Variational Model Inversion Attacks
Year: 2022

Abstract:
Given the ubiquity of deep neural networks, it is important that these models do not reveal information about sensitive data that they have been trained on. In model inversion attacks, a malicious user attempts to recover the private dataset used to train a supervised neural network. A successful model inversion attack should generate realistic and diverse samples that accurately describe each of the classes in the private dataset. In this work, we provide a probabilistic interpretation of model inversion attacks, and formulate a variational objective that accounts for both diversity and accuracy. In order to optimize this variational objective, we choose a variational family defined in the code space of a deep generative model, trained on a public auxiliary dataset that shares some structural similarity with the target dataset. Empirically, our method substantially improves performance in terms of target attack accuracy, sample realism, and diversity on datasets of faces and chest X-ray images.

heading: 1 Introduction
text: Thanks to recent advances, deep neural networks are now widely used in applications including facial recognition [Parkhi et al., 2015], intelligent automated assistants, and personalized medicine [Consortium, 2009; Sconce et al., 2005]. Powerful deep neural networks are trained on large datasets that could contain sensitive information about individuals. Publishers release only the trained models (e.g., on TensorFlow Hub [TensorFlow]), but not the original dataset to protect the privacy of individuals whose information is in the training set. Regrettably, the published model can leak information about the original training set [Geiping et al., 2020; Nasr et al., 2019; Shokri et al., 2017]. Attacks that exploit such properties of machine learning models are privacy attacks [Rigaki and Garcia, 2020]. Other real-world scenarios where an attacker can access models trained on private datasets include interaction with APIs (e.g., Amazon Rekognition [AWS]), or in the growing paradigm of federated learning [Bonawitz et al., 2019; Yang et al., 2019a], where a malicious insider can try to steal data from other data centers [Hitaj et al., 2017]. Kaissis et al. [2020] provides an overview of how these privacy concerns are hindering the widespread application of deep learning in the medical domain.
This paper focuses on the model inversion (MI) attack, a type of privacy attack that tries to recover the training set given access only to a trained classifier [Chen et al., 2020; Fredrikson et al., 2015, 2014; Hidano et al., 2017; Khosravy et al., 2020; Yang et al., 2019b; Zhang et al., 2020]. The classifier under attack is referred to as the “target classifier” (see Figure 1). An important relevant application concerns identity recognition from face images, since facial recognition is a common approach to biometric identification [Galbally et al., 2014; Rathgeb and Uhl, 2011]. Once an attacker successfully reconstructs images of the faces of individuals in the private training set, they can use the stolen identity to break into otherwise secure systems.
Early studies of MI attacks focused on attacking classifiers whose inputs are tabular data [Fredrikson et al., 2015, 2014; Hidano et al., 2017] by directly performing inference in the input space. However, the same methods fail when the target classifier processes high-dimensional inputs, e.g., in the above
35th Conference on Neural Information Processing Systems (NeurIPS 2021), held virtually.
example of a face recognizer. Recent methods cope with this high-dimensional search space by performing the attack in the latent space of a neural network generator [Khosravy et al., 2020; Yang et al., 2019b; Zhang et al., 2020]. Introducing a generator works well in practice, but this success is not theoretically understood. In this paper, we frame MI attacks as a variational inference (VI) [Blei et al., 2017; Jordan et al., 1999; Kingma and Welling, 2013] problem, and derive a practical objective. This view allows us to justify existing approaches based on a deep generative model, and identify missing ingredients in them. Empirically, we find that our proposed objective leads to significant improvements: more accurate and diverse attack images, which are quantified using standard sample quality metrics (i.e., FID [Heusel et al., 2017], precision, and recall [Kynkäänniemi et al., 2019; Naeem et al., 2020]).
In summary, our contributions and findings are:
• We view the model inversion (MI) attack problem as a variational inference (VI) problem. This view allows us to derive a practical objective based on a statistical divergence, and provides a unified framework for analyzing existing methods.
• We provide an implementation of our framework using a set of deep normalizing flows [Dinh et al., 2014, 2016; Kingma and Dhariwal, 2018] in the extended latent space of a StyleGAN [Karras et al., 2020]. This implementation can leverage the hierarchy of learned representations, and perform targeted attacks while preserving diversity.
• Empirically, on the CelebA [Liu et al., 2015], and ChestX-ray [Wang et al., 2017] datasets, our method results in higher attack accuracy, and more diverse generation compared to existing methods. We provide thorough comparative experiments to understand which components contribute to improved target accuracy, sample realism, and sample diversity, and detail the benefits of the VI perspective.
Code can be found at https://github.com/wangkua1/vmi.

