GAN You See Me? Enhanced Data Reconstruction Attacks against Split Inference
Authors: Ziang Li
Mengda Yang
Yaxin Liu
Juan Wang
Hongxin Hu
Wenzhe Yi
Xiaoyang Xu
Venue: NeurIPS 2023 poster (2023)
Keywords: deep learning
split inference
data reconstruction attack

Abstract: Split Inference (SI) is an emerging deep learning paradigm that addresses computational constraints on edge devices and preserves data privacy through collaborative edge-cloud approaches. However, SI is vulnerable to Data Reconstruction Attacks (DRA), which aim to reconstruct users' private prediction instances. Existing attack methods suffer from various limitations. Optimization-based DRAs do not leverage public data effectively, while Learning-based DRAs depend heavily on auxiliary data quantity and distribution similarity. Consequently, these approaches yield unsatisfactory attack results and are sensitive to defense mechanisms. To overcome these challenges, we propose a GAN-based LAtent Space Search attack (GLASS) that harnesses abundant prior knowledge from public data using advanced StyleGAN technologies. Additionally, we introduce GLASS++ to enhance reconstruction stability. Our approach represents the first GAN-based DRA against SI, and extensive evaluation across different split points and adversary setups demonstrates its state-of-the-art performance. Moreover, we thoroughly examine seven defense mechanisms, highlighting our method's capability to reveal private information even in the presence of these defenses.

GAN You See Me? Enhanced Data Reconstruction
Attacks against Split Inference
Ziang Li', Mengda Yang', Yaxin Liu', Juan Wang' Hongxin Hu?, Wenzhe Yi! and Xiaoyang Xu!
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University
Department Computer Science and Engineering, University at Buffalo, SUNY
Abstract
Split Inference (SI) is emerging deep learning paradigm that addresses computa- tional constraints on edge devices and preserves data privacy through collaborative edge-cloud approaches. However, SI is vulnerable to Data Reconstruction Attacks (DRA), which aim to reconstruct users' private prediction instances. Existing attack methods suffer from various limitations. Optimization-basee DRAs do not leverage public data effectively, while Learning-bar -based DRAs depend heavily on auxiliary data quantity and distribution similarity. Consequently, these approaches yield unsatisfactory attack results and are sensitive to defense mechanisms. To overcome these challenges, we propose a GAN-based LAtent Space Search tack (GLASS) that harnesses abundant prior knowledge from public data using advanced StyleGAN technologies. Additionally, we introduce GLASS+ to en- hance reconstruction stability. Our approach represents the first GAN-based DRA against SI, and extensive evaluation across different split points and adversary setups demonstrates its state-of mate-off-the-ar performance. Moreover, we thoroughly examine seven defense mechanisms, highlighting our method's capability to reveal private information even in the presence of these defenses.
Introduction
The emergence of Deep Learning (DL) has brought about transformative impact machine learning applications, granting them remarkable capabilities. To cater to the increasing demand for DL models on edge-side devices, various challenges related to performance arise. The growing size of model parameters poses burden on resource-constrained edge devices. solution. However, deploying DL. services
result, concept of Machine
Learning as a Service (ML LaaS) has gained popularity in the cloud, where APIs are provided to users and raw data is collected for service provisioning, raises concerns about potential data leakage. In this context, Split Inference (SI) has emerged
promising alternative [Eshratifar et al., 2019: Samitalebi-Dehkoore et al. 202 Kang et al. 2017] Matsubara al. 2022 Hauswald et al. 2014]. SI involves splitting and deploying DNN models between the edge and the cloud, allowing the cloud's 's extensive computing and storage resources to be leveraged while ensuring that users only need to upload intermediate feature representations to protect the confidentiality of their original data.
However, recent studies have demonstrated that even with the use of intermediate feature repre- sentations, a malicious cloud server can still launch privacy attacks. Of particular concern is the Data Reconstruction Attack (DRA) [He et al,, 2019; [iinhh et al., 2021; Yang et al.) [022], which represents the most severe violation of user privacy as aims to reconstruct the user's inference
"Corresponding author: jwang whu.edu.cn
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Edge
Me
Ms
Cloud
T
y² predicted result
prinate inpur
Figure 1: Split Inference.
instances. Existing DRAs sufter from critical flaws that significantly diminish their effectiveness.
Optimization-basee DRAs [He et al. 2019 Singh et al. 2021]. for example, fail to effectively
leverage public data, while Learning-basse DRAs He 2019 heavily depend the quantity of
auxiliary data and require a high degree of distribution similarity between the auxiliary data and the inference data.
To address these limitations and enhance the impact of the attack, we propose the GAN-based LAtent Space Search attack (GLASS). This attack leverages the power of StyleGAN KKrras al. 2019 2020 2021 Sauer et al. 2022 and fully capitalizes on the valuable prior knowledge embedded in public data. Additionally, introduce GLASS++ improved version that enhances attack stability and effectiveness.
We systematically evaluate the reconstruction performance of Optimization-based GLASS and Learning- based GLASS++ on face data at different split points. Additionally, we thoroughly examine and analyze seven advanced defense mechanisms against DRA in SI. These mechanisms
catego-
rized into three types: Clipping (Dropout Defense He et al. 2220), DISCO (Singh et al. [02T]). Noise
Addition (Noise Mask (ittombe al. 2021), Shredder Mireshghallah et al. 2020 and Feature Obfuscating (Adversarial Learning Li et al. 2021), NoPeek Vepakomma et al. 2020 and Siamese Defense Osia al. 2020)) ). Furthermore,
go beyond the traditional assumptions about adversary capabilities and extend our attack to heterogeneous data. Through our extensive experimentation, we achieve superior attack results
various split points and different adversary setups, successfully bypassing the employed defense mechanisms and compromising their effectiveness.
The key contributions of this paper
We propose GLASS and GLASS++, which are enhanced DRAs combined with pre-trained StyleGAN models. This the first instance of utilizing the latent space search characteristic of StyleGAN to develop DRAs specifically for SI. Additionally, we expand the practicality our methods by designing attack strategies for various adversary settings.
Through the utilization of advanced StyleGAN technologies, we exploit the rich prior knowledge present in public data, resulting in statc-of-the- reconstruction performance across different split points. Our methods outperform existing baseline attacks on multiple evaluation metrics, showcasing their superiority.
We conduct systematic evaluation and comparison of various DRAs against seven de- fense mechanisms. The results demonstrate that our methods effectively reveal sensitive information and undermine the robustness of the defenses.
Background and Related Work
2.1 Split Inference
Split Inference (SI) and Split Learning GSpta and Raskar 2018 Thapa et al. 2022 Poirot al.) 2019) have emerged as promising alternatives, which split and deploy DNN models on both model M is split into client model Mc and fed Mc to get an intermediate feature representation Mc (x*) =" is then transmitted to the cloud execute y² = MM(=*). Finally, y* is returned to the edge-side to complete the inference process, as shown Figure Collaborative computing across edge-cloud devices facilitates the reduction of computing payload on the edge side. By transmitting
the edge-side and the cloud side. In SI,
server model Ms. An inference data

