Visual Privacy Auditing with Diffusion Models
Authors: Kristian Schwethelm
Johannes Kaiser
Moritz Knolle
Sarah Lockfisch
Daniel Rueckert
Alexander Ziller
Venue: Accepted by TMLR ()

Abstract: Data reconstruction attacks on machine learning models pose a substantial threat to privacy, potentially leaking sensitive information. Although defending against such attacks using differential privacy (DP) provides theoretical guarantees, determining appropriate DP parameters remains challenging. Current formal guarantees on the success of data reconstruction suffer from overly stringent assumptions regarding adversary knowledge about the target data, particularly in the image domain, raising questions about their real-world applicability. In this work, we empirically investigate this discrepancy by introducing a reconstruction attack based on diffusion models (DMs) that only assumes adversary access to real-world image priors and specifically targets the DP defense. We find that (1) real-world data priors significantly influence reconstruction success, (2) current reconstruction bounds do not model the risk posed by data priors well, and (3) DMs can serve as heuristic auditing tools for visualizing privacy leakage.

Published in Transactions on Machine Learning Research (03/2025)
Visual Privacy Auditing with Diffusion Models
Kristian Schwethelm
A.schwcthhim@ttmm de
Chair for Al in Healthoure and Medicine, Technical University of Munich (TUM) and TUM University Hospital
Johannes Kaiser
johannes kaiser@tum.dee de Chair for Al in Healthoare and Medicine, Technical University of Munich (TUM) and TUM University Hospital
Moritz Knolle
moritz. Monitz.knolle@aarr de Chair for Al in Healthoare and Medicine, Technical University of Munich (TUM) and TUM University Hospital
Sarah Lockfisch
saruh.lockfisch de Chair for Al in Healthcare and Medicine, Technical University of Munich (TUM) and TUM University Hospital
Danicl Rüccert
de
Chair for Al in Healthcare and Medicine, Technical University of Munich (TUM) and TUM University Hospital Department of Computing, Imperial College London, UK
Munich Center for Machine Learning (MCML), Munich, Germany
Alexander Ziller
alez. www.erllllrmmmmmmm de Chair for AI in Healthoare and Medicine, Technical University of Munich (TUM) and TUM University Hospital
Reviewed on OpenReview: https: openreview. net/ forum? id= D3DA7pgpun
Abstract
Data reconstruction attacks on machine learning models pose a substantial threat pri- vacy, potentially leaking sensitive information. Although defending against such attacks using differential privacy (DP) provides theoretical guarantees, determining appropriate DP parameters remains challenging. Current formal guarantees the success of data recon- struction suffer from overly stringent assumptions regarding adversary knowledge about the target data, particularly in the image domain, raising questions about their real-world applicability. In this work, we empirically investigale this discrepancy by introducing a re- construction attack based on diffusion models (DMs) that only assumes adversary access to real-world image priors and specifically targets the DP defense. We find that (1) real-world data priors significantly influence reconstruction success, (2) current reconstruction bounds do not model the risk posed by data priors well, and (3) DMs can serve as heuristic auditing tools for visualizing privacy leakage.
1 Introduction
The widespread collection of sensitive data including personal identities, private locations, and medical conditions-har raised critical privacy concerns, particularly in machine learning (ML) where models leak private information from their training data. While differential privacy (DP) (Dwork & Roth 2014] has emerged as the gold standard for providing formal privacy guarantecs, the practical effectiveness of these guaranlees against real-world privacy atlacks remains uncertain, especially in data reconstruction scenarios where adversaries attempt to recover complete data records. This uncertainty poses a substantial challenge for practitioners facing privacy-utility trade-offs, as stronger privacy protections typically reduce model performance. To deploy DP techniques effectively, practitioners need clear understanding of how the mathematical privacy guarantees translate to practical protection of sensitive information.

---

Published in Transactions on Machine Learning Research (03/2025)
(3)
Denoised E1
Less private DP-SGD with E1
Eter
Etss -1
30
Input
(1) Gradient inversion
(2) Reverse Diffusion Process
(3) Denoised #2
More private DP-SGD with 62
Utsz
Utzz
TO
(1) Our reconstruction attack first extracts a noisy image from DP algorithm with privacy guarantec En using, 6.g., gradient inversion on DP-SGD. (2) Then, it employs DM for reconstruction by initiating its reverse diffusion process from specific intermediate state Lt,, (3) We demonstrate DMs strong utility for reconstruction and visual auditing, aiding communication with non-experts. In this exam- ple, it is possible to infer that é offers little privacy protection, allowing accurate reconstruction, while safeguards certain details but still allows disclosure of high-level personal attributes.
Figure 1:
Attempts to address this issue have led to the development of formal upper bounds on data reconstruction success under DP, aiming to enable practitioners to assess the effect of DP guarantees on the maximum fidelity achievable by an adversary's reconstruction attack. Central to such bounds are the formalized threat models, which define the capabilities of potential adversaries and the scenarios under which the bounds hold. Due to the complexity of mathematically formalizing practical scenarios, overly possimistic thrcat models that account for the most powerful (worst-case) attacks have been adopted (Balle et al., 2022 Guo et al.) 2022). Although these bounds offer generality and hold against, all possible attacks, they potentially overestimate the threat in real-world scenarios (Ziller et al.) 2024a).. For instance, while Hayes al. (2023) demonstrate the near-tightness of reconstruction robustness (ReRo) bounds (Balle et al. (0022), their analysis assumes a highly informed adversary with access to prior that includes the complete target record a scenario that is unlikely to occur in practice.
As a result, there is an ongoing effort formulate practical reconstruction bounds tailored to realistic attack scenarios. Ziller et al. (2024b) derive formal bounds on error measures for a specific reconstruction attack DP-SGD (Song al. 2013 Abadi et al., 2016) training, assuming uninformed adversary capable of selecting model architecture and lyperparameters but lacking prior knowledge about the data. However, this threat model may be overly optimistic in domains where data priors are common, particularly in the image domain, where the underlying structure and characteristics of the data are well understood. This raises critical questions: How do realistic data priors influence the effectiveness of data reconstruction attacks against differentially privale machine leurning, and can erisling reconstruction bounds capture these threats?
In this work, we empirically investigate the effectiveness of DP in defending against image reconstruction attacks that leverage wol-world data priors (i.e., domain-specific knowledge about the underlying data distribution). We compare our findings with the ical guarantees given by the (worst-case) ReRo bound (Hayes et al. 2023) and Ziller et al. (2024b). For our study, we extend a well-esta gradient attack method that involves adversarial modification of the model architecture an approach proven effective in, e.g., federated learning (Fowl et al.) 2022 Boenisch et al. 2023a] and backdooring pretrained models (Feng& & Trrmmr 2024) and incorporate image priors approximating the underlying data distribution of the reconstruction target.
Our attack extension builds upon principal finding: under DP-SGD, this gradient attack is equivalent to reconstructing an image perturbed with additive noise (Boenisch et al. 2023b Ziller et al. 2024b). We exploit this characteristic by leveraging strong image priors learned by diffusion models (DMs) (Ho et al.
2020 Dhariwal & Nichol 2021) to denoise the reconstructions (see Fig. Tb. This enables us to specifically target DP-SGD's reliance on noise perturbations and model adversarial access to real-world data priors.
Our findings reveal the substantial influence of data priors on reconstruction success, with their impact vary- ing depending on the strength of the prior (inherent distribution shift). We find that works reconstruction
2

