Generative Model Inversion Through the Lens of the Manifold Hypothesis
Authors: Xiong Peng
Bo Han
Fengfei Yu
Tongliang Liu
Feng Liu
Mingyuan Zhou
Venue: NeurIPS 2025 poster ()
Keywords: Generative Model Inversion Attacks
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Model inversion attacks (MIAs) aim to reconstruct class-representative samples from trained models. Recent generative MIAs utilize generative adversarial networks to learn image priors that guide the inversion process, yielding reconstructions with high visual quality and strong fidelity to the private data. To explore the reason behind their effectiveness, we begin by examining the gradients of inversion loss w.r.t. synthetic inputs, and find that these gradients are surprisingly noisy. Further analysis shows that generative model inversion approaches implicitly denoise the gradients by projecting them onto the tangent space of the generator manifold—filtering out directions that deviate from the manifold structure while preserving informative components aligned with it. Our empirical measurements show that, in models trained with standard supervision, loss gradients exhibit large angular deviations from the data manifold, indicating poor alignment with class-relevant directions. This observation motivates our central hypothesis: models become more vulnerable to MIAs when their loss gradients align more closely with the generator manifold. We validate this hypothesis by designing a novel training objective that explicitly promotes such alignment. Building on this insight, we further introduce a training-free approach to enhance gradient–manifold alignment during inversion, leading to consistent improvements over state-of-the-art generative MIAs.

Generative Model Inversion Through the Lens of the Manifold Hypothesis
Xiong Peng
Bo Han
Fengfei Yu! Tongliang Liu?
Feng Liu
Mingyuan Zhou'
TMLR Group, Department of Computer Science, Hong Kong Baptist University
2yydney AI Centre, The University of Sydney
School of Computing and Information Systems, The University of Melbourne
McCombs School of Business, The University of Texas Austin
(esxpeng. bhanml) @ ecoom..kbu..duei tongliang. liu @sydney.edu.au
alvinfengfei @ gmail.com fengliu.ml @ @gmil..com mingyuan, zhou @ utt.aassebuueeeeeuuuu
Abstract
Model inversion attacks (MIAs) aim to reconstruct class-representattive samples from trained models. Recent generative MIAs utilize generative adversarial net- works to learn image priors that guide the inversion process, yielding reconstruc- tions with high visual quality and strong fidelity to the private training data. To explore the reason behind their effectiveness, we begin by examining the gradients of inversion loss w.t.. synthetic inputs, and find that these gradients are surprisingly noisy. Further analysis reveals that generative inversion implicitly denoises these gradients by projecting them onto the tangent space of the generator manifold, thereby filtering out off-manifold components while preserving informative direc- tions aligned with the manifold. Our empirical measurements show that, models trained with standard supervision, loss gradients often exhibit large angular devia- tions from the generator manifold, indicating poor alignment with class-relevan directions. This observation motivates central hypothesis: models become more vulnerable to MIAs when their loss gradients align more closely with the generator manifold. We validate this hypothesis by designing novel training objective that explicitly promotes such alignment. Building on this insight, we further introduce training-free approach to enhance gradient- manieenld alignment during inversion, leading to consistent improvements over state-of-the-arr generative MIAs. The code is publicly available at https: h/ggttu...../.// com/tmlr wwwgggrooooggaeee AlignMI.
Introduction
Machine learning (ML) models are increasingly deployed in high-stakes domains such fi- nance [Rundo et al., 2019], healthcare [Richens et al., 2020], and biometrics [Zhong et al., 2024]. Trained sensitive data, these models are attractive targets for adversarial threats [Fredrikson et al., 2014. Choquette-Chie Choo et al., 2021, Jiang et al., 2023, Zhang et al., 2023]. One emerging threat is the model inversion attack (MIA), which exploits model outputs to infer class-sensitive attributes or reconstruct representative samples, thereby posing serious risks to user privacy and security.
Early work by Fredrikson al. [2015] formulated MIAs using gradient descent to find inputs that maximize the prediction score a target class. This method effectively reconstructed low-resolution grayscale faces from shallow models. However, this approach performs poorly on deep neural networks (DNNs) trained on high-dimensional data (e.g. RGB facial images). Direct optimization in the input space is often ill-posed, because natural images
input-space optimization problem,
I Corresponddecce Bo Han (bhanml
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Parameters frozen
Forward flow
Backward flow
Generated images x
y( y
V Z
V2C x
VxCcE
fa
V
Framework of Generative MIA
(a) Framework overview
(b) Loss gradient visualization
Figure 1: Generative MIA framework and loss gradient visualization. (a) Generative model inversion extracts private information via inversion-tine time classification loss gradients (x y) from model fe. (b) Loss gradient visualizations under PPA method in the high-resolution setting, comparing cross-entropy (LCr) and Poincaré (PPoincure) losses. In both cases, the loss gradients appear highly noisy. Additional low-resolution visualizations are provided in Appendix E.4.
uniformly distributed across the input domain, but are instead concentrated on a low-dimensional manifold embedded in a high-dimensional ambient space [Fefferman et al., 2016]. Consequently, reconstructions often fall off the manifold and produce semantically irrelevant features.
To address this challenge, Zhang et al. [2020] introduced the generative model inversion framework. which leverages generative adversarial networks (GANs) [Goodfellow et al., 2014, Radford et al., 2016] to learn an image prior from public auxiliary datasets, such as web-scraped facial images. The learned prior constrains the inversion process to the generator's 's latent space, significantly improving the visual quality and semantic relevance of reconstructed samples. This paradigm has spurred notable progress in the MIA field [Wang et al., 2021 aa Struppek et al., 2022, Nguyen et al., 2023b, Peng et al., 2024a], enabling recovery of samples that closely resemble the private training data.
Despite the empirical success of generative MIAs, it remains insufficiently understood how private information encoded in the target model exploited during the inversion process. To bridge this research gap, we adopt a gradient- based perspective, and begin by closely examining the gradients of the inversion-time classification loss w.r.f. the synthetic inputs (hereafter referred as loss gradients) during the inversion optimization process. Surprisingly, we observe that these gradients are highly noisy (see Fig. 1bb).. Based on the manifold hypothesis and geometric analysis, we show that the generative MIA approach implicitly performs gradient denoising by projecting the loss gradients onto the tangent space of the generator manifold. This projection preserves informative components that lie along the manifold while filtering out noisy directions that deviate from it (see Fig. 2).
To assess how well the loss gradients capture semantically meaningful directions, we measure their alignment with the tangent space of the generator manifold [Bordt et al., 2023, Srinivas et al., 2023]. Specifically, we quantify this alignment by computing the cosine of the angle between the gradient and its projection onto the manifold. Empirical results show that models trained under standard classification supervision (i.e., vanilla models) exhibit consistently low alignment (see Fig. 3), suggesting that their loss gradients often deviate from the generator manifold and therefore encode limited class-relevant information. Motivated by this observation, well as the intuition that stronger alignment with the generator manifold indicates more informative gradients, we propose the following hypothesis: Models lend to be more vulnerable to MIAs when their loss gradients are more aligned with the tangent space of the generator munifold.
To validate this hypothesis, we design training objective that promotes alignment between loss gradients and the generator manifold during the inversion process. Although this aligmment is not directly measurable during training. key observation bridges the gap: by the chain rule, loss gradients can be expressed as linear combinations of input gradients, i.e., the gradients of the model's 's outputs w.r.t. its inputs. This insight allows us shift our focus: during training, we can instead encourage alignment between input gradients and the tangent space of the data manifold. To estimate this tangent space, we leverage a pre-trained variational autoencoder (VAE) from Stable Diffusion [Kingma and Welling, 2014, Rombach et al., 2022], which approximates the natural image manifold. Based on this estimate, we propose a novel training objective that augments the standard classification loss with an auxiliary term that promotes input gradients to align with the estimated tangent space.

---

Building on the empirical validation of our hypothesis, we further propose AlignMI, a training- free approach that enhances cradient-maniford alignment during the model inversion process. The key idea is to sample multiple variants of a synthetic input within a local neighborhood and average their corresponding loss gradients [Smilkov et al., 2017]. This operation attenuates noisy, off-manifold components while amplifying consistent directions aligned with the generator manifold, resulting in a more informative and semantically meaningful gradient signal.
In summary, our contributions are: (1) We present the first geometric analysis of generative model inversion, revealing that it fundamentally operates as an implicit gradient denoising mechanism via projection onto the generator manifold (Sec. 3). (2) This perspective leads us to hypothesize, and empirically validate that stronger gradient-maniforn alignment increases a model's 's vulnerability to MIAs, revealing a previously underexplored dimension of model inversion vulnerability (Sec. 4). (3) Based on this insight, we propose AlignMI, a training- faiiingg-freeeeee approach to enhance gradient-manifon alignment during inversion. We instantiate AlignMI with two concrete techniques: perturbation- averaged alignment (PAA) and transformation-avve -vveraae alignment (TAA) (Sec. 5), both of which consistently improve the performance of sfate-of-the-art (SOTA) generative MIAs (Sec. 6).
2
Background
In this section, we formalize the problem setup of generative MIAs and introduce the necessary geometric concepts and notations. A detailed discussion of related work is provided in Appendix A.
Problem Setup of Generative MIAs. Let the ambient space be X' Rd, and the private label space be Vpri = {l,..., C). The target model [(: 0)= X + RC is a classifier that outputs class logits, trained on private dataset DAr sampled from distribution Ppril (x, v). We presume the manifold hypothesis: the private data distribution Ppri is supported on a low-dimensional submanifold
Mpai C _d with intrinsic dimension k < d. In MIAs, the adversary aims to synthesize inputs that reveal slass-sensitive features of the private training data for target class y E Vpri The adversary is assumed to have white-box access to the model f. as well as general knowledge of the data domain (e.g., the data consists of facial images), but no direct access to the private dataset Dps.
MIAS are typically framed as an optimization problem: given a target class y, the adversary seeks for an input
X' that maximizes the likelihood of under model f [Fredrikson et al., 2015]. However, when f is a DNN trained on high-dimensional data, direct optimization in the ambient space X' often results in unrealistic samples that lack semantic relevance [Szegedy et al., 2014], due the ill-posed nature of the problem. To address this challenge, Zhang et al. [2020) proposed a two-stage generative model inversion framework, which we outline below.
In the first stage, the adversary collects a public auxiliary dataset Daux drawn from a distribution Paux: with label set disjoint from that of the private training dataset (i.e., Vmu 0 Ypr 0). The distribution Paux is assumed to be supported on a submanifold Maux that approximates the private data manifold Mpri even though Ppá and Paux may differ. A GAN is then trained Daux to estimate
Paux, consisting of generator G 2 - X' that maps latent variables z E 2 TRx samples x E Maux, and a discriminator D : X' + R that distinguishes real from generated data. In the second stage, the adversary performs attack optimization in the latent space 2 of the generator G, effectively restricting the search space to the manifold Maxx. which can be formulated as:
z arg min Cinv f D) Las y, f, G) + >C (z; G,D).
(I)
Here, Lets denotes the inversion-tine time classification loss, e.g.. the logit loss -fy (G(z)) INguyen et al., 2023b], which drives the optimization toward synthetic sample x = G(z that maximally activates class y. The term Laiir regularizes the latent code z, promoting plausible generations. The hyperparameter controls the trade-off between the two loss terms.
Geometric Preliminaries and Notation. Let M C. Rd be A-dimensional differentiable manifold. At any point x M, the tangent space TxM is a k-dimensional linear subspace of RRd that locally approximates M, capturing the directions of infinitesimal motion that remain on the manifold. To formalize projections onto this space, we denote by Px d the projection matrix that projects vectors in Rdd onto M. When Px is symmetric and idempotent, it defines an orthogonal projection.
Now consider differentiable generator G Z + X. For any latent vector Z, the Jacobian e gddk characterizes how infinitesimal perturbations in the latent space map to
matrix (z(z)=
&G oz
3

---

changes in data space. If Jg (z) has full column rank k, then the image of G forms a k-dimensional differentiable manifold M C Rd [Lee, 2003]. Moreover, the column span (iee, range) of Jg (z) equals the tangent space the corresponding point x G(z):
{ Oz."
DG
aG
TxM span
= Range(Ja(z)).
Oz.
The Jacobian JG plays a key role in our analysis of how loss gradients interact with the generator manifold in the context of generative model inversion, detailed in the next section.
3 A Geometric Lens for Understanding Generative MIAs
In this section, we analyze how generative model in- version exploits private information encoded in tar- get model f to reconstruct input samples. Central to this process are the the inversion-time loss gradients Vf (with x = G(z)), which are backprop- agated to optimize the latent variable (see Fig. (a)). Empirically, we find that these gradients are often highly noisy (see Figs. ((b) and 2), with many components misaligned with the intrinsic structure of the genera- manifold. This observation may explain why direct optimization in the ambient space frequently leads to se- mantically meaningless samples [Fredrikson al., 2015, Zhang et al., 2020, Wang et al., 2021a]. To better un- derstand how the generator G processes this gradient signal, we analyze the transformation of the gradient via the Jacobian JG. By the chain rule, the loss gradients w.r.t the latent variable z can be expressed as:
V.C
Proju,M (V.C)
<..
Residdull vector
V V
Point
T TM
M
V VzCas = (Jc) VxLals E IR
Figure 2: Geometrie interpretation of loss gradients projection onto the gener- ator manifold. The generative model in- version process implicitly denoises the loss gradients VxL by projecting them onto the tangent space T&M of the generator manifold M. The bottom panel illustrates the reconstructed image, its inversion-time loss gradients, the dients, and the residual component.
= = [K<0G. VxLon)
DG
aG Ozi
VxCals
Thus, Cele can be interpreted expressing the am- bient loss gradients VxLas in the basis formed by the columns of the generator's Jacobian (i.e., the tangent basis at x). In other words, each component of the latent gradient represents the directional derivative of the loss along one of the generator's 's valid, manifold-constren directions. This "pullback" maps the nigh-dimensional loss gradient into the latent space, yielding structured signal aligned with the generator manifold. To understand how these latent gradients influence updates in data space, we analyze their pushforward by applying first-order Taylor approximation:
gra-
G(z - v/ G(z)) J
Here, 77 denotes the step size for updating z. The term JG VuLess represents a linear combination of the tangent basis vectors x, where V VaCal serves the coordinate vector in this basis. As result, it lies entirely within the tangent space TxM2 (see Eq. (2)). More importantly, the resulting vector be interpreted the projection of the ambient gradients VxLas onto the tangent space MxM:
Proju,M (VxLas) VaLa [JG(JG) VxLan VxLass
where - JG(G)) is unnormalized projector onto the tangent space M.M This projection operation has critical denoising effect: it preserves only the gradient components aligned with the tangent space of the generator manifold, while filtering out directions that deviate from it (see Fig. 2). Thus, backpropagation through the generator fundamentally acts as a geometric filter, allowing optimization to proceed along semantically meaningful directions.
For notational simplicity, M denote Man throughout this section.