---

only the smashed data to the cloud side, a certain level of privacy protection can be ensured. Utilizing distributed inference/training protocols, SI and SL achieve an improved trade-off between utility and privacy.
2.2 Data Reconstruction Attacks on Split Inference
Data Reconstruction Attack (DRA) is one of the most powerful privacy attacks that focuses on reconstructing private inference data. The existing DRAs can be broadly categorized as Optimization- based and Learning- based. [He et al. 2019 introduced regularized Maximum Likelihood Estimation (rMLE), firstly treating DRA as opumization problem. For an intermediate feature represen- tation= = Mc (z*), they find the optimal sample æ which minimizes the posterior information from feature-level observation by reducing the Euclidean Distance between (x) and Mc(x") Additionally, they adapt the Total Variation (T') et al. 1992] to represent the prior infor- mation derived from the distribution of natural images. Inspired by the deep image prior [lyanov al. 2018 for feature inversion, (Singh et al. 2021] proposed Likelihood Maximization (LM), which took full advantage of a fixed input Autoencoder network MA producing x = M MA and replaced the target optimization by minimizing the loss 12 c (MAE(.)) (-)).)))) which significantly improved the optimization-bante Inverse-Network (IN) that leverages a certain amount of (2*,"") pairs gained by querying the Mc
DRA effect. For learning- based DRA, [He et al. 2019] introduced
to train a model M such that æ = Mc (=*). Similarly, l2 norm in the pixel space is also used as the loss function. Facing serious threats of existing DRAs, variety of defense mechanisms have been proposed to greatly mitigate privacy leakage in SI. They are specifically designed to minimize the disclosure of sensitive information from DRA, while still preserving the practical utility of the inference data.
The Model Inversion Attack [Zhang et al. 2020 Chen et al. 202 An et al. 2022 seeks extract sensitive features of an individual contained in the confidence score of an ID classification model. The Gradient Inversion Attack (Zhu ct al. 2019 Geiping et al.] 2020 Jeon et all 2021] aims to recover original training data from shared gradients. Unlike them, DRA focuses on reconstructing private inference data using feature representation output from the split layer of any functional DNN models.
training data, by leveraging the coupled feature information
2.3 StyleGAN & GAN Inversion
The StyleGAN generator consists of mapping network I' and synthesis network Gstyle- In a typical image generation process of StyleGAN, latent vector z sampled from the space, which follows the Gauss Distribution. Then an intermediate latent vector w is obtained from f(z). The ff is a mapping network implemented by an 8-layer Multi-Layer Perceptron (MLP), making the generation based on disentangled representation. Finally, the is copied N times (N tog(output _i2e,, 2) * 2 2) and leveraged to control layer- mnyer-rrained adaptive instance normalization (AdaIN) Huang and Belongie 2017 operations, as shown in Figure
With the rapid development of the StyleGAN series network, variety of GAN Inversion methods have emerged (ndda Abddl et al. 2019 2020 Richardson et al. 2021: Wang et al. 2023 which aim to invert a given image back into the latent space a pre-trained GAN model. Especially for StyleGAN, several latent spaces (W+, S, PP P+) [Zhu et al. 2020b) and formulations (learning, optimization, or both) Xia et al.) 2022 are utilized to achieve better inversion results. Different from common trade-off Zhu et al.] (220aa Tov et al. 2021]. in this paper we customize advanced GAN Inversion technologies to DRA in SI, concentrating on raising the quality of reconstruction.
GAN Inversion that focuses distortion-editabiii
3 Methodology
In this section, we first analyze the threat model DRA in SI. Then, we formulate the design details and corresponding intuitions of our GLASS and +
3

---

mapping network
GLASS 2 space search
GLASS W space search
2 E Z space
W EW space
GLASS + + W space mapping
1x512 vector
1x512 vector
Zrecon
GLASS + W++ space search
copy
WHE W+ space
10x512
feature2image module
the PSP Encoder
X Xyecon
Clerer Zrecos.
Style
X priv
Mc
Zpriv
A
A
map2xttyee blocks
Figure 2: The framework overview of GLASS & +LASS+
3.1
Threat Model
We assume an honest-but-curious server-side adversary SI, who receives the client's intermediate feature representations and tries to reconstruct the private inference instances from them. The adversary has the parameters and structure of the whole target model Mr, white-box setting. This is reasonable assumption in real-world scenarios, where typically the service provider of SI needs obtain the target model and perform the splitting setup before deploying We also take into account the strictest case that the training of the target model is accompanied by defensive purposes. This usually occurs when the target model provided to the server by a trusted model provider that sets defense mechanisms, or when the training objectives of the target model are forcibly set by the client with privacy protection requirements. where the adversary has limited capabilities, i.e., having client model Mc or being non-queryable, as black-box setting or a query-free setting. Besides, we assume that the adversary has an auxiliary public dataset D with similar distribution that of the target model training dataset. Later in Section 5 we show that our attacks can be carried out effectively, even using an auxiliary dataset with certain distribution shift.
addition, we extend the consideration to scenarios
3.2 GLASS
Setup. Before launching the GLASS, pre-trained StyleGAN generator G is necessary, which trained on data distribution similar the private inference data Dp. This easy to obtain because StyleGAN models pre-trained various data distributions (especially structured data distributions such as faces) are widely released online. We first formalize Optimization-be based DRA as:
min (z)
(1)
where C is the Ig-distance between two intermediate features, and the adversary tries to find an a closest x through optimization.
Z space search. The non-convexity of StyleGAN generation makes the optimization problem non- convex. For the optimization of non-conved functions, an ideal initial point and certain disturbance is extremely significant. The step ! of GLASS is searching in Z space for the reason that the entanglement of Z space increases the amplitude Adam, SGD, etc) in representation space, which avoids the minimization via gradient descent resulting in poor local minima in the same degree. The formal representation of Z space search is:
positive perturbation (come from optimizer
min (M Style (=)), Mc(x)) + R(G 2) + a TV (z)) ZEZ
(2)
Obtaining distorted images is common occurrence by directly searching according to L. as the optimization process may cause to deviate significantly from the distribution of Z space. Therefore,