---

Published in Transactions on Machine Learning Research (03/2025)
bounds do not model these observations well. Instead, they rely simplified assumptions not reflective of real-world scenarios. Beyond highlighting these theoretical limitations, we propose a practical application of our method: a visual auditing tool that complements formal DP guarantees, making privacy risks tangi- ble and interpretable for non-technical stakcholders. By bridging theoretical bounds and practical privacy evaluation, our work contributes to a better understanding of DP's real-world implications and highlights crucial directions for developing more realistic privacy guarantoes.
Our main contributions can be summarized follows:
We demonstrate that the efficacy of realistic reconstruction depends on the strength of the data prior, which not adequately represented by current theoretical bounds. This highlights a significant gap between theory and practice in privacy guarantees.
We introduce an image reconstruction attack leveraging diffusion models to model adversaries with realistic data priors. Our results reveal the significant threat such priors pose in disclosing private information under DP-SGD.
We empirically identify privacy parameters necessary to defend against our attack, and demonstrate its efficacy as a heuristic tool for visually auditing privacy risks.
2 Background and Related Work
2.1 Differential Privacy Guarantees
Differential privacy (DP) (Dwork & Roth 2014) is formal guarantee that provably bounds privacy leakage from computations datasets.
Definition 1. A randomized algorithm (mechanism) M satisfies (E, if, for any pairs of adjacent datascts D = D' that differ in a single sample and all sets of outcomes S S Range(M), it holds that:
Pr(M(D) E S) PT((' E +.
(1)
Intuitively, DP limits the influence of individual sample on the algorithm's outcome. In this work, we focus the Gaussian mechanism (GM), a standard DP mechanism often used in machine learning (ML). GMs introduce controlled randomization mask the contribution of sample through the addition of i.idd. Gaussian noise (N00, A30²1), where the variance of the noise is calibrated to the privacy guarantee using noise multiplier and the mechanism's global L-g-senittivity A₂ [Balle & Wang 2018
The standard DP threat model assumees an adversary with complete knowledge, except for the noise real- ization and whether D or D' was used compute the mechanism's outcome. The latter aspect naturally aligns DP with membership inference attacks, which aim to determine whether specific individual's data part of the dataset (Yeom et al. 2018).
The prevailing approach to implementing DP in ML is DP-Stochastic Gradient Descent (DP-SGD) (Song et al. 2013 Abadi et al. 2016), which limits the privacy leakage from training. DP-SGD is modified version of SGD that enforces an upper bound on scnsitivity A₂ = C by clipping per-sample gradients to an upper norm bound C and adding calibrated i.i.d. Gaussian noise N (00 CZ,"I).
Interpreting DP Guarantees. In DP, the level of privacy preservation provided by an algorithm is typically quantified using parameters such & and 5. However, more operationally interpretable way of quantifying privacy is by attributing practical risk against certain attacks under specific threat models. Recent work has advanced our understanding of practical DP effects through auditing techniques (Lokna et al. 2023 Nasr el al. 2023 Steinke et al. 2023 2022),, relaxed threat models (Nasr el al. 2021 Kaissis el al. 2023b Ziller et al.] 2024a), novel privacy attacks [Geiping et al. 2020 Boenisch et al, 2023a Feng & Tramèr, 2024), and deployment strategics (Ponomarova et al. 2023 Cummings et al. (024).. However, the impact of adversarial access to wal-world data priors on privacy risk remains largely unexplored. Furthermore, while membership inference attacks have been extensively studied, the threats posed by reconstruction
3

---

Published in Transactions on Machine Learning Research (03/2025)
attacks whichh aim to recover complete data records are less understood. Our work addresses these gaps by leveraging powerful data priors to evaluate reconstruction risks under DP, providing practitioners with empirical insights for navigating privacy-utility trade-offs.
2.2 Bounding Data Reconstruction Success
Data reconstruction attacks on ML models pose critical privacy risk by attempting to recover complete data records. While DP mechanisms primarily target membership inference protection, they inherently also defend against broader privacy breaches, including data reconstruction. However, in scenarios where membership information is considered insensitive or even public knowledge, practitioners might consider relaxing DP guaranlees to improve model utility. This has motivated several theoretical bounds reconstruction success (Guo et al. 2022 Stock et al. 2022 Balle et al. 2022 Ziller al. 2024b). Yet, these bounds may not fully capture the threat of practical attack scenarios, particularly when adversarios possess prior knowledge about the data. Our work complements these theoretical results by providing an empirical framework to assess reconstruction risks in practical settings.
Reconstruction Robustness (ReRo). ReRo (Balle et al. 2022 Hayes et al. 2023 Kaissis et al. 2023a provides a formal upper bound on the probability of a successful data reconstruction attack.
Definition 2. randomized algorithm (mechanism) M satisfies ReRoo if, for any reconstruction attack R on the algorithm's output w,, any dataset D_ U {z}, where z denotes the reconstruction target sampled from prior æ, fixed error function p, and baseline success probability (T,)(1), it holds that:
( S PINT, u.MMD R(w)) S 5n)= S
ReRo adopts the DP threat model with the slight modification that only fixed part of the dataset D_ is known to the adversary, while the added reconstruction target = is not. However, the adversary has some prior knowledge π about the target, which, informally, serves as a reference distribution for z.
Given the difficulty in determining p. 7, and π,, as well as approximating (1)) Hayes et al. (2023 in- troduced worst-case ReRo definition ((oR))) based on sample matching. Let p p= 1(2 7 R()), discrete set of n candidate samples 2n-1)- Then, the adversary's task reduces to re-identifying the target by matching the observation to the correct sample from the prior set, which results in simplified "reconstruction" setting, Despite its limitations, we use (0, ReRo as our theoretical baseline since it remains the only computation- ally viable implementation of ReRo. For clarity, we use RRRRo and ReRo interchangeably.
"1 O, (1) 1/n, and be uniform distribution (Ztarget; 21,.... 21,
Uninformed Data Reconstruction. Ziller et al. 2024b) introduced formal bounds on error metrics for a specific data reconstruction attack on DP-SGD training. They assume an uninformed adversary with no prior knowledge about the data but with the ability to observe gradient updates and modify the model architecture and training hyperparameters. By exploiting these capabilitics, they showed that a worst-case adversary can replace the architecture to maximize privacy vulnerabilities. Specifically, they reduce the model to a single fully connected layer without bias, where the output of the layer directly represents the loss: & = Wa, with W denoting the weights and æ the input data. This architecture allows direct reconstruction of the input by inverting the observed gradients Tree = sw x. However, the application of clipping and additive Gaussian noise on the gradients introduced by DP-SGD perturbs the reconstruction, leading to:
at
Preee max([|2l|2/C)) E, with N(0,C500T
Leveraging the closed-form solution of this uninformed reconstruction attack, Ziller al. formally analyze the reconstruction success and, e.g., bound the expected mean squared error (MSE): MSF(#, #rec) 2202.
4

---

Published in Transactions on Machine Learning Research (03/2025)
2.3 Diffusion Models (DMs)
Diffusion models, particularly the denoising diffusson probabilistic models (DDPMs) (Ho et al. 2020), have gained significant attention in recent years. DDPMs rely on a forward diffusion process that step-wise perturbs a signal (image) 2p ~ q(æo) with additive iid. Gaussian noise until the noise prodominates. Mathematically, the forward process is described by:
(4) where the noise schedule 3r E 1) controls both the variance of the noise and the factor reducing the signal at step t {1, ..... T). By defining a, 1- Br, a := II==1 axs and given the underlying Markov chain g(z1...., Frl 2D) = -I g x)-1), the noisy latent variables 2s can be conditioned on Vo:
Dt - VI BL.i-1 V with 6t-1 (O,,,),
zt Va.a0 + are, with No..
The reverse process, used for generating new signals, employs a neural network to approximate the intractable distribution q(x1-1/2; x2) and predict the sampled noise e. Given large number of steps T and schedules of 3,, ær converges to standard Gaussian. Thus, signal can be generated by initiating the reverse process with a standard Gaussian sample and iterative denoising.
Generative image denoising strategies leveraging diffusion models have demonstrated statc-of-the-art perceptual quality in natural (Xic et al. 2023: Pearl et al.) 2023 Yang al.) 2023) and medical imaging (Xiang et al., 2023b a Chung et al., 2023]. Notably, in the broader field of image restoration, diffusion models have also demonstrated efficacy in tasks like super-resolution, colorization, and inpainting (Li et al.] 2023). In contrast to these works, we do not aim to enhance im- age quality by removing some minor natural noise. Instead, we aim to recover privale information from deliberately perturbed images with subslantial noise scales introduced to provide DP guarantees.
Image Denoising with Diffusion Models.
Image Reconstruction with Diffusion Models. Concurrent work (Huang et al. 2024 Liu et al. 2025)
has also explored the use of DMs for maximizing atlack success in image reconstruction. However, our study adopts a broader approach by investigating how data priors influence these attacks in the context of DP. We also analyze how such attacks align with or challenge existing thcoretical reconstruction bounds, providing a deeper understanding of their implications for privacy guarantees.
3 Method
In this section, we present our methodology by formally intrring the problem and describing our approach to leveraging diffusion models (DMs) for image reconstruction.
3.1 Problem Definition
Threat Model. We study common attack scenario on DP-SGD training where an adversary can manip- ulate the model architecture, hyperparameters, and observe training gradients to reconstruct private images. Beyond these capabilities, assume the adversary has access to realistic image priors, í.e., statistical knowl- edge about natural image features (such as textures, edges, and color gradients) or domain-specific patterns (like facial features or medical imaging characteristics).
Base attack. Our work builds on the analytical attack introduced by Fowl et al. (2022), which enables near-perfect data reconstruction from training gradients by placing fully connected (imprint) layer at the model's front. For fully connected layer (y Wæ + b), where is the input, W denotes weight row, and b' bias parameter, the gradients of the loss L with respect to single row of weights and the bias are:
OC Oy'
ac
OC dy ac
W Oy W Oy x.
VbL=
(6)
Oy ay ay
5

