Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?
Authors: Viet-Hung Tran
Ngoc-Bao Nguyen
Son T. Mai
Hans Vandierendonck
Ira Assent
Alex Kot
Ngai-Man Cheung
Venue: Accepted by TMLR ()

Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private
training data from machine learning models. While existing defenses primarily concentrate on model-centric approaches, the impact of data on MI robustness remains largely unexplored. In this work, we explore Random Erasing (RE)—a technique traditionally used for improving model generalization under occlusion—and uncover its surprising effectiveness as a defense against MI attacks.

Specifically, our novel feature space analysis shows that model trained with RE-images introduces a significant discrepancy between the features of MI-reconstructed images and those of the private data. At the same time, features of private images remain distinct from other
classes and well-separated from different classification regions. These effects collectively degrade MI reconstruction quality and attack accuracy while maintaining reasonable natural accuracy. Furthermore, we explore two critical properties of RE including Partial Erasure and Random Location. First, Partial Erasure prevents the model from observing entire objects during training, and we find that this has significant impact on MI, which aims to reconstruct the entire objects. Second, the Random Location of erasure plays a crucial role in achieving a strong privacy-utility trade-off. Our findings highlight RE as a simple yet effective defense mechanism that can be easily integrated with existing privacy-preserving techniques. Extensive experiments of 37 setups demonstrate that our method achieves SOTA performance in privacy-utility tradeoff. The results consistently demonstrate the superiority of our defense over existing defenses across different MI attacks, network architectures, and attack configurations. For the first time, we achieve significant degrade in attack accuracy without decrease in utility for some configurations. Our code and additional results are available at: https://ngoc-nguyen-0.github.io/MIDRE/

Published in Transactions on Machine Learning Research (08/2025)
Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?
Viet-Hung Tran*
h.tran uk
Singapore University of Technology and Design (SUTD); The Queen's University Belfast
Ngoc-Bao Nguyen"
thibaongoc nguyen@@uuddecmmm thiboongoe edu.sg
Singapore University of Technology and Design (SUTD)
Son T. Mai
Chaison.mai@quue ac. uk
The Queen's Universily Belfast
Hans Vandierendonck
vunddierendonck@@ub.ooo uk
The Queen's University Belfast
Ira Assent
ira@es. ou. di
Aorhus University
Alex Kot
eackot@ntu. edu.sg
Nanyang Technological University (NTU)
Ngai-Man Cheung
ngaiman_
Ogaiinn__hhuug@@eeee cheung edu.s9
Singapore University of Technology and Design (SUTD)
Reviewed OpenReview: https: openreview. net/ forum? id= S9CuknPHaQ
0
Abstract
Model Inversion (MT) attacks pose significant privacy threat by reconstructing private training data from machine learning models. While existing defenses primarily concentrate on model-centric approaches, the impact of data on MI robustness remains largely unex- plored. In this work, we explore Random Erasing (RE) a technique traditionally used for improving model generalization under occlusion-ant and uncover its surprising effectiveness as defense against MI allacks.
Specifically, our novel feature space analysis shows that model trained with RE-images intro- duces a significant discrepancy between the features of MI-reconstructed images and those of the private data. At the same time, features of private images remain distinct from other classes and well-separated from different classification regions. These effects collectively de- grade MI reconstruction quality and attack accuracy while maintaining reasonable natural accuracy. Furthermore, we explore two critical propertics of RE including Partial Erasure and Random Location. First, Partial Erasure prevents the model from observing entire objects during training, and we find that this has significant impact on MI, which aims to reconstruct the entire objects. Second, the Random Location of erasure plays a crucial role in achieving strong privacy-utility trade-off. Our findings highlight RE as simple yet effective defense mechanism that can be easily integrated with existing privacy-preserving techniques. Extensive experiments of 37 setups demonstrate that our method achieves SOTA performance in privacy-utility tradcoff. The results consistently demonstrate the superiority of our defense over existing defenses across different MI atlacks, network architectures, and attack configurations. For the first time, we achieve significant degrade in attack accuracy without decrease in utility for some configurations. Our code and additional results are available at: https://ngoo-nnuyyee-- w.t.ii.......o../.............
The finst authors contributed equally. f Corresponding author.

---

Published in Transactions on Machine Learning Research (08/2025)
1 Introduction
Ita public data
Iseer privatte
((0) 1(T(())))
2(0)
(n) No Defense
(4) TL-
Removo stip commudiion
Keop the aurrc:
210)
MI-RAD
+000))
2
[c] NLB
Ranfimmy minddyed
Inuus
Figure 1:
Our Proposed Model Inversion (MI) Defense via Random Erasing (MIDRE). (a) "No
Defense": Training model without MT defense. [()) is the standard training loss, e.g., cross-entropy.
Training model with saate-of-theart MI defense (SOTA) (b) BiDO (Peng al. 2022), (c) NLS (Struppek) et al. ). and (d) TL-DMI (Ho et al. 2024), (c) MI-RAD (Koh et al. 2024)
(f) Our method. Studies in PPng et al. 2022 Struppek et al. 2024] focus on adding new loss to the training objective in other to find the balance between model utility and privacy. Both TL-DMI (Ho et al.
2024 and MI-RAD (Koh ett al. 2024) focus on the model's parameters to defend against MI. For our proposed method (f), the training procedure and objective are the same as that in (a) "No Defense". However, the training samples presented to the model are partially masked, thus, reducing private training sample's information encoded in the model and preventing the model from observing the entire images. Therefore, MIDRE is different from other approaches and focuses on input data only to defend. We find that this significantly degrade MI attacks, which require substantial amount of private training data information encoded inside the model in order to reconstruct high-dimensional private images.
Machine learning and deep neural networks (DNNs) (LeCun et al. 2015) have demonstrated their utility
across numerous domains, including computer vision (Voulodimos al., 2018 O MaMhnyy al.] 2020). natural language processing (Otter al., 2020), and speech recognition (Deng et al. 2013 Nassif et al.
2019). DNNs now applied in critical areas such as medical diagnosis (Azad ct al. 2021 medical imaging
[Shen et al. 2017: Lundervold & Lundervold] 2019), facial recognition (Wang & Deng. 2021 Guo & Zhang,
2019 Masi et al. 2018), , and surveillance (Zhou et al.) 2021 Harikrishnan et al. 2019 Hashmi et al. 2021). However, the potential risks associated with the widespread deployment of DNNs raisc significant concerns. In many practical applications, privacy violations involving DNNs can result in the leakage of sensitive and private data, eroding public trust these applications. Defending against privacy violations of DNNs is of paramount importance.
One specific type of privacy violation is Model Inversion (MI) attacks machine learning and DNN models. MI attacks aim to reconstruct private training data by exploiting access to machine learning models. Recent advancements in MI attacks including GMI (Zhang et al. 2020), KedMI (Chen et al. 2021). PPA (Struppek)
cet al. 2022). MIRROR (An et al.) 2022), IF-GMI (Qiu et al. 2024). PPDG-MI (Peng et al, 2024 PLG-MI (Yuan et al. 2023), and LOMMA (Nguyen et al. 2023) have achieved remarkable progress in attacking important face recognition models. This raises privacy concerns for models that are trained on scnsitive data, such as face recognition, surveillance and medical diagnosis.
Related works. Existing MI defenses primarily focus model-centric strategies like model gradients
Dwork 2006 2008), loss functions (Wang et al.] 2021 Peng et al.) 2022 Struppek et al. 2024). model
features Ho et al.- 2024), and architecture designs (Koh el al.
2024
(see Fig. 1]. Earlier works (Dwork
2006 2008) demonstrated the ineffectiveness
traditional Differential Privacy (DP) mechanisms against
Model Inversion (MI) attacks. Recent research (Wang et al.
2021 Pong et al. 2022 Struppek et al. 2024)
has explored the impact of loss functions on MI resilience.
Wang al. (2021) restricted the dependency
between model inputs and outputs, while BiDO (Peng et al. 2022 focused on limiting the dependency
2