---

we adopt KL-based regularization (Kingma and Welling 2013 to constrain the optimization process of conform the normal distribution as:
Style: 2) 1 E log(o?) nr² -o?)
where of and of represent the clement-wise mean and standard deviation. The regularization item R(-) reduces the Kullback-Leibler divergence between and the standard Gaussian distribution (0,01), 1), controlled by X. Furthermore, we adopt Total Variation [Rudin et al. 1992 to bring
prior information of the natural image, which encourages the generated image x piece-wise smooth, controlled by a. Defined as:
G (2) to be
(v(a)= = Σ |iit1,- risl + [ij+1 Iá.j
(4)
W+ space search. Based on the got in step ①. we perform f(z) to obtain w, then copy 10 times w+. In step ④, we search the W+ space follows:
min LlMo(G W+EW
Mc(x")) + (yyGstttc
For adequate disentanglement of W++ space, it is efficient to find the extreme point in the repre- sentation space, The two-step search algorithm intuitively efficient. As depicted Figure (A), the search in Z space during step ( introduces significant perturbations, thereby preventing the initial point z from getting trapped in local optima. Subsequently, leveraging the superior editability provided by the highly disentangled representations in W+ space, the search in step ② further enhances the resemblance between the reconstructed data and the private input data. The iterative optimization process ultimately achieves the global optimum w+2 (the global optimum refers to the optimum attainable by the attacker with existing knowledge). The detailed algorithm of GLASS can be found in Appendix A.1
10
W
(A)
(B)
Figure 3: (A) Through the large disturbance brought by Z space search, GLASS can easily optimize to w+1 and further reach the global optimum w+z2 by W+ space search. (B) When the available information for reconstruction is tiny. 2 space search will inevitably fall into the local optimal point even accompanying disturbance, making GLASS optimize z" w+i and W+ space search to w While GLASS++ utilizes the mapping relationship between feature space and latent space to obtain an improved initial point w+3 and subsequently achieves the global optimal w+
3.3 GLASS++
Intuition. GLASS, this purely optimization-base DRA method could achieve remarkable results at shallow split points. However, when the split point is deep, the (W (Width, Height of the intermediate feature representation becomes far less than that of the private input, meaning that the spatial information for reconstruction is gradually transformed into the semantic information needed for the classification task. The less spatial information available makes the optimization process more difficult, causing the results of GLASS to fall into pool local optima. As shown in Figure (B), even with huge disturbance amplitude, 22 eventually falls into local extreme point w+i, due to the lack of information. This results in little improvement the subsequent W+ space search. Therefore, we propose + + to alleviate the above problem.
5

---

Setup. Before launching the + we introduce pizel2style2piizl Encoder Epsp and map2styles blocks Mn from [Riharddson al. 202T]. Tensors of the image space are fed psp to generate three levels of feature maps. These feature maps are subsequently utilized by the map2styles blocks Mn to extract desired styles w+. We incorporate these technologies into our DRA framework. For more details on these components, please refer to Appendix B.1
W+ space mapping & search. To tackle the problem of non-convex function optimization tending to fall into local optima, we employ Learning-based methods. These methods involve mapping the intermediate feature representation to W+ space, resulting in more advantageous initial point. We specifically design feature module M,, projecting vectors from high-dimensional feature space into image space. This module serves as a valuable tool for facilitating subsequent style extraction. Then we joint the EspP and Mm to extract desired styles w+. In step ①. these three items collaboratively perform as Encoder E My Epsp Mm, mapping the vectors from feature space W+ space as:
++ = E(M((a)))
with the help of E,, a point near the global optimum is determined the initial point of W++ space search in step 2 As shown in Figure (B), B), it is considerably more effortless to reach w+ from w+3 driven by gradient descent. The detailed algorithm of + can be found in Appendix A.2
3.4 Approach Analysis
Referring to [Jenn et al. 202I, we formalize the DRA under SI as an optimization problem. Through pre-trained StyleGAN generator, the problem of ( can be better solved by transferring from R" to stytee (1) E R²) where is a latent code in either Z or W++ space, & denotes the dimension of 1, and refers to the dimension of image space. Hence, GLASS and GLASS+ perform the latent spaces search as follows:
min (i (c(,=""))))
IER
where 'D represents total loss terms in latent spaces search. When the private inference data is approximated with a sufficient narrow error, the DRA through latent spaces search in aligns with image space search in
4 Evaluation
We systematically evaluate our proposed attacks in terms of their performance against representative image classification tasks and compare them with existing attack methods. Additionally, we measure the robustness of seven defense mechanisms against various DRAs. We implement GLASS and GLASS++ in Pytorch[Pasze et al., 2019). Most experiments are carried out on a server equipped with 256 GB RAM, two Intel Xeon Gold 61 6133, and four NVIDIA RTX 4090 GPUs.
4.1 Experimental Settings
Datasets & Tasks. we use (1) CelebA Liu et al. 2015) containing 202,599 face images of 10, identities, (2) FFHQ/Karras al. 2019 containing 70,000 face images with considerable variation in terms of age, ethnicity and image background. Both are scaled down to 64 x 64 pixels. We study DRA against models built for the Attractiveness Classification task: Binary attractiveness classification performed on the CelebA, as we consider attractiveness to be remarkably inclusive facial attribute. We adopt ResNet- 18 He He al. 2016) and split the target model Mc into different layers, as shown in Appendix B.2
Attack Setup. We split the datasets into two parts: a private dataset Dp for training the target model and a public data used as an auxiliary dataset DA for training our StyleGAN model. For CelebA, we selected 80,525 images belonging to 3,000 identities with the highest number of images as Dp, while the remaining images from other identities as public data DA- This scheme ensures that there are no overlapping identities between DA and Dp in all experiments. This means that the public data only helps the adversary obtain general information about the features prior knowledge,

---

without providing any class-specific information relevant to the private data Chen et al. 2021]. For practical reasons, we utilize the FFHQ dataset as public data train our StyleGAN model, as there are numerous StyleGAN models available on the Internet that are trained with FFHQ. Note that there a certain distribution shift between the FFHQ dataset and the celeba Mataset][Kalaa et al. 2022]. To be fair, We set the number of iterations for Optimization-basen DRA to 20,000 and the number of training epochs for Learning- loss function. It is worth acknowledging that the influence of hyperparameters varies across different adversarial settings and defense mechanisms. We analyze the hyperparameter selection strategies within different settings to meet the reasonable effectiveness of various attacks. Detailed information regarding the hyperparameters can be found in Appendix B.3
DRA to 30, while incorporating Total Variation into each attack
Compared Baselines & Evaluation Protocol. We set the three existing DRAs the baseline attacks: regularized Maximum Likelihood Estimation (rMLE) et al., 2019]. Likelihood Maximiza- tion (LM) (Sngh et al., 202T] and Enverse-Netoor (IN) et all. 2019] For the sake of generality,
our experiments are conducted on 40 randomly selected and fixed images, and the mean value of each evaluation metric is calculated as the result.
Evaluation Metrics. In addition to visually quantifying reconstruction attacks, we selected five metries to evaluate the similarity between the original image and the reconstructed image: Learned Perceptual Image Patch Similarity (LPIPS J) Zhang et al. 2018), Structural Similarity Index (SSIM [Waag et al. 2004), Peak Signal-to-Noise Ratio (PSNR Hooe and Ziou 2010], Mean Squared
Error (MSE 4) and Natural Image Quality Evaluator (NIQE M)ttall et al. 2212). Note that "L"
means the lower the metric the higher the relative image quality, while "1" represents the higher the metric the higher the image quality.
4.2 Attack Performance
Figure 4 shows the reconstruction attack performance of our methods. In general, our methods demonstrate optimal and second-best performance across nearly all split points, whether compared or Learning- based DRAs. Specifically, when the split point is set to Block3, our Optimization- based GLASS reduces LPIPS from 0.298 to 0.140 compared to LM: Our Learning- based +LASS+ enhances the SSIM from 0.685 0.833 compared to IN (the full results are in Appendix C When the split point is located at a deeper Block5, GLASS exhibits a remarkable ability in reconstructing faces with features highly similar to the ground truth. In contrast, other Optimization- based DRAs fail to reveal any valid sensitive information. We attribute this superior performance to two main factors: the wealth of prior knowledge embedded in the pre-trained StyleGAN model and the powerful feature search capability brought by our methods. Note that LM achieves optimal NIQE on Block5, but we observe that its reconstructed images are almost noisy. We analyze that this was due to the instability of NIQE on small-size images, which resulted in extremely poor attack results but good values. Therefore, we exclude NIQE from the experiments in subsection
with Optimization-basee
Ground
Truth
LM
GLASS
Ground Truth
GLASS
Ground Truth
GLASS
Ground
Trath
GLASS++
Block2
Block2
Block3
Block3
Block4
Block4
Block5
Block5
Blockó
(a) Optimization--ased DRAS
(b) Leamnig-baseed DRAs
Figure 4: White-Bor -oxte-Box DRAs against the original model under different split points.
7

