Adversarial Neural Network Inversion via Auxiliary Knowledge Alignment
By Ziqi Yang, Ee-Chien Chang, Zhenkai Liang. 2019
71 citations recorded by the source corpus.
The rise of deep learning technique has raised new privacy concerns about the training data and test data. In this work, we investigate the model inversion problem in the adversarial settings, where the adversary aims at inferring information about the target model's training data and test data from the model's prediction values. We develop a solution to train a second neural network that acts as the inverse of the target model to perform the inversion. The inversion model can be trained with black-box accesses to the target model. We propose two main techniques towards training the inversion model in the adversarial settings. First, we leverage the adversary's background knowledge to compose an auxiliary set to train the inversion model, which does not require access to the original training data. Second, we design a truncation-based technique to align the inversion model to enable effective inversion of the target model from partial predictions that the adversary obtains on victim user's data. We systematically evaluate our inversion approach in various machine learning tasks and model architectures on multiple image datasets. Our experimental results show that even with no full knowledge about the target model's training data, and with only partial prediction values, our inversion approach is still able to perform accurate inversion of the target model, and outperform previous approaches.
Subfields: Artificial Intelligence
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Arun Mallya
- Bo Li
- Hongxu Yin
- Jan Kautz
- José Manuel Álvarez
- Arash Vahdat
- Tinne Tuytelaars
- Pavlo Molchanov
Citations in the corpus
- Privacy in Deep Learning: A Survey (2020, neutral): “Inference Parameter Inference Property Inference Access to Model Access to Model Output Membership Inference [13] # # # # Blackbox Logits Measuring Membership Privacy[35] # # # # Blackbox Logits ML-Leaks[36] # # # # Blackbox Logits The Natural Auditor [37] # # # # Blackbox Label LOGAN [38] # # # # B”
- Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion (2019, background): “Follow-up works have refined and expanded the approach to new threat scenarios such as collaborative learning and membership detection [19, 64, 68].”
- The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks (2019, background): “[24] proposed to train a separate network that swaps the input and output of the target network to perform MI attacks.”
- See through Gradients: Image Batch Recovery via GradInversion (2021, background): “Follow-up works [20, 45, 47] scale to new threat scenarios, but remain limited to shallow networks.”