InstaHide’s Sample Complexity When Mixing Two Private Images 

n O ( kpriv ) priv + poly ( npub ) time for any integer kpriv , where npriv and npub denote the number of images used in the private and the public dataset to generate a mixed image sample . Under the current setup for the InstaHide challenge of mixing two private images ( kpriv = 2 ) , this means n 4/3 priv samples are sufficient to recover a private image . In this work , we show that npriv log ( npriv ) samples are sufficient ( information-theoretically ) for recovering all the private images . 1 Introduction . Collaboratively training neural networks based on sensitive data is appealing in many AI applications , such as healthcare , fraud detection , and virtual assistants . How to train neural networks without compromising data confidentiality and prediction accuracy has become an important and common research goal Shokri & Shmatikov ( 2015 ) ; Ryffel et al . ( 2018 ) ; Phong et al . ( 2018 ) ; McMahan et al . ( 2017 ) ; Konečnỳ et al . ( 2016 ) in both academia and industry . Huang et al . ( 2020b ) recently proposed an approach called InstaHide for image classification . The key idea is to train the model on a dataset where ( 1 ) each image is a mix of kpriv private images and kpub public images , and ( 2 ) each pixel is independently sign-flipped after the mixing . Instahide shows promising prediction accuracy on MNIST Deng ( 2012 ) , CIFAR10 Krizhevsky ( 2012 ) , CIFAR-100 , and ImageNet datasets Deng et al . ( 2009 ) . TextHide Huang et al . ( 2020a ) applies InstaHide ’ s idea to text datasets and achieves promising results on natural language processing tasks . To understand the security aspect of InstaHide in realistic deployment scenarios , InstaHide authors present an InstaHide challenge Challenge ( 2020 ) that involves npriv = 100 private images , ImageNet dataset as the public images , m = 5000 sample images ( each image is a combination of kpriv = 2 private images and kpub = 4 public images and the sign of each pixel is randomly flipped ) . The challenge is to recover a private image given the set of sample images . Chen et al . ( 2021 ) is a theoretical work that formulates the InstaHide attack problem as a recovery problem . It also provides an algorithm to recover a private image assuming each private and public image is a random Gaussian image ( i.e. , each pixel is an i.i.d . draw from N ( 0 , 1 ) ) . The algorithm shows that O ( nkpriv−2/ ( kpriv+1 ) priv ) sample images are sufficient to recover one private image . Carlini et al . ( 2020 ) provides the first heuristic-based practical attack for the InstaHide challenge ( kpriv = 2 ) , and it can generate images that are visually similar to the private images in the InstaHide challenge dataset . Luo et al . ( 2021 ) provides the first heuristic-based practical attack for the InstaHide challenge ( kpriv = 2 ) when data augmentation is enabled . Although the InstaHide challenge is considered broken by several researchers , the current InstaHide challenge is itself too simple , and it is unclear whether the existing attacks Carlini et al . ( 2020 ) ; Luo et al . ( 2021 ) can still work when we use InstaHide to protect large numbers of private images ( large n ) Arora ( 2020 ) . This raises an important question : What ’ s the minimal number of InstaHide images needed to recover a private image ? This question is worthwhile to consider because it is a quantitative measure for how secure InstaHide is . With the same formulation in Chen et al . ( 2021 ) , we achieve a better upper bound on the number of samples needed to recover private images when kpriv = 2 . Our new algorithm can recover all the private images using only Ω ( npriv log ( npriv ) ) samples.1 This significantly improves the state-of-the-art theoretical results Chen et al . ( 2021 ) that requires n 4/3 priv samples to recover a single private image . However , our running time is exponential in the number of private images ( npriv ) and polynomial in the number of public images ( npub ) , where the running time of the algorithm in Chen et al . ( 2021 ) is polynomial in npriv and npub . In addition , we provide a four-step framework to compare our attacks with the attacks presented in Carlini et al . ( 2020 ) and Chen et al . ( 2021 ) . We hope our framework can inspire more efficient attacks on InstaHide-like approaches and can guide the design of future-generation deep learning algorithms on sensitive data . 