---

4.3 Defense Mechanisms Assessment
Reconstruction Performance under Defense Mechanisms. The quantitative metrics in Table [] demonstrate the remarkable effectiveness of our methods in breaching all defenses, surpassing the performance of other baseline attacks even when the aceuracy of the target model declines due to defense. Our +LASS+ and GLASS consistently yield the optimal and the second-best results on most of the metrics. Even against state-of-the oh-thh-art defense mechanisms like NoPeek, Adversarial Learning, and DISCO, we can still carry out powerful DRA, as shown in Figure 5 Specifically, when against NoPeek (Acc=79.9799) 79.9%) GLASS and GLASS+ increased the SSIM of reconstructed images to 0.554 and 0.678, compared to 0.006, 0.233 and 0.376 of baseline attacks, showcasing that our methods turn the failure into the successful attack. is crucial to emphasize that even a 3% loss in accuracy is unsatisfactory because the target task is a simple binary classification problem. However, in practice, DL tasks are often very complex, and even a slight privacy defense may lead to poor performance.
Table I: According to the attack effect of IN, we adjust the hyperparameters of different defenses to provide the defended model with three levels of privacy protection, resulting in gradual decrease in model accuracy (original 79c=79.97 %). All experiments are performed on Block3, Implementation details and hyperparameters of defenses are in Appendix B.4
Defense
Method
LPIPS
SSIM 1
79.97%
PSNR
MSE
LPIPS
SSIM
PSNR
MSE
1.PIPS 1
SSIM
Acc
78.56%
PSNR 1
MSE J
rMLE
0.853
0.006
7.059
1.043
0.855
0.006
7,099
1.039
0.856
0.006
7.105
L.035
I.M
11.74
0.449
0.729
0.171
11.00
0.500
0.766
0.178
10.29
0.539
NoPeek
0.160
0.618
15.15
0.168
GLASS
0.293
0.554
17.53
0.142
0.351
0.422
14:68
0.244
0.414
0.343
13:46
0.326
GLASS+
0,220
0.678
21.60
0.070
0.295
0.549
18.04
0.160
0.301
0,532
18:21
0,115
Defense
Mechod
LPIPS
SSIM 1
79.34%
PSNR
MSE
LPIPS
SSIM
PSNR
MSB
LPIPS 1
SSIM 1
Acc
79.01%
PSNR 1
MSE J
tMLE
0.618
0,330
14.69
0.223
0.781
0.147
11.57
0.367
0.763
0.162
11.36
0.361
LM
0.127
0.762
0.220
12.48
0.799
0.205
DISCO
IN
0.410
0.584
20.59
0.049
0.666
0.336
15.80
0,149
0.636
0.314
15.56
0.158
GLASS
0.165
0.776
24.76
0.022
0.32N
0.464
16.37
0.154
0.345
0.431
15:35
0.201
GLASS+
0.152
0.784
24.75
0.021
0.241
0,584
18.79
0.082
0.260
0.576
18.46
0.886
Defonee
Method
LPIPS
SSIM
Ace
79.135
PSNR
MSE
LPIPS
SSIM 1
Acc
78,765E
PSNR
MSE 1
LPIPS
SSIM 1 PSNR
Acc - 78.13%
MSE 1
IMLE
0.591
0.327
14.60
0.252
0.651
0.200
12.69
0.343
0.678
0.155
12.03
0.381
Adv- Leaming
0.308
0.483
0.667
0.517
20,80
19.82
0,059
0.584
0.414
0.382
0.533
17:57
17.19
0.100
0.601
0,477
0.322
16.45
15.04
0.258
0.130
GLASS
0.155
0.765
23,68
0.067
0,208
0.026
18.26
0.148
0.197
0.686
20.17
0.110
GLASS+
0,131
0.816
25.93
0,016
0.142
0.794
24.69
0,023
0.157
0.763
23.21
0,040
Defense
Mehhod
LPIPS
SSIM 1
Acc = 78.5%%
PSNR
MSE
LPIPS
SSIM
Acc
78.048%
PSNR
MSE
LPIPS 1
SSIM
Acc
77.83%
PSNR 1
MSE 1
rMLE
0,703
0.221
14.65
0.183
0.771
0,099
11.58
0.578
0.835
0.021
7.90
0.869
Noise Misk
LM
IN
0.352
0.610
21.20
18.30
0.079
0.012
0.424
0.708
0.569
0.225
19.71
14.61
0,059
0,185
0.791
0.590
0.424
0.057
16.22
8.78
0.133
0.709
GLASS
0,230
0.660
21.66
0.039
0.245
0.607
20.16
0.056
0.360
0.396
15.18
0,174
GLASS
0.184
0.714
22.57
0.032
0.231
0.626
20.52
0.081
0.283
0.524
17.71
0.096
Defense
Method
LPIPS
SSIM
Ace = 78.09%
PSNR
MSF
LPIPS
SSIM
Acc = 77.65%
PSNR
MSE
LPPPS 1
SSIM 1
Acc- = 77
PSNR 1
35%
MSE J
7MLE
0048
0.330
0.522
19.58
0,610
0.426
17.29
Dropout Defense
I.M
0.319
0.717
23.44
0006
0.408
0.659
22.21
0.034
0.483
D.606
21.11
0.044
IN
0.350
0.612
21.12
0.013
0.425
0.555
20.21
0.053
0.099
0.490
18.83
0.073
GLASS
0.144
0.790
25.31
0
0.171
0.766
24.23
0823
0.195
0.712
22.83
0
GLASS
0.018
0.163
0.777
0.022
Defense
Method
LPIPS
SSIM
Acc
79.23%
PSNR
MSE
LPIPS
SSIM
Acc =
78.65%
PSNR
MSE
LPIPS 1
SSIM 1
Auc =
77.73%
PSNR
MSE
0.030
0.331
14.58
0.217
0.700
0.200
13.07
0.250
0.676
0.234
14.37
0.220
LM
0.547
0.175
19.09
0.074
0.564
0,108
18.M
0.086
0.388
0,481
18.97
0.072
Shrodkkrr
IN
0.373
0.604
21.03
0.044
0,383
0.602
20.91
0,044
0.390
0.596
20.87
0.045
GLASS
0.222
0.668
21,82
IJ142
0.246
0.634
20.95
0047
0.236
CU646
21.32
0.045
GLASS
0.207
0.695
22.27
0.034
0.213
0.695
0.035
22.06
0.006
Defense
Method
LPIPS
SSIM
Acc
78.74%
PSNR
MSE
LPIPS
SSIM
Acc
78844%
PSNR
MSE
LPIPS
SSIM
Acc - 77.56%
PSNR
MSE J
EMLE
12.78
0.304
0.740
0.176
12.74
0.308
0.746
0.175
12.48
0.324
Slamese
Dofense
GLASS
LM
IN
0.166
0.378
0.574
0.797
0.451
0.614
25.30
21.29
16.97
0.023
0.041
0.157
0.604
0.386
0.186
0.751
0.592
0.405
23.77
21.00
16.40
0.033
0.044
0.176
0.201
0.425
0.670
0.731
0.553
0.335
23.07
20.28
14.67
0.052
0,046
0.228
GLASS++
0.016
0.159
0.802
25.33
0.159
25.14
Defense Analysis. For Clipping type defenses (Dropout Defense, DISCO), a high clipping rate is essential for providing sufficient privacy protection (about 90% intermediate feature clipping or 95% channel clipping). Dropout Defense is difficult to defend against Optimized-based DRA: because the Mask (randomly set zero) superimposed on the intermediate feature representation can be easily picked up. DISCO's superior defense effect comes from 95% channel clipping, which is possible
8

