DRAG: Data Reconstruction Attack using Guided Diffusion
Authors: Wa-Kin Lei
Jun-Cheng Chen
Shang-Tse Chen
Venue: ICML 2025 poster (2025)
Keywords: Data Reconstruction Attack
Privacy
Diffusion Model
Primary area: social_aspects->privacy
TL;DR: We use diffusion model as the image prior to improve data reconstruction attack in the context of split inference.

Abstract: With the rise of large foundation models, split inference (SI) has emerged as a popular computational paradigm for deploying models across lightweight edge devices and cloud servers, addressing data privacy and computational cost concerns. However, most existing data reconstruction attacks have focused on smaller CNN classification models, leaving the privacy risks of foundation models in SI settings largely unexplored. To address this gap, we propose a novel data reconstruction attack based on guided diffusion, which leverages the rich prior knowledge embedded in a latent diffusion model (LDM) pre-trained on a large-scale dataset. Our method performs iterative reconstruction on the LDM’s learned image prior, effectively generating high-fidelity images resembling the original data from their intermediate representations (IR). Extensive experiments demonstrate that our approach significantly outperforms state-of-the-art methods, both qualitatively and quantitatively, in reconstructing data from deep-layer IRs of the vision foundation model. The results highlight the urgent need for more robust privacy protection mechanisms for large models in SI scenarios.

DRAG: Data Reconstruction Attack using Guided Diffusion
Wa-Kin Lei Jun-Cheng Chen 2 Shang-Tse Chen
Abstract
promising solutions, as it balances computational and pri- vacy concerns. This approach enables efficient utilization of cloud resources, reduces the computational burden on local devices, and facilitates the integration of complex models into everyday technologies by partitioning neural network computations between edge devices and cloud servers, with data processed locally before being sent to the server.
With the rise of large foundation models, split inference (SI) has emerged as popular compu- tational paradigm for deploying models across lightweight edge devices and cloud servers, ad- dressing data privacy and computational cost con- cerns. However, most existing data reconstruction attacks have focused on smaller CNN classifica- tion models, leaving the privacy risks of founda- tion models in SI settings largely unexplored. To address this gap, we propose a novel data recon- struction attack based on guided diffusion, which leverages the rich prior knowledge embedded in latent diffusion model (LDM) pre-trained on a large-scale dataset. Our method performs iterative reconstruction the LDM's 's learned image prior, effectively generating high-fidelit images resem- bling the original data from their intermediate rep- resentations (IR). Extensive experiments demon- strate that our approach significantly outperforms state-of- the-art methods, both qualitatively and quantitatively, in reconstructing data from deep- layer IRs of the vision foundation model. The results highlight the urgent need for more robust privacy protection mechanisms for large models in SI scenarios. Code is available at: https: // //github. wttp://awwaall///aaaa.a...
Despite its advantages, recent studies (He et al., 2019; Dong et al., 2022; Li et al., 2023; Xu et al., 2024; Sa et al., 2024) have uncovered significant privacy risks associated with SI, particularly in the form of data reconstruction attacks (DRA). In DRA, adversaries attempt to reconstruct clients' input data by exploiting the exchanged intermediate repre- sentations (IR) between clients and servers, posing serious threats that break users' privacy.
While these risks are established, the growing adoption of more powerful models, such as Vision Transformers (ViT) (Dosovitskiy et al., 2021), raises concerns about the ef- fectiveness of existing defenses. ViTs have demonstrated superior performance across various vision tasks and are widely used in modern applications. Nevertheless, the pri- vacy implications of deploying these models in SI settings remain underexplored.
In this paper, we address this gap by investigating privacy leaks in vision transformers in the context of SI. We propose a novel attack based on guided diffusion that effectively uti- lizes the prior knowledge captured by large latent diffusion models (LDM) (Rombach et al., 2022) pre-trained on large- scale datasets (e.g., Stable Diffusion) to reconstruct input data from deep-layer IR. Leveraging this prior knowledge, we successfully invert IR back to the original input data across various natural image datasets, revealing a critical privacy vulnerability in the SI framework. Additionally, we evaluate our attack on models equipped with existing defenses (Singh al., 2021; Vepakomma al., 2020) and show that input data can still be successfully reconstructed from deep-layer IR despite the defenses. Our key contribu- tions are summarized as follows:
1. Introduction
The rapid development of deep learning has revolution- ized various aspects of daily life-from AI assistants to autonomous vehicles. However, the substantial computa- tional resources required by these emerging models often hinder their deployment on edge devices. Therefore, offload- ing intensive computation to cloud servers has become popular alternative. Following this paradigm, split inference (SI) (Kang et al., 2017) has emerged one of the most
'National Taiwan University "Research Center for Information Technology Innovation, Academia Sinica. Correspondence to: Shang-Tse Tse Chen <stchen wetcchen@csi.ntt...oo stw..tt...
We propose DRAG, a novel attack that exploits the prior knowledge captured by LDMs to reconstruct in- put data from deep-layer IR.
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
Our attack can reconstruct high-quality images from

---

DRAG: Data Reconstruction Attack using Guided Diffusion
widely used vision foundation models, specifically CLIP (Radford et al., 2021) and DINOv2 (Oquab et al., 2024), demonstrating that the privacy threat exists even in widely used ceneral-purpos, vision encoders.
Infer
IR h"
We explore defense strategies tailored for vision trans- formers to mitigate the threat of privacy leakage.
? x²
Prediction y
Input.
fe
f.
2. Related Work
2.1. Split Inference
Split inference (SI) (Kang et al., 2017) is method aimed at speeding up inference and/or reducing power consumption in endpoint devices while ensuring data privacy. It has been widely studied in various applications, including computer vision tasks such as image classification, detection, and segmentation, as well as natural language processing tasks such as language understanding (Matsubara et al., 2022). In recent years, SI has also attracted attention for its role in generative AI, including LLMs and text-to-imaa to-image generation (Ohta& & Nishio, 2023).
Figure 1: Privacy threats in split inference.
candidate input to match the target IR, with Total Variation (Rudin et al., 1992) serving as an image prior. Singh et al. (2021) improved reconstruction quality by adding deep image prior (Ulyanov et al., 2018) 8) in their Likelihood Maxi- mization (LM) method. More recently, Li et al. (2023) in- troduced GAN-based Latent Space Search (GLASS), which constrains reconstructions using StyleGAN2 (Karras et al., 2020b). This method yields high-fidelity images that suc- cessfully evade several defenses (He et al., 2019; Singh et al., 2021; Titcombe et al., 2021; Mireshghallah et al., 2020; Li et al., 2021; Osia et al., 2020).
Unlike the traditional cloud-based inference approaches that require transmitting raw data to servers, SI preserves privacy by sending only transformed, non-trivially interpretable IR to the cloud. Specifically, the model f is partitioned into two parts: the client model fo X - H that maps input data x from input space X' to IR space H. and the server model fa H ->> )' that maps IR output space y. The client model is deployed on the edge device, while the server model operates in the cloud. During inference, the private data x" is first processed at the edge by fe, producing the "smashed" data h = fe (x*). This IR then transmitted to the cloud, where the server completes the computation by inferring 3" f. (h*). This approach, which provides cer- tain degree of privacy preservation for users, also leverages the abundant computational resources of cloud servers to accelerate inference, making it feasible solution for appli- cations requiring both privacy and low-latency predictions.
Black- box attacks require only query access to fe, typically utilizing inverse networks trained on input-output pairs (He et al., 2019). Recent work has enhanced this approach by incorporating diffusion models (Chen al., 2024), which offer better reconstruction quality.
Query-free attacks operate without access to fe. Instead, they use a collection of IRs to construct surrogate models f' that approximate fe, followed by applying reconstruction techniques to these surrogates. Beyond He et al. (2019), previous works (Pasquini et al., 2021; Erdogan et al., 2022: Gao & Zhang, 2023; Xu et al., 2024) assume the adversary participates in the model training process to enhance the effectiveness of subsequent reconstruction attacks.
Existing evaluations primarily focused on CNN architec- tures like ResNet18 (He et al., 2016). However, ViTs pro- cess images fundamentally differently through patch tok- enization and attention mechanisms, and their vulnerability to reconstruction attacks remains largely unexplored. Our analysis in Section 5.5 reveals that ViTs exhibit token order invariance, a feature absent in CNNs, which significantly affects attack effectiveness.
2.2. Data Reconstruction Attack (DRA)
In the context of SI, an adversary may extract private infor- mation by reconstructing the original input x" from h", as illustrated in Figure 1. Following He et al. (2019), we cate- gorize existing DRAs based on the adversary's 's knowledge of the client model as follows:
White-box attacks assume complete knowledge of the ar- chitecture and parameters of the client model. This assump- tion has become increasingly reasonable with the rise of large models leveraging frozen, publicly available vision en- coders (Liu et al., 2023; Chen et al., 2023). The early work of He et al. (2019) framed reconstruction as regularized Maximum Likelihood Estimation (rMLE), which optimizes
2.3. Diffusion Models
In recent years, diffusson models (Ho et al., 2020; Song et al., 2020) have demonstrated remarkable capabilities in generating realistic images by iteratively refining noise into coherent visuals. Conditional generation has been signif-
2

---

DRAG: Data Reconstruction Attack using Guided Diffusion
icantly advanced through methods such as classifier guid- ance (Dhariwal & Nichol, 2021) and classifier-free guidance (Ho& & Salimans, 2021), which incorporate class informa- tion to guide the generation process. Specifically, classifier guidance (Dhariwal & Nichol, 2021) estimates the class probability Pr Pc(c)x) x) while maintaining a fixed unconditional distribution pr(x), enabling conditional generation through the Bayes rule: (x(x)() x (x(x) pr (c/x). Universal Guid- ance Diffusion (UGD) (Bansal al., 2024) further expands the scope of conditional generation by integrating various neural networks to incorporate diverse conditions, such as object bounding boxes, segmentation masks, face identities, and stylistic attributes.
Learning Based. The adversary infers x* by training an inverse network L. H -> X, where the network is trained using paired data (x, [x)) from public dataset D publicc
fc arg argmin [lfe (fe(x)) x112]
(2)
The following subsections detail our reconstruction ap- proach, as illustrated in Figure 2.
3.2. Data Reconstruction Attack using Guided Diffusion
In this section, we propose leveraging guided diffusion for data reconstruction attacks. Pre-trained diffusion models serve as image priors Rz. constraining reconstructions to the natural image manifold. Based on a noise predictor co and its corresponding noise scheduler {(ar, ot) un- conditional DDIM sampling (Song et al., 2020) transitions sample x from timestep & f as follows:
While classifier guidance seeks to adapt a fixed uncondi- tional model Pr (x) by developing an appropriate conditional distribution pi (c)x). another line of research (Chung al., 2023; Yang et al., 2024) assumes the availability of a pre- defined conditional distribution (o(c)x). This assumption positions diffusion models as promising tools for addressing a range of conditional generation tasks.
X - vI a4 cO(X))
X,-1 = Varii
Moreover, LDMs (Rombach et al., 2022) have further ad- vanced diffusion models by enabling the generation of di- verse, high-resolution, high-quality images within latent space, thus improving computational efficiency. Subsequent work (Ramesh et al., 2022; Zhang et al., 2023) has extended control mechanisms within the latent diffusion framework, allowing more precise and hierarchical image manipulation.
Var
v
at-1 - of (x{)
Tt Et:
(3)
where ~ ~N, I) denotes Gaussian noise sampled from a standard normal distribution. For conditional image genera- tion, classifier guidance (Dhariwal & Nichol, 2021) modifies the predicted noise by adding the gradient of a classifier's log-probability to the predicted noise:
3. Methodology
<x c) = =x(, - wvI at Xx, x. log pa (c(x)),,
(4)
3.1. Threat Model
where с denotes the condition, and w controls the strength of guidance. Extending classifier guidance, UGD (Bansal et al., 2024) replaces the classification loss with a general, differentiable loss L(x,, c). For data reconstruction, we define the objective function as:
Following previous work (He et al., 2019; Singh et al., 2021; Dong et al., 2022; Li et al., 2023), we consider an honest- but-curious server in SI that seeks reconstruct x* from h.. Given the prevalence of frozen foundation models in downstream applications, we assume white-box access to the client model fc, providing the adversary with complete architectural and parameter knowledge. Under this threat model, we formulate the problem using two complementary approaches: (1) optimization- based and (2) learning-bace based.
L(xe, - -xx(((x)))))
Notably, directly feeding x, to fo for guidance computation is unreliable, as fe is typically trained only on clean images. To address this, Chung et al. (2023) and Bansal et al. (2024)
Optimization Based. The adversary aims to find input data x' whose corresponding IR closely matches h" by solving the following optimization problem:
estimate the guidance using the unique posterior mean Xo- single-step denoised sample:
x' arg min dx (x + ART(x), X
(1)
L(xo, c) = dxx(f((Ro). h²))
(6)
where X is computed using Tweedie's formula with a single forward pass through the noise predictor eg:
where du measures the distance between the IRs, Ri repre- sents the regularization term ensuring perceptually realistic,
and > 2 0 controls the weight of regularization. Ultimately, the adversary's 's goal is to achieve x' R x".
X;
VI aj ca (X::)
Xn
01
3

