Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?

## Abstract

Abstract Model Inversion (MI) is a type of privacy violation that focuses on reconstructing private training data through abusive exploitation of machine learning models.
To defend against MI attacks,
state-of-the-art (SOTA) MI defense methods rely on regularizations that conflict with the training loss, creating explicit tension between
privacy protection and model utility.
In this paper, we present a new method to defend against MI attacks.
Our method takes a new perspective and focuses on training data .
Our idea is based on a novel insight on Random Erasing (RE),
which has been applied in the past as
a data augmentation technique to improve the model accuracy under occlusion.
In our work,
we instead focus on applying
RE for degrading MI attack accuracy. Our key insight is that MI attacks require significant amount of private training data information encoded inside the model in order to reconstruct
high-dimensional
private images.
Therefore, we propose to apply RE to reduce private information presented to the model during training. We show that this can lead to substantial degradation in MI reconstruction quality and attack accuracy. Meanwhile, natural accuracy of the model is only moderately affected.
Our method is very simple to implement and complementary to existing defense methods.
Our extensive experiments of 23 setups demonstrate that our method can achieve SOTA performance in balancing privacy and utility of the models. The results consistently demonstrate the superiority of our method over existing defenses across different MI attacks, network architectures, and attack configurations.

## 1 Introduction

Figure: Figure 1: Our Proposed Model Inversion (MI) Defense via Random Erasing (RE). (a) Training a model without MI defense. $\mathcal{L}(\theta)$ is the standard training loss, e.g., cross-entropy. (b) Training a model with state-of-the-art (SOTA) MI defense BiDO []. The training objective includes additional regularizations based on dependency measure $d(.,.)$. Expensive grid search is used in [] to determine hyperparameters $\lambda_{x}$ and $\lambda_{y}$ to balance the regularizations. (c) Training a model with our proposed MI defense based on RE. Note that the training procedure and objective are the same as that in (a). However, the training samples presented to the model are partially masked via RE, reducing private training sample information encoded in the model. We find that this can significantly degrade MI attacks, which require substantial amount of private training data information encoded inside the model in order to reconstruct high-dimensional private images. See Sec. 2.2 for our comprehensive validation for this claim.
Refer to caption: x1.png

Machine learning and deep neural networks (DNNs) [] have demonstrated their utility across numerous domains, including computer vision [, ], natural language processing [], and speech recognition [, , ]. DNNs are now applied in critical areas such as medical diagnosis [], medical imaging [, , , , ], facial recognition [, , , ], and surveillance [, , , , ]. However, the potential risks associated with the widespread deployment of DNNs raise significant concerns.
In many practical applications, privacy violations involving DNNs can result in the leakage of sensitive and private data, eroding public trust in these applications. Defending against privacy violations of DNNs is of paramount importance.

One specific type of privacy violation is Model Inversion (MI) attacks on machine learning and DNN models. MI attacks aim to reconstruct private training data by exploiting access to machine learning models.
Recent advancements in MI attacks including GMI [], KedMI [],
PPA [], PLG-MI [] and LOMMA [] have achieved remarkable progress in attacking important face recognition models. This raises privacy concerns for models that are trained on sensitive data, such as face recognition, surveillance and medical diagnosis.

To defend against MI attacks, differential privacy (DP) [, ]
has been studied in earlier works, while regularizations [, ] are
recently proposed.
For DP, studies in [] have shown
that current DP mechanisms do not mitigate MI attacks while
maintaining desirable model utility at the same time.
More recently, regularizations have been proposed for MI defense.
In [], they propose regularization to the training objective to
limit
the dependency between the model inputs and outputs.
In BiDO [],
which is existing SOTA MI defense,
they propose regularization to limit the the dependency between
the model inputs and latent representations.
However, these
regularizations conflict with the training loss and harm model utility considerably.
To restore the model utility partially, [] proposes to add another regularization to
maximize
the dependency
between latent representations and the outputs.
However, searching for hyperparameters for two regularizations in BiDO requires computationally-expensive grid search [].

To address the research gap and to improve
privacy-utility trade-off,
we present in this paper a new perspective to defend against MI attacks.
Different from previous defense methods based on additional regularizations on the training objective, we propose to focus on data.
Our idea is based on a novel insight on Random Erasing (RE) [], which has been applied in the past as
a data augmentation technique
to improve generalization of
DNNs under occlusion.
In the training stage, RE masks randomly-selected square regions from the training images and erases the pixel values in the selected regions.
With RE, training images with various levels of occlusion can be simulated, and DNNs with better invariance to occlusions and improved generalization can be obtained
as reported in
[].
In previous work, RE has been focusing on achieving a model with improved generalization under occlusion and better accuracy [].

In this work,
we instead focus on
RE for degrading MI attack accuracy and defending against MI attacks
(Fig. 1).
Specifically, we propose to train the target model with randomly-erased private images, i.e. private training images have randomly-selected square regions erased.
Therefore, the model is
trained with partially-masked images, with some identity features concealed.
Our key insight is that
MI attacks require significant amount of private training data information encoded
inside the model in order to reconstruct private images. In particular, images are high-dimensional data, containing complex and subtle patterns, textures and structures to represent the identities of individuals in the case of face recognition.
Reconstructing high-dimensional private training images
in MI attacks requires leveraging a significant amount of private image information encoded in the model parameters.
Therefore, our idea is to apply RE to present partially-masked images to the model during training in order to reduce private information encoded in the model parameters.
Our analysis finds that this can lead to substantial degradation in
MI
reconstruction quality and attack accuracy (See Sec. 2.2 for our comprehensive analysis and validation).
Meanwhile, our analysis finds that natural accuracy of the model is only moderately affected, as there is sufficient information present in the partially-masked images to discriminate between individuals. In fact, RE could improve the natural accuracy of the model under occlusion in some cases, as shown in previous work [].
Overall,
we can achieve
state-of-the-art
(SOTA) performance in privacy-utility trade-offs as demonstrated in our extensive experiments of 23 setups – 6 SOTA MI attacks including both white-box and label-only MI attacks, 9 model architectures (including vision transformer), 5 datasets and both $64\times 64$ and $224\times 224$ resolution – and user study (in Supp.).
Our contributions are:

- •
To defend against MI attack, we focus on data and propose a new method:
MI Defense via Random Erasing (MIDRE)
(Sec.
2.1).
- •
We conduct analysis to show that our MIDRE can reduce private image information encoded in the model that is critical for reconstructing private training images. Meanwhile, the natural accuracy of the model is only moderately affected
(Sec.
2.2).
- •
We conduct extensive experiments
(Sec.
3) and user study (Supp.)
to demonstrate that our MIDRE can achieve SOTA privacy-utility trade-offs.
Notably, in the high-resolution setting, our MIDRE is the first to achieve competitive MI robustness without sacrificing natural accuracy.
Note that our method is very simple to implement and is complementary to existing MI defense methods.