---

Grand Truth
CALE
GLASS GLASS
Truth
PALLE
LM
GLASS GLASS
Gronnd Truih
ALLE
GLASS CLASSH
Acc-1
Acc-2
Acc-3
a) DISCO
b) Noise Mask
c) Shredder
Acc-I
Acc-2
Acc-3
d) Adversarial Learning
Siamese Defense
NoPeek
Figure 5: The results of different defenses against DRAs. The accuracy rate corresponds to the Acc Table as Acc- Acco3-
because the target task is relatively simple. resulting in highly redundant feature channels. For Noise Addition type defenses (Noise Mask, Shredder), Optimization-baseee DRAs are soise-vensitive Even in a White-box setting, random sampling noise can still greatly interfere with the optimization process, leading to poor attack effects. In contrast, Learning-based DRAs demonstrate certain robustness to noise. For further analysis of Shredder, we collect intermediate feature representations superimposed with Shredder noise and apply L-SN([Van der Maaten and Hinton 2008 to reduce their dimensionality. Notably, even when sampling from 50 noise distributions, the intermediate features can be distinctly clustered into 50 groups, shown in Appendix F We can degrade the noise distribution library of Shredder (default is 20) to a single distribution by using carefully selected intermediate feature representations (which the optimization process, which greatly improves the effect of DRA. For Feature Obfuscating type defenses (Adversarial Learning. NoPeck, Siamese Defense), increase the difficulty of feature matching in DRA. However, with sufficiently powerful feature search capability, the attack is easy implement. Appendix D.1 illustrates the curves of feature loss between the model with NoPeek and the original model under the GLASS, targeting the same image during optimization. It is evident that when the optimization process converges, the numerical difference between them is two orders of magnitude. In Appendix D.2] we establish a correlation between the model's accuracy and the SSIM of DRA under different attacks and defenses. Notably, NoPeek and DISCO emerge as the most effective defense mechanisms. As shown in Appendix D.3 a), the SSIM of our attacks is mostly above 0.5, and the slope of the broken lines large, which means that our attacks are more robust.
be mapped to the corresponding target group) during
believe that they only serve to
5 Extended Experiments
Black-box & Query-free Settings. We relax the assumption of adversary capability and use gradient-free optimization technology to implement Black-box DRA. For Query-free, we adapt model fine-tuning and P+ space cropping. The experimental results show that the gradient-free optimization only takes 2,000 iterations to obtain effective information, and the customized GLASS improves the attack SSIM of Block2 from 0.152 to 0.392 in the Query-free setting, Experimental details and results are in Appendix E
Heterogeneous Data. 10 [Darlow et al. 2018 We chose to utilize the gradient-free CMA optimizer because CINIC-10 has more heterogeneous data distribution than well-aligned datasets like CelebA, making it hard for the gradient- based optimizer to search in latent space Li et al. 2022]. In our implementation, we utilize a publicly released StyleGAN-X model trained on CIFAR-10 (Krizhevsky
We further extend the reconstruction attack to heterogeneous data like CINIC-
al.) 2009) to construct GLASS. F shows part of the results. It can be seen that owing to rich prior knowledge, our GLASS can obtain highly similar semantic information and generate more vivid images than IN. Experimental details are in Appendix B.2

---

Ground
GLASS
Block2
Block3
Block4
Figure 6: DRAs against Heterogeneous Data.
Data Distribution Shift. We replaced the StyleGAN model used in the attack from the one trained on the CelebA to the one trained on the FFHQ. Table 2 shows that GLASS++ is still very effective, even if the prior knowledge learned from data distribution that differs from the private data distribution (facial structure alignment and feature diversity difference). Furthermore, we enhance the robustness of the attack by incorporating a fundamental domain adaptation technique, specifically model fine-tuning. We concatenate step of model parameter optimization after GLASS++ to make the generator model parameters trainable, which further aligns the features of the reconstructed images with the target features.
Table 2: Reconstruction attacks performance of Data Distribution Shift on Block3.
Evalution Metries
Dataset
LPIPS
SSIM
PSNR
MSE J
NIQE
J
CelebA
GLASSE+
0.123
0.833
26.56
0.014
15.30
GLASS+
0.211
0.727
23.95
0.025
13.77
FFHQ
GLASS+ Finc-tuning
24.22
14.25
Moreover, we carry out more practical implementation of DRA on uncroppedduunaligned private inference data to enhance the quality of our work. According to (aang et al., 2023], we enhance StyleGAN by transitioning its constant first-layer feature a variable one. We integrate this with the latent code of W++ space and undertake joint optimization during the second stage of our methodology. As demonstrated in Figure 7 the evaluation of GLASS underscores our method's effectiveness even when dealing with transformed or natural privacy inference data.
Translation
Scaling
Masking
Brightness
Rotation
Condition
Pose
Ground Truth
GLASS
Background
Masking
Scaling
Ground
Truth
GLASS
Figure 7: The results of GLASS when private inference data are transformed or natural images. The split point is set to Block3.
Conclusion
In this paper, we propose GLASS and GLASS++, the enhanced DRAs against SI. Our experiments demonstrate the effectiveness of our attacks on different split points and various adversarial settings. We anticipate that our proposed attacks will spotlight the significance of safeguarding privacy in split inference systems and encourage the advancement of more robust defense mechanisms. Regarding the limitation, it mainly comes from the inherent flaw of Aptimization-basee attacks, for single image optimization less efficient than Learning- attacks.
Acknowledgments and Disclosure of Funding We thank the anonymous reviewers for their constructive comments. This work was supported in part by the National Natral Science Foundation of China under Grants No. 61872430, 61402342, and 61 61772384 and was sponsored by Ant Group.
10