---

LOKNNA
PM Nanda Model
1.
Dunsity
Valuue
0.
0.
2.00
2000
Alignment
2114 0.31
0.00
0.20
8.12
0.38
0.28
0.50
170 000 300 431 303 KTO FOB BID 3ROUERO
(a) Low resolution (DCGAN)
(b) High resolution (StyleGAN)
(c) Inversion-phase dynamics
Figure 3: gradient-manifold alignment during the inversion process. (a) Alignment score distribution in the low-resolution setting using LOMMA with a DCGAN trained on CelebA. (b) High-resolution counterpart using PPA with StyleGAN trained on FFHQ. In both cases, alignment scores are only slightly above those of random vectors, suggesting weak alignment along the generator manifold. (c) Evolution of the average alignment score and prediction confidence over the inversion process. While the model's prediction confidence steadily increases, the gradient- gradient-manifold alignment remains consistently low, indicating no direct dependence between the two. For additional details on this experiment, as well as results from other attack methods, refer to Appendix D.6.
To assess how well the loss gradient Vxhels aligns with informative directions, we measure its alignment with the tangent space TxM at point x. Specifically, we quantify this alignment by computing the cosine of the angle between the loss gradients and the projection onto M. Note that while Px performs a projection onto M,, it is not valid orthogonal projection operator unless the columns of JG are orthonormal. To construct an orthogonal projector, we perform singular value decomposition (SVD) on the Jg: JG UEVT where U E R Σ R and V R Let U E Raxk denote the matrix consisting of the first k left-singular vectors, which form an orthonormal basis for Range(Jc), i.e., the tangent space TxM (see Eq. (2)). The corresponding orthogonal projection matrix is then given by Px U Consequently, compute the cosine of the angle o between the loss gradients and the projection on the tangent space as:
cos Φ) = Px VxLai|| / V
We refer to this quantity the alignment score, denoted AS(V xS(VxCets) == cos(Ø), which quantifies the extent to which the loss gradient lies within the tangent space at point x. Higher values correspond to smaller angles and thus indicate stronger alignment. When evaluating Eq. (3), it is important to note that even random vectors exhibit non-zero projections onto the tangent space purely due to geometric effects. In expectation, random vector aligns with k k-dimensional subspace with magnitude of approximately /k/d (Vershynin, 2018]. To assess the informativeness of the loss gradients, we track the alignment score throughout the inversion process. Empirically, we observe that in models trained with standard supervision, the alignment score remains consistently low (see Fig. 3). This suggests that the loss gradients frequently point in directions misaligned with the underlying data manifold, and therefore carry limited semantically meaningful information for guiding inversion.
4 Does Gradient-Manifold Alignment Indicate MIA Vulnerability?
Motivated by the previous empirical findings and the intuition that stronger alignment with the generator manifold reflects more informative gradients, we propose the following hypothesis:
Models tend to be more vulnerable to MIAs when their loss gradients are more aligned with the tangent space of the generator manifold.
To validate our hypothesis, we aim to design a training objective that promotes stronger alignment between loss gradients and the generator manifold during inversion. A key challenge, however, that this alignment is not directly accessible during training. To bridge this gap, we analyze the inversion-time time classification loss, which is the only term that directly interacts with the target model f to extract private information. By the chain rule, its gradients can be expressed as linear combination of input gradients (i.e., the gradients of model outputs w.r.l inputs) [Srinivas and Fleuret, 2021, Bhalla et al., 2023]. Formally, let fxx = [/i (x), f2(x),.... (x)) denote the model's logits for C' classes. The inversion-time classification loss Cets (f (x), y) is function of these logits, i.e.
5

---

Las(f(x), = Lela ((()..... Thus, by the chain rule, we obtain:
C
HLeks VxSi-
Vxhels Σ
(4)
of
In other words, the loss gradient is a weighted sum of input gradients, where the weights &Cut af: quantify the sensitivity of the loss to each logit. This structural insight allows us to shift our focus from loss gradients to input gradients, which are directly accessible during training [Sundararajan et al., 2017, Dwivedi et al., 2023]. Moreover, if the input gradients align well with the data manifold, then by construction, the loss gradients will also exhibit improved alignment. Thus, during training, we propose to encourage alignment between input gradients and the tangent space of the data manifold, thereby indirectly promoting alignment of loss gradients during the inversion phase, making alignment-aware training feasible without requiring access to the inversion process.
Gradient-Manifold Alignment Training, Building on the above analysis, we propose novel training objective to validate our hypothesis. consists two components: (I) the standard cross-entropy (CE) loss for training-time classification, and (2) auxiliary term that explicitly encourages the model's input gradients to align with the estimated tangent space of the data manifold. Crucially, the second term leverages the fact that the input gradients of the classifier, <xfi(x: 0). differentiable w.E.t. model parameters 0, and can therefore be directly optimized during training.
To estimate the tangent space of the data manifold, we leverage a powerful pre-trained variational autoencoder (VAE), specifically, the one used in Stable Diffusion [Rombach et al., 2022]. Trained on large-scale datasets [Kuznetoova et al., 2020, Schuhmann et al., 2022], this VAE provides strong approximation of the natural image manifold. Given an input image the encoder maps it to latent vector the image as & D(z)². The decoder implicitly defines a data manifold with intrinsic dimension equal to that of the latent space. Then, for any data point E Prri estimate its tangent space via the Jacobian of DD approximated by Range(Jp(z)) Following the method in Sec. 3, we construct the orthogonal projection matrix Px onto the tangent space at To promote aligmment between the model's 's input gradients and the data manifold, we propose the following training objective:
VAE consists of an encoder & and decoder 'D {x)), and the decoder reconstructs
C
P2 Vxfi(x 0)|| [x;((xx
())(xx)).))) Calign (0) = F(xx,))> ()) -
B
Σ
(5)
where the first term is the standard cross-entropy loss for classification, and the second term encour- ages the input gradients to align with the estimated tangent space. The hyperparameter 3 controls trade-off between the two objectives. However, computing this alignment term requires C' projection operations per training example (one per class logit), which can become computationally expensive when the input dimension is high the number of classes is large. To reduce this cost, derive the following upper bound for the alignment promotion term (see Appendix B for proof):
Px P2 P EE, (xf((xx))
c
Px (x)x (x:
Σ
-
This inequality allows us define efficient surrogate objective that only requires a single projection operation per data point (the algorithmic implementation is provided in Appendix C);
Px D vxfi(x;))) I Vxfi(x; 0)|
Latign (0) (x. (cn( u)
(7)
Empirical results confirm that this aligmment-aware training increases the model's vulnerability to generative MIAs, thereby validating our hypothesis (see Sec. 6.2). Moreover, this finding motivates the design of a training-free method to further enhance gradient-manifold alignment during the inversion process, detailed in the next section.
"To align with VAE literature, use D to denote the VAE decoder, despite its earlier use for the dataset in Sec. 2. The latent representation is similarly reused for notational convenience.

---

Enhancing Gradient-Manifold Alignment Without Training
Motivated by the previous observations, we propose AlignMI, a training-free approach enhance gradient-manifold manifold alignment during the inversion process. The core idea is geometric: since informa- tive gradients lie along the tangent space of the generator manifold, we aim to suppress off- aff-manifold components and enhance alignment with semantically meaningful directions. To this end, rather than relying on a single gradient estimate at a synthetic input x, we sample multiple variants of within a local neighborhood and average their corresponding loss gradients. This averaging process attenuates noisy, off-manifold directions while amplifying consistent components aligned with the manifold, yielding
semantically meaningful and geometrically coherent signal. Formally, let (x) C. Rd denote measurable neighborhood around x, and let p(- x) be a probability distribution supported on N (x). We define the smoothed, alignment-enhance gradient as:
(() = Ex- V [xx')]
(8)
This technique is entirely training- free and can be applied directly the inversion time. We instantiate AlignMI with two concrete strategies for sampling from the neighborhood N (xx).
(1) Perturbation-Averagee Alignment (PAA). In this realization, the neighborhood distribution is defined as an isotropic Gaussian centered at the synthetic input:
p- x) = (x 22)).
This corresponds to sampling within spherical region around x, smoothing the gradient by averaging over random perturbations. The process suppresses high-freque high-frequency, noisy components that are likely to deviate from the generator manifold.
(2) Transformation-Avergeel Alignment (TAA). Alternatively, in this realization, we define the distribution uniform over set of semantically invariant transformations:
p(-
x) = Uniform(r(x) TETT.
where T is predefined set of semantic-preservve transformations, such as random cropping, flipping, or affine warping. This formulation captures local perturbations along the manifold, encouraging alignment with directions that preserve perceptual consistency and geometric semantics. Both PAA and TAA are model-agnostic and fully post hoc. Their algorithmic implementations are provided in Appendix C. As demonstrated in Sec. 6.3, incorporating either strategy consistently improves inversion performance by producing loss gradients that are better aligned with the generator manifold.
Experiments
In this section, we first validate the hypothesis proposed in Sec. 4, followed by a comprehensive evaluation of the training-fre free AlignMI approach introduced in Sec. 5. Our experiments focus on real-world face recognition tasks. To ensure computational efficiency, we perform hypothesis validation in the low-resolution setting (64 x 64), where tangent space estimation is tractable. For compare the performance of state-of-the-a generative MIAs before and after integrating our proposed techniques, i.e., PAA and TAA. Specifically, in the high-reoolution setting (224 x 224), we evaluate on PPA [Struppek al., 2022]. For the low-resolution setting, consider GMI (LOMMA) with StyleGAN [Zhang et al., 2020, Karras et al., 2020, Nguyen et al., 2023b], KEDMI (LOMMA) with DCGAN [Chen al., 2021], and PLG-MI [Yuan al., 2023]. In addition, we evaluate the performance of these methods against strong MIA defenses, including BiDO [Peng al., 2022], NegLS [Struppek et al., 2024], and TL-DMI [Ho et al., 2024].
the method evaluation,
6.1 Experimental Setup
We begin with a brief overview of the experimental setup; refer to Appendix D for details.
Datasets and Models. In line with existing MIA literature, we use the CelebA [Liu et al., 2015]. FaceScrub [Ng and Winkler, 2014], and FFHQ datasets [Karras et al., 2019]. These datasets are divided into two parts: the private training dataset Ppri and the public auxiliary dataset Danx with no overlapping classes. For bigh-resolution tasks, we use ResNet-18 [He et al., 2016), DenseNet- 121 [Huang et al., 2017] and ResNeSt-50 [Zhang et al., 2022] as target models. For ressluolution
7

---

1400
Neathel
Venta buenng Fander 0.000)
Teserptine
idomi (-0 (-0.44))
Accurncy
Modil
-4
Damusity
Altymment
2:50
(12 Allgnment
5:90 6-33 U.S
Alignment
0.000
11. Accuracy 196
(a)
(b)
(c)
Figure 4: Empirical evaluation of gradient-manifole alignment. (a) Test accuracy training- time alignment score (ASw)) for models sampled during alignment- aware training. Insets show input gradient visualizations for models with varying degrees of alignment. (b) Distribution of inversion-time alignment scores (ASin)) for the vanilla model compared to the alignment-aware model. (c) Average alignment scores ASt and AShnv across models with varying test accuracy. Enlarged versions of (a) and (h), along with experimental details, are provided in Appendix D.7.
85
Attack Accuracy (%)
80
Vanilla Model
Model
Table 1: Alignment score, predictive accuracy, and inversion vulnerability for vanilla and three alignment-awan aware models.
Model
Training Variant
AStr
Test Ace
Acc@1 I
KNN Dist
60
Vanilla
0.175
96.53
77.92
1452.20
60
Taceliet
VSG15
Model A
0.253
94,92
79.68
1413.53
0.213
0,200
Model B
0.339
93.75
80.76
1408.00
Training-time Alignment Score
Model C
0.406
91.80
69.72
1613.96
Figure 5: MIA success on vanilla and alignment- aware models with different ASt..
tasks, VGG16 [Simonyan and Zisserman, 2015] and FaceNet [Wang et al., 2021b] as target models. Training details for these models are provided in Appendix D.2. A summary of the attack methods, target models, and datasets used is provided in Tab. 3.
Evaluation Metrics. (1) To quantify the alignment between gradients and the image manifold, we report two metrics: training-time alignment scores based on input gradients (AStr). and inversion-time alignment scores based loss gradients (ASm),, defined in Eq. (3). (2) To evaluate the inversion performance of MIAs, we follow standard metrics in the literature [Zhang et al., 2020], including top-1 (Ace@) I) and top-5 (Ace@5) attack accuracy, as well as K-Nearest Neighbors Distance (KNN Dist). Details for these metrics are provided in Appendix D.5.
6.2 Empirical Validation of the Hypothesis
In this subsection, we empirically validate the hypothesis introduced Sec. 4, by comparing standard (vanilla) models with alignment-aware models trained using the objective defined in Eq. (7). For this evaluation, we adopt GMI (LOM) as the inversion method, using a StyleGAN as the prior.
Gradient-manifold Alignment Analysis. Specifically, we fine-tune the pre-trained vanilla VGG16 and FaceNet models using the alignment-aware training objective, resulting in multiple models with varying training-time alignment scores (ASt:). As shown in Fig. 4(a). the vanilla models exhibit low alignment scores (approximately 0.15 and 0.18), which marginally exceed those expected from random vectors, indicating weak alignment between input gradients and the data manifold. As fine- tuning progresses, AS,, steadily increases, and gradient visualizations reveal a corresponding rise in semantically meaningful features. Notably, this increase in alignment accompanied by gradual decline in test accuracy, suggesting an empirical trade-off between gradient-manifole alignment and predictive performance. This trend is consistent across both architectures. We hypothesize that this trade-off could stem from the inherent limitations of modern deep neural network architectures or the implicit biases introduced by stochastic gradient-based optimization.
Fig. 4(b) compares the distribution of inversion-time alignment scores (ASinv) between the FaceNet vanilla model and the alignment-aware model (corresponding to Model B in Fig. 5). The Model

---

trained with the alignment-awe objective exhibits significantly higher AS values, demonstrating that promoting gradient-me gradient-manifold alignment during training leads stronger alignment at inversion time. This validates the effectiveness of our training strategy. Additionally, the inversion loss gradient visualizations also reveal clearer and more semantically meaningful structures.
Model Inversion Vulnerability Analysis. We further evaluate the vulnerability of both vanilla and alignment-aware models to the GMI (LOM) attack method. As shown in Fig. 5, model inversion vulnerability initially increases with training-time alignment score (AS,z), reaching peak before declining. To understand this behavior, we first recall that previous work [Zhang et al., 2020] has shown that models with higher predictive power (i.e.. test accuracy) tend to be more susceptible to generative MIAs, whereas models with lower test accuracy are generally more resistant. gradient- manifold alignment were unrelated to model inversion vulnerability, one would expect a monotonic decline in attack accuracy with increasing AStr. due to the corresponding drop in test accuracy (Fig. 4(a)). However, Fig. 5 instead shows a non-monotonic trend.
This trend arises because improvements in gradient-manifooe alignment create a new attack surface, leading to increased model inversion vulnerability. At early stages, the benefits of improved alignment outweigh the negative impact of reduced test accuracy, hence attack accuracy rises. Beyond certain point, however, the adverse effects of declining test accuracy become dominant, and attack accuracy begins to decline. This trend holds consistently across both architectures we studied. These findings suggest that, for models with comparable test accuracy, those with better gradient- mannfoold alignment tend to be more vulnerable to MIAs, thus supporting our main hypothesis.
To illustrate this trend in detail, we examine three representative alignment-aware models and report their training-time alignment scores, test accuracies, and MIA vulnerabilities. Results in Tab. 1 show that models A and B, despite having lower test accuracy than the vanilla baseline, exhibit greater vulnerability to MIAs. This increased susceptibility is attributable to their higher AS which produces more informative loss gradients during inversion. In contrast, model C, with a higher alignment score but lower test accuracy, shows reduced vulnerability, suggesting that excessive alignment may come at the cost of generalization and thereby diminish the attack surface.
Moreover, we study the correlation between model predictive power and the graiiodt-manifodd aligmment. As shown in Fig. 4(c), both ASt, and ASinv remain relatively steady across models with varying predictive performance, indicating that model predictive power and gradient-manifold alignment exhibit little correlation. These results suggest that gradient-manifoll alignment captures complementary aspect of model inversion vulnerability one not explained by predictive power alone-and offer new insights into the factors underlying privacy risks in machine learning models.
6.3 Evaluation of Proposed Methods
In this subsection, we evaluate the effectiveness of our training-free AlignMI approach by comparing the inversion performance of the PPA method before and after integration with its two realizations, PAA and TAA. This evaluation focuses the high-resolution setting, representing more realistic and challenging attack scenario. Additional experiments, including results on low-resolution MIAs, evaluations under SOTA MIA defenses, and ablation studies, are provided in Appendix E.
For all experiments, we configure PAA with Gaussian perturbations of standard deviation set to 5% of the synthesized images' dynamic range. For TAA, we apply standard semantic- ppraariipp transformations, including random resized cropping with scale [0.8. 1.0] and aspect ratio [0.9, 1.1)), horizontal flipping with a probability of 0.5, and random rotations within + For both methods, we average the loss gradients over 50 samples to approximate the expectation in Eq. (8).
We conduct three independent runs for both the baseline and our method. The mean results are reported in Tab. 2, and the complete results are provided in Tab. 4 in Appendix E. The results demonstrate that our methods consistently enhance inversion performance across all setups, yielding higher attack accuracy and lower KNN distance, thus validating their effectiveness. Notably, TAA outperforms PAA in most cases. This is because PAA improves alignment by adding noise perturba- tions to loss gradients, which can reduce prediction confidence, as models are typically not trained on noisy inputs. In contrast, TAA uses cemantic-preserving augmentations, which maintain input realism and avoid this trade-off. Visualizations of gradient images and reconstructed samples for the target models are provided in Appendix E.4 and Appendix E.5, respectively.