## 2 MI Defense via Random Erasing

In this section, we first present our MI defense method called Model Inversion Defense via Random Erasing (MIDRE).
Then, we present an analysis to support the efficiency of our proposed method against MI attack and its good trade-off between privacy protection and model utility.

### 2.1 Method

Our goal is to enhance the balance between privacy protection and model utility. We seek to significantly reduce the accuracy of MI attacks on the model, making it challenging for adversaries to reconstruct training samples and ensuring privacy protection.
As we strengthen the model against MI attacks, we further seek to minimize any degradation in natural accuracy, thus preserving the model utility. In the context of face recognition, the model should resist the reconstruction of facial training images of individuals while maintaining high recognition accuracy.

Specifically,
our proposed MI defense is based on
Random Erasing (RE) [], a technique which has been applied in the past as data augmentation to improve training of DNNs. RE is particularly useful to improve robustness of the model under occlusion.
On the other hand, our work explores RE for MI defense.
As will be discussed, in our defense, we do not apply RE as data augmentation.
Rather, we apply RE to reduce amount of private training data information presenting to the model during training in order to hinder reconstruction of high-dimensional private images
from the trained model.

Model inversion.
A model inversion (MI) attack aims to reconstruct private training data from a trained machine learning model. The model under attack is called a target model, $T_{\theta}$.
The target model $T_{\theta}$ is trained on a private dataset ${\mathcal{D}}_{priv}=\{(x_{i},y_{i})\}^{N}_{i=1}$, where $x_{i}$ represents the private, sensitive data and $y_{i}$ represents the corresponding ground truth label. For example, $T_{\theta}$ could be a face recognition model, and $x_{i}$ is a face image of an identity.
The model is trained with standard loss function
$\ell$ that penalizes the difference between model output $T_{\theta}(x)$ and $y$:

$$ ${\mathcal{L}}(\theta)=\sum^{N}_{i=1}\ell(T_{\theta}(x_{i}),y_{i})$ (1) $$

The underlying idea of MI is to
seek a reconstruction $x$ that achieves maximum likelihood for a label $y$ under $T_{\theta}$:

$$ $\max_{x}\mathcal{P}(y;x,T_{\theta})$ (2) $$

In addition, some
prior to improve reconstructed image quality can be included [, ].
SOTA MI attacks [, , , ] also apply GAN trained on a public dataset ${\mathcal{D}}_{pub}$ to limit the search space for $x$. ${\mathcal{D}}_{pub}$ has no identity intersection with
${\mathcal{D}}_{priv}$.

MI defense via BiDO [].
BiDO is the existing SOTA MI defense. They propose a regularization in the training objective of $T_{\theta}$
to limit the dependency between the model input and latent representations, and another regularization to restore the model utility:

$$ $\mathcal{L}(\theta)+\lambda_{x}\sum_{j=1}^{M}d(x,z_{j})-\lambda_{y}\sum_{j=1}^ {M}d(z_{j},y)$ (3) $$

Here, $z_{j}$ is the latent representation for $j$-th layer in $T_{\theta}$ with $M$ layers,
$d(.,.)$
is a dependency
measure, and $\lambda_{x},\lambda_{y}$ are hyperparameters.
Despite its SOTA defense performance, computationally-expensive grid search is needed to search for $\lambda_{x},\lambda_{y}$ [].

MI defense via Random Erasing.
Our proposed MI defense is based on RE []. We propose a simple configuration of RE, requiring only one hyperparameter which is set to be the same value in all our experiments across different attacks, model architectures and datasets.
In previous work,
RE is applied as a data augmentation technique to improve robustness of machine learning models in the presence of object occlusion [].
RE involves employing a random selection process to identify an region inside an image. Subsequently, this region is altered through the application of designated pixel values, such as zero or the mean value obtained from the dataset, resulting in partial masking of the image.
Our main idea is to explore such partial masking to limit private training data information presenting to the model during training.

Given a training sample $x$ with dimensions $W\times H$, we propose a square region masking strategy to restrict private information leakage from $x$.
We initiate by randomly selecting a starting point, denoted as $(x_{e},y_{e})$, within the bounds of $x$.
Next, we randomly select the masking area portion $a_{e}$ within the specified range of $[a_{l},a_{h}]$.
In our method, we set $a_{l}=0.1$, guaranteeing at least 10% of $x$ is masked during training, while
$a_{h}$ is the only hyperparameter which is set to be the same value in all our experiments across all setups.
The size of the masking area is $\sqrt{s_{RE}}\times\sqrt{s_{RE}}$ where $S_{RE}=W\times H\times a_{e}$ is the area of the masking.
With the designated area, we determine the coordinates of the masked region $(x_{e},y_{e},x_{e}+\sqrt{s_{RE}},y_{e}+\sqrt{S_{RE}})$. However, we need to ensure this selected area stays entirely within the boundaries of $x$,
i.e. $x_{e}+\sqrt{S_{RE}}\leq W$, $y_{e}+\sqrt{S_{RE}}\leq H$.
If the mask extends beyond the image width or height, we simply repeat the selection process until we find a suitable square mask that fits perfectly within $x$.
Once a proper square mask is selected, we replace the pixel values within the masked region with the ImageNet mean pixel value (See Sec. 3.4 for a detailed discussion on the impact of the masking value).

By incorporating random square masking during the training process, we effectively modify all private data to reduce the amount of private information presented to the model. This obscurity introduced by the masks makes it significantly more challenging for attackers to reconstruct the private images from the trained model.
We depict our method in Fig. 1 and Algorithm 1.

Figure: Algorithm 1 Train Model with Random Erasing (RE) as Model Inversion Defense

### 2.2 Random Erasing for MI Defense: Analysis

In this subsection, we analyze RE’s ability to remove critical information for reconstructing high-dimensional private images, thereby demonstrating its effectiveness in hindering MI attacks. Additionally, we show that this information removal has only a minimal impact on the model’s classification accuracy. We first present the setup of our analysis and then discuss our observations.