heading: 2 Problem Setup: Model Inversion Attack
text: In the problem of model inversion (MI) attack, the attacker has access to a “target classifier”:
pTAR(y|x) : Rd → ∆C−1
where ∆C−1 to denote the (C − 1)-simplex, representing the C-dimensional probability where C is the number of classes. This target classifier is trained on the private target dataset, DTAR = {xi, yi}NTARi=1 where x ∈ Rd and y ∈ {1, 2, ..., C}. We use pTAR(y|x) to denote the given target classifier, which is an approximation of the true conditional probability pTAR(y|x) of the underlying data generating distribution.
Goal. Given a target classifier pTAR(y|x), we wish to approximate the class conditional distribution pTAR(x|y) without having access to the private training set DTAR.
A good model inversion attack should approximate the Bayes posterior pTAR(x|y) ∝ pTAR(y|x)pTAR(x) well, and allow the attacker to generate realistic, accurate, and diverse samples. Notice, our goal shifts slightly from recovering the exact instances in the training set to recovering the data generating distribution of the training data. Let’s consider a scenario where the attacker intends to fake a victim’s identity. A good security system might test the realism of a sequence of inputs [Holland and Komogortsev, 2013]. More generally, faking someone’s identity requires passing a two-sample test [Holland and Komogortsev, 2013; Lehmann and Romano, 2006], which means the ability to generate samples from pTAR(x|y) is necessary. Another scenario can be an attacker trying to steal private/proprietary information. For example, a malicious insider in a federated learning setting can try to steal information from another datacenter by accessing the shared model [Hitaj et al., 2017]. In such a scenario, a good pTAR(x|y) model can reveal not only the distinguishing features of the data, but also its variations.

heading: 3 Related Work
text: In this section, we first discuss related model inversion attack studies, and then discuss applications of inverting a classifier outside of the privacy attack setting. Lastly, since our attack method relies on using a pretrained generator, we discuss existing studies that used a pretrained generator for improving other applications.
Model inversion attacks. MI attacks are one type of privacy attack where the attacker tries to reconstruct the training examples given access only to a target classifier. Other privacy attacks include membership attacks, attribute inference, and model extraction attacks (see Rigaki and Garcia [2020] for a general discussion). Fredrikson et al. [Fredrikson et al., 2015, 2014] were the first to study the MI attack and demonstrated successful attacks on low-capacity models (e.g., logistic regression, and a shallow MLP network) when partial input information was available to the attacker. The setting where partial input information was not available was studied by Hidano et al. [2017]. They termed performing gradient ascent w.r.t. the target classifier in the input space a General Model Inversion attack. Though effective on tabular data, this approach failed on deep image classifiers. It is well-known that directly performing gradient ascent in the image space results in imperceptible and unnatural changes [Szegedy et al., 2013].
To handle high-dimensional observations such as images, MI attacks based on deep generators were proposed [Chen et al., 2020; Yang et al., 2019b; Zhang et al., 2020]. By training a deep generator on an auxiliary dataset, these methods effectively reduce the search space to only the manifold of relevant images. For example, if the target classifier is a facial recognition system, then an auxiliary dataset of generic faces can be easily obtained. Zhang et al. [2020] pretrain a Generative Adversarial Network (GAN) [Goodfellow et al., 2014] on the auxiliary dataset and performed gradient-based attack in the latent space of the generator. Yang et al. [2019b] trained a generator that inverts the prediction of the target classifier, using the architecture of an autoencoder.
Other applications of classifier inversion. Inverting the predictions and activations of a classifier has been studied for applications such as model explanation, and model distillation. Motivated by using saliency maps to explain the decision of a classifier [Simonyan et al., 2013], Mahendran and Vedaldi [2015] proposed to maximize the activation of a target neuron in a classifier for synthesizing images that best explain that neuron. Their method is based on gradient ascent in the pixel-space. The same idea was recently extended to enable knowledge distillation in a setting where the original dataset was too large to be transferred [Yin et al., 2020]. Methods above have the advantage of not requiring the original dataset, but the generated images still appear unnatural. One effective way to improve the realism of the generated images is to optimize in the latent code space of a deep generator [Nguyen et al., 2015, 2017].
Pretrained generators. Pretrained generators from GANs have other applications. Image inpainting/restoration was one of the early successful applications of using a pretrained GAN as image prior. Yeh et al. [2017] optimized the latent code of GANs to minimize the reconstruction error of a partially occluded image for realistic inpainting. The same method formed the basis of AnoGAN, a popular technique for anomaly detection in medical images [Schlegl et al., 2017]. A combination of reconstruction error and discriminator loss was used as the anomaly score. A potential future direction is to apply our proposed method to these adjacent applications.