---

Table 2: Comparison of inversion performance with PPA in the high-resolution setting. Pa = CelebA or FaceScrub, GANs are pre- rreetrained on D.n = FFHQ. The symbol & (or 1) indicates that smaller (or larger) values are preferred, and the green numbers represent the performance improvement. The results are averaged over three independent runs.
CelehA
FaceSerub
Target Model
Method
Acc@
Acci55
KNN Dist.
Ratiol
Accie
Acc
KNN Disti
Ratio]
PPA
85.63
95.12
0.693
81.57
94.85
0.796
/
ResNet-18
PAA
88.75 (2).12)
96.59
0.669 (-0.024)
1.50
83.97 (+2.40)
95.78
0.777 (-0.019)
1.55
TAA (ours)
91.68 (+5.05)
97.68
0.662 (-0.031)
1.61
93.68 (+12.11)
98.84
0.691 (-0.105)
1.61
PPA
82.22
93.26
0.708
75:66
90.91
0.786
1e1seNet-121
(ours)
85.64 (+.342)
95.16
(-0.024)
80.70 (+5.04)
93.40
0.761 (-0.025)
2.82
TAA (ours)
87.88 (+5.66)
96.20
0.687 (-0.021)
2,87
86.54 (+10.88)
95.12
0.712 (-0.074)
2,93
87.43
0.795
90.60
0.827
ResNeSt-50
PAA (ours)
75.71 (64.96)
901448
0.764 (-0.029)
2.93
73.38 (+1)80)
91.
0.807 (-0.020)
3,12
TAA (ours)
(+8.44)
92.28
0.761 (-0.032)
3.12
84.38 (+12.80)
96,04
0.753 (-0.074)
3,13
7 Discussion
Limitations. Our experiments validate the proposed hypothesis in the low-resolution setting, where alignment-aware training is currently feasible only at this scale. We observe an empirical trade-off between alignment and predictive performance, suggesting that stronger alignment may come at the cost of impairing model generalization. However, due to computational limitations, are unable examine whether this trend persists in high-resolution settings. In particular, high- resolution inputs of size 224 x 224 x 3 produce latent representations of size 28 x 28 x 4 from the VAE encoder, resulting in a decoder Jacobian of size 150,528 3136. This is roughly 150 times larger than in the low-resolution case, rendering tangent space estimation computationally and memory intensive. Moreover, the underlying cause of the observed alignment-accuracc trade-off remains unclear and warrants more systematic in future work.
Broader Impacts. From a geometric perspective, our analysis identifies previously underexplored factor contributing to model inversion vulnerability, complementing existing explanations focused on predictive power. This perspective offers new insight into the mechanisms that give rise to privacy risks in machine learning models. Beyond its technical implications, the AlignMI approach also raises important ethical considerations: if misused, it could increase the likelihood of exposing sensitive training data. Conversely, this geometric understanding provides a foundation for principled defenses against generative MIAs. In particular, reducing gradient-manifold alignment may serve as an effective strategy for mitigating such vulnerabilities.
8 Conclusion
In this work, we investigate the underlying mechanism of generative model inversion from geometric perspective. We show that generative MIAs implicitly denoise loss gradients by projecting them onto the tangent space of the generator manifold, preserving informative on-manifold directions while filtering out noisy off-manifold components. Building on this insight, we identified a previously underexplored vulnerability: models with loss gradients align more strongly with the generator manifold tend to be more susceptible to inversion attacks. We validated this hypothesis using novel training objective that explicitly promotes gradient-manife manifold alignment. Finally, we propose AlignMI, a training- free approach to enhance such alignment during inversion, and demonstrate its effectiveness through extensive experiments across multiple attack methods.
Acknowledgments
XP, FFY, and BH were supported by NSFC General Program No. 62376235, RGC Young Collabo- rative Research Grant No. C2005-24Y, RGC General Research Fund No. 12200725, Guangdong Basic and Applied Basic Research Foundation Nos. 2022A151501 1652 and 2024A151501233 and HKBU CSD Departmental Incentive Scheme. TLL is partially supported by the following Australian Research Council projects: FT220100318. DP220102121, LP220100527. LP220200949.
10

---

References
Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity, In NDSS, 2022.
Usha Bhalla, Suraj Srinivas, and Himabindu Lakkaraju. Discriminative feature attributions: Bridging post hoc explainability and inherent interpretability. In NewrIPS, 2023.
Sebastian Bordt, Uddeshya Upadhyay, Zeynep Akata, and Ulrike von Luxburg. The manifold
hypothesis for gradient-based explanations. In CVPR, 2023.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. ICCV, 2021.
Christopher Choquette-Choo Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In ICML, 2021.
Rakesh Dwivedi, Devansh Dawe, Het Naik, Smriti Singhal, Pankesh Patel, Bin Qian, Zhenyu Wen, Tejal Shah, Pramath Meher, and Rajiv Ranjan. Explainable ai (xai): Core ideas, techniques, and solutions. ACM Computing Surveys, 2023.
Charles Fefferman, Sanjoy Mitter, and Hariharan Narayanan. Testing the manifold hypothesis.
Journal of the American Mathematical Society, 2016.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. CCS, 2015.
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogeneties: An end-to-end case study of personalized warfarin dosing. In USENIX Security, 2014.
Ian Goodfellow, Jean Pouget-Abadic, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NeurIPS, 2014.
Bo Han, Jiangchao Yao, Tongliang Liu, Bo Li, Sanmi Koyejo. Feng Liu, et al. Trustworthy machine learning: From data to models. Foundations and Trends@ in Privacy and Security, 7(2-3):74-22) 2025.
Gyojin Han, Jaehyun Choi, Haeil Lee, and Junmo Kim. Reinforcement learning- black-box model inversion attacks. In CVPR, 2023.
Koh Jun Hao, Sy-Tuyen Ho, Ngoc-Bat Bro Nguyen, and Ngai-Man Cheung. On the vulnerability of skip connections to model inversion attacks. In ECCV, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Sy-Tuyen Ho, Koh Jun Hao, Keshigeyan Chandrasegaran, Ngoc-Bao Nguyen, and Ngai-Man Cheung. Model inversion robustness: Can transfer learning help? In CVPR, 2024.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
Xue Jiang, Feng Liu, Zhen Fang, Hong Chen, Tongliang Liu, Feng Zhang, and Bo Han. Detecting duttof-distribution data through in-distribution class prior. In ICML, 2023.
Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In CVPR, 2022.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. CVPR, 2019.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In CVPR, 2020.
11

---

Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In ICLR, 2014.
Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper R. R. Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, Tom Duerig, and Vittorio Ferrari. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. International Journal of Computer Vision, 2020.
John M. Lee. Introduction to Smooth Manifolds. Springer, 2003.
Feng Liu, Wenkai Xu, Jie Lu, Guangquan Zhang, Arthur Gretton, and Danica J. Sutherland. Learning deep kernels for non-parametric two-sample tests. In ICML, 2020.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes the wild. In ICCV, 2015.
Hong-Wec Wei Ng and Stefan Winkler. A data-driven approach to cleaning large face datasets. In ICIP, 2014.
Bao-Ngoc Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Man Cheung. Label-only model inversion attacks via knowledge transfer. In NeurlPS, 2023a.
Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks. In CVPR, 2023b.
Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In KDD, 2022.
Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. Pseudo-private data guided model inversion attacks. In NeurlPS, 2024a.
Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. Pseudo-private data guided model inversion attacks. In NewrIPS, 2024b.
Xiong Peng, Feng Liu, Nannan Wang. Long Lan, Tongliang Liu, Yiu-ming Cheung, and Bo Han. Unknown-awand bilateral dependency optimization for defending against model inversion attacks. IEFE Transactions on Pattern Analysis and Machine Intelligence, 2025.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. In ICLR, 2016.
Jonathan G Richens, Ciarán M Lee, and Saurabh Johri. Improving the accuracy of medical diagnosis with causal machine learning. Nature communications, 2020.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, 2022.
Francesco Rundo, Francesca Trenta, Agatino Luigi Di Stallo, and Sebastiano Battiato. Machine learning for quantitative finance applications: A survey. Applied Sciences, 2019.
Florian Schroff. Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In CVPR, 2015.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev, Laion-5b: An open large-scale dataset for training next generation image-text models, 2022. arXiv preprint arXiv:2210.08440
K Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smoothgrad: removing noise by adding noise. arXiv preprint
2017.
12

---

Suraj Srinivas and François Fleuret. Rethinking the role of gradient- based attribution methods for model interpretability. In ICLR, 2021.
Suraj Srinivas, Sebastian Bordt, and Himabindu Lakkaraju. Which models have perceptually-alignee gradients? explanation via off- robustness. In NeurIPS, 2023.
Lukas Struppek, Dominik Hintersdorf, Antonio De Almeida Correia, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In JCML, 2022.
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting, Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks. In ICLR, 2024.
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In ICML, 2017.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Roman Vershynin. High-Dimente Dithensiinnsi Probability: An Introduction with Applications in Data Science. Cambridge University Press, 2018.
Kuan-Chich Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. In NeurIPS, 2021a.
Qingzhong Wang, Pengfei Zhang, Haoyi Xiong, and Jian Zhao. Face.evolve: A high-performance face recognition library. arXiv preprint arXiv:2 107.08627 2021b.
Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual information regularization. AAAI, 2020.
Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo label-guided model inversion attack via conditional generative adversarial network. In AAAI, 2023.
Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R Manmatha, et al. Resnest: Split-attention networks. In CVPR, 2022.
Shubai Zhang, Feng Liu, Jiahao Yang, Yifan Yang, Changsheng Li, Bo Han, and Mingkui Tan. Detecting adversarial data by probing multiple perturbations using expected perturbation score. In ICMI., 2023.
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020.
Zhixing Zhong, Junchen Hou, Zhixian Yao, Lei Dong, Feng Liu, Junqiu Yue, Tiantian Wu, Junhua Zheng, Gaoliang Ouyang, Chaoyong Yang, et al. Domain generalization enables general cancer cell annotation in single-cell and spatial transcriptomics. Nature Communications, 15(1):1929, 2024.
Zhanke Zhou, Jianing Zhu, Fengfei Yu, Xuan Li, Xiong Peng, Tongliang Liu, and Bo Han. Model inversion attacks: A survey of approaches and countermeasures. arXiv preprint arXiv:2411.10023, 2024.
Tianqu Zhuang, Hongyao Yu, Yixiang Qiu, Hao Fang, Bin Chen, and Shu-Tao Xia. Stealthy shield defense: A conditional mutual information-based approach against black-box model inversion attacks. In ICLR, 2025.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We first analyze the effectiveness of generative MIAs through geometrie lens, revealing their implicit gradient denoising mechanism (Section 3). Based on these insights, hypothesize link between model vulnerability and loss gradient alignment, which we validate using a dedicated alignment-awee training objective (Section 4). Building on this, propose training-free method enhance gradient gradient-manifold alignment during inversion (Section 5). We evaluate the hypothesis and the proposed method through extensive experiments in Section with additional results presented in Appendix E.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
It is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We primarily discuss the limitations of this work in Section 7.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattin, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
14

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: In Appendix B, we present the complete mathematical proof that derives the upper bound for the alignment promotion term, which serves as an efficient surrogate objective to validate our hypothesis.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The experimental setups are briefly introduced at the beginning of Section and detailed in Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
15

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: Our well-organized source codes, along with a detailed README file, is available is available at https: //github. hon/tmlr-grouy Cooup/AligM....
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https:
/ //nips.co..p ctttpss.cc/pbbccc// ceiicc/guiiisseeeeeeee CooeeSubeeeeeeee wwwaaniisssiooooiiiiiioooiooeeee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer:
[Yes]
Justification: The experimental details and settings are briefly introduced at the beginning of Section 6 and detailed in Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Due to the significant time required for MIAs, we conduct single attack against each target model. reduce randomness, we generate at least 100 samples for each target class across various setups.
16

---

Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide detailed information about the hardware and software configura- tions in Appendix D.I.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported didn't ' make it into the paper).
paper (e.g., preliminary or failed experiments that
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics attps://neeus cc htc//pplice/thccssteeeeeee
Answer: [Yes]
Justification: We only utilize publicly available datasets to develop machine learning algo- rithms aimed at promoting community development.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
17

---

Answer: [Yes]
Justification: We primarily discuss the broader impacts of this work in Appendix 7.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets g.g code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
We have cited the original papers that produced the code packages or datasets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
18

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thwdee com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We provide well-structured source code accompanied by detailed README file, which available at https: //aonmmoo//m/m 4open scwenccer//llggnllI
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
19

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: http::://neuripass CcCC//o/eeeeeecec/22222533 for what should or should not be described.
20

---

Appendix
Related Work
22
Derivation of the Aligament-aware Training Objective
23
C Algorithmic Realizations of Gradient-Manifold Alignment Methods
23
Experimental Setup and Implementation Details
24
D.I Hard- and Software Details
24
D.2 Target Models
25
D.3 Evaluation Models
25
D.4 Attack Parameters
................................
26
D.5 Evaluation Metrics
26
D.6 Experimental Details for Figure 3
27
D.7
Experimental Details for Figure 4
27
E
Additional Experimental Results
29
E.1
Additional Empirical Validation of the ii..............................
29
Additional Evaluations Proposed Methods
30
E,3 Ablation Study
32
E,4 Visualization of Gradient Images
33
E.5 Visualization of Reconstructed Images
35
21

