RoLSS). For the ResNet-18 RoLSS-SSF model on
and k 0 is equivalent FaceScrub, we use a lower initial learning rate of 0.0001, as we found it to provide a stronger defense at similar accuracy, compared the typical learning rate of 0.001.
Trapdoor-based Defense (Trap-MID) (Liu & Chen, 2024). The Trap-MID defense im- plements a trapdoor integrated into the model to predict a specific label when the input is injected with the corresponding trigger. The trapdoor information serves shorteut for MI attacks, leading them to extract trapdoor triggers rather than private data. We run two sets of hyperparameters suggested by the authors: Trap-MID denotes their tuned hyperpa- rameters for high-resolution experiments (a = 0.007, B = 0.5), and Trap-MID* denotes the hyperparameters for their nower-resolution experiments (a 0.02, B = 0.2), which we add for additional comparison. We use the original authors' code with minimal refactoring for compatibility with our codebase.
A.2 DATASETS
We consider the three datasets that are the focus of recent experiments on high-definition MIAs:
FaceScrub (Ng & Winkler, 2014). FaceScrub is a commonly used facial dataset of 530 celebrity classes (see e.g. Struppek et al. (2024); Koh et al. (2024); Ho et al. (2024); Qiu et al. (2024); Struppek et al. (2022)). For ease of reproducibility, we use a popular Kaggle- hosted version of the dataset and supply automatic download and processing code.
CelebA (Liu et al., 2015). CelebA is a facial celebrity dataset containing 202,599 images of 10,177 celebrities. Following previous work (see e.g. Struppek al. (2024); Liu & Chen (2024); Qiu et al. (2024): Struppek et al. (2022)), we choose the most common 1000 class identities out of the 10, available, for a total of 30,038 images. As is standard, we apply the CelebA HD Cropper to improve the overall image quality.
Stanford Dogs (Khosla et al., 2011). Stanford Dogs is a dog image dataset containing 20,580 images of 120 different species of dogs, commonly used in model inversion (see e.g. Ho et al. (2024); Koh et al. (2024); Struppek et al. (2022); Qiu et al. (2024)). We use the full dataset² for our experiments and include automatic download and processing code.
Each dataset was partitioned into 90% training and 10% test. From the training set, 20% was used as a validation set for tracking performance and carly stopping. When training target models, we strictly follow the standard MIA data pre gre-processing steps (see e.g. Struppek et al. (2022; 2024), as follows: we normalize the images with μ = a (0.5, 0.5, 0.5). then resize so that the smaller side of the image is 224 pixels. We apply random cropping with patch sizes between 85% and 100%,
Available http://www.aggle.cm/////attttaaa
2 Availlale at https//github.com/ httpm///yyyHHHHDDCCCCCCCCCCCCCC
Availlble http://ww...antouuuuudadaa//aaaa
19

---

Published as a conference paper at ICLR 2026
keeping the aspect ratio fixed at 1.0; then resize the patches to 224 x 224 pixels (RandomResized- Cropping). We then applied random color jitter with saturation and hue factors of 0.1 and contrast and brightness factors of 0.2. Half of all samples are also horizontally flipped.
A.3 TARGET MODEL TRAINING DETAILS
Unless otherwise mentioned, we train target models with the following parameters, following previ- ous work (see c.g. Struppek et al. (2024; 2022)): Before training on Prrse we initialize the models with pre-trained ImageNet weights available through Torchvision. We use the Adam optimizer with 3 = (0.9, 0.999), and batch size of 128. Models are trained for a total of 100 epochs, saving the model weights of the epoch with the lowest validation loss. We measure prediction accuracy the validation split throughout model training, and after training, we measure prediction accuracy on the test split. We use an initial learning rate of 0.001, and we employ a MultiStepLR learning rate scheduler with 0.1. Full implementation details for target models are contained in our replication codes.
A.3.1 PERMUTATION MODEL TRAINING DETAILS
For the models trained with permuted labels in Sec. 3, we use lower learning rate of 0.0001, which we found provided more stable training. All other training hyperparameters are identical to those described above. The target models with permuted labels achieve over 99.4% accuracy on their respective altered training sets.
A.4 ARCHITECTURES
We follow recent MIA work by considering three architectures:
ResNet-112 (He et al., 2015). As in numerous recent works on high-resolution MIAs (e.g., Struppek al. (2022); Qiu et al. (2024); Koh al. (2024); Struppek al. (2024)), our main focus is ResNet-152 models, which exhibit sufficient depth to act as a good proxy for mainstream production vision models. Also, the adversarial examples literature has shown that models of higher capacity can better articulate robust and non-robust features well (llyas et al., 2019; Madry et al., 2017), so the ResNet- 152 architecture natural choice for testing our hypotheses regarding non-robust features.
ResNet-18 18 (He et al., 2015). As in recent MIA work (e.g., Struppek et al. (2022); Ho et al. (2024); Qiu et al. (2024)), we consider a ResNet-18 architecture, which permits us to probe how well our results generalize even to lower-capacity networks with more limited ability to capture complex feature bases.
DenseNet-169 (Huang et al., 2017). As in recent high-resolution MIA work (e.g., Strup- pek et al. (2022); Qiu et al. (2024); Koh et al. (2024); Liu & Chen (2024)), we also consider a higher-capacity DenseNet- 169 architecture, which allows us to test how well our results generalize to other deep convolutional architecture families.
A.5 RECONSTRUCTION ATTACKS
We consider three recent attacks that obtain state-of-the-art performance for our high-definition vision setting:
Plug-and-Play Attack (PPA) (Struppek et al., 2022). Through a novel three-stage in- version attack framework (latent vector sampling, optimization, and robust final selection), PPA leverages a pre-trained StyleGAN-2 (Karras et al., 2020) to allow for impressive and efficient attack performance in the high resolution setting. StyleGAN-2 was trained on the FFHQ dataset (Karras et al., 2019), which has no identity overlap with CelebA or Face- Scrub. For the Stanford Dogs experiments, the StyleGAN-2 model used was trained on the AFHQ dogs dataset (Choi et al., 2020). We adapt the original authors' code to en- sure compatibility with our codebase. During optimization, samples steps for FaceScrub and CclebA target models, and 100 steps for Stanford Dogs. All other hyperparameters are identical to those used in previous work (Struppek al., 2022; 2024).
optimized for 50
20

---

Published as a conference paper at ICLR 2026
Table 6: AT-AT hyperpaaaameerss for the models reported in the main tables. Columns Step Size, and LR are x 10-4. hyperparameters not mentioned are identical to their corresponding baseline models. "RN"
ResNet, DN is DenseNet.
Dataset
Arch.
#Steps
Y
Step Size
LR
RN-152
0.040
0.4
1.5
0.5
FaceScrub
RN-18
0.125
0.1
DN-169
0.100
0.4
0.7
RN-152
0.020
3
0.4
1
0.34
5
CelebA
RN-18t
0.040
0.4
0.75
10
RN-18te
0.010
5
0.1
50
10
10
DN-169
0.020
3
0.4
3
Stanford Dogs RN-152
0.080
0.1
Notes: to and 16 are two distinct sets of hyperparameters for our AT-AT ResNet- 18 model trained on CelebA corresponding the same symbols used in other tables.
Intermediate Features enhanced Generative Model Inversion (IF-GMI) (Qiu et al., 2024) IF-GMI leverages intermediate features of StyleGAN-2 (Karras et al., 2020) to im- prove the expressiveness and transferability of the generated images, becoming the new SOTA for high-resolution MIAs. We adapt the original authors' code ensure compatibil- ity with our codebase. All attack hyperparameters are identical to those used by the original authors.
Pseudo-Private Data Guided Model Inversion Attack (PPDG) (Peng et al., 2024). The PPDG authors find that fixed generative prior, StyleGAN-2 (Karras et al., 2020), leads to a low probability sampling actual private data during the inversion process due to distributional gap to the private data distribution. To address this limitation, they increase the density around high-quality pseudo-private data that exhibit characteristics the pri- vate training data, and slightly tune the generator. All attack hyperparameters identical to those used by the original authors.
PPA and IF-GMI attacks on ResNet- 152 and ResNet- 18 models trained on FaceScrub and Stanford Dogs target all classes unless otherwise specified; for all models trained CelebA, all PPDG at- tacks, and all DenseNet-169 results, we instead target seeded random subset of 75 the classes, holding the randomly selected classes constant for each dataset across all baselines. As attack time and compute scale roughly linearly with the number of classes targeted, this approach reduces time and compute by over 90% for CelebA experiments and over 80% for the relevant FaceScrub experiments, at the cost of a small increase in uncertainty (see the confidence interval margins of error in Tables 27 and 28).
As described in Section 2, we evaluate these attacks using the following standard metrics: Attack Acc@ (AttAcc@) 1), Attack Acc@5 (AttAcc@5), L2-FaceNet Distance (L2), and Average Evalu- ation Confidence (EvalConf).
A.6 GPUs AND CARBON EMISSIONS
We run the majority of our target model training on 1x or 2x NVIDIA RTX A6000 GPUs with 48 GiB of vRAM each. The main attack experiment results were generated primarily through renting virtual machines from Lambda Labs, typically using Ix or 2x NVIDIA A100 GPUs with 80 GiB vRAM, or or 2x NVIDIA H100 GPUs with 80 GiB vRAM. We estimate our total carbon emis- sions from GPU usage be roughly 1200 kg of CO2 eq., estimated using the Machine Learning Emissions Calculator (Lacoste et al., 2019).
B AT-AT HYPERPARAMETER AND TRAINING
Our AT-AT scheme, described in Section 5, has multiple tunable hyperparameters; see Table 6 for details. À governs the relative strength of the anti-AT loss term. For the in-loop generation of adversarial examples, Projected Gradient Descent (PGD) adversarial attack (see e.g. Madry et al. (2017)) is used: the size of the Lx ball around the target image permissible for adversarial example generation, #Steps is the number of iterations used by the PGD attack, and Step Size
21

---

Published as a conference paper at ICLR 2026
Table 7: Comparison of AT-AT FaceScrub ResNet- 132 models different À values. All other hyperparameters are the same as reported for ResNet- 152 FaceScrub Table 6. PPA is performed on seeded random subset 75 FaceScrub classes. The 4 rightmost columns measure AutoAttack robust accuracy under various c levels. The À = 0.04 model is the same AT-AT model reported in our main results; for this model, the PPA-AttAcc@* value (marked by *) is all 530 FaceScrub classes, as opposed to 75.
Defense
TestAcc 1 PPA-AttAcce@ 1 c00.031 c=0.0025t 0.00055
10 T
0.01
0.936
0.099
0
0.307
0.04
0.939
0.058
0
0.119
AT-AT
0.06
0.931
0.049
0
0
0.077
0.10
0.921
0.064
0
0
0.146
0.15
0.899
0.071
0
0
0.036
is the Loo distance the PGD attack moves in one iteration before clipping, which set to be Z e/(SSteps) We also tune the learning rate schedule; we report the initial learning rate LR (same in the Section algorithm) and the decay factor 7 of the MultiStepl.R scheduler. Full implementation and hyperparameter details are available in our replication codes.
In our preliminary experiments, found that as AT-AT models begin rely on non-robust features, training often becomes unstable, resulting in occasional downward spikes in model accuracy in the later epochs of training. We also note that AT-AT occasionally fails converge when data augmentations are not applied. To account for this instability, we perform a variant of early stopping: We save AT-AT models during training at each epoch where they hit a certain pre-set validation accuracy range (e.g. over 90% for FaceScrub models). Notably, all other defenses are also using the corresponding best model checkpoint from the 100 epochs of training. i.e the model with the lowest validation loss. We also note that during AT-AT training, when model accuracy is unstable in later epochs, the reliance of the training model on non-robust features remains reliably high. See Table for assessment of AT-AT performance five different values of X, holding other hyperparameters constant.
B. DEFERRED DISCUSSION OF AT-AT PRACTICAL RUNTIMES
AT-AT's runtimes are roughly 30% faster than vanilla AT trained via PGD, because AT requires re- sistance to strong (high-E) attacks, whereas AT-AT seeks to learn from imperceptibly subtle (low-s) features, requiring many fewer iterations of PGD. Specifically, typical research implementation of AT uses default of 10 steps of PGD, whereas we used just 3 to 5 steps for AT-AT throughout our experiments. These PGD step counts the practical runtime bottleneck. To be concrete, this trans- lates to runtimes of 3.10 hours (AT) vs. 2.14 hours (AT-AT) for CelebA on ResNet- 18 architectures (note that all algorithms train for exactly 100 epochs throughout our experiments). Importantly, like AT, our AT-AT could potentially also benefit from the same well-studied algorithmic and imple- mentation speedups that are widely applied in industry-scale AT implementations (e.g. Wong al., 2020: Shafahi et al., 2019). As such, AT-AT can be implemented at scale at significantly lower cost than the AT implementations already in widespread industry use.
C MIAS: NOTATION AND RELATED WORK
The objective of model inversion attacks in image classification models is to generate images seman- tically similar to the class identities in the training data, causing a leakage of privacy. App. C.I sets notation used throughout the paper and describes some early MIAs. App. C.2 describes more recent generative MIAs. App. C.3 clarifies the scope of our paper and describes some related inversion attack settings.
C.I NOTATION AND EARLY MIAS
Formally, MIAS consider a private training dataset Dpriv = {a,, yi y. where o; E Rdx, y: E {0, 13 and each (x) are sampled i..dd from a joint distribution PxY- Early MIAS used SGD to directly optimize reconstructions of individual training examples (Fredrikson et al., 2015). However, this approach suffers from various optimization complexities when applied to con- temporary vision architectures like deep CNNs. Therefore, recent state-of-the-art attacks simplify
22