---

Published in Transactions on Machine Learning Research (03/2025)
Element-wii wise division of these gradients Dy: 2 By x) perfectly recovers the input, showing that gradients can directly encode the training data. When applied to DP-SGD, this attack yields scaled, noisy version of the target image (see (Boenisch et al. 2023b Ziller et al. 2024b)). While the original attack results in noise from a ratio distribution due to the division of Gaussian random variables, Ziller et al. (2024b) show how to modify the allack to achieve Gaussian noise instead.
Oc
Adversarial Problem Statement. We consider a scenario where an adversary extracts perturbed image from a differentially private computation. In standard DP-SGD setting, this extraction can be achieved by either maliciously sctting batch size of 1 directly obtain per-sample gradients by applying common techniques to extract per-sample gradients from accumulated gradients (Fowl et al. 2022 Boenisch et al.
2023a b The privatized observation is represented as:
priv =
X x + &.
where À = max([]=]|2//,) denotes the clipping factor, x ~ q(x) denotes the original image sampled from data distribution q(x), and & is sampled from i.i.d. Gaussian noise N(0, CooT). The adversary's goal is to reconstruct the private information in æ from ppriv. Following the attack scenario described above, the reconstruction task reduces to a denoising problem. This formulation allows assess the practical privacy leakage and determine sufficient noise levels for protection.
3.2 Private Image Reconstruction with Diffusion Models
Diffusion models (DMs) learn powerful image priors that closely approximate complex data distributions by solving denoising tasks. Their ability to combine observed features with learned statistical patterns makes them highly effective at reconstructing corrupted information. Additionally, DMs can handle various noise levels without retraining, making them well-suited for our work, investigating the effectiveness of different noise perturbations. We leverage these strengths to develop reconstruction attack that exploits DP-SGD's reliance on noise-based privacy mechanisms.
Given the inverse problem in Eq. (7 we define the posterior over the obscrvation as q( Tpriv). Wo approximale this posterior using DMs and leverage their Markov chain initiate the reverse process from a conditional intermediate state ps ps( <peiv) instead of pure noise until the original image recovered, i.e., Ty The casiest choice to integrate Fpriv into the reverse process is adopting the Variance Exploding (VE) form of DMs (Song et al. 2021b):
27, 20 oLe, with N),,
with variance schedule {a and of + co. Notice that this formulation does not reduce the signal by Vo,, which is also the in Eq. 77. However, the VE form complicates hyperparameter tuning since standard DMs employ the Variance Preserving (VP) form, where vI Qq + (see Eq. 5)) To utilize the
VP form, we use the equivalence between the two forms Kawar et al. 2022 and define the starting point of the reverse process as follows:
1 (10=+ +
Baars
priv
(9)
V1+ o
where fstart denotes the starting step in the DM's noise schedule.
Handling the Clipping Factor X. An unknown parameler in Eq. (9 is the linear scalar À introduced by the clipping operation of DP-SGD, This parameter scales down the image, reducing its brightness and value range. In a realistic scenario, the exact value of À is unknown to the adversary. However, given that À represents single value and images are typically characterized by a constrained range of color values, the
Note that dı denotes the noise variance relative æo, which differs from & and on in the standard DM definition (see
Sec. 2.3 as well as from in DP (see Sec. 2.1

---

Published in Transactions on Machine Learning Research (03/2025)
adversary can easily approximate À through normalization trial-and-error (see Appendix Aj. Therefore, we assume the worst-case scenario, wherein the adversary successfully recovers the exact value of X.
We stress that knowing À comes with little advantage to the adversary, as it only enables them to rescale the image after perturbation, which increases the noise sample & by factor A. Thus, the tignal-tonoise ratio remains unchanged. Combining our assumption with Eq. ( yields:
A
Sstact
priv
(a xg)-
(10)
V + oa
V + oea
Markov Chain Matching. The Markov chain of (discrete) DMs is based on a pro-defined noise schedule {Be]==1 and, therefore, does not contain a slate for all possible noise variances. Thus, initiale the reverse process from perturbed image with variance 8² 220222, we must compute the variance schedule
(11)
IT (1 3e)
Oz
and search the next largest state latart under the condition tatart Ô.
Enforcing Data Consistency. The stochastic generative process of DMs introduccs randomness after each denoising step, increasing sample diversity. However, this is not desirable in reconstruction problems, where the results should closely resemble the original. Therefore, we enforce data consistency by adopting the deterministic generation process of denoising diffusson implicit models (DDIMs) (Song et al., 2021a), which has been shown retain image features throughout the generation process:
xt- vI 1/1--
a4 Eg
(x1()
Pt-1 Va-1
Vā
(12)
0:-1 cB (1)
(2:).
Data consistency can also be enforced by conditioning every step of the reverse process on Ppriv by, e.g., concatenating the low-quality sample to each latent state It, yiclding the posterior distribution po(x xpriv xz). However, our scenario considers extreme cases where the images are heavily perturbed. Conditioning with such low-quality images causes harmful effects on the generation of DMs (Li et al. 2023 Thus, we forgo such an approach.
Algorithm D summarizes method.
Algorithm 1: Private Image Reconstruction with DMs
Require: Epriv 1/Ax &, with & (0 C²o²1), noise schedule a; model 0
V 1-1
Variance schedule
2: Tpriv Axpriv
Rescaling
3: lstart = arg min - CoA) V o, CoA
b Markov chain matching
4: Diata V+o
Epriv
Reparameterivation
5: for = Istart...... do
b Step-wisc denoising
x: 11-v1--a a. (xe) vT a: 66 (xx),
#t-1 vār-1
/o:
7: end for

---

Published in Transactions on Machine Learning Research (03/2025)
10a
10a
10
101
10a
10a
10
10
MSE
10
10
10
10
10
10
10
10
10
10
0.8
0.8
0.8
L.IPS
0.6
0.6
0.6
0.4
0.4
0.4
0.2
0.2
0.2
0.8
0.8
0.8
SSIM
0.6
0.6
0.6
0.4
0.4
0.4
0.2
0.2
0.2
101
102
10
102
10a
10a
Jr C/o
11 == C=c
/ C/a
(a) CIFAR-10 (32 x 32)
(b) CelebA-HQ (256 x 256)
(c) ImageNet (256 256)
Figure 2: Average similarity of image reconstructions. We compute the similarity between the original and the reconstructed images from our DM attack (blue )), the attack of (Ziller et al.) 2024b) (red m), and the ReRo attack (Hayes al.) 2023 (green A). For μ 3, CelebA-HQ and ImageNet images exceed the maximal noise variance dy in the schedule; thus, results be given. The dashed line represents average similarity between test images, indicating at which point reconstructions become unrelated to the original.
4 Experiments
This section compares the data reconstruction success of prevailing theoretical reconstruction bounds and our practical attack leveraging image priors learned by diffusion models (DMs). Additionally, it investigates the effectiveness of using DMs to specifically target the DP-SGD defense in scenarios with limited target access and weaker attack assumptions. For experimental details and ablation experiments, refer to Appendices and respectively.
4.1 Experimental Setting
Our experimentation includes three datasots: CIFAR-10 (Krizhessky & Hinton 2009 CelebA-HQ Karras et al. 2018), and ImageNet-1IK (Deng et al. 2009), with the latter two resized to 256 256. For evaluation, we randomly seloct subsct of 5,000 test images from each dataset and quantitatively measure the reconstruction
success with mean squared error (MSE), VGG-based learned perceptual image patch similarity (LPIPS) (Simonyan & Zisserman, 2015 Zhang al. 2018), and structural similarity index measure (SSIM) (Wang ct al. 2004). We note that the employed DM's are not trained on test images.
We report results with respect to = C/a, where C denotes the clipping parameter and the noise multiplier of DP-SGD, can be interpreted as signal-to-noie ratio (SNR), where C bounds the signal amplitude and a represents the noise. Analogously the privacy parameter E, lower μ (SNR) makes reconstruction more difficult and, thus, corresponds to a higher privacy guarantee. We note that given specific DP-SGD configuration (number of steps and sampling rate), i can be converted to the (e, 8) notion (see Appendix
8

---

Published in Transactions on Machine Learning Research (03/2025)
Original μ 100 μ = 50
1 = 30
/ 20
p= 5
CIFAR- 10
CelebA-HQ
ImageNet
Figure 3: Reconstruction results under DP with respect to μ C/o. For each dataset, the reconstructed image from the base attack without prior knowledge (top) and our DM attack (bottom) are shown. The top images also represent the input of our attack.
4.2 Reconstruction Success under Different Data Priors
We evaluate privacy leakage under reconstruction attacks with varying levels prior knowledge about the target data. Our attack incorporates realistic priors learned by diffusion models that capture both general statistics of image features and domain-specifie patterns. We compare our approach against the (0, RRooo bound, which assumees access to the target image within prior set of 256 images (Hayes et al. 2023 and the bound of (Ziller et al. 2024b), which assunes prior knowledge.
The results in Fig. 2 show that our reconstruction error falls between the theoretical bounds:
higher than the ReRo bound but lower than Ziller et al.'s uninformed adversary bound? As expected, the ReRo bound is overly pessimistic, assuming powerful allacker achieving mostly perfect reconstructions an unrealistic scenario, especially for the challenging ImageNet dataset. Conversely, Ziller al. are too optimistic and undercstimate the thrcat of rcalistic attacker.
A crucial finding emerges when examining reconstruction performance across image scales: As image size increases, the gap between our and Ziller et al.'s results widens, revealing significant weakness in their method. Images with the same SNR show similar reconstruction difficulty, suggesting that image size should not substantially impact reconstruction success under constant μ. This aligns with both DP and ReRo, which depend on the SNR ratio C/a. The discrepancy with Ziller et al.'s fndings-where Co derived for specific error metrics indicates that directly bounding metrics with limited perceptual relevance may inadequately capture both reconstruction difficulty and actual privacy risk. This also highlights the challenge of formulating appropriate error function for ReRo that isn't based matching, as in (0, R)eRoo.
2In Fig. I.PIS and SSIM for Ziller et al.'s attack converge while the MSE does This discrepancy arises from limitations their method but from I.PIS and SSM,, which necessitate clipping color values between 0 and 1.
9

