Adversarial Neural Network Inversion via Auxiliary Knowledge Alignment

Abstract

The rise of deep learning technique has raised new privacy concerns about the training data and test data. In this work, we investigate the model inversion problem in the adversarial settings, where the adversary aims at inferring information about the target model's training data and test data from the model's prediction values. We develop a solution to train a second neural network that acts as the inverse of the target model to perform the inversion. The inversion model can be trained with black-box accesses to the target model. We propose two main techniques towards training the inversion model in the adversarial settings. First, we leverage the adversary's background knowledge to compose an auxiliary set to train the inversion model, which does not require access to the original training data. Second, we design a truncation-based technique to align the inversion model to enable effective inversion of the target model from partial predictions that the adversary obtains on victim user's data. We systematically evaluate our inversion approach in various machine learning tasks and model architectures on multiple image datasets. Our experimental results show that even with no full knowledge about the target model's training data, and with only partial prediction values, our inversion approach is still able to perform accurate inversion of the target model, and outperform previous approaches.

References in corpus (9)

• Deep Learning with Differential Privacy
• Understanding Neural Networks Through Deep Visualization
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Visualizing Deep Convolutional Neural Networks Using Natural Pre-Images
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Gazelle: A Low Latency Framework for Secure Neural Network Inference
• Machine Learning Models that Remember Too Much
• Privacy-preserving Prediction

Cited by in corpus (14)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Privacy in Deep Learning: A Survey
• Dreaming to Distill: Data-free Knowledge Transfer via DeepInversion
• The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks
• See through Gradients: Image Batch Recovery via GradInversion
• Deep Quaternion Features for Privacy Protection
• On the Effectiveness of Regularization Against Membership Inference Attacks
• Improving Robustness to Model Inversion Attacks via Mutual Information Regularization
• Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey
• DPlis: Boosting Utility of Differentially Private Deep Learning via Randomized Smoothing
• Vulnerability of Face Recognition Systems Against Composite Face Reconstruction Attack
• 10 Security and Privacy Problems in Large Foundation Models
• Rotation-Equivariant Neural Networks for Privacy Protection
• Reconstructing Network Inputs with Additive Perturbation Signatures