Research map / Adversarial robustness and security / Black-box and transfer attacks
From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SMILE, a query-efficient black-box model inversion attack that trains a long-tailed surrogate model from a small set of logits and then runs NGOpt gradient-free latent search, using about 5% of prior query overhead.
Problem
Black-box model inversion attacks on face recognition models need an impractical number of queries, and surrogate models trained by distillation on few query outputs are poor because the sampled labels follow an extreme long-tail distribution.
Approach
Treat surrogate training as long-tailed recognition: train an ensemble of classifier heads on a frozen shared backbone with distribution-aware diversity loss, distillation plus pseudo-label cross-entropy, and top-k reweighting, then use the surrogate's white-box inversion as initialization for NGOpt (MetaModelOnePlusOne) black-box latent search with enlarged P-space clipping.
Key results
- SMILE outperforms existing black-box MIAs (Mirror-b, RLBMI) on most dataset and target-model settings in Table 3 while requiring about 5% of the query overhead (3.5K queries for N=1 vs 120K for Mirror-b).
- Ablation shows the full long-tailed surrogate training raises surrogate test accuracy on VGGFace2 well above the base distillation model (e.g., InceptionV1 with CelebA prior reaches 36.54/58.90 vs 5.00/11.74 at 2.5K samples).
- Under defenses (BiDO, MID, LS, TL) SMILE still outperforms existing black-box MIAs, though performance drops.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use SMILE instead of Mirror-b | black-box MIA · VGGFace2 | Acc@1: 24.49 -> 44.22±2.54 | Helped |
| use SMILE instead of RLBMI | black-box MIA · VGGFace2 | Acc@1: 42.86 -> 44.22±2.54 | Helped |
| use SMILE instead of RLBMI | black-box MIA · VGGFace2 | Acc@5: 65.31 -> 61.90±5.36 | Hurt |
| use SMILE instead of Mirror-b | black-box MIA · VGGFace2 | Acc@5: 38.78 -> 61.90±5.36 | Helped |
| use SMILE instead of RLBMI | black-box MIA · VGGFace2 | query overhead: 80K -> 3.5K | Helped |
| add DKL distillation loss (ablation) | Base surrogate training · VGGFace2, InceptionV1 surrogate; CelebA prior; 2.5K samples | surrogate accuracy: 5.00/11.74 -> 12.94/25.11 | Helped |
| add diversity loss (ablation) | DKL surrogate training · VGGFace2, InceptionV1 surrogate; CelebA prior; 2.5K samples | surrogate accuracy: 12.94/25.11 -> 16.21/29.59 | Helped |
| add DCE pseudo-hard-label loss and Top-k reweighting (ablation) | DKL+DDiversity surrogate training · VGGFace2, InceptionV1 surrogate; CelebA prior; 2.5K samples | surrogate accuracy: 16.21/29.59 -> 21.84/39.29 | Helped |
Surprising findings
- Over 65% of classes receive no samples when labeling 20K GAN-sampled images with the target model, and doubling sample size does not mitigate this long tail.
- Black-box MIA results on RLBMI appear inflated because some outputs became transferable adversarial examples that the evaluator classifies confidently.
Limitations
- Surrogate quality and attack success vary with the surrogate architecture.
- Defenses degrade black-box attack performance considerably.
Experimental setup
Datasets: CelebA FFHQ VGGFace2 VGGFace CASIA
Benchmarks: VGGFace VGGFace2 CASIA
Metrics: Acc@1 Acc@5 KNN Dist Feature Distance
Baselines: Mirror-w Mirror-b PPA RLBMI
Builds on: Mirror RIDE NGOpt GMI
Closest papers by meaning
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.88)
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.87)
- Pseudo-Private Data Guided Model Inversion Attacks (NeurIPS 2024 · similarity 0.86)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
- Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition (NeurIPS 2026 · similarity 0.85)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.