论文标题
知识增强的分布模型反演攻击
Knowledge-Enriched Distributional Model Inversion Attacks
论文作者
论文摘要
模型反转（MI）攻击旨在从模型参数重建培训数据。这种攻击引发了人们对隐私的越来越关注，尤其是考虑到越来越多的在线模型存储库。但是，现有针对深神经网络（DNN）的MI攻击有巨大的绩效空间。我们提出了一种新颖的反转特异性gan，可以更好地提炼知识，可用于从公共数据中对私人模型进行攻击。特别是，我们训练歧视者不仅区分真实和假样品，而且区分目标模型提供的软标签。此外，与以前直接搜索单个数据点以表示目标类别的工作不同，我们建议为每个目标类建模一个私人数据分布。我们的实验表明，这些技术的组合可以显着提高最先进的MI攻击的成功率150％，并更好地推广到各种数据集和模型。我们的代码可在https://github.com/scccc21/knowledge-enriched-dmi上找到。
Model inversion (MI) attacks are aimed at reconstructing training data from model parameters. Such attacks have triggered increasing concerns about privacy, especially given a growing number of online model repositories. However, existing MI attacks against deep neural networks (DNNs) have large room for performance improvement. We present a novel inversion-specific GAN that can better distill knowledge useful for performing attacks on private models from public data. In particular, we train the discriminator to differentiate not only the real and fake samples but the soft-labels provided by the target model. Moreover, unlike previous work that directly searches for a single data point to represent a target class, we propose to model a private data distribution for each target class. Our experiments show that the combination of these techniques can significantly boost the success rate of the state-of-the-art MI attacks by 150%, and generalize better to a variety of datasets and models. Our code is available at https://github.com/SCccc21/Knowledge-Enriched-DMI.
