ICML 2025

DRAG: Data Reconstruction Attack using Guided Diffusion
Wa-Kin Lei 1 Jun-Cheng Chen 2 Shang-Tse Chen 1
Abstract
With the rise of large foundation models, split
inference (SI) has emerged as a popular compu-
tational paradigm for deploying models across
lightweight edge devices and cloud servers, ad-
dressing data privacy and computational cost con-
cerns. However, most existing data reconstruction
attacks have focused on smaller CNN classifica-
tion models, leaving the privacy risks of founda-
tion models in SI settings largely unexplored. To
address this gap, we propose a novel data recon-
struction attack based on guided diffusion, which
leverages the rich prior knowledge embedded in
a latent diffusion model (LDM) pre-trained on a
large-scale dataset. Our method performs iterative
reconstruction on the LDM’s learned image prior,
effectively generating high-fidelity images resem-
bling the original data from their intermediate rep-
resentations (IR). Extensive experiments demon-
strate that our approach significantly outperforms
state-of-the-art methods, both qualitatively and
quantitatively, in reconstructing data from deep-
layer IRs of the vision foundation model. The
results highlight the urgent need for more robust
privacy protection mechanisms for large models
in SI scenarios. Code is available at: https:
//github.com/ntuaislab/DRAG
1. Introduction
The rapid development of deep learning has revolution-
ized various aspects of daily life—from AI assistants to
autonomous vehicles. However, the substantial computa-
tional resources required by these emerging models often
hinder their deployment on edge devices. Therefore, offload-
ing intensive computation to cloud servers has become a
popular alternative. Following this paradigm, split inference
(SI) (Kang et al., 2017) has emerged as one of the most
1National Taiwan University 2Research Center for Information
Technology Innovation, Academia Sinica. Correspondence to:
Shang-Tse Chen <stchen@csie.ntu.edu.tw>.
Pr...