Model inversion (MI) attacks aim to infer and reconstruct private training
data by abusing access to a model. MI attacks have raised concerns about the
leaking of sensitive information (e.g. private face images used in training a
face recognition system). Recently, several algorithms for MI have been
proposed to improve the attack performance. In this work, we revisit MI, study
two fundamental issues pertaining to all state-of-the-art (SOTA) MI algorithms,
and propose solutions to these issues which lead to a significant boost in
attack performance for all SOTA MI. In particular, our contributions are
two-fold: 1) We analyze the optimization objective of SOTA MI algorithms, argue
that the objective is sub-optimal for achieving MI, and propose an improved
optimization objective that boosts attack performance significantly. 2) We
analyze "MI overfitting", show that it would prevent reconstructed images from
learning semantics of training data, and propose a novel "model augmentation"
idea to overcome this issue. Our proposed solutions are simple and improve all
SOTA MI attack accuracy significantly. E.g., in the standard CelebA benchmark,
our solutions improve accuracy by 11.8% and achieve for the first time over 90%
attack accuracy. Our findings demonstrate that there is a clear risk of leaking
sensitive information from deep learning models. We urge serious consideration
to be given to the privacy implications. Our code, demo, and models are
available at
this https URL

本文提出了两个能够有效提高现有所有最优模型对抗攻击性能的解决方案：对现有最优模型对抗攻击算法的优化目标进行分析并提出了改进的优化目标，以及分析了 “过度拟合” 并提出了一种新的 “模型增强” 思想来克服这个问题。实验证明，这些提出的解决方案能使现有的最优模型对抗攻击算法准确率提高 11.8％。