Figure: Figure 2: Our analysis shows that Random Erasing (RE) can lead to substantial degradation in MI reconstruction quality and attack accuracy, while natural accuracy of the model is only moderately affected. In this analysis, we experiment 6 setups with different MI attacks/target models architecture/private/public datasets. We analyze the attack and natural accuracy of the target models under different extents of random erasing applied in the training stage, using random erasing ratio $a_{e}=\frac{S_{e}}{S}$ as discussed in Sec. 2.1. To properly reconstruct private high-dimensional facial images of individuals, MI attacks require significant amount of private training data information encoded inside the model. We observe that reducing private information presented to the model using RE by small percentages can hinder MI and degrade MI reconstruction significantly, e.g. up to 72.69% decrease in MI attack accuracy. Meanwhile, natural accuracy of the model is only moderately affected, e.g. 0.45%, as sufficient information remains in the partially-masked images for the model to learn to discriminate between individuals (Setup 6). We note that in Setup 3, using GMI as the attack method, the attack accuracy degrades to nearly zero with $a_{e}$ of 0.3; thus, further degradation beyond this point is small. Overall, our proposed defense method can achieve SOTA privacy-utility tradeoffs.
Refer to caption: extracted/5827688/Images/PLGMI_VGG16_CelebA_CelebA.png

Setup of analysis.
In the analysis, we study attack accuracy and natural accuracy of a target model $T_{\theta}$ under different extent of RE.
For the target model, which is a face recognition model, in each setup, we employ the same architecture and hyperparameters, while modifying the RE ratio
$a_{e}=\frac{S_{e}}{S}$ as discussed in Sec. 2.1
to vary the extent of RE.
Specifically, we vary RE ratio
$a_{e}$ from 0.0
(indicating no random erasing and the same as No Defense) to 0.5. After the training of $T_{\theta}$, we proceed to evaluate its top 1 attack accuracy using SOTA MI attacks. This evaluation is conducted for all target models trained with different $a_{e}$. In order to ensure diversity in our study, we employ six distinct setups for the model inversion attacks, target model architecture, private dataset, and public dataset.
Setup 1: Attack method = PLG-MI [], $T_{\theta}$ = VGG16, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = CelebA.
Setup 2: Attack method = KedMI [], $T_{\theta}$ = IR152, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = CelebA [].
Setup 3: Attack method = GMI [], $T_{\theta}$ = FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = CelebA.
Setup 4: Attack method = LOMMA + KedMI [], $T_{\theta}$ = FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = FFHQ.
Setup 5: Attack method = PPA [], $T_{\theta}$ = ResNeSt-101, ${\mathcal{D}}_{priv}$ = Stanford Dogs, ${\mathcal{D}}_{pub}$ = AFHQ Dogs.
Setup 6: Attack method = PPA, $T_{\theta}$ = ResNet-18 [], ${\mathcal{D}}_{priv}$ = Facescrub, ${\mathcal{D}}_{pub}$ = FFHQ.
We follow strictly the experiment setting in [, , , ]. See Sec. 3.1/Supp for more details.

RE has small impact on model utility while degrading MI attacks significantly.
Fig. 2 summarizes the impact of random erasing on model performance and model inversion attacks. In all setups, RE demonstrably improves robustness against MI attacks with small sacrifice to natural accuracy.
For instance,
introducing RE at a ratio of 0.2 in Setup 1 caused a small 3.92% decrease in natural accuracy while the attack accuracy plummeted by 15.47%.
This trend continued in Setup 2 – a 0.2 ratio of RE led to a modest 3.36% decrease in natural accuracy, but a substantial 39.96% drop in attack accuracy. We note that in Setup 3, GMI attack accuracy degrades to nearly zero.
For high resolution images (Setup 5 and Setup 6), we observe a similar trend.
In Setup 6, there is a significant 72.69% drop in attack accuracy while natural accuracy slightly decreases (0.45%) when $a_{e}$ = 0.5.
In conclusion, applying RE during training significantly
degrades MI attack
while impact on natural accuracy is small.

These findings suggest that MI defense based on Random Erasing could achieve a strong balance between privacy and utility. We will validate the effectiveness of MIDRE through comprehensive experiments in the next section.

## 3 Experiments

### 3.1 Experimental Setting

To demonstrate the generalisation of our proposed MI defense, we carry out multiple experiments using different SOTA MI attacks on diverse architectures. In addition, we also use different setups for public and private data. The summary of all experiment setups is shown in Tab. 1. In total, we conduct 23 experiment setups to demonstrate the effectiveness of our proposed defense MIDRE.

Table: Table 1: Details of our experiments. In total, we conduct 23 experiment setups to demonstrate the effectiveness of MIDRE.

Dataset: We follow the same setups as SOTA attacks [, , ] and defense [] to conduct the experiments on three datasets including: CelebA [], FaceScrub [], and Stanford Dogs []. We use FFHQ [] and AFHQ Dogs [] for the public dataset.
We strictly follow [, , , ] to divide the datasets into public and private set. See Supp for the details of datasets.

Model Inversion Attacks. To evaluate the effectiveness of our proposed defense MIDRE, we employ a comprehensive suite of state-of-the-art MI attacks. This includes various attack categories: white-box and label-only. We leverage four SOTA white-box attacks: GMI [], KedMI [], PLG-MI [], and LOMMA [] (including both LOMMA-GMI and LOMMA-KedMI). These attacks target a common resolution of 64$\times$64 pixels, commonly used in MI research. Additionally, we incorporate
BREPMI [] for label-only attacks. Finally, to assess robustness at higher resolutions, we employ PPA [] against attacks targeting 224$\times$224 pixels. We strictly replicate the experimental setups in [, , , , , ] to ensure a fair comparison between NoDef (the baseline model with no defense), existing state-of-the-art defenses, and our proposed method, MIDRE.

Target Models.
We follow other MI research [, , , ] to train defense models.
We use eight architectures for the target model to assess its resistance to MI attacks using various experimental configurations. Following previous work [, , , ],
we use VGG16 [], ResNet-152 (IR152) [], FaceNet64 (face.evoLve) [], ResNet-18 [], ResNet-101, ResNeSt-101 [], and DenseNet-169 [] in our study.
In addition, we employ MaxVIT [] as a modern architecture for the target model. See Tab. 1 for more details of our experiment setups.

Comparison Method.
We compare the performance of our model against no defending method (NoDef) and two defense methods including BiDO [] and MID [].
We establish a baseline (NoDef) by training the target model from scratch without incorporating any MI defense strategy. For other MI defense methods, only BiDO provides a pre-trained VGG16 model trained on a private dataset ${\mathcal{D}}_{priv}$ = CelebA.
To ensure a fair comparison, we reimplemented BiDO, and MID on other setups. We then carefully tuned the hyperparameters of each method to achieve optimal performance.

Evaluation Metrics.
MI defenses typically involve a trade-off between the model’s original utility and its resistance to model inversion attacks. We evaluate these defenses using two key metrics:

- •
Natural Accuracy (Acc $\uparrow$). This metric measures the accuracy of the defended model on a private test set, reflecting its performance on unseen data.
- •
Attack accuracy (AttAcc $\downarrow$). This metric measures the percentage of successful attacks, where success is defined as the ability to reconstruct private information from the model’s outputs. Lower attack accuracy indicates a more robust defense.
Following existing works [, , , ], we utilize a separate evaluation model. This model has a distinct architecture and is trained on the private dataset ${\mathcal{D}}_{priv}$. Similar to human inspection practices [], the evaluation model acts as a human proxy for assessing the quality of information leaked through MI attacks. Higher attack accuracy on the evaluation model signifies a more effective attack, implying a weaker defense.