---

A Related Work
Model inversion attacks (MIAs) were first introduced by Fredrikson et al. [2014], who demonstrated the reconstruction of private data in simple regression tasks using shallow models. Their pioneering attack algorithm aimed to infer sensitive attributes, such as genetic markers, via input space optimiza- tion, assuming access both the linear target model and auxiliary information. This work highlighted the privacy risks inherent in exposing model predictions. Building on this, Fredrikson et al. [2015] extended MIAs shallow neural networks for reconstructing low-resolution grayscale face images. While effective for simple models, this method fails when applied to deep neural networks (DNNs) handling high-dimensional data, as reconstructions often lack semantic relevance.
To address these limitations, Zhang et al. [2020] introduced the two-stage generative model inversion approach. which leverages generative adversarial networks (GANs) [Goodfellow et al., 2014, Radford et al., 2016] to learn an image prior from public auxiliary datasets and constrains the attack optimiza- tion the generator's ' latent space. This breakthrough significantly improved the visual quality and semantic fidelity of reconstructed samples and has since fueled major advances in the field of MIAs, particularly for nigh-dimensional image data [Zhou et al., 2024, Han et al., 2025]. Recent works can be categorized by the model inversion adversary's s access level: white-box, black-box, and label-only settings, each posing unique challenges and guiding corresponding defense developments.
In the white-box setting. where attackers have full access to the model architecture and weights, most works follow the generative model inversion framework. KEDMI [Chen al., 2021] enhanced this by introducing an advanced discriminator that incorporates knowledge from the target model. VMI [Wang al., 202 Ia] recast the problem variational inference, using Bayesian framework to balance diversity and fidelity. PPA [Struppek et al., 2022] further pushed the frontier by leveraging pre-trained StyleGAN generators and introducing the Poincaré loss to replace cross-entropy (CE) loss, addressing gradient vanishing issues in the inversion process. Similarly, Nguyen et al. [2023b] proposed the logit maximization (LOM) loss as an alternative CE loss, alongside model augmenta- tion techniques to mitigate overfitting. PLG-MI [Yuan er al., 2023] advanced MIAs by integrating a conditional GAN (cGAN) with max-margin loss and pseudo-label guidance, effectively decoupling class-speciff search spaces and enhancing the exploitation of target model information. These methods primarily concentrate on either the initial training process of GANs or the optimization techniques used in the attacks. A Recent work PPDG-MI [Liu et al., 2020, Peng et al., 2024b] took a different direction by fine-tuning the GAN generator post-attack with reconstructed samples, narrowing the distribution gap between prior and private data distributions.
In the black- box setting, where attackers can only query the model, An et al. [2022] introduced genetic search approach to replace gradient-based optimization, while RLB-MI [Han et al., 2023] framed the attack as a Markov decision process (MDP) and applied reinforcement learning optimize the latent vector. In the label-only setting, which is the most restrictive scenario where only hard labels are available, Kahla al. [2022] proposed the boundary- method, which uses zeroth- Optimization method to approximate gradient descent and steer the search toward dense class regions. Inspired by transfer learning. Nguyen al. [2023a] introduced label-only via knowledge transfer (LOKT), which uses a target model-assisted ACGAN (T-ACGAN) to effectively transform the label-only attack into a white-box setting.
model inversion (BREP-MI)
Many studies have also focused on designing defense methods against generative MIAs. Since MIAs exploit the strong correlation between inputs and outputs for successful attacks, Wang et al. [2020] proposed augmenting the standard classification objective with a mutual information regularizer to penalize this correlation. However, this approach can significantly degrade the model's 's predictive performance. To overcome this limitation, Peng et al. [2022] introduced bilateral dependency opti- mization (BiDO), which enhances the dependency between input features and latent representations while minimizing the dependency between representations and outputs [Peng et al., 2025]. Inspired by BiDO. Stealthy Shield Defense (SSD) [Zhuang et al., 2025] adopts an inference-time strategy that minimizes mutual information between input features and predictions while maximizing the mutual information between predictions and labels, providing an effective black-box defense. Addi- tionally, Ho et al. [2024] proposed freezing the early layers of a pre-trained model and fine-tuning the remaining layers on private data to reduce vulnerability for reconstruction attacks. Struppek et al. [2024] further observed that negative label smoothing can also mitigate generative MIAs. In a recent work, Hao et al. [2024] examined the impact of model architecture on MIA robustness and found that residual connections can increase vulnerability to these attacks.
22

---

B Derivation of the Alignment-aware Training Objective
In this section, we provide a derivation of the Inequality (6), which serves as relaxation used to obtain the final alignment
training objective in Eq. (7).
Lemma B.1. Under the same notation as in Section 4, and assuming all gradient vectors vxfi(x;; have equal norm, the following inequality holds:
| LE vxfi(x;0)] 1 C (x;
Px vxf((x(0]
(9)
[xf((x;0)
Proof. Let := (x/i(x;; 0) and assume || = a > 0 for all i. Put g = Ee Ii and suppose
g # O. By linearity of the orthogonal projector Px x-
Pxg
Σ
P Pxpi
Applying the triangle inequality,
P
|>
Pxgi
P
S
Σ
P
Dividing both sides by |ل9|| and multiplying by - reverses the inequality:
Px
Px9:|
P
Di=1
(10)
||g||
Since |lg|| | 9ill <
E |1aill = Ca, we have
Substituting this bound into the
Tfll
Ca
right-hand side of Inequality (10) yields
Σ P
E
x9
P Px9.
(11)
1gll
Ca
a
Combining Inequalities (10) and (11) and substituting
||
gives
P Px9
1
Σ
Px
|
C
19911
which is exactly Inequality (9). Equality holds iff both triangle inequalities above are tight, i.e., (i)
all vectors Pxge are colinear and (ii) all g: themselves colinear.
C Algorithmic Realizations of Gradient-Manifold Alignment Methods
This section presents the algorithmic implementations of our proposed training objective for validating the hypothesis, well the training-free alignment approach designed to enhance gradient-manifold alignment and improve model inversion performance.
(1) Alignment-Aware Training. To validate hypothesis that stronger alignment between loss gradients and the generator manifold leads to greater inversion vulnerability, we introduce gradi- ent-manifold alignment- loss with a geometric alignment term and can be optimized via standard backpropagation. The training procedure is detailed in Algorithm 1.
training objective. This objective augments the standard classification
(2) Training-Free Alignment Promotion. Motivated by the above findings, we propose a training- free method that improves manifol alignment at inversion time. By averaging loss gradients over perturbed or transformed versions of the synthetic input, this approach denoises the gradient signal in a geometry-awan manner. The inference-time procedure is described in Algorithm 2.
23

---

Algorithm Gradient-Manifold Alignment-Aware Training
Input: Classifier f(:;0), pre-trained VAE decoder training set Prr trade-off hyperparameter 3,
number of training steps T
Output: Updated target model parameters 0
1: for = 1 to T do
2: Sample minibatch {(x(*), ()"))) | from pri
3: for each (x. y) in batch do
4: Compute latent code: <- {xx)
5:
Compute Jacobian: Jp(z) 2g
0D
6:
Compute SVD: (z) UEV
7:
Let U be the first & columns of U
8:
Estimate projection matrix: Px + U
&
9:
Compute softmax probabilities: p sxf)
10:
Compute CE loss: LCr = log Py
11:
Compute input gradients of logits: (xx
12:
Compute gradient sum: -EE (x)(xx;)
|
13:
Compute alignment term: Lg
14:
Compute final loss: Lalign (0)
LCr
B
C
15:
end for
16:
Update 9 via backpropagation over average batch loss
17:
end for
18:
return
Algorithm Training-Free Gradient-Manifold Alignment During Inversion
Input: Target model f, pre-trained generator G. inversion loss C, initial latent code z, number of inversion steps T, number of samples K, perturbation strength o, sampling strategy P E (PAA, TAA} Output: Recovered image X = G(z)
1: for t- 1 to T do
2: x 4- Giz)
3: Initialize gradient buffer: G <- 0
4: for k = 1 to K do
5: if p PAA then
6:
Compute noise scale: o +- a (max(xx min(x))
7:
Sample noise: eg ~ (N00,011
8:
Xx f x + Ek
9:
else if p TAA then
Sample transformation: Tk
11:
f (x)
end if
13:
Compute loss gradient: gk + L(x+)
Append buffer: g + GU {gr}
15:
end for
Compute averaged gradient: 7((x) +- K > gi
17:
Update latent code: z Jz(z) VL(xx
18: end for
19: return & G(z)
D Experimental Setup and Implementation Details
D.I Hard- and Software Details
All high-resolution MIA experiments using Plug & Play Attacks (PPA) were conducted on Oracle Linux Server 8,9 with NVIDIA A100-80G GPUs, using CUDA 11.7, Python 3.9.18, and PyTorch
24

---

Table 3: A summary of experimental setups.
Setting
MIAs
Private Dataset
Public Dataset
Target Model
Evaluation Model
GMI (LOMMA)) KEDMI (LOMMA)/
CelebA FFIQ
VGG16/
Low-resclution setting
CelebA
FaceNet (112)
FaceNet (64)
PLG-MI
ResNet-18/
CelebA/ / FaceSerub
llighrreootttion selting
PPA
FFUQQ
DenseNet-1211
Inception-v3
ResNeSt--5
1.13.1. Low-resolution facial recognition MIAs were run on Ubuntu 20.04.4 LTS with NVIDIA RTX 3090 GPUs, under CUDA 11.6, Python 3.7.12, and PyTorch 1.13.1.
D.2 Target Models
(1) Empirical Validation of the Hypothesis. To validate our hypothesis, we conduct experiments on models pre-trained for a 1000-class classification task using 64 x 64 CelebA images. The model and training pipeline are based on the implementation provided at sutd-visual- compualoooopinnnnnogmmmmm group/Rec wwwpp//eeetiniin..... ttinkiingnnM..... To compute alignment scores, we require estimates of the tangent space at each training point. These are obtained using a pre-trained VAE decoder, which maps latent representations back to the image space. For each training image, compute the Jacobian of the decoder to extract the local tangent basis and pre-store it for downstream alignment computation. However, this procedure is memory- meemoryintensive. For cxample, estimating and storing tangent bases for approximately 2, 700 training images from the first 100 classes CelebA requires about 30 GB of disk space. Due to this storage constraint and the exploratory nature of the analysis, we restrict our investigation to a 100-class subset of the full dataset.
com/
To obtain models trained on this 100-class subset, we first adapt the original 1000-class model by fine-tuning on the corresponding subset. Fine-tuning is performed for 20 epochs using stochastic gradient descent with an initial learning rate of 10-2, momentum of 0.9, weight decay of 10-1, and batch size of 128. The learning rate scheduled to decrease by a factor 0.02 at epochs 10 and 15. This procedure yields 100-class vanilla model. Subsequently, to obtain models with varying manifold alignment, we continue fine-tuning the 100-class vanilla model for 30 additional epochs using our proposed alignment-ave rate is fixed throughout this phase. To capture the evolution of training-tine alignment scores, we save model checkpoints intermediate epochs. These models serve the basis for evaluating the correlation between alignment and model inversion vulnerability in later experiments.
levels of training- time gradient-manifold
training objective. The learning
To evaluate our proposed methods, we adopt distinct training configurations for models at different image resolutions. For high-resolution inputs (224 x 224) from the CelebA and FaceScrub datasets, optimized using Adam [Kingma and Ba. 2015] with an initial learning rate of 10 3 parameters set to (0.9, 0.999), and a weight decay of 10 Training runs for 100 epochs with batch size of 128, and the learning rate is reduced by a factor of 0. at epochs 75 and 90. Input preprocessing includes normalization (mean and standard deviation both set to 0.5), followed by sequence of augmentations: random cropping with a scale range of (0.85, 1.0) and fixed aspect ratio of 1.0, resizing to 224 x 224, and horizontal flipping with probability of 0.5.
(2) Evaluation of Proposed Methods.
follow the setup from Struppek et al. [2022]. Models
For low-resolution images (64 x 64) from CelebA, we follow the training protocol provided by httpp:://gt thub. com/sutd-visuse
Specifically, we use stochastic gradient descent (SGD) with an initial learning rate of 10 10-2, momentum of 0.9, and weight decay of 10 44 Models are trained for 100 epochs with batch size of 64, and the learning rate is decayed by a factor of 0. at epochs 75 and 90.
wwwputinottt....ce wwwpetiiigggrgug//ee prroup/Re-thinking
D.3 Evaluation Models
For our PPA-based experiments, we follow the original implementation at https: thub. com/ LukasStrruppek/Plug -twp:///uuuuaaa-daaaaeee and-Play-Attackes train Inception-v3 evaluation models, using the training configurations specified in Struppek et al. [2022]. These models achieve test accuracies of
eeP--baseeexperieeent
25

---

96.53% on FaceScrub and 94.87% on CelebA. To compute K-nearest neighbor (KNN) distances, which serve similarity metric between reconstructed and true samples facial recognition tasks, we adopt the pre-trained FaceNet model [Schroff et al., 2015], available at https: //gi thub. com/ timesler///ee wfwp://fcceeeteeeeeeeeeeeeeeee wwwtenettttttccch....oo
For experiments on target models trained on 64 x 64 resolution CelebA dataset, we use an evaluation model from https:/ //git///ttbbt ctwp wwmm/sud-vvas visuall ceall-ooottiingggeeeeee
Reeethiniing..ee MI. This model is based on the face.evoLVe architecture [Wang et al., 2021b] with a modified ResNet-50 backbone, and achieves a reported test accuracy of 95.88% Details on the training procedure are available in Zhang et al. [2020].
D.4 Attack Parameters
High-Resolution Setting, In the high-resolution setting, we follow the Plug & Play Attack (PPA) method, which comprises three stages: (1) latent code pre-selection, (2) latent code optimization, and (3) result selection. During pre-selection, we sample 2000 latent codes per class and retain the top 100 candidates based on the target model's response for both CelebA and FaceScrub datasets. In the optimization stage, we perform 70 iterations of gradient-based latent code updates per class. The final result selection stage is omitted in our implementation in order include as many as samples for evaluation. We focus on the first 100 classes. generating 100 reconstructed samples per class.
As for the parameters of PAA strategy, we Gaussian perturbations of standard deviation set to 5% of the synthesized images' dynamic range. For parameters of TAA strategy, we apply three geometrically constrained transformations: random resized cropping with scale factors spanning [0.8, 1.0] and aspect ratios limited to [0.9, 1.1], horizontal flipping with probability p = 0.5, and random rotations within +5 angular displacement.
Now-Resolution Setting. In the low-resolution setting, we target the first 100 classes from CelebA as the private dataset Pri and generate 100 samples per identity using CelebA, FFHQ and FaceScrub as auxiliary datasets D D For instantiations of AlignMI, we maintain identical PAA and TAA parameter configurations from the high-resolution setup unless explicitly stated. Implementation details differ slightly across MIAs. For GMI (LOMMA) using StyleGAN, we directly sample and optimize 100 latent codes for 100 steps with batch size of 20, and set the PAA's Gaussian noise standard deviation a is set to 0.5% of the synthesized images' dynamic range. For KEDMI (LOMMA) with DCGAN, we process 100 samples per identity through 200 optimization steps with a batch size of 100. For PLG-MI with a cGAN prior, the baseline includes a data augmentation pipeline comprising: random resized cropping 64 x 64 with scale in [0.8, 1.0) and fixed aspect ratio 1.0, color jittering with brightness and contrast set to +0.2, random horizontal flips (probability 0.5), and rotations within +55 In our PAA and TAA configurations, we omit this augmentation pipeline to isolate the effect of alignment. Optimization for PLG-MI runs for 100 steps with a batch size of 20.
Due to the high computational cost of generative MIAs, perform single attack per target model. To reduce randomness, we generate at least 100 inversion samples per class across all configurations.
D.5 Evaluation Metrics
Attack Accuracy (Attack Acc). We employ an evaluation model (generally more robust and powerful than the target model) trained on the same dataset the target model to verify whether reconstructed images correctly represent the target class, following the evaluation method of Zhang al. [2020]. This metric serves an automated proxy for human evaluation, assessing how well the reconstructed images capture the distinctive characteristics of the target class compared to other classes. The attack accuracy computed as the percentage of predictions matching the target class, reporting both top-1 (Acc@) 1) and top-5 (Acc@5) accuracy scores.
K-Nearest Neighbors Distance (KNN Dist). KNN distance quantifies reconstruction quality through 12 distance computation in a model's feature embedding space, measuring the similarity between reconstructed images and their nearest original private training samples. This metric serves as a quantitative indicator of visual fidelity, where smaller distances correspond to higher similarity between generated and genuine training data. For high-resolution attacks in PPA [Struppek et al., 2022], we extract features from FaceNet's penultimate layer [Schroff et al., 2015], while for low- resolution model inversion attacks, we use the evaluation model's penultimate layer features.
26

