[xucheng]

Just like any autoencoder, it is not about getting back the exact original, which is of course impossible. It is about summarizing the image in 96bits information, which is quite enough to leak the gist of the original image. For example, [1] talks about reversing Microsoft’s PhotoDNA.

> but you should be aware that "similar" to the network need not mean "similar" to a human.

With techniques like GAN and DLSS, it is quite possible to generate some photo realistic image being enough similar to the original one, or at least leaking some private information.

[1]: https://www.hackerfactor.com/blog/index.php?/archives/929-On...