---

Published in Transactions on Machine Learning Research (08/2025)
between model imputs and latent representations. To partially restore model utility, BiDO maximized the dependency between latent representations and outputs. Struppek et al. (2024) proposed using negative label smoothing factors as a defense. However, these loss function-based approaches often introduce conflicting objectives, leading to significant degradation in model utility. Recently, TL-DMI (Ho et al. 2024 restricted the number of layers to be encoded by the private training data, while MI-RAD (Koh et al. 2024] found that removing skip connections in final layers enhances robustness. However, both approaches experience difficulty in achieving competitive balance between utility and privacy.
Data augmentation, technique that creates new, synthetic samples from existing data points, offers a promising avenuc for enhancing model robustness. In this paper, we pioneer the investigation of Random Erasing (RE) (Zhong et al., 2020) for MI defense. RE, traditionally used to improve model generalization for detecting occluded objects by removing randomly a region in training samples, demonstrates its effectiveness as powerful defense against MI attacks. In MI attacks, adversaries optimize reconstructed images to align with the target modcl's feature space representation of training samples. As will be shown in our novel analysis, thanks to RE, the larget model's feature representations are inherently biased towards the RE- private images, the training data, rather than the private data. Consequently, RE creates a discrepancy between the features of MI-reconstructed images and that of private images, resulting in degraded MI attacks. Meanwhile, features of private images remain distinct from other classes, maintaining reasonable natural accuracy. Furthermore, we highlight two crucial properties of R.E. that serve as an effective MI defense: Partial Erasure and Random Location. On the one hand, Partial Erasure significandll reduces the amount of private information embedded in the training data, preventing the model from observing the enlire image, and consequently degrades the MT attacks. On the other hand, Random Location improves the diversity of training data, thereby, enhances the model utility. Our proposed method leads to substantial degradation in MI reconstruction quality and attack accuracy (See Sec. 3 for our comprehensive analysis and validation). Meanwhile, natural accuracy of the model is only moderately affected. Overall, we can achieve state-of-the-art performance in privacy-utility trade-offs as demonstrated in our extensive experiments of 37 setups 9 SOTA MI attacks including both white-box, black-box, and label-only MI attacks, 11 model architectures (including vision transformer), datasets and different resolution including 64 x 64, 160 160, and 224 x 224 resolution and user study (in Supp.). Our contributions are:
Our novel defense method, Model Inversion Defense via Random Erasing (MIDRE), is the first work lo consider the well-known RE technique as a privacy protection mechanism, leveraging its powerful ability to reduce MT attack accuracy while maintaining model utility. All results support the SOTA effectiveness of a simple technique in addressing a critical security concern.
We provide a deep understanding on feature space analysis of Random Erasing's defense effectiveness which leads to reduce of MI attacks in MIDRE model.
Our analysis investigates two crucial properties of RE that serve effective MI defense: Partial Erasure and Random Location. With these two properties, our defense method degrades the attack accuracy while the impact on model utility is small.
We conduct extensive experiments (Sec. A Supp.) and user study (Supp.) to demonstrate that our MIDRE can achieve SOTA privacy-utility trade-ofTs. Notably, in the high-resolution setting, our MIDRE is the first to achieve competitive MI robustness without sacrificing natural accuracy. Note that method is very simple to implement and is complementary to existing MI defense methods.
2 O ur Approach: Model Inversion Defense via Random Erasing (MIDRE)
2.1 Model inversion
A model inversion (MI) attack aims to reconstruct private training data from a trained machine learning model. The model under attack is called target model, Tg. The target model Ta is trained on a private dataset Dprie {(2,,))) ()) where x; represents the private, sensitive data and y represents the corre- sponding ground truth label. For example, To could be face recognition model, and x; is face image of
3

---

Published in Transactions on Machine Learning Research (08/2025)
identity. The model is trained with standard loss function E that penalizes the difference between model output (1())) and y-
MI attacks. The underlying idea of MI attacks is to seek a reconstruction I that achieves maximum likelihood for a label y under To:
max Pr
In addition, some prior to improve reconstructed image quality can be included (Zhang et al. 2020; Chen et al. 2021 SOTA MT attacks (Zhang et al. 2020; Chen et al. 2021 Nguyen et al. 2023 Struppek et al. 2022 also apply GAN trained on a public dataset pub to limit the search space for æ. Doub has no identity intersection with Pprivs assuming attackers can not access to any private samples.
2.2 Random Erasing (RE) as defense
Random Erasing (RE) [hoog et al. 2020) involves employing a random selection process to identify an region inside an image. Subsequently, this region is altered through the application of designated pixel values, such as zero the mean value obtained from the dataset, resulting in partial masking of the image. Traditionally, RE is applied as data augmentation technique to improve robustness of machine learning models in the presence of object occlusion (Zhong et al. 2020
We propose a simple configuration of RE as a MI defense, roquiring only one hyper-parameter. Given a training sample x with dimensions W x H, we propose a square region erasing strategy to restrict private information leakage from x, We initiate by randomly selecting a starting point, denoted as (x., Be), within the bounds of æ. Next, we randomly select the erased area portion ae within the specified range of [0.1, an), guarantecing at least 10% of z is erased during training, while aj is the only dyper-parameter of our defense. The size of the erased region is /ERE x /SnE where SRE W x H x a, is the erased region. With the designated region, we determine the coordinates of the erased region (Ie, ye: + / + /SRE). However, we need to ensure this selected region stays entirely within the boundaries of x, L.c Ie Iet/ S W, / I H. the erased region extends beyond the image width or height, we simply repeat the selection process until we find a suitable square erased region that fits perfectly within x. We fill the crased regions with ImageNet mean pixel value (See Supp for detailed discussion on the impact of the erased value) to obtain the RE-image. Note that RE is applied to all private training samples and the size and position vary each training iteration. We depict our method in Algorithm 1 (Supp.)
3 Analysis of privacy effect of MIDRE
In this section, we analyze the privacy impact of RE within our proposed MIDRE framework. We conduct a thorough analysis and demonstrate that RE can achieve a surprisingly state-of-tho-art balance between utility and privacy. Specifically, when employed as defense against. MI altacks, RE is the first method to significantly reduce attack accuracy without compromising utility in certain configurations, whereas all prior MI defenses exhibit noticeable degradation in utility to achieve similar reductions in attack success. Experimental results in Sec. further validate this finding.
We delve deeper into the mechanisms that underpin the effectiveness of RE. Importantly, we conduct a feature space analysis to explain RE's defense effectiveness, showing that model trained with MIDRE leads to a discrepancy between the features of MI-reconstruuted images and that of private images, resulting in degrading of attack accuracy. At the same time, private images remain distinct from other classes and well-separated from different classification regions, maintaining reasonable natural accuracy. Furthermore, our analysis reveals that partial erasure, implemented in RE, is highly effective method for mitigating MI attacks. Particularly, to present the model with less private pixels during training, approach of applying partial crasure while maintaining the original number of training epochs proves to be more effective than the alternative approach of reducing the number of epochs without using partial erasure. We altribute this to the fact that MI attacks rely on the target model to reconstruct the entire image, and RE's partial crasure prevents the target model from ever fully observing the entire image throughout the training process. Additionally, we show that applying partial crasure random locations, as is done in RE, more effective than erasure at fixed locations.
4