---

LORINA WITOOLD
P.O-M moddi
1- yeer Sar ver PIGI 3030
Parcomi (.0
10
Denatty
0.0
0.
2.00
200:
Alignment
2l14 0:31
0.50
0.00
0.28
5.52
0.43
0.44
0.50
Inversion Progress
(a) KEDMI (LOMMA)
(b) PLG-MI
(c) Inversion-phase dynamics
Figure 6: Additional gradient-maniton alignment during inversion process. Al)gmigmeent score distribution for KEDMI (LOMMA) using an inversion-specific GAN trained on CelebA. (b) Conrsponding results for PLG-MI using conditional GAN. (c) Evolution of mean alignment scores versus prediction confidence during inversion. Notably, while prediction confidence demonstrates monotonic improvement throughout the inversion process, gradient-manifold alignment in additional attack methods also remains stable and low, reinforcing the lack of correlation between confidence and graddiett-manffon alignment.
D.6 Experimental Details for Figure 3
Low- Low-Resolution Setting. In the low-resolution experiments, we adopt DCGAN trained on CelebA as the generative prior. The latent space dimension of DCGAN is 100, corresponding to a random baseline alignment score of approximately 0.090. The target classifier is VGG16 model trained on CelebA. and the inversion targets the first 25 classes, each containing 1, 000 images. For Fig. 3()), we run the inversion optimization for 1, 200 steps and record the inversion-ting alignment scores of the loss gradients every 10 steps for each reconstructed sample. The figure presents the distribution of all collected alignment scores. In Fig. 3(c), we further analyze temporal dynamics by averaging alignment scores across all classes at each step, illustrating how gradient-manin alignment evolves during optimization.
Additionally, we evaluate gradient-manifole alignment during the inversion process for other attack methods, including KEDMI (LOMMA) and PLG-MI, in the row-resolution setting. The results are present in Fig. Both methods leverage CelebA as the generative prior and target VGG16 classifier trained on CelebA. Specifically for KEDMI, we adopt DCGAN with latent space dimen- sion of DCGAN 100, corresponding to a random bascline alignment score approximately 0.090. The inversion process targets the first 50 classes, each containing 500 images and proceeds 200 optimization steps. For PLG-MI, we use conditional GAN (cGAN) with 128 latent dimensions, which corresponds to a random baseline alignment score approximately 0.102. The inversion process executes 100 optimization iterations targeting the first 100 classes, each containing 100 images.
Interestingly, the PLG-MI method exhibits higher inversion-time alignment scores than GMI (LOM) and KEDMI (LOM)). This improvement can be attributed to its use of conditional GAN, which incorporates label information throughout the inversion process. The stronger alignment may partially explain PLG-MI's superior attack performance.
High-Resolution Setting. In the high-resolution experiments, we use a StyleGAN model trained on FFHQ as the generative prior. The latent space has dimension 512, yielding random baseline alignment score of approximately 0.058. The target classifier is a ResNet18 8 model trained on CelebA, with inversion targeting the first 50 classes, each containing 50 images. For Fig. 3(b), inversion is run for 100 steps, with alignment scores recorded at 10 equally spaced intervals per reconstructed sample. The figure shows the distribution of the recorded scores. In Fig. 3(c), we track temporal alignment by averaging scores over all latent vectors at each interval, capturing how alignment develops throughout the inversion process.
D.7 Experimental Details for Figure 4
Tangent Space Estimation. To compute training- time alignment scores, we estimate the tangent space at each training sample using pre-trained VAE from Stable Diffusion. Specifically, the VAE encoder maps an input image of shape 64 x 64 x 3 to latent representation z of shape 8 x 8 x 4, which then decoded back to the image space by the VAE decoder. For each training image, we compute the Jacobian of the decoder to obtain the local tangent basis, resulting in Jacobian matrix of
27

---

Training
images
Recovered images
Figure 7: Original training samples (top row) and corresponding reconstructions (bottom row) from the pre-trained VAE used for tangent space estimation. The visual similarity confirms the VAE's ability to approximate the natural image manifold reliably.
100
20
FaceNet
Vanilla training
VGG16
Alignment training
Test Accuracy (%)
Vanilla Model
15
Random
Density
200
91
88
85
0.1
0.2
0.3
0.4
0.5
0.15
0.30
0.45
0.60
0.75
Training-time Alignment Score
Inversion-time Alignment Score
(a)
(b)
Figure 8: Empirical evaluation of gradient-manifole alignment (enlarged version). (a) Test accuracy vs. training- time alignment score (AS,,) for models sampled during fine-tuning vanilla models with the alignment-aware training objective. Insets show input gradient visualizations for models with varying degrees of alignment. (b) Distribution of inversion-timg alignment scores (ASjwv) for the vanilla model compared to the alignment- aware model.
shape 12,288 x 256. This process is memory- inntor-intensive: for example, estimating and storing tangent bases for approximately 2,700 training samples from the first 100 classes of CelebA consumes roughly 30 GB of disk space. As shown in Fig. 7, the reconstructed images closely match the original inputs, indicating that the pre-trained VAE, despite not being trained the target dataset, offers reliable approximation of the natural image manifold.
Empirical evaluation of gradient-manifole alignment. To empirically evaluate the trade-off between test accuracy and training-tine time alignment score as shown in Fig. 4(a) (or Fig. 8(a)), we conducted experiments using two 100-class target models: VGG16 and FaceNet. The training procedures for these models followed the same specifications detailed Appendix D.2. During training, saved intermediate model checkpoints various epochs capture the evolution of model performance under our alignment-aware objective.
For analyzing the distribution of inversion-time alignment scores presented in Fig. 4(b) (or Fig. 8(b)), we select two 100-class FaceNet models as target models. The vanilla model achieves a test accuracy of 96.53% with training-time time alignment score AS,, 0.175, while the aligned model achieves test accuracy of 93.733.... 75% with AS,, = 0.339. We use the GMI (LOM) attack method with StyleGAN as a prior, targeting the first 25 classes and running the optimization for 100 steps with batch size 20 for both the vanilla and aligned models.
In Fig. 4(c), we extend our evaluation to 1000-class VGG16 models, following the same training protocol as described in Appendix D.2. We save checkpoints at intermediate training epochs obtain models with varying test accuracies. The alignment scores ASt, are recorded throughout the training process. Additionally, we compute the alignment scores ASh using the GMT (LOM) attack with StyleGAN, again targeting the first 25 classes and running the optimization for 100 steps.
28

---

Training images
AS 0.18
ASH
Training Progress
ASL- 0.40
AS 0.45
Figure 9: Training-time alignment progression with alignment-aware training. Evolution of training-time alignment score (AS.r) and gradient visualizations during fine-tuning of FaceNet using our alignment-awwan objective. alignment improves, loss gradients exhibit increasingly structured and semantically meaningful patterns. (Best viewed with zoom.)
Recovered
images
Vanilla
Align
Figure 10: Comparison of inversion-time loss gradients. Visualization of loss gradients from the vanilla model (top) and the alignment-ave aware model (bottom).. The alignment-aware model produces gradients that are sharper and more semantically aligned with facial structures, indicating stronger alignment with the generator manifold. (Best viewed with zoom.)
E
Additional Experimental Results
E.1
Additional Empirical Validation of the Hypothesis
We illustrate the fine-tuning progress of a FaceNer model optimized with our alignment-aware ob- jective in Fig. 10. As fine-tuning proceeds, the training-time alignment score (AS.r) consistently increases, and corresponding gradient visualizations exhibit progressively clearer and more seman- tically meaningful structures. This demonstrates the effectiveness of alignment-awarc training strategy in promoting geometrically informative gradients.
For comparison, Fig. 10 also presents inversion-time loss gradient images from both the vanilla and aligmment-awwan models. The gradients from the alignment-awand model reveal clearer, semantically meaningful structures, highlighting improved alignment with the underlying generator manifold.
To further validate our hypothesis, we extend our experiments to include 152 as the target model, using the GMI (LOM) attack method. As shown in Fig. 11 the results are consistent with our earlier findings in Fig. 4(a) (Sec. 6.2): as fine-tuning progresses, the training-time alignment score (AS,)) steadily increases, and corresponding gradient visualizations reveal increasingly semantically
29

---

100
90
Random
Model
Attack Accuracy (%)
Test Accuracy (%)
98
Vanilla Model
85
96
Model
Vanilla Model
80
92
Model C
90
0.13
0.21
0.29
0.37
0.45
75
0.15
0.20
0.25
0.30
0.35
Training-time Alignment Score
Training-time Alignment
(a)
(b)
Figure 11: Additional empirical evaluation of gradient-manifold alignment. (a) Test accuracy vs. training-time alignment score (AS,,) for IR152 models sampled during fine-tuning vanilla models with the alignment-aware training objective. Insets show input gradient visualizations for models with varying degrees of alignment. (b) MIA success vanilla and alignment-aware IR152 models with different AS
Table 4: Comparison of inversion performance with PPA in the high-resolution setting. D CelebA or FaceScrub, GANs are pre-trained on Dm,. FFHQ. The symbol + (or 1) indicates that smaller (or larger) values are preferred, and the green numbers represent the performance improvement. The results averaged three independent runs.
CelebA Acce5t
FaceScrub Acc@5t
Target Model
Method
1cc@11
KNN Dist
Acc
KNN Dist]
PPA
85.63 + 1.39
95.12 + 0,80
0.693 + 0.009
81.57 + 0.25
94.85 + 0.05
0.796 0.003
ResNet-18
+ PAA (ours)
88.75 1.63
96.59 + 0.75
0.669 0.006
83,97 + 0.29
95.78 0.14
0.777 0.003
TAA (ours)
91.68 0.19
97.68 1: 0.04
0.662 0.001
93.68 1: 0.05
98.84 0.08
0.691
0.001
PPA
82,22 + 0.44
93.26 + 0.39
0.708 = 0.002
75.66 + 0.46
90.91 = 0.22
0.786 0.002
DenseNet-121
+ PAA (ours)
85.64 0.15
95.16 + 0.50
0.684 = 0.003
80,70 + 0,22
93.40 = 0.09
0.761 0.003
TAA (ours)
87.88 0.86
96.20 1: 0.41
0.687 0.008
86.54 1: 0.73
95.12 1: 0.52
0.712 0.004
PPA
70.75 + 0.41
87.43 + 0.36
0.793 + 0.001
71.58 + 0.19
90.60 + 0.28
0.827
0.004
ResNeSt-50
+ PAA (ours)
75.71 0.06
90.48 + 0.09
0.764 0.002
73.38 + 0.18
91.34 = 0.16
0.807 0.004
TAA (ours)
79.19 0.63
92.28 + 0.12
0.761 0.002
84.38 1 0.41
96.04 = 0.21
0,753 0.002
Table 5: Comparison of inversion performance with white-box MIAs in the low-resolution setting, Target model f VGG16 trained on Pri = CelebA. GANs are trained on Daux = CelebA or FFHQ.
CelchA
FFRQ
Acc@5t
Dist,
Ratia]
A
Acc@5t
Dist.
Ratio
GMI (LOMMA)
94.12
98.93
1155.02
73.07
92.95
1288 08
PAA (aurs)
94.65 (60.533
99.00 (60007)
1104 52 (-50.50)
72.11 (-0.6)
92.55
1292.79 (14.71)
11.11
+ TAA (ours)
96.36 (+2.24)
99.14 (+0.51)
1105 63 (-19.38)
4,76
81.25 (48.18)
96.02 (+3.07)
1255.01 (-33,07)
12.38
KEDMI (LOMMA)
60.46
87.35
1278.10
26.32
$2.65
1592 32
PAA (ours)
(416.29)
1266.
25 (-0.66)
17.27
TAA (ours)
$9.67 (-0.79)
86.83 (-0.52)
1364 (-89.51)
9.33
(-0.20)
(+0.30)
1595.83 (43.51)
meaningful features. Notably, this rise in alignment is accompanied by a gradual decline test accuracy, reaffirming the trade-off between alignment and generalization.
Additionally, we evaluate model inversion performance across both vanilla and alignment-aware mod- els with varying levels of AStr. As shown in Fig. (b)),, the trend mirrors Fig. 5: MIA vulnerability increases with aligmment up to certain threshold, after which further increases in ASt reduce attack success. This characteristic inverted V-shaped relationship supports our hypothesis and demonstrates that the correlation between different model architectures.
manifold alignment and inversion vulnerability holds across
E.2 Additional Evaluations of Proposed Methods
Inversion-Time Alignment Score Comparison with PPA in High- Resolutiso Setting. Fig. 12 shows the distribution of inversion-time alignment scores for the baseline method and our training-free variants, PAA and TAA. These results are obtained using the PPA attack ResNet- 18 model trained
30

---

Table 6: Comparison of inversion performance with white-box MIAS in the low-resolution setting. Target model f = FaceNet trained on PM CelebA. GANs are trained on Daux = CelebA or FFHQ.
CelebA
FFHQ
Mathed
Acc
Accles
KNN Dist
Ratiol
Acc
Acc
KNN Dist
Ratiol
GMI (LOMMA)
98.25
1084.60
74.01
1279.53
+ PAA (ours)
93.73 (+0.07)
98.31 (+0.66)
1082.41 (-2.19)
11.64
74.36 (+0.35)
93.22 (+0.31)
1278.74 (-0.99)
11.27
+ TAA (ouns)
96.74 (+3.08)
99.11 (+0.66)
1077.23 (-7.37)
12.60
84.90 (+10.89)
96.64 (+3.73)
1234.00 (-45.53)
15:20
KEDMI (LOMMA)
60.42
89.47
1331,94
30.33
1542.77
+ PAA (ours)
61.20 (+0.78)
$9.50 (+0.03)
1342.33 (+10.39)
15.15
29.29 (-1.04)
61,05 (-0.15)
1540.16 (-2.61)
16.13
TAA (ouns)
60.55 (10.13)
89.50 (10.035
1336.16
14.73
30.28 (-0.05)
61,43 (10.23)
1540.33 (-2.44)
15.81
Table 7: Comparison of inversion performance with PLG-MI in the low-resolution setting. Target model f = FaceNet trained on pri CelebA. GANs are trained on Daux FaceScrub FFHQ.
FaceScruh
FFHQ
Method
Acc@ 11
Atc@St
KNN Dist,
Ratiol
@cc@1 11
Acc@5t
KNN Dist.
Ratiol
PLG
32.06
58.17
1558.26
88.68
97.06
1267.12
/
PAA (ours)
29.93 (-2.13)
53,99
1557.11 (-L15)
9:07
87.32 (-1.6))
96.37
1270.54 (43,42)
9.04
TAA (ours)
35.99 (+3.93)
62.87
1539.27 (-18.99)
11.07
90.79 (+2.11)
97.56
1256.07 (-11.05)
11.07
on CelebA, with a StyleGAN generator pre-trained on FFHQ. Both PAA and TAA significantly shift the alignment score distribution to the right compared to the vanilla baseline, indicating stronger alignment between the loss gradients and the generator manifold. This enhanced alignment aligns well with the improved gradient visualizations shown in Fig. 13.
Comparison with white-box MIAs in the low-resolution setting. In this experiment, we evaluate the performance of two target models, namely VGG16 and FaceNet, under three attack methods: GMI (LOMMA), KEDMI (LOMMA), and PLG-MI. Quantitative results are presented in Tabs. 5, 6, and 7. Overall, AlignMI consistently outperforms baseline methods in most setups, achieving gains in both attack accuracy and KNN distance across different auxiliary datasets. For example, when attacking VGG16 using GMI (LOMMA), PAAA increases top-1 I accuracy from 94. 1 22 to 94.65% on CelebA, while TAA achieves an additional 2.54% improvement and reduces the KNN distance from 1155.02 to 1105.63. Similar trends are observed for KEDMI (LOMMA) and PLG-MI, demonstrating the broad effectiveness of our proposed techniques. However, we also observe occasional performance drops, particularly with PAA in certain KEDMI (LOMMA) and PLG-MI scenarios. This degradation likely arises from the poor visual quality of reconstructions produced by certain low-resolution attacks, especially under significant distribution shifts between the private and public auxiliary datasets. In such cases, additional perturbations further compromise image fidelity, diminishing the effectiveness of neighborhood sampling. As a result, the derived gradients become less informative, leading to occasional failures in inversion.
Comparisons under SOTA MIA defenses. Our evaluation focuses on the high- high-resolution setting, where assess the efffcctiveness of our proposed training-free alignment enhancement methods, PAA and TAA, when integrated with sfatc-of-the- (SOTA) generative model inversion attacks against leading MIA defenses, including BiDO-HSIC [Peng et al., 2022], NegLS [Struppek et al., 2024], and TL-DMI [Ho et al., 2024]. The results, summarized in Tab. 8, show that both PAA and TAA improve inversion performance across all defense scenarios, with TAA consistently achieving the strongest results. All attacks are conducted using the Plug & Play Attack (PPA) method, targeting a ResNet- 152 classifier trained on pri = FaceScrub, with the generative prior provided by StyleGAN model trained on Daux FFHQ. Detailed results are shown in Tab. 8.
For the BiDO-HSIC defense, the baseline inversion performance drops significantly, with top-1 accuracy (Ace @ 1) of 35.11%. top-5 accuracy (Aco@5) @) of 59.14%. and KNN distance of 1.031. Integrating PAA yields moderate gains, raising Acc @1 I to 39.06% and Acc@5 to 67. 67.46%, while reducing the KNN distance to 0.975. In contrast, TAA achieves substantial improvements, boosting Acc @ I to 62. 58% and Acc @5 to 84.09%, alongside sharper drop in KNN distance to 0.855. This suggests that TAA more effectively recovers semantically meaningful gradients that better align with the generator manifold.
Under the stronger NegLS defense, which imposes stronger regularization and suppresses inversion more aggressively, the baseline Acc@1 I is just 8.40%. Although this setting presents a more chal- lenging scenario, PAA still offers slight improvements, raising Ace@1 I to 8. 8.62% and reducing KNN distance from 1.309 to 1.303. TAA further improves Acc @ I to 10.61% and reduces KNN distance
31

