Model inversion attacks (MIAs) seek to infer the private training data of a
target classifier by generating synthetic images that reflect the
characteristics of the target class through querying the model. However, prior
studies have relied on full access to the target model, which is not practical
in real-world scenarios. Additionally, existing black-box MIAs assume that the
image prior and target model follow the same distribution. However, when
confronted with diverse data distribution settings, these methods may result in
suboptimal performance in conducting attacks. To address these limitations,
this paper proposes a \textbf{C}onfidence-\textbf{G}uided \textbf{M}odel
\textbf{I}nversion attack method called CG-MI, which utilizes the latent space
of a pre-trained publicly available generative adversarial network (GAN) as
prior information and gradient-free optimizer, enabling high-resolution MIAs
across different data distributions in a black-box setting. Our experiments
demonstrate that our method significantly \textbf{outperforms the SOTA
black-box MIA by more than 49\% for Celeba and 58\% for Facescrub in different
distribution settings}. Furthermore, our method exhibits the ability to
generate high-quality images \textbf{comparable to those produced by white-box
attacks}. Our method provides a practical and effective solution for black-box
model inversion attacks.

本文提出了一种称为 CG-MI 的置信度引导模型反演攻击方法，利用预训练的可公开获取的生成对抗网络（GAN）的潜在空间作为先验信息和无梯度优化器，在不同数据分布的黑盒设置中实现了高分辨率的模型反演攻击。实验证明，我们的方法在 Celeba 和 Facescrub 的不同分布设置中，比 SOTA 黑盒 MIA 的攻击效果提高了超过 49％和 58％。此外，我们的方法能够生成与白盒攻击产生的质量相当的高质量图像。我们的方法为黑盒模型反演攻击提供了实用而有效的解决方案。