{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T17:30:06Z","timestamp":1755797406269,"version":"3.44.0"},"reference-count":84,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012335","name":"National Defense Basic Scientific Research Program of China","doi-asserted-by":"publisher","award":["JCKY2023603C043"],"award-info":[{"award-number":["JCKY2023603C043"]}],"id":[{"id":"10.13039\/501100012335","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172402","62472128"],"award-info":[{"award-number":["62172402","62472128"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key Research and Development Plan of Heilongjiang Province","award":["2022ZX01C01"],"award-info":[{"award-number":["2022ZX01C01"]}]},{"DOI":"10.13039\/501100005046","name":"Natural Science Foundation of Heilongjiang Province","doi-asserted-by":"publisher","award":["LH2024F023"],"award-info":[{"award-number":["LH2024F023"]}],"id":[{"id":"10.13039\/501100005046","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3592542","type":"journal-article","created":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T17:54:21Z","timestamp":1753379661000},"page":"8465-8480","source":"Crossref","is-referenced-by-count":0,"title":["FGMIA: Feature-Guided Model Inversion Attacks Against Face Recognition Models"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-3068-475X","authenticated-orcid":false,"given":"Ye","family":"Lu","sequence":"first","affiliation":[{"name":"School of Cyberspace Science, Harbin Institute of Technology, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5748-5438","authenticated-orcid":false,"given":"Shen","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Science, Harbin Institute of Technology, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7956-5343","authenticated-orcid":false,"given":"Guopu","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Science, Harbin Institute of Technology, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3611-7060","authenticated-orcid":false,"given":"Zhaoyang","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Science, Harbin Institute of Technology, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7625-5689","authenticated-orcid":false,"given":"Jiwu","family":"Huang","sequence":"additional","affiliation":[{"name":"Guangdong Laboratory of Machine Perception and Intelligent Computing, Faculty of Engineering, Shenzhen MSU-BIT University, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3507902"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.10.081"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3229593"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3228494"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref7","article-title":"Privacy leakage on DNNs: A survey of model inversion attacks and defenses","author":"Fang","year":"2024","journal-title":"arXiv:2402.04013"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-025-11248-0"},{"key":"ref9","first-page":"20522","article-title":"Plug & play attacks: Towards robust and flexible model inversion attacks","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Struppek"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00453"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00813"},{"key":"ref12","first-page":"1","article-title":"Imagenet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"25","author":"Krizhevsky"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref15","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref17","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. 3rd Intl. Conf. Learn. Represent. (ICLR)","author":"Simonyan"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.5555\/3298023.3298188"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01553"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.220"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298907"},{"key":"ref23","first-page":"1988","article-title":"Deep learning face representation by joint identification-verification","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"27","author":"Sun"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.713"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2781233"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01035"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00401"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/IJCB52358.2021.9484374"},{"key":"ref32","first-page":"1","article-title":"Deep leakage from gradients","volume-title":"Proc. NIPS","author":"Zhu"},{"key":"ref33","first-page":"16937","article-title":"Inverting gradients-how easy is it to break privacy in federated learning?","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Geiping"},{"key":"ref34","first-page":"5959","article-title":"Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Lam"},{"key":"ref35","first-page":"7232","article-title":"Evaluating gradient inversion attacks and defenses in federated learning","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Huang"},{"key":"ref36","first-page":"1","article-title":"Bayesian framework for gradient leakage","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Balunovic"},{"key":"ref37","first-page":"1","article-title":"Understanding training-data leakage from gradients in neural networks for image classifications","volume-title":"Proc. NeurIPS Workshop PriML","author":"Chen"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.305"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3302161"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3522792"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"ref43","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","volume-title":"Proc. 29th USENIX Conf. Secur. Symp.","author":"Jagielski"},{"key":"ref44","first-page":"5680","article-title":"Stealing part of a production language model","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Carlini"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref46","first-page":"1","article-title":"Generative adversarial nets","volume-title":"Proc. NIPS","author":"Goodfellow"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01587"},{"key":"ref48","first-page":"9706","article-title":"Variational model inversion attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Wang"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01572"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3140687"},{"key":"ref51","first-page":"1","article-title":"Language model inversion","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Morris"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i3.25442"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73411-3_7"},{"key":"ref54","article-title":"Model inversion attacks through target-specific conditional diffusion models","author":"Li","year":"2024","journal-title":"arXiv:2407.11424"},{"key":"ref55","first-page":"1291","article-title":"Updates-leak: Data set inference and reconstruction attacks in online learning","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX)","author":"Salem"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01462"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01964"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3285015"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3367808"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3381820"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3295944"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3518779"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.23919\/cje.2022.00.031"},{"key":"ref64","first-page":"68895","article-title":"Label-only model inversion attacks via knowledge transfer","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Nguyen"},{"key":"ref65","article-title":"MIBench: A comprehensive framework for benchmarking model inversion attack and defense","author":"Qiu","year":"2024","journal-title":"arXiv:2410.05159"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3372815"},{"key":"ref67","article-title":"Inverting face embeddings with convolutional neural networks","author":"Zhmoginov","year":"2016","journal-title":"arXiv:1606.04189"},{"key":"ref68","first-page":"12703","article-title":"Face reconstruction from facial templates by learning latent space of a generator network","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"36","author":"Otroshi Shahreza"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3312123"},{"key":"ref70","first-page":"5584","article-title":"Face reconstruction from face embeddings using adapter to a face foundation model","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR)","author":"Shahreza"},{"key":"ref71","first-page":"1","article-title":"Poincar\u00e9 embeddings for learning hierarchical representations","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"30","author":"Nickel"},{"key":"ref72","first-page":"1","article-title":"CGANs with projection discriminator","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Miyato"},{"issue":"11","key":"ref73","first-page":"2579","article-title":"Visualizing data using t-sne","volume":"9","author":"Van der Maaten","year":"2008","journal-title":"JMLR"},{"key":"ref74","article-title":"On convergence and stability of GANs","author":"Kodali","year":"2017","journal-title":"arXiv:1705.07215"},{"key":"ref75","first-page":"3481","article-title":"Which training methods for GANs do actually converge","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Mescheder"},{"key":"ref76","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume-title":"Proc. NIPS","author":"Ho"},{"key":"ref77","first-page":"1","article-title":"Score-based generative modeling through stochastic differential equations","volume-title":"Proc. 9th Int. Conf. Learn. Represent.","author":"Song"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.2970919"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/FG.2018.00020"},{"key":"ref82","first-page":"1","article-title":"GANs trained by a two time-scale update rule converge to a local Nash equilibrium","volume-title":"Proc. 31st Int. Conf. Neural Inf. Process. Syst. (NIPS)","author":"Heusel"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2017.227"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11095706.pdf?arnumber=11095706","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,18]],"date-time":"2025-08-18T19:41:53Z","timestamp":1755546113000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11095706\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":84,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3592542","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}