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Backprop.
Random Init.
2
V dxx
X
fc
X0
X
Forward and compare h with h"
?
fe
Backward to get guidance on X₁
h
Sample X;-1
4 If needed, add noise to get X
fc
0i Xcoarse + al
(Only used in DRAG++)
X
Xcoarse
Figure 2: Illustration of DRAG (Data Reconstruction Attack using Guided Diffusion). The diffusion model serves as an image prior, constraining the solution space of in optimization-base -baee DRAs. Moreover, DRAG can be extended by incorporating the Inverse Network (He al., 2019): we first obtain initial estimate Xcoarse = fe= (h"), then refine by diffusion-deeoiisngg process. We refer to this enhanced variant DRAG++
Diffusion with Spherical Gaussian constraint (DSG) (Yang al., 2024) reduces the required denoising steps while hancing generation quality. DSG aligns e, with the guidance g: Vx, I((S,, c) through:
3.3. Extending DRAG with Inverse Networks
To enhance the performance and efficiency of DRAG, we integrate an auxiliary Inverse Network (He et al., 2019). This network accelerates DRAG by providing coarse re- construction from the target IR, serving as more effective initialization. We train this network on an auxiliary dataset of publicly available data Dpublic to project the IR back to image space and obtain Xçoarse- This coarse reconstruction is further projected onto an editable manifold by adding random noise a small timestep s7:
6 x-r UNIT(( w) oe wr UNIT(g:)).
where r Vno, with being the dimension of x and operator UNITO normalizes vectors to unit norm. We adopt Equation (8) for our guided diffusion process.
To enhance reconstruction quality, we refine the guidance using gradient clipping and historical guidance vector with optimizers such as Adam (Kingma & Ba, 2015). Since fo is typically non-convex, a single guidance step insufficient for high-quality reconstruction. Therefore, we employ self- recurrence (Bansal al., 2024), projecting Xt-1 back to X; via small-step DDPM diffusion (Ho et al., 2020) and iterating this denoising difffuiion cycle l times:
X; = Vot Xeoarse V o where e ~ (O, (10)
where the strength parameter satisfies 0 S S 1. We refer to this enhanced method as DRAG++
3.4. Adapting to Latent Diffusion Models
As LDMs perform diffusion and denoising processing in the latent space Z instead of the pixel space X, we adapt our approach when leveraging LDMs as the image prior by replacing the noisy sample x; with the noisy latent 2,. The mapping between X' and provided by the corresponding latent autoencoder & and D. All other components of the method remain unchanged.
x, = -=/a//a-- X,-1 + VI a1/ar-1... (9)
We refer to this approach as DRAG- Data Reconstruction Attack using Guided Diffusion. Algorithm outlines our proposed attack in detail. Note that the problem differs from previous works (Chung al., 2023; Yang et al., 2024) in three key aspects, introducing additional challenges: (1)
client models Jr. are typically assumed to be non-convex, (2) defensive mechanisms may be deployed, forcing attackers to operate in adversarial settings, (3) clients can embed randomness into fe. further complicating the problem, as detailed in Section 5.5.
4. Experimental Setups
In this section, we first introduce the details of our experi- mental settings, including datasets, target models, compared methods, evaluation metries, and attacker models.

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Algorithm 1 DRAG
(Oquab et al., 2024) vision encoder, known for its strong adaptability and zero-shot capabilities across vision tasks (Rao et al., 2022; Mokady et al., 2021). The reconstruction is performed after layers / = 30, 6, 9, 12) for CLIP- ViT- B/16 and DINOv2-Base, while for CLIP-RN50, the attack is conducted after blocks ( 31, 4, 5}. We evaluated the attack in three configurations: (1) the model is frozen at the pre-trained checkpoint, (2) protected by DISCO (Singh et al., 2021), and (3) protected by NoPeek (Vepakomma et al., 2020). The details of these two defenses can be found in Appendix D. These two defenses, highlighted in Li et al. (2023), have demonstrated superior crivacy-preserving performance compared to other defenses.
// Noise is sampled from (0.0.) I) for every usage
(.m 0,.V 0, 0}
2T 10, for t = to do
for π = 1 to l. do
Xy <- ((CWEDRRESSTMATIO(I2))
gr f Vz, (dxx (8)()) h²) + de Reg (xo))
5. f CLIPNORM( gr, Cmax)
gr: STATHUPPATEEG,
21-1 + GUUDDEDSAMPLINGZZZ, g1
24 4- Vai/ar-1 2 + v 0t/00-1
end for end for return D(z))
4.3. Baseline and Metries
We compare our method with previous aptimization-basee DRAs: rMLE (He et al., 2019), LM (Singh et al., 2021) and GLASS (Li et al., 2023). Implementation details are provided in Appendix C. To quantify privacy leakage across these attacks, we evaluated reconstruction performance us- ing three complementary metrics: MS-SSIM (Wang et al., 2003), LPIPS (Zhang et al., 2018), and image similarity measured by DINO ViT-S/16 (Caron et al., 2021). These metrics capture both low-level fidelity and high-level se- mantic similarity, better reflecting privacy risks by aligning with human perceptual judgment compared to pixel-wise measures such as MSE or PSNR (Horé & Ziou, 2010).
// Refine g. via momentum such Adam function STATEUPDATE(CS s)
s.m <- 31 s.m + (1 11-1 (1) g:
S.v + S.v + (1 (1- gi
8.i f s
m, v + s.m/ (1- (1-8)). s (1 83)
g: - m/ (VV + 10-8)
return g.:
end function
function GUIDEDS Bi)
6 f- r- UNIT((1 w) oe + wr UN)T(g:))
return DDIM(Z;; ep e2)).
4.4. Attacker Models
end function
We use Stable Diffusion v1.5 (SDv1.5) as our image prior. GLASS (Li al., 2023) uses domain-specific pri- StyleGAN2-ADA (FFHQ) (Karras al., 2020a) for facial images and StyleGAN-XI. (ImageNet-IK) (Sauer et al., 2022) for others, assuming knowledge of the target distribution. This inherently advantages GLASS by match- ing priors to true data distribution, while our diffusion-based approach uses a single, donain-agnostic prior.
4.1. Datasets
To evaluate our proposed methods, we sample 10 im- ages from the official validation splits of each dataset: (1)
MSCOCO (Lin et al., 2014), (2) FFHQ (Karras et al., 2019), and (3) ImageNet-IK K (Deng et al., 2009), constructing collection of diverse natural images. All images are center- cropped and resized to 224x224. We use ImageNet- IK image classification as the primary task to quantitatively assess model utility. To simulate realistic conditions where the client and adversary have non-overlapping datasets, we randomly split the official training split of ImageNet- IK into two distinct, equal-sized and non-overlapping subsets: a private portion privaree and a public portion Dpablic- The target model I is fine-tuned exclusively on Dprivate. while the inverse network f- as proposed in Section 3.3, is trained solely on D Ppublic.
For the architecture of the inverse network, we adopt the decoder architecture from He et al. (2022) to reconstruct im- ages from the tokenized representations produced by ViTs. During training, we randomly replace maakk = 25% of patch tokens with [MASK] token to improve its generalization.
4.5. Distance Metrics and Regularization
We use token-wise cosine distance as the distance metric du for the data reconstruction process in ViT-family models:
(h :] h2 bi]
(h1, h2) =
(1I)
| :JIl'
4.2. Target Models
We aim to reconstruct data from the widely used CLIP- B/16, CL5P-RN50 (Radford al., 2021), and Dasev2-Base
where N denotes the number of tokens. For CLIP-RNSO, the MSE loss is adopted. To prevent the latent z, from
5