---

Published as a conference paper at ICLR 2026
optimization by adopting an 'image prior' that is, by restricting the search space of training ample reconstructions to the image outputs of a domain-relevant GAN, and conducting SGD-based optimization on the GAN's input noise vectors instead of directly the high-dimensional images' feature space, as first introduced by Zhang et al. (2020h). More specifically, GAN-based MIAs op- timize a latent noise vector Z such that the resultant GAN-generated image is classified as class maximized confidence by the target model T::
min LTT, G, 2,)
where L is standard loss function (e.g. cross-entropy) to maximize the confidence of the GAN- generated image on class c given pretrained GAN generator G - X Xprior and GAN discrimina- tor D.
C.2 RECENT GENERATIVE MIAS
In the following years after the introduction of generative MIAS by Zhang et al. (2020b), low- resolution generative MIAs saw numerous improvements (see e.g. Chen et al. (2021); Wang et al. (2022); Yuan et al. (2023); Nguyen et al. (2023b)). While these attacks show impressive performance in the low-resolution scenario, they have yet prove effective on higher-resolution data.
MIRROR (An et al., 2022) became the first attack to have success in the high-resolution scenario. PPA (Struppek et al., 2022) made further improvements, proposing a framework that supports the use of a pre-trained StyleGAN model (Karras et al., 2020) unspecific to the target model T,, which increases robustness to distributional shifts and flexibility choice of target model while offering impressive performance on high-resolution image data. Most recently, IF-GMI (Qiu et al., 2024) leverages intermediate features of StyleGAN to improve the expressiveness and transferability of the generated images, becoming the new SOTA for high-resolution MIAs.
C.3 INVERSION ATTACKS IN OTHER SETTINGS
While the mentioned MIAs are all white-box attacks, there has been some exploration black-box and label-only model inversion attacks (Liu et al., 2024; Han et al., 2023; Nguyen et al., 2023a; An et al., 2022: Yang et al., 2019; Kahla et al., 2022; Zhu et al., 2023; Qiu et al., 2025) and defenses (Zhuang al., 2025; Zhu et al., 2023). should be noted that while it has previously been shown that some recent black-box and label-only attacks have outperformed previous white-box attacks (Zhuang al., 2025; Han al., 2023; Nguyen et al., 2023a), these performance comparisons had been limited to earlier, low-resolution MIAs (Chen et al.. 2021: Zhang et al., 2020b); more recent, high-resolution white-box MIAs (Qiu et al., 2024; Struppek al., 2022) are likely outperform black-box and label-only MIAs, which have primarily been evaluated on low-resolution data regimes (Han et al., 2023; Nguyen et al., 2023a). As such, for the purposes of this paper, we focus on the more difficuult white-box scenario.
Separately, a related stream of research studies gradient inversion attacks and defenses in the fed- erated learning scenario, where neural networks are collaboratively trained server (Fang et al., 2023; Huang et al., 2021; Geiping et al., 2020). While both gradient inversion attacks and modern MIAs share the goal of leaking private training data, the threat models fundamentally different; gradient inversion attacks often seek per-image or per-batch reconstructions based on gradient in- formation provided by local user during collaborative training. while modern MIAs instead seek class-representative reconstructions based on queries to an already-trained neural network. As such, we leave the impact of information dependency and adversarial robustness on gradient inversion attacks as an important direction for future research.
D HSIC EXTENDED RESULTS
Table is an extended version of Table which includes ResNet-18 models, as well as the extra Trap-MID* baseline. The results are similarly uncorrelated; some defenses, like the ResNet- 18 RoLSS-SS SSF model, have some low HSIC values but perform poorly against a PPA attack, while other defenses, like ResNet- 152 NegLS, have similarly high HSIC values to undefended model, but perform well against PPA attack. It should be noted that BiDO utilizes an HSIC estimator and that in some problems optimized HSIC tests outperform optimizing the statistic (Xu al., 2025).
23

---

Published as a conference paper at ICLR 2026
Table 8: HSIC(X, 22) for different defenses FaceScrub. Models: ResNet-112 and ResNet--1. AttAce(e
from a PPA attack on all classes.
Arch.
Defense
TestAce
AttAcc@1
HSIC(X, 20)
HSIC(X, 21)
HSIC(X, 22)
HSIC(XX Za)
NoDef
0.958
0.882
71.66
72.32
72.72
72.72
MID
0.950
0.391
71.52
72.57
72.84
61.98
ResNet-152
BiDO
0.928
0.780
73.68
73.68
73.68
73.63
TL-DMI
0.911
0.190
71.73
72.52
72.93
72.58
NegLS
0.906
0.160
71.64
72.33
72.29
73.63
RoLSS
0.886
0.474
72.09
72.30
29.69
61.92
RoLSS-SSF
0.869
0.343
71.88
72.02
32.75
64.94
Trap-MID"
0.949
0.587
69.93
71.96
72.56
72.65
Trap-MID
0.926
0.401
69.80
71.88
72.62
69.28
NoDef
0.950
0.901
63.48
49.74
37.80
72.38
MID
0.924
0.714
61.03
48.39
30.08
65.73
ResNet-18
BiDO
0.884
0.530
73.80
73.81
73.80
73.75
TL-DMI
0.906
0.240
61.11
50.29
36.31
72.64
NegL.S
0.929
0.649
63.27
50.76
34.97
T3.68
RoLSS
0.950
0.858
61.23
49.38
13.33
72.25
RoLSS-SSF
0.950
0.849
61.44
19.38
13.30
72.27
Trap-MID# MID
0.927
0.502
57.84
47.80
34.93
72.01
Trap-MIID
0.928
0.735
62.44
47.33
34.91
67.44
App. D.I revisits BiDO hyperparameter tuning, exploring the possibility of creating model with low HSIC values with the BiDO scheme.
D.1 BIDO EXPERIMENTS
Let X and Y be random variables representing the inputs and outputs, respectively, and let Zı...., Zm be intermediate embeddings chosen different points from passing X as input to the model (e.g. the outputs of the four major blocks a ResNet). Motivated by theoretical concepts in statistical dependency (Gretton al., 2005), the popular BiDO defense Peng et al. (2022) uses
the following training loss function:
m
HSIC(X, 2,) X Σ m
[()) = (()) A Σ
HSIC (2,,
where L. is standard cross-entropy loss and Az. Ay. 0 are hyper- saperrparameters. The Ar term is intended minimize dependency between inputs and intermediate embeddings. As for the Xy term, Peng et al. (2022) argue that solely minimizing HSIC(X, Zj) would ledd lead to the loss of useful information, so it necessary to keep the [A,]] term to make sure Z, is informative enough of as well as maintain the discriminative nature of the classifier."
After the surprising discovery that BiDO with (Az, Ay) = (0.05, 0.5) fails to decrease HSIC(X, Z,) (see Table 8), experimented with other pairs (Ag Xy) to if HSIC Z,) (referred here- after as 'HSIC") could indeed be lowered through the BiDO training scheme. To check whether the Ay term of the objective function
impeding the model's ability to reduce HSIC, first experimented with setting Ay = 0; however, according to the ablation study of Peng et al. (2022), setting (Az, A (0.1, 0) completely impedes the model's ability to train. We instead surpris- ingly find success with smaller values of A more specifically, we train ResNet-18 8 and ResNet-152 BiDO models FaceScrub with (Az, Ag) (0.001, 0) and (Ar, = (0.0001, 0). We use initial learning rates of 0.001 and 0.0001 for the ResNet-152 and ResNet-18 models, respectively. For the ResNet-18 models, we train for just 75 epochs, as this was sufficient for them to converge; for the ResNet- 152 models, we train for 100 epochs. All other training hyperparameters are identical to those described in App. A.3. a natural next step, we run PPA attack on our new "low-HSIC" BiDO models. Due to compute considerations, attack seeded random subset of 75 out of the 530 FaceScrub identities; all other attack hyperparameters are identical to those described in App. A.5.
Results. As Table shows, across both architectures, BiDO 00000,000000 and BiDO 00.0001, 0) gener- ally succeed in lowering HSIC(X, Z,) for most values of while losing only 0.1 to 1.8 percentage points test accuracy. However, these -SSC BiDO models fail to provide a meaningful de- fense against model inversion, with top-1 attack accuracies consistently exceeding 80%. In sum,
24

---

Published as a conference paper at ICLR 2026
Table 9 reinforces the notion that the HSIC dependency used in BiDO, while theoretically well-motivated, is orthogonal to model inversion robustness.
Table 9: HSIC X; 2,) for different BiDO hyperparameter variations, with comparisons to NoDef, MID, and TL-DMI. ResNet-18 18 and ResNet-152 models trained on FaceScrub. AttAcc@ from PPA on all 530 classes, except for the four BiDO models with A, = O. for which PPA is run seeded random subset of 75 classes
of 530. The ResNet-152 BiDO,.001.0 model also reported in Table BiDOss
Arch.
Defense
TestAcc
ÁttAccée
HSTC Zoo
HSTC 2n)
HSIC Z2)
HSTC Zuz
NoDef
0.958
0.882
71.66
72.32
72.72
72.72
RN-152
MID
0.950
0.391
71.52
72.57
72.84
61.98
BiDOC.OS..5)
0.928
0.780
73.68
73.68
73.68
73.63
BiDOCO01.C
0.940
0.815
2.159
1.256
9.310
71.81
BiDOC,0001,0)
0.948
0.849
70.62
72.15
72.71
72.68
TL-DMI
0.911
0.190
71.73
72.52
72.93
72.58
NoDef
0,950
0.901
63.48
49.74
37.80
72.38
MID
0.924
0.714
61.03
48.39
65.73
RN-18
.)
0.884
0.530
73.80
73.81
73.80
73.75
BiDOL001.0
0.943
0.817
4.403
1.402
1.511
72.34
BiDO(,0001.0)
0.949
0.834
54.51
41.08
24.83
T2.37
TL-DMI
0.906
0,240
61.11
50.29
36.31
72.64
E 97% WISSEN-PPXXHS MODEL EXPERIMENT DETAILS
This section provides further details for our Unseen- Pixels experiment in section 3. Appendix E. describes related work in feature selection for neural networks; Appendix E.2 then describes method for creating a mask that deletes over 97% of pixels from the training data before training the model, while losing only a few percentage points in accuracy. Appendix E.3 describes the relationship between recent theoretical guarantess for data reconstruction attacks and our Unseen- Pixels method; Table 10 presents additional Unseen-Pixcle results against an IF-GMI attack.
E.1 BACKGROUND AND RELATED WORK ON FEATURE SELECTION SHALLOW NEURAL. NETWORKS
Feature selection within the training of shallow fully-connected neural networks is well-studied, particularly with techniques derived from the popular Lasso regularization (Tibshirani, 1996) linear models. In particular, LassoNet (Lemhadri et al., 2021) proposes to insert a skip connection directly from the inputs the output a feedforward neural network, then imposes Lasso penalty on the skip connection weights to the loss function during training, such that some of these weights would be zeroed out. The features would then be weighted the main network corresponding to their weight in the skip connection, which created the desired feature selection. A parallel approach has been to apply Group Lasso (or T2,11 norm) penalty directly fully connected layer (Zhang et al., 2020a; Scardapane et al., 2017; Zhao et al., 2015). Let un be the i-th column vector W; the Group Lasso penalty then of W = Σ ||w:|12. Adding this penalty to the loss function then allows for the zeroing out of unhelpful groups of weights in this initial matrix; each of these groups of weights correspond with an input feature. Building on this idea, the "GroupLassor AdaptttttattteGoooouo version the weights W, then uses this as a "rough data-dependent
the weights W of the initial
(GL+AGL) technique (Dinh & Ho, 2021) first calculates
a Group Lasso-regularize estimate shrink groups of parameters with different regularization strengths", creating more aggressive and consistent feature selector (Dinh & Ho, 2020). However, all of the above approaches
Table 10: Unseen-Pixce trained FaceScrub obtains very limited defense against reconstruction by IF-GMI.
Arch. Defense
% deleeed
TestAce
AffAcc@11
L2-Face AttAcce55
EvalConf
RN-152
NoDef
0.958
0.987
0.998
0.700
0,984
NoDeff-arlyStop
0
0.917
0.886
0.981
0.772
0.875
TL-DMI
0
0.911
0.420
0.691
0.946
0.401
Unseen-Pixe Pixels
97.8
0.910
0.860
0.966
0.770
0.848
NoDef
0.950
0.983
0.996
0.740
0.979
RN-18
EoDes-Ea
0.890
0.897
0.980
0.757
0.881
TL-DMI
0.906
0.515
0.760
0.935
0.492
Unseen-Pixels
97.2
0.892
0.797
0.935
0.821
0.780
25

