PaperlayerView exact revision on arXiv

Source-linked AI summary

Variational Model Inversion Attacks

Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, Alireza Makhzani

arXiv:2201.10787v1cs.LGcs.CR

TL;DR

Model inversion seeks to recover private training data from a trained classifier, while useful attacks should capture realistic and diverse class-conditional samples. This paper formulates inversion as variational inference and optimizes a generative-model-based variational family. The method improves attack accuracy, realism, and diversity across the evaluated tasks compared with baselines.

  • Problem

    Model inversion attempts to recover private training data from a trained classifier, so attacks should approximate the class-conditional data distribution without access to the dataset.

    Source: §1 · pp. 1–2

  • Method

    The paper frames model inversion as variational inference and optimizes its objective using a generative-model variational family, including a StyleGAN and deep flow model.

    Source: §1 · p. 2, §4.1 · p. 6

  • Results

    Across three tasks, VMI formulations outperform baselines in target accuracy and sample realism; the paper also reports higher accuracy and more diverse generation than existing methods.

    Source: §1 · p. 2, §5.1 · p. 8

  • Takeaways & Limitations

    The attacks were effective across three tasks and different target classifiers, while targeting the data-generating distribution rather than exact training instances.

    Source: §7 · p. 10

    The method relies on access to a relevant auxiliary dataset, an assumption the authors identify as a future direction to remove.

    Source: §6 · p. 10

Abstract

from arXiv · show

Given the ubiquity of deep neural networks, it is important that these models do not reveal information about sensitive data that they have been trained on. In model inversion attacks, a malicious user attempts to recover the private dataset used to train a supervised neural network. A successful model inversion attack should generate realistic and diverse samples that accurately describe each of the classes in the private dataset. In this work, we provide a probabilistic interpretation of model inversion attacks, and formulate a variational objective that accounts for both diversity and accuracy. In order to optimize this variational objective, we choose a variational family defined in the code space of a deep generative model, trained on a public auxiliary dataset that shares some structural similarity with the target dataset. Empirically, our method substantially improves performance in terms of target attack accuracy, sample realism, and diversity on datasets of faces and chest X-ray images.

1 Introduction

The paper frames model inversion as variational inference and reports improved attack accuracy and diversity over existing methods. It situates the problem in privacy risks from trained models and in earlier approaches that struggle with high-dimensional inputs.

1 Introduction

  • Trained models can leak information about sensitive training data, despite publishers withholding the original datasets.The paper notes model access through published models, APIs, and federated-learning settings.Source: §1 · p. 1
  • Model inversion seeks to recover a training set from a trained classifier; reconstructed face identities could be used to break into otherwise secure systems.The paper identifies face images as a relevant biometric-recognition application.Source: §1 · p. 1
  • Early model-inversion studies used input-space inference on tabular data, but these methods fail on high-dimensional inputs such as faces.The passage contrasts tabular attacks with the high-dimensional setting.Source: §1 · p. 1
  • The variational-inference perspective yields a practical objective, provides a unified framework for analyzing existing methods, and helps identify missing ingredients.The authors say it also justifies existing approaches based on deep generative models.Source: §1 · p. 2
  • On CelebA and ChestX-ray, the method achieves higher attack accuracy and more diverse generation than existing methods.The paper frames the attack as variational inference and reports improved sample quality metrics as well.Source: §1 · p. 2

2 Problem Setup: Model Inversion Attack

The setup gives the attacker a trained target classifier but not its private training set. The goal is to approximate the class-conditional data distribution so the attacker can generate realistic, accurate, and diverse samples.

2 Problem Setup: Model Inversion Attack

  • The target classifier is trained on a private dataset and maps inputs to a probability distribution over classes.The setup denotes the classifier by pTAR(y|x), with its output in the C-class probability simplex.Source: §2 · p. 2
  • The attacker's goal is to approximate the target class-conditional distribution without access to the private training set.The target classifier provides an approximation of the underlying data-generating conditional probability.Source: §2 · p. 2
  • A good attack approximates the Bayes posterior and generates realistic, accurate, and diverse samples rather than recovering exact training instances.The target is the training data's generating distribution, including distinguishing features and variation.Source: §2 · p. 3

3 Related Work

Prior work studies model inversion, classifier inversion for explanation and distillation, and pretrained generators for image applications. Deep generators address high-dimensional image attacks by restricting the search to a manifold of relevant images.

