arXiv 2407.138632024-09-13cs.CV

深入探究GAN先验：利用中间特征增强模型反转攻击

A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks

Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies（广东省新型安全智能技术重点实验室）；Pengcheng Laboratory（鹏城实验室）；Augusta University（奥古斯塔大学）

Yixiang Qiu, Hao Fang, Hongyao Yu, Bin Chen, MeiKang Qiu, Shu-Tao Xia

备注：: ECCV 2024

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对现有GAN先验的模型反转攻击仅利用潜在空间、语义提取和跨模型迁移性受限的问题，提出IF-GMI方法，通过利用GAN中间特征并施加L1球约束，在多基准尤其是分布外场景下取得了最优攻击效果。

摘要：

模型反转（MI）攻击旨在利用输出信息从已发布的模型中重建涉及隐私的训练数据，这引发了人们对深度神经网络（DNNs）安全性的广泛担忧。生成对抗网络（GANs）凭借生成高保真、语义合理的逼真图像的强大能力，其最新进展显著提升了MI攻击的性能。然而，以往的MI攻击仅利用GAN先验的潜在空间来获取隐私信息，限制了其语义提取能力以及在多个目标模型和数据集间的可迁移性。为解决这一问题，我们提出了一种新方法——中间特征增强生成式模型反转（IF-GMI），该方法拆解GAN结构并利用中间模块间的特征，将优化空间从潜在编码扩展到表达能力更强的中间特征。为防止GAN先验生成不逼真的图像，我们在优化过程中施加了L1球约束。在多个基准上的实验表明，我们的方法显著优于现有方法，在多种设置下均取得了最优结果，尤其是在分布外（OOD）场景下。我们的代码可在https://github.com/final-solution/IF-GMI获取。

英文摘要：

Model Inversion (MI) attacks aim to reconstruct privacy-sensitive training data from released models by utilizing output information, raising extensive concerns about the security of Deep Neural Networks (DNNs). Recent advances in generative adversarial networks (GANs) have contributed significantly to the improved performance of MI attacks due to their powerful ability to generate realistic images with high fidelity and appropriate semantics. However, previous MI attacks have solely disclosed private information in the latent space of GAN priors, limiting their semantic extraction and transferability across multiple target models and datasets. To address this challenge, we propose a novel method, Intermediate Features enhanced Generative Model Inversion (IF-GMI), which disassembles the GAN structure and exploits features between intermediate blocks. This allows us to extend the optimization space from latent code to intermediate features with enhanced expressive capabilities. To prevent GAN priors from generating unrealistic images, we apply a L1 ball constraint to the optimization process. Experiments on multiple benchmarks demonstrate that our method significantly outperforms previous approaches and achieves state-of-the-art results under various settings, especially in the out-of-distribution (OOD) scenario. Our code is available at: https://github.com/final-solution/IF-GMI

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。