PaperlayerView exact revision on arXiv

Source-linked AI summary

Knowledge-Enriched Distributional Model Inversion Attacks

Si Chen, Mostafa Kahla, Ruoxi Jia, Guo-Jun Qi

arXiv:2010.04092v4cs.LG

TL;DR

White-box model inversion seeks to reconstruct training data, but attacks on DNNs have substantial room for improvement. The paper trains an inversion-specific GAN using target-model soft labels and estimates a private-data distribution for each class. The combined approach achieves state-of-the-art attack performance across datasets and models, including under public-to-private distribution shift.

  • Problem

    White-box model inversion raises privacy concerns as online repositories make entire models available, while DNN attacks still have substantial performance gaps.

    Source: §1 · p. 1

  • Method

    The method trains a GAN to distinguish real and fake samples while learning target-model labels, then estimates private-data distribution parameters for each class.

    Source: §1 · p. 2, §3.2 · p. 4, §3.3 · p. 4

  • Results

    The combined techniques achieve state-of-the-art white-box DNN attack performance across datasets and models, including under large public-to-private distribution shift.

    Source: §5 · p. 10

  • Takeaways & Limitations

    The attack models a distribution of private examples per target class rather than searching only for a single representative input.

    Source: §1 · p. 2

    Performance drops on some 64 × 64 images with poor lighting or partial faces; domain adaptation is proposed as a possible remedy.

    Source: §4.2 · p. 9

Abstract

from arXiv · show

Model inversion (MI) attacks are aimed at reconstructing training data from model parameters. Such attacks have triggered increasing concerns about privacy, especially given a growing number of online model repositories. However, existing MI attacks against deep neural networks (DNNs) have large room for performance improvement. We present a novel inversion-specific GAN that can better distill knowledge useful for performing attacks on private models from public data. In particular, we train the discriminator to differentiate not only the real and fake samples but the soft-labels provided by the target model. Moreover, unlike previous work that directly searches for a single data point to represent a target class, we propose to model a private data distribution for each target class. Our experiments show that the combination of these techniques can significantly boost the success rate of the state-of-the-art MI attacks by 150%, and generalize better to a variety of datasets and models. Our code is available at https://github.com/SCccc21/Knowledge-Enriched-DMI.

1 Introduction

White-box model inversion of DNNs remains underperforming, leaving open whether the gap reflects limited model memorization or imperfect attack design. The paper addresses attack-design limitations by adapting GAN training to target-model labels and recovering a private-data distribution for each target class.

1 Introduction

  • The paper argues that DNN inversion underperformance reflects imperfect attack design rather than a lack of private-data memorization.It cites 45% top-one identification accuracy for face images inverted from a state-of-the-art face-recognition classifier.Source: §1 · p. 1
  • Prior attacks inadequately use target-classifier information to adapt public-data knowledge and assume one reconstructed example per label.The paper instead motivates recovery of a distribution of examples for each target label.Source: §1 · p. 2
  • The proposed GAN discriminator learns from target-model labels as well as real-versus-fake samples, while attack optimization estimates private-distribution parameters.The paper reports improved state-of-the-art DNN attacks across datasets and architectures, including when public data do not overlap with private target labels.Source: §1 · p. 2

2 Related work

Prior model-inversion work ranges from MAP-based attacks on simpler models to GAN-guided attacks on DNNs, alongside research on other privacy threats and attacker settings. The proposed work differs from feature visualization by tailoring public-to-private distillation and recovering a data distribution.

2 Related work

  • Model inversion seeks to recreate training data or sensitive attributes, unlike extraction, membership-inference, and property-inference attacks.Model extraction instead seeks a substitute model that performs the target task.Source: §2 · p. 2
  • Early MAP attacks inverted linear models and later decision trees or shallow networks, but produced blurry reconstructions and failed on DNNs with three-channel images.The cited work reports success recovering genetic markers from a linear-regression model and performance above random guessing on some shallow networks.Source: §2 · p. 2
  • A prior two-pronged attack used a GAN trained on public data to search for inputs maximizing target-class responses, but did not recover private-class distributions.The public data could lack both labels and class intersection with the private data.Source: §2 · p. 2
  • Other work studied black-box inversion, including attacks on online learning that use target-model versions before and after an update.The update-focused setting aims to recover the data used for that update.Source: §2 · pp. 2–3
  • Unlike feature visualization, the proposed work tailors public-to-private knowledge distillation and formulates data-distribution synthesis for more realistic image recovery.Feature visualization also seeks images that maximally activate a target network.Source: §2 · p. 3

3 The Proposed Approach

The attack trains a GAN on public data under target-model guidance, then estimates a private-data distribution for each target class rather than a single representative input.