---

Published in Transactions on Machine Learning Research (03/2025)
Original
# = 200
μ = 150
μ = 100
11 = 50
/ = 30
μ = 20
=
=
Figure 4: Reconstruction results under distribution shift. The performance of the DM trained on CIFAR-10 and tested on CTFAR-100 (top), and the performance of the ImageNet DM on CelebA-HQ (middle) and CheXpert (bottom) are shown.
Regarding our reconstruction success, a "phase transition" becomes apparent. For μ S 5, the similarity of our reconstructions to the original converges to the average similarity of test images (dashed line in Fig. 2) indicating the diffusion model generates plausible but unrelated images from the learned distribution.
The qualitative results in Fig. 3 and Appendix D demonstrate the strong performance of our DM-based attack against the DP-SGD defense. While the base attack yields noisy images, the DM successfully recovers substantial original image content. Notably, we observe an additional phase transition at / 20, where reconstructed images start deviating from the original while still sharing similar high-level attributes such as dataset class, image color, or gender. Additionally, as observed in Fig. 2 for μ S 5, the reconstructions become unrelated to the original, indicating good privacy protection.
4.3 Reconstruction Success under Distribution Shift
Previously, we assumed the adversary has access to training data with the same underlying data distribution as the target. (test) data, which enables them to learn very strong data prior. To investigate how prior knowledge quality affects reconstruction success, we examine scenarios where the data prior does not stem from the same distribution, f.c., out-of-distribution prior, which is weaker than in-distribution priors. We perform this experiment in three settings: (1) The DM is trained on CIFAR-10 and is used to reconstruct test images from CIFAR-100 (Krizhevsky & Hinton 2009). These datasets are very similar, differing primarily in class number and diversity. (2) An ImageNet DM reconstruets CelebA-HQ face images, and (3) the ImageNet DM reconstructs grayscale chest X-ray images from the CheXpert dataset (Irvin et al. 2019 Intuitively, the greater the discrepancy between training and test data, the larger the distribution shift.
The results in Figs. and 5 show clear trend: larger distribution shifts (weaker data priors) lead to decreased reconstruction success. This is particularly evident from the shift in the privacy guarantee (μ- value) at which the similarity of the reconstructions surpasses the average similarity of the test datasets (dashed line in Fig. 5). Irrespective of the error function, this serves as a good indicator for less-than--sseff reconstructions, which are more similar to the training data than the target images.
Our findings demonstrate the significant impact of data distribution shift on the reconstruction performance of DMs, especially in high privacy regimes. However, our method yields reasonable reconstructions for low privacy guarantees even in scenarios with significant distribution shifts.
10

---

Published in Transactions on Machine Learning Research (03/2025)
1
0.8
0.8
LPIPS
0.6
LPIPS
0.6
0.4
0.2
0.2
0
10a
102
10a
102
# == C/o
/ #= c-o
Figure 5: Roconstruction success under distribu- tion shift. The performance of the DM trained on CIFAR-10 and tested CIFAR-100 (blue )), and the ImageNet DM tested on CelebA-HQ (green A) and CheXpert (red are shown. The dashed line represents average similarity bet ween test images of the datasets (same color). The results show the sig- nificant influence of distribution shift between the data prior and the reconstruction target.
Figure Reconstruction success estimated from av- erage similarity between multiple DDPM samples of CIFAR-10 (blue )) CelebA (green }), and Ima- geNet (red compared to the true succoss obtained by computing the average similarity between recon- st structions and the original images (dashed line). The closeness between same colored lines shows that the original image is not required to estimate the recon- struction success well.
4.4 Estimating Reconstruction Success without Target Access
DMs always generate & candidate reconstruction, even when the perturbed image lacks information for reconstruction. This implies that the resulting reconstructions may differ from the target images. While this is useful for data owners and practitioners who can directly compare the features of the reconstructions with the original images, adversaries lacking access to the original image (reconstruction target) may struggle to infer which features are made up by the DM.
We propose that adversaries can overcome this challenge by generating multiple candidate reconstructions using the probabilistic gencration process of, e.g., DDPMs and assess which features remain consistent across reconst.ruction.. Such features are most likely originate from the reconstruction larget. This is analogous to marinum posteriori attack, where the mode of the empirically generated images is computed.
Fig. D shows the average pairwise similarity between five DDPM generations from each of the 5,000 noisy images under different privacy levels, providing insights into estimating the reconstruction success using such
an approach. It shows that, for all datasets, the true reconstruction success (dashed lines in Fig. 6 can estimated well without access to the original image. Qualitative results in Supplementary Fig, 15 iluutrate the shared features among different generations. In our example, gender can be inferred until μ 5, and the hair color remains consistent until 20.
These findings highlight that visual insights from DMs' reconstructions hold value not only for data owners comparing reconstructions with the original images but also for adversaries who only have access to the noisy image and multiple generations.
4.5 Reconstruction Success under Weaker Attack Assumptions
While our previous experiments assumed idcal attack conditions to align with thcorctical bounds, we now evaluate our method's effectiveness in a practical training scenario where adversaries can only access accu- mulated mini-batch gradients rather than per-sample gradients. This setting aligns with real-world DP-SGD implementations and follows the attack methodology of Fowl et al. (2022). The key challenge lies in extracting individual sample information from aggregated gradients.
Our experimental setup employs mini-batches of size 64 and a ResNet-9 architecture (Klause et al. 2022) augmented with an imprint layer (Fowl al.) 2022). The imprint layer's parameters are carcfully tuned separate individual activations within the accumulated gradient using a binning technique (128 bins). For reconstruction, we process the binned weight and bias gradients according to Eq. ( instead of relying
11

---

Published in Transactions on Machine Learning Research (03/2025)
(a) Ground truth batch
(b) Reconstructed (no DP) (c) Reconstructed (DP) (d) DM reconstructed (DP)
Figure 7: Reconstruction results on ResNet-9 training using the attack of Fowl et al. 2022 under: (b) no privatization, (c) DP-SGD, and (d) DP-SGD including our DM attack strategy. DP-SGD applied with μ μ 1000. Cells are sorted by reconstructions success of (d). Emply cells (gray) indicate failed reconstructions, while green borders highlight successfully reconstructed images matching the original training data.
the clipping factor À approach used in prior experiments. This produces reconstructions with noise following a Gaussian ratio distribution, though the precise distribution may deviate due to the binning process.
Our attack pipeline consists of four key steps: (1) apply binning to separate individual contributions from the observed accumulated gradient, (2) divide weight and bias gradients for each bin to yield the (perturbed) reconstruction, (3) determine the reverse diffusion starting point lstart by estimating the noise variance using scikit-image, and (4) apply our DM reconstruction method to each bin. This approach enables simultancous recovery of all images in the batch from a single accumulated gradient.
Results in Fig. 7 remonstrate the effectiveness of our altack under these non-ideal conditions. Without DP, most images are reconstructed with high fidelity (Fig, 7b). While DP-SGD protection initially reduces most bins noise patterns (Fig. 7c our DM-based method successfully recovers many recognizable features from these protected versions (Fig. 7d.. This strongly supports the effectiveness of data priors reducing DP's effects. Finally, it is important to note that j can be significantly larger in this scenario due to other non-zero gradients in the ResNet architecture that are not used for reconstruction but add to the gradient norm. This effect decreases the signal for the relevant gradients while the noise scale remains constant, further challenging the reconstruction process.
5 Discussion
Our investigation into real-world data priors reveals significant gap between theoretical reconstruction bounds and empirical attack outcomes. We demonstrate that the strength of the data prior substantially influences the reconstruction success, positioning our attack between existing bounds. This finding highlights both the importance and challenge of incorporating realistic data priors into formal privacy guarantees.
While our work primarily provides empirical evidence of enhanced reconstruction capabilities through diffu- sion models (DMs), establishing theoretical bounds for reconstruction attacks under such data priors remains an open challenge. The key difficulty lies capturing the semanttcs of learned represent atons and their re- lationship to the private training data in a formal framework. While thrcat models assuming no prior (Ziller et al. 2024b) remain valuable where priors are unavailable, incorporating prior knowledge could substantially improve bound accuracy. We also recognize the flexibility of the ReRo bound in formalizing different data priors. Nevertheless, addressing challenges related to defining an appropriate prior æ and error functions p will be crucial for its effective implementation. The development of theoretical foundations for realistic data priors, such as those learned by DMs, represents an important direction for future research.
Furthermore, we find that DMs excel at extracting information from hcavily perturbed images beyond human visual capabilities. Our method substantially improves the reconstruction outcomes of previous methods Fowl et. al. 2022: Boenisch et al. 2023b Ziller et al.] 2024bb with simple post-processing step. Given the
12