---

Published as a conference paper at ICLR 2026
rely on the existence of set of weights in the neural network that correspond to each feature; in the deep CNNs that are the focus of our paper, such weights do not exist, and so these approaches cannot be readily applied.
As an alternative approach, Li et al. (2016) propose prepending sparse one-to-one layer D. of the same dimensions as a member of the training data, to the model; the forward pass is done through elementwise multiplication. During training, an Elastic-Net (Zou & Hastie, 2005) penalty is applied the weights D; features are removed when their corresponding weight in D vanishes. Other sim- ilar approaches include CancelOul (Borisov et al., 2019) and Feature-Aware Drop Layer (Jiménez- Navarro et al., 2024). While the above approaches are all compatible with convolutional networks, none of their empirical analyses explores the hi-res image classification scenario with deep convo- lutional networks that the subject of our paper.
E.2 A GENERAL METHOD FOR FEATURE SELECTION IN DEEP CNNS
To achieve our goal of creating mask that selects only small subset of pixels from high- resolution training data images without compromising on model utility, we use a combination of many of the above approaches. We prepend a one-to-one mask layer to the front of the CNN and perform variant GL+AGL regularization (Dinh & Ho, 2021) on this layer. More specifically, let the mask layer weights be matrix D of same shape the input images (in our experimental setting, shape 3 x 224 x 224). Then, our new model T mask is simply the normal model T after an elementwise multiplication with D: mask (X) T(X @ D).
All of our datasets are RGB images, and as such, each weight of corresponds to one RGB channel of pixel, as opposed to a whole pixel. Let Di, represent the channel for color e for pixel at position (i,j) in the image. For visual ease, seek to select pixels, channels of pixels;
do so, will apply a variant of GL+ on the group of three channels for each pixel. In our experimental settings, this creates groups (D. D D()) for each pair (i.j) where 0 S i,j S 223, for total of 224x 224 = 50176 groups. Let D Norm be a 224 x 224 matrix where D.N = [I D D.)) l12-
To create the mask use to delete training data pixels prior to training model, we proceed in two training stages: (1) Ridge base estimator creation and (2) GL+AGL feature selection. In Stage to generate the base estimator needed for GL+AGL, we apply Ridge regression to the grouped weights of D:
[()) (()) + A1 1|D
We train in Stage for 100 epochs and save the resulting mask layer î as a base estimate for Stage discarding the rest of the trained model. For Stage 2, we apply the penalty formula given in Dinh & Ho (2020) with our ridge base estimator:
_(0) = L(0) + X2 MMD),
where
224 224
D
Norm
M(D) = ΣΣ
(DNormyp'
During Stage 2, after each gradient update, we apply a threshold t to such that if D < t, then RD ag DC D is set to O within D, dropping the pixel at position (i, from model training. We begin with = 1e-6, and after epoch 10, we set 0.0025.
We train in Stage 2 for 100 epochs and save the resulting trained mask D* discarding the rest of the trained model. 1" is then altered such that any nonzero element is set to 1, so that elementwise multiplication by D* has no additional effect besides dropping the pixels it has learned to mask. This completes the creation of the mask D
Finally, the true target model is trained with the mask D* applied. The result of this 'true" training run is the "Unseen-Pixels model reported in Table 3. D* is applied as a pre-augmentation data transform, ensuring that data augmentations allow stherwise-deleted pixels to influence model training. This training run is done with identical hyperparameters and data augmentations to those described for target models in App. A.
26

---

Published as a conference paper at ICLR 2026
In Figure 1, the mask applied is D" for our ResNet- 152 Unseen-Pixels model. The reconstructions in the third column are the result of the same PPA attack on this ResNet- Unseen- Pixells model reported in Table 3.
A controls the relative strength of the ridge penalty in Stage I, and X2 controls the relative strength of the AGL penalty in Stage 2. P regulates the influence of the base estimator during Stage 2. For both ResNet-18 and ResNet-152, we set 2 = 0.01, X2 = 0.1, and p = 1. During Stages and 2, we apply only brightness, saturation, and hue augmentations: random resized cropping, con- trast augmentations, and random horizontal flipping are removed since their inclusion would allow otherwise-deleted pixels to influence mask training. All unmentioned training hyperparameters dur- ing Stage 1 and Stage 2 are identical to those described in App. A; full materials for reproduction of results are given our replication codes.
This method of feature selection is primarily intended as proof-of-coneee to test the effectiveness of MIAS on a model trained on data with large amounts of hidden pixels. The creation of the mask D' involved many design choices with how to incorporate ridge vs. lasso penalties, whether to apply Group Lasso on its own or GL+AGL, and so on; we do not claim that our approach is the optimal one within this family of design choices, or that our hyperparameter choices for '1. 22. l, and p are optimal. We leave this analysis as an interesting direction for future work in feature selection for deep CNNs.
Nevertheless, our approach succeeds in the creation of masks that allows us to delete over 97% of the training pixels in each image, such that they are never seen during training, while losing only few percentage points in accuracy. The fact that this unseen data is still devastatingly reconstructed by MIAs calls into question the intuitive role of soaninggddat-to-mmode dependencies in MIAs.
E.3 UNSEEN-PIXEL AND RECENT THEORETICAL PRIVACY RESULTS
In this section, we describe recent theoretical guarantees for data reconstruction attacks that lower- bound the variance of unbiased estimators of training data, and we describe why no such estimator exists for the hidden pixels of our Unseen-Pixels models, suggesting that guarantees based on unbi- ased reconstruction estimators are overly optimistic for the MIA setting.
The recent works of Hannun et al. (2021) and Chaudhuri et al. (2024) seek to provide theoretical guarantees on training data privacy by framing the privacy leakage issue statistical parameter estimation problem, as follows: Let z = [ .1....... "N. UN] N be formed by concate- nating all of the examples in the training dataset 'D prie-- Given a randomized learning algorithm A(z) that outputs model in hypothesis space Ht after training on data 2 Price we consider the prob- ability distribution of possible models (or set of model outputs hzx)) to be parameterized by the dataset vector The adversary then seeks to create observations h(z)); a successful estimator would leak information about the dataset vector z, cre- ating breach of privacy. To create theoretical privacy guarantees, both papers provide methods to lower-bound the variance of any unbiased estimator à; Hannun et al. (2021) introduce the con- cept using Fisher Information Loss and the Cramér-Rao bound, while Chaudhuri al. (2024) use Hammersley- chhamerslcy-Chapmaan Robbbins bounds, which are tractable to compute for deeper convolutional networks.
estimator 2 based
the observation h (or
In this statistical framing, the hidden pixels of our Unseen-Pixels models have no effect on the model or model outputs, and cannot be inferred by an unbiased estimator. This is the strongest version of this privacy guarantee from the above papers; instead of a lower bound on variance, it is simply the case that there is no unbiased estimator of the hidden pixels (or, equivalently, unbiased reconstruction estimators of the hidden pixels have unbounded variance). However, as Fig. 1 shows, in spite of this strong privacy guarantee on over 97% of pixels in the training data images, MIAs are still able cause significant privacy leakage.
This result suggests that privacy guarantees related to unbiased estimators à may not provide ade- quate privacy protection in the context of MIAs, perhaps unless they can be applied to all pixels of the input images. We hypothesize this is because of the strong prior that contemporary MIAs use in the form of pre-trained facial GAN. As mentioned in Chaudhuri et al. (2024), the requirement that 2 is unbiased is "tantamount to forbidding the use of extra, outside information such as a Bayesian prior", and that unbiasedness is "reasonable yet significant restriction". Our experiment under-
27

---

Published as a conference paper at ICLR 2026
Original Image
c=1
c=0.5
c=0.031
c=0.025
0.00225
-00.
c=0.00001
Figure 5: Adversarial examples (PGD attack) for the different perturbation magnitudes e.
scores the significance of this restriction, since the GAN prior of PPA is powerful enough to create faithful representations of faces of which less than 3% of the pixels have been seen by the target model.
We emphasize that our discussion is limited to the usefulness of privacy guarantees given by un- biased reconstruction estimators in the MIA scenario. The output of an MIA is not intended to be a pixel-by-pen exelll reconstruction of each individual image, but instead a class-representative image that captures the likeness of certain private identity. It is likely that guarantees unbiased recon- struction estimators have more success against other forms of data privacy attacks that do indeed seek exact reconstructions of individual data points, such training data extraction from generative models (Carlini et al., 2023).
On a separate note, biased estimators also discussed in similar work (Hannun et al., 2021; Guo et al., 2022); strong guarantees on biased estimators may be more applicable in the MIA experimen- tal setting, they can potentially account for the presence of strong prior information (Chaudhuri et al., 2024). We consider further exploration of the practical usefulness of privacy guarantees on biased reconstruction estimators to be interesting area for future research.
Regardless, our results caution against the idea that a strong guarantee against unbiased reconstruc- tion estimators yields universal confidentiality protections.
F ADVERSARIAL ROBUSTNESS: EVALUATION DETAILS AND CONNECTIONS TO PRIVACY
F.1 ADVERSARIAL EXAMPLES: ADDITIONAL BACKGROUND
Adversarial examples (Szegedy et al., 2014) are small noise perturbations that when added to an im- age in the dataset, changes the prediction of the model. The noise is restricted to be in a small range ||0|p c, where is the perturbation, p is the norm, and is the limit of the size perturbations. Since the perturbations are limited to very small changes, they are mostly imperceptible for humans and don't carry semantic meaning. Figure shows adversarial examples generated from Project Gradient Descent (PGD) attack (Madry et al., 2017) various Loc perturbation magnitudes
The existence of adversarial examples was first discovered Szegedy et al. (2014). Algorithms to generate them (Croce & Hein, 2020b) and defend against them (Madry et al., 2017; Shafahi et al., 2019; Wong et al., 2020) have since been heavily studied.
F.2 ADVERSARIAL EXAMPLES AND PRIVACY: RELATED WORK
Our work is inspired by many previous studies on adversarial robustness (or non-robustness) and its connection to privacy. Tursynbek et al. (2021) and Boenisch et al. (2021) show how different aspects of differentially private training (Abadi et al., 2016) can make models vulnerable to adver- sarial attacks, while Zhang& & Bu (2023) provide further analysis showing that differentially private models can indeed also be adversarially robust. Song et al. (2019) show empirically that adversar- ially robust deep learning models are often vulnerable membership inference attacks, exploring
28

---

Published as a conference paper at ICLR 2026
related factors such model capacity and robustness generalization. Hayes (2020) explores this relationship further, describing the effect of the size of the adversarial perturbation used, as well as the size of the training set. Khaled et al. (2022) show that model extraction attacks often more effective on adversarially trained models. We also consider our work related to the recent stream of evidence that more interpretable models are inherently less Privacy-preeervnng (Naretto al., 2022; Shokri et al., 2021).
Recent works also focus on the connection of adversarial examples model inversion specifically. Mejia et al. (2019) show that adversarially trained models allow for the success of previously- intractable low-resolution model inversion attacks, arguing that the more semantically meaningful feature space that AT creates (Engstrom et al., 2019; Madry et al., 2017) enhances the performance of MIAs. Separately, a recent study on black-box MIAs (Zhou et al., 2024) incorporates adversarial examples into training data in order to increase the diversity of semantically meaningful information available to the adversary.
Wen et al. (2021) proposes to defend against black-box MIAs by adding carefully-chosen adversarial noise to the output of the target model, offering impressive performance. While this defense does not apply in the white-box scenario, as adversaries would have access to the output before the adversarial noise is applicd, we nonetheless consider this work complementary to our results involving the effectiveness of AT-AT.
Our work is particularly inspired by the ideas presented in Mejia et al. (2019); we expand upon this work by 1) considering newer, high-resolution MIAs; 2) showing that recent generic MIA defenses obtain their performance through an unintended reliance on non-robust features; and 3) introducing novel algorithm, AT-AT, that allows for direct tradeoff between model inversion defense and adversarial robustness.
F.3 ADVERSARIAL ROBUSTNESS EVALUATION: DEFERRED EXPERIMENTAL DETAILS
As explained by Carlini et al. (2019), adversarial robustness (and, therefore, adversarial vulnerabil- ity) is often improperly quantified. To mitigate this issue, Carlini al. (2019) provide a checklist of actions to take to ensure proper evaluation of adversarial robustness, including performing adaptive attacks, applying a diverse of attacks, and verifying that attacks have converged. In response to this advice, the AutoAttack ensemble (Croce & Hein, 2020b) has emerged as a popular benchmark to measure adversarial robustness due to its fixed hyperparameters, automatic convergence checks, and diversity of attacks. The four primary adversarial attacks in the ensemble are 1) untargeted Auto-PGD with cross-entropy loss; 2) targeted Auto-PGD with Difference of Logits Ratio (DLR) loss (APGD-T): 3) targeted Fast Adaptive Boundary (FAB-T) (Croce& & Hein, 2020a); and 4) Square Attack (Andriushchenko
al., 2020). The two Auto-PGD variants are original to the AutoAttack paper (Croce& & Hein, 2020b). We run AutoAttack with varying Loo e-ball constraints on 1024 examples of the validation set for each of the reported target models.
F.4 DEFERRED FULL RESULTS FROM AUTOATTACK AND ADVERSARIAL ROBUSTNESS EXPERIMENTS
Tables 11, 12, 13, 14 present the full results of the AutoAttack adversarial robustness experiments for {0.031, 0.0025, 0.0005, 10-5), respectively. Specifically, for each of these values of the respective table reports robust accuracy of each defense on each dataset and architecture both (1) overall (i.e. worst-case), and (2) for each of standard AutoAttack's 's four constituent attacks: untargeted Auto-PGD; targeted DLR Auto-PGD (Croce& & Hein, 2020b); targeted FAB (Croce & Hein, 2020a); and Square (Andriushchenko al., 2020).
29