3.1 Overview of our attack

  • The white-box attack assumes complete access to the target network and first trains a public-data GAN before estimating the private-data distribution.Face recognition is the running example.Source: §3.1 · p. 3

3.2 Building an Inversion-Specific GAN

  • The discriminator distinguishes fake samples from public examples while also learning target-model classes from the target’s soft labels.Its K target classes are supplemented by a class for fake samples.Source: §3.2 · p. 4
  • Generator training matches discriminator features to public images and constrains generated data to have low prediction entropy under the target network.The paper motivates the entropy term by noting that private training data should receive high-confidence target-model predictions.Source: §3.2 · p. 4

3.3 Distributional Recovery

  • For identity k, the attack fits learnable µ and σ² of a Gaussian latent distribution and samples images through the trained generator.The distribution replaces a single-point reconstruction with multiple samples for the target class.Source: §3.3 · p. 4
  • Figure 2’s sampled faces vary in pose, expression, hair, and beard; their corresponding-identity softmax scores are high under the evaluation classifier.Each row represents an identity.Source: Figure 2 · p. 5, §3.3 · p. 5

4 Experiment

The section evaluates the proposed attack against GMI across datasets, target architectures, and single- and multi-target settings. It reports broad gains, while noting that public-private distribution shift reduces performance.

4.1 Experimental setting

  • Experiments span face, digit, object, and disease-prediction tasks, use disjoint public and private classes, and assess attack accuracy, KNN feature distance, and FID.The evaluation protocol averages performance over five reconstructions for each attack.Source: §4.1 · pp. 5–6

4.2 Result

  • On CelebA, our method significantly improves GMI across VGG16, ResNet152, and face.evolve, with lower performance variance across target identities.Table 1 compares attack performance across the CelebA models.Source: Table 1 · p. 7, §4.2 · p. 7
  • Figure 3 qualitatively shows better preservation of facial features by our reconstructions, which are not simply memorized public examples.It displays target images, public-domain nearest neighbors, and reconstructions from GMI and our attack.Source: §4.2 · p. 7, Figure 3 · p. 7
  • The proposed attack also outperforms GMI in recovering implicit attributes such as gender, age, and hairstyle.Table 2 measures attack accuracy with an attributes classifier trained on CelebA.Source: §4.2 · p. 7, Table 2 · p. 8
  • Across datasets, our attack outperforms GMI by a large margin, including reconstructing MNIST digit 0 where GMI tends to generate 6.Figure 4 shows generated MNIST samples for digit 0.Source: §4.2 · p. 8, Table 3 · p. 8, Figure 4 · p. 8
  • Under cross-dataset shift, both attacks lose performance but ours remains ahead; the drop is larger for FaceScrub than FFHQ.The authors suggest unsupervised domain adaptation as a possible future way to address the performance drop.Source: §4.2 · pp. 8–9, Table 4 · p. 9
  • Soft-label discrimination or distributional recovery improves attack accuracy and image quality, entropy minimization adds further gains, and combining all three performs best.The ablation study is for VGG16 trained on CelebA.Source: §4.2 · p. 9, Table 5 · p. 9
  • Joint use of IR152 or face.evolve with VGG16 raises attack accuracy by 9% or 11%, and three-model attacks exceed 0.9.The reported increases are relative to the respective single-target accuracies.Source: Table 6 · p. 9, §4.2 · p. 10

5 Conclusion

The paper proposes techniques to improve whitebox model inversion against DNNs by tailoring GAN training and explicitly modeling private-data distributions. Experiments report state-of-the-art performance across varied datasets and models, including under large public–private distribution shifts.

5 Conclusion

  • The method customizes GAN training to distill attack-relevant knowledge from public data and parameterizes the private-data distribution, with methods to estimate its parameters.The paper also extends the attack to settings with multiple models trained on the same private dataset.Source: §5 · p. 10
  • The combined techniques achieve state-of-the-art attack performance across datasets and models, including when public data has a large distributional shift from private data.Source: §5 · p. 10
  • The paper identifies improving model inversion in the blackbox setting as future work.Source: §5 · p. 10

A Extension to Multi-Target Model Inversion Attacks

The paper extends its inversion attack to multiple target models trained on the same private dataset. It combines losses across those models for GAN training and distributional recovery.

A Extension to Multi-Target Model Inversion Attacks

Loading 2010.04092v4…