---

Published in Transactions on Machine Learning Research (08/2025)
Setup 1: KedMIRR12
Setup 2: PLGMIVGG16
Setup 3: LOMMA +K acdMM/aa CelebA/FFHQ
CelebA/Celeba 6le64
CelebA/CelebA/GAxe
100
100
100
Acc/ABAcce
Acc/ABAce
AcciAttAcs
50
50
accuracy attack accuracy
0.1
0.2
0.3
0.4
0.5
0.1
0.2
0.3
0.4
0.5
0.3
3g
Setup 4: PPA/MT FaccEScrub/FFHQ//ZZZZZ
Setup 5: NPA/ResNet18
Setup 6: PPA/ResNeSt101
FaceSsrub//FFQ//22424
Stanford Dog2/AFFHQ/224x22
100
100
AAcc
AcciAmAce
Acc/ArtAc
90-
50
80
70-
0.1
0.2
0.3
0.4
0.5
0.1
0.2
0.3
0.4
0.5
0.1
0.2
0.3
0.4
0.5
8e
8g
8e
Figure 2: Our analysis shows that Random Erasing (RE) can lead to substantial degradation in MI reconstruction quality and attack accuracy, while natural accuracy of the model is only moderately affected. In this analysis, we conduct experimental setups with different MI attacks/targel models ceshittecbur//rriouale ppubic datasels/imag resolution. We analyze the attack (green line) and natural accuracy (orange line) of the target models under different extents of random erasing applied in the training stage, using random erasing ratio ae /Ræ/ (W x H) as discussed in Sec. 2.2 To properly reconstruct private high-dimensional facial images of individuals, MI attacks require significant amount of private training data information encoded inside the model. We find that the model using RE by small percentages can significantly degrade MI attacks, with MI attack accuracy decreasing, for example, from 15.47% to 39.93%. However, the natural accuracy of the model only decreases slightly, less than 4%, as sufficient information remained in the RE-images for the model to learn to discriminate between individuals (Setup 1-3). We also observe a high degradation in MI attack accuracy while the model accuracy increases. For instance, model accuracy increases by 0.37%, while attack accuracy decreases by 69.39% (Sctup 4). Overall, our defense demonstrates state-of-the-art privacy-utility trade-offs and can improve model utility in certain setups
3.1 RE degrades MI significantly, achieving SOTA savvac--uiility trade-off
In the analysis, we study attack accuracy and natural accuracy of a target model T3 under different erased region portions ae- Rocall ag = SRE/WW> x H), and V x /RRE is the dimension of the crased region. For the larget model, which is a face recognition model, in each setup, we employ the same architecture and seper-parameters. while modifying the erased region portions ae- Specifically, we fix the values of a, for this analysis, to study the effect of a, to model utility (accuracy) and model privacy (attack accuracy). We vary ae from 0.0 (indicating no random erasing and the same No Defense) to 0.5 (erasing 50% of each input image). After the training of To, we proceed to evaluate its top 1 attack accuracy using SOTA MI attacks. This evaluation is conducted for all target models trained with different ag. In order to ensure diversity in our study, we employ six distinct setups for model inversion attacks, target model architecture, private dataset, and public dataset, and both low- and high-resolution datasets.
RE has small impact on model utility while degrading MI attacks significantly. Fig, 2 summa- rizes the impact of erased portions model performance and model inversion attacks. In all setups, we demonstrably improve robustness against MI attacks with small sacrifice to natural accuracy. For instance, introducing crased portions 0e at ratio of 0.2 in Sctup 1 caused a small 2.76% decrease in natural accuracy while the attack accuracy plummeted by 29.2%. This Irend cont inues in Setuu 2 a 0.2 ratio of de led to a modest 3.92% decrease in natural accuracy, but a substantial 15.47% drop in attack accuracy. We note that in Sctup 3, LOMMA KedMI attack accuracy degrades by 39.93%. For high resolution images (Sctup 4, 5), we observe an increase in model accuracy when using RE. In Setup 4, there is a significant 69.39% drop attack accuracy while natural accuracy slightly increase (0.37%) when a, 0.5. Similar trend for Setup 5,
5

---

Published in Transactions on Machine Learning Research (08/2025)
(a) NoDef, Att 88.67%, f
NoDef
(b) MIDRE, o. 0.4, AttAcc = 27.75%, firain
JRE
+IIDRE
Figure Feature space analysis to show that, under MIDRE, S and I MIDRE has a discrepancy, degrading MI attack. We visualize penultimate layer activations of private images (* fprie); RE-private images (v fRE), and Ml-roconstructed images (x frecm) generated by both (a) NoDef
prie
and (b) our MIDRE model. We also visualize the convex hull for private images, RF-private images
and MI-reconstructed images In (a), NNoDef closely resemble
consistent with high attack fprie <NoDef
accuracy. (b), private images and RF-private images share some similarity but they are not identical, fASTDRE closely resembles AMIDRE f DRE
with partial overlap between PMIDRE and fprse
JRE
MMIDRE
Importantly,
as REE-privat is the training data for MIDRE. This results in a reduced overlap between frecon
FMIDRE and
MIIDRE explaining that MI does not accurately capture the private image features under prie
MIDRE. More visualization can be found in Supp.
attack accuracy drops from 88.67% to 27.75% when ae = 0.4 while natural accuracy increases 1.83%. In con- clusion, using RE-images during training significantly degrudes MI allack while impact on natural accuracy is small.
3.2 Feature space analysis of Random Erasing's defense effectiveness
In this section, we present a novel observation that explains RE's defense effectiveness. We observe Property P1: Model trained with RE-private images following our MIDRE leads to a discrepancy be- tween the features of MI-reconsstrutted images and that of private images, resulting in degrading of attack accuracy.
The following analysis explains why MIDRE has Property P1. We use the following notation: ftrain. Spriv fRE and frecon represent the features of training images, private images RE-private images
and Ml-reconstructed images respectively. To extract these features, we first train the targel model without any defense (NoDef) and another target model with our MIDRE. Then, we pass images into these models to obtain the penultimate layer activations. Specifically, we input private images into the models to obtain Spriv- Next, we apply RE to private images, pass these RF-private images into the models to obtain fnæ- We also perform MI attacks to obtain reconstructed images from NoDef model (resp. MIDRE model), and then feed them into the NoDef model (resp. MIDRE model) to obtain freco- We the same experimental visualize penultimate layer activations fprivs fRE. freco by both NoDef and
setting in Sec. 3.3 Then, our MIDRE model. We use a. = 0.4 to train MIDRE and to generate RE-private images. Additionally, we visualize the convex hull of these features.
Features of MI-reconstructed images tend to match features of training data. SOTA MI attacks aim reconstruct images that maximize the likelihood under the target model (Eq. 1 in order extract training data (which possess high likelihood under the target model). Under attacks of high accuracy,