To quantify the trade-off between model utility (Natural accuracy) and attack performance (Attack accuracy), we compute
$\Delta=\frac{AttAcc_{NoDef}-AttAcc_{defenseModel}}{Acc_{NoDef}-Acc_{
defenseModel}}$.
This metric calculates the ratio between the decrease in attack accuracy and the decrease in natural accuracy when applying a MI attack on a model with no defenses (noDef) and defense models(^1^11This metric is used when defense models have lower natural accuracy compared to the no-defense model.).
A higher $\Delta$ value indicates a more favorable trade-off.

We further complement these results with qualitative results and a user study (See Supp).

Hyperparameters.
Our method is efficient, requiring only one hyperparameter to control the maximum masking area portion $a_{h}$. In all our experiments, we set $a_{h}$= 0.4, which resulted in masking between 10% and 40% of the image area.
In other words, our proposed method reduces the amount of private information directly accessible during training by 10% to 40%.

### 3.2 Comparison against SOTA MI Defenses

Table: Table 2: We report the MI attacks under multiple SOTA MI attacks on images with resolution 64$\times$64. We compare the performance of these attacks against existing defenses including NoDef, BiDO, MID, and DP. $T$ = VGG16, $D_{pub}$ = CelebA

We evaluate our method against existing Model Inversion defenses. We follow the experiment setup in BiDO [] and report the results on the standard setup using $T$ = VGG16 and ${\mathcal{D}}_{priv}$ = CelebA in Tab. 2. We evaluate against six MI attacks, including GMI [], KedMI [], LOMMA [] with two variances (LOMMA+GMI and LOMMA+KedMI), PLGMI [], and BREPMI [].

In addition, we reimplemented BiDO and MID on high-resolution images (224$\times$224) using the ResNet family architecture, including ResNet-18, ResNet-101, and ResNet-152. We employ PPA [] on the defense models and summary the results in Tab. 3.

Table: Table 3: We evaluate the MI attack PPA [] on high-resolution images (224$\times$224). We compare the performance of our proposed method, MIDRE, against no defense (noDef) and existing defenses, BiDO and MID. Here, we use ${\mathcal{D}}_{priv}$ = Facescrub and ${\mathcal{D}}_{pub}$ = FFHQ. Among methods, our defense models achieve the highest natural accuracy while exhibiting the lowest attack accuracy, demonstrating the clear effectiveness of our proposed method.

Our proposed method, MIDRE, achieves significant improvements in security for 64$\times$64 setups compared to SOTA MI defenses. MIDRE achieves this by demonstrably reducing top-1 attack accuracy while maintaining natural accuracy on par with other leading MI defenses.
Specifically, compared to BiDO, MIDRE offers a substantial 43.74% decrease in top-1 attack accuracy with sacrificing only 7.05% in natural accuracy (measured using the KedMI attack method). Notably, while BiDO achieves similar natural accuracy to MIDRE, it suffers from a significantly higher top-1 attack accuracy (8.84% higher than MIDRE).

Interestingly, we are the first to observe that our defense models achieve higher natural accuracy than no defense model for larger image sizes (224$\times$224).
Our method increase from 2.47% to 3.06% compared to the NoDef method in term of natural accuracy, while existing defenses suffer a drop from 2.89% to 4.42%. MIDRE does experience a significant decrease in top-1 attack accuracy compared to NoDef (around 40-45%), showing the effectiveness in preventing attackers to recover the private information from our RE-trained models.

The experiment results show that our defense model has small impact on model utility while enhancing the model’s robustness against SOTA MI attacks.

### 3.3 Additional Results

We further show the effectiveness of our proposed method on a wide range of target model architectures including IR152, FaceNet64, DenseNet-169, ResNeSt-101, and MaxVIT. The results are shown in Tab. 4(b) for 64$\times$64 images and in Tab. 5(b) for 224$\times$224 images,

The experiment results consistently demonstrate the effectiveness of our proposed method. For example, with $T$ = IR152, we sacrifice only 6.25% in natural accuracy, but the attack accuracies drop significantly, from 22.07% (PLGMI attack) to 40% (LOMMA + GMI attack). Similarly, when $T$ = FaceNet64, natural accuracy decreases by 6.94%, while the attack accuracies drop significantly, from 24.47% (PLGMI attack) to 45% (LOMMA attack).

For large resolution images, we observe the same trend while using the Stanford Dogs dataset as the private data. Interestingly, with ${\mathcal{D}}_{priv}$ = Facescrub, we see a slight increase in natural accuracy (1.95%) along with a significant reduction in attack accuracy of around 40%. These results consistently show that MIDRE significantly reduces the impact of MI attacks.

Table: Table 4: Additional results on 64$\times$64 images. We use (a) $T$ = IR152 and (b) $T$ = FaceNet64. The target models are trained on ${\mathcal{D}}_{priv}$ = CelebA and ${\mathcal{D}}_{pub}$ = CelebA. The results conclusively show that our defense model is effective.

Table: Table 5: Additional results on high-resolution images 224$\times$224. We use two private dataset (a) ${\mathcal{D}}_{priv}$ = Stanford Dogs and (b) ${\mathcal{D}}_{priv}$ = Facescrub with the target models are MaxVIT and ResNeSt-101. The results strongly support the effectiveness of our defense model.

### 3.4 Ablation study

Ablation study on Masking Values.
In this section, we examine the effect of masking value to MIDRE performance. We select
attack method = PLGMI [], $T$ = FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = FFHQ.
We set $a_{e}$ = (0.2,0.2).
Similar to [], we investigate four types of masking values: 0, 1, a random value, and the mean value. In case of random value, we randomly select it within a range (0,1). The mean value uses the ImageNet dataset’s mean pixel values ([0.485, 0.456, 0.406]).

Tab. 7 demonstrates that the mean value offers the best balance between robustness against MI attacks and maintaining natural image accuracy.
Consequently, we adopt the Imagenet mean pixel values for masking in MIDRE.

Table: Table 6: The effect of different masking value. We use attack method = PLGMI [], $T$ = FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = FFHQ. Overall, mean value achieves the best balance between robustness against MI attacks and maintaining natural image accuracy.

Ablation study on Area Ratio.
In MIDRE, the area ratio $a_{e}$ controls the portion of an image masked to prevent MI attacks. This experiment investigates the impact of different $a_{e}$ values on MIDRE’s performance. In particular, $a_{e}$ is randomly selected within the range (0.1, $a_{h}$), guaranting that at least 10% of the image is always masked. We select three values for $a_{h}$: 0.3, 0.4, and 0.5.
Similar to the previous ablation study, we employ attack method = PLGMI [], $T$ = FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = FFHQ.
The masking process uses the ImageNet mean pixel values.

