Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff

Key points

• State-of-the-art privacy defenses, standard training techniques such as MixUp and Adversarial Training, and undefended models all leak training images at rates 1.16 to 6.59 times higher on FaceScrub under simple adaptive changes to the attack, with the largest increases among defenses reporting the strongest privacy.1
• We further show that measured leakage depends on the feature basis of the external classifier used to evaluate reconstructions: for the same reconstructed images, an adversarially trained Inception evaluator identifies the targeted identity at different rates than the standard Inception evaluator.1
• Once we adapt the attack and vary the evaluator, reconstruction leakage closely tracks adversarial robustness across recent defenses and standard training regimes, suggesting that robustness provides an attack-agnostic proxy for reconstruction vulnerability that applies far more broadly than previously theorized.1
• This raises an open question: can a practical defense reduce training-data reconstruction without paying a corresponding cost in adversarial robustness?1

Sources (1)

• [1]Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 6, 03:11 AM

  In this paper, we show that standard evaluations of high-resolution Model Inversion Attacks (MIAs) significantly underestimate training-data privacy leakage.

  State-of-the-art privacy defenses, standard training techniques such as MixUp and Adversarial Training, and undefended models all leak training images at rates 1.16 to 6.59 times higher on FaceScrub under simple adaptive changes to the attack, with the largest increases among defenses reporting the strongest privacy.

Extractive summary: sentences quoted from the sources.