.png){kind=icon}
.png){kind=icon}
Return
Query-Efficient Model Inversion Attacks: An Information Flow View
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3518779.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Model Inversion Attacks (MIAs) pose a certain threat to the data privacy of learning-based systems, as they enable adversaries to reconstruct identifiable features of the training distribution with only query access to the victim model. In the context of deep learning, the primary challenges associated with MIAs are suboptimal attack success rates and the corresponding high computational costs. Prior efforts assumed that the expansive search space caused these limitations, employing generative models to constrain the dimensions of the search space. Despite the initial success of these generative-based solutions, recent experiments have cast doubt on this fundamental assumption, leaving two open questions about the influential factors determining MIA performance and how to manipulate these factors to improve MIAs. To answer these questions, we reframe MIAs from the perspective of information flow. This new formulation allows us to establish a lower bound for the error probability of MIAs, determined by two critical factors: (1) the size of the search space and (2) the mutual information between input and output random variables. Through a detailed analysis of generative-based MIAs within this theoretical framework, we uncover a trade-off between the size of the search space and the generation capability of generative models. Based on the theoretical conclusions, we introduce the Query-Efficient Model Inversion Approach (QE-MIA). By strategically selecting an appropriate search space and introducing additional mutual information, QE-MIA achieves a reduction of 60% similar to 70% in query overhead while concurrently enhancing the attack success rate by 5% similar to 25%.
Keywords:
Data models
Training data
Training
Analytical models
Deep learning
Data privacy
Optimization
Mutual information
Image reconstruction
Generative adversarial networks
Model inversion attack
data privacy
deep neural network
Journal
IF:
8
Papers:
5.2K
Citations:
2.3W
Organization
View more organizations