Does CLIP Know My Face?

Abstract

With the rise of deep learning in various applications, privacy concerns around the protection of training data have become a critical area of research. Whereas prior studies have focused on privacy risks in single-modal models, we introduce a novel method to assess privacy for multi-modal models, specifically vision-language models like CLIP. The proposed Identity Inference Attack (IDIA) reveals whether an individual was included in the training data by querying the model with images of the same person. Letting the model choose from a wide variety of possible text labels, the model reveals whether it recognizes the person and, therefore, was used for training. Our large-scale experiments on CLIP demonstrate that individuals used for training can be identified with very high accuracy. We confirm that the model has learned to associate names with depicted individuals, implying the existence of sensitive information that can be extracted by adversaries. Our results highlight the need for stronger privacy protection in large-scale models and suggest that IDIAs can be used to prove the unauthorized use of data for training and to enforce privacy laws.

Published in the Journal of Artificial Intelligence Research (JAIR)

References in corpus (22)

• Adam: A Method for Stochastic Optimization
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Training language models to follow instructions with human feedback
• Hierarchical Text-Conditional Image Generation with CLIP Latents
• Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding
• Flamingo: a Visual Language Model for Few-Shot Learning
• Zero-Shot Text-to-Image Generation
• LAION-5B: An open large-scale dataset for training next generation image-text models
• GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models
• Reproducible scaling laws for contrastive language-image learning
• LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairs
• Scaling Autoregressive Models for Content-Rich Text-to-Image Generation
• Extracting Training Data from Diffusion Models
• Variational Model Inversion Attacks
• Membership Inference Attacks Against Text-to-image Generation Models
• Adversarial Attacks on Image Generation With Made-Up Words
• This Person (Probably) Exists. Identity Membership Attacks Against GAN Generated Faces
• User-Level Membership Inference Attack against Metric Embedding Learning
• Membership Inference of Diffusion Models
• Everything About You: A Multimodal Approach towards Friendship Inference in Online Social Networks

Cited by in corpus (3)

• Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics
• Adversarial Attacks in Multimodal Systems: A Practitioner's Survey
• Multimodal Privacy-Preserving Entity Resolution with Fully Homomorphic Encryption