A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks

TL;DR

This paper introduces a new metric, DDCS, for evaluating sample-level privacy in model inversion attacks, and proposes a transfer learning framework to enhance attack effectiveness and defense capabilities.

Contribution

It presents DDCS, a novel evaluation metric for sample-level privacy, and a transfer learning-based framework to improve MI attack performance and defense strategies.

Findings

Many training samples are resilient against MI attacks.

The proposed framework improves attack effectiveness across multiple metrics.

DDCS can identify vulnerable samples for privacy defense.

Abstract

Model Inversion (MI) attacks, which reconstruct the training dataset of neural networks, pose significant privacy concerns in machine learning. Recent MI attacks have managed to reconstruct realistic label-level private data, such as the general appearance of a target person from all training images labeled on him. Beyond label-level privacy, in this paper we show sample-level privacy, the private information of a single target sample, is also important but under-explored in the MI literature due to the limitations of existing evaluation metrics. To address this gap, this study introduces a novel metric tailored for training-sample analysis, namely, the Diversity and Distance Composite Score (DDCS), which evaluates the reconstruction fidelity of each training sample by encompassing various MI attack attributes. This, in turn, enhances the precision of sample-level privacy assessments. Leveraging DDCS as a new evaluative lens, we observe that many training samples remain resilient against even the most advanced MI attack. As such, we further propose a transfer learning framework that augments the generative capabilities of MI attackers through the integration of entropy loss and natural gradient descent. Extensive experiments verify the effectiveness of our framework on improving state-of-the-art MI attacks over various metrics including DDCS, coverage and FID. Finally, we demonstrate that DDCS can also be useful for MI defense, by identifying samples susceptible to MI attacks in an unsupervised manner.