SoK: Privacy Attacks on Machine Learning via Explainable AI — Paper

Abstract

Machine learning explanations reveal model behavior beyond predictions, creating attack surfaces for model confidentiality and data privacy. We systematize 25 studies that exploit explanations for model extraction, membership inference, and model inversion, treating attribute inference as partial inversion. Existing work is often labeled only black- or white-box, obscuring substantial differences in what explanation signal reaches an adversary. We therefore separate model knowledge from explanation acquisition and identify five paths: target-released, attacker-derived, secondary disclosure, privileged access, and released global artifacts. Across these paths, explanations reduce extraction cost, expose membership signals through explanation statistics, recourse distance, and explanation-guided robustness, and support spatial or algebraic reconstruction of private inputs. We compare system and threat models, explanation signals, auxiliary knowledge, target models, modalities, query budgets, evaluation metrics, reported performance, and defenses. Our analysis shows that no explanation family is uniformly unsafe and no defense is uniformly effective. Risk depends on which signal is exposed, how it is acquired, which asset is targeted, and what the attacker already knows. We argue that explanation privacy should therefore be evaluated as an end-to-end disclosure problem, with defenses matched to the acquisition path and protected asset.

Authors 3

Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday

Specification

Official page: arxiv.org/abs/2609.10627
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
Arxiv announce type: cross
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
arXiv id: 2609.10627
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
Categories: cs.CR, cs.LG
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
PDF: arxiv.org/pdf/2609.10627
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
Primary category: cs.CR
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh
Published: 11 Sept 2026
Source:arXiv (Atom API + RSS)T1observed 2 h agohigh

Each value shows its source, tier and observation time. Conflicting claims are kept side by side and flagged — never averaged. How AI Atlas records facts →

Provenance

Attributed facts

9

Source tiers

T19

Freshest observation

2 h ago

Conflicts

None

No models linked to this paper yet.

Authors: Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday

As of

Rewind the record: see this entity's attributes exactly as AI Atlas knew them on a given day.

Claim history · Authors

1 claims · 1 propertiesShow all properties

Authorsauthors1

Claim history for Authors
Value	Valid from → to	Status	Source	Confidence	Extractor
Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday	11 Sept 2026 21:02 UTC → current	current	arXiv (Atom API + RSS)T1	high	deterministic

Claims are temporal and append-only: a new observation closes the previous claim (valid_to) instead of overwriting it. Conflicting claims from different sources are kept side by side and flagged — never averaged. Methodology →

11 Sept 2026
New paperPaperSoK: Privacy Attacks on Machine Learning via Explainable AI
New paper: SoK: Privacy Attacks on Machine Learning via Explainable AI
arxiv
rss.arxiv.org

Full timeline →

Source documents
Source	Document	Type	Tier	Last observed	Snapshots
arXiv (Atom API + RSS)	rss.arxiv.org/rss/cs.LG	feed	T1· Official	10 min ago	1

Tier 1 = official/primary, 2 = quality secondary, 3 = community, 4 = unverified. Every snapshot is archived; see all sources and the methodology.