heading: 4 Model Inversion Attack as Variational Inference
text: In this section, we derive our Variational Model Inversion (VMI) learning objective. For each class label y, we wish to approximate the true target posterior with a variational distribution q(x) ∈ Qx, where Qx is the variational family. This can be achieved by the optimizing the following objectives
q∗(x) = argmin q∈Qx
{ DKL(q(x)||pTAR(x|y)) } = argmin
q∈Qx
{ Eq(x)[− log pTAR(y|x)] +DKL(q(x)||pTAR(x)) + log pTAR(y) } = argmin
q∈Qx
{ Eq(x)[− log pTAR(y|x)] +DKL(q(x)||pTAR(x)) } . (1)
where in Equation 1 we have used the fact that log pTAR(y) is independent of q(x), and thus can be dropped in the optimization.
Auxiliary Image Prior. In order to minimize Eq. (1), we need to compute DKL(q(x)||pTAR(x)), which requires evaluating the true image prior pTAR(x), that is not accessible. Similar to recent works on MI attacks [Khosravy et al., 2020; Yang et al., 2019b; Zhang et al., 2020], we assume that a public auxiliary dataset DAUX, which shares structural similarity with the target dataset, is available to learn an auxiliary image prior pAUX(x). This auxiliary image prior pAUX(x) is learned using a generative adversarial network (GAN) pAUX(x) = EpAUX(z)[pG(x|z)], where pAUX(z) = N (0, I) is the GAN prior, and pG(x|z) is the GAN generator that is parameterized by a deep neural network G(z), and a Gaussian observation noise with small standard deviation σ: pG(x|z) = N ( G(z), σ2I ) , or equivalently x = G(z) + σϵ, ϵ ∼ N (0, I).
The learned generator pG(x|z) defines a low dimensional manifold in the observation space x, when z is chosen to have fewer dimensions than x. We now make the following assumption about the structural similarity of pAUX(x) and pTAR(x). Assumption 1 (Common Generator). We assume pTAR(x) is concentrated close to the low dimensional manifold of pG(x|z), learned from the auxiliary dataset DAUX. In other words, we assume there exists a target prior pTAR(z), possibly different from pAUX(z), such that pTAR(x) ≈ EpTAR(z)[pG(x|z)]. We refer to pG(x|z) as the “common generator”.
The name “common generator” is inspired by recent progress in theoretical analyses of few-shot and transfer learning, where assumptions about an underlying shared representation have been used to provide error bounds. In these works, this shared representation is referred to as the “common representation” [Du et al., 2020; Tripuraneni et al., 2020]. Assumption 1 usually holds in the context of model inversion attacks. For example, pAUX(x) could be the distribution of all human faces, while pTAR(x) could be the distribution of the celebrity faces; or pAUX(x) could be the distribution of natural images, while pTAR(x) could be the distribution of different breeds of dogs. In these examples, both pAUX(x) and pTAR(x) approximately live close to the same low dimensional manifold, but the distribution on this shared manifold could be different, i.e., pTAR(z) ̸= pAUX(z).