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Table I: Reconstruction performance of optimization-baser attacks across target models and split points without defenses.
Bold indicates the best scores, while underlined indicate the second- best.
CLIP-VIT-B/16
||
DINOv2-BAR
CLIP-RNSO
Method
Split Point
MS-SSIM 1
LPIPS 4
DINO 1
|| MS-SSIM
LPIPS 4
DINO t
Split Point
MS-SSIM 1
LPIPS 4
DINO 1
1MLE
0,8888
0.0709
0.9712
0.9162
0.0504
0.9630
0.6832
0.1543
0.9111
LM
0,9638
0.0237
0.9903
0.9698
0.0227
0,9850
0.9769
0.0150
0.9919
Layer O
Block
GLASS
0,8700
0,1466
0.8289
0.9147
0.1076
0.8369
0,9052
0.0785
0.8485
DRAG
0,9588
0.0489
0.9259
0.9567
0.0440
0.9284
0.9316
0.0476
0.9454
IMLE
0.8612
0.0914
0.9706
0.8371
0.1641
0,9302
0,5741
0.2618
0.9053
LM
0.9742
0.0206
0.9923
0,9682
0.0250
0,9890
0,9313
0.0382
0.9868
Layer 3
Block
GLASS
0.9091
0.0556
0,9623
0,9340
0.0488
0,9580
0.7829
0.2185
0.7563
DRAG
0.9500
0.0372
0.9715
0.9570
0.0323
0.9728
0.9151
0.0604
0.9539
1MLE LM GLASS
0,6888
0,2608
0.8875
0.6566
0,2562
0.9111
0.6745
0.2233
0.8986
0, 8604
0.0784
0.9734
0.7334
0,1676
0.9768
0,9028
0.0596
0.9769
Layer 6
Block
0,7113
0.1352
0.9326
0.7444
0,1495
0.9333
0.6785
0,2405
0.7877
DRAG
0,9028
0,0465
0.9784
0.9196
0,0455
0,9782
0.9118
0.0528
0. 0.9662
IMLE
0,4957
0.5131
0.7159
0,5855
0.4374
0.7663
0,4888
0.4198
0.7776
LM
0.6681
0,2138
0,9063
0.5281
0.3839
0,9555
0,5855
0.2576
0.9012
Layer 9
Block 4
GLASS
0,3852
0.4310
0.6740
0.5404
0.3230
0.8467
0.4872
0.3568
0.7315
DRAG
0.7974
0.0967
0.9652
0.8483
0.0820
0,9719
0.7896
0.0898
0.9622
1MLB
0.3884
0,5900
0.6524
0.4375
0,5680
0.6079
0.3980
0,5006
0.6739
LM
0,2560
0.6024
0.4248
0.3640
0.6190
0.8878
0.4432
0.3409
0.7614
Layer 12
Block
GLASS
0,2396
0.5790
0.4553
0.4456
0.4076
0.7297
0.2917
0.4225
0.6811
DRAG
0.6735
0.1857
0.9331
0.7581
0.1443
0.9463
0.52/66
0.2231
0.9001
deviating too far from the domain of the noise predictor eg. we introduce la regularization on 8o to the objective (Equation (6)) to ensure it remains within the range [-1,1]
degrades beyond layer 9 and layer 12, respectively. In con- trast, DRAG outperforms the others at deeper split points across the evaluated metrics.
during the reconstruction process:
Compared to GLASS, which also utilizes a data-driven im- age prior and achieves strong performance on the FFHQ dataset, method attains comparable performance on FFHQ and generalizes robustly to MSCOCO and ImageNet. Despite employing GAN trained on ImageNet, GLASS reconstructs images from ImageNet with evident artifacts at deep split points. In contrast, DRAG maintains high-fidelity outputs free from such distortions, as shown in Figure 3.
Re ($xo = Ae
(12)
CHW
5. Experimental Results
In this section, we first compare the reconstruction perfor- mance of DRAG with prior methods on frozen, pre-trained foundation models. Next, we evaluate DRAG++, which integrates an auxiliary inverse network (IN) to improve reconstruction performance. Subsequently, we evaluate the generalization ability of DRAG on out-of-distribttion data. We then examine its robustness against two defenses, DISCO and NoPeek. Finally, we analyze the reconstruction performance when applying the token shuffling defense, mechanism intrinsic to ViTs. Complete experimental results can be found in Appendix A, and further experiments the effects of key hyperparameters appear in Appendix B.
5.2. Enhancing DRAG with Inverse Networks
We evaluate DRAG++ on CLIP-ViT-BI/ by comparing its performance to the inverse network (IN) and the original DRAG method. As shown in Table 2, DRAG++ achieves higher reconstruction performance in terms of LPIPS and DINO split points beyond layer 3. While IN attains higher MS-SSIM, DRAG++ demonstrates notable improvements in LPIPS and DINO, with only a slight sacrifice in MS-SSIM compared to IN. This result suggests that the combined approach enhances perceptual quality in reconstruction.
5.1. Reconstruction from Frozen Foundation Models
Table presents quantitative reconstruction results, while Figure 3 visualizes results on CI.IP-VT--B/6 highlighting qualitative differences. Our approach consistently outper- forms prior methods in reconstructing data from deeper layers. Although rMLE and LM achieve competitive perfor- mance at shallow split points, their reconstruction quality
5.3. Distribution Shift
We evaluate the generalization capability of DRAG and DRAG++ through two experiments in out-of-distribution settings. In the first experiment, we reconstruct aerial images from the UCMerced LandUse dataset (Yang &
6

---

DRAG: Data Reconstruction Attack using Guided Diffusion
MSCOCO
FFHQ
ImageNet
GT
MLE
LM
GLASS
DRAG
GT
rMLE
LM
GLASS
DRAG
GT
FMLE
LM
GLASS
DRAG
Layer 0
Layer 3
Layer 6
Layer 9
Layer 12
Figure 3: Reconstruction results for CIJP--YT-B/16 across split points without defenses.
Table 2: Reconstruction performance comparison between inverse network alone and DRAG++ on CLIP-ViT-BIA
Table 3: Reconstruction performance using diffusion model
trained on out-of-distribure distribution data for
Split Point
Method
MS-SSIM
LPIPS
DINO t
Split Point
Method
MS-SSIM t
LPIPS
DINO
IN
0.9907
0.0112
0.9937
rMLE
0.8888
0.0709
0.9712
Layer
DRAG
0.9588
0.0489
0,9259
LM
0.9638
0.0237
0.9903
Layer
DRAG++
0.9608
0.0485
0.9234
GLASS
0.8700
0.1466
0.8289
IN 0.9763
0.0351
0,9458
DRAG
0.9692
0.0275
0.9591
Layer 3
DRAG
0.9500
0.0372
0.9715
rMLE
0.8612
0.0914
0.9706
DRAG++
0.9504
0.0349
0,9719
LM
0.9742
0.0206
0.9923
Layer
IN DRAG
0.9120
0.1799
0.7869
GLASS
0,9091
0.0556
0. 0,9623
Layer 6
0.9028
0.0465
0.9784
DRAG
0.9488
0.0427
0.9722
DRAG+
0.9093
0.0457
0.9785
rMLE
0.6888
0.2608
0.8875
IN DRAG
0.8188
0.2993
0.7130
LM
0.8604
0.0784
0,9734
Layer
Layer
0.7974
0.0967
0,9652
GLASS
0.7113
0.1352
0.9326
DRAG++
0.8224
0.0875
0.9700
DRAG
0.8244
0.1574
0.9438
IN DRAG
0.7443
0.3618
0.6660
rMLE
0.4957
0.5131
0.7159
Layer 12
0.6735
0.1857
0,9331
LM
0.6681
0,2138
0.9063
Layer
DRAG++
0.7257
0.1685
0,9492
GLASS
0.3852
0.4310
0.6740
DRAG
0.5379
0.3937
0.8154
Newsam, 2010), using f=1 trained on ImageNet-1K. KK. As shown in Figure 4, DRAG and DRAG++ successfully recon- struct these images, demonstrating their robustness across different domains. In the second experiment, we replace the diffusion model with a Nomain-spectie model trained on the LSUN-bedroom dataset (Yu al., 2015). We compare this configuration while keeping the other attack settings changed. The results shown in Table 3 indicate that DRAG achieves the best performance at layer 12 and ranks as the runner-up at layers 3, 6, and 9, further demonstrating its robustness even in an -iitt--distribution setting.
rMLE
0.3884
0.5900
0.6524
LM
0.2560
0.6024
0.4248
Layer 12
GLASS
0.2396
0,5790
0.4553
DRAG 0.3958
0.4938
0.7245
Based diffusion model trained on LSUN bedroom dataset.
Since Config-III and Config- VI represent the most challeng- ing settings for adversaries, we highlight the results under these configurations in Table 5 and Figure Our attack proves effective against weaker defense configurations, with comprehensive results across all configurations presented in Appendix A.2 and Figure 9.
5.4. Reconstruction from Privacy-Guarded Models
For DISCO, we assume the adversary lacks knowledge of the pruning model or the mask applied to h", as pruning is dynamic, auxiliary component that can be decomposed from fc- The pruned channels mislead the reconstruction
We evaluate attacks on models protected by DISCO and NoPeek defenses with varying hyperparameter settings that determine privacy protection strength, as detailed Table

---

DRAG: Data Reconstruction Attack using Guided Diffusion
GT
GT
L3
(a) Reconstruction from DRAG
(b) Reconstruction from DRAG++
Figure 4: Reconstruction results on out-of-distribution aerial images from the UCMerced LandUse dataset.
Table 4: Defense parameters for DISCO and NoPeck.
Table 5: Performance under DISCO (Config-III) and
NoPeek (Config- VI) for CLIP-ViT-B/I layer 12.
Defense
Config
Defense Parameters
Method
MS-SSIM t
LPIPS |
DINO
PD = 0.95, rp = 0.1
DISCO
nD 0.75, rp =
Config-III
III
PD 0.95, Tp 0.5
rMLE 0.1686
0.8128
0.1129
IV
PN = 1.0
LM
0.1638
0.7079
0.1654
NoPeek
V
PN = 3.0
GLASS
0.1479
0.6225
0.3878
VI PN = 5.0
DRAG
0.0788
0.7449
0.3201
Config- III w/ adaptive attacks
process, leading to failures in the most challenging setting, Config-Ill. However, since pruned channels generally have smaller absolute values than unpruned counterparts, this discrepancy can be exploited by adaptive attacks. Specifi- cally, the adversary can filter out channels with low mean absolute values when caleulating dz, thereby mitigating the misleading influence of pruned channels. Our experimental results also show that DRAG performs the best after the adaptive attack filters out the pruned channels.
rMLE
0.2101
0.7822
0.2072
LM
0.1696
0.6953
0.1818
GLASS
0.2402
0.5401
0.4862
DRAG
0.4557
0.3778
0.7557
Config-
rMLE
0.2270
0.7048
0.3747
LM 0.1783
0.7917
0.2099
GLASS 0.1950
0.7248
0.3141
For NoPeek, we observe that dæ is significantly lower than unprotected models during the optimization process, con- sistent with findings in Li al. (2023). Despite this, DRAG still reconstructs the target images with higher fidelity com- pared to the previous works.
DRAG 0.4469
0.3836
0.8096
we propose the following protocol: the client shuffles the patch tokens and randomly drops r'rop N patch tokens be- fore sending them to the server, where Tarop is the proportion of the dropped tokens. Specifically, shuffling is applied af- ter the positional embedding layer, while the [CLS] token remains fixed in position.
5.5. Token Shuffling (and Dropping) Defense
VIT' naturally exhibit adaptive computation capability, enabling reduced inference time by discarding redundant tokens in the intermediate layers. Previous work (Yin et al., 2022) investigates strategies for dropping tokens in interme- diate layers. From a privacy protection perspective, shuf- fling (and dropping) patch tokens hinders data reconstruc- tion, as the distance metrics dH is sensitive the token order. For tasks where token order is irrelevant (e.g.. clas- sification), shuffling patch tokens offers straightforward defense against DRA. Additionally, this method is easy to implement, as it only requires memory copying.
As noted in Darcet et al. (2024), tokens retain information about their original positions, which can be inferred by classifier. Based on this observation, we train a 2-layer MLP classifier to predict the probability that token h(i, was originally at position arg max po(h(i: :]). Once trained, the classifier enables us to reorder the patch tokens by solving assignment problem, maximizing the joint probability using the Hungarian algorithm (Kuhn, 1955).
We present the reconstruction results under three configu- rations: (1) patch tokens are randomly permuted, and the adversary is unaware of the permutation; (2) the adversary uses a token position classifier reorder the tokens; and
We evaluate the privacy risk against the token-Nn shuffliuufiig (and dropping) defense. To simulate -eoonnn scenario,
8

---

DRAG: Data Reconstruction Attack using Guided Diffusion
GT
FMLE
LM
GLASS
DRAG
rMLE
LM
GLASS
DRAG
FMLE
LM
GLASS
DRAG
(a) Config-Ill
(b) Config-Ill (adaptive attack)
(c) Config-V VI
Figure Reconstruction results for CLIP-ViT-BIL at layer 12 with DISCO (Config- IIII and NoPeek (Config- VI).
GT
rMLE
LM
GLASS DRAG
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS
DRAG
(a) Tdrop 0.0 (w/o reordering tokens) (b) raro = 0.0 (w/ reordering tokens)
(c) Paxo = 0.5 (w/ reordering tokens)
Figure 6: Reconstruction results for CLIP-ViT-B/16 at layer 12 with token shuffling defense.
(3) the client drops 50% of the patch tokens before send- ing them to the server, leaving the adversary to infer their correct placement. Experiments are conducted B/16 splitting at layer 12. The token position classification model achieves 21. 11.00% top-1 accuracy in predicting to- ken positions, with an average & distance of 2.34 from the correct position on ImageNet-IK. As shown in Figure 6, both rMLE and LM fail to reconstruct the target images, whereas the normal configuration succeeds. For GLASS and DRAG, reconstruction performance is degraded in the shuffled scenarios, but some reconstructed images still retain key features of the original inputs.
A Acknowledgements
This research supported by National Science and Tech- nology Council, Taiwan under grant numbers 113-2222-E- 002-004-MY33, 133-2334-T-002-007, and 113-2634-F-002-
CLIP-ViT
001-MBK; by the Featured Area Research Center Program within the Higher Education Sprout Project of the Ministry of Education (grant 113L900903); and by Academia Sinica (grant AS-CDA-110-MOD We also thank the National Cen- ter for nigh-perffrrance Computing of National Applied Research Laboratories in Taiwan for providing computa- tional and storage resources.
Impact Statement
6. Conclusion
This work investigates the privacy risks of large vision foun- dation models in the split inference framework. As these models are widely adopted in downstream tasks, privacy concerns become crucial. Our proposed DRAG method shows that, unlike smaller CNN models studied previously, large vision models are also vulnerable embedding re- construction attacks, posing risks applications like do- mestic robots and syber-physices systems. These findings provide key insights for ML developers and users, urging re-evaluation of privacy risks and the development of more robust, privacy-preservinn architectures.
This work reveals significant privacy risks SI with large vi- sion foundation models like CLIP-VIT and DINOv2, extend- ing beyond previous attacks on CNN models like ResNet18. 88. We propose novel data reconstruction attack leveraging LDMs pre-trained on large-scale datasets. Our method gen- erates high-fidelity images from IR and outperforms state- of-the-art approaches in reconstructing data from deep-layer IR. These findings highlight the need for stronger defenses to protect privacy when deploying transformer-basse mod- els in SI settings.