---

Published in Transactions on Machine Learning Research (08/2025)
frecon tends to match the features of training data ftrain (Nguyen et al. 2023).
FRE fpriv
(a); as the training data of NoDef is Ipreres, we observe that in NoDef model, /reche/ overlaps priv NNoDes i.e. there is significant overlap between the pink and blue polygons. In Fig. (b), the MIDRE model trained with RE-private images Itasn FMTDRE- and as a result, pink polygon frecon fEEDREE and green polygon JRE M overlap. This confirms features of reconstructed images tend to match the features of training data, i.e. spraee in NoDef and fMIDRE in MIDRE.
Evidence. In Fig. 3
private images Strain prie
fRE fMIDRE
16-
Figure 4: MIDRE target model
achieves high accuracy despite partial overlap of MIDRE and prree fMIDRE We
Mismatch in feature space of MIDRE. MIDRE is trained using REEprivate images and is generalizable to images with- out RE as shown (Zhong et al. 2020). Under MIDRE larget model, fRE &MIDRE and fprie fAIDRE have partial overlaps, but they are not identical. Mcanwhile, fe tend to match with JRE MIDRE (RE-private images are training data for MIDRE, and follows the discussion above). Therefore, freeD do not repli- FMIDRE significantly degrading the MI attack.
JE
visualize the penultimate layer activations of RE-private images and private images for three identities. While SiE JMIDRE and prit FMIDRE do not completely overlap, the model can still classify private images with high accuracy. This is because the private images remain distinct from other classes and distant from other classification re- gions, even when their representations are partially shared with RE-private images (the training data). We remark that RE randomly erases different regions from the images in different iterations, preventing the model to learn shortcut features and forcing the model to learn intrinsic fea- tures and become more generalizable be- yond training data. More visualization can be found in Supp.
cate fprie
Evidence. In Fig. 3 (b): FMIDRE and prii FRE overlap. Importantly, JACIDRE, which overlaps with I J as explained above, only partially overlaps with fpri SMIDRE, sug- gesting MI attacks fail to guide the reconstructed features to replicate private features. Consequently, MIDRE introduces discrepancy between MI-reconstructedd and private images in feature space of the target model, degrading the attack accuracy.
FMIDRE are partial MIDRE
Remark. Note that the mismatch between JRE foriv /MIDRE does not cause the reduction of model utility (see Fig. 4. This is because the private images remain distinct from other classes and distant from other classification regions,
MIDRE and
even when their representations are partially overlapped with RE-private images (the training data).
3.3 Importance of partial erasure and random location for privacy-utility trade-off
In addition to two properties discussed in Sec. 3.2 which contribute to outstanding effectiveness of applying RE to degrade MI, we analyse in this section two propertics of Random Erasing that are: Property P2: Partial Erasure, and Property P3: Random Location. To investigate the effect of each property. we conduct the experiment using the following setup: We use T ResNet-18 (Simonyan & Zisserman 2014), Dprin Pacecrub (Ng & Winkler 2014), Dpns = FFHQ (Karras et al. 2019), attack method = PPA Struppek et al. 2022). To evaluate the effectiveness of Partial Erasure and Random Location, we conduct experiments on three schemes: Entire Erasing (EE), Fixed Erasing (FE), and Random Erasing (RE). These schemes are compared against a No Defense baseline, which is trained for 100 epochs without any defense. In the Entire Erasing (EE) scheme, randomly reduce the number of erased samples per ID in each training epoch to simulate varying pixel concealment levels. Specifically, we train the model for 100 epochs, and for cach epoch, we erase randomly 50%, 40%, 30%, 20%, 10%, and 0% of images per ID. For Fixed Erasing (FE), a fixed location within each image is erased throughout the entire training process. However, the erased location varied across different images. For Random Erasing (RE), the location of erased areas is randomly selected for each image and training itcration. We train the RE model for 100 epochs with different values of the crasure ratio, ag 0.5, 0.4, 0.3, 0.2, 0.1 corresponding to 50, 40%, 30 %, 20%, and 10% pixel concealment, respectively.
7

---

Published in Transactions on Machine Learning Research (08/2025)
Table 1: We compare three different techniques for pixel concealment, to reduce the amount of private information presented the model during training. The results show that simply reducing epochs in "Entire Erasure" is insufficient for degrading attack performance. Meanwhile, RE improves model utility while degrading attack accuracy effectively.
Partial Erasure
Entire Erasing
Concealment
Random Erasing
Fixed Erasing
Ge
Ace (1)
AttAce (I)
Ace (1)
AttAcc (L)
Acc (1)
AttAce (L)
0%
0
97.69
87.12
97.69
87.12
97.69
87.12
10%
0.1
97.91
79.76
96.13
85.26
97.33
87.83
20%
0.2
97.64
66.32
96.79
69.81
97.52
87.03
30%
0.3
97.14
46.30
96.13
50.71
97.53
89.15
40%
0.4
96.05
27.75
93.10
28.49
97.30
89.03
50%
0.5
93.77
15.98
86.69
14.86
97.21
87.59
Property P2 brings the privacy effect to defend against MI attacks. By erasing portions of training images, it reduces the amount of private information exposed to the model during training. By erasing more information, we can offectively degrade the accuracy privacy attacks. Importantly, partial crasures prevent the model from seeing entire images. Consequently, RE-images provide less information about the entirety of the face, such as inter-pupillary distance, relative distances between the eyes, nose, and mouth, the position of the cheekbones, etc. Note that, features need to be presented to the model many times during training in order for the model to learn the features, suggested by the common practice of using multiple epochs to train a robust model. Property P2 reduces the frequency of presenting the features to the model during training. Such reduced frequency using partial crasure makes it more difficult for the model to memorize the identity features.
Evidence. In Tab. D in terms of degrading the attack, partial erase (fixed or random) more effective than entire erase (reduce numbers of sample per ID) although the percentages of pixel conccalment the same. Specifically, EE (reduce 50% images per ID) is significantly more vulnerable to attacks than RE and FE (50% image areas are erased, trained in 100 epochs), suffering approximately 71% higher in attack accuracy.
Property P3 recovers the model utility. While information reduction can improve privacy, may also negalively impact model utility too much information is erased. Fixing the erasing location for an image mcans some identity feature of this image will never be presented to the model, model may not have adequate information to learn effectively. RE avoids this issue. As the location of erased area is changed in each training iteration, RE improves the diversity of the training data and ensures that the model still observes significant portion of the image.
Evidence. In Tab. 1. RE improves the model accuracy while maintains the same atlack accuracy as FE in different erased portion ratio de- For instance, RE has higher model accuracy than FE by 7.08% with ae 0.5. With a, = 0.3 and 0.4, RE has higher accuracy and lower attack accuracy than EE model, showing that privacy effect of RE.
4 Experiments
4.1 Experimental Setting
To demonstrate the generalisation of our proposed MI defense, carry out multiple experiments using different SOTA MI attacks on various architectures. In addition, we also use different setups for public and private data. The summary of all experiment setups is shown in Tab. 2 In total, we conducted 37 experiment setups to demonstrate the effectiveness of our proposed defense MIDRE.
Datasct: We follow the same setups as SOTA attacks (Zhang al. 2020 Nguyen al. 2023 Struppek et al. 2022) and defense (Peng al. 2022 Struppek et al.) 2024 Ho et al. 20244) conduct the experiments four datasets including: CelebA LLiu et al. 2015 FaceScrub (Ng & Winkler 2014), VGGFace2 (Coo