The results in Tab. 7 indicate that increasing $a_{h}$ strengthens MIDRE’s defense against MI attacks, but this comes at the cost of reduced natural accuracy. To achieve a balance between robustness and natural accuracy, we opt $a_{h}$ = 0.4 in MIDRE.

### 3.5 Qualitative Results

We show the comparison on qualitative results in Fig. 3. We collect images acquired from the PPA attack using $T$ = ResNet-18, ${\mathcal{D}}_{priv}$ = Facescrub, ${\mathcal{D}}_{pub}$ = FFHQ. It is clear that attack samples obtained when attacking the target model trained by our strategy have lower quality compared to samples obtained when attacking the NoDef and BiDO models.

Figure: Figure 3: Reconstructed image obtained from PPA attack with $T$ = ResNet-18, ${\mathcal{D}}_{priv}$ = Facescrub, ${\mathcal{D}}_{pub}$ = FFHQ. The quality of the reconstructed image obtained from the attack on the model trained by MIDRE is comparatively worse when compared to that from NoDef and BiDO methods, suggesting the efficiency of our proposed defense MIDRE.
Refer to caption: extracted/5827688/Images/PPA_resnet18_visualization.png

## 4 Conclusion

We propose a novel approach to defend against MI attacks based on Random Erasing.
We conducted an analysis to demonstrate that employing RE to reduce the private information presented to the model during training results in a significant decrease in MI attack accuracy. Meanwhile, the natural accuracy of the model is only moderately affected.
Experiments validate that our approach achieves outstanding performance in balancing model privacy and utility.
The results consistently demonstrate the superiority of our method over existing defenses across various MI attacks, network architectures, and attack configurations.
The code and additional results can be found in the Supplementary section.

## Overview

In this supplementary material, we provide additional experiments, analysis, ablation study, and details that are required to reproduce our results. These were not included in the main paper due to space limitations.

## Appendix A Additional Experimental Results

### A.1 Additional results

We report the results of additional setup in Tab. 1(c). In particular, we use attack method = PLGMI, $T$ = VGG16/IR152/FaceNet64, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = FFHQ.

Table: Table A.1: We report the PLGMI attacks on images with resolution 64$\times$64. $T$ = VGG16, IR152 and FaceNet64, $D_{pub}$ = FFHQ

In addition to measuring attack accuracy, we incorporate KNN distance to demonstrate the efficacy of our strategy across different evaluation scenarios. The specifics of KNN distance can be found in section C.2. The results are presented in table A.2 and 3(b).

Table: Table A.2: We report the MI attacks under multiple SOTA MI attacks on images with resolution 64$\times$64. We compare the performance of these attacks against existing defenses including NoDef, BiDO, MID, and DP. $T$ = VGG16, $D_{pub}$ = CelebA

Table: Table A.3: Additional results on 64$\times$64 images. We use (a) $T$ = IR152 and (b) $T$ = FaceNet64. The target models are trained on ${\mathcal{D}}_{priv}$ = CelebA and ${\mathcal{D}}_{pub}$ = CelebA. The results conclusively show that our defense model is effective.

### A.2 User Study

In addition to attack accuracy measured by the evaluation model, we conduct a user study to further validate the attack’s effectiveness.

We conduct the user study by employing the services of Amazon Mechanical Turk.
For our user study, we use the reconstructed images performing by PLGMI with $T$ = VGG16, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = CelebA.
We compare the reconstructed images of our proposed method MIDRE and BiDO.
We randomly selected 150 reconstructed images each from 20 different classes for each defense model to create 150 pairs, with each pair containing images from the same class.
Participants were presented with a user interface (see Figure A.1) where they were shown a pair of images and asked to select the image that appeared more like the original target person.
Two independent users voted on each image pair. A total of 300 votes were collected. A smaller
number of samples selected by users suggests improved defense performance against model inversion.

The results are shown in Table A.4, suggesting improved defense performance with our proposed method.

Figure: Figure A.1: Our Amazon Mechanical Turk (MTurk) interface for user study with model inversion attacking samples
Refer to caption: extracted/5827688/Supp_Images/user_study.png

**Table A.4: A user study was performed utilising Amazon Mechanical Turk. Reconstructed samples of PLG-MI/VGG16/CelebA/CelebA with 20 classes were generated. The study asked users for inputs regarding the similarity between a private training image and the reconstructed image from BiDO trained model / our trained model. The results are shown below.**
| Defense | Num of samples selected by users as more similar to private data |
| --- | --- |
| BiDO | 153 |
| \hdashlineOurs | 147 |

## Appendix B Ablation Study

### B.1 The effectiveness of RE-trained model on occlusion data.

We analyzed the histogram of likelihood $\mathcal{P}(y;x,T_{\theta})$, for full and random erasing samples in the private test set across all three target models (NoDef, BiDO, and MIDRE (ours). We use setup 1 for this analysis. The results (see Fig. B.2) show that models trained with Random Erasing can still make accurate predictions, i.e., have a high likelihood of assigning the correct label, even with partially-masked images. This is because RE removes only a portion of the object while preserving its overall structure. This is especially beneficial for objects with a consistent layout, like faces. When the amount of image erased is low (e.g., RE ratio = 0.2), enough facial information remains to distinguish between individuals. Therefore, models trained with RE achieve good accuracy despite not seeing the entire image during training.

Figure: Figure B.2: Effectiveness of target models on partially masked and full images from a private test set. We compare three models: a baseline model without defense (NoDef), a state-of-the-art MI defense (BiDO), and our proposed MI defense with randomized erasing (MIDRE). In this visualization, we present the likelihood distribution of the ground-truth label. We compare two scenarios: private data (Priv) and private data with Random Erasing (Priv+RE). Here, Priv represents the likelihood denoted by $\mathcal{P}(y;x,T_{\theta})$, where $x$ signifies data points from the private test set with known ground-truth labels $y$. Priv+RE denotes the probability $\mathcal{P}(y;\rho(x),T_{\theta})$, where $\rho(x)$ represents the Random Erasing operator applied to $x$. The RE hyper-parameters are $(a_{l},a_{h})=(0.1,0.4)$. The results demonstrate the effectiveness of the RE-trained target model. Similar to [], where RE improves model robustness against occlusion, our model maintains high likelihood for the ground-truth class even with partial or full masking. In contrast, models trained with NoDef or BiDO struggle with occluded images and require full visibility.
Refer to caption: extracted/5827688/Supp_Images/NoDef_hist_prob.png

### B.2 Ablation Study on the GRADCAM.

We employed GRADCAM visualization [] on false positive samples. We remark that false positives are reconstructed samples that the target model classifies with high confidence but are demonstrably incorrect when evaluated by a separate model (e.g., evaluation model). We analyzed models trained with NoDef, BiDO, and our proposed MIDRE method using $T$ = VGG16, ${\mathcal{D}}_{priv}$ = CelebA, ${\mathcal{D}}_{pub}$ = CelebA. The GRADCAM visualizations for these analyses are presented in Fig. B.3.

