Research map / Adversarial robustness and security / Attacks on text and graphs
A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DDCS, a target-sample-oriented metric for model inversion attacks, and a GAN augmentation framework that transfers a pretrained StyleGAN2 with entropy loss regularized by natural gradient descent to improve coverage and FID of MI attacks.
Problem
Existing model inversion (MI) evaluation metrics focus on label-level privacy and distributional similarity, which are sensitive to redundant samples and fail to measure per-sample reconstruction; current MI attacks also leave many training samples unreconstructed.
Approach
A target-dataset-oriented composite score (DDCS) that matches each target sample to its nearest reconstructed sample via LPIPS and averages reciprocal reconstruction distances, plus a transfer-learning GAN augmentation that applies entropy loss with a natural-gradient projection (Hessian of squared LPIPS) to avoid artifacts.
Key results
- On UMDFaces with VGG16BN, Ours improves DDCS_avg to 0.6772 vs 0.5046 for PPA, with coverage 0.3907 vs 0.3213 and FID 47.64 vs 48.35.
- Across four victim architectures on UMDFaces, Ours achieves the best FID and coverage and the best DDCS in every case (e.g., IR50-SE DDCS_avg 0.7017 vs 0.5146 for PPA).
- On Stanford Dogs, Ours improves DDCS_avg for VGG16BN from 0.1777 (PPA) to 0.2787, though PPA keeps slightly higher Acc@1 and lower Dist.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · UMDFaces, VGG16BN | Coverage: 0.3213 -> 0.3907 | Helped |
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · UMDFaces, VGG16BN | FID: 48.35 -> 47.64 | Helped |
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · UMDFaces, VGG16BN | DDCS_avg: 0.5046 -> 0.6772 | Helped |
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · Stanford Dogs, VGG16BN | Coverage: 0.0569 -> 0.0782 | Helped |
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · Stanford Dogs, VGG16BN | FID: 57.63 -> 57.21 | Helped |
| Apply GAN augmentation with transfer learning and natural-gradient-projected entropy loss instead of PPA | StyleGAN2 MI attack · Stanford Dogs, VGG16BN | DDCS_avg: 0.1777 -> 0.2787 | Helped |
| Project the entropy-loss gradient using natural gradient descent (ablation) | StyleGAN trained with entropy loss · Generated-image quality | FID: 33.73 to 10.98 | Helped |
Surprising findings
- Existing MI attacks leave most training samples unmatched; DDCS shows coverage of only about 16-39% of target samples on UMDFaces.
- Entropy loss (HLoss) integrated with StyleGAN degrades image quality, with FID rising to 64-79 on UMDFaces, and it underperforms PPA on all metrics.
Limitations
- Accuracy and feature distance do not reflect the gains of the proposed method, so the comparison relies on newly proposed metrics.
- Experiments are limited to face recognition and dog breed classification with white-box attacks.
- Generated sets contain many redundant samples, which the authors note inflates FID.
Experimental setup
Datasets: UMDFaces CelebA-HQ Stanford Dogs Tsinghua Dogs LSUN-Dogs
Benchmarks: UMDFaces Stanford Dogs
Metrics: DDCS_avg DDCS_best Acc@1 Acc@5 feature distance FID coverage
Baselines: PPA HLoss (KEDMI entropy loss)
Builds on: KEDMI Plug & Play Attack StyleGAN2 LPIPS
Closest papers by meaning
- Pseudo-Private Data Guided Model Inversion Attacks (NeurIPS 2024 · similarity 0.90)
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.90)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.88)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.88)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.88)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.