---

Published in Transactions on Machine Learning Research (08/202)
Table 2: In total, we conduct 37 experiment setups to demonstrate the effectiveness of MIDRE.
Attack
Dpriv
D Dpub
Resolution
GMI (Zhang et sl.
2020
KedMi
Chen al.
202
VGG16
Simonyan & Zisserman
2014
LOMMA
[gguyen of al. 2023
IR152 He al. 2016
CelebA
CelebA/FFH
64x64
PLGMI
Yuan et al.
FaceNet64 Cheng et al.
2017
RLBMI
Han et al.
BREPMI
Kahla et al.
2022
ResNet18
[e al.
2016
ResNet101
He et al.
2016
ResNet152
He ct al.
2016
Facescrub
FFHQ
PPA Struppek al.
2022
DenseNet121
Iuang et 2017
224x224
DenseNet 169
Huang ot al. 2017
MaxVIT
Tu et al.
2022
ResneSt100
Stanford Dogs
AFHQ Dogs
Inception-V V1 [Inc
160x 160
MIRROR An et
2022
VGGFace2
FFI
ResNet50 (He al. 2016
224x224
18
IF-GMT Qiu al. 2024
Facescrub
FFHQ
224x224
ResNet152
et al.
2018), and Stanford Dogs (Dataset
2011 We use FFHQ Karras et al.
2019 and AFHQ Dogs CChoi
et al.
2020 for the public dataset. We strictly follow (Zhang et al. 2020; Nguyen el al. 2023
Struppek
et al.
2022 An et al.) 2022 Peng et al. 2022 Struppek et al., 2024 Ho et al. 2024
Koh et al. 2024 to
divide the datascts into public and private set. Soe Supp for the details of datasots.
Model Inversion Attacks. To evaluate the effectiveness of our proposed defense MIDRE, we employ comprehensive suite of seate-of-the-are MI attacks. This includes various attack categories: white-box and label-only, one type of black-box attack. To assess robustness at high resolutions, we employ PPA (Struppek
et al. 2022 and IF-GMT (Qiu et al. 2024) against atlacks targeting 224 pixels and MIRROR (An et al. 2022 against attacks targeting 224 224 and 160 160 pixels. For low resolution 64x64 pixels, we leverage four SOTA white-box attacks: GMI (Zhang et al., 2020), KedMI (Chen et al. 2021 PLG-MI (Yuan et al.,
2023), and LOMMA (Nguyen al.
2023) (including LOMMA+GMI and LOMMA+KedMII Additionally, 2023) for black-box attack and BREPMI (Kahla et al.] 2022 for label-
we incorporate RLBMT (Han et al.
only attack. We strictly replicate the experimental sctups in ŞZhang et al. 2020 Chen et al. 2021 Yuan
eet al. 2023 Nguyen et al. 2023: Struppek et al., 2022 Peng et al. 2022 Han et al. 2023 An et. al. 2022 to ensure a fair comparison between NoDeff (the baseline model without defense), existing state-of-the-al defenses, and our proposed method, MIDRE.
Target Models. We follow other MI research ZZhang el al. 2020 Nguyen et al. 2023: Struppek el al. 2022 Peng et al. (022)) to train defense models. We use 11 architectures for the target model to assess its rosistance to MI attacks using various experimental configurations. The details summarized in Tab. [ (ax) for all low-resolution data set-ups. In addition,
We train target models with the same for high-resolution data, we use two value for hyper-parameter = 0.4 and an 0.8 across all setups. This allows us to demonstrate MIDRE's effectiveness in achieving the optimal trade-off between utility and privacy with consistent hyper-paramen
Comparison Methods. We compare the performance our model against no defending method (NoDef) and five defense methods, including NLS (Negative Label Smoothing) (Struppek et al. 2024), TL-DMI (Ho et al.) ). MI-RAD (MI-resilient architecture designs) (Koh et al.) 2024). BiDO (Peng et al. 2022 and
MID Wang et al. )021). As for MI-RAD (Koh et al. 2024), compare results to Removal of Last Stage Skip-Connection (RoLSS), Skip-Connection Scaling Factor (SSF), Two-Stage Training Scheme (TTS).
We establish a baseline (NoDel) by training the target model from scratch without incorporating any MI defense strategy. According to NLS, TL-DMI, MI-RAD, we follow their setup and evaluation to compare with MIDRE. We then carefully tune the hyper-paramctors of each method to achieve optimal performance.
Evaluation Metrics. MI defenses typically involve trade-off between the model's utility and its resistance
9

---

Published in Transactions on Machine Learning Research (08/2025)
ResNet18
ResNet101
NesNet152
100
100
80
CP +DP+BIDO BIDO
NoDef
80
DP
MID
SeNoDer
80
oDe
MID
0 0.rs10.1, 0.4)
ABACc
+ 66DD
RoLS Ours(0.1. 0.4)
Atbccc
60
MID
BIDO
0urs10.1, 0.4)
40
40
40
TL-DMI
NLS
20
TL-DMI
20
20
Ours(0.1, 0.8)
O'rrs001. 0.8)
NLS
Qurs 0.8)
88
90
92
94
96
98
100
90
92
94
96
98
100
92
94
96
98
100
Acc
Acc
Acc
DenseNet121
DenseNet169
MaxVIT
100
100
NoDef
80
80
NoDef
80
NoDef
AttAcc
#5SF (0.1 0.4)
AttAcc
455F
AtfAcc
60
Ou 0.4
40
LN
40
Ours(0.1. 0.4)
40
TL-DMI *RoLSS
20
20
20
Rade-nn
ROLSS
0.31
AROLSS
0.8)
Ours(0.1,
0.8)
75
80
85
90
95
100
75
80
85
90
95
100
94
96
98
100
Acc
Acc
Acc
Figure We evaluate PPA attack (Struppek et al. 2022) on our proposed method, NoDef, MID (aang et al. 2021), BiDO (Peng et al. 2022), NLS (Struppek al. 2024), and TL-DMI (Ho et al., 2024). Target models are trained on Dpriv= Facescrub with 6 architectures. The results show that our method archives the best trade-of between utility and privacy among state-of-the-art defenses.
MIRKOO:ResNeeSSWGGGaaaz
I-GMMlResNeeBBFaacccco
IF-G .cCMMReesteettSSFaacccscbbb
100
100
NöDef
100
NoDef
KaDel
NoDot
Ours(0:1:044
80-
Ours:o.1.0044 0.44
0urs10.1. 0.4)
AMAcc
60
Alaccc
60
Durs 0.4)
1.rs 0.8)
Best 01
(urs(0:3 0.81
Sest Trederede
20
Curstc.1 0.)) Best on
Ours/0.3,
30
92
94
96
98
100
88
90
92
94
96
98
100
92
94
96
38
100
34
96
98
100
Acc
Acc
Acc
Acc
Figure 6: We evaluate MIRROR attack (An et al. 2022) on VGGFace2 dataset. The results show that our method archives the best trade-of between utility and privacy than NoDef model.
Figure 7: Results of IF-GMI (Quu et al. 2024 attack on Facescrub dataset. Here, we use T Res
ResNet D Dpriv = Facescrub, Dpuo = FFHQ, image resolution 224x224 images.
to model inversion attacks. In this section, we evaluate these defenses using two key metries: Natural Accuracy (Ace 1) to evaluate the model utility and Attack accuracy (AttAcc 4) and to evaluate the model privacy. We further show other evaluation metrics, including K-Nearest Neighbor Distance, deval; 8face (Struppek et al. 2022), complement these results with qualitative results and a user study in Supp.
4.2 Comparison against SOTA MI Defenses
We compare the model accuracy and attack accuracy of defense models in 6 architectures using attack hethod PPA (Struppek et al. 2022) in Fig. 3 All the target models are trained on Facescrub dataset. Interestingly, we are the first to observe that our defense models achieve higher natural accuracy but lower attack acuracy than no defense model for larger image sizes (224x224). With small masking areas (Ours(0.11.0.4)) our proposed method consistently achieves the lowest attack accuracy among all defense models while its natural accuracy is higher than NoDef, BiDO, MID, and DP models. For example, using ResNet101, our model reduces attack accuracy by 39.42% compared to NoDef while achieving the model accuracy is higher than NoDef model 3.16%. MaxVTT, a recent advanced architecture, has very high attack accuracy (80.66%). Our defense mechanism significantly enhances its robustness, lowering attack accuracy to 42.5% without compromising model performance. By increasing the masking areas (Ours(0.1,00.8). they achieve a significant reduction in attack accuracy while maintaining high natural accuracy, outperforming other strong defense methods like NLS and TL.DDMI. Specially, our allack accuracies are below 20% for all architeclures. This
10

