SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 4 shows the reconstruction attack performance of our methods. In general, our methods demonstrate optimal and second-best performance across nearly all split points, whether compared with Optimization-based or Learning-based DRAs. Specifically, when the split point is set to Block3, our Optimization-based GLASS reduces LPIPS from 0.298 to 0.140 compared to LM; Our Learning-based GLASS++ enhances the SSIM from 0.685 to 0.833 compared to IN (the full results are in Appendix C). When the split point is located at a deeper Block5, GLASS exhibits a remarkable ability in reconstructing faces with features highly similar to the ground truth. In contrast, other Optimization-based DRAs fail to reveal any valid sensitive information. We attribute this superior performance to two main factors: the wealth of prior knowledge embedded in the pre-trained StyleGAN model and the powerful feature search capability brought by our methods. Note that LM achieves optimal NIQE on Block5, but we observe that its reconstructed images are almost noisy. We analyze that this was due to the instability of NIQE on small-size images, which resulted in extremely poor attack results but good values. Therefore, we exclude NIQE from the experiments in subsection 4.3.
(a) Optimization-based DRAs
(b) Learning-based DRAs
Figure 4: White-Box DRAs against the original model under different split points.
4.3 Defense Mechanisms Assessment
Reconstruction Performance under Defense Mechanisms. The quantitative metrics in Table[1] demonstrate the remarkable effectiveness of our methods in breaching all defenses, surpassing the performance of other baseline attacks even when the accuracy of the target model declines due to defense. Our GLASS++ and GLASS consistently yield the optimal and the second-best results on most of the metrics. Even against state-of-the-art defense mechanisms like NoPeek, Adversarial Learning, and DISCO, we can still carry out powerful DRA, as shown in Figure[5]. Specifically, when against NoPeek (Acc=79.97%), GLASS and GLASS++ increased the SSIM of reconstructed images to 0.554 and 0.678, compared to 0.006, 0.233 and 0.376 of baseline attacks, showcasing that our methods turn the failure into the successful attack. It is crucial to emphasize that even a 3% loss in accuracy is unsatisfactory because the target task is a simple binary classification problem. However, in practice, DL tasks are often very complex, and even a slight privacy defense may lead to poor performance.
Defense Analysis. For Clipping type defenses (Dropout Defense, DISCO), a high clipping rate is essential for providing sufficient privacy protection (about  $90\%$  intermediate feature clipping or  $95\%$  channel clipping). Dropout Defense is difficult to defend against Optimized-based DRAs because the Mask (randomly set to zero) superimposed on the intermediate feature representation can be easily picked up. DISCO's superior defense effect comes from  $95\%$  channel clipping, which is possible
Figure 5: The results of different defenses against DRAs. The accuracy rate corresponds to the Acc in Table [1] as Acc-1>Acc-2>Acc-3.
because the target task is relatively simple, resulting in highly redundant feature channels. For Noise Addition type defenses (Noise Mask, Shredder), Optimization-based DRAs are noise-sensitive. Even in a White-box setting, random sampling noise can still greatly interfere with the optimization process, leading to poor attack effects. In contrast, Learning-based DRAs demonstrate a certain robustness to noise. For further analysis of Shredder, we collect intermediate feature representations superimposed with Shredder noise and apply t-SNE[Van der Maaten and Hinton, 2008] to reduce their dimensionality. Notably, even when sampling from 50 noise distributions, the intermediate features can be distinctly clustered into 50 groups, as shown in Appendix F. We can degrade the noise distribution library of Shredder (default is 20) to a single distribution by using carefully selected intermediate feature representations (which can be mapped to the corresponding target group) during the optimization process, which greatly improves the effect of DRA. For Feature Obfuscating type defenses (Adversarial Learning, NoPeek, Siamese Defense), we believe that they only serve to increase the difficulty of feature matching in DRA. However, with a sufficiently powerful feature search capability, the attack is easy to implement. Appendix D.1 illustrates the curves of feature loss between the model with NoPeek and the original model under the GLASS, targeting the same image during optimization. It is evident that when the optimization process converges, the numerical difference between them is two orders of magnitude. In Appendix D.2, we establish a correlation between the model's accuracy and the SSIM of DRA under different attacks and defenses. Notably, NoPeek and DISCO emerge as the most effective defense mechanisms. As shown in Appendix D.3(a), the SSIM of our attacks is mostly above 0.5, and the slope of the broken lines is large, which means that our attacks are more robust.
