Aligning the domains in cross domain model inversion attack.

Area of Science:

• Machine Learning Security
• Deep Learning Privacy
• Adversarial Attacks

Background:

• Model Inversion Attack (MIA) aims to reconstruct training data from deep learning models.
• Existing MIAs often assume similar data distributions between private and auxiliary datasets, which is unrealistic.
• Domain divergence between datasets poses a significant challenge for effective MIA.

Purpose of the Study:

• To address the challenge of Cross Domain Model Inversion Attack where training and auxiliary data distributions diverge.
• To develop novel methods for both feature vector and prediction vector inversion in cross-domain scenarios.
• To improve the quality and accuracy of reconstructed data in MIA under domain divergence.

Main Methods:

• Proposed Domain Alignment MIA (DA-MIA) to align feature vectors of auxiliary and private data adversarially.
• Introduced Domain Alignment MIA with Auxiliary Classifier (DA-MIA-AC) for prediction vector inversion, incorporating a pre-trained and fine-tuned auxiliary classifier.
• Conducted experiments to evaluate the effectiveness of DA-MIA and DA-MIA-AC in Cross Domain Model Inversion Attack.

Main Results:

• DA-MIA significantly improved the Structural Similarity Index (SSIM) score of reconstructed images by up to 191%.
• DA-MIA-AC increased the classification accuracy of reconstructed images from 9.18% to 81.32% in the cross-domain setting.
• Both methods demonstrated effectiveness in mitigating domain divergence challenges in MIA.

Conclusions:

• DA-MIA and DA-MIA-AC are effective in performing Cross Domain Model Inversion Attacks.
• These methods successfully address the domain divergence problem, enabling better reconstruction of private data.
• The proposed techniques enhance the security and privacy analysis of deep learning models.