Variational Family. We further consider our variational family Qx to be all distributions that lie on this manifold by assuming that q(x) is of the form q(x) = Eq(z)[pG(x|z)], q(z) ∈ Qz, where Qz is a variational family in the code space. In the next section, we further restrict Qz to be either Gaussian distributions or normalizing flows. Proposition 1. We have DKL ( q(z)||pTAR(z) ) ≥ DKL ( Eq(z)[pG(x|z)]||EpTAR(z)[pG(x|z)] ) .
See Appendix A for the proof. Using Assumption 1, we can approximate the objective of Equation 1 with q∗(z) = argmin
q∈Qz
{ Ez∼q(z),ϵ∼N (0,I)[− log pTAR(y|G(z) + σϵ)] +DKL ( Eq(z)[pG(x|z)]||EpTAR(z)[pG(x|z)] )} ,
(2)
where this objective is now defined in terms of q(z) ∈ Qz in the latent space of the GAN. Now using the Proposition 1, we can obtain the following upper bound on the objective of Equation 2 (assuming σ = 0)
q∗(z) = argmin q∈Qz
{ Ez∼q(z)[− log pTAR(y|G(z))] +DKL(q(z)||pTAR(z)) } . (3)
Power Posteriors. We now consider the optimization of Equation 3. Since we do not have access to pTAR(z), we propose to replace it with pAUX(z), noting that, as argued above, pAUX(z) may not accurately represent pTAR(z). We also propose to replace the unknown likelihood pTAR(y|G(z)) with the pTAR(y|G(z)) defined by the target classifier, noting that this likelihood could be miscalibrated. Miscalibration is a known problem in neural network classifiers [Guo et al., 2017]; namely, the classifier predictions can be over- or under-confident. In order to account for these issues, instead of the standard Bayes posterior qBAYES(z) ∝ pAUX(z)pTAR(y|G(z)) as the solution of Equation 3, we consider the family of “power posterior” 1 [Bissiri et al., 2016; Holmes and Walker, 2017; Knoblauch et al., 2019; Miller and Dunson, 2018], which raise the likelihood function to a power 1γ
q∗γ(z) ∝ pAUX(z)p 1 γ TAR(y|G(z)),
and can be characterized as the solution of the following optimization problem:
q∗γ(z) = argmin q∈Qz LγVMI(q), (4)
LγVMI(q) := Ez∼q(z)[− log pTAR(y|G(z))] + γDKL(q(z)||pAUX(z)).
See Appendix A for the proof. If the prior pAUX(z) is not reliable, by decreasing γ, we can reduce the importance of the prior. Similarly, by adjusting γ, we can reduce or increase the importance of overor under-confident likelihood predictions pTAR(y|G(z)).
Accuracy vs. Diversity Tradeoff. In the context of model inversion attack, the Bayes posterior qBAYES(z) can only achieve a particular tradeoff between the accuracy and diversity of the generated samples. However, the family of power posteriors enables us to achieve an arbitrary desired tradeoff between accuracy and diversity by tuning γ. If γ = 0, then q∗γ=0(z) = δ(z − z∗), and the model essentially ignores the image prior and diversity, and finds a single point estimate z∗ on the manifold which maximizes the accuracy pTAR(y|G(z)). As we increase γ, the the model achieves larger diversity at the cost of smaller average accuracy. When γ = 1, we recover the Bayes posterior q∗γ=1(z) ∝ pAUX(z)pTAR(y|G(z)). In the limit of γ → ∞, we have q∗∞(z) = pAUX(z). In this case, the model ignores the classifier and accuracy, and sample unconditionally from the auxiliary distribution (maximum diversity). We empirically study the effect of γ in Section 5.

