打破黑盒：面向分布偏移的置信度引导模型逆向攻击
Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift
AI总结：
针对黑盒模型逆向攻击中需完全访问模型且难以应对分布偏移的问题，提出基于预训练 GAN 潜空间与无梯度优化的置信度引导方法 CG-MI，在 Celeba 和 Facescrub 上显著超越现有黑盒方法。
摘要：
模型逆向攻击（MIA）旨在通过查询模型，生成反映目标类别特征的合成图像，从而推断目标分类器的私有训练数据。然而，以往研究依赖对目标模型的完全访问权限，这在真实场景中并不现实。此外，现有黑盒 MIA 假设图像先验与目标模型服从同一分布。但在面对多样化的数据分布设置时，这些方法在实施攻击时可能产生次优性能。为解决这些局限，本文提出一种置信度引导的模型逆向攻击方法 CG-MI。该方法利用公开可用的预训练生成对抗网络（GAN）的潜空间作为先验信息，并采用无梯度优化器，从而能够在黑盒设置下跨不同数据分布实现高分辨率 MIA。实验表明，在不同分布设置下，本方法在 Celeba 和 Facescrub 上分别显著超过最先进黑盒 MIA 达 49% 以上和 58% 以上。此外，本方法能够生成与白盒攻击所生成图像质量相当的高质量图像。该方法为黑盒模型逆向攻击提供了一种实用且有效的解决方案。
英文摘要：
Model inversion attacks (MIAs) seek to infer the private training data of a target classifier by generating synthetic images that reflect the characteristics of the target class through querying the model. However, prior studies have relied on full access to the target model, which is not practical in real-world scenarios. Additionally, existing black-box MIAs assume that the image prior and target model follow the same distribution. However, when confronted with diverse data distribution settings, these methods may result in suboptimal performance in conducting attacks. To address these limitations, this paper proposes a \textbf{C}onfidence-\textbf{G}uided \textbf{M}odel \textbf{I}nversion attack method called CG-MI, which utilizes the latent space of a pre-trained publicly available generative adversarial network (GAN) as prior information and gradient-free optimizer, enabling high-resolution MIAs across different data distributions in a black-box setting. Our experiments demonstrate that our method significantly \textbf{outperforms the SOTA black-box MIA by more than 49\% for Celeba and 58\% for Facescrub in different distribution settings}. Furthermore, our method exhibits the ability to generate high-quality images \textbf{comparable to those produced by white-box attacks}. Our method provides a practical and effective solution for black-box model inversion attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