---

Published in Transactions on Machine Learning Research (08/2025)
IFCM///ReNNet18/Faaecouuuu
Private
Acc
AttAcc 4
No Def.
94.22
98.30
MIDRE
97.28
72.58
a 0.4
MIDRE
93.33
24.86
0.8
Figure 8: Reconstructed image obtained from IF-GMI attack with T RcsNet-188, Ppriv Facescrub, Dpub FFHQ. Overall, our reconstructed images have less similarity to private images compared to those from the no-defense model, suggesting the efficiency of our proposed defense MIDRE.
represents the best priiityy-rvayyy trade-off among all evaluated defense models, demonstrating our method's effectiveness in mitigating model inversion attacks.
We further show the effectiveness of our proposed method using two attacks MIRROR {An et al. 2022 and IF-GMI (Qiu et al., 2024). Regarding the MIRROR attack, we compare the results of MIDRE and the NoDef model using Prrie VGGFacc2 (sce Fig. G Our defense reduces the attack accuracy by 22% and 70% without harming model utility, where the target model T = ResNet50/ InceptionVV. ReeNNet50//neeptionn Results of IF-GMI attack are shown in Fig. The results show that MIDRE reduces the attack accuracy by more than 22%.
For low resolution attacks, we evaluate against four MI attacks, inchuding GMI [Zhang et al. 2020). KedMT (Chen et al., 2021). LOMMA et al. 2023) with two variances (LOMMA+ GMI and
We evaluate multiple SOTA MI attacks on 64x64 images, comparing their performance under NoDef, NL.S, and our MIDRE defense. T = VGG16, D Drriv CelebA, Dpub CelebA.
Table 3:
Nguyen
LOMMA+KedMT), and PLGMI YYuan et al. 2023
We follow the same setup and compare with NL. in Tab. In addition, we also use NoDef bascling in NLS paper to compare and estimate A in Tab. 3
Attack
Defense
Ace
AttAcc. J
A 1
NoDef
85.74
53.64
4.64
LOMMA + GMT
NLS
80.02
4.25
2.53
MIDRE
79.85
26.62
1.93
4.59
NoDef
85.74
72.96
1.92
Overall, our proposed method, MIDRE, achieves significant improvements sccurity for 64x64 se- tups compared to SOTA MI defenses. MIDRE achieves this by demonstrably reducing top-1 attack accuracy while maintaining natural accuracy on par with other leading MI defenses. More results of other attacks can be found in Supp.
LOMMA + KedMI
NLS
80.02
63.60
1.37
1.64
MIDRE
79.85
41.82 1: 1.24
5.29
NoDef
85.74
71.00 = 3.31
PLGMI
NL.S
80.02
72.00 + 2.50
-0.17
MIDRE
79.85
66.60 + 2.94
0.75
We show the comparison on qualitative results in Fig. S Images are reconstructed using IF-GMI atack QQuu et al. 2024). T ResNet-18, Dpriv = Facescrub, Dpus = FFHQ. Overall, our reconstructed images have less similarity to private images compared to those from the no-defense model, demonstrating the effectiveness of our defense. More reconstructed images included in Supp and project page.
The experiment results demonstrate that our defense model has a small impact model utility while significantly enhancing the model's robustness against state-of-the-art MI attacks. Moreover, we are the first to report a substantial improvement in model utility among all existing defenses.
4.3 Ablation study on data augmentation type.
To evaluate the effectiveness of our method compared other data augmentation-based defenses, compare
11

---

Published in Transactions on Machine Learning Research (08/2025)
Table 4: We report the PPA attack on images with resolution 224 T ResNet18, Drrio = Faco- scrub, Dpub FFHQ to target models trained with different data augmentation. MIDRE consistently achieves the best balance between utility and pri- vacy, significantly degrading MI attack performance while maintaining competitive natural accuracy.
Table 5: The combination MIDRE with existing de- fense BiDO and NLS. The combine models signifi- cantly reduces attack accuracy compared to individual defensos. We denote "OP" for A if the accuracy of the defense model outperforms that of the NoDef model.
Setup
Defense
Acc (1)
AttAcc ()) A(1)
NoDef
95.43
86.51
NLS
91.50
13.94
18.47
Attack
Defense
Acc f
AttAcc I
Setup
MIDRE
95.47
15.97
OP
NoDef
94.22
88.67
MIDRE NLS
93.69
3.75
47.65
MIDRE
97.28
48.16
NoDef
86.90
81.80
1.44
PPA
Mut
98.74
67.12
BIDO
79.85
63,00 1 2.08
2.67
Setup
Random Cropping
92.24
74.22
MIDRE
79.85
43.07 + 1.99
5.49
Gaussian Blur
97.57
87.12
MIDRE
BIDO
82.15
39.00 + 1.30
9.01
MIDRE with models trained using CutMix, random cropping, and Gaussian blur. Those augmentations are commonly employed to enhance model generalization. Here, use the setup: attack method PPA, T ResNet18, Dpriv = Facescrub, Dpub FFHQ, image resolution = 224x224
The results, summarized in Table A indicate that while alternative augmentations provide some level of protection, MIDRE consistently achieves the best balance between utility and privacy, significantly degrading MI attack performance while maintaining competátive natural accuracy.
4.4 Combination with Existing Defenses
Since MIDRE improves defense effectiveness from the training data perspective, our proposod method can be combined with other defense mechanism from the training objective perspective such as BiDO (Peng et al., 2022) and NLS (Struppek et al. 2024). We use 2 setups: Setup 1: T = ResNet152, D Pprie Facescrub, Puu FFHQ, Attack method = PPA, image size = 224 x 224. Sctup 2: T VGG16, Dprin /Dpbb CelebA, Attack method = LOMMA + KedMI, image size = 64 x 64. We use dg = [0.1,0.4] and [0.1,088) for setup 1 and setup 2 to train MIDRE and during allack.
The results (sce Tab. 5 demonstrate the effectiveness of combining MIDRE with either NLS or BiDO for enhancing defense against MI attacks, as our MIDRE takes a data-centric perspective for defense, comple- mentary to existing defenses. In both experimental setups, the combination models demonstrate substantial reduction in attack accuracy compared to using MIDRE the other defenses independently. In particular, in sctup 1, the combination of MIDRE and Negative LS achieves remarkable 3.75% attack accuracy when using the state-of-the-art. PPA attack while preserving model utility. For Setup 2, MIDRE + BiDO improves the natural accuracy of the model by 2.3% while reducing the attack accuracy by 4.07% and 24% compared to MIDRE and BiDO, respectively. This shows our effectiveness of combining MIDRE and existing defense for a better defense. The combination ability of MIDRE supports that it examines distinct aspect of the system by focusing data input, setting it apart from other existing approaches to defend against model inversion attacks.
5 Conclusion
We propose novel approach to MI Defense via Random Erasing (MIDRE). We conduct analysis to demonstrate that RE possess two crucial properties to degrade MI attack while the impact on model utility is small. Furthermore, our features space analysis shows that model trained with RE-private images following MIDRE leads to a discrepancy between the features of MI-reconstructed images and that of privale images, resulting in reducing of attack accuracy. Experiments validate that our approach achieves outstanding performance balancing model privacy and utility. The results consistently demonstrate the superiority of our method over existing defenses across various MI attacks, network architectures, and attack configurations. The code and additional results can be found in the Supplementary section.
12