---

DRAG: Data Reconstruction Attack using Guided Diffusion
References
Gao, X. and Zhang. L. PCAT: Functionality and data stealing from split learning by pseudo-client attack. In 32nd USENIX Security Symposium (USENIX Security 23), 2023.
Bansal, A., Chu, H.-M., Schwarzschild, A., Sengupta, S., Goldblum, M., Geiping, J., and Goldstein, T. Universal guidance for diffusion models. In International Confer- ence on Learning Representations (ICLR), 2024.
Hatamizadeh, A., Yin, H., Roth, H. R., Li, W., Kautz, J., Xu, D., and Molchanov, P. GradViT: Gradient inversion of vision transformers. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Caron, M., Touvron, H., Misra, L., Jégou, H., Mairal, J., Bojanowski, P., and Joulin, A. Emerging properties in self-supervised vision transformers. In International Con- ference Computer Vision (ICCV), 2021.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In IEEE conference on Computer Vision and Puttern Recognition (CVPR), 2016.
Chen, D., Li, S., Zhang, Y., Li, C., Kundu, S., and Beerel, A. DIA: Diffusion based inverse network attack on collaborative inference. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
He, K., Chen, X., Xie, S., Li, Y., Dollár, P., and Girshick, R. Masked autoencoders are scalable vision learners. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Chen, J., Zhu, D., Shen, X., Li, X., Liu, Z., Zhang, P., Krish- namoorthi, R., Chandra, V., Xiong, Y., and Elhoseiny, M. MiniGPT-v22 large language model as a unified interface for lasion-l multi-task learning. arXiv preprint arXiv:2310.09470 2023.
He, Z.., Zhang, T., and Lee, R. Model inversion attacks against collaborative inference. In Annual Computer Security Applications Conference (ACSAC), 2019.
Chung, H., Kim, J., Mccann, M. T., Klasky, M. L., and Ye, J. C. Diffusion posterior sampling for general noisy in- verse problems. In International Conference on Learning Representation (ICLR), 2023.
Ho, and Salimans, T. Classifier-free diffusion guidance. In NeurIPS Workshop Deep Generative Models and Downstream Applications, 2021.
Darcet, T., Oquab, M., Mairal, J., and Bojanowski, P. Vision transformers need registers. International Conference Learning Representations (ICLR), 2024.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. Advances in Neural Information Process- ing Systems (NeurIPS), 2020.
Deng. J., Dong, W., Socher, R., L.-J,, Li, K., and Fei-Fei, L. ImageNet: A large-scale hierarchical image database. In JEEE/CVE Conference on Computer Vision and Put- tern Recognition (CVPR), 2009.
Horé, A. and Ziou, D. Image quality metrics: PSNR vs. SSIM. In International Conference on Pattern Recogni- tion (ICPR), 2010.
Kang. Y., Hauswald, J., Gao, C., Rovinski, A., Mudge, T., Mars, J., and Tang, L. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge. In In- ternational Conference on Architectural Support for Pro- gramming Languages and Operating Systems (ASPLOS), 2017.
Dhariwal, and Nichol, A. Diffusion models beat GANS on image synthesis. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
Dong, X., Yin, H., Álvarez, J. M., Kautz, J., Molchanov, P., and Kung, H. Privacy vulnerability of split computing to data-free model inversion attacks. In 33rd British Machine Vision Conference (BMVC), 2022.
Karras, T., Laine, S., and Aila. T. A style-based genera- tor architecture for generative adversarial networks. In IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2019.
Dosovitskiy, A., Beyer, L.,, Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M.. Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. International Conference Learning Representations (ICLR), 2021.
Karras, T., Aittala, M., Hellsten, J., Laine, S., Lehtinen, J., and Aila, T. Training generative adversarial networks with limited data. In Advances in Neural Information Processing Systems (NeurIPS), 2020a.
Erdogan, E., Küpçüi, A., and Çişek, A. E. Unsplit: Data- oblivious model inversion, model stealing, and label in- ference attacks against split learning. In 2/st Workshop on Privacy in the Electronic Society, 2022.
Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T. Analyzing and improving the image quality of StyleGAN. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020b. 2020b.
10

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. In International Conference Learning Representations (ICLR), 2015.
Pasquini, D., Ateniese, G., and Bernaschi, M. Unleashing the tiger: Inference attacks split learning. In ACM SIGSAC Conference Computer and Communications Security, 2021.
Kuhn, H. W. The hungarian method for the assignment problem, Naval research logistics quarterly, 2(1-2), 1955.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML), 2021.
Li, A., Guo, J., Yang, H., Salim, F. D., and Chen, Y. Deepob- fuscator: Obfuscating intermediate representations with adversarial learning on smartphones. In International Conference on tiemmet-of-Thing. Design and Implementation (IoTDI), 2021.
Ramesh, A., Dhariwal, P., Nichol, A., Chu, C.,, and Chen, M. Hierarchical text-conditional image generation with CLIP latents. arXiv preprint arXiv:2204.06/22 2022.
Li, Z., Yang, M., Liu, Y., Wang, J., Hu, H., Yi, W., and Xu, X. GAN you see me? Enhanced data reconstruction attacks against split inference. In Advances Neural Information Processing Systems (NeurIPS), 2023.
Rao, Y., Zhao, W., Chen, G., Tang, Y., Zhu, Z., Huang, G., Zhou, J., and Lu, DenseCLIP: Language-guider dense prediction with context-aware prompting. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft COCO: Common objects in context. In European Con- ference on Computer Vision (ECCV), 2014.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Liu, H., Li, C., Wu, Q., and Lee, J. Visual instruction tuning. In Advances in Neural Information Processing Systems (NeurIPS), 2023.
Matsubara, Y., Levorato, M., and Restuccia, F. Split com- puting and early exiting for deep learning applications: Survey and research challenges. ACM Computing Sur- veys, 2022.
Rudin, L. L., Osher, S., and Fatemi, E. Nonlincar total variation based noise removal algorithms. Physica D: Nonlinear Phenomena, 1992.
Sa, C.-C., Cheng, L.-C., Chung. H.-H., Chiu, T.-C., Wang, C.-Y., Pang, A.-C., and Chen, S.-T. Ensuring bidirec- tional privacy on wireless split inference systems. IEEE Wireless Communications, 2024.
Mireshghallah, F. Taram, M., Ramrakhyani, P., Jalali, A., Tullsen, D., and Esmaeilzadeh, H. Shredder: Learning noise distributions to protect inference privacy. In Inter- national Conference on Architectural Support for Pro- gramming Languages and Operating Systems (ASPLOS), 2020.
Sauer, A., Schwarz, K., and Geiger, A. StyleGAN-XL: Scaling StyleGAN to large diverse datasets. In ACM SIGGRAPHI conference proceedings, 2022.
Mokady, R., Hertz, A., and Bermano, A. H. Clip- cap: Clip prefix for image captioning. arXiv preprint arXiv:2111.09734, 2021.
Singh, A., Chopra, A., Sharma, V., Garza, E., Zhang, E., Vepakomma, P., and Raskar, R. DISCO: Dynamic and invariant sensitive channel obfuscation for deep neural networks. In IEEE/CVF Conference Computer Vision and Patlern Recognition (CVPR), 2021.
Ohta, S. and Nishio, T. A-split: A privacy-preservinn split computing framework for cloud-powered generative ai. arXiv preprint ar arXiv22310.14633 2023.
Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. In International Conference on Learning Representations (ICLR), 2020.
Oquab, M., Darcet, T., Moutakanni, T., Vo, H. V., Szafraniec, M., Khalidov, V., Fernandez, P., HAZIZA, D., Massa, F., El-Nouby, A., et al. Dinov2: Learning robust visual features without supervision. Transactions on Machine Learning Research (TMLR), 2024.
Titcombe, T., Hall, A. Papadopoulos, P., and Romanini, D. Practical defences against model inversion attacks for split neural networks. arXiv preprint arXiv:2104.05744 2021.
Osia, S. A., Shamsabadi, A. S., Sajadmanesh, S., Taheri, A., Katevas, K., Rabiee, H. R., Lane, N. D., and Had- dadi, H. A hybrid deep learning architecture for privacy- preserving mobile analytics. IEEE Internet of Things Journal (IoT-J), 2020.
Ulyanov, D., Vedaldi, A., and Lempitsky, V. Deep image prior. JEEE/CVF conference on Computer Vision and Pattern Recognition (CVPR), 2018

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Vepakomma, P., Singh, A., Gupta, O., and Raskar, R. NoPeek: Information leakage reduction to share acti- vations in distributed deep learning. In International Conference on Data Mining Workshops (ICDMW), 2020.
Wang, Z., Simoncelli, E. P., and Bovik, A. C. Multiscale structural similarity for image quality assessment. In Asilomar Conference Signals, Systems & Computers, 2003.
Xu, X., Yang, M., Yi, W., Li, Z., Wang. J., Hu, H., Zhuang, Y., and Liu, Y. A stealthy wrongdoer: Feature-oriented reconstruction attack against split learning. In IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2024.
Yang. L.. Ding, S., Cai, Y., Yu, J., Wang, J., and Shi, Y. Guidance with spherical gaussian constraint for condi- tional diffusion. In International Conference on Machine Learning (ICML), 2024.
Yang, Y. and Newsam, S. Bag-olsvisual-words and spatial extensions for land-use classification. In SIGSPATIAL international conference advances in geographic in- formation systems, 2010.
Yin, H., Vahdat, A., Alvarez. M., Mallya, A., Kautz, J., and Molchanov, P. AdaViT: Adaptive tokens for effi- cient vision transformer. In IEEE/CVF conference Computer Vision and Pattern Recognition (CVPR), 2022.
Yu, F., Zhang, Y., Song. S., Seff, A., and Xiao, LSUN: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint 03,30,, 2015.
Zhang, L., Rao, A., and Agrawala, M. Adding conditional control to text-to-image diffusion models. In IEEF/CVF International Conference Computer Vision (ICCV), 2023.
Zhang. R., Isola, P., Efros, A. A., Shechtman, E., and Wang, O. The unreasonable effectiveness of deep features perceptual metric. In IEEE Conference Computer Vision and Pattern Recognition ( (CVPR), 2018.
12

