Recent works have demonstrated that machine learning models are vulnerable to
model inversion attacks, which lead to the exposure of sensitive information
contained in their training dataset. While some model inversion attacks have
been developed in the past in the black-box attack setting, in which the
adversary does not have direct access to the structure of the model, few of
these have been conducted so far against complex models such as deep neural
networks. In this paper, we introduce GAMIN (for Generative Adversarial Model
INversion), a new black-box model inversion attack framework achieving
significant results even against deep models such as convolutional neural
networks at a reasonable computing cost. GAMIN is based on the continuous
training of a surrogate model for the target model under attack and a generator
whose objective is to generate inputs resembling those used to train the target
model. The attack was validated against various neural networks used as image
classifiers. In particular, when attacking models trained on the MNIST dataset,
GAMIN is able to extract recognizable digits for up to 60% of labels produced
by the target. Attacks against skin classification models trained on the pilot
parliament dataset also demonstrated the capacity to extract recognizable
features from the targets.

介绍了一种名为 GAMIN 的黑盒模型逆向攻击框架，通过训练目标模型的替代模型和生成器，可以对包括卷积神经网络在内的复杂模型进行攻击，成功地从 MNIST 数据集和 pilot parliament 数据集的目标模型中提取出可辨别的特征。