---

Published as a conference paper at ICLR 2026
Table 11: AutoAttack robust accuracies with -0.031. Attack is 8 batches (1024 validation examples).
Data
Arch.
Defense
TestAce 1 Overall
APGD-CET APGD-11 1 FAB-T
Square 1
Diffowsss that allempt to inovesse pchacy peunioalyy by reelncing information www.lencyllmmmrroooo
NoDel
0. 0.365
0.00/2
MID
0.954
0.009
0.009
0.169
0.885
RN-152
BIDO
0.928
0
0
0.0005
FaceSeruhh
TL-DMI
0.911
0
0
0.000
AT-AT
0. 0.939
0
0.035
NoDee
0.964
0
0
0
MID
0.124
0,022
0,003
0.349
0.880
RN-18
BIDO
0.884
0
0
0.004
TL-DMI
0 0.906
0
0
0.002
AT-AT
0.921
0
0.008
NoDef
0.838
0
0:003
MID
0. 8,802
0.004
0. 0.099
0. 0.066
0.306
0.705
152
TI-DMI
BIDO
0. 8.688
0.747
0
0
0.001
0.001
TL-DMI-S
0.814
D
0
0.005
Cdeba
AT-AT
0.819
0.021
NoDef
0.859
0
0.001
MID
0.737
0.003
0. 0.000
0. 120
0.591
0.624
BIDO
0.625
0
0.003
RX-18
FL-DMI
0.752
0
0
0.001
TL- TL-DMI-S
0.831
0
0
0.003
XI-ATT
0.825
0.004
AT-AT1
0.787
0.002
Diofenses that suppress pllock gradients
KoLSS-SSF
0.503
0
RoLSS
0 HSSG
0
01
0.000
RS-152
NegLSS
0. 9.996
0.782
0.004
FaceSermb
Trip MID
0. 0.927
0.023
0.001
Trap-MID
0. 0.948
0.023
0.023
RoLSS SSF
0 0.900
0
0
0.083
RoLSS
0.950
0
0
0.003
RN 18
NegLS
0 0.929
0.815
0
0
0.002
Trap MID
0 0.928
0
0
0.009
0.004
Tap-MiD'
0.9227
0
0
0.004
0.003
RoL Ro--SS-SFF
0 8-428
0
0
0
Rol SS
0. 0.537
0
0.001
0
RN-152
Negl S
0. 8.805
0.153
0.003
Coleh4
Tap-MID
Tri--MDDe
0. 806
0 0.848
D
0
0
DUDGS
0.025
0.002
0.005
Rol SS-53F
0.830
0
0.002
Rol SS
0.850
0
0.001
RX-18
Nogl.S
0.838
0. 0.006
0
0
Trap MID
0.830
0
0
0.020
0.004
Trap-MID* 0.811
0.014
0.004
Notes: to and 1o denote two sets of hyperparameters for AT-AT (see Table 6).
Table 12: AutoAttack robust accuracies with c=00025. Attack is on 8 batches (1024 validation set examples).
Defense
Overall AFGD-CE APGD-T FAB-T
Square
Defonses attewpp increase privay generically by reducing information depondency/neent botion
0.0055
0.304
0.079
0.223
0.942
0.121
0.147
0.121
FaceSerub
NoDef
0.950
0.194
0. 0.231
0.194
0.215
0.883
MID
0 0.924
0.083
0.127
0.44
0.612
0. 3.905
18
BIDO
0. 884
0.075
0. 0.089
0.075
0.092
0.779
TL-DMI
0. 8.006
0.478
0.074
NaDef
0.838
0.050
0.050
0.067
0.689
MTD
0.130
0.222
0.485
0.726
0.747
0.070
0.062
0.600
0.224
TL-DMI-S
0.814
0.541
Cdeba
NoDee
0. 0.85
0.084
0.102
0.084
0.009
0.754
MID
0.737
0.168
0. 2.226
0.423
0.651
0.650
BIDO
0. 0.022
0.000
0. 0.0000
0.007
0.011
0.445
R8-18
TL-DMI
0.752
0.517
TL-DMI-S
0.831
0.517
AT !T-
0.825
0
0
0.388
XI-AF1
0.787
0.191
Diffenas supprass
RoLSS
0.009
0.767
NegL.S
FuceSerob
Trip-MID
MID
0.948
0.023
0.037
RoLSS SSP
0.
0. 2.002
0.013
0.882
RaLSS
0. 0.550
0.002
0. 0.004
0.002
0.008
0.860
RN-18
NegL.S
0.
0.215
0 8.814
0.215
0.238
0.818
Trip-MID
0.010
0.285
Trap
0.018
SS-S3F
0.4238
0.185
0.234
NegL.S
0.013
0.184
0.018
0.624
Cobb-
Trap-MID
Trap-MID*
0.49
0 0.833
0.08
0. 0.0004
0.08
0.008
0.729
RoLSS
0. 0.8300
0.066
0. 0.078
0,070
0.083
0.709
RN-18
NegLSS
0. 0.8558
0.100
0.147
01 0.100
0.134
0.724
Tri--MID
0.830
0.044
0.144
0.044
0.078
0.680
Trap-MIn*
0.811
0.015
0.069
Notes: to and
16 denote two sets of hyperparameters for AT-AT (see Table 6).
30

---

Published as a conference paper at ICLR 2026
Table 13: AutoAttack robust accuracies with c=0.005. Attack is on 8 batches (1024 validation examples).
Data
Arch.
Defense
TestAce 1
Overall
APGD-CE APGD-I: 1 FAB-T
Square 1
Diefowss that allempt to inovesse pchacy peunically by reclucing information dewwadennyy/nmmmon wwt.:////mmmmmooooooooo
NoDel
0.365
0.200
0. 0,0000
0. 1.550
0. (..00
0. 0.955
MID
0.954
0.770
0.7133
0.849
0.504
0.941
RN-152
BIDO
0.928
0.547
0.848
0.547
0.545
0.91
FaceSeruh
TL-DMI
0.911
0
0
0.301
AT-AT
0. 0.939
0
0.516
NoDDe
0.964
0.89G
0.806
0.896
0.596
0.946
MID
0.924
0.822
0.871
0.9100
0.898
0.904
RN-18
BIDO
0.884
0.784
0.785
0. 0.784
0.786
0.859
TL-DMI
0.906
0.903
0.004
0.003
0.005
0.843
AT-AT
0 0.921
0
0
0
0.696
NoDef
0.838
0.875
0.677
0.875
0.675
0.300
MID
0. 8,802
0.542
0. 70704
0.726
0.717
0.728
R5-
BIDO
TI-DMI
0. 0.688
0.747
0.002
0.590
0. 0022
0. 8.800
0. 4.590
0.002
0.500
0.004
0.550
0.717
TL-DMI-S
0.814
0.119
0.130
0.119
0.132
0.765
Cdeba
AT-AT
0.819
0
0
0.104
NoDef
0.850
0.746
0. 0.748
0.746
0.747
0.535
MID
0.737
0.452
0. 0.600
0.636
0.630
0.646
BIDO
0.625
0.394
0. 0.398
0.394
0.596
0.581
RX-18
FLDDMI
0.752
0.028
0 0037
0.028
0.041
0.656
TL-DMI-S
0.831
0.146
0.154
0.146
0.165
0.763
NI-ATT
0.825
0
01
0.721
AT-AT1
0.787
0
0.617
Tiofenses that suppress pllock gradients
KoLSS-SSF
0.503
0.721
0:721
0.721
0.223
0.341
RoLSS
0 HSSG
0.744
0.747
0.744
0.750
0.868
RS-152
NegLS
0. 9.906
0.769
0.828
0.709
0.769
0.882
FaceSermb
Trap MID
0. 0.927
0
0
0.023
0.790
Trip-MIDe
0. 0.948
0.025
0.800
RoLSS SSF
0.950
0.813
0.836
0.813
0.820
0.941
RoLSS
0.950
0.819
0.822
0.819
0.826
0.938
RN- 18
NegLS
0.929
0.854
0 868
0.854
0.854
0.916
Trap MID
0. 0:928
0.530
0 1.565
0.548
0.585
0.852
Tap-MiD'
0.922
0
01
0.004
0.833
Rol SS-SSS
0 0-128
0.042
0. 048
0.042
0.064
0.394
Rol SS
0. 0.537
0.086
0. 004
0.087
0.102
0.494
RN-152
Negl S
0. 8,805
0.559
0.678
0.569
0.562
0.749
Coleh4
Tap-MID
Tri-MMDDe
0 0.806
0 0.848
0.333
D 0.412
0
0
0.338
0.025
0.409
0.601
0.787
Rol SS-S3F
0.839
0.723
0. 7.7
0.723
0.725
0.519
Rol SS
0.850
0.701
0. 7.704
0.701
0.702
0.796
RX-18
NogL.S
0.838
0.711
0.711
0.711
0.712
0.803
Trap MID
0.830
0.885
0.732
0.685
0.690
0.812
Tra- MID*
0.811
0.001
0.001
0.001
0.016
0.724
Notes: to
and 1o denote two sets of hyperparameters for AT-AT (see Table 6).
Table 14: AutoAttack robust accuracies with e=10- Attack is on 8 batches (1024 validation set examples).
Defense
Overall
AFGD-CE APGD-T FAB-T
Square
Dofonses attewpp increase privcy generically by reducing information depondency/eemmon
0.3055
(.5m%)
(15KY]
0.560
RN-152
0:950
0.928
0.944
0.923
0.923
FaceSerub
0.867
0.902
0.930
0.127
NoDef
0.950
0.959
0. 9.909
0.959
0.959
0.959
MID
0 0.924
0.856
0 9.000
0. 0.905
0.898
0.914
R8
BIDO
0 884
0.879
0. 830
0. 9.879
0.679
0.881
TL-DMI
0. 8.006
0.386
0. 857
0. 88866
0. 688
0.800
AT-AT
6.921
0.911
NoDef
0.818
0.818
0.818
0.819
0.820
MTD
0.574
0.729
0.723
0.720
0.733
0.747
0.748
0.749
0.748
0.748
0.751
TL.DMI
0.641
0.644
0.641
0.643
0.668
TL-DMI-5
0.814
0.799
79999
0.811
Cdeba
0.819
0.178
0.157
NoDee
0. 8.5
0.548
0.848
0.548
0.548
0.845
MID
0.737
0.464
0.644
0.648
0.651
0.646
BIDO
0. 0.625
0.609
0. 0.609
0.609
0.609
0.611
R8-18
TL-DMI
0.752
0.718
0.718
0.718
0.719
0.734
TL-DMI-S
0.831
0.802
808
0.802
0.503
0.816
AT !T-
0.825
0.756
0. 0.758
0.756
0.757
0.802
XI-Ar1
0.787
0.601
0.645
0.652
0.786
Diffeuis supprass
0.857
0.857
0.380
RoLSS
0.862
152
NegL.S
FuceSerob
Trip-MID
0.456
MLD
0.948
0.943
0.943
0.943
0.843
0.948
RoLSS SSP
0. 2.950
0.951
0. 0.952
0.951
0.952
0.954
RaLSS
0. 0.050
0.948
0 0.945
0.948
0.648
0.951
RN-18
NegI.S
0. 0.9229
0.933
0 0.933
0.933
0.633
0.934
Trip-MID
0.014
0.914
0.914
0.514
0.916
Trap
0.921
0.921
0.984
SS-S3F
0.4258
0.406
0.308
0.406
0.408
0.414
0.530
0.530
0.630
0.538
NegL.
0.771
0.771
0.771
0.776
Cobb-4
Trap-MID
Trap-MID*
0.848
0.828
0.760
0.828
0.835
0.8:3
0.834
0.834
0.884
0.534
0.834
RoLSS
0. 0.8300
0.813
0.813
0.813
0.534
0.815
R8-18
NegLS
0. 0.813M
0.825
0. 0.825
0.825
0.825
0.825
Mri--MID
0.830
0.837
0 8.8
0.527
0.528
0.829
Trap-MIn*
0.811
0.790
0.790
0.780
0.791
0.809
Notes: to and
16 denote two sets of hyperparameters for AT-AT (sée Table 6).
31

---

Published as a conference paper at ICLR 2026
G DEFERRED PRIVACY-ROBUSTNESS REGRESSION ANALYSIS DETAILS AND RESULTS
Section 4 investigates whether the privacy associated with mainstream generic information dependency-baie -ased defenses (MID, BiDO, TL-DMI) is actually correlated with, or explained by, tradeoff with adversarial robustness. Concretely, we ask:
1. Can we perfectly predict MIA leakage (AttAcc@) 1) just from defense's robust accuracy under AutoAttack?
2. For each percentage point reduction in leakage (AttAco@) under PPA or IF-GMI,, what is the associated cost in terms of robust accuracy under AutoAttack at different e, which capture non-robust features of different magnitudes (See Fig. 5).
We accomplish this by presenting the first systematic tests of the robustness of MIA defenses to very different attack vector: adversarial examples. Tables 11, 12, 13, 14 in App. F.4 report robust accuracies under each of AutoAAtack's constituent attacks. Specifically, we are interested in the standard AutoAttack robust accuracy, which is the worst-case robust accuracy across the various attacks in the AutoAttack ensemble, at various magnitudes e. This is reported in Table 4.
To obtain a principled test of whether these raw AutoAttack and privacy leakage results reflect a relationship between leakage and robustness under AutoAttack, we consider the following simple main regression specifications. These standard regression models test the degree to which privacy leakage (our response variable, measured by AttAcc@1 E [0, 1] under PPA or under IF-GMI) is linear function of a defense's s robust accuracy under AutoAttack at several perturbation magnitudes, above and beyond its clean test accuracy (control variable). Intuitively, these models ask: holding clean accuracy fixed, do defenses that are less robust to small adversarial perturbations (i.e., that rely more on non non-robust features) exhibit less leakage under MIA?
Specifically, the following OLS model estimates the magnitude and significance of this privacy- robustness relationship:
LeakageAnAw@@1,
1.Aco = + 31
+
+ te (4)
We careful to also estimate Beta regression variants with appropriate distributional assumptions and logit link (g(z)) to capture the fact that the response (AttAco@) under PPA or IF-GMI) is bounded in [0, 1]:
LeakageAnscc@1,, Beta(1y0, (1- 15))))
s(m,g B1 TestAccy Jo0, Acoe= A00
Because we estimate these models using relatively small number of observations, we are also careful to report, for OL.,, the appropriate small sample-robust HC2 standard errors. We are also careful to compute confidence intervals with the conservative small sample to 16.97611322.660 (with the HC2 SEs) and report adjusted R.2. Beta regressions already accommodate appropriate assumptions, so we report CI with the standard Wald (+1.9) on the logit scale.
To evaluate goodness-of-ff fit, we report degree-of- adjusted R2 (for OL or the appropriately estimated pseudo- R² (for Beta regressions). For all specifications, we also report Mean Absolute Error (MAF) on the response scale.
Figure visualizes the fitted values.
Interpretation (units and signs). All accuracies and leakages are in [0, 1] during estimation; for readability we discuss effects in percentage points (pp). A positive regression 39, 83, and/or 84 means that, holding clean accuracy fixed, higher robust accuracy at that respective is associated with higher leakage (worse privacy). Equivalently, privacy gains from generic defenses coincide with losses in robustness to small perturbations (i.e., increased reliance non-robust features). The coefficient 31 captures any residual association between clean accuracy and leakage after condition- ing on robustness.
Defenses, scope, and limitations. In keeping with our hypothesis that generic defenses work, at least in part, by shifting their models' feature bases towards non-robust features, we estimate regressions
32

