Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees

Abstract: Data reconstruction attacks on trained neural networks aim to recover the data on which the network has been trained and pose a significant threat to privacy, especially if the training dataset contains sensitive information. Here, we propose a unified optimization formulation of the data reconstruction problem based on initial and trained parameter values, incorporating state-of-the-art proposals. We show that in the random feature model, this formulation provably leads to training data reconstruction with high probability, provided the network width is sufficiently large; this unprecedented finite-width result uses PAC-style bounds. Furthermore, when the data lies in a low-dimensional subspace, we show that the network width requirement for successful reconstruction can be relaxed, with bounds depending on the subspace dimension rather than the ambient dimension. For general neural network models and unknown data orientations, we propose an efficient reconstruction algorithm that approximates the low-dimensional data subspace through the change in the first-layer weights during training and uses only the last-layer weights for reconstruction, thus reducing the search space dimension and the required network width for high-quality reconstructions. Our numerical experiments on synthetic datasets and CIFAR-10 confirm that our subspace-aware reconstruction approach outperforms standard full-space techniques.

• The paper introduces an optimization framework that recovers training data using finite-width neural network properties and precise PAC-style guarantees.
• The approach exploits low-dimensional structure by reducing the search space to an estimated subspace, significantly enhancing computational efficiency.
• Empirical experiments on synthetic and CIFAR-10 datasets validate both last-layer and full-parameter reconstruction strategies.

Efficient Techniques for Data Reconstruction with Finite-Width Recovery Guarantees

Introduction and Context

The paper "Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees" (2605.06519) systematically investigates data reconstruction attacks—a class of privacy threats where the goal is to recover a model’s training data solely from its trained weights. Existing work has shown that, for certain regimes (notably infinite-width neural tangent kernel (NTK) or highly overparameterized settings), it is possible to attack a model in this way, but such results often rely on unrealistic assumptions (e.g., infinite width, known data structure, or impractically strong attackers). The authors introduce a unified optimization-based framework for reconstructing data and, crucially, provide the first finite-width, non-asymptotic theoretical recovery guarantees for structured and unstructured data. They further develop new algorithmic techniques that exploit low-dimensional data structure and empirically validate their effectiveness on both synthetic and real (CIFAR-10) datasets.

Unified Framework for Data Reconstruction

Central to the paper is an optimization-based formulation for data reconstruction. Let $f(\cdot, \theta)$ be a neural network trained on dataset $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$ with labels $y \in \mathbb{R}^n$. Define $\Delta = \theta_{\text{final}} - \theta_0$ as the parameter movement during training. The reconstruction task is to recover $X$ (or a close approximation) given access only to $\Delta$ and to the network architecture.

They consider the loss function:

$$\mathcal{L}_{\mathrm{recon}}(\hat{X},\hat{\alpha}) = \| \Delta - \sum_{i=1}^n \hat{\alpha}_i\, \nabla_\theta f(\hat{x}_i, \theta_{\text{final}}) \|_2^2,$$

where the minimization is over candidate reconstructions $(\hat{X}, \hat{\alpha})$, under normalization constraints on $\hat{x}_i$ to ensure identifiability. This framework subsumes prior methods for both NTK ([loo2023understanding]) and random features (RF, [iurada_law_2025]) regimes, unifying them as projections onto the subspace spanned by model gradients at data points.

Theoretical Recovery Guarantees for Random Feature Models

A core contribution is the first finite-width PAC-style guarantees for data reconstruction in random feature models. The main results show:

• General Unstructured Data: If the RF network width $p \gtrsim dn$, then, with high probability, the reconstruction algorithm recovers the training data up to an arbitrary (but tunably small) error, precisely quantifying the dependence on $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$0, $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$1, $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$2, and kernel smoothness.
• Low-Dimensional Data Structure: If the data lies in (or close to) an $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$3-dimensional subspace ($X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$4), the network width requirement can be relaxed to $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$5—demonstrating strong dependence on the intrinsic, not ambient, dimension.