---

Published in Transactions on Machine Learning Research (08/2025)
Acknowledgements
This research is supported by the National Research Foundation, Singapore under its Al Singapore Pro- grammes (AISG Award No.: AISG2-TC-2022-007)) The Agency for Science, Technology and Research (A*STAR) under its MTC Programmatic Funds (Grant No. M23L7b0021). This research is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclusions or recommendations expressed this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore and Infocomm Media Development Authority. This research is also part-funded by the European Union (Horizon Europe 2021-2027 Framework Programme Grant Agreement number 10107245. Views and opin- lons expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. The European Union cannot be held responsible for them) and by the Engineering and Physical Sciences Research Council under grant number EP/ EP/XX29174/1.
References
Inception resnet (v1) models pytorch. https://githhbb.oom com /timmsler////////ee /ot.iimmseemmmmmeee///e/
facenet-pytorch.
Shengwei An, Guanhong Tao, Qinling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity. Proceedings of the 29th Network and Distributed System Security Symposium, 2022.
Mir Mohammad Azad, Apoorva Ganapathy, Siddhartha Vadlamudi, and Harish Paruchuri. Medical diagnosis using deep learning techniques: research survey. Annals of the Romanian Society for Cell Biology, 25()):5511-5600, 2021.
Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pp. 67 74. IEEE, 2018.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enniccee distributional model inversion attacks. Proceedings of the JEEE/CV /CVF international conference computer vision, 16178 16187, 2021.
Cheng, Jian Zhao, Zhecan Wang, Yan Xu, Karlekar Jayashree, Shengmei Shen, and Jiashi Feng. Know you at one glance: A compact vector representation for low-shot learning. In Proceedings of the IEEE international conference on computer vision workshops, pp. 1924-1932, 2017.
Yunjey Choi, Youngjung Uh. Jaejun Yoo, and Jung- Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pottern recognition, pp. 3188-8197, 2020.
E Dataset. Novel datasets for fine-grained image categorization. In First Workshop on Fine Groined Visual Catego- rization, CVPR. Citeseer. Cileseer. Cileseer, 2011.
Li Deng, Geoffrey Hinton, and Brian Kingsbury. New types of deep neural network learning for speech recognition and related applications: An overview. In 2013 IEEE international conference acouslics, speech and signal processing, pp. 1599-86033 IEEE, 2013.
Cyuthia Dwork. Differential privacy. In International colloquium on aulomala, languages, and programmming, pp. 1-12. Springer, 2006.
Cyuthia Dwork.
Differential privacy: A survey of results. In International conference on theory and applications of models of computation, pp. 1-19. Springer, 2008.
Guodong Guo and Na Zhang. A survey deep learning based face recognition. Computer vision and image underslanding, 189:102805, 2019.
Gyojin Han, Jachyun Choi, Haeil Lee, and Jummo Kim. Reinforcement learning- based black-box model inversion attakss. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pallern Recognition, pp. 20504 20513, 2023.
13

---

Published in Transactions on Machine Learning Research (08/2025)
Harikrishuan, Arya Sudarsan, Aravind Sadashiv, and Remya AS Ajai. Vision-face recognition allendance monitoring system for surveillance using deep learning technology and computer vision. In 2019 international conference on vision lowards emerging trends in commanication and nelworking (WTECCNN), pp. 1-5. IEEE, 2019.
Tufail Sajjad Shah Hashmi, Nazeef U1 Haq, Muhammad Moazam Fraz, and Muhammad Shahzad. Application of deep learning for weapons detection in surveillance videos. In 2021 international conference on digital futures and trunsformative technologies (ICoDT2), pp. 1-6. IEEE, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the TEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Sy-Tuyen Ho, Koh Jun Hao, Keshigeyan Chandrasegaran, Ngoc-Bao Bao Nguyen, and Ngai-Man Cheung. Model inversion robustness: Can transfer learning help? In Proceedings of the IEEE/CVE Conference on Computer Vision and Pallern Recognilion, pp. 22183-12199 2024.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pottern recognition, pp- 4700-4708, 2017.
Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion altacks via boundary repulsion. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pollern Recognition, pp. 15045 15053, 2022.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pp. 4401-4410, 2019.
Jun Hao Koh, Sy-Tuyen Ho, Ngoc-Bao Nguyen, and Ngai-man Cheung. On the vulnerability of skip connections to
model inversion attacks. In European Conference on Computer Vision, 2024.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, (7553)):::33 141, 2013.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730-3738, 2015.
Alexander Selvikvāg Lundervold and Arvid Tundervold. An overview of deep learning in medical imaging focusing on mri. Zestschrift für Medizinische Physik, 29(2):102 127, 2019.
lacopo Masi, Yue Wu, Tal Hassner, and Prem Natarajan. Deep face recognition: A survey. In 2018 31st SIBGRAPI conference on graphics, patterns and images (SIBGRAPI), pp. 471-478. IEEE, 2018.
Ali Bou Nassif, Tsmail Shahin, Imtinan Attili, Mohammad Azzeh, and Khaled Shaalan. Speech recognition using deep neural networks: A systematic review. IEEE access, 7:19143 43111165111, 2019.
Hong-Wee Wei Ng and Stefan Winkler. A dala-driven approach to cleaning large face datasets. In 2014 IEEE international conference on image processing (ICIP), pp. 343 347. IEEE, 2014.
Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognétion, pp. 16384-16393, 2023.
Daniel W Otter, Julian R Medina, and Jugal K Kalita, A survey of the usages of deep learning for natural language processing. IEEE trunsactions on neurul nelworks and learning systems, 32(2):604 624, 2020.
Niall O'Mahony, Sean Campbell, Anderson Carvalho, Suman Harapanahalli, Gustavo Velasco Hernandez, Lenka Krpalkova, Daniel Riordan, and Joseph Walsh. Deep learning vs. traditional computer vision. In Advonces in Computer Vision: Proceedings of the 2019 Compuler Vision Conference (CVC), Volume 1 1, pp. 128 144. Springer, 2020.
Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1358-1367 2022.
Xiong Peng, Bo Han, Feng Liu, Tongliang Liu, and Mingyuan Zhou. Pseudo-private data guided model inversion atlacks. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomezak, and C. Zhang (eds.), Advances Neural Information Processing Systems, volume 37, pp. 33338 33375. Curran Associates, Inc., 2024.
14