heading: 4.1 The Common Generator
text: In the previous section, we derived a practical MI objective from the perspective of variational inference. Similar to previous works [Chen et al., 2020; Zhang et al., 2020] VMI requires a common generator that is trained on a relevant auxiliary dataset. In this subsection, we first provide a brief description of the most common choice, DCGAN. Then, we introduce StyleGAN, which has an architecture that allows for fine-grained control. Finally, we describe how to adapt our VMI objective to leverage this architecture by using a layer-wise approximate distribution.
For the common generator G we use a GAN due to their ability to synthesize high quality samples [Abdal et al., 2019; Bau et al., 2018; Karras et al., 2019; Shen et al., 2020]. The generator is trained on the auxiliary dataset. A common choice is the DCGAN architecture [Radford et al., 2015]. Though optimizing in the latent space results in more realistic samples, this search space is also more restrictive. Early investigation showed that optimizing at some intermediate layers of a pretrained generator was better than either optimizing in the code space, or the pixel space. This motivated the use of a generator architecture where activations of intermediate layers can be manipulated.
StyleGAN. A framework that naturally allows for optimization in the intermediate layers is the StyleGAN [Karras et al., 2019]. It consists of a mapping network f : z 7→ w, and a synthesis network S. The synthesis network takes as input one w at each layer, S : {wl}Ll=1 7→ x, where L is the number of layers in S. During training of a StyleGAN, the output from the mapping network is copied L times, {w}Ll=1 = COPY(w, L) before being fed to the synthesis network. This input space of the synthesis network S has been referred to as the “extended w space” [Abdal et al., 2019]. The full generator is GSTYLE(z) = S ( COPY ( f(z), L )) .
1These posterior updates are sometimes referred to as “power likelihood” or “power prior” [Bissiri et al., 2016].
StyleGAN is known for its surprising ability to perform “style mixing”. Namely, the synthesis network can generate a “mixed” image, when being fed a mixture of two w’s in the extended w space, i.e., S([{w1}L0l=1; {w2}Ll=L0+1]), where [·; ·] denotes concatenation, and L0 is some intermediate layer. Figure 2 visualizes the effect of manipulating different layers of the synthesis network. Performing an attack in this extended w space allows us to achieve the desired effect of optimizing the intermediate layers. Because of the lack of a explicit prior for w, we instead optimize the extended z space (Figure 3). Suppose q(z1, . . . , zL) is the joint density over
z1, . . . , zL, and ql(zl) is the marginal density over zl. We consider the following objective for the VMI with the StyleGAN generator:
LγS-VMI(q) := Eq(z1,...,zL) [ − log pTAR ( y ∣∣∣S({f(zl)}Ll=1))]+ γL L∑ l=1 DKL(ql(zl)||pAUX(zl)). (5)

