Abstract
Model inversion (MI) attacks are a type of privacy attack that involves attempting to infer and reconstruct private training data by exploiting access to a deep neural networks (DNNs). Model inversion attacks have raised concerns about the potential leaking of sensitive information, such as private facial images used in the training of face recognition systems.
In this thesis, we first revisit model inversion attacks and analyze the core optimization objective of state-of-the-art (SOTA) model inversion algorithms. We argue that this objective is suboptimal for model inversion. We design a new optimization objective that better aligns with the goal of model inversion attacks. We evaluate our proposed optimization objective on a variety of model inversion benchmarks and show that it significantly boosts attack performance.
Subsequently, we explore a critical issue termed "Model Inversion Overfitting", which has not been addressed in existing methods. We demonstrate that this MI overfitting prevents the reconstructed images from accurately capturing the semantics of the training data. Inspired by the conventional issue of overfitting in machine learning tasks, we propose a novel "model augmentation" idea to overcome this issue. Our proposed method can be easily applied to all existing MI attacks to reduce overfitting and improve attack results on all standard benchmarks.
Finally, we investigate Label-only Model Inversion, which is the most challenging MI attack setting where the adversary only has access to the hard label predictions of the victim (target) model. We propose a novel label-only model inversion method that transfers knowledge from the opaque target model to surrogate models. We propose knowledge transfer based on generative modeling, and introduce a new Target model-assisted ACGAN (T-ACGAN) for effective knowledge transfer. Our method casts the challenging label-only MI problem into the more tractable white-box setting by performing SOTA white-box attacks on our learned surrogate models. We also provide analysis to support that surrogate models based on our approach are good proxies for the target model for MI.
As machine learning models become more powerful and are used in more applications, model inversion attacks become even more of a threat to privacy. Our work provides important insights into the problem of model inversion attacks and highlights the importance of considering the privacy implications when deploying machine learning models.