Figure: Figure B.3: GRADCAM visualisation on false positive reconstructed samples obtained when attacking Nodef, BiDO, and our MIDRE target models. We note that GRADCAM heatmaps of reconstructed samples from our model are more concentrated in parts of the images. When the target model is trained using our MIDRE, the model learns to produce a high likelihood based on parts of an input image. During an MI attack on this MIDRE-trained model, the attacker may achieve a high likelihood by correctly reconstructing parts of the image related to a specific identity, while the rest of the image may not contain accurate features for this identity, resulting in false positives as shown in these results.
Refer to caption: extracted/5827688/Supp_Images/FalsePositiveGradCAM.png

We observe that
GRADCAM visualizations for reconstructions from our proposed method with Random Erasing show a more focused heatmap compared to other methods. Recall that MI attacks aim to maximize the target model’s likelihood score for the reconstructed image. Since RE-trained models assign high likelihood based on partial information (which makes the model robust to occlusion
as previously shown in []), attackers might achieve high scores by reconstructing only identity-relevant parts. This can lead to false positives, where reconstructed images appear plausible to the target model but lack accurate features for the specific identity. Consequently, we observe significant reductions in MI attack accuracy for our defense models while the model’s natural accuracy experiences a moderate impact.

## Appendix C Additional Analysis and Details on Experimental Setup

### C.1 Dataset

We use three datasets including CelebA [], Facescrub [], and Stanford Dogs [] as private training data and use two datasets including FFHQ [] and AFHQ Dogs[] as public dataset.

The Celeba dataset [] is an extensive compilation of facial photographs, encompassing more than 200,000 images that represent 10,177 distinct persons. For MI task, we follow [, , ] to divide CelebA into private dataset and public dataset. There is no overlap between private and public dataset. All the images are resized to 64$\times$64 pixels.

Facescrub [] consists of a comprehensive collection of 106836 photographs showcasing 530 renowned male and female celebrities. Each individual is represented by an average of around 200 images, all possessing diversity of resolution.
Following PPA [] to resize the image to 224$\times$224 for training target models.

The FFHQ dataset comprises 70,000 PNG images of superior quality, each possessing a resolution of 1024x1024 pixels. FFHQ is used as a public dataset to train GANs using during attacks [, , ].

Stanford dogs [] contains more than 20,000 images encompassing 120 different dogs. AFHQ Dogs [] contain around 5,000 dog images in high resolution. Follow [], we use Stanford dogs dataset as private dataset while AFHQ Dogs as the public dataset.

### C.2 Evaluation Method

K-Nearest Neighbor Distance (KNN Dist):
KNN distance measures the similarity between a reconstructed image of a specific identity and their private images. This is calculated using the $L_{2}$ norm in the feature space extracted from the penultimate layer of the evaluation model.

In MI defense, a higher KNN Dist value indicates a greater degree of robustness against model inversion (MI) attacks and a lower quality of attacking samples on that model.

### C.3 Hyperparameters for Model Inversion Attack

In the case of GMI[], KedMI[], and PLG-MI[], BREPMI[], our approach is primarily based on the referenced publication outlining the corresponding attack. However, in certain specific scenarios, we adhere to the BiDO study due to its distinct model inversion attack configuration in comparison to the original paper.
The LOMMA approach involves adhering to the optimal configuration of the method, which encompasses three augmented model architectures: EfficientNetB0, EfficientNetB1, and EfficientNetB2. We adopt exactly the same experimental configuration, including the relevant hyperparameters, as described in the referenced paper.

## Appendix D Discussion

We propose a new defense against MI attacks using Random Erasing (RE) during training. RE reduces private information exposure while significantly lowering MI attack success, with small impact on model accuracy. Our method outperforms existing defenses across 23 experiment setups using 6 SOTA MI attacks, 9 model architectures, 5 datasets, and user study.

### D.1 Broader Impacts

Model inversion attacks, a rising privacy threat, have garnered significant attention recently. By studying defenses against these attacks, we can develop best practices for deploying AI models and build robust safeguards for applications, especially those that rely on sensitive training data. Research on model inversion aims to raise awareness of potential privacy vulnerabilities and strengthen the defense.

### D.2 Limitation

Firstly, we currently focus on enhancing the robustness of classification models against MI attacks.
This is really important because these models are being used more and more in real-life situations where privacy and security are a major concern.
In the future, we plan to expand our research scope to encompass MI attacks and defenses for a broader range of machine learning tasks.

Secondly, while our current experiments are comprehensive compared to prior works [, , , , ] which mainly focus on image data, real-world applications often involve diverse private/sensitive training data. Addressing these real-world data complexities through a comprehensive approach will be essential for building robust and trustworthy machine learning systems across various domains.

## Appendix E Experiments Compute Resources

In order to carry out our experiments, we utilise a workstation equipped with the Ubuntu operating system, an AMD Ryzen CPU, and 4 NVIDIA RTX A5000 GPUs. Furthermore, we utilise a secondary workstation equipped with the Ubuntu operating system, an AMD Ryzen CPU, and two NVIDIA RTX A6000 GPUs.

## Appendix F Related Work

### F.1 Model Inversion Attacks

The GMI [] is a pioneering approach in model inversion to leverages publicly available data and employs a generative model GAN to invert private datasets. This methodology effectively mitigates the generation of unrealistic data instances. KedMI [] can be considered an enhanced iteration of the GMI model, as it incorporates the transmission of knowledge to the discriminator through the utilisation of soft labels. PLGMI [] is the current leading model inversion method in the field. It leverages pseudo labels derived from public data and the target model. LOMMA [] employs an augmented model in order to reduce the model inversion overfitting. The augmented model is trained to distill knowledge from a target model by utilising public data. During attack, the attackers generate images in order to minimise the identity loss in both the target model and the augmented model. However, it should be noted that the aforementioned four approaches are specifically designed for target models that have been trained on low-resolution data, specifically 64x64 for the CelebA private dataset. Recently, PPA [], MIRROR [], and DMMIA [] perform the attack on high resolution images.
In addition, Kahla, Mostafa, et al [] introduced the BREPMI attack as a form of label-only model inversion attack, where the assault is based on the predicted labels of the target model. Another work is RLBMI [], which utilises a reinforcement learning approach to target a model in a black box scenario.