---

Published as a conference paper at ICLR 2026
this set of defenses (MID, BiDO, TL-DMI, and TL-DMI-5 where applicable). Note that TL-DMI- 5 is a variant of TL-DMI with 5 layers frozen instead of the standard 6 layers, which we include alongside the standard TL-DMI to give this defense the best opportunity to perform well on lower- capacity ResNet-18 networks that have fewer layers.
We then reestimate all regressions the dataset of gradient-suppressing defenses (NegLS,, RoLSS, RoLSS-SSF). SSF), which directly target PPA/IF-GMI gradients, as we do not hypothesize that these defenses work via non-robust features.
We emphasize that these regressions provide correlational evidence, and do not by themselves prove causality. Our separate randomized AT-AT experiment (Section 5) provides causal evidence by treating the model's reliance on non-robust features in a randomized controlled experiment and observing the induced change in leakage.
G.1 DEFERRED OLS AND BETA REGRESSION RESULTS.
We find that leakage (AttAcc@) under both PPA and IF-GMI) strongly and significantly corre- lated with robust accuracy all levels of (note p values), with R 0.995, and mean abs. error of just 0.042-0.05, Contrary to widespread belief, (2) clean test accuracy is only weakly or insignificantll correlated with leakage after controlling for robust accuracy. To examine the bustness of these results to different regression specifications, PPA versus IF-GMI attack leakage, different distributional assumptions, controls for dataset/arcciitettue,, various robust standard errors estimators, etc., we show that these results hold across 56 alternate regression specifications.
Specifically, Table 15 presents full deferred OLS and Beta regressions for NoDef and generic de- fenses (MID, BiDO, TL-DMI), which we hypothesize unintentionally obtain their privacy from non-robust features.
Table 18 recomputes these regressions on generic privacy defenses using IF-GMI AttAcc@) I to measure privacy leakage (response variable) instead of PPA. A similar strong relationship exists between robust accuracy and leakage using the IF-GMI AttAco@) as leakage measure.
Table 16 recomputes these regressions using PPA AttAco@ 1, but on gradient defenses (NegLS, RoLSS, RoLSS-SSEP SSF), which we do not hypothesize to work via non-robust features. As expected, the regression results do not show the same strong, significant relationship between leak- age and non-robust features. Also note that the model fit metrics (e.g. R²) are far lower for these suppresn-suppressing defenses.
Table 19 shows that the lack of clear, significant relationship between leakage and non-robust fea- tures for suulient-upppressing defenses (NegLS, RoLSS, RoLSS-SSF) persists when we measure leakage via IF-GMI AttAcc@) I instead of PPA AttAcc@1.
Finally, Tables 17 and 20 present multiple additional 'robustness test' regressions, showing that the strong and highly statistically significant relationship between leakage and non-robust features is not merely an artifact of the regression specification. Specifically, Tables 17 and 20, left side show that controlling for dataset interactions still yields significantly worse fitting regression model compared to the non-robust features regressions described above, regardless of whether leakage is measured via PPA attacks (Table 17) or IF-GMI attacks (Table 20). Tables 17 and 20, right side show that the same applies when we instead control for architecture interactions. Note that the goodness- of-fit metrics in both cases are inferior to the goodness-of -fosss--fffii of- metrics for non-robust regressions.
Using coefficients to estimate the cost of privacy. Per the Beta model, we can compute that reducing PPA leakage (AttAce@) 1) by percentage point (pp) corresponds to significant 0.31 pp decrease in AutoAttack robust accuracy at c=0.0025, (95% CI: 0.24- a significant 5.4 pp decrease at e=0.0005 (95% Cl: 2.9-58.3). and a significant 0.91 pp decrease at 1-10- (95% Cl: 0.60-1.93). To derive these "costs' of privacy, note that in Beta regression with logit link (Eq. 2). logit(u), X, coefficients 3. live the link scale. The response-scale marginal effect of robust Ø F[
accuracy at expected leakage is
Be n11
1). Evaluated at the sample mean
0 Acc.
33

---

Published as a conference paper at ICLR 2026
leakage P from the regression sample, the robustness cost of pp privacy gain is the inverse slope
① Acc.
1
Te- e Leakage
(pp of robust accuracy per 1 pp change in leakage),
Be P1 (a)
Confidence intervals. Using the delta method, if we treat j fixed, SE(f.) =
8y SE(3.) =
03,
SE(3.). so a 95% CI 9. 1.96 SE(G.). More generally, allowing for uncertainty in
(3,P the parameter ju:
Var(fc)
~
Or
Var(3e)
+
07 8y
Var(A)
By 8n +
Cov(Be. 83, on
link coef.
leakage
1 and 07
2p
with 07 83, 82 p(1 p)) By
B. (1 1²)² In practice we report CIs using the fixed-Pi -i
version (slightly narrower); including Var(ū) yields virtually identical conclusions.
Table 15: Linear (OLS) Beta regressions quantifying the privacy-robustnes tradcoff for generic informa-
tion dependency-baseee privacy defenses under various specifications. Leakage (response) is PPA AttAce@1 SE's in parentheses; OLS MacKinnon & White (HC2) small-sample robust SE's in brackets. Test accuracy is clean; e's are robust accuracies under the AutoAttack ensemble at the indicated noise levels. Note that Beta coefficients are the logit scale.
All Predictors
All
Clean Acc.
D.0.5
000000
OLS
Bela
OLS
Bela
OLS
Bela
Bela
Betu
OLS
Beta
Predictors
Acc.
0.01
0.192
1,759*
7,495"
(0.390)
(1.582)
(0.477)
(2,041)
[0:478]
[0.458]
c0000055
2
12,82
2
12.685
3
13.689*
(0.452)
(2.010)
(0.363)
(1.672)
(0. (0.604)
(2.694)
[0.739]
[0:428]
[0.768]
c0.0005
0.211
0.737'
0,212
0.748'
0.639
2.915
(0.080)
(0.325)
(0:074)
(0.313)
(0.090)
(0.442)
[0.108]
[0:083]
[0.084]
1=10
0.795
4,390
0.788
4
0.969
4,561
(0.285)
(1.180)
(0.130)
(0.597)
(0.378)
(1.524)
[0.360]
[0.113]
[0.474]
Fii Mtiisiiss
12
0.934
0.952
0.939
0.952
0.425
0.485
0.590
0.613
0.743
0.733
0.247
0.304
Mean ahs,
0.047
0,042
0.047
0.042
0.156
0.151
0.126
0.124
0.099
0.095
0.186
0.181
Note: H' are Adjusted (OLS); Pseudo (Beta).
P<0.1:
0.00.
PP=0.01
Table 16: Linear (OLS) & Beta regressions quantifying privacy-robustness tradeoff for attack gradient sup-
pressor defenses (NegLS, RoLSS, RoLSS-SSF) under various specifications. Leakage (response) is PPA
AttAce@1 1. SE's in parentheses; OLS MacKinnon & White (HC2) small- sample robust SE's brackets. Test accuracy is clean; e's are robust accuracies under AutoAttack at the indicated noise levels. Note that Beta coef- ficients are on the logit scale.
All Predictors OLS
All
Clean Acc.
0.0025
0.0005
c= 10
Beta
OLS
Beia
OLS
Beta
OLS
Bela
OLS
Beta
OLS
Beta
Predictors
Test Acc.
-2.016
-0.033
1,296
6,434
(8,500)
(27.413)
(0.353)
(1.721)
[3.780]
[0.282]
000025
-0.167
-0.912
-0.026
-0.908
1.264
4,883
(1.419) (4.615)
(1.211) (4.189)
(1.327) (4.833)
[0.785]
[0.646]
[0.906]
e0.000
0.737
2.868
0,547
2.862
0.780
3.805*** (0.208)
(1.808)
(6.437)
(1.481) (5.743)
(1.025)
[0.537]
[0.691]
[0.125]
c=10
2,018
1.759
0.387
1.717
1.258**
6.171
(7.307)
(23.662)
(2.326)
(8.951)
(0.340)
(1.649)
[4.667]
[1,33]]
[0.282]
Fit statisties
R.
0.355
0.727
0.431
0.727
0.532
0.718
-0.008
0.080
0.543
0.722
0.535
0.713
Mean abs.
0.120
0.124
0.123
0.124
0.137
0.131
0.194
0.195
0.122
0.118
0.135
0.129
Note: R are Adj. (OLS); Pseudo (Beta).
P<0.05:
"p=0.01:
p=00.001
34

---

Published as a conference paper at ICLR 2026
Table 17: Robustness checks: Leakage regressions with Clean Accuracy Dataset Clean Accuracy Architecture interaction as an alternate explanation for leakage of generic information dependency-baue -based defenses. Leakage (response) is PPA AttAcc@ 1. Left: Dataset interaction: Right: architecture interaction (ResNet-152) 152 vs. ResNet-18), SE's in parentheses; OLS MacKinnon & White (HC2) small-sample robust SE's in brackets.
OLS
Bela
OLS
Beta
(nterceptt
1.055
6.997
(Intercept)
-1.021
-6.447*
(0.664)
(2.714)
(0.650)
(2.527)
[0.412]
[0.617]
Test Acc.
1.805
8.188
Test Acc.
1.719*
7.320*
(0.860)
(3.469)
(0.762)
(2.944)
[0.538]
[0.785]
DatasctFaceSerub
-3.983
18.816
ArchRN-18
-0.051
-0.203
(2.688)
(10.302)
(0.866)
(3.395)
[3.746]
[0.775]
Test Facesaaa
4.257
20.047
Test Acc.:ArchRN-18
0.112
0.443
(2.940)
(11.282)
(1.024)
(3.989)
[4.042]
[0.988]
R
0.442
0.574
R
0.353
0.493
Mean abs, err.
0.150
0.146
Mean abs.
0.155
0.152
Note: R² are Adj. (OLS); Pseudo (Beta).
0=c0.1; "p<0.05; "* "p=00.01
Table 18: Linear (OLS) & Beta regressions quantifying the privacy aavacc-robustness. tradeoff for generic infor-
privacy defenses under various specifications. Leakage (response) IF-GMI AttAce@1. 1. SE's in parentheses; OLS MacKinnon & White (HC2) small-sample robust SE's brackets. Test
mation dependency-
accuracy is clean; e's are robust accuracies under the AutoAttack ensemble at the indicated noise levels. Note that Beta coefficients
the logit scale.
All Predictors
All
Clean Acc.
0000225
00000
< 10
Predictors
0.496
-7.272"
1,343"
7.146
(0.827)
(3.149)
(0.471)
(2.102)
[1.116]
[0.466]
<000005
2 20.719
2.153"
13.175
2
13,590
(0,960)
(4.438)
(0.781)
(3.688)
(0.642)
(3.129)
[1.766]
[1.049]
[0.748]
000000
-0.686
0.056
-0.043
0.458
2.249
(0.169)
(0.622)
(0.160)
(0.663)
(0.117) (0.555)
[0.257]
[0.204]
[0.108]
1=10
1,072
10,162"*
0.752"
4.688
0.787"
4.146"*
(0.605)
(2.598)
(0.279)
(1.268)
(0.349) [0.389]
(1.507)
[0.840]
[0.221
R
0.628
0.837
0.645
0.801
0,295
0.361
0.418
0.486
0.460
0.488
0.194
0.301
Meam abs, etr.
0.094
0.143
0.138
0.129
0.124
0.167
0,166
Note: Adjusted (OLS); Psendo (Beta).
0=10
0=0005:
p=00.01
35

---

Published as a conference paper at ICLR 2026
Table 19: Linear (OLS) & Beta regressions quantifying privacy-robustee tradeoff for aftack gradient sup- pressing privacy defenses (NegLS, RoLSS, RoLSS-SSF) under various specifications. Leakage (response) is IF-GMI AttAce@ 1. SE's in parentheses: OLS MacKinnon & White (HC2) small-sample robust SE's in brackets. Test accuracy is clean; e's are robust accuracies under AutoAttack at the indicated noise levels. Note
that Beta coefficients are the logit scale.
All Predictors
All
Clean Acc.
e=0.02
+=00005
10
OLS
Beta
OLS
Beta
OLS
Beta
OLS
Beta
OLS
Beta
OLS
Bela
Predictors
Test Acc.
3.326
6.828
1,577 6.567**
(11,153)
(37.227)
(0.490) [0.314]
(2.107)
[4.541]
c000025
1.102
2.484
0.870
2,015
2.513
6.428
(1.861)
(6.437)
(1,591)
(5.876)
(1.606) (5.551)
[0.945]
[0.742]
[1.186]
=000005
0.826
2.483
1.172
3.233
0.975
4.027*
(2.373)
(8.159)
(1.948)
(7.188)
(0.281) (1.254)
[0.617]
[0.850]
[0.146]
<=10-
-3.149
-4382
-0.460
1.049
1.518"
6.327
(9,587)
(32.113)
(3.059)
(11.264)
(0.477)
(2.040)
[5.097]
[1.579]
[0.314]
Fill statistics
R
0.336
0,595
0.412
0.593
0.459
0.572
0.116
0.137
0.501
0.589
0.453
0.569
Mean abs, emr.
0.157
0.180
0.160
0.183
0.196
0.201
0.249
0.264
0.177
0.188
0.197
0.201
Note: Rº are Adj. (OLS); Pseudo (Beta).
p=00.05:
P=-0.01;
p=c0.001
Table 20: Robustness checks: Leakage regressions with Clean Accuracy x Dataset or Clean Accuracy x Architecture interaction alternate explanation for the leakage of generic information dependency based defenses. Leakage (response) IF-GMI AttAcc@ Left: Dataset interaction: Right: architecture interaction (ResNet-152 vs. ResNet-18), SE's parentheses; OLS MacKinnon & White (HC2) small-sample robust SE's in brackets.
OLS
Beta
OLS
Beta
(Intercept)
-1.33
7.277
(Intercept)
00.22
-,336
(0.635)
(2.722)
(0.634)
(2.604)
[0.509]
[0.842]
Test Acc.
2.520**
9.987
Test Acc.
1.136
7.187
(0.822)
(3.541)
(0.743)
(3.093)
[0.634]
[1.028]
DatasetFaceSerub
-0.63
13.955
ArchRN-18
-0.300
0.158
(2.570)
(11.315)
(0.844)
(3.436)
[3.777]
[0.883]
Test Dacusa
0.382
14.268
Test Acc::ArchRN-18
0.428
0.026
(2.810)
(12.406)
(0.998)
(4.107)
[4.109]
[1.088]
Rd
0.471
0.474
R
0.363
0.369
Mean abs,
0.127
0.126
Mean abs.
0.144
0.138
Note: R² are Adj. (OLS); Pseudo (Beta).
0=<0.1 pp50.55 0=0.01
H DEFERRED DETAILS OF RANDOMIZED CONTROLLED EXPERIMENT: AT-AT CAUSES PRIVACY
Causal effect of AT-AT non-robust feature reward term on privacy. By design, note that AT-AT with simplifies to vanilla training i.e. NoDef. Therefore, to estimate the causal effect of including AT-AT's non-robust feature reward term (i.e. x>0) on privacy, we train 10 RN-152's on
FaceScrub and randomly assign half as 'control' x=0 (equal to Vanilla/NoDef) and half as 'treat- ment' X>0. For treatment units, we use the default X = 0.04 used throughout our experiments (See App 6).
Causal OLS (ATE on the probability scale). Let Y, = Leakage, (AttAcc@) I for model j) and D, = 1 1(2 > 0} indicate assignment to nonzero X, i.e., treatment with the AT-AT non-robust reward in the loss function. With complete randomization, D, 1 (Y), (1)) and the ATE is (1) - (0)). We estimate
Y, T DD ujz
Eluy Djj = 0.
(6)
36