---

References
Rameen Abdal, Yipeng Qin, and Peter Wonka. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4432-4441, 2019.
Rameen Abdal, Yipeng Qin, and Peter Wonka. Image2stylegantt: How to edit the embedded images? In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8296 8305, 2020.
Shengwei An, Guanhong Tao, Qiuling Xu, Yinggi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity. In Proceedings of the 29th Network and Distributed System Security Symposium, 2022.
Amin Bamitalebi-Dehkordi, Naveen Vedula, Jian Pei, Fei Xia, Lanjun Wang, and Yong Zhang Auto-split: general framework of collaborative edge-cloud ai. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages
2021.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEF/CVE international conference on computer vision, pages 16178-16187 2021.
Luke N Darlow, Elliot Crowley, Antreas Antoniou, and Amos Storkey, Cinic- 10 is not imagenet or c0f arXiv preprint arXiv:1810.03500. 2018.
Amir Erfan Eshratifar, Mohammad Saeed Abrishami, and Massoud Pedram. Jointdnn: An efficient training and inference engine for intelligent mobile cloud computing services. IEEE Transactions on Mobile Computing, 20(2):565-577 2019.
Jonas Geiping. Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems, 13:16977-16947, 2020.
Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116:1-8, 2018.
Nikolaus Hansen. The ema evolution strategy: tutorial. arXiv preprint arXiv:1604.00772 2016.
Johann Hauswald, Thomas Manville, Qi Zheng, Ronald Dreslinski, Chaitali Chakrabarti, and Trevor Mudge. A hybrid approach offloading mobile image classification. 2014 IEEE International Conference on Acoustics, Speech and Signal Processing ( (ICASSP), pages 1375-8379 IEEE, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 770-778, 2016.
Zecheng He, Tianwei Zhang, and Ruby B Lee. Model inversion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 148-162, 2019.
Zecheng He, Tianwei Zhang, and Ruby B Lee. Attacking and protecting data privacy in edge-cloud collaborative inference systems. IEEE Internet of Things Journal, 8(12)9970699716 2020.
Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recognition, pages 2366-22662262 2369. IEEE, 2010.
Xun Huang and Serge Belongie. Arbitrary style transfer in real-time with adaptive instance normaliza- tion. In Proceedings of the IEEE international conference on computer vision, pages 1501-1510. 2017.
Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al. Gradient inversion with generative image prior. Advances in neural information processing systems, 14:29898-29900 202..

---

Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15045-15053, 2022.
Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge. ACM SIGARCH Computer Architecture News, 45(1):615-62) 2017.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401-4411 2019.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 8110-8119, 2020.
Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo
Aila. Alias-free generative adversarial networks. Advances in Neural Information Processing Systems, 34:852-863, 2021.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 14, 2013.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Ang Li, Jiayi Guo, Huanrui Yang, Flora D Salim, and Yiran Chen. Deepobfuscator: Obfuscating intermediate representations with Proceedings of the International Conference on Aiterne-oofThhing Design and Implementation, pages 28 -9, 2021.
adversarial learning smartphones. In
Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learning via generative gradient leakage. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10132- 10142, 2022.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730-3738. 2015.
Yoshitomo Matsubara, Marco Levorato, and Francesco Restuccia. Split computing and early exiting for deep learning applications: Survey and research challenges. ACM Computing Surveys, 55(5):
1-30, 2022.
Fatemehsadat Mireshghallah, Mohammadkazem Taram, Prakash Ramrakhyani, Ali Jalali, Dean Tullsen, and Hadi Esmaeilzadch. Shredder: Learning noise distributions to protect inference privacy. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pages 3-18, 2020.
Anish Mittal, Rajiv Soundararajan, and Alan Bovik. Making a "completely blind" image quality analyzer. IEEE Signal processing letters, 20(3):209-11) 2012.
Seyed Ali Osia, Ali Shahin Shamsabadi, Sina Sajadmanesh, Ali Taheri, Kleomenis Katevas, Hamid R Rabiee, Nicholas D Lane, and Hamed Haddadi. A hybrid deep learning architecture for privacy- preserving mobile analytics. IEEE Internet of Things Journal, 7(5):4505-44 4518, 2020.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luea Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
Maarten G Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Salpathy-Cramer, Rajiv Gupta, and Ramesh Raskar. Split learning for collaborative deep learning in healthcare, arXiv preprint 191.:19912.12115. 2019.
Elad Richardson, Yuval Alaluf, Or Patashnik, Yotam Nitzan, Yaniv Azar, Stav Shapiro, and Daniel Cohen-Or. Encoding in style: stylegan encoder for image-to-image translation. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 2287-2296, 2021.
12

---

Leonid Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: nonlinear phenomena, 60(1-4):259-2) 268, 1992.
Axel Sauer, Katja Schwarz, and Andreas Geiger. Stylegan-xl: Scaling stylegan to large diverse datasets. In ACM SIGGRAPH 2022 conference proceedings, pages 1-10, 2022.
Abhishek Singh, Ayush Chopra, Ethan Garza, Emily Zhang, Praneeth Vepakomma, Vivek Sharma, and Ramesh Raskar. Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12125-12135, 2021.
Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. Splitfed: When federated learning meets split learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 1485-8493, 2022.
Tom Titcombe, Adam J Hall, Pavlos Papadopoulos, and Daniele Romanini. Practical defences against model inversion attacks for split neural networks. arXiv preprint arXiv:2/04.05743, 2021.
Omer Tov, Yuval Alaluf, Yotam Nitzan, Or Patashnik, and Daniel Cohen-Or. Designing an encoder for stylegan image manipulation. ACM Transactions on Graphics (TOG), 40(4):1-14, 2021.
Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Deep image prior. In Proceedings of the
IEEE conference on computer vision and pattern recognition, pages 9446-9454, 2018.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 911),, 2008
Praneeth Vepakomma, Abhishek Singh, Otkrist Gupta, and Ramesh Raskar. Nopeek: Information leakage reduction share activations in distributed deep learning. In 2020 International Conference on Data Mining Workshops (ICDMW), pages 933-942. IEEE, 2020.
Yanbo Wang, Chuming Lin, Donghao Luo, Ying Tai, Zhizhong Zhang, and Yuan Xie. High-resolution gan inversion for degraded images in large diverse datasets. arXiv preprint arXiv:2302.03406, 2023.
Zhou Wang, Alan Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEFE transactions on image processing, 13(4):600-612, 2004.
Weihao Xia, Yulun Zhang, Yujiu Yang, Jing-Hao Xue, Bolei Zhou, and Ming-Hsuan Yang. Gan inversion: A survey, IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Mengda Yang, Ziang Li. Juan Wang, Hongxin Hu, Ao Ren, Xiaoyang Xu, and Wenzhe Yi. Mcasuring data reconstruction defenses in collaborative inference systems. Advances in Neural Information Processing Systems, 15855-8112887 2022.
Shuai Yang, Liming Jiang, Ziwei Liu, and Chen Change Loy. Styleganex: Stylegan-based manipula- tion beyond cropped aligned faces. In ICCV, 2023.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative indeel-ivvession attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 253-261, 2020.
Jiapeng Zhu, Yujun Shen, Deli Zhao, and Bolei Zhou. In-domain gan inversion for real image editing. In Computer EsiionECCVV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XVII 16, pages 592-608. Springer, 2020a.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019.
Peihao Zhu, Rameen Abdal, Yipeng Qin, John Femiani, and Peter Wonka, Improved stylegan embedding: Where are the good latents? arXiv preprint arXiv:2012.09038 2020b.
13