The technical proof leverages uniform kernel approximation bounds and shows that the maximum mean discrepancy (MMD) between the distributions of the reconstructed and ground-truth data (with respect to the induced kernel) must be small for finite $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$6, translating into norm proximity between reconstructed and true samples. This is nontrivial since earlier works addressed only infinite-width limits or lacked explicit, tight bounds.

Algorithmic Developments for Structured Data

For practical scenarios where the data subspace is unknown, the authors present an efficient subspace-aware reconstruction algorithm. Key ideas include:

• Subspace Estimation: The change in first-layer weights $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$7 throughout training encodes the data subspace. The span of top right singular vectors of $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$8 provides a robust estimate, supported by the chain rule and empirical singular spectrum analysis.
• Search Space Reduction: Rather than searching in $X = [x_1,\dots,x_n] \in \mathbb{R}^{n \times d}$9 for each data point, the algorithm reduces the problem to the estimated $y \in \mathbb{R}^n$0-dimensional subspace, lowering computational burden and requisite network width.
• Use of Last-Layer Parameters: The reconstruction can be performed using only the last-layer weights, which is particularly efficient for deep networks and large-scale models.

Numerical Results

Comprehensive experiments validate the theoretical findings:

• Synthetic Data: On synthetic low-dimensional data, the subspace reconstruction method achieves equivalent or better recovery with roughly half the network width required by full-space search, and performance is essentially equal to using the (oracle) true subspace.
• CIFAR-10 Images: On real-world data (CIFAR-10, with $y \in \mathbb{R}^n$1 or $y \in \mathbb{R}^n$2 images per experiment), both 2- and 5-layer networks demonstrate high-quality recovery with the subspace-aware approach, with last-layer-only access performing nearly as well as access to all network parameters.
• Impact of Network Depth: For moderate depths and large widths, last-layer-only reconstruction surpasses all-parameters strategies in computational efficiency and accuracy.

Strong Claims and Contradictions

The paper makes and substantiates several notable claims:

• Finite-Width Achievability: It is not necessary to operate in the infinite-width regime for accurate data recovery; careful analysis reveals that finite, though large, widths suffice, quantifiable in terms of intrinsic data dimension.
• Practical Subspace Estimation: For realistic neural architectures, the first-layer weight changes encode enough information to learn the data subspace, even without explicit access to the training data or strong attacker assumptions.
• Computational Efficiency of Last-Layer Attacks: Limiting access to the last-layer is often ideal rather than restrictive: reconstruction is still effective and avoids significant computational and memory bottlenecks.

Implications and Future Directions

The theoretical and algorithmic advances in this work significantly clarify the circumstances under which parameter-space data reconstruction is feasible. The findings have several implications:

• Privacy and Security: Widespread deployment of large, overparameterized networks in privacy-sensitive applications (e.g., healthcare, biometrics) may expose raw training samples to extraction attacks, especially if models are released or weights are leaked.
• Model Selection and Public Release: Designers of neural networks should carefully consider the interplay between network width, memorization, and data vulnerability. The results argue for caution when deploying networks in the “memorization regime” (very wide, perfectly interpolating).
• Defensive Mechanisms: Understanding precise thresholds for data reconstructability can inform the development of regularization, architectural, or privacy-preserving methods that thwart such attacks. For example, operating below the $y \in \mathbb{R}^n$3 threshold or incorporating differential privacy noise at appropriate layers.
• Theory to Modern Practice: The paper opens lines for exploring data reconstruction in even more general architectures (e.g., transformers, convolutional nets), alternative attack models, and partial information settings (e.g., only some weights/gradients are accessible).

Conclusion

The authors provide essential theoretical and practical advances in the field of data reconstruction from neural network parameters. Their unified approach supplies finite-width guarantees in random feature regimes, quantifies the effects of low-dimensional structure, and proposes efficient, scalable algorithms that are empirically validated on both synthetic and real-world datasets. These results have direct implications for model privacy, the safe design of public neural network artifacts, and future directions in defensively-motivated learning theory.

Citation: "Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees" (2605.06519)