---

Published as a conference paper at ICLR 2026
and report HC2-robust SEs with small small-sample t critical values.
Causal Beta regression (randomized AT-AT vs. control). As before, we note that the response (AttAcc@) 1) bounded in [0,1]. thus we also estimate the causal effect via the appropriate beta regression. Let Y = Leakage, (AttAco@) for model j) and Dj 1(2; > 0} indicate assignment to AT-AT (treatment). Under complete randomization, Dj 1 (Y,(0), (1)).
Yj Beta( (1 pz)d), (15) = + DD.
(7)
Odds-ratio interpretation. The treatment effect on the log-odds scale is r; the odds ratio is exp(r). A "77x reduction in odds" corresponds to exp(T) = 11/77, i... 7 -n 77.
Percentage-ponn ppint effect (ATE response scale). Let μıo logit ((ait and μl logit "(eit="(aa0 r). The average treatment effect on the response scale is
= E|y, Dj = 1|, D2 = μn 11--0 vo (in proportion units; multiply by 100 for pp).
Inference. We estimate (7) by MLE and report Wald z-tests and 95% Cls. For T. 95% CI for the odds ratio is exp 1.96 (B(()) For A, use the delta method with gradient (0A/0a, 0A/0r) (M1(1 (1) Mo po), p1 pı)):
Var(A) R gd Var 7 (
9 = (MI(1 11) - Mo(1 HO))
11 H1)
and 95% Cs Á L96SE((),
Causal inference results. Table 21 reports causal inference results. In particular, beta regression of PPA AttAcc@) I on treatment shows that AT-AT's non-robust term causes 77x reduction leakage odds (2=38.0, p<10-16 16 6.5% reconstruction rate under AT-AT vs. 84% for control).
Table 21: Causal regressions of leakage (AttAce@) 1) AT-AT assignment. OLS 95% CIs use HC2 SEs with f0.975.8 2.306; Beta Wald (+1.96SE) on the logit scale. Baseline is NoDef; the cocfficient AT- AT (Treatment) is the effect relative to NoDef. Odds ratio (AT-AT vs NoDef) from Beta: 0.0130 (95% Cl: 0.0104-0.012)..
OLS 95% CD)
Beta (1 95% CT)
Intercept (NoDet)
0.842 1 0.029
1.677 1 0.126
AT-AT (Treatment)
-0.778 + 0.029
-4.344 + 0.224
R
0.9976 (adj.)
0.995 (pscudo)
We can similarly identify the causal effect AT-AT on L2 reconstruction distance. Specifically, we recompute the OLSS regression replacing the response with our 1.2 reconstruction distance evaluation metric (note that there is no need for beta regression for 1.2 response). We find that treating with non-robust features via AT-AT's reward increases the L.2 reconstruction distance by 0.430 + 0.017:
Table 22: OLS regression of reconstruction distance (Lz) on AT-AT assignment. 95% CIs use HC2 SEs with f0.975,8 2.306. Bascline is NoDef;; the coefficient on AT-AT (Treatment) the effect relative to NoDef.
OLS 95% CT
Intercept (NoDel)
0.786 1 0.012
AT-AT (Treatment)
0.430 0.017
R²
0.9973 (adj.)
I MIA DEFENSE EXTENDED RESULTS
Table 23 presents full results and privacy metrics for AT-AT and all baselines on FaceScrub and CelebA using the standard ResNet- 152 architecture. These results are an extended tabular version of Fig. 4.
37

---

Published as a conference paper at ICLR 2026
1.1 QUALITATIVE COMPARISONS
Fig. shows examples of original images side-by-side with their respective PPA attack reconstruc- tions under each defense. To avoid cherr-picking images to include in this comparison, display the reconstructions for which the evaluation model is maximally confident that the reconstruction class matches the original class.
Defence
Trap-MI
Figure Image reconstructions generated from PPA attacks for each defense applied ResNet- 152 trained on FaceScrub. avoid cherry- picking, each image is selected by maximum confidence on evaluation model (worst case).
1.2 OTHER ARCHITECTURES AND DATASETS
Table 24 presents full results and privacy metrics for AT-AT and all baselines run on FaceScrub and CelebA using the DenseNet- 169 architecture. Table 25 presents the results of the same experiments rerun using the lower-capacity ResNet-18 architecture.
Table 26a presents PPA attack results and privacy metrics for AT-AT and all baselines using the standard ResNet- 152 architecture on the Stanford Dogs dataset. Table 26b presents the results the same experiments for the lower-capacity ResNet- 18 architecture.
38

---

Published as a conference paper at ICLR 2026
1.3 TABLES INCLUDING CONFIDENCE INTERVALS
We note that the main results tables, Tables 23 and 25, omitted confidence intervals for readability. We therefore include these confidence intervals separately below. Specifically, Tables 27 and 28 expanded versions of the main MIA results (Tables 23 and 25) that add the deferred per-class or per-image confidence intervals. More specifically, for the AttAcc @ 1/AttAcc @ 5 metrics, we run per-image 95% Wilson confidence interval with the proportion p =AttAcc@ @ 1/AttAco@5 and the sample size n equal to the total of images on which attack accuracy calculated (for FaceScrub, = 26500, and for CelebA, target classes, we run a 95% per-class t-interval on the list of L2 metric values for each attack target class (of length 530 for FaceScrub, and length 75 for CelebA).
3750). For the L.2 distance metric, as it is mean over attack
J REQUIRED LLM DISCLOSURE
LLMs were used in the creation of this paper to (1) read for typos, and (2) to suggest LaTeX format- ting fixes (table spacing, algorithm watermark, etc.). LLMs were not used to write the paper, code the experiments, or for research ideation.
39

---

Published as a conference paper at ICLR 2026
Table 23: Full privacy experiments results: AT-AT vs Baselines on standard ResNet-152 architectures on
CelebA and FaceScrub data under PPA, IF-GMI, and PPDG attacks.
Data
Attack Defense
TestAce i AttAcc@1 AttAcc@5 + L2 EvalCon!'
Defenses that attempt to increase privacy generically
NoDef
0.958
0.882
0.980
0.768
0.862
MID
0.950
0.391
0.699
0.950
0.364
PPA
BiDO
0.928
0.780
0.949
0.820
0.756
TL-DMI
0.911
0.190
0.435
1.057
0.178
AT-AT
0.939
0.058
0.190
1.224
0.055
FaceSerub
NoDef
0.958
0.987
0.998
0.700
0.984
MID
0.950
0.391
0.668
1.002
0.365
IF-GMI
BiDO
0.928
0.937
0.988
0.792
0.927
TL-DMI
0.911
0,420
0.694
0.946
0.401
AT-AT
0.939
0.084
0.238
1.216
0.080
NoDef
0.958
0.902
0.979
0.805
0.890
MID
0.950
0.343
0.583
1.056
0.315
PPDG
BiDO
0.928
0.799
0.937
0.885
0.777
TL-DMI
0.911
0.142
0.338
1.125
0.132
AT-AT
0.939
0.022
0.084
1.353
0.021
NoDel
0,838
0.497
U.753
0.843
0.473
MID
0.802
0.474
0.725
0.821
0.450
BiDO
0.747
0.362
0.629
0.923
0.340
PPA
TL-DMT
0.688
0.080
0.221
1.103
0.075
TL-DMI-5
0.814
0.281
0.550
0.929
0.265
AT-AT
0.819
0.049
0.138
1.245
0.044
NoDer
0.838
0.793
0.940
0.770
0.773
CclebA
MID
0.802
0.728
0.864
0.836
0.709
BiDO
0.747
0.597
0.834
0.867
0.575
IF-GMI
TL-DMI
0.688
0.258
0.513
0.964
0.243
TL-DMI-S
0.814
0.661
0.883
0.805
0.641
AT-AT
0.819
0.188
0.377
1.140
0.181
NoDef
0.838
0.559
0.796
0.863
0.536
MID
0.802
0.491
0.688
0.928
0.461
BiDO
0.747
0.389
0.647
0.956
0.368
PPDG
TL-DMI
0.688
0.079
0.206
1.157
0.076
TL-DMI-S
0.814
0.319
0.585
0.959
0.303
AT-AT
0.819
0.023
0.071
1.430
0.021
Defenses that suppress attack gradients
NegLS
0.906
0.160
0.365
1.151
0.152
RoLSS
0.886
0.474
0.760
0.858
0.450
PPA
RoLSS-SSF
0.869
0.343
0.635
0.918
0.322
Trap-MID*
0.949
0.587
0.830
0.920
0.556
Trap-MIID
0.926
0.401
0.676
0.980
0.376
FaceScrub
NegL.S
0.906
0.147
0.352
1.199
0.142
RoLSS
0.886
0.522
0.785
0.884
0.499
IM-GMI
RoLSS-SSF
0.869
0.373
0.657
0.956
0.354
Trap-MID'
0.949
0.714
0.792
0.939
0.705
Trap-MID
0.926
0.618
0.738
1.004
0.603
NegLS
0.906
0.105
0.245
1.247
0.101
RoLSS
0.886
0.456
0.742
0.910
0.432
PPDG
RoLSS-SSF
0.869
0.294
0.558
0.999
0.272
Trap-MID*
0.949
0.634
0.813
0.958
0.616
Trap-MID
0.926
0.425
0.665
1.039
0.408
NegL.S
0.805
0.340
0.623
0.908
0.321
RoLSS
0.537
0.046
0.145
1.147
0.043
PPA
Rol SS-SS-
0.428
0.039
0.118
1.183
0.035
TraD-MID*
0.806
0.092
0.193
1.358
0.088
Trap-MID
0.847
0.330
0.569
0.944
0.309
NegL.S
0.805
0.554
0.811
0.885
0.532
CelebA
RoLSS
0.537
0.045
0.145
1.172
0.042
IF-GMI
RoLSS-SS
0.428
0.044
0.131
1.218
0.040
Trap-MID*
0.806
0.168
0.223
1.437
0.163
Trap-MID
0.847
0.417
0.601
1.004
0.403
Ne
0.805
0.331
0.580
0.955
0.314
RoLSS
0.537
0.038
0.110
1.266
0.035
PPDG
RoLSS-SSF
0.428
0.029
0.093
1.295
0.027
Trap-MID*
0.806
0.074
0.148
1.455
0.072
Trap-MID
0.847
0.331
0.556
1.035
0.315
40

