Abstract:Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at <a class="link-external link-https" href="https://github.com/ntuaislab/Trap-MID" rel="external noopener nofollow">this https URL</a>.

What problem does this paper attempt to address?

### The Problem Addressed by the Paper This paper aims to address the issue of Model Inversion (MI) attacks in Deep Neural Networks (DNNs). MI attacks pose a serious threat to privacy by recovering the training data distribution from a well-trained model. Existing defense methods typically rely on regularization techniques to reduce information leakage, but these methods remain vulnerable to recent MI attacks. This paper proposes a Trapdoor-based Model Inversion Defense method (Trap-MID), which integrates trapdoors into the model to mislead MI attacks. ### Specific Problem Description 1. **Privacy Leakage Issue**: - Deep neural networks may involve sensitive data during training, such as facial recognition and medical diagnosis, raising privacy concerns. - MI attacks can recover private data of specific categories from a well-trained model. For example, an attacker can recover training images of specific identities from a facial recognition system. 2. **Limitations of Existing Defense Methods**: - Existing defense methods mainly reduce information leakage through techniques like Differential Privacy (DP), regularization, or manipulating the loss landscape, but these methods are still vulnerable to the latest MI attacks. - Some recent defense methods attempt to mislead MI attacks by guiding the model to classify fake samples into protected categories. However, these methods require additional data and significant computational overhead and usually can only protect single or limited categories. 3. **Proposed New Method**: - The Trap-MID method proposed in this paper misleads MI attacks by integrating trapdoors into the model. Trapdoors predict specific labels when specific triggers are injected into the input data, causing MI attacks to extract trapdoor triggers instead of private data. - The authors provide theoretical analysis to explore the impact of the effectiveness and naturalness of trapdoors on misleading MI attacks and demonstrate the defense performance of Trap-MID against various MI attacks through experiments. ### Main Contributions 1. **Proposed a Trapdoor-based Defense Method**: - By misleading MI attacks, Trap-MID can effectively protect privacy without adding significant computational overhead or additional data. - Experimental results show that Trap-MID exhibits state-of-the-art defense performance against various MI attacks. 2. **Established a Connection Between MI Defense and Trapdoor Injection Techniques**: - The authors are the first to establish a connection between MI defense and trapdoor injection techniques and theoretically discuss the importance of the effectiveness and naturalness of trapdoors in misleading MI attacks. 3. **Improved Computational and Data Efficiency**: - Compared to previous defense methods, Trap-MID performs better in terms of computational and data efficiency, not requiring significant computational overhead or additional data. ### Summary This paper proposes a Trapdoor-based defense method (Trap-MID) to address the issue of Model Inversion attacks in deep neural networks. By integrating trapdoors into the model, Trap-MID can effectively mislead MI attacks, reducing the risk of privacy leakage. Experimental results show that Trap-MID performs excellently against various MI attacks, with high computational and data efficiency.

Trap-MID: Trapdoor-based Defense against Model Inversion Attacks

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

NetGuard: Protecting Commercial Web APIs from Model Inversion Attacks Using GAN-generated Fake Samples

A GAN-Based Defense Framework Against Model Inversion Attacks.

Re-thinking Model Inversion Attacks Against Deep Neural Networks

Improving Robustness to Model Inversion Attacks via Mutual Information Regularization

Defending against Model Inversion Attacks via Random Erasing

Inversion-guided Defense: Detecting Model Stealing Attacks by Output Inverting

Model Inversion Attacks: A Survey of Approaches and Countermeasures

Model Inversion Robustness: Can Transfer Learning Help?

Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses

CALoR: Towards Comprehensive Model Inversion Defense

Model Inversion Attack via Dynamic Memory Learning

Eliminating Backdoors in Neural Code Models via Trigger Inversion

MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense

C2FMI: Corse-to-Fine Black-box Model Inversion Attack

Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift

Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attacks

Model Inversion Attacks Through Target-Specific Conditional Diffusion Models

Towards Reliable and Efficient Backdoor Trigger Inversion Via Decoupling Benign Features.

On the Vulnerability of Skip Connections to Model Inversion Attacks