Gradient leakage has been identified as a potential source of privacy
breaches in modern image processing systems, where the adversary can completely
reconstruct the training images from leaked gradients. However, existing
methods are restricted to reconstructing low-resolution images where data
leakage risks of image processing systems are not sufficiently explored. In
this paper, by exploiting diffusion models, we propose an innovative
gradient-guided fine-tuning method and introduce a new reconstruction attack
that is capable of stealing private, high-resolution images from image
processing systems through leaked gradients where severe data leakage
encounters. Our attack method is easy to implement and requires little prior
knowledge. The experimental results indicate that current reconstruction
attacks can steal images only up to a resolution of $128 \times 128$ pixels,
while our attack method can successfully recover and steal images with
resolutions up to $512 \times 512$ pixels. Our attack method significantly
outperforms the SOTA attack baselines in terms of both pixel-wise accuracy and
time efficiency of image reconstruction. Furthermore, our attack can render
differential privacy ineffective to some extent.

通过扩散模型并利用梯度指导的微调方法，我们提出了一种新的重建攻击方法，可通过泄露的梯度从图像处理系统中窃取私密的高分辨率图像。实验结果表明，我们的攻击方法能够成功恢复和窃取分辨率高达 512 x 512 像素的图像。此外，我们的攻击方法在图像重建的像素级准确性和时间效率方面明显优于其他攻击基准方法，并在一定程度上使差分隐私失效。

扩散模型的安全性研究：基于梯度引导的扩散模型导致严重数据泄漏

Is Diffusion Model Safe? Severe Data Leakage via Gradient-Guided  Diffusion Model

Deep learning based systems are susceptible to adversarial attacks, where a
small, imperceptible change at the input alters the model prediction. However,
to date the majority of the approaches to detect these attacks have been
designed for image processing systems. Many popular image adversarial detection
approaches are able to identify adversarial examples from embedding feature
spaces, whilst in the NLP domain existing state of the art detection approaches
solely focus on input text features, without consideration of model embedding
spaces. This work examines what differences result when porting these image
designed strategies to Natural Language Processing (NLP) tasks - these
detectors are found to not port over well. This is expected as NLP systems have
a very different form of input: discrete and sequential in nature, rather than
the continuous and fixed size inputs for images. As an equivalent model-focused
NLP detection approach, this work proposes a simple sentence-embedding
"residue" based detector to identify adversarial examples. On many tasks, it
out-performs ported image domain detectors and recent state of the art NLP
specific detectors.

本文介绍了如何将图像设计的策略移植到自然语言处理（NLP）领域，发现传统的图像领域的检测器并不适用于 NLP 领域，并提出一种基于文本嵌入的检测器来识别自然语言处理领域的对抗性样本。该检测器在许多任务上的表现优于传统的移植自图像领域的检测器和最新的 NLP 特定检测器。