Research map / Adversarial robustness and security / Attacks on text and graphs
Pseudo-Private Data Guided Model Inversion Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PPDG-MI, which iteratively fine-tunes the GAN generator prior using high-quality pseudo-private samples recovered by model inversion, raising the chance of sampling real private data and improving generative model inversion attacks.
Problem
Generative model inversion attacks use a fixed GAN prior learned from public auxiliary data, which has a distribution gap to the private training data, so private samples are rarely sampled during inversion and attack accuracy is limited.
Approach
Iteratively run model inversion on the target model to get pseudo-private samples, select high-quality ones by expected prediction score, and slightly fine-tune the generator (point-wise via LPIPS, or batch-wise via MMD or conditional transport) to increase prior density around them, so the prior moves toward the private data distribution.
Key results
- On CelebA with ResNet-18, PPDG-MMD raises PPA top-1 attack accuracy from 80.80% to 88.53% (+7.73).
- Against the BiDO-HSIC defense, PPDG-MMD improves top-1 accuracy by 6.05 points over the PPA baseline.
- PPDG-vanilla improves LOM (GMI) top-1 accuracy on CelebA from 64.54% to 76.89% in the low-resolution setting.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add PPDG tuning to PPA | PPA with ResNet-18, DenseNet-121, or ResNeSt-50 · CelebA and FaceScrub, high-resolution | Acc@1: CelebA: +1.67 to +8.47; FaceScrub: values increase in all reported setups | Helped |
| Use batch-wise tuning instead of point-wise tuning | PPA + PPDG-MI · CelebA and FaceScrub, high-resolution | Acc@1 | Helped |
| Add vanilla tuning | GMI, LOM, and KEDMI · CelebA, low-resolution, VGG16 | Acc@1: GMI: +5.07 and +1.11; LOM (GMI): +12.35 and +12.59; KEDMI: +3.36 and +0.33; LOM (KEDMI): +0.73 and +4.46 | Helped |
| Add PPDG tuning against BiDO-HSIC | PPA · FaceScrub, high-resolution, ResNet-152 | Acc@1: 52.50 -> 54.65; 52.50 -> 57.40; 52.50 -> 58.55 | Helped |
| Add PPDG tuning against NegLS | PPA · FaceScrub, high-resolution, ResNet-152 | Acc@1: 11.35 -> 14.65; 11.35 -> 16.25; 11.35 -> 13.25 | Helped |
| Continue iterative fine-tuning for additional rounds (ablation) | PPDG-MI · CelebA, high-resolution, ResNet-18 | attack performance | Helped |
| Select high-quality pseudo-private samples instead of randomly selected recovered samples (ablation) | PPDG-MI density enhancement · CelebA, high-resolution, ResNet-18 | attack performance | Helped |
| Use the discriminator as an empirical density estimator to locate high-density neighbors (ablation) | PPDG-MI point-wise and batch-wise tuning · CelebA, high-resolution, ResNet-18 | attack accuracy: approximately 13-22% reduction without the discriminator | Helped |
Surprising findings
- Discriminator-based high-density neighbor search matters: removing it drops attack accuracy by roughly 13-22%.
- Direct distribution matching of the generator to pseudo-private data destroys the generator manifold on high-dimensional images, motivating the point-wise and batch-wise tuning instead.
Limitations
- Gains depend on the quality of pseudo-private samples recovered by the initial inversion round.
- Each identity is attacked with a single run due to compute cost, and attacks are limited to a few identities for black-box and label-only settings.
Experimental setup
Datasets: CelebA FaceScrub FFHQ
Benchmarks: CelebA FaceScrub FFHQ
Metrics: Acc@1 Acc@5 KNN Dist running time ratio
Baselines: PPA GMI KEDMI LOM PLG-MI RLB-MI BREP-MI BiDO-HSIC NegLS
Builds on: Plug & Play Attacks GMI KEDMI LOM BREP-MI
Closest papers by meaning
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.90)
- Generative Model Inversion Through the Lens of the Manifold Hypothesis (NeurIPS 2025 · similarity 0.87)
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.87)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.86)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.