---

DRAG: Data Reconstruction Attack using Guided Diffusion
A. Report
A.1. Reconstruction from Frozen Foundation Models
Besides Table 1, we provide a figure in Figure 7 that visualizes the performance of each attack. Additionally, we present the attack success rate (ASR), which is defined the proportion of images for which the reconstruction metrics exceed specified threshold, shown in Figure 7.
Figure 8 illustrates the performance of attacks on the same target images at different split points for CLIP-ViT-B/16. An image from each dataset was chosen for evaluation.
100
8
0.4
0.25
M5-55IM
L-IP
(
12
12
12
0.5
0.2
0.4
0.6.
D3
140 0.
62
04
0.6
28
1.0
0.
0.2
044
05 0. 1.0
Salit Print
Sp8t
Spiit Point
(1)
DINO
(a) CLIP- VIT-B/16 (mean)
(d) CLIP- CLIP-ViT--B B/16 (ASR, Layer 12)
0.75
0.4
0.25
12
12
12
0.5
0.2
0.4
0.6 08
1.0 0.0
02
0.4
0.6
58
100
0.
0.2
0.4
0.6 0.8
1.0
Soltt Point
Spiit Point
Spiit Point
MS 55--53M (1)
1-199(111
(7)
(b) DINOv2-Basd Base (mean)
(c) DINOv2 Base (ASR, Layer 12)
0.8
0.75
0.4
0.25
Spti: Point
Soit Paint
Spltt Point
2090
GLXSS
0.5
0.2 0.4
MS-53IM (1)
0.6
03 10 0.
02 0.6
1-1795
38
100
0.0
0.2
0.5 DND (1)
04
0.8
1.0
0960
GLSSS
(c) CLIP-RNSO (mean)
(I) CLIP-RNSO (ASR, Block 5)
Figure 7: Reconstruction quality metric and attack success rate (ASR) across target models without defenses.
MSCOCO
FFHQ
ImageNet
GT
rMLE
LM
GLASS
DRAG
GT
rMLE
LM
GLASS
DRAG
GT
rMLE
LM
GLASS
DRAG
Layer
Layer 3
Layer 6
Layer 9
Layer 12
Figure 8: Reconstruction results for CLIP-VIT-B/16 across split points without defenses. The same images are used as evaluation targets to compare the performance of previous attacks.
13

---

DRAG: Data Reconstruction Attack using Guided Diffusion
A.2. Reconstruction from Privacy Guarded Models
Table 6 provides the model utility, which is measured by classification accuracy on ImageNet- IK. The complete quantitative results for Section 5.4, conducted on -VT--V61B/11 and DINOv2- 2-Base, presented in Table and Figure 9.
Table 6: Model utility under privacy defenses, measured by ImageNet- 1K classification accuracy.
Defense
Config
Parameters
CLIP- ViT-B/16
DINOv2-Base
w/o defense
79.87%
83.81%
PD 0.95, rp 0.1
79.20%
83.51%
DISCO
II
0.75, Pp 0.2
79.02%
83.46%
PD 0.95, rp 0.5
78.04%
82.85%
IV
PN 1.0
79.28%
83.43%
NoPeck
PN 3,0
78.67%
83,39%
VI
PN 5.0
77.88%
83.22%
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS DRAG
(a) Config-l
(b) Config-II
(c) Config-Ill
rMILE
LM
GLASS
DRAG
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS DRAG
(d) Config-l (adaptive attacks)
(e) Config-II (adaptive attacks)
(l) Config-III (adaptive attacks)
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS
DRAG
rMLE
LM
GLASS DRAG
(g) Config-IV
(h) Config-V
Config- VI
Figure Reconstruction results for CLIP-ViT-B/16 under various defense configurations.
14

---

DRAG: Data Reconstruction Attack using Guided Diffusion
Table 7: Performance of the optimization-baste attack against various defenses, split at layer 12.
CLIP-ViT-B/16
DINOv2-Bas Base
Config
Method
MS-SSIM
LPIPS +
DINO f
MS-SSIM f
LPIPS +
DINO f
rMLE
0.1957
0.7881
0.1768
0.3840
0.5993
0.4710
LM
0.1749
0.6690
0.1965
0.3953
0,5112
0.7031
Config-1
GLASS
0.2138
0.5568
0.4783
0.3881
0.4222
0.6667
DRAG
0.3309
0.4793
0.6497
0.7392
0.1602
0.9370
IMLE
0.1706
0.8145
0.1101
0.3840
0.5993
0.4710
LM
0.1800
0.6838
0.1872
0.3953
0.5112
0.7031
Config-ll
GLASS
0.2050
0.5627
0.4433
0.3881
0,4222
0.6667
DRAG
0.2704
0.5264
0.6015
0.7392
0.1602
0.9370
rMLE
0.1686
0.8128
0.1129
0.2469
0.6571
0.2463
LM
0.1638
0.7079
0.1654
0.3198
0.5770
0.4781
Config-Ill
GLASS
0.1479
0.6225
0.3878
0.2699
0.4884
0.5310
DRAG
0.0788
0.7449
0.3201
0.5703
0.2880
0.8432
MMLE
0.4062
0.5088
0.6880
0.4481
0.5796
0.5597
Config-1
LM
0.1765
0.6996
0.1962
0.4336
0.4916
0.8097
w/ adaptive
GLASS
0.2321
0.5443
0,4770
0.4526
0.3849
0,6962
DRAG
0.5930
0.2489
0.8772
0.7918
0.1218
0.9573
rMLE
0,3837
0.5498
0.6229
0.3851
0.6160
0.4820
Config-II
LM
0.1833
0.6816
0.2056
0.4155
0.4939
0.8124
w/ adaptive
GLASS
0.2157
0.5630
0.4528
0.4242
0.3967
0.6954
DRAG
0.6076
0.2347
0.8830
0.7783
0.1329
0.9489
MMLE
0.2101
0.7822
0.2072
0.3993
0.5794
0.5063
Config-IlI w/ adaptive
LM
0.1696
0.6953
0.1818
0.4068
0.5104
0.7899
GLASS
0.2402
0,5401
0,4862
0.4052
0.3971
0.6792
DRAG
0.4557
0.3778
0.7557
0.7551
0.1467
0.9415
MMLE
0.2799
0.6604
0.4729
0.2428
0.6822
0.2546
LM
0.1834
0.7159
0.2271
0.2852
0.6868
0.7270
Config-IV
GLASS
0.1837
0.6707
0.3381
0.3499
0.4664
0,6782
DRAG
0.5526
0.2925
0.8778
0.6252
0.2216
0.9243
rMLE
0.2348
0,6939
0.3863
0.2306
0.6653
0.3183
LM
0.1782
0.7377
0.2114
0.2546
0.7107
0.6272
Config- V
GLASS
0.1715
0.6864
0.3043
0.3710
0.4447
0.6446
DRAG
0.4889
0.3369
0.8381
0.5235
0.2790
0.9106
MMLE
0.2270
0.7048
0.3747
0.2218
0.6821
0.3136
LM
0.1783
0.7917
0.2099
0.2410
0.7140
0.5797
Config- VI
GLASS
0.1950
0.7248
0.3141
0.3620
0.4339
0.6516
DRAG
0.4469
0.3836
0.8096
0.5010
0.2977
0.9093
15

---

DRAG: Data Reconstruction Attack using Guided Diffusion
A.3. Execution Time
The execution times for each attack algorithm are provided in Table
Table 8: Execution times for optimization- attacks at deepest split points.
Method
# of Iterations
CLIP-ViT-B/16
DINOv2- Baseee-Base
CLIP-RN50
IMLE
20,000
min 42
min 13
min 04
LM
20,000
24 min 20
24 min 32
22 min 27
GLASS (SY/KGAN2-ADA-FFO)))
20,000
21 min 28
22 min 02
19 min 45
GLASS (SyykGANN
20,000
I hr 37 min 08
I hr 37 min 02
1 hr 34 min 34
DRAG (SDv1.5)
4,000
32 min 52
33 min 04
32 min 40
B. Extended Experiments
B.1. Scaling Reconstruction Schedule
Increasing T or k improves reconstruction performance by allowing more refinement steps, especially in the deeper layer. However, it also raises computational overhead. Figure 10a and Figure 10b visualizes the attack performance for different values of T and k. Since T = 250 and k 16 provides a satisfactory balance between performance and efficiency, we adopt it as the default hyperparameter setting.
B.2. Guidance Strength
The guidance strength w balances feature matching and image prior during sampling. Increasing enhances guidance by focusing more on minimizing the distance dx, but this may compromise the realistic property Rī as defined in Equation (I), Conversely, an excessively low w results in an unsuccessful attack due to insufficient guidance. Figure 10c presents the relationship between w and reconstruction performance.
also tested Equation (8) with linear interpolation (lerp) and spherical linear interpolation (slerp), but found no significant performance differences.
B.3. Importance of the Optimizer
Figure 10d compares the performance of attacks on IR from layer 12 with and without the Adam optimizer. The figure demonstrates that smoothing gradients with non-convex optimization techniques significantly enhances attack performance, especially the deeper layer.
C. Baseline Attacks
rMLE.. (He et al., 2019) first proposed an optimization-based reconstruction attack that reconstructs x" by optimizing a vero-initialized x to minimize (x),, h²). To improve reconstruction quality, the method incorporates Total Variation regularization (Rudin et al., 1992) as an image prior:
x' arg min (x(((())),)))) ArvRTv(xx. xEX
(13)
LM. (Singh al., 2021) enhances reconstruction quality by applying deep image prior (Ulyanov et al., 2018) to regularize Rather than updating they re-parameterize it the output of a CNN-based image synthesis model fo(e), where the fixed input (O, remain constant during optimization, while the model parameters 0 are optimized:
= arg min dx (fo(o(e))))) h²) + XrvRtv(x).
(14)
Since ViTs divide images into non-overlapping patches, directly optimizing x often yields visible artifacts at patch boundaries. To alleviate this, we add the patch-smoothness prior Rpatch from Hatamizadeh et al. (2022) both the rML.E and LM
16

---

DRAG: Data Reconstruction Attack using Guided Diffusion
objectives when reconstructing images from ViTs:
# -1
Reatch (x)
| P.k.;
x/: P.
1,4:112 +
|xx|, P- P. x(i;;, P- 1,:112.
(15)
where denotes the patch size of the VIT model.
GLASS. (Li et al., 2023) proposed scenario in which the adversary has knowledge of the data distribution and access to auxiliary data for training StyleGAN. Instead of directly updating the adversary updates the latent code Z or the style code w E W to improve the quality of the generated image. In the first stage, the latent code z is randomly
1.0
1.0
0.9
0.8
0.9
T=50
0.6
0.7
0.8
T=100
0.7
T=125
0.4
0.5
T=250
MS-SSIM
LPIPS
DINO (
T-500
0.2
0.3
0.5
12
Split Point
Split Point
Split Point
(a) Effect of denoising steps T.
1.00
0.9
0.95
0.95
0.85
k=4
0.7
0.75
0.90
k=8
0.85
k=16
0.5
0.65
0.80
kw
MS-SSIM
t
LPIPS )
0.75
DINO
k=32
0.3
6
12
3
12
12
Split Point
Split Point
Split Point
(b) Effect of internal iterations k.
0.7
0.85
0.95
0.80
0.90
0.6
0.75
0.85
0.70
lerp
0.5
0.80
slerp
0.65
0.4
MS-SSIM t
0.60
LIPS 4
0.75
DINO (
0.10 0.15
0.20 0.25 0.30
0.10 0.15
0.20 0.25 0.30
0.10 0.15 0.20 0.25 0.30
Guidance strength w
Guidance strength w
Guidance strength w
Effect of guidance strength w at layer 12.
0.9
0.9
0.9
0.7
0.8
0.8
w/ Adam
0.7
0.5
0.7
w/o Adam
0.6
MS-SSIM )
1
LPIPS
DINO (
0.3
0.5
6
12
12
Split Point
Split Point
Split Point
(d) Performance comparison of DRAG with and without the Adam optimizer.
Figure 10: Hyperparameter sensitivity analysis for DRAG CLIP-ViT-B/16.
17