1.1 Our result . Chen et al . ( 2021 ) formulates the InstaHide attack problem as a recovery problem that given sample access to an oracle that can generate as much as InstaHide images you want , there are two goals : 1 ) sample complexity , minimize the number InstaHide images being used , 2 ) running time , use those InstaHide images to recover the original images as fast as possible . Similar to Chen et al . ( 2021 ) , we consider the case where private and public data vectors are Gaussians . Let Spub denote the set of public images with |Spub| = npub , let Spriv denote the set of private images with |Spriv| = npriv . The model that produces InstaHide image can be described as follows : • Pick kpub vectors from public data set and kpriv vectors from private data set . • Normalize kpub vectors by 1/ √ kpub and normalize kpriv vectors by 1/ √ kpriv . • Add kpub + kpriv vectors together to obtain a new vector , then flip each coordinate of that new vector independently with probability 1/2 . We state our result as follows : Theorem 1.1 ( Informal version of Theorem 3.1 ) . Let kpriv = 2 . If there are npriv private vectors and npub public vectors , each of which is an i.i.d . draw from N ( 0 , Idd ) , then as long as d = Ω ( poly ( kpub ) log ( npub + npriv ) ) , there is some m = O ( npriv log npriv ) such that , given a sample of m random synthetic vectors independently generated as above , one can exactly recover all the private vectors in time O ( dm2 + dn2pub + n 2ω+1 pub +mn 2 pub ) + d2 O ( m ) with high probability . Notations . For any positive integer n , we use [ n ] to denote the set { 1 , 2 , · · · , n } . For a set S , we use supp ( S ) to denote the support of S , i.e. , the indices of its elements . We also use supp ( w ) to denote the support of vector w ∈ Rn , i.e . the indices of its non-zero coordinates . For a vector x , we use ‖x‖2 to denotes entry-wise ` 2 norm . For two vectors a and b , we use a ◦ b to denote a vector where i-th entry is aibi . For a vector a , we use |a| to denote a vector where the i-th entry is |ai| . Given a vector v ∈ Rn and a subset S ⊂ [ n ] we use [ v ] S ∈ R|S| to denote the restriction of v to the coordinates indexed by S. 1For the worst case distribution , Ω ( npriv ) is a trivial sample complexity lower bound . Contributions . Our contributions can be summarized into the following folds . • We propose an algorithm that recover all the private images using only Ω ( npriv log ( npriv ) ) samples in the recent theoretical framework of attacking InstaHide Huang et al . ( 2020b ) when mixing two private image , improving the state-of-art result of Chen et al . ( 2021 ) . • We summarize existing methods of attacking InstaHide into a unifying framework . By examining the functionality of each steps we identify the connection of a key step with problems in graph isomorphism . We also reveal the vulnerability of existing method to recover all private images by showing hardness to recover all images . Organizations . In Section 2 we formulate our attack problem . In Section 3 we present our algorithm and main results . In Section 4 we conclude our paper and discuss future directions . 