Unveiling Hidden Visual Information: A Reconstruction Attack Against Adversarial Visual Information Hiding

TL;DR

This paper reveals vulnerabilities in adversarial visual information hiding by demonstrating a dual-strategy data reconstruction attack that can effectively recover encrypted images, challenging the security of current image encryption methods.

Contribution

Introduces a novel dual-strategy DR attack incorporating generative-adversarial and augmented identity loss to improve image reconstruction from encrypted data.

Findings

The attack significantly improves reconstructed image quality.

Fewer images need to share the same key model for security.

Results validated on image recognition and re-identification benchmarks.

Abstract

This paper investigates the security vulnerabilities of adversarial-example-based image encryption by executing data reconstruction (DR) attacks on encrypted images. A representative image encryption method is the adversarial visual information hiding (AVIH), which uses type-I adversarial example training to protect gallery datasets used in image recognition tasks. In the AVIH method, the type-I adversarial example approach creates images that appear completely different but are still recognized by machines as the original ones. Additionally, the AVIH method can restore encrypted images to their original forms using a predefined private key generative model. For the best security, assigning a unique key to each image is recommended; however, storage limitations may necessitate some images sharing the same key model. This raises a crucial security question for AVIH: How many images can safely share the same key model without being compromised by a DR attack? To address this question, we introduce a dual-strategy DR attack against the AVIH encryption method by incorporating (1) generative-adversarial loss and (2) augmented identity loss, which prevent DR from overfitting -- an issue akin to that in machine learning. Our numerical results validate this approach through image recognition and re-identification benchmarks, demonstrating that our strategy can significantly enhance the quality of reconstructed images, thereby requiring fewer key-sharing encrypted images. Our source code to reproduce our results will be available soon.