### F.2 Model Inversion Defenses

Researchers often use the Differential Privacy (DP) method [, , ], to keep data confidential in machine learning applications. However, DP may not be effective against attack techniques that use public datasets such as GMI []. A recent study has mathematically proven the limitations of DP for high-dimension datasets and suggested a more robust defense mechanism called MID []. The process of minimizing mutual information between the input and output of a machine learning model is known as MID.
However, the primary supervised loss often conflicts with the MID regularization term, making it challenging to balance utility and privacy. To tackle this issue, [] developed a more practical approach called Bilateral Dependency Optimization (BiDO). BiDO aims to minimize the input and intermediate feature dependence to enhance model security and prevent inversion attacks. At the same time, it strives to maximize the correlation between the intermediate representation and the ground truth to maintain good classification task performance and improve the model’s discriminative features. BiDO is applied to all layers to protect privacy throughout the deep neural network. Recently, Ye et al. [] introduced a new approach that utilises differential privacy to protect against model inversion. Gong et al. [] proposed a novel Generative Adversarial Network (GAN)-based approach to counter model inversion attacks.
In this paper, we do not conduct experiments to compare to these methods as the code is not available.

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: - Regarding the utility evaluation. To me, RE may have different effects on different tasks, e.g., gender classification or identity classidication. The authors are suggested to discuss more on how RE will affect the utility of different types of tasks.

- For different resolution images, the authors compare different attacks, e.g., GMI for 64x64 and PPA for 224x224. I am wondering could each attack be applied to different resolutions? For example, GMI for 64x64, 160x160, and 224x224.

- Regarding attack evaluation, the authors leverage attack accuracy as the evaluation metric. To me, it's not clear how to calculate the accuracy. Please correct me if I am wrong, is it calculated by training an identify classifier and see if the prediction results are the same for the original image and the reconstructed image? Also, the authors should better justify why the attack accuracy is a good metric for evaluating the performance of MI.

- Is it a training time defense? Or are the images also leveraging RE during the inference phase?
soundness: 3
strengths: - important research topic
- simple yet effective method
- well-organized paper
summary: This paper focuses on defending model inversion (MI) attacks via random erasing. The authors discover that random erasing (RE) has a negative impact on the MI attacks. Specifically, partial erasure plays an important role on reducing attack performance and random location can contribute to better privacy-utility trade-off.
weaknesses: - evaluation could be more in-depth
- some details need better clarification

---

confidence: 5
contribution: 3
initial_rating: 5
presentation: 2
questions: + Evaluation model details, such as model architecture and natural accuracy information.
soundness: 3
strengths: + Existing MI defenses either focus on model architectures or the training loss. This paper takes another direction and perform the defense on the training data itself. This method adds a novel dimension to the literature on model inversion defenses.
+ The approach is well-motivated and defense mechanism is intuitive. The visualization of the embedding space in Figure 2 indicates that the proposed method is convincing and reasonable.
+ The experiments contains a wide range of setting, such as datasets, model architectures, types of attacks and defenses. The proposed method shows improved results across most of the settings, supporting the defense effect of the method.
summary: The paper introduces a novel method to enhance model robustness against model inversion attacks. Instead of model architecture and training loss, the paper propose a novel insight on the training data. The research reduce private training data information encoded in the model by randomly erasing some area of the input images. The visualization of the embedding space and the comparison experiments show the strong defense performance of random erasing.
weaknesses: + The experimental results are incomplete. Some distance metrics in Tables B.14 and B.15 are missing. Why only AttAcc is evaluated and other distance indicators are not evaluated? This makes readers suspect that your method is not as good as the previous method.
+ Defense needs to ensure that it does not compromise the robustness of other aspects, and the paper lacks validation on some other attacks, e.g., adversarial attacks, backdoor attacks, etc. Some settings of those attacks can be found in previous work [1].


Minor remarks:

+ Some annotations in Figure 2 overlap.
+ In the LOMMA+GMI setting in Table B.3, the attack accuracy in the MIDRE case is much higher than that in the TL-DMI case. However, the AttAcc results for MIDRE are bolded in the table.
+ Typo on line 763: "Celeba" should be corrected to "CelebA".
+ The word "areased" in line 149 seems wrong.
+ The title of Table 4 has some grammar mistakes.

[1] Struppek, Lukas, Dominik Hintersdorf, and Kristian Kersting. "Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks." *arXiv preprint arXiv:2310.06549* (2023).

---

confidence: 5
contribution: 3
initial_rating: 5
presentation: 2
questions: + The resolution of Mirror is inconsistent throughout the text. Could you clarify whether it is 116\*116 or 160\*160? Please ensure consistency to avoid confusion for readers.
+ The significance of the trade-off value $\Delta$ : Is there a linear relationship between the decrease in model performance and the decrease in attack accuracy? More explanations and evaluation should be conducted to make this metric reasonable. For example, if the defense method helps improve the model utility, the metric would have a negative value.
soundness: 3
strengths: + The motivation and analyses are clear.
+ The experiments are comprehensive.
+ The first to explore model inversion defense from the perspective of robust data.
summary: This paper applies Random Erasing (RE) technique to model inversion defenses. From the perspective of robust data, the paper analyses the impact of RE on privacy-utility trade-off. Additionally, a feature space analysis is conducted to prove the effectiveness of RE in model inversion defenses. Experimental results have shown the superiority of MIDRE compared to baselines.
weaknesses: + Table B.14 and B.15 show that the random erasing technique can enhance the model performance in natural accuracy. The Figure 2 shows that features of the reconstructed images are closed to the random erasing samples. Therefore, this may be beneficial for attackers to use the inversion results to train their own models. It can be measured with the *knowledge extraction score* proposed in paper [1]. However, this paper lacks this metric. 
+ Some target models do not have enough performance such as the target models in Table 2. In actual deployment, almost no one will use a model with such low accuracy.
+ PLGMI [2] also has a strong performance on attack accuracy in the $224\times224$ resolution settings. However, the experiments are only performed at $64\times64$​​​.
+ According to paper [1], it is essential to assess whether the proposed defense degrades model's vulnerability to other attacks (e.g. adversarial attacks).

[1] Struppek, Lukas, Dominik Hintersdorf, and Kristian Kersting. "Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks." *arXiv preprint arXiv:2310.06549* (2023).

