Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper frames the model inversion problem as a variational inference problem, where the goal is to approximate the posterior distribution p^{tar}(x|y) from the known target classifier p^{tar}(y|x). From a class of candidate distributions q(x), the aim is to find one that is close to p^{tar}(x|y), and this is achieved by minimizing the KL-divergence between the 2 distributions. Such a formulation allows the authors to make a principled derivation of an objective function that encourages both the optimized distribution to produce images likely to be classified correctly by the target classifier, and the produced images to be realistic. It is also a unified framework for existing methods of generative model inversion.

Additionally, the authors propose using the StyleGAN architecture as a pre-trained generator for the model inversion task. This allows intermediate layers (as opposed to just the input latent code in previous formulations) of the GAN to be optimized during the search for q*, improving the expressiveness of the GAN. The StyleGAN architecture also means that the attack can focus on layers whose representations control the semantics of the final image. 

main_review: The techniques proposed in this paper are not entirely novel by themselves (e.g. distributional recovery in model inversion has been proposed in Si Chen, Ruoxi Jia, and Guo-Jun Qi. Improved techniques for model inversion attack.) However, the novelty is the theoretical framework used to motivate such techniques - framing the model inversion problem as approximating the posterior p^{tar}(x|y) distribution. 

The proposal to use StyleGAN as the generator architecture makes sense, since individual layers can potentially control different features related to identity. However, this is not particularly groundbreaking. One can imagine trying out other architectures used in unsupervised disentangled representation learning as well (e.g. InfoGAN).

In the derivation of the objective function, a number of assumptions are made. Assumption 1 assumes that a generator trained on the auxiliary dataset can capture the distribution of the target data. However, given that the target data and the auxiliary data are meant to be disjoint (should not contain the same classes), it is not immediately obvious that this assumption holds. For example, the generator trained on the ‘letters’ split of the EMNIST dataset is unlikely to capture the distribution of the ‘digits’ images in the MNIST dataset.

There are also some concerns about the reported results: in table 2, Generative MI on CelebA dataset is reported to have an accuracy of only 6%. However, in the original paper cited (Zhang 2020), the authors reported an accuracy of 44%. What is the reason for the discrepancy? If Generative MI can achieve 44% accuracy, then VMI w/DCGAN which achieves 37% accuracy is not better. The same applies to the Chest X-ray dataset which in the Zhang et al has an accuracy of 71% but is reported to be 28% in this work. Though there are some differences in training data between the implementations, it does not explain such a huge discrepancy in results.

========== after rebuttal ===========



There is large discrepancy between the results reported in this paper and the original GMI paper Zhang et al. 2020.


Given such a large discrepancy (6% reported in this submission vs 44% reported in Zhang et al. 2020), and VMI w/ DCGAN actually has poorer accuracy than the original GMI (37% vs 44%), it would be difficult for me to further increase my rating.






limitations_and_societal_impact: yes, this is discussed in sec 6.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper at hand propose a new model inversion attack that recovers the training dataset that was used to learn a supervised model. The proposed attack uses generative adversarial networks (namely a DCGAN and a StyleGAN) and variational inference to invert the probability distribution $p(y|x)$ that is learned by the classifier. The authors also describe how the proposed VMI framework can be seen as an unified framework of existing model inversion attacks. Experimental evaluation was performed on MNIST, the ChestX-ray dataset and the CelebA dataset.
main_review: REASONS FOR SCORE:

- The reported experimental results look promising, however I have some concerns about the evaluation:
    1. As the generator is in some cases also trained on the actual input distribution it would be important to also compare the reported FID scores to FID scores of the generator before the attack was performed.
    2. Related works (e.g., [2] which is also cited by the authors) also evaluate on the CIFAR10 dataset. The authors might consider extending their experiments to also include that dataset.
    3. What is the test accuracy of the target classifiers before the attack was performed?
    4. How does VMI compare to General MI in terms of computational runtime?

- The structure of the paper is reasonable, but the mathematical writing can be improved at many places: 
    1. The notation $G : z \rightarrow x$ (used, e.g., in l. 129 and l. 135) is not correct, as $x$ and $z$ are random variables and not sets.
    2. In l. 119: What is p? (I suppose $p^\text{tar}$ is meant.)
    3. In l. 143f: "$\mathcal{J}(q)$ can be rewritten as..." (I think "rewritten" is the wrong word here, because the following inequality is a lower bound!)
    4. In Eqn. 5: The authors should write $x^*$ instead of $x'$ (which would be more consistent with the notation of the rest of the paper)
    5. In l. 136: It would be better to write $p^G$ instead of $p_G$ (as it would be more consistent with $p^\text{tar}$, $p^\text{aux}$). 

- Zhang et al. [1] are able to use auxiliary information about the retrieved images, e.g., blurred versions of the images or partly occluded images. How can auxiliary information be incorporated into this framework? 

CONCLUSION:

Overall, I lean towards rejection. The proposed method sure has its merits, but the writing of the paper can be improved and the discussion of the performed experiments lacks some details.

MINOR REMARKS:

- Subsections not always in title-case (for example: "Relationships with existing methods" vs. "Model Class of q(z)")
- l.219: \gamma=0 not in math mode

REFERENCES:

[1] Zhang, Yuheng, et al. "The secret revealer: Generative model-inversion attacks against deep neural networks." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

[2] Si Chen, Ruoxi Jia, and Guo-Jun Qi. Improved techniques for model inversion attack. arXiv preprint arXiv:2010.04092, 2020.

limitations_and_societal_impact: Yes.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper frames model inversion attacks as a variational inference problem, leading to the derivation shown in Equation one. Following prior work, they also assume access to a common generator, than can be learned on auxiliary data and can capture a shared conditional distribution $p_G(x|z)$. With this assumption, they can derive a practical objective as shown in Equation 3, which maximizes (in code space) the attack accuracy (first term) and the realism / diversity of the generated samples (KL term). 

From an empirical standpoint, they experiment using both DGGAN and StyleGAN as their pretrained generator, and using either a gaussian or flow model to form their $q(z)$. They show that their model outperforms prior work across MNIST, CelebA and CXR datasets in terms of attack accuracy, FID and diversity. 

main_review: Originality:
This study offers a well-motivated framing of model inversion attacks (i.e as variational inference), and this framing offers a useful lense to unify the prior work and leads to a natural objective. This offers a novel perspective to this line of work. 

Quality:
The core claims of this paper (i.e improving the performance of model inversion attacks) are well supported by their empirical results across MNIST, CelebA and CXR. 

Clarity:
As a whole, the paper is well written and easy to follow. There were a few areas that I thought could benefit from improved exposition:

Section 4.2:
      There really isn’t enough detail here to get a concrete idea of what is being used without just looking through the code. If there isn’t enough space, this should maybe be detailed better in an appendix. 

Section 4.1:
      This description was difficult to follow. 


Significance:
This paper offers a useful new perspective on model inversion attacks, and their constriction leads to improved attacks. I think this study is useful for this ongoing work in better understanding, developing and defending against model inversion attacks. 

limitations_and_societal_impact: Yes, the authors noted their primary limitation (assumption 1) and indicated multiple useful areas for future work. They also noted the possible ethical downsides of this line of work (people doing more powerful attacks).
review_title: null

Meta-review: The paper proposes a well-motivated method with technical novelty, and good performance is shown.  
Reviewer's major concerns, including the questionable assumption and the seemingly inconsistent baseline results with the original papers, have been addressed.  
Mathematical notation should be improved in the camera-ready version.
Decision: Accept (Poster)