Abstract:The widely applications of deep learning have raised concerns about the privacy issues in deep neural networks. Model inversion attack aims to reconstruct specific details of each private training sample from a given neural network. However, limited to the availability of useful information, reconstructing distinctive private training samples still has a long way to go. In this paper, the requirements to reconstruct distinctive private training samples are investigated using information entropy. We find that more information is needed to reconstruct distinctive samples and propose to use the often ignored hidden information to achieve this goal. To better utilize this information, Amplified-MIA is proposed. In Amplified-MIA, a nonlinear amplification layer is inserted between the target network and the attack network. This nonlinear amplification layer further contains a nonlinear amplification function. The definition of the nonlinear amplification function is given and the effect of this nonlinear amplification function on the entropy of the hidden information is derived. The proposed nonlinear amplification function can amplify the small prediction vector entries and enlarge the differences between different prediction vectors in the same class. Thus, the hidden information can be better utilized by the attack network and distinctive private samples can be reconstructed. Various experiments are performed to empirically analyze the effects of the nonlinear amplification function on the reconstruction results. The reconstruction results on three different datasets show that the proposed Amplified-MIA outperforms existing works on almost all tasks. Especially, it achieves up to 68% performance gain of the Pixel Accuracy score over the direct inversion method on the hardest face reconstruction task.

An Evolutionary Attack for Revealing Training Data of DNNs with Higher Feature Fidelity

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

A GAN-Based Defense Framework Against Model Inversion Attacks.

Model Inversion Attack via Dynamic Memory Learning

Variational Model Inversion Attacks

Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses

Analysis and Utilization of Hidden Information in Model Inversion Attacks.

Re-thinking Model Inversion Attacks Against Deep Neural Networks

Boosting Model Inversion Attacks with Adversarial Examples

Model Inversion Attacks Through Target-Specific Conditional Diffusion Models

Evolution Attack On Neural Networks

Art-Attack: Black-Box Adversarial Attack via Evolutionary Art

Model Inversion Attacks: A Survey of Approaches and Countermeasures

Distributional Black-Box Model Inversion Attack with Multi-Agent Reinforcement Learning

A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks

Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks

Exploring User-level Gradient Inversion with a Diffusion Prior

An Evolutionary-Based Black-Box Attack to Deep Neural Network Classifiers.

Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift

High-Fidelity Gradient Inversion in Distributed Learning

Reinforcement Learning-Based Black-Box Model Inversion Attacks