3 Related Work

  • Early model-inversion work attacked low-capacity classifiers with partial input information; input-space gradient ascent later handled tabular data but failed on deep image classifiers.Direct image-space gradient ascent can produce imperceptible and unnatural changes.Source: §3 · p. 3
  • For image attacks, deep generators trained on auxiliary data restrict the search to a manifold of relevant images; prior methods use GAN latent optimization or an autoencoder to invert classifier predictions.The cited examples include facial-recognition attacks using generic faces as auxiliary data.Source: §3 · p. 3
  • Classifier inversion has also supported model explanation and data-free distillation, though generated images can appear unnatural; deep-generator latent codes can improve realism.These approaches invert classifier activations or predictions rather than targeting privacy attacks.Source: §3 · p. 3
  • Pretrained GANs have been used for realistic image inpainting and medical-image anomaly detection, and the paper suggests its method as a possible extension to these applications.AnoGAN combines reconstruction error and discriminator loss for anomaly scoring.Source: §3 · p. 3

4 Model Inversion Attack as Variational Inference

VMI formulates model inversion as variational inference and restricts its variational family to a generator manifold learned from auxiliary data. A tunable power posterior balances accuracy and diversity, while a layer-wise StyleGAN implementation and code-space distributions connect the framework to earlier attacks.

4 Model Inversion Attack as Variational Inference

  • VMI approximates each class’s target posterior with a variational distribution constrained to the common generator’s learned manifold.The family represents q(x) through a distribution over latent codes and the generator.Source: §4 · p. 4
  • The common-generator assumption places the target distribution near the low-dimensional manifold learned from auxiliary data, even when target and auxiliary code distributions differ.The paper gives generic human faces versus celebrity faces as an example of shared structure with different distributions on the manifold.Source: §4 · p. 4
  • Increasing γ raises sample diversity at the cost of average accuracy; γ = 0 yields a point estimate, while γ → ∞ samples from the auxiliary prior.The power-posterior family adjusts the influence of the classifier likelihood relative to the auxiliary prior.Source: §4 · p. 5

4.1 The Common Generator

  • StyleGAN’s extended latent space lets VMI optimize intermediate layers, whose features contribute differently to identity and low-level image statistics.The paper reports that earlier layers generally contribute more to facial features, while later layers contribute more to lighting and shading.Source: §4.1 · p. 6, Figure 2 · p. 6

4.2 Code Space Variational Family Qz

  • The code-space variational family uses tractable deep flow models, with one model per synthesis layer; Gaussian distributions are also tested.The flow architecture is similar to Glow, adapted to treat latent vectors as 1×1 images.Source: §4.2 · p. 6

4.3 Relationships with Existing Methods

  • VMI unifies earlier attacks as special cases, including data-space point optimization and generator-based point estimation, while learning a distribution for repeated sampling.The paper characterizes general MI as γ = 0 and Generative MI as γ = 1/λ, with a point estimate for z.Source: §4.3 · pp. 6–7

5 Experiments

Across MNIST, CelebA, and ChestX-ray, the experiments evaluate VMI attacks on accuracy, sample quality, and diversity, including comparisons across generators and target classifiers. VMI generally outperforms baselines, with results also showing accuracy–diversity tradeoffs and layer-specific changes.

5 Experiments

  • Experiments cover MNIST, CelebA, and ChestX-ray, using EMNIST letters, non-target CelebA identities, and 50,000 remaining ChestX-ray images as auxiliary data.CelebA targets the 1,000 most frequent identities; ChestX-ray targets eight diseases.Source: §5 · p. 7

5.1 Results

  • Across all three tasks, VMI formulations outperform baselines in target accuracy and FID; Equation 5 with StyleGAN further improves performance on all metrics.The full VMI formulation also improves FID over pretrained generators on CelebA.Source: Table 1 · p. 8, §5.1 · p. 8

5 Experiments

  • Evaluation uses FID for aggregate sample quality and averages improved precision/recall with coverage/density as per-class diversity, addressing FID's omission of intra-class diversity.Source: §5 · p. 8

5.1 Results

  • Held-out target accuracy was 62.1% for VGG and 96.1% for ArcFace-NC; the authors report that the same VMI observations hold for both classifiers.Source: §5.1 · p. 9
  • On CelebA, StyleGAN-based VMI generally achieves a better accuracy–diversity tradeoff than DCGAN; the authors conjecture that better layer-wise disentanglement explains it.Source: Figure 6 · p. 9, §5.1 · p. 9
  • Across CelebA and ChestX-ray, optimized q(z) distributions show generally lower KL divergence and higher entropy in earlier layers, which are more modified and control face identity features.Source: §5.1 · p. 9, Figure 7 · p. 10

6 Limitation & Ethical Concerns

VMI relies on a relevant auxiliary dataset and is evaluated in the white-box setting; its GAN-based search may not transfer equally well to text or tabular data. The authors also note potential misuse and hope the work encourages privacy research and awareness.