5 Extended Experiments
Black-box & Query-free Settings. We relax the assumption of adversary capability and use gradient-free optimization technology to implement Black-box DRA. For Query-free, we adapt model fine-tuning and  $\mathcal{P}+$  space cropping. The experimental results show that the gradient-free optimization only takes 2,000 iterations to obtain effective information, and the customized GLASS improves the attack SSIM of Block2 from 0.152 to 0.392 in the Query-free setting. Experimental details and results are in Appendix E.1
Heterogeneous Data. We further extend the reconstruction attack to heterogeneous data like CINIC-10 [Darlow et al., 2018]. We chose to utilize the gradient-free CMA optimizer because CINIC-10 has a more heterogeneous data distribution than well-aligned datasets like CelebA, making it hard for the gradient-based optimizer to search in latent space [Li et al., 2022]. In our implementation, we utilize a publicly released StyleGAN-XL model trained on CIFAR-10 [Krizhevsky et al., 2009] to construct GLASS. Figure 6 shows part of the results. It can be seen that owing to rich prior knowledge, our GLASS can obtain highly similar semantic information and generate more vivid images than IN. Experimental details are in Appendix E.2
Figure 6: DRAs against Heterogeneous Data.
Data Distribution Shift. We replaced the StyleGAN model used in the attack from the one trained on the CelebA to the one trained on the FFHQ. Table 2 shows that  $GLASS++$  is still very effective, even if the prior knowledge is learned from a data distribution that differs from the private data distribution (facial structure alignment and feature diversity difference). Furthermore, we enhance the robustness of the attack by incorporating a fundamental domain adaptation technique, specifically model fine-tuning. We concatenate a step of model parameter optimization after  $GLASS++$  to make the generator model parameters trainable, which further aligns the features of the reconstructed images with the target features.
Table 2: Reconstruction attacks performance of Data Distribution Shift on Block3.
Dataset	Method	Evaluation Metrics
LPIPS ↓	SSIM ↑	PSNR ↑	MSE ↓	NIQE ↓
CelebA	GLASS++	0.128	0.833	26.56	0.014	15.30
FFHQ	GLASS++	0.211	0.727	23.95	0.025	13.77
GLASS++ Fine-tuning	0.199	0.736	24.22	0.023	14.75
Moreover, we carry out a more practical implementation of DRA on uncropped/unaligned private inference data to enhance the quality of our work. According to [Yang et al., 2023], we enhance StyleGAN by transitioning its constant first-layer feature to a variable one. We integrate this with the latent code of  $\mathcal{W}+$  space and undertake joint optimization during the second stage of our methodology. As demonstrated in Figure 7, the evaluation of GLASS underscores our method's effectiveness even when dealing with transformed or natural privacy inference data.
Figure 7: The results of GLASS when private inference data are transformed or natural images. The split point is set to Block3.
In this paper, we propose GLASS and  $GLASS++$ , the enhanced DRAs against SI. Our experiments demonstrate the effectiveness of our attacks on different split points and various adversarial settings. We anticipate that our proposed attacks will spotlight the significance of safeguarding privacy in split inference systems and encourage the advancement of more robust defense mechanisms. Regarding the limitation, it mainly comes from the inherent flaw of Optimization-based attacks, for single image optimization is less efficient than Learning-based attacks.
Acknowledgments and Disclosure of Funding We thank the anonymous reviewers for their constructive comments. This work was supported in part by the National Natural Science Foundation of China under Grants No. 61872430, 61402342, and 61772384 and was sponsored by Ant Group.