---

Published as a conference paper at ICLR 2026
Table 24: Full privacy experiments results: AT-AT vs Baselines standard DenseNet-10l architectures on
CclebA and FaceSerub data under PPA, IM- and PPDG attacks.
Data
Áttack Defense
TestAce
AttAce@1 II
AttAce@3 + L2 EvalConf
Defenses that attempt increase privacy generically
NoDet
0.947
0.890
0.980
0.763
0,868
MID
0.949
0.595
0.835
0.869
0.561
PPA
BiDO
0.921
0.693
0.891
0.831
0.667
TL-DMI
0.921
0.294
0.575
0.996
0.278
AT-AT
0.933
0.058
0.190
1.194
0.057
FaceSerub
NoDef
0.947
0.983
0.998
0.722
0.979
MID
0.949
0.621
0.808
0.951
0.587
IF-GMI BiDO
0.921
0.872
0.967
0.826
0.855
TL-DMI
0,921
0.627
0.845
0.885
0.606
AT-AT
0.933
0.124
0.303
1.157
0.116
NoDef
0.947
0.915
0.984
0.787
0.903
MID
0.949
0.537
0.749
0.970
0.510
PPDG
BiDO
0.921
0.747
0.915
0.856
0.724
TL-DMI
0.921
0.329
0.586
1.017
0.311
AT-AT
0.933
0.037
0.118
1.305
0.035
NoDef
0.856
0.503
0.788
0.800
0.480
MID
0.730
0.419
0.675
0.836
0.394
PPA
BiDO
0.611
0.132
0.313
1.021
0.123
TL-DMI
0.788
0.151
0.361
1.000
0.145
AT-AT
0.836
0.086
0.205
1.177
0.078
NoDer
0.856
0.820
0.943
0.755
0.801
CclebA
MID
0.730
0.577
0.731
0.882
0.557
IF-GMI
BiDO
0.611
0.199
0.409
1.005
0.192
TL-DMI
0.788
0.474
0.735
0.861
0.453
AT-AT
0.836
0.389
0,599
0.990
0.369
NoDel
0.856
0.594
0.826
0.819
0.570
MID
0.730
0.402
0.616
0.952
0.380
PPDG
BiDO
0.611
0.142
0.311
1.062
0.135
TL-DMI
0.788
0.145
0.333
1.068
0.137
AT-AT
0.836
0.041
0.101
1.359
0.039
Defenses that suppress attack gradients
NegLS
0.924
0.208
0.450
1.107
0.202
RoLSS
0.732
0.098
0.267
1.116
0.093
PPA
RoLSS-SSF
0,886
0.462
0.761
0.882
0.438
Trap-MID
0.920
0.529
0.787
0.893
0.500
Trap-MID*
0.946
0.708
0.912
0.833
0.680
FaceSerub
NegLS
0.924
0.448
0.714
1.047
0.433
RoL.SS
0.732
0.096
0.253
1.105
0.088
IF-GMI
RoLSS-SSF
0.886
0.551
0.823
0.877
0.531
Trap-MID
0.920
0.707
0.837
0.902
0.689
Trap-MID*
0.946
0.903
0.939
0.778
0.894
NegL.S
0.924
0.239
0.478
1.145
0.230
RoLSS
0.732
0.069
0.197
1.160
0.065
PPDG
RoLSS-SSF
0.886
0.486
0.746
0.908
0.465
Trap-MID
0.920
0.575
0.784
0.928
0.552
Trap-MIID M
0.946
0.783
0.917
0.836
0.764
NegLS
0.820
0.528
0.800
0.781
0.507
RoLSS
0.275
0.034
0.126
1.149
0.034
RoLSS-SSF
0.557
0.103
0.285
1.007
0.100
Trap-MID
0.681
0.195
0.404
0.976
0.185
Trap-MID*
0.711
0.198
0.443
0.957
0.188
NegLS
0.820
0.819
0.938
0.719
0.800
CelebA
RoLSS
0.275
0.038
0.121
1.161
0.035
IF-GMI
Rol RoL.SS-SSF
0.557
0.111
0.323
1.005
0.108
Trap-MID
0.681
0.264
0.461
1.044
0.250
Trap-MID*
0.711
0.412
0.650
0.942
0.393
NegI.S
0.820
0.587
0.821
0.793
0.563
RoLSS
0.275
0.027
0.102
1.193
0.025
PPDG
RoLSS- SSF
0.557
0.091
0.259
1.040
0.087
Trap-MID
0.681
0.164
0.358
1.079
0.157
Trap-MID MID*
0.711
0.224
0.453
1.032
0,211
41

---

Published as a conference paper at ICLR 2026
Table 25: Additional privacy experiments results: Lower-capacity ResNet-18 architectures CelebA and
FaceScrub data under PPA and IF-GMI attacks.
Data
Attack Defense
TestAce
AttAcce
AttAcc@5
L2
EvalConf
Defenses that attempt increase privacy generically
NoDef
0.950
0.901
0.986
0.761
0.881
MID
0.924
0.714
0.903
0.815
0.688
PPA
BiDO
0.884
0.530
0.811
0.915
0.504
FaceSerub
TL-DMI
0.906
0.240
0.505
1.020
0.225
AT-AT
0.921
0.110
0.297
1.143
0.104
NoDef
0.950
0.983
0.996
0.740
0.979
MID
0.924
0.776
0.840
0.899
0.764
IF-GMI BiDO
0.884
0.782
0.925
0.887
0.764
TL-DMI
0.906
0.515
0.760
0.935
0.492
AT-AT
0.921
0,283
0.520
1.082
0.268
NoDef
0.859
0.634
0.859
0.774
0.608
0.737
0.386
0.671
0.838
0.362
BiDO
0.625
0.146
0.359
1.009
0.136
TL-DMT
0.752
0.153
0.339
1.013
0.142
TL-DMI-5
0.831
0.324
0.602
0.886
0.302
CelebA
AT-ATis
0.825
0.296
0.561
0.945
0.279
AT-AT
0.787
0.155
0.350
1.029
0.144
NoDeF
0.859
0.913
0.970
0.708
0.903
MID
0.737
0.550
0.740
0.889
0.529
BiDO
0.625
0.368
0.629
0.908
0.347
IF-GMI TL-DMI
0.752
0.439
0.710
0.872
0.421
TL-DMI-5
0.831
0.750
0.922
0.751
0.728
AT-AT!a
0.825
0.783
0.912
0.799
0.764
AT-AT
0.787
0.617
0.806
0.856
0.599
Defenses that suppress attack gradients
NegLS
0.929
0.649
U.888
0.876
0.624
RoL.S
0.950
0.858
0.973
0.746
0.837
RoLSS-SSF
0.950
0.849
0.973
0.751
0.828
FaceSerub
Trap-MID"
0.927
0.502
0.752
0.949
0.475
Trap-MIID
0.928
0.735
0.930
0.831
0.704
NegL.S
0.929
0.932
0.989
0.824
0.923
RoL
0.950
0.979
0.996
0.683
0.975
IF-GMI
RoLSS-SSF
0.950
0.973
0.992
0.699
0.969
Trap-MID*
0.927
0.687
0.770
0.960
0.673
Trap-MIID
0.928
0.918
0.970
0.790
0.910
NegL.S
0.838
0.667
0.887
0.730
0.640
RoLSS
0.830
0.506
0.769
0.809
0.474
PPA
RoLSS-SSS SSF
0.839
0.519
0.764
0.810
0.490
CelebA
Trap-MIID
0.811
0.019
0.031
1.571
0.018
MID
0.830
0.443
0.700
0.854
0.423
NegLS
0.838
0.953
0.993
0.649
0.944
RoLSS
0,830
0.724
0.904
0.778
0.705
IF-GMI SS-SSF
0.839
0.765
0.909
0.775
0.742
Trap-MID* 0.811
0,088
0.134
1.482
0.084
Trap-MID
0.830
0.670
0.797
0.911
0.647
Notes: to and T6
denote two sets of hyperparameters for AT-AT (see Table 6).
42

---

Published as a conference paper at ICLR 2026
Table 26: Additional privacy experiments results: PPA attack Stanford Dogs data using the pre- vre-trained dog StyleGAN-2.
(a) ResNet-152
Data
Attack Defense
TestAce f AttAcc@1 I AttAce@5 J
L2 1
EvalConf
Defenses that attempl to increase privacy generically
NoDef
0.867
0.820
0.957
106.6
0.708
Stanford Dogs
MID
0.820
0.484
0.759
241.3
0.381
PPA
BiDO
0.817
0.717
0.916
139.8
0.727
TL-DMI
0.852
0.754
0.930
127.3
0.605
AT-AT
0.814
0.386
0.632
275.8
0.235
Defenses that suppress attack gradients
NegLS
0.816
0.625
0.858
181.7
0.532
PPA
RoLSS
0.684
0.551
0.820
198.7
0.712
RoLSS-SSF
0.673
0.481
0.789
212.5
0.415
(b) ResNet-18
Data Attack Defense
TestAce 1 AttAcc@1 AttAce@5
L2
EvalConf
Defenses that attempl to increase privacy generically
NoDef
0.776
0.823
0.949
105.7
0.759
Stanford Dogs
MID
0.675
0.680
0.850
167.0
0.615
PPA
BiDO
0.660
0.626
0.845
176.1
0.563
TL-DMI
0.777
0.774
0.933
118.1
0.709
AT-AT
0.711
0.468
0.724
238.7
0.415
Defenses that suppress attack gradients
NegLS
0.778
0.828
0.953
113.2
0.745
PPA
RoLSS
0.745
0.793
0.939
113.8
0.730
RoLSS-SSF
0.753
0.786
0.935
119.2
0.721
43

---

Published as a conference paper at ICLR 2026
Table 27: Full privacy experiments results: AT-AT Baselines ResNett-152 CelchA and FaceScrub
under PPA IM-GMI. Entries show mean 1 95% half-width for non-confidence metries.
Data
Attack Delense
TestAcc AttAcc@1]
AttAcc@5
EvalConf
Defenses that attempl to increase privacy generically
NoDel
0.958
0.882 0.004
1.98010.0000
0.768 0.010
0.862
MID
0.950
0.391 0.006
0.699
+.000
0.364
PPA
BiDO
0.928
0.009
0.010
0.756
FaceSerub
TL-DMI
0.911
0.190 0.005
0.435
1.057
0.178
AT-AT
0.939
0.058
+ 0.003
0.190
+.025
0.055
NoDef
0.958
0.987
= 0.001
0.998
0.700
0.984
MID
0.950
0.391
+ 0.006
0.668
1 0.006
1.002
0.010
0.365
IF-GMI BiDO
0.928
0.937
+ 0.003
0.792
0.927
TL-DMI
0.911
0.420
+ 0.006
0.694
0.006
0.010
0.401
AT-AT
0.939
0.084
0.003
0.238
- 0.005
0.013
0.080
NoDel
0.838
0.497 1 0.016
0.753
0.813
11.13110000
0.473
MID
0.802
0.474 0.016
0.725
0,821 = 0.035
0.450
BiDO
0.747
0.362
+ 0.015
0.629
0.923 0.037
0.340
PPA
TL-DMI
0.688
0.080
0.009
0.221
0.013
1.103
0.037
0.075
CelebA
TL-DMI-S
0.814
0.281
0.014
0.550
0.016
0.929 + 0.035
0.265
AT-AT
0.819
0.049
0.007
0.138 - 0.011
1.245 - 0.047
0.044
NoDer
0,838
0.793
-1 0.013
0.940
0.770
0.773
MID
0.802
0.728 + 0.014
0.836 0.037
0.709
BiDO
0.747
0.597
+ 0.016
0.867
0.036
0.575
IF-GMI
TL-DMI
0,688
0.258
0.014
0.513 0.016
0.037
0.243
TL-DMI-5
0.814
0.661
+ 0.015
0.883
+ 0.010
0.033 0.805
0.641
AT-AT
0.819
0.188
0.013
0.377
1 0.016
1.140
1 0.051
0.181
Dejenses that suppress allack gradients
NegLS
0.906
0.160 + 0.004
0.365 0.006
1.151
0.016
0.152
RoLSS
0.886
0.760 0.474
0.858 0.011
0.450
PPA
RoLSS-SSF
0.869
0.63 0.843
0.918
0.322
FaceSerub
Trap-MID
0.926
0.401 0.016
0.676
0.039
0.376
Trap-MID*
0.949
0.587
0.010
0.920
0.556
NegL.S
0.906
0.147 0.004
0.006
0.013
0.142
RoLSS
0.886
0.522 0.006
0.785
1175510.0000
0.884
0.011
0.499
IF-GMI
RoLSS-SSF
0.869
0.373
0.006
0.657
0.956 0.011
0.354
Trap-MII
0.926
0.618
0.016
1.00 0.06
0.603
Trap-MID*
0.949
0.713 + 0.014
0.792
0.013
0.939
1 0.039
0.705
NegLS
0.805
0.340 1 0.015
0.623
1 0.016
0.908 1 0.037
0.324
RoLSS
0.537
0.046 + 0.007
1.147 0.044
0.043
PPA
Rol SS-SFF
0.428
0.039
+ 0.006
0.118
0.010
1.183 + 0.055
0.035
CelebA
Trap-MID
0.847
0.330
0.015
0.569
+ 0.016
0.944 + 0.051
0.309
0.806
0.092
0.009
0.013
1.358 1 0.066
0.088
NegLS
0.805
0.554 0.016
0.811 0.013
0.885:0.000 0.035
0.532
RoLSS
0.537
0.045
0.145
+
0.042
IF-GMI
RoL.SS-SFF
0.428
0.044 0.007
0.131
0.011
1.218 0.056
0.040
Trap-MID
0.847
0.417 0.016
0.600
0.016
1.004 0.052
0.403
MID*
0.806
0.168 = 0.012
0.223 0.013
1.437
0.163
44

---

Published as a conference paper at ICLR 2026
Table 28: Full privacy experiments results: AT-AT Baselines ResNett-18 CelebA and FaceScrub under
PPA and IF-GMI Entries show mean 95% CI half- non-confidence metries.
Data
Attack Defense
TestAce
AttAcc@1.
AttAcc@5
1,2
EvalConf
Defenses that attempt to increase privacy generically
NoDef
0.950
0.901 0.004
0.986
0.761
0.010
0.881
MID
0.924
0.714
0.006
0.903+00000
0.815 0.012
0.688
PPA
BiDO
0.884
0.530
0.006
0.005
0.011 0.011
0.504
FaceScrub
TL-DMI
0.906
0.240
= 0.005
0.005
1.020
0.225
AT-AT
0.921
=110==0.000
0.297
0.104
NoDef
0.950
0.983
+ 0.002
0.996
0.740
0.010
0.979
MID
0.924
0.776 : 0.005
0.840
0.899
0.013
0.764
IF-GMI
BiDO
0.884
0.782
1 0.005
0.005
0.887
0.011
0.764
TL-DMI
0.906
0.515
= 0.006
0.760
0.935
0.011
0.492
AT-AT
0.921
0.283
0.006
+.520++000000
1.082
0..002++000 0.014
0.268
NoDel
0.859
0.634
: 0.016
0.774
0.608
MID
0.737
0.386
0.016
0.015
0.838
0.036
0.362
BiDO
0.625
0.146 0.011 0.359
0.016
1.009
0.136
PPA
TL-DMI
0.752
0.153
0.339
0.016
1.013 0.037
0.142
TL-DMI-5
0.831
0.324 1: 0.015
0.602
0.016
0.886
0.035
0.302
CelebA
AT-AT
0.825
0.296 + 0.015 0.561 +: 0.016 0.945 1 0.038
0.279
AT-AT
0.787
0.156 + 0.012 0.350 + 0.016 1.029 + 0.039
0.145
NoDef
0.859
0.970 0.006 0.708
0.031
0.903
MID
0.737
0.550 +: 0.016
0.
0.889
0.045
0.529
BiDO
0.625
0.368
+ 0.016
0.629
+ 0.016 0.908
0.033
0.347
IF-GMI TL-DMI
0.752
0.439 0.016
0.710
0.015
0.006
0.421
TL-DMI-5
0.831
0.750
1 0.014
0.922
1 0.009
0.751
1.0029 0.029
0.728
AT-ATts
0.825
0.783
0.014 0.912
0.799
0.087
0.764
AT-AT
0.787
0.617 + 0.016
1.806
0.856
0.040
0.599
Defenses that suppress attack gradients
NegLS
0.929
0.004
0.07
0.624
RoL.S
0.950
0.858 +.0000
0.973
0.746 0.010
0.837
PPA
RoLSS-SSF
0.950
0.849
0.973
0.751
0.828
FaceScrub
Trap-MID
0.928
0.735
0.008
0.831 0.027
0.704
Trap-MID*
0.927
0.502
0.016
0.012
0.949 0.035
0.475
NegL.S
0.929
0.932
0.004
0
0.824 0.014
0.923
RoLSS
0.950
0.979
0.002
0.996
0.001
0.683
0.009
0.975
IF-GMI
RoLSS-SSF
0.950
0.973 = 0.002
1.090
+ 0.010
0.969
Trap-MID
0.928
0.918 + 0.009
0.790
+ 0.025
0.910
Trap-MID>*
0.927
0.687
+ 0.015
0.770
0.013
0.960
+ 0.043
0.673
NegLS
0.838
0.667
+ 0.015
0.887
0.730
+ 0.030
0.640
RoLSS
0.830
0.506
1 0.016
0.
0.014
0.809 1 0.034
0.474
PPA
RoLSS-SSF
0.839
0.519
0.016
0.014
0,810 0.033
0.490
CelebA
Trap-MID
0.830
0.443
0.016
0.700 0.015
0.854
0.050
0.423
0.811
0.019
0.004
0.032
1.571
0.018
NegLS
0.838
0.953
0.993
1
1.64910.003)
0.944
RoL.SS
0.830
0.724 + 0.014
0.901
0.010
0.778 0.037
0.705
IF-GMT RoLSS-SSF
0.839
0.765 0.014
0.909
0.009
0.775 +
0.742
Trap-MID
0.830
0.669
0.015 0.797
0.013
+
0.647
Trae-MID*
0.810
0.088
0.009 0.131 + 0.011 1.482 0.047
0.084
Notes: To and 1b
denote two AT-AT hyperparameter settings (see Table 6).
45