Reviews:
[{"review_id": "2nEfvts6Vc", "reviewer": "Reviewer_HnH3", "summary": "The paper titled \"GAN You See Me? Enhanced Data Reconstruction Attacks against Split Inference\" investigates and proposes new methods of data reconstruction attacks (DRAs) against split inference (SI), a deep learning paradigm that addresses computational constraints on edge devices while preserving data privacy. The authors present GLASS and GLASS++, which are the first DRA methods that use Generative Adversarial Networks (GANs), specifically leveraging StyleGAN, for the purpose of data reconstruction in SI. These methods are evaluated against seven advanced defense mechanisms in the SI paradigm and are found to be effective even in their presence. The authors claim their proposed methods significantly outperform existing DRAs.", "questions": "Please provide responses for my concern in the weakness section above. \n\nAlso, please elaborate more on the potential countermeasures that could be implemented to prevent or mitigate the effects of attacks such as GLASS and GLASS++?", "limitations": "While the paper showcases impressive results, it seems to lack a comprehensive discussion about the potential ethical implications of enabling more effective data reconstruction attacks, which could be used maliciously.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Originality: The paper introduces the novel application of GANs in data reconstruction attacks, marking a significant shift in the approach to DRAs in SI.\n\nQuality: The paper is technically sound and contains thorough experimental evaluations. It systematically evaluates the proposed methods across different split points, multiple defense mechanisms, and various adversarial settings, providing a well-rounded view of their performance.\n\nClarity: The paper is well-structured and coherent, with clear descriptions of the problem, proposed methods, and the results obtained. It does an excellent job of explaining the limitations of existing DRAs and how the proposed methods overcome these.\n\nSignificance: The work is of high significance as it highlights the existing vulnerabilities of SI, suggesting that even advanced defense mechanisms may not provide sufficient protection against data privacy attacks. This research could lead to more robust defense strategies in SI systems.", "weaknesses": "For the paper weaknesses. I think the biggest concern that I have is that the method relies on StyleGAN which is trained on cropped/aligned face data images. One big assumption made here is that the private inference data resembles these cropped/aligned face images. To me, this is a pretty restrictive setting. In order to generalize to other types of image data, the StyleGAN discussed in the paper would not be sufficient. The whole pipeline needs to be redesigned because the pipeline is specially designed with face-StyleGAN in place and certain modules are designed to extract desired styles w+.  \n\nThe impracticality to generalize and the relatively restrictive setting of the proposed pipeline is the major weakness in my opinion. \n\nIn addition, the performance of GLASS and GLASS++ against defense mechanisms is analyzed, but the paper lacks a clear discussion on possible countermeasures or ways to further improve these defenses in light of the presented attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We highly appreciate the invaluable and perceptive feedback offered by the reviewer. We have considered all the concerns mentioned and responded appropriately to each one.\n\n**Answer for Weaknesses:**\n\n- Data Types\n\nWe appreciate the reviewer's comment. We'd like to clarify that our attack pipeline isn't solely tailored for face-StyleGAN; rather, we extend our method to diverse data types, as mentioned in Lines 308-314 of the paper. In Appendix D.2, we showcase how our approach adapts to heterogeneous image data with varying structural similarity. Our experiments employed the StyleGAN-XL model [7], pretrained on CIFAR-10 [8], to target private inference data from CINIC-10 [9]. Despite a shift in data distribution between CIFAR-10 and CINIC-10, our attack remains effective, as illustrated in Figure 12. In Lines 652-656, we delve into the reasons for our method's superiority over other DRA methods. We apologize for placing this vital result in the Appendix and assure you that we'll revise the paper's content and structure to incorporate these pertinent findings into the main body. \n\nWe acknowledge the challenge associated with generating out-of-range images using StyleGAN. Nevertheless, our research primarily concentrates on harnessing the unique characteristics of StyleGAN's latent spaces to amplify the attack performance of DRA. Our focus lies in refining the accuracy of searching for sensitive privacy features. In the existing landscape of privacy attacks and defenses in machine learning [1][2][3][4][5], it's a prevailing convention to assume the utilization of cropped/aligned face images as private inference and auxiliary data. Adhering to the adversarial settings established in previous work [5], our goal is to unveil greater private information from inference data when compared to baseline methods. With regards to the limitation posed by StyleGAN's reliance on the cropped/aligned faces it's pretrained on, we believe this concern extends to other domains within computer vision. Recent research [6], conducted by Yang et al., has caught our attention, as it briefly investigates the fixed-crop constraint of StyleGAN2 – the primary generative model employed in our experiments. The proposed approach effectively expands the generative scope beyond cropped/aligned faces.\n\nWhile addressing the aforementioned limitation is not our primary research focus, we concur that a more practical implementation of DRA on uncropped/unaligned private inference data would enhance the quality of our work. According to [6], we enhance StyleGAN by transitioning its constant first-layer feature to a variable one. Furthermore, we integrate this with the latent code of W+ space and undertake joint optimization during the second stage of our methodology. As demonstrated in response.pdf/Figure-1, the evaluation of GLASS underscores our method's effectiveness even when diverse transformations are applied to private inference data. Moreover, we've implemented GLASS within a more authentic context. Illustrated in response.pdf/Figure-2, we capture images of a volunteer and gather multiple nature images as private inference data. The resulting attack outcomes affirm the robustness of our approach. It's crucial to clarify that, in the aforementioned experiments, the StyleGAN generator utilized for our attack was still trained on CelebA, featuring cropped/aligned images. We believe the integration of data augmentation into StyleGAN training could further bolster the attack's effectiveness. In our revised version, we will incorporate a dedicated section to comprehensively discuss and present these experiments.\n\n- Possible Countermeasures\n\nCurrent defense mechanisms focus on safeguarding entire images from the reconstruction. In contrast, our proposal suggests a targeted approach, concentrating on specific sensitive attributes to enhance defense efficacy. For instance, by masking the mouth region of the input image, we can thwart the attacker's ability to reconstruct this portion, albeit introducing a new trade-off in utility. Furthermore, incorporating adversarial samples against StyleGAN, like generating optimized noise perturbations for each intermediate feature, could potentially yield a more potent defense strategy due to its one-to-one correspondence. We will delve into these aspects in greater detail in the revised version. We sincerely appreciate the reviewer's invaluable feedback, and we are fully committed to enhancing our work based on constructive suggestions.\n\n**Answer for Questions:**\n\nPlease refer to our answer for **Weaknesses**.\n\n**Answer for Limitations:**\n\nWe appreciate the reviewer's suggestion and will incorporate further discussions regarding the ethical implications of enhancing the effectiveness of DRAs in our manuscript. The potential adverse societal consequences of GAN-based DRAs largely revolve around the exposure of private data. When the attacker successfully reconstructs the initial data supplied to the edge-side DL model, it can result in privacy breaches and the propagation of harmful false information. We anticipate that our proposed attacks will spotlight the significance of safeguarding privacy in split inference systems and encourage the advancement of more robust defense mechanisms.