2 Preliminaries . We use the same setup as Chen et al . ( 2021 ) . Definition 2.1 ( Image matrix notation , Definition 2.2 in Chen et al . ( 2021 ) ) . Let image matrix X ∈ Rd×n be a matrix whose columns consist of vectors x1 , . . . , xn ∈ Rd corresponding to n images each with d pixels taking values in R. It will also be convenient to refer to the rows of X as p1 , . . . , pd ∈ Rn . We define public set , private set and synthetic images following the setup in Huang et al . ( 2020b ) . Definition 2.2 ( Public/private notation , Definition 2.3 in Chen et al . ( 2021 ) ) . We will refer to Spub ⊂ [ n ] and Spriv = [ n ] \Spub as the set of public and private images respectively , and given a vector w ∈ Rn , we will refer to supp ( w ) ∩ Spub and supp ( w ) ∩ Spriv as the public and private coordinates of w respectively . Definition 2.3 ( Synthetic images , Definition 2.4 in Chen et al . ( 2021 ) ) . Given sparsity levels kpub ≤ |Spub| , kpriv ≤ |Spriv| , image matrix X ∈ Rd×n and a selection vector w ∈ Rn for which [ w ] Spub and [ w ] Spriv are kpub- and kpriv-sparse respectively , the corresponding synthetic image is the vector yX , w = |Xw| ∈ Rd where | · | denotes entrywise absolute value . We say that X ∈ Rd×n and a sequence of selection vectors w1 , . . . , wm ∈ Rn give rise to a synthetic dataset Y ∈ Rm×d consisting of the images ( yX , w1 , . . . , yX , wm ) > . We consider Gaussian image which is a common setting in phase retrieval Candes et al . ( 2013 ) ; Netrapalli et al . ( 2017 ) ; Candes et al . ( 2015 ) . Definition 2.4 ( Gaussian images , Definition 2.5 in Chen et al . ( 2021 ) ) . We say that X is a random Gaussian image matrix if its entries are sampled i.i.d . from N ( 0 , 1 ) . Distribution over selection vectors follows from variants of Mixup Zhang et al . ( 2017 ) . Here we ` 2 normalize all vectors for convenience of analysis . Since kpriv is a small constant , our analysis can be easily generalized to other normalizations . Definition 2.5 ( Distribution over selection vectors , Definition 2.6 in Chen et al . ( 2021 ) ) . Let D be the distribution over selection vectors defined as follows . To sample once from D , draw random subset T1 ⊂ Spub , T2 ⊆ Spriv of size kpub and kpriv and output the unit vector whose i-th entry is 1/ √ kpub if i ∈ T1 , 1/ √ kpriv if i ∈ T2 , and zero otherwise.2 For convenience we will define pub and priv operators as follows , Definition 2.6 ( Public/private operators ) . We define function pub ( · ) and priv ( · ) such that for vector w ∈ Rn , pub ( w ) ∈ Rnpub will be the vector which only contains the coordinates of w corresponding to the public subset Spub , and priv ( w ) ∈ Rnpriv will be the vector which only contains the coordinates of w corresponding to the private subset Spriv . 2Note that any such vector does not specify a convex combination , but this choice of normalization is just to make some of the analysis later on somewhat cleaner , and our results would still hold if we chose the vectors in the support of D to have entries summing to 1 . Algorithm 1 Recovering All Private Images when kpriv = 2 1 : procedure RecoverAll ( Y ) . Theorem 3.1 , Theorem 1.1 2 : . InstaHide dataset Y = ( yX , w1 , . . . , yX , wm ) > ∈ Rm×d 3 : . Step 1 . Retrieve Gram matrix 4 : M← 1 kpriv+kpub ·GramExtract ( Y , 1 2 ( kpub+kpriv ) ) . Algorithm 1 in Chen et al . ( 2021 ) 5 : . Step 2 . Subtract Public images from Gram matrix 6 : for i ∈ [ m ] do 7 : Si ← LearnPublic ( { ( pj ) Spub , y X , wi j ) } j∈ [ d ] ) . Algorithm 2 in Chen et al . ( 2021 ) 8 : end for 9 : Wpub ← ( pub ( vec ( S1 ) ) , . . . , pub ( vec ( Sm ) ) ) > . Wpub ∈ { 0 , 1 } m×npub 10 : Mpriv ← kpriv · ( M− 1kpubWpubW > pub ) 11 : . Step 3 . Assign original images 12 : Wpriv ← AssigningOriginalImages ( Mpriv , npriv ) . Algorithm 2 13 : . Step 4 . Solving system of equations . 14 : Ypub = 1√ kpub WpubX > pub . Xpub ∈ Rd×npub , Ypub ∈ Rm×d , Wpub ∈ { 0 , 1 } m×npub 15 : X̃ ← SolvingSystemofEquations ( Wpriv , √ kprivYpub , √ kprivY ) . Algorithm 3 16 : return X̃ 17 : end procedure For subset S̃ ⊂ S we will refer to vec ( S̃ ) ∈ Rn as the vector that vec ( S̃ ) i = 1 if i ∈ S̃ and vec ( S̃ ) i = 0 otherwise . We define the public and private components of W and Y for convenience . Definition 2.7 ( Public and private components of image matrix and selection vectors ) . For a sequence of selection vectors w1 , . . . , wm ∈ Rn we will refer to W = ( w1 , . . . , wm ) > ∈ Rm×n as the mixup matrix . Specifically , we