---

Published in Transactions on Machine Learning Research (03/2025)
widespread availability of pre-trained DMs across various data distributions, it is reasonable to assume that adversaries can profit from their capabilities. This accessibility broadens the scope of potential adversaries who could utilize such techniques, emphasizing the urgency for robust defenses to counter such threats.
However, this same capability presents an opportuniyy: DMs can serve as powerful tools for visualizing reconstruction risk privacy audits. Our reconstructions effectively capture the residual information after privatization, offering intuitive insights into privacy leakage that complement formal DP guarantees. Un- like abstract privacy parameters that are challenging to interpret for non-experts (Cummings et al. 2024 our approach offers tangible means of visualizing privacy leakage, thereby facilitating communication with stakcholders and enhancing their comprehension of privacy in machine lcarning. For instance, when re- constructions preserve class information while altering low-level features, it suggests that low-level features are privatized, whereas the class information can be disclosed (Sec. 4.4). This practical approach to privacy auditing aligns with recent developments in heuristic auditing methods (Steinke et al. 2024). We emphasize, however, that our method is intended as a communication tool and does not provide theorctical guarantees.
Finally, since DP ensures consistent mathematical privacy guarantees regardless of prior knowledge even under ideal priors mechanisms like DP-SGD may be excessive. We demonstrate that prior-basee post-processing of privatized gradients can increase the utility of data reconstruction attacks. The same approach can be used to get improved model utility in DP-SGD) training by post- pros-ppoosssing gradients before the model update, while obtaining the same mathemaiical guarantee. This insight aligns with recent advances in gradient denoising techniques Nasr et al. 2020
findings suggest an interesting practical consideration: the standard noise levels in
Zhang et al. 2024), suggesting promising directions for future research.
6 Conclusion
Our work empirically shows the critical role of data priors in reconstruction attacks, revealing limitations in current theoretical bounds. This gap between theory and practice highlights the need for reconstruction bounds that better capture real-world adversarial capabilities. We show both the threat and utility of DMs in privacy contexts: while they enhance reconstruction attacks, they also enable intuitive privacy auditing that bridges the gap between theoretical guarantees and practical understanding. Future work should focus on developing more adaptive privacy metrics and defenses that can address realistic capabilities adversaries.
Broader Impact Statement
This work proposes a data reconstruction attack capable of disclosing sensitive information from real-world ML models. While our method can be used maliciously, we use to highlight how to defend against data reconstruction attacks using privacy methods like DP and how attack can be utilized as tool for non-experts to select sufficient privacy guarantees. Furthermore, we only utilize publicly available images, thereby not exposing data that is not already available.
Acknowledgments
KS and DR received support from the Bavarian Collaborative Research Project PRIPREKI of the Free State of Bavaria Funding Programme " "Artificial Intelligence Data Science".
AZ and DR received support from the German Ministry of Education and Research and the Medical Infor- matics Initiative part of the PrivateAIM Project (grant no. 01ZZ2316C).
JK received support from the European Union under Grant Agreement 101100633 (EUCAIM). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.
MK was supported by the DAAD programme Konrad Zuse Schools of Excellence in Artificial Intelligence, sponsored by the Federal Ministry of Education and Research.
13

---

Published in Transactions on Machine Learning Research (03/2025)
SL received support from the Research and Development Program Information and Communication Tech- nology Bavaria, DIK0444/03.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Πya Mironov, Kunal Talwar, and Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Confer- ence on Computer and Communicatioos Security, CCS '16, pp. 308 318, New York, NY, USA, 2016. Association for Computing Machinery. ISBN 9781450341394. doi: 10.1145/29777492277888 URL
https://doi.org: org.:....rrg// 1ttp:/...114//99111 11t./197///979999 2978318
Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference Machine Learning, 2018. URL https:
//api. semanticscholaat .rgg/CorpusD::21711000
Borja Balle, Giovanni Cherubin, and Jamie Hayes. Reconstructing training data with informed adversaries. In 2022 IEEE Symposium on Security and Privacy (SP), pp. doi:
IEEE Computer Society, 2022,
URL https::/ddo www.coopptteesssceeetcooooo 1tt.///0...00/9446211.
2022. 9833677
Leonard Berrada, Soham De, Judy Hanwen Shen, Jamie Hayes, Robert Stanforth, David Stutz, Pushmeet Kohli, Samuel L. Smith, and Borja Balle. Unlocking accuracy and fairness in differentially private image classification, 2023.
F. Boenisch, A. Dziedzic, R. Schuster, A. Shahin Shamsabadi, I. Shumailov, and N. Papernot. When the curious abandon honesty: Federated learning is not private. In 2023 IEFE 8th European Symposium Security and Privacy (EuroStaapp:P), pp. 175-199, Los Alamitos, CA, USA, jul 2023a. IEEE Com- puter Society. doi: 10. 10.1109/ SuuroSP57114.2223000000 URL https://doi. http://dw..eeecomuuuurrrrccccoyt 10. 1109/BuroSP5714. 2023.00000
Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Thi.. Shumailov, and Nicolas Papernot. Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroSBP), pp. 241-2511 2023b. doi: 10.1109 Fw/.F/SSSSS77722222.....
S.G. Chang, Bin Yu, and M. Vetterli. Adaptive wavelet thresholding for image denoising and compression. IEEE Transactions on Image Processing. (9):15522-1546 2000. doi: 10.1109 11.009/83..66 83.662633.
Hyungjin Chung, Eun Sun Lee, and Jong Chul Ye. Mr image demoising and super-resolution using regularized reverse diffusion. IEEE Transactions on Medical Imaging, 42(4):922 934, 2023. doi: 202222...... 3220681.
Rachel Cummings, Damien Desfontaines, David Evans, Roxana Geambasu, Yangsibo Huang, Matthew Jagielski, Peter Kairouz, Gautam Kamath, Sewoong Oh, Olga Ohrimenko, Nicolas Papernot, Ryan Rogers, Milan Shen, Shuang Song, Weijie Su, Andreas Terzis, Abhradeep Thakurta, Sergei Vassilvitskii, Yu-Xiang Wang, Li Xiong, Sergey Yekhanin, Da Yu, Huanyu Zhang, and Wanrong Zhang. Advancing Differential Privacy: Where We Are Now and Future Directions for Real-World Deployment. Harvard Data Science Review, jan 16 2024. https:/ /ddrr
http:////ddr.mmppesssssss wwtmmiiss.ssiiiimmmm hatt.edd//uu//llweeeee
Kostadin Dabov, Alessandro Foi, Vladimir Katkovník, and Karen Egiazarian. Image denoising by sparse 3-d transform-domain collaborative filtering. IEEE Transactions on Image Processing, 16(8):2080 2095, 2007. doi: 10.1109/TTI (TT00//TPP0007912222230
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEEE Conference on Computer Vision and Pottern Recognition, pp. 248-255, 2009. doi: 10.109/CVPP..000556662
14