---

DRAG: Data Reconstruction Attack using Guided Diffusion
initialized from a standard normal distribution, (O, I), and is then update as follow:
z'
arg min du (f h²) + (TV + AKL (z), ZEZ
(16)
where RKL. is the Kullback-Leible divergence that regularize the latent code z. The updated latent code z' is then transformed to the style code w = f Smap (z'),,), which is subsequently updated for fine-grained reconstruction:
w
arg min du (f (),G(("")) h²) ) + Rrv(x..
(17)
For class-conditioned GANs, we further optimize a zero-initialized class logits vector E R.0000 which is normalized via the softmax function to produce class probabílities p = softmax(1) during the forward pass w =mupp (z', Ep). Then p multiplied by the class embeddings E E I0dx1000 1000 to compute the class-specific latent code Ep.
D. Defensive Algorithms
D.1. Privacy Leakage Mitigation Methods
DISCO. (Singh et al., 2021) introduces a method to mitigate privacy leakage by pruning a subset of the IRs' channels before transmitting them to the server. Specifically, the pruning operation h' = fp, rp) is performed using an auxiliary channel pruning module fp. where the pruning ratio rp controls the proportion of pruned channels. This ratio can be dynamically adjusted during model inference. The pruning module fp is trained in min-max framework, where fp minimizes privacy leakage by maximizing the reconstruction loss, and the inverse network f--1 minimizes the reconstruction loss:
Tuiil E(funi (fs((').)))
I Typrivay Bi[.s (hh)) - x x||2];
(18)
min 1 Lprivac + PD min Lun]. f=
fp
fer.
NoPeek. (Vepakomma al., 2020) aims to mitigate privacy leakage by training models minimize the mutual information T(X; H) between the input data X and the intermediate representation H. Since directly calculating 7(X;H) H) is challenging, the authors propose using distance correlation (dCor) as a surrogate measure:
min Eipn dCor(ff(xx)xx) + fu v)
(19)
fe.f.
While Vepakomma et al. (2020) assumes that users pre-train the target models f from scratch using distance correlation loss, our experiments differ by applying the loss during model fine-tuning. This adaptation allows us to leverage pre-existing model knowledge while still addressing privacy concerns.
D.2. Implementation of Defense Mechanisms
Since the target models are not pre-trained on ImageNet-I they lack classification heads tailored for the ImageNet-1 K classification task. While it is possible to directly initialize random classification heads and train with DISCO or NoPeck, this approach significantly degrades accuracy. To address this, we prepare target models f through a two-stage process. First, perform linear probing by freezing the pre-trained backbone and training only the classification head on D Prrvvate. Then, fine-tune the entire model using the selected defense mechanism. This strategy helps preserve classification performance during the defensive training phase.
To ensure the effectiveness and robustness of DRAG, we adopt an informed defender threat model, assuming the client has full knowledge of DRAG. Under this assumption, defenders can design countermeasures by leveraging insights from the methodology of DRAG. Specifically, for DISCO, we employ an inverse network with the same architecture as described in Section 4.4. For NoPeek, we adopt the same distance metric du as defined in Equation (11), which reflects how an informed defender would calibrate a privacy-preserving model against DRAG.
18

---

DRAG: Data Reconstruction Attack using Guided Diffusion
E. Implementation Details
We list the hyperparameters for various optimization-bant and learning-based reconstruction attacks in Table and Table 10, respectively. The experiments were conducted on server equipped with 384 GB RAM, two Intel Xeon Gold 6226R CPUs, and eight NVIDIA RTX A6000 GPUs.
The implementation of rMLE (He al., 2019), LM (Singh et al., 2021), DISCO (Singh al., 2021) and NoPeek (Vepakomma et al., 2020) are adapted from prior works.!
Table 9: Default hyperparameters for the optimization-base based reconstruction attacks.
rMLE
LM
GLASS
Optimizer
Adam (Ir = 0.05) 20,000
Adam (Ir = 0.01) 20,000
Adam (Ir = 0.01)
Num iters (n) Pretrained model
20,000
StyleGAN2-ADA (FFHQ)
StyleGAN-XL (ImageNet-IKg
ATv
1.5
0.05
Apatch
0.001
0.001
Aez
0
0
0
AKI.
1.0
DRAG
DRAG+
Strength (s)
1.0
0.3
DDIM randomness (n)
1.0
1.0
Guidance strength (w)
0.2
0,2
Max grad norm (Cmax)
0.02
0.02
Sampling steps (T)
250
250
Seff-recurrence (k)
16
16
\Tv
0
0
patch
0
0
0.01
0.01
Table 10: Hyperparameters for inverse network training across all experiments.
Optimizer
Adam 0.001)
LR Scheduler
Cosine annealing (linear warm-up in 5000 iterations)
Number of iterations
100,000
Batch size
256
Mask ratio (rmak)
0.25
19


