Research map / Adversarial robustness and security / Attacks on text and graphs
Model Inversion Robustness: Can Transfer Learning Help?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TL-DMI, a transfer-learning defense against model inversion that freezes early layers pre-trained on public data and fine-tunes only the last layers on private data, reducing MI attack accuracy while keeping utility.
Problem
Model inversion attacks reconstruct private training data from classifiers, and existing MI defenses based on dependency-minimization regularization substantially degrade natural accuracy and are hyperparameter-sensitive.
Approach
Rather than adding regularization that conflicts with the training objective, limit the private-data fine-tuning to the last several layers (early layers frozen after public pre-training), since Fisher Information analysis shows early layers are important for MI but not for classification.
Key results
- On PPA with ResNet-18 on FaceScrub, TL-DMI reduces attack accuracy from 88.46% to 22.36% with natural accuracy 91.12% vs 94.22% undefended.
- Combined with BiDO on KEDMI/VGG16, TL-DMI cuts attack accuracy from 46.23% to 18.87% while raising accuracy from 80.35% to 82.15%.
- Across 20 MI setups spanning 9 architectures, 4 private datasets and 7 MI attacks, TL-DMI reports state-of-the-art MI robustness, reducing KEDMI top-1 attack accuracy by 13.33%-42.60%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNet-18 · PPA | AttAcc: 88.46 -> 22.36 | Helped |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNet-18 · PPA | Acc: 94.22 -> 91.12 | Hurt |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNet-34 · VMI | AttAcc: 39.40 -> 23.70 | Helped |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNet-34 · VMI | Acc: 69.27 -> 62.20 | Hurt |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on VGG-16 · LOMMA | AttAcc: 95.67 -> 75.67 | Hurt |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on MaxViT · PPA / FaceScrub | AttAcc: 79.63 -> 21.17 | Helped |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNeSt-101 · PPA / Stanford Dogs | Acc: 75.07 -> 79.54 | Helped |
| Fine-tune only the last several layers instead of the whole model (ablation) | TL-DMI on ResNeSt-101 · PPA / Stanford Dogs | AttAcc: 91.90 -> 60.88 | Helped |
| Combine TL-DMI with BiDO (ablation) | TL-DMI on the KEDMI/GMI setup · KEDMI/GMI | AttAcc: 46.23% to 18.87% | Helped |
| Combine TL-DMI with BiDO (ablation) | TL-DMI on the KEDMI/GMI setup · KEDMI/GMI | Acc: 80.35% to 82.15% | Helped |
| Reduce the number of parameters fine-tuned on private data (ablation) | TL-DMI with KEDMI · KEDMI | AttAcc: a third attack accuracy | Helped |
| Reduce the number of parameters fine-tuned on private data (ablation) | TL-DMI with PPA · PPA | AttAcc: 91.7% to 22.36% | Helped |
Surprising findings
- Less similarity between the pre-training and private dataset domains improves defense effectiveness.
Limitations
- Evaluation limited to classification; object detection and other tasks left for future work.
- Natural accuracy drops for some setups (e.g., KEDMI with VGG16 drops from 89% to 83.41%), and too few fine-tuned parameters can render the model unusable.
- Defense relies on a public pre-training dataset with no class/identity overlap with the private data.
Experimental setup
Datasets: ImageNet1K CelebA MS-CelebA-1M FFHQ FaceScrub VGGFace2 Stanford Dogs AFHQ
Benchmarks: KEDMI attack setups GMI attack setups VMI LOMMA PPA MIRROR
Metrics: natural accuracy attack accuracy (top-1/top-5) KNN distance l2 distance delta ratio FID FaceNet delta user study
Baselines: BiDO MID No Defense
Builds on: BiDO MID KEDMI GMI Fisher Information
Closest papers by meaning
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.90)
- Pseudo-Private Data Guided Model Inversion Attacks (NeurIPS 2024 · similarity 0.87)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.87)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.87)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.86)
- Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.