heading: 4.2 Code Space Variational Family Qz
text: In the VMI formulations (Equation 4 and 5), the approximate distribution q(z) can be seen as a generator, or “miner” network [Wang et al., 2020] for the latent space of the common generator. It must belong to a distribution family Qz, whose distribution can be sampled from, and can be evaluated in order to optimize the KL-divergence. In this work, we experiment with a powerful class of tractable generative models: deep flow models. When optimizing LγS-VMI(q) (Equation 5), we use L such models, one for each layer in the synthesis network. In our experiments, we used an architecture similar to that of Glow [Kingma and Dhariwal, 2018], where we treated the latent vector as 1x1 images. We removed the original squeezing layers that reduced the image size to account for this change. We also experimented with using a Gaussian variational family for q(z).

heading: 4.3 Relationships with Existing Methods
text: VMI provides a unified framework that encompasses existing attack methods. Through the lens of VMI, we can obtain insights on the conceptual differences between the existing methods and their pros and cons. “General MI” attack [Hidano et al., 2017] performs the following optimization:
x∗ = argmax x log pTAR(y|x). (6)
Note that this objective can be viewed as special case of VMI, where the code space is the same as the data space, and we have γ = 0 in the objective: Lγ=0VMI (q). In this case, as discussed in the previous section, the q(x) distribution collapses to a point estimate at which pTAR(y|x) is maximized. As we will see in the experiment section, since the optimization is in the data space, the solution does not live close the manifold of images, and thus generally does not structurally looks like natural images.
“Generative MI” attack [Zhang et al., 2020] also uses a generator trained on an “auxiliary” dataset. The attack optimizes the following objective:
z∗ = argmin z
{ − λ log pTAR(y|(G(z))− log σ ( D(G(z)) )} (7)
where G,D denotes the generator and discriminator respectively, and σ(·) is the sigmoid function. Note that this objective can be viewed as special case of VMI, with γ = 1λ , and with the prior p(z) ∝ σ ( D(G(z) ) , and a point estimate for z, instead of optimizing over distributions q(z). As a result of this point-wise optimization, the Generative MI attack requires re-running the optimization procedure for every new samples. In contrast, VMI learns a distribution q(z) using expressive normalizing flows, which allows us to draw multiple attack samples after a single optimization procedure. Recently, Chen et al. [2020] proposed extending Generative MI by considering a Gaussian variational family in the latent space of the pretrained generator in Equation 7. However, we note this method still theoretically results in collapsing the Gaussian variational distributions to a point estimate. VMI prevents this by penalizing the entropy of the variational distribution with the KL-divergence term. From the implementation perspective, Chen et al. [2020] uses DCGAN while we use StyleGAN which helps us to achieve better disentanglement. Furthermore, we use a more expressive variational family such as normalizing flows.

heading: 5 Experiments
text: In this section, we demonstrate the effectiveness of the proposed VMI attack method on three separate tasks. We will refer to each task by their target dataset: MNIST [LeCun et al., 2010], CelebA [Liu et al., 2015], and ChestX-ray (CXR) [Wang et al., 2017]. Then, we showcase the robustness of the VMI attack to different target classifiers on CelebA. More experimental details can be found in Appendix B.
Data. For the MNIST task, we used the ‘letters’ split (i.e., handwritten English alphabets) of the EMNIST [Cohen et al., 2017] dataset as the auxiliary dataset. For CelebA, we used the 1000 most frequent identities as the target dataset, and the rest as the auxiliary dataset. For ChestX-ray, we used the 8 diseases outlined by Wang et al. [2017] as the target dataset, and randomly selected 50,000 images from the remaining as the auxiliary dataset. Real samples from these six datasets are visualized in Figure 4. Target classifiers. The target classifiers used in all tasks were ResNets trained using SGD with momentum. Optimization hyperparameters were selected to maximize accuracy on a validation set of the private data.
Evaluation metrics. An ideal evaluation protocol should measure different aspects of the attack samples such as target accuracy, sample realism, and sample diversity.
Target Accuracy: To automate the process of judging the accuracy of an attack, we use an “evaluation” classifier. This metrics measures how well the generated samples resemble the target class/identity. Given a target identity i, an attack produces a set of samples {x′n}Nn=1. Each sample is assigned a predicted label by the evaluation classifier, and then the top-1 accuracy is computed.
If a good evaluation classifier only generalized to realistic inputs, then this metric would also penalize unrealistic attack samples. To some extent, this was the case in our experiments as evidenced by the extremely low accuracy assigned to the General MI attack baseline in Table 1. In Figure 5, the General MI attack samples were clearly unrealistic. To ensure a fair and informative evaluation, the evaluation classifier should be as accurate and generalizable as possible (details in Appendix B.3).
Sample Realism: We used FID [Heusel et al., 2017] to directly measure the overall sample quality. To compute FID, we aggregated attack samples across classes and compared them to aggregated real images. Following standard practice, the feature extractor used for computing FID was the pretrained Inception network [Szegedy et al., 2015].
Sample Diversity: Though FID captures realism and overall diversity, it is known to neglect properties such as intra-class diversity, which is an important feature of a good MI attack. To overcome this limitation, we computed the improved precision & recall [Kynkäänniemi et al., 2019], coverage & density [Naeem et al., 2020] on a per class basis, capturing the intra-class diversity of the generated samples. The same Inception network was used as the feature extractor. Recall proposed in Kynkäänniemi et al. [2019] can be problematic when the generated samples contain outliers. Coverage proposed in Naeem et al. [2020] is less susceptible to outliers, but also less sensitive. For convenience of comparison, we take the average of the two quantities and call the resulting metric “diversity”.
Generators. Two generator models were considered: DCGAN [Radford et al., 2015], and StyleGAN [Karras et al., 2019]. For StyleGAN, we used the original implementations.2 There were 10 and 12 layers in the synthesis networks for the 64x64 CelebA data and 128x128 ChestX-ray data respectively. We do not use StyleGAN for the MNIST task since the images are simple.