---

Baseline
Baseline
Random (-n 0.058)
Random (=n 0.058)
Density
Density
Inversion-time Alignment Score
Inversion-time Alignment Score
(a)
(b)
Figure 12: Distribution inversion-time alignment scores. (a) Comparison between baseline and PAA method. (b) Comparison between baseline and TAA method. Each plot shows the distribution of alignment scores between the inversion-tine loss gradients and the generator manifold. The measurement is performed using the PPA method with StyleGAN generator trained on FFHQ, and the target model a ResNet-18 trained on CelebA. Both PAA and TAA lead to rightward shift in the score distribution, indicating stronger alignment with the generator manifold.
Table 8: Model inversion performance against SOTA defense methods in high- nigh-resolution settings. Target model f = ResNet- 152, trained on Dpr = FaceScrub. GAN is pre-trained on Daux FFHQ.
Method
Acc@ 11
Acc@5t
KNN Dist.
No Defense
57.89
81.25
0.893
BiDO-HSIC
35.11
59.14
1.031
PAA
39.06 (43.95)
67.46 (48.32)
0.975 (-0.056)
+ TAA
62.58 (427.47)
84.09 (424.95)
0.855 (-0.176)
NegLS
8.40
23.50
1.309
+ PAA
8.62 (+0.22)
23.67 (+0.17)
1,303 (-0.006)
TAA
10.61 (+2.21)
27.31 (+3.81)
1.278 (-0.031)
TL-DMI
25.14
51.72
1,026
PAA
34.93 (+9.79)
63.66 (+11.94)
1.022 (-0.004)
TAA
47.80 (422.66)
75.51 (423.79)
0.971 (-0.055)
to 1.278. While the absolute gains are smaller due the strength of the defense, the consistent improvements across all metries indicate enhanced gradient informativeness.
Finally, the TL-DMI defense, which involves partial model freezing during fine-tuning, the baseline attack achieves Acc of 25.14 25.14%, Acc@5 51.72%, and KNN distance of 1.026. PAA improves Acc@1 to 34.93% and Acc@5 5 to 63. 63.66%, slightly reducing the KNN distance to 1.022. TAA again shows superior performance, reaching A of 47.47.88 .00. Acc@ of 75.51%, and decreasing KNN distance to 0.971.
Overall, across all three defenses, both PAA and TAA enhance inversion performance, with TAA consistently outperforming PAA in all metrics. These results highlight the generality and robustness of our alignment-enhancingg framework. TAA, in particular, effectively boosts attack success rates while recovering reconstructions that are perceptually and semantically closer to the true data distribution, even under strong privacy-pres fivacc--rreeervng defenses.
E.3 Ablation Study
In this subsection, we perform an ablation study to examine the sensitivity of our proposed AlignMI approach to two key hyperparameters: (1) the number of samples K used to compute the smoothed, alignment-enhanced gradients, and (2) the perturbation strength a used the perturbation-average alignment (PAA) method. All experiments conducted using DenseNet- 121 target model trained
32

---

Table 9: Ablation study on PAA sample size K with a 0.03. Higher K improves results slightly, but gains saturate.
Table 10: Ablation study on PAA sample size K with a 0.05. Higher K improves results slightly, but gains saturate.
Method
K
Acc@1f
Acc@51
KNN Dist.
Method
K
Acc@51
KNN Dist.
77.00
92.44
0.807
PPA
77.77
92.73
0.798
PAA
20
79.56
93.24
0.804
PAA
20
82.52
94.48
0.789
PAA
60
78.64
92.84
0.804
+AA
60
82.04
94.08
0.789
+ PAA
100
78.60
93.32
0,802
+PAA
100
81.92
94.55
0.788
+ PAA
150
79.16
93.44
0.797
+ PAA
150
82.28
94.16
0.788
Table 12: Ablation study PAA perturbation scale a at fixed K = 60. Increasing a improves
Table 11: Ablation study on TAA sample size K.
Higher K yields marginal gains.
alignment but saturates.
Method
K
Acc@1 1
Acc@5t
KNN Dist..
Method
a
Acc@1 11
Acc@51
KNN Dist.
PPA
77.77%
92.73%
0.798
+ TAA
20
87. 77.64%
96.04%
0,748
PAA
0.01
74.72%
91.80%
0.822
TAA
60
88 88.28%
96.44%
0.746
PAA
0.03
78.64%
0.804
+ TAA
100
88.44%
96. 10%
0.745
PAA
0.05
82.04%
94.08%
0.789
TAA
88.16%
96.44%
0.745
PAA
0.10
82.84%
94.48%
0,780
PAA
0.15
79.16%
93.44%
0.797
on the FaceScrub dataset 224 224 resolution, with StyleGAN generator pre-trained FFHQ serving as the prior model.
Effect of Sample Number K in PAA. We first investigate the influence of the sample number K on PAA under two different perturbation strengths. As shown in Tabs. 9 and 10, we observe that increasing K has limited effect attack accuracy, which remains relatively stable across settings. However, the KNN distance continues to decrease slightly as K grows, indicating progressively finer reconstruction fidelity. These findings suggest that while larger K offers marginal improvements, even a relatively small sample number (e.g., K 20) is sufficient to achieve substantial gains over the baseline. This highlights the practicality of PAA in improving inversion performance with minimal computational overhead.
Effect of Sample Number K in TAA. We conduct similar evaluation for the TAA method. As presented in Tab. 11, both attack accuracy and KNN distance improve as K increases, with performance gains tapering off beyond K 100. Notably, TAA achieves strong results even with K = 20, outperforming the baseline by a significant margin. This again demonstrates that our training-free alignment promotion strategy enhances inversion performance effectively, with limited sampling, thus making it computationally efficient.
Effect of Perturbation Strength in PAA. Finally, we analyze the role of the perturbation strength PAA. As shown Tab. 12, increasing a initially boosts both attack accuracy and KNN distance, with performance peaking around = 0.1. However, beyond this threshold (e.g. both metrics begin to deteriorate, likely due to the perturbations introducing excessive noise that destabilizes the model's prediction and results in unreliable gradients. This suggests that careful tuning of a is critical, and moderate values around 0.05 to 0.1 provide favorable balance between denoising and preserving informative signals.
0.15),
E.4 Visualization of Gradient Images
In this subsection, qualitatively demonstrate that both PAA and TAA produce loss gradients that are better aligned with the generator manifold. Our analysis focuses on the high-resolution setting, which enables high-quality visualizations of gradient structures. Figs. 13, 14, and 15 present gradient visualizations from ResNer-18, DenseNet- and ResNeSt-50 models trained on CelebA. Each figure compares gradient maps produced by the baseline, PAA, and TAA methods, using GANs pre-trained on FFHQ We also visualize the inversion-time loss gradient images for three attack methods in the low-resolution setting (see Fig. 16), complementary comparison Fig. 1(b).
33

---

Recovered images
PPA
PAA
TAA
Figure 13: Visual comparison of inversion-ting loss gradients for PPA the high-resolution setting. We illustrate reconstructed samples for ten classes in Dpn = CelebA using GANs pre-trained on Daux -FFHQ. The target model is ResNet-15 8. (Best viewed with zoom.)
Recovered images
PPA
PAA
TAA
Figure 14: Visual comparison of inversion-time loss gradients for PPA in the high-resolution setting. illustrate reconstructed samples for ten classes in Prri = CclebA using GANs pre-trained trained on Daux FFHQ. The target model is DenseNet-121 121. (Best viewed with zoom.)
Recovered images
PPA
PAA
Man
Figure 15: Visual comparison of inversion- time loss gradients for PPA in the high-resolution setting. We illustrate reconstructed samples for classes in Dpri CelebA using GANs pre-trained D FFHQ. The target model is ResNeSt-50,, (Best viewed with zoom.)
34

---

GMI (LOMMA)
KEDMI (LOMMA)
PLG-MI
Figure 16: Visual of inversion -eese loss gradients for three attack methods in the low-resolution setting. The target model is FaceNet. (Best viewed with zoom.)
E,5 Visualization of Reconstructed Images
In this subsection, we present qualitative results of the baseline attack methods and our proposed
AlignMI approach. High-resolutinn reconstructions are shown Figs. and 18. Fig. 17 compares reconstructed samples from the first ten classes using 188, DenseNet-121, and ResNeSt-50 trained on CelebA, with GANs pre-trained on FFHQ. Fig. 18 provides similar results for the same target models trained on FaceScrub, also using FFHQ-pretrained GANs.
In low-resolution setting, we evaluate reconstruction quality by comparing samples from the first classes generated by GMI (LOMMA) and KEDMI (LOMMA) attack methods. These experiments employ VGG16 and FaceNet trained on CelebA as target models, with GANs pre-trained on both CelebA and FFHQ datasets, as shown in Figs. 19, and 20 respectively. Additionally, we present PLG-MI reconstructions FaceNet using GANs trained on FFHQ and FaceScrub datasets in Fig. 21.
35

---

Real
PPA
PAA
TAA
ResNet-18
PPA
PAA
TAA
DenseNet-122
PPA
PAA
TAA
ResNeSt-50
Figure 17: Visual comparison in high-resolutin settings. We illustrate reconstructed samples for the first ten classes in Ppri = CelebA using GANs pre-trained on Dau = FFHQ.
36

---

Real
PPA
PAA
TAA
ResNet-18
PPA
PAA
TAA
DenseNet-122 121
PPA
PAA
TAA
ResNeSt-50
Figure 18: Visual comparison in righ-resolution settings. We illustrate reconstructed samples for the first ten classes in DrI FaceScrub using GANs pre-trained Daux FFHQ.
37

---

GMI (LOMMA)
PAA
CelebA
TAA
KEDMI (LOMMA)
PAA
TAA
GMI
(LOMMA)
PAA
FFHQ
TAA
KEDMI (LOMMA)
PAA
TAA
Figure 19: Visual comparison in low-resolutions settings. We illustrate reconstructed samples for the first ten classes in pa = CelebA using GANs trained from scratch on 2 CelebA / FFHQ. The target model VGG16.
38

---

Real
GMI (LOMMA)
PAA
CelebA
TAA
KEDMI (LOMMA)
PAA
TAA
GMI
(LOMMA)
PAA
FFHQ
TAA
KEDMI (LOMMA)
PAA
TAA
Figure 20: Visual comparison in low-resolutions settings. We illustrate reconstructed samples for the first ten classes in pm = CelebA using GANs trained from scratch on D CelebA / FFHQ. The target model FaceNet.
39

---

Real
PLG-MI
FFHQ
PAA
TAA
PLG-MI
FaceScrub
PAA
TAA
Figure 21: Visual comparison in low-resolutions settings. We illustrate reconstructed samples for the first ten classes Pp CelebA using GANs trained from scratch Daux FFHQ FaceScrub. The target model is FaceNet.
40