will refer to Wpub ∈ { 0 , 1 } m×npub as the public component of mixup matrix and Wpriv ∈ { 0 , 1 } m×npriv as the private component of mixup matrix , i.e. , Wpub = √ kpub · pub ( W1 , ∗ ) ... pub ( Wm , ∗ ) ∈ { 0 , 1 } m×npub , Wpriv = √ kpriv · priv ( W1 , ∗ ) ... priv ( Wm , ∗ ) ∈ { 0 , 1 } m×npriv . We will refer to Xpub ∈ Rd×npub as public component of image matrix which only contains the columns of X ∈ Rd×n corresponding to the public subset Spub , and Xpriv ∈ Rd×npriv as private component of image matrix which only contains the columns of X ∈ Rd×n corresponding to the private subset Spriv . Furthermore we define Ypub ∈ Rm×d as public contribution to InstaHide images and Ypriv ∈ Rm×d as private contribution to InstaHide images : Ypub = 1√ kpub WpubX > pub , Ypriv = 1√ kpriv WprivX > priv . Instead of considering only one private image recovery as Chen et al . ( 2021 ) , here we consider a harder question which requires to recover all the private images . Problem 1 ( Exact Private image recovery ) . Let X ∈ Rd×n be a Gaussian image matrix . Given access to the public images { xs } s∈Spub and the synthetic dataset ( yX , w1 , . . . , yX , wm ) , where w1 , . . . , wm ∼ D are unknown selection vectors , output a set of vectors { x̃s } s∈Spriv for which there exists a one-to-one mapping φ from { x̃s } s∈Spriv to { xs } s∈Spriv satisfying φ ( x̃s ) j = ( xs ) j , ∀j ∈ [ d ] . 3 Recovering All Private Images when kpriv = 2 In this section , we prove our main algorithmic result . Our algorithm follows the high-level procedure introduced in section A . The details are elaborated in following subsections . Theorem 3.1 ( Main result ) . Let Spub ⊂ [ n ] , and let npub = |Spub| and npriv = |Spriv| . Let kpriv = 2 . Let k = kpriv + kpub . If d ≥ Ω ( poly ( kpub , kpriv ) log ( npub + npriv ) ) and m ≥ Ω ( kpoly ( kpriv ) npriv log npriv ) , then with high probability over X and the sequence of randomly chosen selection vectors w1 , . . . , wm ∼ D , there is an algorithm which takes as input the synthetic dataset Y > = ( yX , w1 , . . . , yX , wm ) ∈ Rd×m and the columns of X indexed by Spub , and outputs npriv images { x̃s } s∈Spriv for which there exists one-to-one mapping φ from { x̃s } s∈Spriv to { xs } s∈Spriv satisfying φ ( x̃s ) j = ( xs ) j for all j ∈ [ d ] . Furthermore , the algorithm runs in time O ( m2d+ dn2pub + n 2ω+1 pub +mn 2 priv + 2 m ·mn2privd ) . Remark 3.2 . Our result improves on Chen et al . ( 2021 ) on two aspects . First , we reduce the sample complexity from nkpriv−2/ ( kpriv+1 ) priv to npriv log npriv when kpriv = 2 . Note that our sample complexity is optimal up to logarithmic factors since finding unique solutions of linear system requires at least npriv sample complexity . Second , we can recover all private images exactly rather than recovering a single image , which is highly desirable for real-world practitioners . Furthermore notice that fixing all public images , multiplying any private image by −1 might not keep InstaHide images unchanged . Thus information theoretically , we are able to recover all private images precisely ( not only absolute values ) as long as we have access to sufficient synthetic images . In fact , from the proof of Lemma 3.7 our sample complexity suffices to achieve exact recovery .

Summary: The paper studies the sample complexity of InstaHide challenge in an idealized setting, where it is assumed that each public and private image is generated using a standard Gaussian distribution. Further, similar to previous attacks, the paper assumes that each image is a combination of 2 private images.  The main contribution of the paper is to show that using O(n polylog ) images one can recover all private images in the InstaHide challenge. This is an improvement over previous works in two ways: 1) The paper shows how to recover all images rather than few (or 1) images. 2) The previous best sample complexity for this case was n^4/3. However, on the downside, the running time of the algorithm is exponential in the number of private images.