[2] Yuan, Xiaojian, et al. "Pseudo label-guided model inversion attack via conditional generative adversarial network." *Proceedings of the AAAI Conference on Artificial Intelligence*. Vol. 37. No. 3. 2023.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: Please refer to the weakness
soundness: 3
strengths: 1. This paper proposes an innovative use of random erasing (RE), traditionally a data augmentation tool, for privacy defense in model training.
2. This paper provides a feature space analysis that goes beyond typical empirical evaluation, explaining why RE disrupts MI attacks.
3. This paper provides a comprehensive experimental setup validating robustness across models, architectures, and attacks.
4. The proposed method is easy to implement and can be integrated with existing MI defenses.
summary: The paper explores random erasing (RE) as a defense mechanism against model inversion (MI) attacks, a method where adversaries attempt to reconstruct private training data. Traditionally used for data augmentation, RE is shown here to degrade MI attack accuracy while maintaining model utility by partially erasing image regions and selecting erasure locations randomly. Extensive experiments confirm that this RE-based approach offers a state-of-the-art privacy-utility trade-off.
weaknesses: 1. While extensive experiments are presented, the analysis does not sufficiently engage with the theoretical implications of the findings. For instance, a discussion on the conditions under which RE is most effective or the mechanism behind the observed performance would provide valuable insights and improve the paper's theoretical contributions.
2. The potential ethical biases inherent in the proposed defense method are not discussed. For example, what facial features or gender, etc., make a person more likely to be protected by this method.

---

confidence: 4
contribution: 1
initial_rating: 3
presentation: 1
questions: - Q1: Why are the green spaces in Figure 2 disjoint for the case that there is no defense, and highly overlapping when there is a defense? - Q2: Is there a fraction of training images that is not masked to keep the distributions similar?
soundness: 3
strengths: The experimental evaluation is extensive with multiple model architectures, MI attacks and datasets. The paper compares to other MI-defenses.
summary: The paper proposes a defense against model inversion attacks (MI) that relies on modifications in the input space, namely masking out random regions of the training images.
weaknesses: The contribution and insights of the work are not novel: already in 2018, [1] randomly masked out pixels and showed how it negatively affects MI results (see their Figure 8). Similarly, [2] assesses the impact of masking random pixels with noise. The delta of masking out entire regions of the image seems limited.

**Experimental Evaluation**

The experimental evaluation takes into account prior defenses, and ablates the two elements, i.e., mask fraction and location. However, other sensible baselines that would be worth exploring are: Are squares the best masks? Why not try random pixels like [1,2], or rectangles, circles?

Additionally, the evaluation is limited to centered datasets, however, I am wondering whether masking out random squares would still be effective in non-object-centric and scene datasets.

**Conceptual Comments**

Conceptually, we see that utility still suffers for multiple datasets when decreasing attack success, see, for example, Figure 1. 
For the other datasets, is extremely surprising that masking out entire squares of input images does not impact utility severely: the masking out should not only create a discrepancy between the features of MI-reconstructed images and that of private images, but also between training and test data. It seems hard to understand why under such a strong distribution shift, utility would still be this high. Q1: Why are the green spaces in Figure 2 disjoint for the case that there is no defense, and highly overlapping when there is a defense? Q2: Is there a fraction of training images that is not masked to keep the distributions similar?

**Minor presentation improvements**

- The tenses are not used consistently, especially in the related work paragraph, it changes between past and presence, e.g. "proposed using negative label", vs. "restricts the number of layers"
- There are minor grammar issues that nowadays language models or plug ins like grammarly could easily detect and fix, like missing articles, incorrect use of singular and plural etc., e.g. "identify a*n* region inside an image".
- Presenting Figure 1 before the experimental setup has been introduced is not optimal, given the many abbreviations in the figure which are not understandable from the figure alone, not even with the extremely long caption.
- Figure 3 should have aligned x-axes to present the quality of the method better. On the first glance, it seems that based on the hyper parameters for "Ours" in MaxViT, there is significant utility degradation. However, the axis is only that fine grained.

**References**

[1] Zhang, T., Z. He, and R. B. Lee. "Privacy-preserving machine learning through data obfuscation. arXiv 2018." arXiv preprint arXiv:1807.01860.

[2] Yu, Guangsheng, Xu Wang, Caijun Sun, Ping Yu, Wei Ni, and Ren Ping Liu. "Obfuscating the dataset: Impacts and applications." ACM Transactions on Intelligent Systems and Technology 14, no. 5 (2023): 1-15.

---

confidence: 3
contribution: 2
initial_rating: 6
presentation: 3
questions: 1. Could you clarify why random erasing prevents the model from learning certain private characteristics?

2. In Figure 2(b), there’s a notable gap between features from RE-altered training data and private test data. Could you explain why accuracy remains largely unaffected in such cases?
soundness: 3
strengths: 1. The experiments are comprehensive, covering a wide range of complex datasets and setups.

2. The results are visually clear and well-organized, making them easy to interpret.

3. The writing is easy to follow.
summary: This paper explores using Random Erasing (RE) as a defense against Model Inversion (MI) attacks, which aims to reverse private training data. Unlike traditional defenses that focus on loss functions and model modifications, this study shows how the data augmentation technique, i.e., RE, helps protect privacy.
weaknesses: 1. The connection between RE and the model's learning of private information remains unclear. Model inversion typically targets private characteristics at the class level. It's unclear why partial occlusion at the sample level would prevent learning sensitive information. For instance, if one image has a partially obscured cheek but another does not, how does RE effectively prevent the model from learning this class's private features?

2. It’s puzzling how the model can maintain high classification accuracy despite significant feature differences between RE-altered training data and private test data, as seen in Figure 2(b). This raises concerns that the model's utility may be inflated, as it suggests the model may incorrectly match different individuals to the target class but still achieves high accuracy.

3. The user study design seems questionable. If users are choosing between two options, one of which closely resembles the reference image, it’s unclear how this evaluates privacy. Shouldn’t the study assess whether the two samples resemble?

4. The source code and link for the pre-trained target model are missing in Supplementary Materials.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 2
questions: My opinion is as stated in the weaknesses section. If this paper could provide a more profound theoretical analysis, I would like to increase the score.
soundness: 3
strengths: 1. The random erasing method employed in this paper is straightforward to implement, requiring only the erasure of certain regions in the training data. 

2. The paper offers a very detailed description of the experimental setup and conducts a comprehensive set of experiments to validate the performance of the adopted method.
summary: This paper proposes a method of defending against Model Inversion Attacks (MIA) through random erasing, which is simple to implement. Additionally, the authors provide a detailed description of the experimental setup and conduct extensive experiments to validate that this method effectively balances the model's utility and privacy.
weaknesses: The contribution of this paper is relatively limited. The authors employ random erasing as a defense against model inversion attacks, a strategy that has already been proposed as a form of data augmentation. It must be stated that we are not opposed to using simple methods to achieve objectives. As a paper intended for publication in a top-level academic conference, if it merely applies existing methods in different fields, we think that theoretical analysis is perhaps necessary. However, this paper relies heavily on experimental validation without truly revealing why random erasing can resist model inversion attacks. For instance, the authors' analysis is too intuitive; they believe that random erasing prevents the model from seeing the entire image. Even in the demonstration of feature space distribution, the authors only provide empirical results. Overall, this paper resembles more of a technical report than an academic paper. It is necessary to deepen the analysis of this paper, such as exploring the profound relationships between random erasing and model generalization, representation learning, and model inversion attacks.