Reviews:
[{"review_id": "Tk5jnvfCH3", "reviewer": "Reviewer_u9u9", "summary": "The paper introduces a new reconstruction attack method, DRAG (Data Reconstruction Attack using Guided Diffusion), that reconstructs private data from intermediate representations in split Inference settings. Unlike previous attacks on small CNNs, DRAG employs Latent Diffusion Models (LDMs) to iteratively improve reconstructions, resulting in high-fidelity image recovery from the deep-layer intermediate representations of CLIP and DINOv2. The experimental results indicate that the propsoed method surpasses existing attacks (e.g., rMLE, LM, GLASS) in deep layers and maintains effectiveness against privacy defenses such as DISCO and NoPeek. Furthermore, the enhanced version, DRAG++, utilizes an inverse network for improved initialization, leading to higher attack success rates. The results highlight significant privacy risks in vision foundation models, emphasizing the necessity for stronger defenses within SI frameworks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We address your concerns point by point below.\n\n---\n> Fig. 2 is not very effective for understanding, even though it is drawn simply. The caption should include additional explanations.\n\nWe agree that enhancing the caption and associated text will improve clarity. We will revise the figure accordingly and upload the updated version to OpenReview before 4/8.\n\n---\n> The paper evaluates DRAG against DISCO (2021) and NoPeek (2020), but these defenses are somewhat outdated.\n\nThank you for pointing out this issue. We chose DISCO and NoPeek as target defenses because they are representative of the approaches highlighted in GLASS, and they provide a well-established baseline for comparison. Additionally, we have identified several more recent works [4-6], and we will include evaluations against these newer defenses in the next revision to offer a more comprehensive assessment.\n\n---\n> The method is not specifically designed for ViT or deeper layer models. Its applicability to CNNs and potential performance improvements over other methods remain unclear.\n\nDRAG is broadly applicable to all models regardless of architecture. To address it, we evaluated our method on CLIP-RN50. Key results are presented in Table 2 of the main paper. Detailed experimental results can be found in Appendix A, specifically Table 6, Fig. 6c) and Fig. 7c). We will reorganize the paper to more clearly direct readers to the experimental results and improve overall clarity.\n\nThe table below—captured from Appendix A—illustrates DRAG's effectiveness compared to other methods in reconstructing data from CLIP-RN50. In this experiment, the $d_\\mathcal{H}$ was implemented using MSELoss. Due to space limitations, we have presented results for model splits at blocks 4 to 5.\n\n|Split Point| Method | MS-SSIM ($\\uparrow$) | LPIPS ($\\downarrow$) | DINO ($\\uparrow$) |\n| - | - |:-:|:-:|:-:|\n|Block 4|rMLE|0.4888|0.4198|0.7776|\n||LM   |0.5855|0.2576|0.9012|\n||GLASS|0.4872|0.3568|0.7315|\n||DRAG |**0.7896**|**0.0898**|**0.9622**|\n|Block 5|rMLE |0.3980|0.5006|0.6739|\n||LM   |0.4432|0.3409|0.7614|\n||GLASS|0.2917|0.4223|0.6811|\n||DRAG |**0.5206**|**0.2231**|**0.9001**|\n\n---\n> The experimental results lack discussion. The method is more effective at reconstructing data from deep layers compared to shallow layers. What accounts for this difference?\n\nOptimization-based DRAs optimize the sample $x$ by minimizing $d_\\mathcal{H}$. When the split point is deep, this primarily guides $x$ to align with the high-level features of the target image, without necessarily ensuring a match of pixel-level accuracy. Prior DRAs often fail in reconstructing the image from deep-layer IR because they do not sufficiently restrict the search space. To improve DRA, we leverage a diffusion prior to constrain $x$, based on the assumption that the private image is an natural image.\n\n---\n> The paper should include the discussion of FORA, etc,. methods.\n\nWe agree that FORA and related works are important to discuss in the context of privacy threats in split inference, and we will include a discussion of these methods in the revised paper.\n\nThese works consider privacy risk under a different configuration from ours by exploring query-free data reconstruction attacks in split learning. In that setup, the attacker cannot directly access $f_c$ but may capture or interfere with the training process to build a surrogate model $\\tilde{f}_c \\approx f_c$. Once this surrogate model is built, attackers can reconstruct private data using either optimization-based (e.g., DRAG) or learning-based methods. Xu et al. [1] note that combining these two research areas can lead to more powerful reconstruction attacks, as their developments are independent. \n\nOn the other hand, our work focuses on the privacy risks associated with using foundation models as part of the model parameters in downstream tasks, implying that an attacker can feasibly access $f_c$ directly. Our findings highlight the need to develop privacy-preserving inference techniques, especially as new applications [2, 3] increasingly leverage foundation models.\n\n---\nWe appreciate your feedback and remain available to address any additional questions or concerns you may have.\n\n### Reference\n[1] Xu, X., et al. A stealthy wrongdoer: Feature-oriented reconstruction attack against split learning. In CVPR, 2024.\n\n[2] Liu, H., et al. Visual instruction tuning. In NeurIPS, 2023.\n\n[3] Chen, J., et al. Minigpt-v2: large language model as a unified interface for vision-language multi-task learning. arXiv preprint arXiv:2310.09478. 2023\n\n[4] Wang, T., et al. Improving robustness to model inversion attacks via mutual information regularization. In AAAI, 2021\n\n[5] Zou, T., et al. Mutual information regularization for vertical federated learning. arXiv preprint arXiv:2301.01142. 2023\n\n[6] Duan, L., et al. Reimagining Mutual Information for Enhanced Defense against Data Leakage in Collaborative Inference. In NeurIPS. 2024", "claims_and_evidence": "The paper presents empirical evidence supporting its claims through quantitative experiments on several benchmarks (MSCOCO, FFHQ, ImageNet-1K) and thorough comparisons with previous data reconstruction attacks (rMLE, LM, GLASS). The findings indicate that DRAG offers superior reconstruction quality, especially at deeper layers of CLIP and DINOv2. This reinforces the main assertion that large vision foundation models are susceptible to privacy attacks in split inference (SI) scenarios.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are well-suited for assessing reconstruction quality, utilizing vision foundation models such as CLIP and DINOv2 alongside benchmark datasets like MSCOCO, FFHQ, and ImageNet-1K. Metrics including MS-SSIM, LPIPS, and DINO similarity effectively evaluate both low- and high-level fidelity. Additionally, comparisons with rMLE, LM, and GLASS confirm the improvements made. The inclusion of privacy defenses (DISCO and NoPeek) further strengthens the analysis.", "theoretical_claims": "This paper is primarily empirical rather than theoretical, focusing on experimental validation of data reconstruction attacks rather than formal proofs.", "experimental_designs_or_analyses": "The paper shows a comprehensive experimental design that evaluates prominent vision models (CLIP, DINOv2) and benchmark datasets (MSCOCO, FFHQ, ImageNet-1K). It effectively compares previous attack methods (rMLE, LM, GLASS) and incorporates multiple reconstruction quality metrics (MS-SSIM, LPIPS, DINO similarity) for an in-depth analysis. However, The paper evaluates DRAG against DISCO (2021) and NoPeek (2020), which are relatively older defenses in the evolving landscape of privacy-preserving machine learning.", "relation_to_broader_scientific_literature": "The paper builds upon prior work in **data reconstruction attacks**, **diffusion models**, and **split inference** privacy risks, contributing a novel diffusion-guided approach for reconstructing private data from intermediate representations.", "essential_references_not_discussed": "A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning, CVPR 2024\nGAN-based data reconstruction attacks in split learning,", "other_strengths_and_weaknesses": "Weakness:\n\n\n+ Figure 2 is not very effective for understanding, even though it is drawn simply. The caption should include additional explanations.\n\n+ The paper evaluates DRAG against DISCO (2021) and NoPeek (2020), but these defenses are somewhat outdated.\n\n+ The method is not specifically designed for ViT or deeper layer models. Its applicability to CNNs and potential performance improvements over other methods remain unclear. \n\n+ The experimental results lack discussion. The method is more effective at reconstructing data from deep layers compared to shallow layers. What accounts for this difference?\n\n+ The paper should include the discussion of FORA (A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning 2024 CVPR), etc,. methods.", "other_comments_or_suggestions": "Please refer to Other Strengths and Weaknesses.", "questions_for_authors": "Please refer to Other Strengths and Weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zNmHKRW13t", "reviewer": "Reviewer_DMzW", "summary": "This paper proposes a data reconstruction attack in split inference. The proposed method is based on guided diffusion, which leverages the rich prior knowledge embedded in a latent diffusion model (LDM) pre-trained on a large-scale dataset. The proposed method performs iterative reconstruction on the LDM’s learned image prior, effectively generating high-fidelity images resembling the original data from their intermediate representations (IR). Extensive experiments demonstrate that the proposed approach outperforms prior methods.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We address your concerns point by point below.\n\n---\n> The proposed method make sense for the problem and application. However, the paper lacks details on the attack framework. The author only refer to the Figure 2 for the attack framework. In Figure 2, why all images look like noise for timesteps 0 to $T$? $g_t$ in equation 6 is not clear shown in the figure. Algorithm 1 is never cited, and the symbols in the algorithm are not explained. \n\nWe apologize for the lack of clarity regarding the DRAG framework in the draft. In the revised manuscript, we will provide a detailed description of the DRAG approach and address several points. In Figure 2, we currently want to decipt that $x_{t-1}$ to $x_0$ are to be computed, and we will further improve the legend to enhance clarity. Additionally, we will explicitly illustrate and define $g_t$ in Figure 2 to clearly depict its role. We will also properly reference Alg. 1 in the main paper and include thorough explanations for all associated symbols.\n\n---\n> In line 225, it is unclear why there is a loop and what is the value for $k$ in the experiments. If the attack requires back propogation for every timestep, the attack should experience very long runtime. If the attack does not require back propogation for every timestep, it is unclear what backprop. is done for the diffusion model.\n> \n> How does the back propagation applied to the diffusion model as suggested in Figure 2?\n\nTo clarify, DRAG requires back-propagation at each timestep to reconstruct the image, and the number of iterations $k$ in the inner loop controls the reconstruction quality. Figure 11b) illustrates the trade-off between reconstruction quality and execution time, while Table 9 provides execution times for various DRAs. Although the algorithm includes an inner loop, our experiments demonstrate that this approach leads to higher reconstruction performance when the split point is deep, thereby highlighting significant privacy threats.\n\nThe back propagation computes the gradient for the sample $x_t$, which is then used to adjust the sampling process of $\\epsilon_t$ according to Eq. 8 during DDPM denoising.\n\n---\n> In section 2.2 line 98-99, the author mentions three types of DRA, however, only one of them is introduced in this section.\n\nThanks for pointing out this issue. We will revise this section to mention the other types of DRA for a more comprehensive review.\n\n---\n> Below is a work solving the same problem by using diffusion model, and the target model is ViT. I suggest comparing DRAG with DIA.\n\nIn our framework, DIA can be viewed as an enhancement to the inverse network $f_c^{-1}$ within our reconstruction pipeline (see Fig. 2), as it provides a better initialization for the optimization-based reconstruction process. Notably, the $f_c^{-1}$ component is optional and requires extra data and model training. In contrast, DRAG leverages a publicly available diffusion model and does not require additional training or data, aligning with the prior work we compared against.\n\n---\nWe appreciate your feedback and remain available to address any additional questions or concerns you may have.", "claims_and_evidence": "I didn't find claims that are problematic.", "methods_and_evaluation_criteria": "The proposed method make sense for the problem and application. However, the paper lacks details on the attack framework. The author only refer to the Figure 2 for the attack framework. In Figure 2, why all images look like noise for timesteps 0 to T? g_t in equation 6 is not clear shown in the figure. Algorithm 1 is never cited, and the symbols in the algorithm are not explained. In line 225, it is unclear why there is a loop and what is the value for k in the experiments. If the attack requires back propogation for every timestep, the attack should experience very long runtime. If the attack does not require back propogation for every timestep, it is unclear what backprop. is done for the diffusion model. \n\nThe evaluation criteria is solid.", "theoretical_claims": "There is no theoretical claim and proof.", "experimental_designs_or_analyses": "This paper lacks experimental details. There is no information is provided for the number of timestep T, the t in Algorithm 1.\n\nBesides the above parameters, the experiments are comprehensive and convincing.", "relation_to_broader_scientific_literature": "This work focus on an important research area. However, this paper lacks compare with recent methods which addressing the same proble. See below.", "essential_references_not_discussed": "Below is a work solving the same problem by using diffusion model, and the target model is ViT. I suggest comparing DRAG with this work.\n\nChen, D., Li, S., Zhang, Y., Li, C., Kundu, S. and Beerel, P.A., 2024. DIA: Diffusion based Inverse Network Attack on Collaborative Inference. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 124-130).", "other_strengths_and_weaknesses": "Strengths:\n\nThis paper provides defense methods to DRA.\n\nWeakness:\n\nIn section 2.2 line 98-99, the author mentions three types of DRA, however, only one of them is introduced in this section.", "other_comments_or_suggestions": "I don't have additional comments or suggestions.", "questions_for_authors": "How does the back propagation applied to the diffusion model as suggested in Figure 2?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wloR35THI7", "reviewer": "Reviewer_WYvj", "summary": "- This paper is about reconstruction attacks in split inference (SI) configurations. Specifically, this paper studies reconstructing a datapoint given the intermediate representation of that datapoint in a deep models\n- The paper proposed guided diffusion to do this attack (DRAG), where the guidance term is given by a cosine similarity between the reconstruction intermediate embedding and the target embedding\n- The authors validate they method on pretrained CLIP models, and for models with defences applied, showing good results compared to existing methods\n- DRAG++ is also proposed (in a very rushed fashion) which also uses an inverse model to bootstrap the attack", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We address your concerns point by point below.\n\n---\n> it is unclear what dataset the GAN used in GLASS is trained on, and how that compared to the dataset that the diffusion model DRAG is trained on, and should be mentioned in more detail.\n\nIn our evaluation of GLASS, we used two GAN models: StyleGAN2-ADA (trained on FFHQ) and StyleGAN-XL (trained on ImageNet). These models are the most relevant publicly accessible GANs, to the best of our knowledge. We assume that GLASS has prior knowledge of the target image distribution; therefore, if the private image is from FFHQ, the attacker selects StyleGAN2-ADA, and if not, StyleGAN-XL is selected. This setup inherently gives advantages to GLASS in the comparison.