Reviews:
[{"review_id": "6ODOR3kNL6", "reviewer": "Reviewer_APiD", "summary": "The paper argues that training-data leakage is driven by adversarially robust features instead of information dependency, and it supports this claim with experiments that falsify the dependency hypothesis. The authors therefore propose Anti-Adversarial Training (AT-AT) which intentionally shifts learning toward non-robust features to reduce leakage, since these are hard for MIAs to turn into clear pictures.", "questions": "Does AT-AT trade privacy gains for interpretability? The proposed method might help privacy, but it may suffer in terms of interpretability compared to robustly trained models. If the model leans on tiny, high-frequency cues spread across many pixels (rather than dog’s head or a face), attribution maps may become visually unintuitive.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "Strong MIA defense, AttAcc@1 fell from ~84% to ~6.5% (Tab. 21). On RN-152 accuracy vs. privacy (Fig. 3), AT-AT outperforms baseline methods across datasets and attacks.\n\n\nThe paper combines causal reframing, quantified trade-off, and practical SOTA method. The authors clearly test and challenge a popular theory using simple, targeted experiments, and turn the insights into AT-AT that lowers SOTA inversion success while keeping accuracy high.\n\nThe paper is generally well written, with a decent amount of details provided in the appendix.", "weaknesses": "Non-robust cues may still be highly predictive when added up and even sufficient for generalization. That means an adaptive MIA that directly optimizes the target’s representations could still extract identity/membership information. The paper does not systematically evaluate such features or prior-agnostic inversion attacks, so its privacy gains may depend only on the current setup.\n\n\nNarrow empirical scope. The paper lacks tests with broader attackers, other modalities, and offers no formal guarantees.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YkvDwyB5Sk", "reviewer": "Reviewer_2dtt", "summary": "This paper challenges the prevailing paradigm that \"reducing information dependency mitigates training data leakage via Model Inversion Attacks (MIAs)\" through three counterintuitive experiments. To explain these findings, the authors identify a novel privacy-adversarial robustness tradeoff. Based on these findings, they propose Anti Adversarial Training (AT-AT), a defense that proactively learns non-robust features by reversing standard adversarial training. Experimental results have validated the effectiveness of the proposed method.", "questions": "Refer to Weaknesses.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Good performance: the proposed method outperforms baselines in most metrics\n- Generalizability: results hold across datasets, architectures, and attacks, demonstrating the tradeoff’s universality and AT-AT’s adaptability.\n- Practical Relevance: AT-AT’s tunable λ addresses a key limitation of SOTA defenses (fixed privacy-robustness tradeoffs) and works for deployed models without modifications on the training/generation process.", "weaknesses": "- This work only focuses on the white-box attacks. It is recommended that the author conducts more evaluation on the black-box attacks and label-only attacks to further validate the correlation between adversarial robustness and privacy.\n- The compared baselines are not sufficient. Attacks like PLGMI [1] and PPDG [2] and defenses like Trap-MID [3] are expected to compare.\n- If a model is fine-tuned post-deployment (shifting its non-robust features), the author does not evaluate whether AT-AT’s privacy guarantees persist or require retraining.\n\n\n[1] Yuan X, Chen K, Zhang J, et al. Pseudo label-guided model inversion attack via conditional generative adversarial network[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2023, 37(3): 3349-3357.\n\n[2] Peng X, Han B, Liu F, et al. Pseudo-private data guided model inversion attacks[J]. Advances in Neural Information Processing Systems, 2024, 37: 33338-33375.\n\n[3] Liu Z T, Chen S T. Trap-MID: Trapdoor-based Defense against Model Inversion Attacks[J]. Advances in Neural Information Processing Systems, 2024, 37: 88486-88526.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "37qw03C6Ke", "reviewer": "Reviewer_K1VG", "summary": "This paper addresses the challenge of defending against model inversion attacks (MIA). It investigates the relationship between information dependency and privacy, yielding three key findings:\nModels that effectively defend against MIA (measured by Attack Acc@1) do not necessarily exhibit reduced information dependency (quantified by HSIC).\nModels that memorize training data can still remain robust to MIA (evaluated via L2-Face).\nEven models trained on images with 97% of pixels masked can still be reconstructed by MIA (as indicated by Attack Acc@1, @5, and L2-Face).\nTo interpret these counterintuitive results, the authors introduce the concept of non-robust features—imperceptible perturbations that alter predicted labels. By analyzing robust accuracies under varying perturbation magnitudes, they demonstrate a clear linear relationship between robust accuracy and attack success rate.\nBuilding on this insight, the paper proposes a new training objective, AT-AT, which learns non-robust features to obtain MIA defense.\nThe paper offers interesting new perspectives, is generally well written (even though this could be further improved, as detailed below), and the experimental evaluation shows some promise (even though some details are unclear).", "questions": "First experiment:\nWhy does training with HSIC regularization result in a higher HSIC value? According to the BiDO paper, HSIC was originally introduced to reduce information dependency, yet this work reports the opposite effect. It would be helpful to clarify this discrepancy. Interestingly, the BiDO paper did not explicitly report post-training HSIC values for comparison.\n\nSecond experiment:\nHow exactly are the labels permuted? If labels are permuted per person (on the images), this would merely rename the classes and should not alter the learned representations. I assume the permutation is performed per image, but this should be explicitly stated.\nAdditionally, an overfitted model typically learns a direct mapping from input to label rather than meaningful features, effectively reducing the dependency between images and latent representations while increasing the dependency between latent representations and labels. For example, the model can memorize the label of a specific input by memorizing several pixel values. Reporting HSIC values between images and latent spaces for both the permuted and non-permuted models would provide valuable insight.\n\nThird experiment:\nIn this setting, the available information in the image space is extremely limited, meaning the latent space could potentially encode nearly all pixel-level details. This might explain the model’s vulnerability to inversion attacks. Measuring the HSIC between images and latent spaces in this scenario could help validate this hypothesis.\nFurthermore, what datasets are used to train the PPA generative model? If the generative model is trained on the same dataset as the classifier, reconstructing images from only 3% visible pixels may be significantly easier, which would influence the interpretation of the results.\nLine 410 and Equation (3):\nWhy is the objective formulated as a maximization rather than a minimization? In the AT-AT algorithm, ( x + \\delta ) corresponds to ( x’ ). Given that the model should predict ( y’ ) for input ( x’ ), it seems that a minimization objective would be more appropriate. Please clarify.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This work challenges the conventional assumption that reducing information dependency between inputs and latent representations inherently improves privacy. Moreover, it identifies a meaningful correlation between privacy leakage and robust accuracy, opening a new perspective and research direction at the intersection of privacy and robustness.\nThe experimental design is sound, comprehensive, and statistically validated, lending credibility to the reported observations.\nThe paper compares against a sufficient range of baseline methods, including those focusing on information dependency as well as those emphasizing gradient-based denfense strategies.\nThe visualizations and plots are clear, well-structured, and intuitive, effectively supporting the main arguments.", "weaknesses": "Lack of causal evidence: Section 4 establishes a correlation between privacy and non-robust features, which is well supported by experimental results. However, no causal relationship is demonstrated. Consequently, the claim that “recent MIA defenses obtain their privacy improvements by unintentionally shifting models toward such features” remains insufficiently substantiated.\nMissing hyperparameter details: In the proposed AT-AT algorithm, the hyperparameter ε (epsilon)—which controls perturbation magnitude—is neither defined nor discussed. The absence of this detail limits reproducibility and interpretability of the results.\nLimited dependency metrics: The paper relies solely on HSIC to measure information dependency. Other established measures, such as CLUB, could have been included to provide a more comprehensive and cross-validated analysis.\nRestricted model scope: The experiments are conducted exclusively on ResNet-based architectures, with no evaluation on Transformer-based models. This limits generalizability of the findings to such architectures.\n\nMinor comments:\nThe structure and organization of the paper could be improved. For example, robust accuracy is frequently referenced in Section 4 and the Introduction, but is not clearly defined, and its relationship to non-robust features is insufficiently discussed. Moreover, there is substantial redundancy between the Introduction and the Experiments section.\nTerminological consistency should be improved. The terms information dependency and memorization are used somewhat interchangeably, leading to ambiguity. Choosing a single consistent terminology and providing a clearer definition would enhance readability and conceptual clarity.\n\nRef: Cheng, Pengyu, et al. “Club: A contrastive log-ratio upper bound of mutual information.” International conference on machine learning. PMLR, 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9QbTJR0CX6", "reviewer": "Reviewer_1QzK", "summary": "This paper challenges the prevailing view that information dependency causes privacy leakage in machine learning models. It compellingly argues that vulnerability to reconstruction attacks stems from the model's reliance on \"robust,\" human-interpretable features. Based on this, it introduces Anti-Adversarial Training (AT-AT), a novel method that intentionally trains the model to use \"non-robust,\" human-imperceptible features to obscure visually sensitive information from attackers.\n\n\nI recommend a Weak Accept. \n- The paper's excellent and fundamental contribution in identifying that robust features are the root cause of privacy leakage. However, I find its proposed solution, which sacrifices model robustness and interpretability for privacy, to be a questionable direction that I do not endorse.", "questions": "- The AT-AT framework appears to encourage models to rely on non-robust, human-imperceptible features for classification. Could the authors clarify how this design aligns with the broader goal of developing interpretable and trustworthy AI systems?\n\n- Have the authors considered integrating interpretability-preserving constraints or perceptual alignment mechanisms to mitigate the opacity introduced by adversarial feature reliance?\n\n- Since the framework intentionally leverages non-robust features, how do the authors ensure that the resulting models are not excessively fragile to adversarial perturbations or distributional shifts?\n\n- In the broader security context, how do the authors justify deliberately reducing model robustness as a viable long-term strategy for privacy protection?\n\n\nWhile the paper's contribution in identifying the role of robust features in privacy leakage is excellent, I do not endorse the proposed solution of relying on non-robust features as a viable or \"correct\" way to build private models. The solution sacrifices too much in terms of robustness and interpretability.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 4, "strengths": "- Fundamental and Novel Contribution: The paper's primary strength is its rigorous and convincing refutation of the widely-held \"information dependency → leakage\" hypothesis. The identification of the connection between robust features and privacy vulnerability is a fundamental, paradigm-shifting insight that could redirect future research in this area.\n\n- Strong Empirical Evidence: The three initial experiments are exceptionally well-designed and counter-intuitive, providing strong evidence to dismantle the status quo. The findings—that effective defenses don't reduce information dependency metrics, that rote-memorizing models are private, and that data from massively pixel-deleted images can still be reconstructed—are surprising and impactful.\n\n\n- Revealing a New Trade-off: The discovery and formalization of the \"privacy-robustness trade-off\" is a significant conceptual contribution in itself. It provides a new and valuable lens for understanding the inherent tensions in designing secure and private machine learning models.", "weaknesses": "- Undermines Model Interpretability and Trustworthiness: A core goal of building reliable AI is for models to learn features that are robust and align with human perception, making them more interpretable. The AT-AT framework intentionally subverts this principle by compelling the model to rely on non-robust, human-imperceptible features for classification. While this may protect visual privacy, it achieves it by making the model's decision-making process opaque and semantically meaningless to humans. This is a significant step backward for explainable and trustworthy AI.\n\n- Creates Intentionally Fragile Models: The direct consequence of relying on non-robust features is an extreme vulnerability to adversarial attacks. The authors acknowledge this as a trade-off, but I argue that deliberately engineering models to be fragile is not an acceptable solution. For years, the community has worked to make models more robust; this approach reverses that progress, trading one major security flaw (privacy leakage) for another (vulnerability to adversarial manipulation). This does not seem like a net gain for model security.\n\nWhile the paper's contribution in identifying the role of robust features in privacy leakage is excellent, I do not endorse the proposed solution of relying on non-robust features as a viable or \"correct\" way to build private models. The solution sacrifices too much in terms of robustness and interpretability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)