Reviews:
[{"review_id": "JaSkeVqkKh", "reviewer": "Reviewer_Xy65", "summary": "This paper studies the problem of model inversion attacks (MIA). The authors find that the gradients of inversion loss are noisy and generative inversion implicitly denoises them by projecting onto the tangent space of data manifold. Since alignment of gradient and the tangent space makes models more vulnerable to MIA, the authors propose a training objective too promote it. They further propose a training-free approach to enhance gradient–manifold alignment during inversion.", "questions": "(derived from \"weaknesses\")\n1. Is it possible to show experiments from multiple runs for statistical significance?\n2. Why is the alignment phenomenon so specific to the MIA problem?\n3. Can there be data leakage from the use of VAE?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The hypothesis about alignment provides novel insights for the MIA problem. I believe it will be interesting to a large audience.\n- The hypothesis is validated by extensive experiments. The proposed method also consistently improve the performance.\n- The paper is well-written. The problem is well motivated. The methodology is clearly presented. The experiments are reproducible.\n\nWeaknesses:\n1. In checklist #7, the authors acknowledge the lack of statistical significance. Although they mentioned that this is due to computational cost, it may still reduce reliability. \n2. The intuition is not fully convincing. Why is the alignment phenomenon so specific to the MIA problem? It seems that in any tasks involving optimization over image space, having gradient along data manifold can be helpful.\n3. The use of VAE may be unfair. The method relies on a pretrained VAE to estimate the data manifold. Then, it means that there is already some understanding of the data before implementing the attack.", "was_revised": true, "final_justification": "I thank the authors for the rebuttal. I keep the original score since it is already positive.", "rebuttal": "Thank you for your thoughtful comments and generous support! We appreciate your recognition of our contributions and the strengths of the paper. Please see our detailed responses to your comments and suggestions below.\n\n> W1, Q1. Lack of multiple experimental runs to ensure statistical significance.\n\nThank you for pointing this out. To address this concern, we have conducted three independent runs (with different random seeds) of our key experiments in Table 2 to assess the consistency and statistical significance of our results. We report the mean and standard deviation of the results in the table below:\n\n\n|              |        | **CelebA**        |                   | **FaceScrub**     |                   |\n|--------------|--------|-------------------|-------------------|-------------------|-------------------|\n| **Target Model** | Method | Acc@1 $\\uparrow$  | KNN Dist $\\downarrow$ | Acc@1 $\\uparrow$  | KNN Dist $\\downarrow$ |\n| **ResNet‑18**    | PPA    | 86.04 $\\pm$ 0.04  | 0.6897 $\\pm$ 0.0002 | 81.86 $\\pm$ 0.35  | 0.7943 $\\pm$ 0.0024 |\n|              | + PAA (ours) | 88.69 $\\pm$ 0.28  | 0.6691 $\\pm$ 0.0011 | 83.98 $\\pm$ 0.22  | 0.7761 $\\pm$ 0.0025 |\n|              | + TAA (ours) | 90.17 $\\pm$ 1.15  | 0.6624 $\\pm$ 0.0001 | 93.46 $\\pm$ 0.30  | 0.6984 $\\pm$ 0.0071 |\n| **DenseNet‑121** | PPA    | 81.15 $\\pm$ 0.80  | 0.7148 $\\pm$ 0.0054 | 74.52 $\\pm$ 1.78  | 0.8007 $\\pm$ 0.0178 |\n|              | + PAA (ours) | 85.42 $\\pm$ 0.23  | 0.6870 $\\pm$ 0.0005 | 80.35 $\\pm$ 0.06  | 0.7363 $\\pm$ 0.0021 |\n|              | + TAA (ours) | 87.84 $\\pm$ 0.73  | 0.6832 $\\pm$ 0.0095 | 84.91 $\\pm$ 0.14  | 0.7287 $\\pm$ 0.0036 |\n| **ResNeSt‑50**   | PPA    | 71.16 $\\pm$ 0.10  | 0.7926 $\\pm$ 0.0004 | 71.62 $\\pm$ 0.20  | 0.8315 $\\pm$ 0.0002 |\n|              | + PAA (ours) | 76.08 $\\pm$ 0.17  | 0.7614 $\\pm$ 0.0012 | 73.52 $\\pm$ 0.55  | 0.8074 $\\pm$ 0.0042 |\n|              | + TAA (ours) | 78.07 $\\pm$ 1.41  | 0.7665 $\\pm$ 0.0120 | 84.10 $\\pm$ 0.04 | 0.7568 $\\pm$ 0.0005 |\n\n\n\nThese results confirm that our method consistently outperforms the baselines across runs, demonstrating the statistical robustness of our approach. We will include the updated results in the main results section (Section 6.3) of the final version of our paper to enhance the reliability of the proposed method.\n\n\n\n\n> W2, Q2. The intuition is not fully convincing ... having gradient along data manifold can be helpful.\n\nThank you for the thoughtful question. The motivation behind our work is grounded in the evolution of model inversion attacks (MIAs). The seminal work [r1] formulated MIAs as an input-space optimization problem. However, this traditional approach often produces noisy features, especially when the target DNNs are trained on high-dimensional data.\n\nTo address this, generative model inversion (GMI) approaches [r2] introduced image priors via pretrained generators (e.g., GANs), constraining the optimization to the generator’s latent space. This significantly improved visual quality and semantic relevance of reconstructed samples. These advancements naturally led us to ask: Why are GMI approaches so effective?\n\nThis question drove the analysis presented in Section 3. Our derivation shows that GMI methods implicitly denoise gradients by projecting them onto the generator’s manifold, thereby preserving only the gradient components aligned with the tangent space of the generator manifold and filtering out directions that deviate from it (Figure 2). Surprisingly, despite the effectiveness of GMI approaches, we found the degree of alignment between the gradients and the generator manifold to be **remarkably low** (Figure 3).\n\nThis observation led us to our core idea: can we explicitly **promote gradient–manifold alignment** to further improve inversion performance? To the best of our knowledge, this question has not been explored in prior work, and it forms one of the central contributions of our paper. Before proposing a new attack method, we rigorously validated our hypothesis that improving gradient–manifold alignment would boost inversion performance. This hypothesis is formalized in Section 4 and empirically validated in Section 6.2.\n\n\n> W3, Q3. The use of VAE may be unfair ... understanding of the data before implementing the attack.\n\nWe would like to clarify that the use of VAE is not **intended to facilitate the attack itself**, but rather to estimate the data manifold for validating our hypothesis. In this context, model inversion attacks are used as an **evaluation tool** to assess how different levels of gradient–manifold alignment impact a model’s inversion robustness. Therefore, the use of a pretrained VAE to estimate the data manifold is not meant to simulate a realistic attack scenario, but instead to **enable a principled evaluation** of the core hypothesis being examined.\n\n**We hope the clarifications provided have addressed your concerns and reinforced your confidence in our work. Please feel free to reach out if you have any further questions or require additional details.**\n\n---\n**References:**\n\n[r1] Fredrikson et al. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.\n\n[r2] Zhang et al. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020."}, {"review_id": "s776O5uiB5", "reviewer": "Reviewer_psS7", "summary": "This paper studies the problem of generative model inversion, which loosely consists of retrieving class-representative data samples from a trained classifier using a GAN model. First, the authors observe that during the model inversion phase, backpropagation of the inversion-time loss through the generator acts as a projection of the loss onto the tangent space of the manifold where the data distribution lies. However, they empirically observe that the loss gradients remain poorly aligned with the tangent space during model inversion, suggesting that the gradients are noisy and thus carry limited semantically meaningful information for guiding the inversion process. The authors hypothesize that models are more vulnerable to inversion attacks when their inversion-time loss gradients are well aligned with the data manifold. To test this hypothesis, they propose two methods to improve the manifold alignment of the loss gradients: (1) fine-tuning the models by adding a regularization term that promotes alignment with the manifold, and (2) averaging multiple gradients sampled from a small neighborhood during the inversion phase. Finally, the authors empirically validate their hypothesis with experiments using two standard classifiers on the CelebA dataset.", "questions": "- 1/ how do you explain the behavior of the VGG16 model in Figure 5?\n- 2/ Could a similar technique, based on your analysis, be developed to reduce the MIA vulnerability of models?", "limitations": "yes. However, please put this discussion on the limitations of the method in the main and not in the appendix.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "As someone not familiar with model inversion, I enjoyed reading this paper. The approach seems new as far as I can tell. \n\nStrengths:\n\n- The paper establishes a link with MIA vulnerability and loss gradient alignment with the data manifold\n- The authors have designed a training-free method to increase the manifold-alignment and the empirically show in Tab 2 that this method is effective to increase MIA vulnerability.\n\nWeaknesses: \n\n- Apparently, the method is limited to relatively low-dimensional setting due to its computational cost\n- In my opinion, the experiment section doesn’t completely validate the author’s hypothesis formulated in section 4. Indeed, the authors observe that the penalized training approach inevitably deteriorates the performances of the classifier, which has apparently itself an impact on MIA vulnerability. I’m therefore not sure that this approach can be used to rigorously validate the authors hypothesis.  At the opposite, the training-free approach seems to me to better validate the author’s hypothesis but it would have been nice to give also the evolution of the alignments scores because its not completely clear if this latter approach effectively improves the manifold-alignment scores since its mostly based on an intuition.", "was_revised": true, "final_justification": "Authors adressed my main concern (W2) and added a new experiments relatively to (Q2).", "rebuttal": "We sincerely thank you for your constructive comments and generous support! Please see our detailed responses to your comments and suggestions below.\n\n> W1. The method is limited to relatively low-dimensional setting due to its computational cost.\n\nThank you for the observation. The low-dimensional setting is used **only for hypothesis validation**, as computing and storing the decoder Jacobian at high resolution (e.g., 224×224×3) would be prohibitively expensive. Since the goal here is to validate the main hypothesis rather than implement a practical attack, experiments in low-dimensional settings are sufficient and appropriate for empirical analysis. Importantly, when evaluating the **AlignMI attack algorithm**, we conduct experiments in **both low- and high-resolution settings** to demonstrate its effectiveness in realistic scenarios.\n\n\n> W2.1. In my opinion, the experiment section doesn’t completely validate the author’s hypothesis formulated in section 4 ... I’m therefore not sure that this approach can be used to rigorously validate the authors hypothesis.\n\n> Q1. How do you explain the behavior of the VGG16 model in Figure 5?\n\nThank you for raising this important point. We agree that the interpretation of our hypothesis validation requires a nuanced understanding, and we would like to clarify our reasoning through a step-by-step analysis:\n\n**1. Increase in $AS_{tr}$ leads to decrease in test accuracy (Figure 4(a)):**\n\nIdeally, to rigorously test the hypothesis, we would compare models with varying training-time alignment scores ($AS_{tr}$) while keeping test accuracy constant. However, in practice, alignment-aware training **inevitably reduces test accuracy**. We hypothesize that this trade-off could stem from inherent limitations of modern deep neural network architectures or the inductive biases introduced by SGD optimization. A parallel example is **adversarial robustness training** [r1], which improves robustness but consistently compromises natural accuracy. \n\n**2. Lower test accuracy leads to reduced model inversion vulnerability:**\n\nPrevious work [r2] has shown that models with higher test accuracy tend to be more susceptible to generative MIAs, whereas those with lower test accuracy are typically more resistant. This is intuitively understandable—lower test accuracy implies weaker dependencies between input features and predictions, thus making it harder to infer input features from model outputs.\n\n**3. Interpreting Figure 5 (the inverted-U-shaped curve):**\n\nIf gradient–manifold alignment were entirely unrelated to model inversion vulnerability, one would expect a **monotonic decline** in attack accuracy with increasing $AS_{tr}$, due to the corresponding drop in test accuracy (as discussed in Point 1). However, Figure 5 reveals a **non-monotonic** trend—attack accuracy initially increases before eventually declining. This is because improvements in gradient–manifold alignment **create a new attack surface**, leading to **increased model inversion vulnerability**. At early stages, the benefits of improved alignment outweigh the negative impact of reduced test accuracy, hence attack accuracy rises. Beyond a certain point, however, adverse effects of declining test accuracy become dominant, and attack accuracy begins to decline. This trend holds consistently across both architectures we studied. Therefore, we can infer that, for models with comparable test accuracy, those with better gradient–manifold alignment are more vulnerable to MIAs, thus supporting our core hypothesis.\n\n\n> W2.2. At the opposite, the training-free approach seems to me to better validate the author’s hypothesis ... since it's mostly based on an intuition.\n\nThank you for this insightful observation. As you noted, the training-free approach is primarily grounded in geometric intuition, whereas the alignment-aware training provides a more principled way to validate the hypothesis, as discussed earlier.\n\nTo address your request for more concrete evidence, we note that our initial submission already included quantitative and qualitative evidence demonstrating that the training-free AlignMI approach indeed improves gradient–manifold alignment. Specifically, **Figure 12** in Appendix E.2  presents a comparison of the $AS_{tr}$ distributions between the baseline and both the PAA and TAA variants of AlignMI. The results clearly show that the AlignMI approach increases the alignment scores relative to the baseline. \n\nFurthermore, **Figures 13, 14, and 15** in Appendix E.4 visualize the loss gradients for both the baseline and AlignMI. These visualizations reveal that the gradients produced by AlignMI exhibit more semantically meaningful features, offering qualitative evidence that our approach enhances alignment between the loss gradients and the generator manifold.\n\n> Q2. Could a similar technique, based on your analysis, be developed to reduce the MIA vulnerability of models?\n\nWe appreciate your insightful question and your intuition is indeed correct. We investigated how reducing $AS_{tr}$ (i.e., gradient-manifold alignment) affects a model’s vulnerability to generative MIAs. As shown in the following table, decreasing this alignment consistently leads to lower attack success rates, indicating a reduction in vulnerability.\n\n\n| Target Model | Training Variant | $AS_{tr}$ | Test Acc $\\uparrow$ | Acc@1 $\\downarrow$ | KNN Dist $\\uparrow$ |\n|--------------|------------|-----------|----------|-------|-----------|\n| VGG16        | Model A    | 0.1655    | 93.00    | 88.83 | 1162.49   |\n|              | Model B    | 0.1034    | 92.97    | 85.06 | 1213.12   |\n|              | Model C    | 0.0470    | 93.75    | 75.56 | 1326.68   |\n| IR152        | Model A    | 0.2219    | 96.88    | 85.87 | 1300.92   |\n|              | Model B    | 0.1558    | 96.48    | 84.70 | 1320.47   |\n|              | Model C    | 0.1062    | 96.48    | 81.70 | 1350.10   |\n\nThese findings support the promising direction that techniques explicitly designed to reduce gradient–manifold alignment could be developed as effective defenses against generative MIAs. We view this as a compelling area for future work and appreciate your suggestion in helping shape that research direction.\n\n\n\n> Re: Discussion of Limitations.\n\nThank you for pointing this out. Due to space constraints in the initial submission, we included the discussion on the limitations of our method in the appendix. We agree that this discussion is important and will move it to the main text in the final version of the paper to ensure greater clarity and completeness.\n\n\n**We hope the clarifications provided have addressed your concerns and reinforced your confidence in our work. Please feel free to reach out if you have any further questions or require additional details.**\n\n\n---\n**References:**\n\n[r1] Fredrikson et al. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.\n\n[r2] Zhang et al. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020."}, {"review_id": "8MBKyINpxR", "reviewer": "Reviewer_WVQ7", "summary": "This paper presents an in-depth analysis of Model inversion attacks (MIAs), revealing that the input loss gradients involved in MIAs are often noisy and significantly misaligned with the underlying data manifold. The authors empirically demonstrate that when a model’s loss gradients are more aligned with the generator’s manifold, the model becomes more vulnerable to MIAs. Based on this insight, they propose AlignMI, a training-free method that enhances gradient-manifold alignment during the inversion process by explicitly projecting gradients onto the generator’s tangent space. Extensive experiments across diverse architectures validate the effectiveness of the proposed method.", "questions": "1. **Can you provide controlled experiments or causal analysis** to support the claim that gradient–manifold alignment directly leads to increased vulnerability to MIAs, beyond observed correlation?\n2. **Why is the explicit projection (GMP) necessary**, given that the backpropagation path through the generator already restricts updates to the manifold span? Under what conditions does GMP outperform the implicit projection already present in GMI?\n3. **Have you analyzed Jacobian degeneracy** in the generator across different latent regions? In cases where JG is rank-deficient, does the projection still help or even degrade the attack?", "limitations": "Please see my comments above.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "#### **Strengths**\n\n- The paper is well-written and easy to follow, with clear structure and logical progression.\n- The proposed method achieves consistent and interpretable improvements over prior baselines in the MIA literature.\n- The geometric perspective—analyzing the alignment between input gradients and the data manifold—is novel and intellectually stimulating.\n- The observation that the generator structure inherently suppresses non-semantic (\"off-manifold\") gradient directions is insightful and valuable.\n\n#### **Weaknesses**\n\n- **Lack of causal analysis between alignment and leakage**:\n  The central claim that \"better alignment between gradients and the data manifold leads to higher vulnerability to MIAs\" is only empirically correlated. No controlled experiments or ablation studies are provided to demonstrate a causal link.\n- **Unclear motivation for explicit projection in Section 5**:\n  In Section 3, it is claimed that the generator’s structure naturally imposes an implicit projection (e.g., $\\Delta x = J_G J_G^\\top \\nabla_x L$ . However, Section 5 adds an explicit projection step without fully explaining why it provides further benefit over the implicit process.\n- **No discussion of Jacobian degeneracy in practice**:\n  The generator Jacobian is assumed to be full-rank, but in complex generators like StyleGAN, the Jacobian may degrade or collapse in certain regions of the latent s", "was_revised": true, "final_justification": "I have read the rebuttal and the comments of the other reviewers. My final rating is accept.", "rebuttal": "Thank you for your constructive comments and generous support! Please see our detailed responses to your comments and suggestions below.\n\n> W1. Lack of causal analysis between alignment and leakage: The central claim that \"better alignment between gradients and the data manifold leads to higher vulnerability to MIAs\" is only empirically correlated. No controlled experiments or ablation studies are provided to demonstrate a causal link.