Using a PRISMA-style systematic review methodology, the researchers analyzed papers from the last five years of literature, the period in which privacy attacks against machine learning evolved from academic curiosities into practical threats. Their contribution is not a single new technique but a map of the entire battlefield: a unified taxonomy of attack families, a parallel taxonomy of defenses, recommended evaluation metrics for each attack type, and a reproducibility checklist alongside an attack-by-defense protection matrix that distills the qualitative findings of hundreds of studies into a single comparative view.

The taxonomy of attacks is sobering in its breadth. Membership inference attacks ask a deceptively simple question of a model: was this specific person’s record part of your training data? First demonstrated systematically by Shokri and colleagues in 2017 and refined since through approaches that exploit overfitting, prediction sensitivity, and quantile regression, these attacks now extend even to large language models, recommender systems, graph neural networks, and diffusion models. Model inversion attacks go further, reconstructing representative images or attributes of training classes from a model’s outputs, exploiting the confidence information that models emit so freely. Model extraction attacks steal entire architectures and weights through prediction APIs, converting years of training investment into a target for intellectual property theft as well as privacy abuse.

Perhaps most alarming for the federated learning era is gradient leakage. In collaborative training settings where participants share gradient updates instead of raw data, researchers showed as early as 2019 with the Deep Leakage from Gradients work that those updates can be inverted to reconstruct training inputs almost pixel-perfectly. The survey also covers property and attribute inference, in which adversaries deduce sensitive characteristics of training populations, alongside poisoning and backdoor attacks that corrupt models from within, side-channel attacks that exploit hardware implementations, and a rapidly growing family of large language model specific leakage, including verbatim training data extraction from production models and membership inference against in-context learning.

Against this arsenal, the survey organizes defenses into coherent families. Differential privacy, introduced by Cynthia Dwork in 2006, remains the workhorse: by injecting carefully calibrated noise into gradients during training, typically through the DP-SGD algorithm of Abadi and colleagues, it provides a mathematically provable bound on how much any single individual’s data can influence the model. The literature has spawned refinements including Rényi and Gaussian differential privacy, concentrated variants, adaptive gradient clipping, and privacy accounting improvements, along with integration into generative adversarial networks, Bayesian neural networks, and stochastic gradient Langevin dynamics.

Federated learning itself constitutes a second defense pillar, allowing organizations such as hospitals to train shared models without centralizing patient records, a principle already demonstrated in real multicenter studies for glaucoma detection, skin cancer diagnosis, and medical image analysis. Yet the survey is clear that federated learning alone is not privacy protection: gradient reconstruction, membership inference, and property inference all remain viable against naive federated systems, which is why the pairing with robust and privacy-preserving aggregation rules, secure aggregation protocols, and blockchain-based verification has become an active research frontier.

At the strongest end of the guarantee spectrum sit cryptographic approaches: homomorphic encryption, which permits computation directly on encrypted data, and secure multi-party computation, which distributes computation so no party sees another’s inputs. These techniques offer mathematically rigorous confidentiality, and standardized frameworks from IEEE and ITU now exist to guide their deployment. But the survey’s comparative analysis is unambiguous about the price: cryptographic stacks impose computational and communication overheads that can be orders of magnitude higher than plaintext training, making them practical today mainly for inference workloads, smaller models, or high-stakes domains such as healthcare and finance where the value of the data justifies the cost. Hybrid architectures, such as federated learning combined with homomorphic encryption or differential privacy layered over secure aggregation, attempt to balance these trade-offs.

The authors sharpen their analysis with three case studies covering centralized image classification, federated learning, and large language models. The verdict on the current landscape is nuanced. Noise-based methods such as differential privacy remain the practical baseline, deployable at scale and increasingly efficient, but they offer only partial protection, and their privacy-utility trade-off still forces difficult choices in accuracy-sensitive applications. Cryptographic methods deliver the strongest theoretical guarantees at substantially higher cost. Most urgently, the survey identifies large language model and multimodal leakage as an under-benchmarked gap: while training data extraction and membership inference against language models have been repeatedly demonstrated, standardized evaluation of defenses in this space lags far behind the pace of model deployment.

What makes this survey particularly valuable for practitioners is its insistence on evaluation discipline. For each attack family, the authors recommend specific metrics, recognizing, for example, that membership inference success should be measured against realistic background-knowledge assumptions rather than favorable shadow-model setups, and that privacy claims must be tested against adaptive attackers rather than fixed benchmarks. The reproducibility checklist addresses a chronic weakness of the field, where attack papers and defense papers often use incompatible threat models, making headline claims difficult to compare. The attack-by-defense protection matrix gives system designers a direct way to reason about which combination of techniques addresses which threats, and where residual risk remains.

The stakes of getting this right are rising alongside regulation. Data protection laws around the world increasingly impose concrete obligations on organizations whose models memorize personal information, and the survey situates the technical landscape within this regulatory context, noting that healthcare, finance, and government deployments face the tightest constraints. For the field as a whole, the message is one of guarded optimism paired with urgency. The defensive toolkit is now rich, mathematically grounded, and increasingly practical, and surveys like this one provide the coordination infrastructure the field has lacked. But as models grow larger, more multimodal, and more deeply embedded in everyday services, the attack surface grows with them, and the gap between what can be attacked and what has been rigorously defended remains widest precisely where the data is most personal. Closing that gap, the authors suggest, will require the same systematic, benchmark-driven rigor that this survey brings to mapping the problem.

Subject of Research: Privacy-preserving methodologies and privacy attacks in deep learning

Article Title: Privacy-preserving methodologies against privacy attacks on deep learning: a survey

Article References: Ghosh, S., & Mandal, A. K. (2026). Privacy-preserving methodologies against privacy attacks on deep learning: a survey. Knowledge and Information Systems, 68(1), Article 255. https://doi.org/10.1007/s10115-026-02865-4

Image Credits: AI Generated

DOI: 10.1007/s10115-026-02865-4

Keywords: deep learning, privacy attacks, differential privacy, federated learning, homomorphic encryption, membership inference, model inversion, gradient leakage, large language models, secure multi-party computation, data privacy, machine learning security