A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks

TL;DR

This paper introduces IF-GMI, a novel model inversion attack leveraging intermediate features of GANs, significantly improving privacy data reconstruction and robustness across models and datasets.

Contribution

The paper proposes a new method that exploits intermediate features in GANs for model inversion, extending the optimization space beyond latent codes for better attack performance.

Findings

Outperforms previous MI attack methods

Achieves state-of-the-art results on multiple benchmarks

Effective in out-of-distribution scenarios

Abstract

Model Inversion (MI) attacks aim to reconstruct privacy-sensitive training data from released models by utilizing output information, raising extensive concerns about the security of Deep Neural Networks (DNNs). Recent advances in generative adversarial networks (GANs) have contributed significantly to the improved performance of MI attacks due to their powerful ability to generate realistic images with high fidelity and appropriate semantics. However, previous MI attacks have solely disclosed private information in the latent space of GAN priors, limiting their semantic extraction and transferability across multiple target models and datasets. To address this challenge, we propose a novel method, Intermediate Features enhanced Generative Model Inversion (IF-GMI), which disassembles the GAN structure and exploits features between intermediate blocks. This allows us to extend the optimization space from latent code to intermediate features with enhanced expressive capabilities. To prevent GAN priors from generating unrealistic images, we apply a L1 ball constraint to the optimization process. Experiments on multiple benchmarks demonstrate that our method significantly outperforms previous approaches and achieves state-of-the-art results under various settings, especially in the out-of-distribution (OOD) scenario. Our code is available at: https://github.com/final-solution/IF-GMI