\n\nOn the other hand, DRAG utilizes SDv1.5, pretrained on a subset of LAION-5B, to demonstrate the effectiveness of the diffusion prior with the support of a large dataset. This choice reflects the evolving nature of DMs and their accessibility, potentially reducing the attacker's cost in preparing the model. We will update the paper to include these experimental details for improved clarity.\n\n---\n> There is very limited explanation of the DRAG++ method. In particular:\n> 1. Can we write out the DRAG++ pseudocode in full? At least in the appendix\n> 2. What are the details of the dataset used to train the reconstruction network? How sensitive is DRAG++ to the choice of public dataset\n> 3. I think DRAG++ should be explained earlier in the paper rather than at the end right before the conclusion. At the moment it seems like it was added ad-hoc\n\nWe agree that DRAG++ should be introduced earlier in the paper. We will also include the full DRAG++ pseudocode in the appendix to provide complete details. In brief, DRAG++ uses an auxiliary $f_c^{-1}$ to initialize $x_{t}$ and denoises from $t=sT$ (where $s \\in [0,1]$), while the core guided diffusion remains unchanged. We refer to DRAG++ as an optional enhancement, since $f_c^{-1}$ is an auxiliary component for attackers who have the resources to train such a network. Regarding the training dataset of $f_c^{-1}$, we train it on the ImageNet-1K training split (using 50% of the data, while assuming the other 50% is not accessible to the attacker).\n\nTo evaluate the sensitivity of DRAG++ to the choice of public dataset, we also train $f_c^{-1}$ on other datasets. For a fair comparison, we randomly sampled 60,000 images from the dataset to serve as the training data. Our results indicate that using a less diverse dataset (e.g., FFHQ) leads to a slight performance drop, whereas training on more complex datasets (e.g., ImageNet or MSCOCO), maintains similar performance.\n\n| Split Point | Dataset | MS-SSIM ($\\uparrow$) | LPIPS ($\\downarrow$) | DINO ($\\uparrow$) |\n|--|:- |:-:|:-:|:-:|\n|Layer 9| ImageNet |0.8062|0.0914|0.9682|\n|| MSCOCO   |0.8037|0.0944|0.9655|\n|| FFHQ     |0.7805|0.1021|0.9632|\n|Layer 12| ImageNet |0.6987|0.1732|0.9412|\n|| MSCOCO   |0.6850|0.1867|0.9407|\n|| FFHQ     |0.6568|0.2092|0.9325|\n\n---\n> The largest concern is that the paper is that there is both the reconstruction model and the attack DM are trained on the same domain. \n\nTo address this concern, we designed an experiment to evaluate the OOD capability of using a DM as an image prior in DRA. In this experiment, we employ the checkpoint \"google/ddpm-bedroom-256\" from HuggingFace, which we denote as DRAG* to distinguish it from DRAG using SDv1.5. The inference model used is CLIP-ViT-B/16, and the evaluation is performed on the same dataset as in our paper. The bold number, shown among rMLE, LM, GLASS, and DRAG*, indicates the best score. The original score of DRAG is also provided for reference.\n\n| Split Point | Method | MS-SSIM ($\\uparrow$) | LPIPS ($\\downarrow$) | DINO ($\\uparrow$) |\n|:-|:-|:-:|:-:|:-:|\n| Layer 9 | rMLE | 0.4957    | 0.5131    | 0.7086    |\n|| LM   | **0.6681**| **0.2138**| **0.9037**|\n|| GLASS| 0.3852    | 0.4310    | 0.6648    |\n|| DRAG*|   0.5378  |   0.3940  |   0.8147  |\n|| DRAG |   0.7974  |   0.0967  |   0.9652  |\n| Layer 12| rMLE |   0.3884  | 0.5900    |   0.6462  |\n|| LM   | 0.2560    | 0.6024    | 0.4097    |\n|| GLASS| 0.2396    |   0.5790  | 0.4578    |\n|| DRAG*| **0.3958**| **0.4941**| **0.7240**|\n|| DRAG |   0.6735  |   0.1857  |   0.9331  |\n\nThese experimental results show that DRAG using an OOD DM outperforms rMLE, LM, and GLASS in Layer 12 according to LPIPS and DINO metrics, thereby demonstrating the effectiveness of leveraging DMs in DRAs under an OOD configuration.\n\n---\n> For ResNet models, do you still use the same cosine loss function given in equation 10? The authors only specify this for transformer models.\n\nWe have applied MSELoss as the distance metric $d_\\mathcal{H}$ for all DRAs while attacking CLIP-RN50. We would mention this configuration earlier in the revised menuscript.\n\n---\nWe appreciate your feedback and remain available to address any additional questions or concerns you may have.", "claims_and_evidence": "Most of the claims are substantiated. See other sections for specific details.\n\nI think that generally speaking, the attack seems promising and the results are convincing, particularly when compared to equivalent attacks in the same settings. However, it is unclear what dataset the GAN used in GLASS is trained on, and how that compared to the dataset that the diffusion model DRAG is trained on, and should be mentioned in more detail", "methods_and_evaluation_criteria": "There is very limited explanation of the DRAG++ method. In particular:\n1. Can we write out the DRAG++ pseudocode in full? At least in the appendix\n2. What are the details of the dataset used to train the reconstruction network? How sensitive is DRAG++ to the choice of public dataset\n3. I think DRAG++ should be explained earlier in the paper rather than at the end right before the conclusion. At the moment it seems like it was added ad-hoc", "theoretical_claims": "There are no theoretical concerns in this paper.", "experimental_designs_or_analyses": "There are a few concerns:\n1. The largest concern is that the paper is that there is both the reconstruction model and the attack diffusion model are trained on the same domain. Appendix A.3. claims that they do this, testing on the UCMerced LandUse data, but because they are using pretrained diffusion models (stable Diffusion 1.5), it is unclear how much contamination there is in the diffusion model.\n2. I am not convinced that fine-tuning the bast model on distinct subsets of the dataset ensures separation, as the base model is already pretrained on data which might include both the private and public splits of data.\n3. To fix this, I think it would be best to train models from scratch (at least in one section of the paper). In this case the inference model could, for example, be trained on CelebA, and the diffusion model be trained on ImageNet. This would ensure that there is no leakage in the paper.", "relation_to_broader_scientific_literature": "This paper proposes another reconstruction attack for the split inference setting. It is not particularly surprising that such an attack works, however this is good validation. I think that using diffusion models in reconstruction attacks is a promising general research direction.", "essential_references_not_discussed": "None that I am aware of.", "other_strengths_and_weaknesses": "Main concerns are in the experimental design/analysis section.", "other_comments_or_suggestions": "None.", "questions_for_authors": "- For ResNet models, do you still use the same cosine loss function given in equation 10? The authors only specify this for transformer models.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xvOjT3n9Ao", "reviewer": "Reviewer_i33r", "summary": "This paper proposes DRAG, a new data reconstruction attack under the guidance of diffusion models. This method utilizes the rich prior knowledge embedded in the latent diffusion model and firstly reconstructs data from vision foundation models. Experiments have shown the superiority of DRAG to some extent.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We address your concerns point by point below.\n\n---\n> 1. Related to the evaluation metrics\n\nThe choice of metrics is highly application dependent, and our selections were guided by prior works in this area. In our study, we focused on MS-SSIM, LPIPS, and DINO because they better capture human perceptual similarity and privacy leaks. PSNR and MSE are sensitive to translation and other low-level distortions. However, we are open to including PSNR to offer a more comprehensive analysis. \n\n---\n> 2. It would be better to provide comparisons with more SOTA attacks. \n> 3. The assumption that the attacker has white-box access to the model architecture and parameters is a strong setting, which is usually unpractical in real-world scenarios. \n> \nWe agree that FORA [1] and related works are important to discuss in the context of privacy threats in split inference, and we will include a discussion of these methods in the revised paper.\n\nThese works consider privacy risk under a different configuration from ours by exploring query-free data reconstruction attacks in split learning. In that setup, the attacker cannot directly access $f_c$ but may capture or interfere with the training process to build a surrogate model $\\tilde{f}_c \\approx f_c$. Once this surrogate model is built, attackers can reconstruct private data using either optimization-based (e.g., DRAG) or learning-based methods. Xu et al. [1] note that combining these two research areas can lead to more powerful reconstruction attacks, as their developments are independent. \n\nOn the other hand, our work focuses on the privacy risks associated with using foundation models as part of the model parameters in downstream tasks, implying that an attacker can feasibly access $f_c$ directly. Our findings highlight the need to develop privacy-preserving inference techniques, especially as new applications [2, 3] increasingly leverage foundation models.\n\n---\n> 4. What about the performance on smaller CNN models like ResNet? More evaluation on the CNN models utilized in previous works is expected for alignment with the baselines.\n\nDRAG is broadly applicable to all models regardless of architecture. To address it, we evaluated our method on CLIP-RN50. Key results are presented in Table 2 of the main paper. Detailed experimental results can be found in Appendix A, specifically Table 6, Fig. 6c) and Fig. 7c). We will reorganize the paper to more clearly direct readers to the experimental results and improve overall clarity.\n\nThe table below—captured from Appendix A—illustrates DRAG's effectiveness compared to other methods in reconstructing data from CLIP-RN50. In this experiment, the feature space distance metric $d_\\mathcal{H}$ was implemented using MSELoss. Due to space limitations, we have presented results for model splits at blocks 4 to 5.\n\n| Split Point | Method | MS-SSIM ($\\uparrow$) | LPIPS ($\\downarrow$) | DINO ($\\uparrow$) |\n| - | - |:-:|:-:|:-:|\n|Block 4|rMLE |  0.4888  |  0.4198  |  0.7776  |\n|       |LM   |  0.5855  |  0.2576  |  0.9012  |\n|       |GLASS|  0.4872  |  0.3568  |  0.7315  |\n|       |DRAG |**0.7896**|**0.0898**|**0.9622**|\n|Block 5|rMLE |  0.3980  |  0.5006  |  0.6739  |\n|       |LM   |  0.4432  |  0.3409  |  0.7614  |\n|       |GLASS|  0.2917  |  0.4223  |  0.6811  |\n|       |DRAG |**0.5206**|**0.2231**|**0.9001**|\n\n---\n> Minor mistake: the GLASS is published in 2023 instead of 2024.\n\nThanks for pointing out this issue. We have revised the year of this reference.\n\n---\n> The GradViT is introduced in the “Baseline Attacks” section in the Appendix. But where is the experimental results?\n\nWe apologize for the confusion regarding the explanation of GradViT. GradViT is a parallel work that focuses on reconstructing training data using the gradients of model parameters. We referenced it because we observed artifacts in rMLE when attacking ViT, and GradViT proposed a regularization to mitigate these artifacts. We have adapted this regularization to strengthen rMLE and LM (referring to $\\lambda_\\text{patch}$ in Table 10). However, even with this regularization, reconstruction of deep-layer IR fails, which motivated our proposal of a data-driven image prior for enhancement.\n\n---\nWe appreciate your feedback and remain available to address any additional questions or concerns you may have.\n\n### Reference\n[1] Xu, X., et al. A stealthy wrongdoer: Feature-oriented reconstruction attack against split learning. In CVPR, 2024.\n\n[2] Liu, H., et al. Visual instruction tuning. In NeurIPS, 2023.\n\n[3] Chen, J., et al. Minigpt-v2: large language model as a unified interface for vision-language multi-task learning. arXiv preprint arXiv:2310.09478. 2023", "claims_and_evidence": "No, the experiments are insufficient and certain claims need further justifications. Please refer to the later parts of this review for details.", "methods_and_evaluation_criteria": "Yes, this method is the first data reconstruction attack that introduces the diffusion model.", "theoretical_claims": "Yes, the theoretical claims are correct.", "experimental_designs_or_analyses": "The experimental results in this paper are insufficient and problematic. Detailed comments are listed as follows:\n- Current evaluations mainly focus on the image fidelity of reconstructed images without fully considering the potential privacy threat for users. More discussion of the metrics are expected.\n- The compared baselines are not sufficient. It would be better to provide comparisons with more SOTA attacks such as [1-4]. The listed methods are also evaluated in the previous data reconstruction attacks.\n- The assumption that the attacker has white-box access to the model architecture and parameters is a strong setting, which is usually unpractical in real-world scenarios. However, previous works [4-5] have discussed the utility of their methods under black-box scenarios. More discussion on the more practical settings are expected.\n- What about the performance on smaller CNN models like ResNet? More evaluation on the CNN models utilized in previous works is expected for alignment with the baselines.\n\n[1]Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. Unleashing the tiger: Inference attacks on split learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2113–2129, 2021.\n[2]Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning. In Proceedings of the 21st Workshop on Privacy in the Electronic Society.\n[3]Xinben Gao and Lan Zhang. PCAT: Functionality and data stealing from split learning by Pseudo-Client attack. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5271–5288, Anaheim, CA, 2023. USENIX Association.\n[4]Xu X, Yang M, Yi W, et al. A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 12130-12139.\n[5]Li Z, Yang M, Liu Y, et al. GAN you see me? enhanced data reconstruction attacks against split inference[J]. Advances in Neural Information Processing Systems, 2023, 36: 54554-54566.", "relation_to_broader_scientific_literature": "This paper focuses on an important privacy problem. However, it relies on a strong setting of white-box access to the target model. This will limit its potential impact on broader scientific literature.", "essential_references_not_discussed": "Yes, there are certain new works [1-4] that are not evaluated in this paper.", "other_strengths_and_weaknesses": "Other Strengths:\n- The proposed method is not time-consuming.\n\nOther Weaknesses:\n- The Peak Signal-to-Noise Ratio (PSNR) metric is also critical to assess the image fidelity. However, this paper does not adopt this metric.", "other_comments_or_suggestions": "- minor mistake: the GLASS [5] is published in 2023 instead of 2024.", "questions_for_authors": "- The GradViT is introduced in the “Baseline Attacks” section in the Appendix. But where is the experimental results?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes DRAG, a new data reconstruction attack against split inference. The key idea is to use a pre-trained diffusion model as the image prior, which significantly reduces the dimensionality of the feature inversion optimization problem. The authors show that DRAG is able to invert deeper layer representations compared to prior work, and can remain effective against token dropping and shuffling defenses.

Reviewers generally agreed that DRAG is novel and effective. Some reviewers suggested improving the writing to improve the clarity of technical details. The main point of contention is whether or not the experiments are sufficient enough to demonstrate DRAG's effectiveness in different scenarios, including:
1. Different pre-trained diffusion model image prior.
2. Different image encoder architectures, including CNN and ViT.
3. Comparison with prior work suggested by Reviewers u9u9, DMzW and i33r.

The authors responded to these weaknesses directly in the rebuttal, addressing Weakness 1 by using an OOD diffusion model, and addressing Weakness 2 by evaluating on RN50 image encoders. The authors also explained the difference in attack setting compared to prior work. Although reviewers were not fully convinced by the rebuttal experiments, AC believes the paper has shown sufficient evidence that DRAG is a superior data reconstruction attack compared to prior work, and is one of the first that effectively utilizes the diffusion image prior to do so. As a result, the paper's merits outweigh its weaknesses, and should be of considerable value to the ICML community going forward.
Decision: Accept (poster)