\n\nThank you for your comment. We acknowledge the importance of establishing a causal relationship between gradient-manifold alignment and MIA vulnerability. In Section 6.2, we provide empirical validation of our hypothesis. The interpretation of our hypothesis validation requires a nuanced understanding, and we would like to clarify our reasoning through a step-by-step analysis:\n\n**1. Increase in $AS_{tr}$ leads to decrease in test accuracy (Figure 4(a)):**\n\nIdeally, to rigorously test the hypothesis, we would compare models with varying training-time alignment scores ($AS_{tr}$) while keeping test accuracy constant. However, in practice, alignment-aware training **inevitably reduces test accuracy**. We hypothesize that this trade-off could stem from inherent limitations of modern deep neural network architectures or the inductive biases introduced by SGD optimization. A parallel example is **adversarial robustness training** [r1], which improves robustness but consistently compromises natural accuracy. \n\n**2. Lower test accuracy leads to reduced model inversion vulnerability:**\n\nPrevious work [r2] has shown that models with higher test accuracy tend to be more susceptible to generative MIAs, whereas those with lower test accuracy are typically more resistant. This is intuitively understandable—lower test accuracy implies weaker dependencies between input features and predictions, thus making it harder to infer input features from model outputs.\n\n**3. Interpreting Figure 5 (the inverted‑U‑shaped curve):**\n\nIf gradient–manifold alignment were entirely unrelated to model inversion vulnerability, one would expect a **monotonic decline** in attack accuracy with increasing $AS_{tr}$, due to the corresponding drop in test accuracy (as discussed in Point 1). However, Figure 5 reveals a **non-monotonic** trend—attack accuracy initially increases before eventually declining. This is because improvements in gradient–manifold alignment **create a new attack surface**, leading to **increased model inversion vulnerability**. At early stages, the benefits of improved alignment outweigh the negative impact of reduced test accuracy, hence attack accuracy rises. Beyond a certain point, however, adverse effects of declining test accuracy become dominant, and attack accuracy begins to decline. This trend holds consistently across both architectures we studied. Therefore, we can infer that, for models with comparable test accuracy, those with better gradient–manifold alignment are more vulnerable to MIAs, thus supporting our core hypothesis.\n\n\n\nAdditionally, the effectiveness of AlignMI compared to the baseline further supports the hypothesis, as it explicitly promotes better alignment and improves inversion performance.\n\n\n> W2. Unclear motivation for explicit projection in Section 5.\n\nThank you for your comment. To clarify, we do not introduce an explicit projection operation in Section 5. Instead, we propose AlignMI, a method that constructs an alignment-enhanced loss gradient:\n$$\n\\widetilde{\\nabla}\\mathcal{L}(\\mathbf{x}) = \\mathbb{E}_{\\mathbf{x}'\\sim p(\\cdot\\mid \\mathbf{x})}\\bigl[\\nabla \\mathcal{L}(\\mathbf{x}')\\bigr]\n$$\n\nThis method is designed to better align with the generator manifold compared to the original loss gradient $\\nabla_{\\mathbf{x}} \\mathcal{L}$. Unlike implicit projection, which naturally arises from the generator's structure during optimization, AlignMI explicitly modifies the gradient to enhance this alignment and leverages it to boost the effectiveness of generative model inversion attacks. This design offers **a complementary benefit** to the implicit mechanism described in Section 3 by directly reinforcing alignment, rather than relying solely on the generator's inductive bias.\n\nWe support the AlignMI method with both quantitative and qualitative evidence: (1) Figure 12 (Appendix E.2) shows that AlignMI achieves higher alignment scores than the baseline. (2) Figures 13, 14, and 15 (Appendix E.4) visualize loss gradients and demonstrate that AlignMI produces gradients with more semantically meaningful features, indicating stronger alignment with the generator manifold.\n\n\n> W3. No discussion of Jacobian degeneracy in practice: The generator Jacobian is assumed to be full-rank, but in complex generators like StyleGAN, the Jacobian may degrade or collapse in certain regions of the latent space.\n\nThank you for raising this important point. We acknowledge that the analysis in Section 3 assumes the generator Jacobian $J_G$ is full-rank, which forms the basis for interpreting $Range(J_G)$ as the tangent space of the generator manifold. This assumption enables a clean and tractable theoretical framework for analyzing the alignment between gradients and the generator’s manifold.\n\nWhile Jacobian degeneracy is theoretically possible, the likelihood of such degeneracy is generally low in practice. This is primarily due to the dimensional disparity between the image space (e.g., 64×64×3 or 224×224×3) and the latent space (e.g., dimension 512), which reduces the risk of rank deficiency in the Jacobian.\n\n\nTo further investigate, we conducted a statistical analysis of the Jacobian’s rank during the inversion optimization process. Specifically, we employed singular value decomposition (SVD) to evaluate the smallest singular values of $J_G$, as a non-zero minimum singular value indicates full rank. We sampled **10,000 samples** during the optimization and report the distribution of the smallest singular values in the table below.\n\n\n| Smallest Singular Value Range | Percentage of Data Points (%) |\n|--------------------|-------------------------------|\n| 0.001 - 0.01       | 0.0%                          |\n| 0.01 - 0.1         | 99.3%                         |\n| 0.1 - 1            | 0.7%                          |\n\nThe results indicate that the generator Jacobian remains consistently full-rank throughout the inversion process, as evidenced by the strictly positive smallest singular values observed across all sampled instances. \n\n**We hope the clarifications provided have addressed your concerns and reinforced your confidence in our work. Please feel free to reach out if you have any further questions or require additional details.**\n\n---\n**References:**\n\n[r1] Fredrikson et al. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.\n\n[r2] Zhang et al. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020."}, {"review_id": "8a8By0qc9m", "reviewer": "Reviewer_6LmF", "summary": "This manuscript investigates generative model inversion attacks (MIAs), which aim to reconstruct class-representative samples from trained models. The authors analyze the mechanism of generative MIAs through a geometric lens, revealing that these attacks implicitly denoise inversion loss gradients by projecting them onto the tangent space of the generator manifold, thus preserving informative directions aligned with the data manifold. They hypothesize that models are more vulnerable to MIAs when their loss gradients align more closely with the generator manifold, validated by designing an alignment-aware training objective. Additionally, they introduce AlignMI, a training-free approach that enhances gradient-manifold alignment via perturbation-averaged (PAA) and transformation-averaged (TAA) strategies, outperforming state-of-the-art generative MIAs in experiments. Notable limitations include statistical imprecision in experiments, increased computational overhead, and potential discrepancies between estimated and real data manifolds.", "questions": "- The author's research subject in this manuscript is generative MIA. What is the difference between this and model inversion (such as psp, e4e, etc.)? Where is the specific manifestation of the attack? I hope the author can clarify these conceptual differences.\n\n- The datasets targeted by the author are all facial datasets, and most of them are cropped images. As is well known, the degree of restoration of the background area in image inversion is an indicator of the quality of inversion. However, I did not find any significant information from the results presented in this manuscript.\n\n- The manuscript did not report experimental error bars or confidence intervals, and only generated at least 100 samples through a single attack to reduce randomness. This approach cannot fully validate the reliability of the results, especially as there may be fluctuations in generalization across different models and datasets.\n\n- Only a few SOTA defenses such as BiDO and NegLS were compared, without covering emerging defense strategies such as adversarial training and gradient masking, which may not fully reflect the robustness of the method.", "limitations": "- The author claims that the method proposed in this manuscript is aimed at generative models. Generative models include generative flow, VAE, GAN, and diffusion models. Is the method of this manuscript applicable to all generative models?\n\n- Assuming that the attacker has white box access to the model (such as gradient information), but in black box scenarios (where only the model output can be observed), the effectiveness of methods such as AlignMI may be significantly reduced.\n\n- Generative MIA highly relies on the quality of pre trained GANs (such as StyleGAN). If the generator cannot capture key features of private data (such as specific poses and expressions), the inversion effect will be significantly reduced.\n\n- The projection operation in aligning training targets has extremely high computational costs in high-dimensional inputs or multi class scenes. Although upper bound optimization reduces overhead, it may still limit its application in large-scale tasks.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n\n- The proposed training objective promotes input gradient alignment with the data manifold (estimated via a pre-trained VAE), enhancing loss gradient informativeness during inversion. This approach validates that stronger alignment increases model vulnerability.\n\n- By averaging gradients from perturbed or transformed inputs, AlignMI suppresses off-manifold noise, yielding consistent improvements.\n\n**Weaknesses:**\n\nPlease see the details in Questions and Limitations.", "was_revised": true, "final_justification": "The authors should ensure consistency in hyperparameter settings across experiments to maintain fairness. However, this issue does not undermine the potential impact of the work in its field. Based on all the above comments and the authors’ responses, and from my experience, the intention to accept this paper outweighs the intention to reject it.", "rebuttal": "Thank you for your great comments and efforts in reviewing our paper. Please see our detailed responses to your comments and suggestions below.\n\n\n> Q1. What is the difference between this and model inversion (such as psp, e4e, etc.)? Where is the specific manifestation of the attack? \n\n\nThank you for your question. To clarify the distinction between **generative model inversion Attacks (MIA)** and model inversion methods such as **PSP** and **e4e**, we can identify several key differences in both their approaches and objectives.\n\n**MIA** is a category of **privacy attack** aimed at reconstructing representative samples by exploiting access to **only a well-trained model**. Early work [r1] framed MIAs as an input-space optimization problem, where the objective is to use gradient descent to find inputs that maximize the prediction score for a given target class.\n\n**Generative MIA** [r2] extends this framework by integrating generative models such as GANs to learn an image prior. This prior is used to constrain the inversion process to the latent space of the generator, significantly improving the visual quality and semantic relevance of the reconstructed samples, which enhances the effectiveness of model inversion attacks.\n\nIn contrast, **model inversion methods** like PSP and E4E focus on inverting a pre-trained generative model (e.g., StyleGAN) to generate latent representations or embeddings for **a given target image**. This enables tasks such as image manipulation and editing, where the goal is not necessarily to infer sensitive information but to alter or reconstruct the image from the latent representation.\n\nWe hope this clarifies the conceptual differences between these two approaches. Please let us know if further clarification is needed!\n\n> Q2. The datasets targeted by the author are all facial datasets ... in this manuscript.\n\n\nThank you for your question. We followed the common evaluation protocol established in prior MIA literature [r2-4], which predominantly uses facial datasets due to their relevance to real-world privacy concerns. These datasets reflect scenarios where the primary risk lies in revealing sensitive attributes such as facial features. As we clarified earlier, the goal of MIA is to reconstruct representative samples that reveal class-sensitive information. Consequently, the background area does not carry significant class-sensitive information, and therefore is less critical to the effectiveness of the inversion in our context.\n\n> Q3. The manuscript did not report experimental error bars or confidence intervals.\n\n\nThank you for pointing this out. To address this concern, we have conducted three independent runs (with different random seeds) of our key experiments in Table 2 to assess the consistency and statistical significance of our results. The averaged results and standard deviations are reported in the following table:\n\n\n|              |        | **CelebA**        |                   | **FaceScrub**     |                   |\n|--------------|--------|-------------------|-------------------|-------------------|-------------------|\n| **Target Model** | Method | Acc@1 $\\uparrow$  | KNN Dist $\\downarrow$ | Acc@1 $\\uparrow$  | KNN Dist $\\downarrow$ |\n| **ResNet‑18**    | PPA    | 86.04 $\\pm$ 0.04  | 0.6897 $\\pm$ 0.0002 | 81.86 $\\pm$ 0.35  | 0.7943 $\\pm$ 0.0024 |\n|              | + PAA (ours) | 88.69 $\\pm$ 0.28  | 0.6691 $\\pm$ 0.0011 | 83.98 $\\pm$ 0.22  | 0.7761 $\\pm$ 0.0025 |\n|              | + TAA (ours) | 90.17 $\\pm$ 1.15  | 0.6624 $\\pm$ 0.0001 | 93.46 $\\pm$ 0.30  | 0.6984 $\\pm$ 0.0071 |\n| **DenseNet‑121** | PPA    | 81.15 $\\pm$ 0.80  | 0.7148 $\\pm$ 0.0054 | 74.52 $\\pm$ 1.78  | 0.8007 $\\pm$ 0.0178 |\n|              | + PAA (ours) | 85.42 $\\pm$ 0.23  | 0.6870 $\\pm$ 0.0005 | 80.35 $\\pm$ 0.06  | 0.7363 $\\pm$ 0.0021 |\n|              | + TAA (ours) | 87.84 $\\pm$ 0.73  | 0.6832 $\\pm$ 0.0095 | 84.91 $\\pm$ 0.14  | 0.7287 $\\pm$ 0.0036 |\n| **ResNeSt‑50**   | PPA    | 71.16 $\\pm$ 0.10  | 0.7926 $\\pm$ 0.0004 | 71.62 $\\pm$ 0.20  | 0.8315 $\\pm$ 0.0002 |\n|              | + PAA (ours) | 76.08 $\\pm$ 0.17  | 0.7614 $\\pm$ 0.0012 | 73.52 $\\pm$ 0.55  | 0.8074 $\\pm$ 0.0042 |\n|              | + TAA (ours) | 78.07 $\\pm$ 1.41  | 0.7665 $\\pm$ 0.0120 | 84.10 $\\pm$ 0.04 | 0.7568 $\\pm$ 0.0005 |\n\n\n\nThese results confirm that our method consistently outperforms the baselines across runs, demonstrating statistical reliability. We will include the updated results in the main results section (Section 6.3) of the final version of our paper to enhance the reliability of the proposed method.\n\n\n\n> Q4. Only a few SOTA defenses such as BiDO and NegLS were compared ... the robustness of the method.\n\n\nThank you for your comment. We chose to evaluate with BiDO, NegLS, and TL-DMI because **they represent state-of-the-art defense mechanisms specifically designed to counter model inversion attacks**. However, as we understand it, adversarial training and gradient masking are primarily techniques designed to defend against adversarial attacks (please correct us if our understanding is incorrect), rather than directly addressing the unique vulnerabilities posed by MIAs. As a result, these methods fall outside the scope of our evaluation.\n\n\n> L1. Is the method of this manuscript applicable to all generative models?\n\n\nThank you for your question. The method proposed in this manuscript is applicable to **single-step generative models** such as generative flow, VAE, and GAN, where the generation process can be expressed as $\\mathbf{x}=G(\\mathbf{z})$ through a single forward pass of the generator. This structure enables direct computation of the Jacobian, allowing us to apply projection-based methods for analysis.\n\nHowever, for **diffusion models**, the sampling/generation process is iterative and involves denoising at each step, which makes it more complex and fundamentally different from single-step models. As a result, our projection-based method is not directly applicable to diffusion models.\n\n\n> L2. Re: Extending AlignMI to black-box settings.\n\n\nThank you for your comment. As stated in our problem setup (Section 2), our study focuses on the **white-box setting**, since AlignMI relies on inversion loss gradients to improve gradient–manifold alignment—this naturally requires access to the model's internal gradients.\n\nWe acknowledge that model inversion attacks have also been studied in black-box settings, where several works have proposed search-based methods in the latent space to approximate gradients using surrogate signals [r5-6]. While our method is not directly applicable in such scenarios, we believe **the core idea of promoting alignment between surrogate gradients and the data manifold** holds potential for generalization to the black-box setting. We view this as a promising direction for future research.\n\n> L3. Generative MIA highly relies on the quality of pre-trained GANs (such as StyleGAN) ... the inversion effect will be significantly reduced.\n\nThank you for your comment. The goal of MIA is to reconstruct representative samples that reveal class-sensitive information, and therefore specific poses and expressions may not be critical to our context. We acknowledge that the distributional gap between the generator and the private data can affect inversion quality [r7]. However, recent studies have shown that characteristic features of target classes can still be revealed even under large distributional shifts [r3]. Moreover, while this limitation exists, it primarily arises from the choice and quality of the generator itself. Addressing this issue **falls outside the scope of our work**, which focuses on enhancing inversion through gradient-manifold alignment.\n\n> L4. The projection operation in aligning ... it may still limit its application in large-scale tasks.\n\nThank you for your comment. Compared to the standard classification objective, the primary computational overhead of the gradient-manifold alignment training objective comes from the additional **single matrix-vector multiplication** required for the projection operation. However, this increase in computational cost is marginal relative to the overall time spent on training.\n\nTo further investigate this, we tested the gradient-manifold alignment training objective against the standard classification objective across three models. We conducted experiments over 30 epochs, with each experiment repeated three times. The results are as follows:\n\n\n| Target Model | $L_\\text{CE}$    | $L_\\text{Align}$    | Relative Increase |\n|:------------:|:------------------------:|:----------------------------:|:-------------------:|\n| **VGG16**    | 442.21 $\\pm$ 5.18      | 449.04 $\\pm$ 2.20          | 1.54 %              |\n| **FaceNet64**| 438.18 $\\pm$ 3.39      | 444.53 $\\pm$ 2.98         | 1.45 %              |\n| **IR152**    | 436.84 $\\pm$ 4.20      | 455.99 $\\pm$ 5.09         | 4.38 %              |\n\nThese findings suggest that while there is a slight increase in computational cost, it has **negligible impact** on overall training efficiency.\n\n**We hope our responses have clarified the confusion and addressed your concerns. We would greatly appreciate it if you could take them into consideration during your final evaluation of our work. Please let us know if you have any outstanding questions.**\n\n\n\n---\n**References:**\n\n[r1] Fredrikson et al. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.\n\n[r2] Zhang et al. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020.\n\n[r3] Struppek et al. Plug & play attacks: Towards robust and flexible model inversion attacks. In ICML, 2022.\n\n[r4] Peng et al. Pseudo-private data guided model inversion attacks. In NeurIPS, 2024.\n\n[r5] An et al. Mirror: Model inversion for deep learning network with high fidelity. In NDSS, 2022.\n\n[r6] Kahla et al. Label-only model inversion attacks via boundary repulsion. In CVPR, 2022."}]

Author rebuttal:

Meta-review: In this paper, the authors study Model Inversion Attacks (MIAs), where one seeks class-representative samples from a trained generative model, which poses potential privacy and security risks for trained models.  The authors make an original observation that MIAs implicitly denoises inversion loss gradients by projecting them onto the generators signal manifold.  As a result, they hypothesize that models are more vulnerable to MIAs when their loss gradients align with tangent spaces to the generative manifold.  This leads the authors to introduce an MIA that works by enhancing alignment with the gradient manifold. The resulting MIA outperforms state-of-the-art baselines.  The conclusions in the paper are original and provide conceptual understanding of ML systems that leads to new algorithmic approaches.  It is likely to be of interest to a broad community.
Decision: Accept (poster)