---

Published in Transactions on Machine Learning Research (03/2025)
Prafulla Dhariwal and Alexander Quimn Nichol. Diffusion models beat GANs image synthesis. In A. Beygekimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Informa- tion Processing Systems, 2021. URL
David L Donoho and lain M Johnstone. Ideal spatial adaptation by wavelet shrinkage. Biometrika, 81(3): 425-455, 09 1994. ISSN 0006-3444. doi: 10.1093/biomn biomct/81.3.422 URL https:///oi. http:///oo.oogg/...oo otg//0.1093,
biomet/81.33 3.45
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sei., 933-4):211-07, aug 2014. ISSN 1551-305X. doi: 00.1561/4400000422 URL https:
//doi.org// 10. 1561/0400000042
Shanglun Feng and Florian Tramèr. Privacy backdoors: Stealing dala with corrupted pretrained models. In Forty-first International Conference on Machine Learning, 2024. URL http::////ppeeeeeeeeeeeeeeeeeeee
1d=7yixJXm2b8
Liam H Fowl, Jonas Geiping, Wojciech Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed:
Directly obtaining private data in federated learning with modified models. In International Conference on Learning Representations, 2022. URL https://openreviien nett/Eoruum?dd-ffvugooooo.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it to break privacy in federated learning? In H. Larochelle, M. Ranzalo, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 16987-169477, Cur- ran Associates, Inc., 2020. URL https://proceeddngg iee.rrerrengg.n.urrrrppsr wwurips.cc/papen... ec/paper / (44de66bbd988819a0 10220260061100000222 141e:efff44-5PP 45-----r- pdff
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential pri- vacy. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vanghan (eds.), Advances in Neural Information Processing Systems, volume 34, pp. 11631-11642, Curran Associates, Inc., 2021. URL https::/prooeddngs..nntt wwweurps..cppappeee httpppppprffa_ppappeleree filesspappr/2021/E12 6097d8f37142057 4001340000001111644442422
pdf
Chuan Guo, Brian Karrer, Kamalika Chaudhuri, and Laurens van der Maaten. Bounding training data reconstruction in private (deep) learning. In Kamalika Chaudhuri, Stefanic Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato (eds.), Proceedings of the 39th International Conference on Ma- chine Learning, volume 162 of Proceedings of Machine Learning Research, pp. 8056 8071. PMLR, 17 23 Jul 2022. URL attps://procceedings mlr. press/v1622/uu22c.hhot html
Jamie Hayes, Borja Balle, and Saced Mahloujifar. Bounding training data reconstruction in DP-SGD. In Seirth-seventh Conference on Newral Information Processing Systems, 2023. URL https::/
aet/forumi1d=77/4ZZZZZ
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS'17, pp. 6629 6640, Red Hook, NY, USA, 2017. Curran Associates Inc. ISBN 9781510860964.
Jonathan Ho, Ajay Jain, and Picter Abbcol. Denoising diffusion probabilistic models. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS'20, Red Hook, NY, USA, 2020. Curran Associates Tne. ISBN 9781713829546.
Tao Huang, Jiayang Meng, Hong Chen, Guolong Zheng, Xu Yang, Xun Yi, and Hua Wang. Gradient-guided conditional diffusion models for private image reconstruction: Analyzing ad adversarial impacts of differential privacy and denoising, 2024. URL https:
0330333311
Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ileus, Chris Chute, Henrik Mark- lund, Behzad Haghgoo, Robyn Ball, Katic Shpanskaya, Jayne Sockins, David A. Mong, Safwan Halabi, Jesse K. Sandberg, Ricky Jones, David B. Larson, Curtis P. Langlotz, Bhavik N. Patel, Matthew P. Lun- gren, and Andrew Y. Ng. Chexpert: A large chest radiograph dataset with uncertainty labels and expert
15

---

Published in Transactions on Machine Learning Research (03/2025)
comparison. Proceedings of the AAAI Conference Artificial Intellignne 33(01) Jul. 2019. doi: 00.1609/anai.v3330111 590. URL httpp:://jss.aee aaai. www.....g/.ia..../.aaaaaaaa/aae. http://www.///../aatttttaaaaa//a
Georgios Kaissis, Jamie Hayes, Alexander Ziller, and Daniel Rueckert. Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy, 2023a.
Georgios Kaissis, Alexander Ziller, Stefan Kolek, Anneliese Riess, and Daniel Rueckert. Optimal privacy guarantees for relaxed threat model: Addressing sub-optimal adversaries in differentially private machine learning. In Thirly--eventh Conference Neural Information Processing Systems, 2023b. URL https: //openreview.o wwt.:/oooumiddddBSSsiii.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. In International Conference on Learning Representations, 2018. URL
https://openrrevev... wttp://eeeteoooorrrdddddaaaaaee
Bahjat Kawar, Michael Flad, Stefano Ermon, and Jiaming Song. Denoising diffusion restoration ion models. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Newral Informa- tion Processing Systems, 2022. URL https:// wwt wett/oormm?ddkkkkootttttt
Helena Klause, Alexander Ziller, Daniel Rucckert, Kerstin Hammernik, and Georgios Kaissis. Differentially private training of residual networks with scale normalisation, 2022.
Alex Krizhevsky and GeolTrey Hinton. Learning multiple layers of features from tiny images. Technical Report 0, University of Toronto, Toronto, Ontario, 2009. URL https://www: cs. toronto..oo...ooo toronto..ed/--2r12..
Xin Li, Yulin Ren, Xin Jin, Cuiling Lan, Xingrui Wang, Wenjun Zeng, Xinchao Wang, and Zhibo Chen. Diffusion models for image restoration and enhancement a comprehensive survey, 2023.
Xuan Liu, Siqi Cai, Qihua Zhou, Song Guo, Ruibin Li, and Kaiwei Lin. Mjolnir: Breaking the shield of perturbation-protecti gradients via adaptive diffusion, 2025. URL htttts://///tttt/ http:///xaxxv..o/aaabb 05285
Johan Lokna, Anouk Paradis, Dimitar I Dimitrov, and Martin Vechev. Group and attack: Auditing differ- ential privacy. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Securily, 2023.
Tlya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263 275, 2017. doi: 10.1109 /C////FF.2000 2017.11.
Milad Nasr, Reza Shokri, and Amir hounansadr. Improving deep learning with differential privacy using gradient encoding and denoising, 2020.
Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlini. Adversary instan- tiation: Lower bounds for differentially private machine learning. In 2021 TEFE Symposium on Security and Privacy (SP), pp. 866-882. IEEE Computer Society, 2021. doi: 10.1109/SP40001.0 2000000..0..00069.. URL
Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramer, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis. Tight auditing of differentially private machine learning. In Proceedings of the 32nd USENIX Conference Security Symposium, SEC '23, USA, 2023. USENIX Association. ISBN 978-1- 939133-37-3.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Yang, Zach DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjic Bai, and Soumith Chintala. PyTorch: an òmperative style, high-performane deep learning library. Curran Associates Inc., Red Hook, NY, USA, 2019.
16

---

Published in Transactions on Machine Learning Research (03/2025)
Naama Pearl, Yaron Brodsky, Dana Berman, Assaf Zomet, Alex Rav Acha, Daniel Cohen- Or, and Dani Lischinski. Svnr: Spatially-variant noise removal with denoising diffusion, 2023.
Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H. Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Rescarch, 77:1113-1200 July 2023. ISSN 1076-9757. doi: 10.1613/jairr1.11
URL http:://tt.ddi..ooo.....1... 16t3///ar..13///arrrrr 1. 14649
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Nassir Navab, Joachim Hornegger, William M. Wells, and Alejandro F. Frangi (eds.); Medical Image Computing and Computer-Assister Intervention MICCAI 2015, pp. 234-241, Cham, 2015. Springer International Publishing, ISBN 978-3-319-2457444
Tim Salimans, Andrej Karpathy, Xi Chen, and Diederik P. Kingma. PixcICNN++: Improving the pixcl- CNN with discretized logistic mixture likelihood and other modifications, In International Conference on Learning Represenlations, 2017. URL
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Con- http://wwwweeeere/r//e/eaaaaaaaa
ference on Learning Representations, 2021a. URL
Shuang Song, Kamalika Chaudhuri, and Anand D. Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference Signal and Information Processing, pp. 245-248, 2013. doi: 10. /GlobalSTP.0013677735
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021b. URL http:////ppeeeeeeeeee.aerrrtttrp
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. In Thirty- seventh Conference on Neural Information Processing Systems, 2023. URL https: net/
formm?id=f3EV2111B
Thomas Steinke, Milad Nasr, Arun Ganesh, Borja Balle, Christopher A. Choquette-Choo, Matthew Jagielski, Jamie Hayes, Abhradeep Guha Thakurta, Adam Smith, and Andreas Terzis. The last iterate advantage: Empirical auditing and principled heuristic analysis of differentially private sgd, 2024. URL https:
/arxxv. wwt.:/org/ab/////111 absp/aas/....// http://41..001110 06186
Pierre Stock, Igor Shilov, Ilya Mironov, and Alexandre Sablayrolles. Defending against reconstruction attacks with rényi differential privacy, 2022.
Stéfan van der Walt, Johannes L. Schönberger, Juan Nunez-Iglesias, François Boulogne, Joshua D. Warner, Neil Yager, Emmanuelle Gouillart, Tony Yu, and the scikit-inage contributors. scikil-image: image processing in Python. PeerJ, 2:e453, 6 2014. ISSN 2167-8359, doi: 10.7717/peeej.453. URL https:
//doi.org/1e 100gg/10.000 www.o//////../////../// 7w1.7//777........ .453 .453
Patrick von Platen, Suraj Patil, Anton Lozhkov, Pedro Cuenca, Nathan Lambert, Kashif Rasul, Mishig Davaadorj, and Thomas Wolf. Diffusers: State-of-the-arl diflusion models. httpp://giithb... com/
Siggingface/diffuseen 2022.
Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4):600 612, 2004. doi: 10.1109/TIP. 2003.819861.
Tiange Xiang, Mahmut Yurt, Ali B Syed, Kawin Setsompop, and Akshay Chaudhari. DDMS Self- supervised diffusion MRI denoising with generative diffusion models. In The Eleventh International Con- ference on Learning Represenlations 2023a. URL http:///pppaeeeeee.eeee///otrrrn
17