---

Published in Transactions on Machine Learning Research (08/2025)
Yixiang Qiu, Hao Fang, Hongyao Yu, Bin Chen, MeiKang Qiu, and Shu-Tao Xia. A closer look at gan priors: Exploiling intermediate features for enhanced model inversion altacks. In Proceedings of European Conference on Computer Vision, 2024.
Dinggang Shen, Guorong Wu, and Heung-Il Suk. Deep learning medical image analysis. Annual review of biomedical engineering, 19:221-248, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint (xXi::149..1566 2014.
Lukas Struppek, Dominik Hintersdorf, Antonio De Almeida Correira, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In International Conference Machine Learning, pp. 20522 20545. PMLR, 2022.
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Be careful what you smooth for: Label smoothing can a privacy shield but also catalyst for model inversion attacks. The Twelfth International Conference on Learning Hepresentations, 2024.
Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. Earopean conference on computer vision, pp. 459-479. Springer, 2022.
Athanasios Voulodimos, Nikolaos Doulamis, Anastasios Doulamis, Eftychios Protopapadukis, el al. Deep learning for computer vision: A brief review. Computational intelligence and neuroscience, 2018, 2018.
Mei Wang and Weihong Deng. Deep face recognition: survey, Neurocomputing, 429:215-244, 2021.
Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual informa- tion regularization. In Proceedings of the AAAT Conference Artificial Intelligence, volume 35, pp. 11666 -1673, 2021.
Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang, Pseudo label-guided model inversion attack via conditional generative adversarial network. AAAJ 2023, 2023.
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 253 253-26:3 261, 2020.
Zhun Zhong, Liang Zheng, Guoliang Kang, Shaozi Li, and Yi Yang. Random erasing data angmentation. In Proceed- ings of the AAAI conference artificial intelligence, volume 34, pp. 13001-13008, 2020.
Xiaokang Zhou, Xuesong Xu, Wei Liang, Zhi Zeng, and Zheng Yan. Deeplearringg-ehhaned multitarget detection for end edge cloud surveillance in smart iot. IEEE Internet of Things Journal, 8(16):12588 12596, 2021.
15


Reviews:
[{"review_id": "caOZGhxhz4", "reviewer": "Reviewer_1fBS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. The contribution of this paper is significant. It provides other perspectives to understand and defend against model-inversion attacks, which can motivate more papers in this research direction.\n\n2. The paper is written clearly. Reviewers can easily understand the main contributions after reading the introduction. The method is then introduced very clearly.\n\n3. The experiments show enough evidence to support the basic claim of this paper. The performance, in terms of attack accuracy and accuracy, can well support the claim.\n\nWeaknesses:\n\n1. In evaluating the performance of defense MI methods, attack accuracy is only one metric. More metrics should be considered in the experiments, like FID. Note that TMLR mainly requires the proper claims; please do not overclaim the performance on all metrics. \n\n2. The inverted private images should be shown in this paper, which can help understand this research direction better. It is interesting to see what kind of images we can obtain by the proposed defense method.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper revisits the model-inversion attacks from a data-centric perspective, which is quite novel to the field. The previous defense methods mainly want to train a better model with a given private dataset, yet this paper finds that we can change inputs and then train a model with a common loss function (no additional part like previous methods did). \n\nThis contribution is significant in my view because it provides other perspectives to understand and defend against model-inversion attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Weaknesses:\n\n1. In evaluating the performance of defense MI methods, attack accuracy is only one metric. More metrics should be considered in the experiments, like FID. Note that TMLR mainly requires the proper claims; please do not overclaim the performance on all metrics. \n\n2. The inverted private images should be shown in this paper, which can help understand this research direction better. It is interesting to see what kind of images we can obtain by the proposed defense method.", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "uH9738Mbrp", "reviewer": "Reviewer_24UE", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The existing defenses against model inversion typically target either the architecture or the training loss. This work, however, adopts an alternative perspective by intervening directly on the training data, offering a fresh angle to the ongoing discourse on model inversion defenses.\n- The proposed approach is both well-justified and conceptually straightforward. The visualization presented in Figure 3 lends further credibility to the method, illustrating its effectiveness in modifying the embedding space in an intuitive and interpretable manner.\n- The experimental evaluation is comprehensive, covering various datasets, model architectures, as well as multiple attack and defense scenarios. The method consistently demonstrates improved performance across most settings, providing solid support for its effectiveness as a defense strategy.\n\nWeaknesses:\n- The experimental evaluation thoughtfully considers existing defenses and includes ablations on two key components: mask fraction and location. Nonetheless, it might be worth considering additional baselines to further strengthen the analysis. For instance, exploring alternative masking strategies, such as random pixels, or using varied shapes like rectangles or circles", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a novel approach to enhancing model robustness against model inversion attacks. Rather than focusing on model architecture or training loss, the authors offer a fresh perspective by intervening directly at the training data level. By randomly erasing regions of input images, the method aims to reduce the amount of private information embedded in the model. The visualization of the embedding space, along with comparative experiments, demonstrates the strong defensive effectiveness of the random erasing strategy.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "In the Introduction, most of the MIAs discussed are from 2023 or earlier. It might be helpful to consider including some more recent studies published in top-tier conferences, if available, to further enhance the comprehensiveness of the paper.", "broader_impact_concerns": "NA.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "iivOIqiyGQ", "reviewer": "Reviewer_njFH", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros\n1The method is simple yet highly effective, achieving state-of-the-art performance in privacy-utility trade-offs while enabling seamless integration with existing baseline defenses.\n\n2The authors provide feature-space visualizations to explain why RE works, offering insights into how it disrupts MI attacks by creating discrepancies between private and reconstructed image features.\n\n3The paper includes comprehensive experiments and ablation studies, validating the approach across diverse datasets, architectures, and attack scenarios.\n\nQuestions\n\n1. The essence of RE is to prevent the model from observing the entire object information in images during training. This raises a concern: current baseline datasets (e.g., face datasets) have a high proportion of useful information (e.g., 70%+ facial content), so RE retains sufficient information. However, for datasets that useful information is inherently sparse (like object tracking dataset), directly applying RE might lose all useful information or fail to mask partial information effectively. How do the authors address this limitation? In other words, how does the author consider the relationship between the proportion of useful information in the image and the size of RE masking?\n\n2. The RE operation reminds me of the techniques in Masked Autoencoders (MAE)(arXiv:2111.06377). Have the authors explored alternative masking strategies (e.g., smaller but more patches, pixel-level masking)? Such variations might offer better results, particularly for high-resolution or complex data.\n\nIn sum, this paper presents a novel and practical defense mechanism against MI attacks, with clear theoretical and empirical contributions. The simplicity of RE, combined with its effectiveness, makes it an attractive solution for privacy-pre", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes Model Inversion Defense via Random Erasing (MIDRE), a method to mitigate model inversion (MI) attacks by training models with randomly erased images. The approach leverages Random Erasing (RE), a data augmentation technique, to degrade MI attack accuracy while preserving model utility. The authors analyze RE’s effectiveness through feature-space visualization, demonstrating that RE introduces discrepancies between MI-reconstructed and private image features. Extensive experiments across 37 setups, including diverse datasets, architectures, and MI attacks, show MIDRE achieves state-of-the-art privacy-utility trade-offs. Ablation studies and combinations with existing defenses further validate its robustness.\n﻿serving machine learning.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See questions above", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)