heading: 5.1 Results
text: Comparison with Baselines. Across all three tasks, our VMI formulations outperformed baselines in terms of target accuracy and sample realism (see Table 1), even when using the same generator architecture (DCGAN). Using a flow model for q(z) led to improvements in terms of accuracy. Using the formulation in Equation 5 and a StyleGAN further improved performance on all metrics. VMI also improved the overall sample qualities as evidenced by the lower FIDs. The full VMI (Equation 5) was able to improve FID over pre-trained generators on CelebA. In general, MI attack methods including VMI sacrificed sample quality to achieve higher accuracy, suggesting there is still room for improvements for methods that can retain full realism. Detailed evaluation using sample diversity metrics are reported in Table 2. In general, increasing γ increased diversity and realism while sacrificing accuracy. Our VMI attack outperformed the baseline on all metrics at multiple settings. The reported improvements in the quantitative metrics can be verified qualitatively in Figure 5. Detailed results for MNIST and ChestX-ray (Table 4, and 5) can be found in the Appendix C. Using StyleGAN with a Gaussian q(z) resulted in a slightly lower accuracy, but better diversity.
Our reported results for our baseline [Zhang et al., 2020] are obtained using our own implementation since the reproduction code was not publicly available. The discrepancy with the original result can come from a number of factors: dataset split, target classifier checkpoint, and the hyperparameters involved in the method. We used the task setup described in this paper, and tuned the hyperparameters over a reasonable grid of values.
2Code from: https://github.com/NVlabs/stylegan2-ada
Attacking Different Target Classifiers. After establishing the effectiveness of our VMI attack on different datasets, we conducted experiments to test the effectiveness of our VMI attack against different target classifiers. We further tested two target classifier on CelebA: a VGG network [Simonyan and Zisserman, 2014] trained from scratch on our target dataset, and an adapted ArcFace classifier [Deng et al., 2019], which we denote as ArcFace-NC. The ArcFace is a specialized face identity recognizer pretrained on a large collection of datasets. We adapt it by using the pretrained network as a feature encoder,3 and adding a nearest cluster classifier in the feature space. This approach of adapting a powerful feature extractor is popular and effective in few-shot classification [Chen et al., 2019; Snell et al., 2017]. The resulting accuracy on held-out test examples in the target dataset were 62.1% (VGG) and 96.1% (ArcFace-NC). Results in Table 3 show that the same observations hold.
Accuracy vs. Diversity Tradeoff. Figure 6 shows the accuracy vs. diversity tradeoff in VMI attacks on CelebA. The VMI attacks that used the StyleGAN generally achieved a better accuracy vs. diversity tradeoff than the ones used the DCGAN. We conjecture this is because of the better layer-wise disentanglement that the StyleGAN achieves.
Effect of Individual Layers. As motivated in Section 4.1, the extended latent space in Equation 5 allowed our attack to modify each layer which controlled different aspects of an image. Figure 7 shows values for the KL-divergence and entropy for ql(z) at all layers after VMI optimization in CelebA and ChestX-ray datasets. We can see a
general downward trend in KL divergences and an upward trend in entropies of q(z) with respect to layers. This shows that in general the q(z) of the earlier layers were modified more by the optimization than the q(z) of the later layers. This is consistent with our observation in Figure 2 that the earlier layers have more control over features relevant to the identity of a face.
3Code and model from: https://github.com/TreB1eN/InsightFace_Pytorch

