Research map / Adversarial robustness and security / Attacks on text and graphs
Trap-MID: Trapdoor-based Defense against Model Inversion Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Trap-MID, which injects a blended, optimized trapdoor (label-specific triggers) into a classifier so that white-box model inversion attacks are drawn to trapdoor triggers instead of private identities.
Problem
Model inversion attacks recover private training images from well-trained classifiers; existing regularization-based defenses remain vulnerable to recent GAN-based attacks like PLG-MI, while misleading-based defenses need extra data and heavy computation.
Approach
Integrate per-class trapdoors (blended triggers optimized with a discriminator for naturalness and a trapdoor loss for effectiveness) into the target model so that MI attacks take the trapdoor as a shortcut; theory links trapdoor effectiveness and naturalness to a lower bound on posterior of poisoned data.
Key results
- Against PLG-MI on VGG-16 (CelebA), Trap-MID reduces top-1 attack accuracy from 95.81% (undefended) to 6.23% while keeping model accuracy at 81.37%.
- Against GMI, Trap-MID reaches top-1 attack accuracy 0.24% versus 14.29% undefended and best baselines around 4.92% (BiDO).
- Against LOMMA (GMI), Trap-MID lowers top-1 attack accuracy to 41.63% compared with 48.90% for NegLS and 67.60% undefended.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply Trap-MID instead of no defense | VGG-16 · CelebA, GMI | AA-1: 14.29 { $\pm$ 0.63} -> 0.24 { $\pm$ 0.19} | Helped |
| apply Trap-MID instead of no defense | VGG-16 · CelebA, KED-MI | AA-1: 56.46 { $\pm$ 2.56} -> 9.24 { $\pm$ 9.36} | Helped |
| apply Trap-MID instead of no defense | VGG-16 · CelebA, PLG-MI | AA-1: 95.81 { $\pm$ 1.63} -> 6.23 { $\pm$ 5.60} | Helped |
| apply Trap-MID instead of no defense | VGG-16 · CelebA, LOMMA (GMI) | AA-1: 67.60 { $\pm$ 4.72} -> 41.63 { $\pm$ 2.28} | Helped |
| apply Trap-MID instead of no defense | VGG-16 · CelebA, LOMMA (KED-MI) | AA-1: 79.47 { $\pm$ 3.95} -> 61.25 { $\pm$ 5.71} | Helped |
| use TeD's five-square patch patterns instead of Trap-MID's pixel-spread triggers (ablation) | VGG-16 with PLG-MI · CelebA, PLG-MI | AA-1: 6.23 { $\pm$ 1.70} -> 90.94 { $\pm$ 2.26} | Hurt |
| fix triggers instead of optimizing them (ablation) | VGG-16 with PLG-MI · CelebA, PLG-MI | AA-1: 90.92 { $\pm$ 2.36} -> 6.23 { $\pm$ 1.70} | Hurt |
| add trapdoor loss to fixed triggers (ablation) | VGG-16 with GMI · CelebA, GMI | AA-1: 0.12 { $\pm$ 0.23} -> 0.04 { $\pm$ 0.11} | No clear effect |
| add trapdoor loss to fixed triggers (ablation) | VGG-16 with KED-MI · CelebA, KED-MI | AA-1: 0.08 { $\pm$ 0.22} -> 0.50 { $\pm$ 0.36} | Hurt |
| add discriminator loss to trapdoor optimization (ablation) | VGG-16 with PLG-MI · CelebA, PLG-MI | AA-1: 89.44 { $\pm$ 2.20} -> 6.23 { $\pm$ 1.70} | Helped |
| reduce blend ratio from 0.1 to 0.03 (ablation) | VGG-16 with GMI · CelebA, GMI | AA-1: 1.36 { $\pm$ 0.81} -> 0.10 { $\pm$ 0.22} | Helped |
| reduce blend ratio from 0.1 to 0.03 (ablation) | VGG-16 with KED-MI · CelebA, KED-MI | AA-1: 34.54 { $\pm$ 1.85} -> 6.04 { $\pm$ 1.29} | Helped |
Surprising findings
- TeD's patch-based trapdoors offer little protection against PLG-MI (about 91-96% attack accuracy), showing that trigger naturalness and full-image spread matter for MI defense.
- Trap-MID is weaker against LOMMA, whose knowledge distillation can neutralize backdoor-based trapdoors, though it still outperforms other baselines.
Limitations
- Trigger initialization is random, producing larger variance in defense performance across runs.
- Requires about 1h15m training due to three gradient updates per epoch, versus cheaper baselines.
- Evaluated only on relatively simple facial recognition models trained on CelebA at 64x64 resolution.
Experimental setup
Datasets: CelebA FFHQ
Benchmarks: CelebA
Metrics: attack accuracy top-1 attack accuracy top-5 KNN distance FID classification accuracy
Baselines: MID BiDO NegLS TeD GMI KED-MI LOMMA PLG-MI
Builds on: TeD NetGuard Data-Centric Defense PLG-MI blended backdoor attack
Closest papers by meaning
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.88)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.88)
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.87)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.86)
- SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation (NeurIPS 2025 · similarity 0.86)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.