Model-based attacks can infer training data information from deep neural
network models. These attacks heavily depend on the attacker's knowledge of the
application domain, e.g., using it to determine the auxiliary data for
model-inversion attacks. However, attackers may not know what the model is used
for in practice. We propose a generative adversarial network (GAN) based method
to explore likely or similar domains of a target model -- the model domain
inference (MDI) attack. For a given target (classification) model, we assume
that the attacker knows nothing but the input and output formats and can use
the model to derive the prediction for any input in the desired form. Our basic
idea is to use the target model to affect a GAN training process for a
candidate domain's dataset that is easy to obtain. We find that the target
model may distract the training procedure less if the domain is more similar to
the target domain. We then measure the distraction level with the distance
between GAN-generated datasets, which can be used to rank candidate domains for
the target model. Our experiments show that the auxiliary dataset from an MDI
top-ranked domain can effectively boost the result of model-inversion attacks.

本文提出了一种基于生成对抗网络的方法来推断目标模型的可能或相似域，即模型域推断攻击（Model Domain Inference Attack）。通过生成数据集的距离来排名候选领域，从而帮助攻击者提高模型转化攻击的效果。

基于 GAN 的领域推断攻击

GAN-based Domain Inference Attack

Through using only a well-trained classifier, model-inversion (MI) attacks
can recover the data used for training the classifier, leading to the privacy
leakage of the training data. To defend against MI attacks, previous work
utilizes a unilateral dependency optimization strategy, i.e., minimizing the
dependency between inputs (i.e., features) and outputs (i.e., labels) during
training the classifier. However, such a minimization process conflicts with
minimizing the supervised loss that aims to maximize the dependency between
inputs and outputs, causing an explicit trade-off between model robustness
against MI attacks and model utility on classification tasks. In this paper, we
aim to minimize the dependency between the latent representations and the
inputs while maximizing the dependency between latent representations and the
outputs, named a bilateral dependency optimization (BiDO) strategy. In
particular, we use the dependency constraints as a universally applicable
regularizer in addition to commonly used losses for deep neural networks (e.g.,
cross-entropy), which can be instantiated with appropriate dependency criteria
according to different tasks. To verify the efficacy of our strategy, we
propose two implementations of BiDO, by using two different dependency
measures: BiDO with constrained covariance (BiDO-COCO) and BiDO with
Hilbert-Schmidt Independence Criterion (BiDO-HSIC). Experiments show that BiDO
achieves the state-of-the-art defense performance for a variety of datasets,
classifiers, and MI attacks while suffering a minor classification-accuracy
drop compared to the well-trained classifier with no defense, which lights up a
novel road to defend against MI attacks.

本文提出了一种双边依赖优化策略，旨在同时最小化潜在表示和输入之间的依赖关系，同时最大化潜在表示和输出之间的依赖关系，用作一种普遍适用的正则项，以防御模型反演攻击，在多个数据集，分类器和攻击中达到了最先进的防御性能。

双向依赖优化：抵御模型反演攻击

Bilateral Dependency Optimization: Defending Against Model-inversion  Attacks

This paper studies model-inversion attacks, in which the access to a model is
abused to infer information about the training data. Since its first
introduction, such attacks have raised serious concerns given that training
data usually contain privacy-sensitive information. Thus far, successful
model-inversion attacks have only been demonstrated on simple models, such as
linear regression and logistic regression. Previous attempts to invert neural
networks, even the ones with simple architectures, have failed to produce
convincing results. We present a novel attack method, termed the generative
model-inversion attack, which can invert deep neural networks with high success
rates. Rather than reconstructing private training data from scratch, we
leverage partial public information, which can be very generic, to learn a
distributional prior via generative adversarial networks (GANs) and use it to
guide the inversion process. Moreover, we theoretically prove that a model's
predictive power and its vulnerability to inversion attacks are indeed two
sides of the same coin---highly predictive models are able to establish a
strong correlation between features and labels, which coincides exactly with
what an adversary exploits to mount the attacks. Our extensive experiments
demonstrate that the proposed attack improves identification accuracy over the
existing work by about 75\% for reconstructing face images from a
state-of-the-art face recognition classifier. We also show that differential
privacy, in its canonical form, is of little avail to defend against our
attacks.

本文介绍了一种新型攻击方法 —— 生成模型反演攻击，它可以显著地提高逆转深度神经网络的准确率，攻击者使用部分公共信息学习分布先验，引导逆转过程，并且通过实验证明了差分隐私在该攻击下的防御效果有限。