---

Published in Transactions on Machine Learning Research (03/2025)
Tianqi Xiang, Wenjun Yue, Yiqun Lin, Jiewen Yang. Zhenkun Wang, and Xiaomeng Li. Diffemr: Fast cardiac mri reconstruction with diffusion probabilistic models, 2023b.
Yutong Xie, Minne Yuan, Bin Dong, and Quanzheng Li. Diffusion model for generative image denoising, 2023.
Cheng Yang, Lijing Liang, and Zhixun Su. Real-world denoising via diffusion model, 2023.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyz- ing the connection to overfitting In 2018 TEEE 31st Computer Security Foundations Symposium (CSF), pp. 268 282, 2018. doi: 10.1109/CSF 2018.00027.
R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features perceptual metric. In 2018 IEEE/CVE Conference Computer Vision and Pattern Recognition (CVPR), pp. 586 595, Los Alamitos, CA, USA, jun 2018. IEEE Computer Society. doi: 2018.00068. URL
13460 Xinwei Zhang, Zhiqi Bu, Mingyi Hong, and Meisam Razaviyayn. Doppler: Differentially private optimizers with low-pass filter for privacy noise reduction, 2024. URL 1199/CVPR.2018.00006
Alexander Ziller, Tamara T. Mueller, Simon Stieger, Leonhard F. Feiner, Johannes Brandt, Rickmer Braren, Daniel Rueckert, and Georgios Kaissis. Reconciling privacy and accuracy ai for medical imaging. Nature Machine Intelligence, 6(7):764-77) 774, 2024a.
Alexander Ziller, Anneliese Riess, Kristian Schwethelm, Tamara T. Mueller, Daniel Rueckert, and Georgios Kaissis. Bounding reconstruction attack success of adversaries without data priors, 2024b.
18

---

Published in Transactions on Machine Learning Research (03/2025)
A Approximating the Clipping Factor X
Recall our assumption that the adversary has knowledge about the exact value of the clipping factor À = max(||=|e//,,) in Eq. 7 In this section, we demonstrate the simplicity of yielding a good approximation of using trial-and-error.
As an example, we take an image from the CIFAR-10 dataset and assume DP-SGD practice (Ponomareva et al., 2023 and p = C/o = 30. The example image has a L2-norm of | 27.24, thus, it will be clipped and À | 27.24.
(a standard value in
The first step of an adversary could be to set value range for A. Given the standard range of color values 2, E [0. 1), the maximum L2-norm of flattened image E IDW is vHWD, in this case, (I|=Il2)max = v32 : 32 3 = 55.43 and, therefore, À E [1, 55.43J. Now, without further assumptions, the adversary can repeat the reconstruction process with different values for À and select the best result. Figure g shows some example results of the Lrid--and-error approach.
Original
Clipped
A = 10
À = 25
X = 40
Ô = 0.03
Ô = 0.3
Ô = 0.75
Ô 1.2
Figure 8: Reconstruction results for different approximations of X. The (scaled) perturbed image (top) and the DM's reconstruction (bottom) are shown. Additionally, the change in the standard deviation the noise CoA resulting from rescaling given.
B Experimental Details
Models. For the CIFAR-10 and CelebA-HQ datasets, we utilize the diffusion models and exponential
moving average (EMA) checkpoints from Ho et al. 2020)) These checkpoints achieve validation Fréchet
Inception Distance (FID) Heuuel et al. 2017) of 3.17 for CIFAR-10, the FID for CelebA-HQ was not reported. For the ImageNet dataset, we employ the unconditional DM of Dhariwal & Nichol (2021). which achieves a validation FID of 12.00. All DMs are based on U-Net architectures (Ronneberger et al. 2015) and PixeICN++ (Salimans et al. 2017).
Frameworks. We use the Diffusers library (vo Platen et al. 2022) (based on PyTorch (Paskke et al, 2019 to leverage srate-of-the-ane pro-trained DMs for implementing our reconstruction attack.
Compute Reconstruction Performance. To evaluate the roconstruction performance of the considerod allacks, asses the average similarity between the reconstrueted test images and their original counterparts. First, execute the reconstruction attack proposed by Ziller et al. (2024b) on DP-SGD (as described in Sec. 2 obtaining their reconstruction performance. Then, we post-process the noisy images generated by Ziller et al.'s attack using our proposed DM method (as described in Sec. 3 representing our attack's reconstruction performance.
For the ReRo lower bound, we implement the prior-aware attack proposod by Hayes al. 20233 under iden- tical DP-SGD settings and architectures Ziller et al.) (2024b). We compute reconstructions by matching the noisy and clipped gradients from DP-SGD with the clipped gradients derived from prior set comprising
19

---

Published in Transactions on Machine Learning Research (03/2025)
256 candidate images using the dot product. The resulting matched images then considered recon- structions and used to compute the similarity. Intuitively, successful matching by the ReRo attack results in perfect reconstructions.
C Interpreting μ for Standard DP-SGD Configurations
As discussed Sec. 4.1 we report results using the signal-to toll-ttooooiee noise ratio (SNR), defined as μ = C/a, where is the clipping parame- ter and is the noise multiplier in DP-SGD, This metric provides privacy measure that is independent of specific training hyper- parameters, enabling generalization of our results across various training configurations.
10a
102
10
In DP, privacy guarantees are typically expressed in the (e, 6)-DP framework. For a fully defined DP-SGD configuration (including the number of steps T, sampling probability p, and 8), f can be converted into an () pair by using advanced privacy accountants MMironov 2017 Gopi et al. )
10a
10a
10a
p= C=c
Figure 9: Conversion of μ to (c, 5)DP for typical DP-SGD configurations for CIFAR-10 (blue .) and ImageNet (green Additionally, we adopt worst-case configuration (red A).
To facilitate comparisons with the (c,8) notion, present esti-
mates for representative DP-SGD configurations in Fig. g These
values are illustrative and were not directly used in our experi- ments, as our setup does not rely on specific configurations. For CIFAR-10 with N = 50, 000 training samples, we adopt the parameters from [Klause et al.) 2022). using T = 2, 400 steps, a sampling probability of p 024/224/000 '50 000, and ó 10-5 5, For ImageNet (N 1, 14,281,613 167), we employ the fine-tuning setting from [Berrada et al. 2023 with T = 1, 000, p 262, 144/1, 281, 167, and 5 8 10-7 Additionally, consider worst-case scenario where an adversary modifies the hyperparameters to T step and a batch size of 1, resulting in 1/50, 000.
Our results reveal large differences in privacy guarantecs across these configurations, underscoring the sub- stantial impact of training hyperparametens on privacy protection. These findings support. our choice of using j as an independent, robust metric in our analysis.
D Ablation Experiments
In this section, conduct series of ablation experiments to assess the performance of our reconstruction attack under different settings and assumptions. Each ablation experiment evaluates the average similarity between the reconstructed images and the original images using CIFAR-10 and LPIPS. In all figures, the dashed line represents the average similarity of Lest. images.
Privacy Leakage from Re-Identification. In this experi- ment, we evaluate the capabilities of an adversary using our method for re-identification. For this, we employ the matching strategy introduced by Hayes et al. (2023) (see Sec. 2.1 and match
0.8
0.6
0.4
the reconstructed image with the most similar image from a prior
0.2
set using LPIPS and compute the ratio of correct matches. Wo
compare our matching success with the (0,7)-ReRo bound.
10 p C/a
102
The results in Fig. 10 corroborate our expectation that our method achieves lower matching success than the ReRo bound. This differ- ence can be attributed to our allack solely assuming a general data prior, while ReRo assumes access to the full underlying dataset. Consoquently, our mothod relics on the DM-basod reconstruction of the image, which may drop some information in the generation process. However, despite this limitation, matching perfor-
Figure 10: Image matching success Y with prior set size of 256 using re- constructed images (blue compared to the ReRo lower (red and upper bound (green).
20