heading: 6 Limitation & Ethical Concerns
text: While our VMI attack was effective, it relied on the same assumption made in previous works: the attacker had access to a relevant auxiliary dataset [Yang et al., 2019b; Zhang et al., 2020]. A worthwhile future direction is to develop methods that do not depend on this assumption. Methodologically, our proposed VMI attack used a GAN to narrow down the search space of the variational objective, but GANs might not be equally effective for other data modalities such as text, and tabular data. Lastly, our study focused on the white-box setting where the attacker had full access to the model; extensions of the current VMI attack to the grey-box or black-box settings are also worthy of further investigation.
In this work, we focused on a method for improving model inversion attacks, which could have negative societal impacts if it falls into the wrong hands. As discussed in Section 1, malicious users can use attacks like this to break into secured systems and steal information from private data-centers. On the other hand, by pointing out the extent of the vulnerability of current models, we hope to facilitate research that builds better privacy-preserving algorithms, and raise awareness about privacy concerns.

heading: 7 Conclusion
text: An effective model inversion attack method must produce a set of samples that accurately captures the distinguishing features and variations of the underlying identity/class. Our proposed VMI attack optimizes a variational inference objective by using a combination of a StyleGAN generator and a deep flow model as its variational distribution. Our framework also provides insights into existing attack methods. Empirically, we found our VMI attacks were effective on three different tasks, and across different target classifiers.
Acknowledgments and Disclosure of Funding
Acknowledgement. We would like to thank reviewers and ACs for constructive feedback and discussion. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute www.vectorinstitute.ai/#partners.

Review summaries:
This paper frames the model inversion problem as a variational inference problem, where the goal is to approximate the posterior distribution p^{tar}(x|y) from the known target classifier p^{tar}(y|x). From a class of candidate distributions q(x), the aim is to find one that is close to p^{tar}(x|y), and this is achieved by minimizing the KL-divergence between the 2 distributions. Such a formulation allows the authors to make a principled derivation of an objective function that encourages both the optimized distribution to produce images likely to be classified correctly by the target classifier, and the produced images to be realistic. It is also a unified framework for existing methods of generative model inversion.  Additionally, the authors propose using the StyleGAN architecture as a pre-trained generator for the model inversion task. This allows intermediate layers (as opposed to just the input latent code in previous formulations) of the GAN to be optimized during the search for q*, improving the expressiveness of the GAN. The StyleGAN architecture also means that the attack can focus on layers whose representations control the semantics of the final image.  

The paper at hand propose a new model inversion attack that recovers the training dataset that was used to learn a supervised model. The proposed attack uses generative adversarial networks (namely a DCGAN and a StyleGAN) and variational inference to invert the probability distribution $p(y|x)$ that is learned by the classifier. The authors also describe how the proposed VMI framework can be seen as an unified framework of existing model inversion attacks. Experimental evaluation was performed on MNIST, the ChestX-ray dataset and the CelebA dataset.

This paper frames model inversion attacks as a variational inference problem, leading to the derivation shown in Equation one. Following prior work, they also assume access to a common generator, than can be learned on auxiliary data and can capture a shared conditional distribution $p_G(x|z)$. With this assumption, they can derive a practical objective as shown in Equation 3, which maximizes (in code space) the attack accuracy (first term) and the realism / diversity of the generated samples (KL term).   From an empirical standpoint, they experiment using both DGGAN and StyleGAN as their pretrained generator, and using either a gaussian or flow model to form their $q(z)$. They show that their model outperforms prior work across MNIST, CelebA and CXR datasets in terms of attack accuracy, FID and diversity.