Abstract
With the development of machine learning (ML) technology, various online intelligent services use ML models to provide predictions. However, attacker may obtain privacy information of the model through interaction with online services. Model inversion attacks (MIA) is a privacy stealing method that utilizes ML models output values to reconstruct input values. In particular, an indispensable step of implementing proposed MIA approaches is that the attacker query the auxiliary datasets entirely. However, in reality, it will be inefficient to transfer huge datasets to online services to get prediction values of inference models. More seriously, the huge transmission may cause the administrator’s active defense. In this paper, we propose a novel MIA scheme which reduce queries on auxiliary datasets, by utilizing latent information of primitive models as high dimension features. We systematically evaluate our inversion approach in convolutional neural networks (CNN) classifier on LFW, pubFig, MNIST datasets. The experimental results show that even with a few queries of the inference model, our inversion approach still work accurately and outperforms than previous approaches. As conclusion, our method proves that implementing MIA does not require querying all auxiliary data on the classifier model, making it more difficult for the administrator to defend against the attack and elicit more investigations for privacy-preserving.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
Amazon: Machine learning at aws. https://aws.amazon.com/machine-learning/
apple: Arfaceanchor.blendshapelocation. https://developer.apple.com/
Dalal, N., Triggs, B.: Histograms of oriented gradients for human detection. In: 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2005), vol. 1, pp. 886–893. IEEE (2005)
Dosovitskiy, A., Brox, T.: Inverting visual representations with convolutional networks. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4829–4837 (2016)
Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1322–1333 (2015)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770–778 (2016)
Huang, G.B., Mattar, M., Berg, T., Learned-Miller, E.: Labeled faces in the wild: a database forstudying face recognition in unconstrained environments (2008)
Kataoka, H., Iwata, K., Satoh, Y.: Feature evaluation of deep convolutional neural networks for object recognition and detection. arXiv preprint arXiv:1509.07627 (2015)
Krizhevsky, A., Sutskever, I., Hinton, G.E.: Imagenet classification with deep convolutional neural networks. Commun. ACM 60(6), 84–90 (2017)
Kumar, N., Berg, A.C., Belhumeur, P.N., Nayar, S.K.: Attribute and simile classifiers for face verification. In: 2009 IEEE 12th International Conference on Computer Vision, pp. 365–372. IEEE (2009)
LeCun, Y.: The mnist database of handwritten digits (1998). http://yann.lecun.com/exdb/mnist/
Lowe, D.G.: Distinctive image features from scale-invariant keypoints. Int. J. Comput. Vis. 60(2), 91–110 (2004)
Mahendran, A., Vedaldi, A.: Understanding deep image representations by inverting them. In: 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 5188–5196 (2015)
Nash, C., Kushman, N., Williams, C.K.I.: Inverting supervised representations with autoregressive neural density models. In: The 22nd International Conference on Artificial Intelligence and Statistics, pp. 1620–1629 (2018)
Oliva, A., Torralba, A.: Modeling the shape of the scene: a holistic representation of the spatial envelope. Int. J. Comput. Vis. 42(3), 145–175 (2001)
Oquab, M., Bottou, L., Laptev, I., Sivic, J.: Learning and transferring mid-level image representations using convolutional neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1717–1724 (2014)
Sharif Razavian, A., Azizpour, H., Sullivan, J., Carlsson, S.: CNN features off-the-shelf: an astounding baseline for recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 806–813 (2014)
Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. In: International Conference on Learning Representations (ICLR 2015) (2015)
tencent: facerecognition. https://cloud.tencent.com/product/
Várkonyi-Kóczy, A.R.: Observer-based iterative fuzzy and neural network model inversion for measurement and control applications. In: Rudas, I.J., Fodor, J., Kacprzyk, J. (eds.) Towards Intelligent Engineering and Information Technology. SCI 2009, vol. 243, pp. 681–702. Springer, Berlin (2009). https://doi.org/10.1007/978-3-642-03737-5_49
Wei, Y., et al.: Cnn: Single-label to multi-label. arXiv preprint arXiv:1406.5726 (2014)
Yang, Z., Zhang, J., Chang, E.C., Liang, Z.: Neural network inversion in adversarial setting via background knowledge alignment. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS 2019), pp. 225–240 (2019)
Zhang, T.: Solving large scale linear prediction problems using stochastic gradient descent algorithms. In: Proceedings of the Twenty-First International Conference on Machine Learning, p. 116 (2004)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Mo, K., Huang, T., Xiang, X. (2020). Querying Little Is Enough: Model Inversion Attack via Latent Information. In: Chen, X., Yan, H., Yan, Q., Zhang, X. (eds) Machine Learning for Cyber Security. ML4CS 2020. Lecture Notes in Computer Science(), vol 12487. Springer, Cham. https://doi.org/10.1007/978-3-030-62460-6_52
Download citation
DOI: https://doi.org/10.1007/978-3-030-62460-6_52
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-62459-0
Online ISBN: 978-3-030-62460-6
eBook Packages: Computer ScienceComputer Science (R0)