---

Published in Transactions on Machine Learning Research (03/2025)
mance is notably close the ReRo bound, indicating attack's ability to recover unique features even under strong perturbations. Once again, we observe that J S 5 serves as threshold beyond which our attack cannot recover any unique features.
Comparison between DDIM and DDPM Generation.
Recall that we employ the deterministic generation process DDIMs enforce data consistency. this experiment, we evalu- ale the effect of this design choice reconstruction performance by comparing DDIM generation with the probabilistic generation process of DDPMs, which is usually used in implementations of DMs.
0.6
LPIPS
0.4
0.2
0
10a
10a
p C/o
The results in Fig. 11 show improved performance across various privacy levels with DDIM sampling, suggesting that DDIMs ex- hibit greater consistency and remain closer the original image throughout the generation process.
Figure 11: DDIM (blue .) and DDPM
(red generation performance.
Unknown Noise Variance. In our main experiments, sume that the adversary knows the variance of the noise in the privatized image. However, this assumption may not always hold true in practical scemarios. In this experiment, we assess the im- pact of unknown noise variance on our reconstruction performance. For this, we approximate the noise variance using the wavelet- based implementation in scikit-image (van der Walt et al. 2014) (restoration, estimate _aiiessss________ which is described in Section 4.2 of [Donoho & Johnstone, 1994).
0.6
LPIPS
0.4
0.2
10
10a
p p= C/a
Performance under known noise variance (blue e) and noise vari- ance estimation (red
Figure 12:
The results in Fig. 12 show only slight decrease in reconstruction performance, indicating that the noise variance can be accurately estimated and that our attack robust against estimation errors.
Denoising without Learned Data Priors. In this experi- ment, we assess the effectiveness of structural image priors that only capture patterns inherent in images, and do not approximate specific data distribution. For this, we employ traditional de- noising methods based on wavelet transformation (Chang et al. 2000 and BM3D (Dabox et al.) 2007) and compare their perfor- mance with our DM method approximating the underlying data distribution.
LPIPS
0.5
0.2
10
10a
# C/o
The results in Fig. 13 show the limitations of traditional demoising methods when confronted with large noise perturbations. Specif- ically, the results reveal large performance difference across all privacy levels.
Figure 13: Performance of traditional denoising methods based wavelet transformation (green and BM3D (red compared to our DM method (blue
21

---

Published in Transactions on Machine Learning Research (03/2025)
E
Additional Reconstruction Results
Original
/r = 20
/1 = 10
/ 5
Original
# 20
/ 10
== 5
Original
/ = 20
/ 10
1 5
Figure 14: Reconstruction results of our DM attack with respect to μ C/a for CIFAR- 10 (top), CelebA-HQ (middle), and ImageNet (bottom).
22

---

Published in Transactions on Machine Learning Research (03/2025)
Orig.
Noisy
Rec.
Rec.
Rec. 3 Rec.
Rec. 5
11 = 100
1 50
11 30
11 20
11 10
==
11 3
Figure 15: DDPM reconstruction results with respect to C/a for CelebA-HQ image. For each μt- value, the original image, the noisy image, and five reconstructions from the noisy image are shown. We observe that lower μ (SNR) lead to larger deviations between generations. The adversary is interested the features that stay consistent across generations, as these likely originate from the original image. For example, hair color stays consistent until μ 20, and gender can be inferred until μ This shows that the visual insights from roconstructions of DMs are not only valuable for data owners who compare the reconstruction with the original image, but also for adversaries who only have access to the noisy image and the ability to compare different generations.
23


Reviews:
[{"review_id": "M9N7kY8pHI", "reviewer": "Reviewer_j7Cv", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n1. The paper proposes using diffusion models for data reconstruction in DP training.\n2. The paper conducts a series of numerical experiments on using diffusion models for image recovery from privatized gradients for different SNRs and compares them with the algorithms without using diffusion models. \n\nWeakness:\n1. It is unclear how the privatized image $x_{priv}$ is obtained. In DP-SGD, the attacker can only get the **averaged** gradient instead of the individual gradient of one sample. Therefore, the adv. problem eq(7) is not a valid setting at first glance. Please provide a more in-depth discussion on how to obtain the input $x_{priv}$. \n2. The paper's section 4.5 assumes only using mini-batch SGD. This setting is more aligned with the practical DP training. The authors should provide a detailed discussion of the algorithm and experiment setting for this case.\n3. In section 4.1, the author mentioned that $\\mu$ can be translated to $(\\epsilon,\\delta)$. More rigorous discussion should be given. Specifically, the authors should provide a few examples of $\\mu$ for typical DP training settings on the tested datasets.\n4. The paper should discuss more related work using diffusion models for privacy attacks, e.g., [[R1]](https://arxiv.org/pdf/2411.03053), [[R2]](https://arxiv.org/pdf/2407.05285)\n5. The input reconstruction requires the input layer to be fully connected layer. For general convolutional layers, is there a way to recover the privatized input from the per-sample gradient?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates the usage of diffusion models for gradient inversion attacks on vision models during differentially private training. In this setting, the diffusion model has prior knowledge of the data distribution and, therefore, has more capability to attack the DP training successfully. The authors argue that the level of data privacy protection by DP is not accurate, considering the possible prior knowledge of the data distribution gained by the diffusion model. The paper designs a series of numerical experiments to demonstrate the ability of diffusion models to recover the original image from the privatized gradient under different SNRs.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please check the weaknesses above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "am82Wv3vsY", "reviewer": "Reviewer_rCx3", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. The paper proposes a new attack using DM for analyzing privacy risks and offers practical insights into the limitations of DP guarantees.\n\n2. Experimental evaluation of the proposed framework on CIFAR-10, CelebA-HQ, and ImageNet datasets.\n\n3. The paper is well-written and structured.\n\nWeaknesses:\n\nPlease see the requested changes below.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper develops a novel data reconstruction attack using diffusion models (DMs). Specifically, the contributions are:\n\n1. The observation that real-world data priors significantly affect the success of reconstruction attacks, challenging current theoretical bounds.\n\n2. The introduction of a new attack incorporating DMs to enhance reconstruction of images protected by Differential Privacy (DP) mechanisms, such as DP-SGD.\n\n3. The observation/proposal to use DMs as heuristic tools for visualizing privacy leakage.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Could you please convert the μ to ε for Figure 2?\n\n2. There are works that either use DP-GANs [1,2,3] or synthesize images with DP guarantees that are visually different from the private images[4]. Please explain how this method is different from them and compare with them in terms of performance and privacy. Specifically, currently the paper evaluates the reconstruction performance of the private images for a model trained with DP-SGD. How the DM generated images are better than the GAN-generated images? What are the advantages of using the DM? Furthermore, [4] shows that a model can be trained using visually different synthetic and achieve comparable utility as the private images. Please explain more the concept that of visual privacy that the paper proposes and how this is different from other SOTA works.\n\n[1] Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial\nnetwork. arXiv preprint arXiv:1802.06739, 2018\n\n[2] Frederik Harder, Kamil Adamczewski, and Mijung Park. Dp-merf: Differentially private mean embeddings\nwith randomfeatures for practical privacy-preserving data generation. In International conference on\nartificial intelligence and statistics, pp. 1819–1827. PMLR, 2021\n\n[3] Shun Takagi, Tsubasa Takahashi, Yang Cao, and Masatoshi Yoshikawa. P3gm: Private high-dimensional\ndata release via privacy preserving phased generative model. In 2021 IEEE 37th International Conference\non Data Engineering (ICDE), pp. 169–180. IEEE, 2021\n\n[4]Soufleri, Efstathia, Deepak Ravikumar, and Kaushik Roy. \"DP-ImgSyn: Dataset Alignment for Obfuscated, Differentially Private Image Synthesis.\" Transactions on Machine Learning Research.\n\nMinor comment:\n\n Is any way to establish theoretically your proposal?Note that the paper demonstrates the experimental results and additional theory would add extra value", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "xkwpRp0FAX", "reviewer": "Reviewer_2F3d", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "[strengths]\n- accuracy of reconstruction success can be approximated even without ground-truth images\n- necessary and well-measured comparison between theoretical bounds with assumptions and attacks that use practical priors\n- novel and interesting usage of diffusion models to reconstruct images, very clear empirical results on its success compared to prior work\n\n[weaknesses]\n- diffusion models blur the line between “successful” and “unsuccessful” reconstruction attack, since the reconstructed image often looks like a real image, though this is partially addressed by success approximation", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "In this paper, the authors investigate how well prior theoretical bounds on image reconstruction attack success under differential privacy (DP) hold under more realistic data priors. Namely, the authors reference two existing papers which provide theoretical reconstruction attack success with opposing levels of adversarial assumptions. Then, this paper introduces a new attack for reconstructing images from privately trained models using diffusion models. The authors then use this novel attack to show that their realistic data prior assumptions + attack settle between the two bounds provided by prior work. This shows that assumptions on prior data significantly impact reconstruction success, which limits the practicality of existing theoretical bounds. Finally, the authors state that their diffusion-based private reconstruction attack can thus be used as an effective auditing tool for privacy leakage (with a visualization component).", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- can the authors include classifier training details used for their three datasets? It is hinted that resnet-9 was used, but it would be good to know the full training details + testing accuracy when applying DP\n- it is mentioned that increasing image size furthers the gap between Ziller et. al’s bound and the DM attack, but this finding isn’t *quantifiably* clear from the manuscript. Is there a way to include a measurement of the increasing gap between Ziller et al’s bound and the DM attack?", "broader_impact_concerns": "none", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: As outlined in the "Claims and Evidence" field, the paper studies the privacy properties of computer vision models trained under DP using reconstruction attacks. The paper is well written, and presents the claims and evidence clearly. While one of the three reviewers suggested a weak reject for the paper, I believe the authors have done sufficient job in responding to the criticism during the discussion period, and moreover I believe the paper meets the acceptance criteria of TMLR.
Decision: Accept (poster)