On the Importance of Encrypting Deep Features

TL;DR

This paper demonstrates the vulnerability of deep feature vectors to model inversion attacks in black-box settings and proposes ShuffleBits, a simple encryption method that secures features directly in production models.

Contribution

It introduces ShuffleBits, a novel, easy-to-implement encryption technique for deep features, enhancing privacy in neural network deployment.

Findings

Adversaries can infer sensitive data from deep features even with limited assumptions.

ShuffleBits effectively encrypts features, preventing data reconstruction.

The method is compatible with any neural network and easy to deploy.

Abstract

In this study, we analyze model inversion attacks with only two assumptions: feature vectors of user data are known, and a black-box API for inference is provided. On the one hand, limitations of existing studies are addressed by opting for a more practical setting. Experiments have been conducted on state-of-the-art models in person re-identification, and two attack scenarios (i.e., recognizing auxiliary attributes and reconstructing user data) are investigated. Results show that an adversary could successfully infer sensitive information even under severe constraints. On the other hand, it is advisable to encrypt feature vectors, especially for a machine learning model in production. As an alternative to traditional encryption methods such as AES, a simple yet effective method termed ShuffleBits is presented. More specifically, the binary sequence of each floating-point number gets shuffled. Deployed using the one-time pad scheme, it serves as a plug-and-play module that is applicable to any neural network, and the resulting model directly outputs deep features in encrypted form. Source code is publicly available at https://github.com/nixingyang/ShuffleBits.