6 Limitation & Ethical Concerns

  • VMI depends on access to a relevant auxiliary dataset, an assumption shared with prior work.Source: §6 · p. 10
  • The study uses a GAN to narrow the search space, but GANs may be less effective for text or tabular data, and only the white-box setting is studied.Grey-box and black-box extensions remain future directions.Source: §6 · p. 10
  • The authors warn that model inversion could enable breaking into secured systems and stealing private data, while hoping the work prompts privacy research and awareness.Source: §6 · p. 10

7 Conclusion

VMI combines a StyleGAN generator and deep flow model as a variational distribution to optimize a variational-inference objective for model inversion. The authors report effectiveness across three tasks and different target classifiers.

7 Conclusion

  • VMI uses a StyleGAN generator and deep flow model as its variational distribution to optimize a variational-inference objective.The framework also provides insights into existing attack methods.Source: §7 · p. 10
  • The VMI attacks were effective on three different tasks and across different target classifiers.Source: §7 · p. 10
  • Effective model inversion attacks must capture both distinguishing features and variations of the underlying identity or class.Source: §7 · p. 10

Appendix A Proofs

The proof appendix invokes a KL chain-rule identity, while the experimental-details passage states that experiments ran on Nvidia GPUs.

Appendix A Proofs

  • The proofs invoke the KL chain rule, decomposing joint-distribution divergence into expected conditional divergence plus marginal divergence.Source: Appendix A · p. 15

Appendix B Experimental Details

  • All experiments were run on Nvidia GPUs.Further details are in the open-source code.Source: Appendix B · p. 15

B.1 Datasets

The experiments use auxiliary and target datasets for MNIST, CelebA, and ChestX-ray8, and tune target classifiers by validation accuracy. The appendix reports each classifier's best validation accuracy for its task.

B.1 Datasets

  • The dataset setup uses EMNIST letters as MNIST auxiliary data, splits CelebA by identity, and uses the eight ChestX-ray8 diseases as targets.MNIST images were resized to 32x32; CelebA images were center-cropped and resized to 64x64; ChestX-ray images were resized to 128x128, and most auxiliary images were from the normal/healthy population.Source: §B.1 · p. 15

B.2 Target Classifiers

  • The MNIST target classifier, a ResNet10, reached 98.1% best validation accuracy on the 10-way classification problem.It was trained for 13 epochs using Adadelta; the EMNIST letter split served as auxiliary data.Source: §B.1 · p. 15, §B.2 · p. 16
  • The CelebA ResNet34 reached 69.0% best validation accuracy on the 1000-way classification problem.The private set contains the 1,000 most frequent identities, while the auxiliary set contains the remaining 9,177 identities.Source: §B.1 · p. 15, §B.2 · p. 16
  • The ChestX-ray8 ResNet34 reached 45.3% best validation accuracy on the 8-way classification problem.Translation was used as data augmentation.Source: §B.2 · p. 16

B.3 Evaluation Classifiers

The evaluation classifiers use separate MNIST training, a finetuned pretrained model for CelebA, and a pretrained ImageNet model finetuned for ChestX-ray8. The flow details identify Glow as the variational distribution.

B.3 Evaluation Classifiers

  • The MNIST evaluation classifier shares the target classifier's structure and hyperparameters but uses a different random seed.Source: §B.3 · p. 16
  • The CelebA evaluation classifier was finetuned from a facial-recognition checkpoint and achieved 97% accuracy on the unseen set.Source: §B.3 · p. 16
  • The ChestX-ray evaluation classifier was an ImageNet-pretrained ResNet50 finetuned on the target dataset, with 50.3% unseen-test accuracy.Source: §B.3 · p. 16

B.4 Flow Details

  • Glow defines the variational distribution q(z); latent vectors are treated as 1x1 images and squeezing layers are removed.Source: §B.4 · p. 16

Appendix C Additional Results

Appendix C directs readers to detailed attack metrics for MNIST and ChestX-ray, and to ChestX-ray attack samples organized by disease.

Appendix C Additional Results

Loading 2201.10787v1…