\n\n*References:*\n\nKindly refer to the comprehensive global response provided earlier."}, {"review_id": "rkaJa5nQP2", "reviewer": "Reviewer_BEtd", "summary": "The paper proposed GLASS and GLASS++, which utilize StyleGAN to launch data reconstruction attacks against Split Inference. This is the first GAN-based reconstruction attacks against split inference, and it shows consistently better results compared with previous methods, against 7 defense schemes.", "questions": "1. Could you provide some visualizations on the intermediate results of searching the optimal W+, to make readers understand more about the optimization progress and how your model helps the optimization towards optimal reconstruction?\n", "limitations": "Same as weakness.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. As stated by authors, this is the first GAN-based reconstruction attacks against SI. I am not sure if similar ideas (search GAN latent space in privacy attacks) have been proposed in similar topics (for example other privacy attacks like gradient inversion or model inversion), so I would like to discuss with other reviewers about the novelty or originality of the method.\n\n2. The work has achieved a high level of completion, and the experiments were conducted comprehensively. The results are reported to be state-of-the-art for nearly every setting.", "weaknesses": "The results highly rely on the (1) similarity of auxiliary distribution and private distribution and (2) The complexity of the distribution modeled.  Although the authors discussed the performance under distribution shift, they conducted experiments on FFHQ and CelebA, which are both face image datasets, well aligned and structured.  In practice, the server may not know much about data distribution from end users, so the auxiliary dataset and private dataset could have significantly different distributions. Additionally, in practice, the distribution could be highly complex, for example, for a facial recognition system, photos from end users are not likely to be cropped and well-aligned. They may have various backgrounds, poses, and lighting conditions. Although the paper provides SOTA methods over their settings, it is worth discussing how the method will perform under more challenging settings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We deeply value the priceless and insightful feedback provided by the reviewer. We have taken into account all of the mentioned concerns and addressed them accordingly.\n\n**Answer for Weaknesses:**\n\nWe thank the reviewer for the comment and would like to further clarify the adversary's knowledge about the data distribution. In real-world protocols for Split Inference, it is relatively easy for a server-side adversary to know the tasks of the target model and the information related to the data distribution, since the service provider usually obtains the complete target model and deploys it in a split. This knowledge allows the adversary to choose auxiliary data with a distribution similar to the client-side private inference data. In addition, existing privacy attacks and defenses studies in machine learning [1][2][3][4][5] typically use aligned/structured face images as assumptions for private data and auxiliary data, and our work follows this setup as well.\n\nOur method is also expanded to heterogeneous data, as mentioned in Lines 308-314. In Appendix D.2, we illustrate that our approach can be adapted to heterogeneous image data with a lower level of structural similarity. Our experiments involve the utilization of a released StyleGAN-XL model [7], pre-trained on CIFAR-10 [8], to reconstruct private inference data from CINIC-10 [9]. Despite there is a shift in data distribution between CIFAR-10 and CINIC-10, our attack demonstrates effectiveness in this setting, as depicted in Figure 12. In Lines 652-656, an analysis is presented explaining the better performance of our method compared to other DRA. We are sorry for placing this important result in the appendix and assure you that we will make adjustments to the paper's content and structure to include relevant results in the main body. \n\nWe concur that a more realistic implementation of DRA on uncropped/unaligned private inference data will enhance the quality of our research. According to [6], we improve StyleGAN by modifying its first-layer feature from constant to variable. Furthermore, we combine it with the latent code of W+ space and carry out joint optimization during the second stage of our method. The evaluation of GLASS shows our method's effectiveness even when different transformations are applied to private inference data, as illustrated in response.pdf/Figure-1. Furthermore, we implement GLASS in a more realistic setting. As shown in response.pdf/Figure-2, we photographed a volunteer and obtained multiple nature images as private inference data. The attack results demonstrate the robustness of our method. It is essential to clarify that in the above experiments, the StyleGAN generator used in our attack was still trained on CelebA which is cropped/aligned. We believe incorporating data augmentation in StyleGAN training could further improve the attack's effectiveness. A dedicated section will be included in our revised version to comprehensively discuss and present the experiments.\n\n**Answer for Questions:**\n\nWe thank the reviewer for this suggestion. As shown in response.pdf/Figure-3, based on a good initialization (brought by the Z space search or the encoder network), the W+ space search carries out a fine-grained search for sensitive features. Visually, as the number of iterations increases, the reconstructed image gradually resembles the target image. We will likewise provide clearer and more intuitive explanations in our manuscripts.\n\n**Answer for Limitations:**\n\nPlease refer to our answer for **Weaknesses**.\n\n*References:*\n\nPlease refer to global response."}, {"review_id": "yYutlYQIea", "reviewer": "Reviewer_k9Qp", "summary": "This paper proposes GAN-based latent space search attack (GLASS) that leverages a pre-trained StyleGAN for reconstructing private data from shared representations in split inference via a two-step search in the Z space and the W+ space. Additionally, GLASS++ is proposed to learn a mapping model to produce better initial points for subsequent optimizations. The effectiveness of the proposed method is evaluated on the CelebA and FFHQ datasets against several defenses.", "questions": "Which portion of data is used to train the encoder network used in GLASS++? Would it still perform well if both the StyleGAN and the encoder are trained on a different data distribution?", "limitations": "The negative societal impact may be stated more explicitly, e.g., via adding a discussion section.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-structured and easy to follow.\n\n2. It is interesting to consider combining optimization-based attacks with learning-based attacks.\n\n3. The evaluation considered several attack baselines and defense mechanisms.\n", "weaknesses": "1. Some closely related prior works [R1, R2] were not discussed/compared. For instance, the idea of utilizing GAN inversion to improve data reconstruction has been introduced in [R1], which utilizes a pre-trained GAN to invert latent vectors produced by DNN to the corresponding input images through optimization. The usage of a StyleGAN with the latent space search and learned mapping is new but it is unclear if there are other technical novelties.\n\n2. In the evaluation, it is not quite clear which part of the data is used to train the encoder network, which makes it a bit hard to verify the benefits of GLASS++ as claimed in Figure 3. If there’s a distribution shift in the data used for training the encoder, could it still produce an initial point that is better than random initialization?\n\n3. The experiments only considered CelebA as the private dataset and 40 images for evaluating the attacks. As the optimization process is stochastic and sensitive to initialization, it would be better to consider more data samples to validate the effectiveness of the proposed attacks.\n\n[R1] Zhang, Yuheng, et al. \"The secret revealer: Generative model-inversion attacks against deep neural networks.\" CVPR 2020.\n[R2] Dong, Xin, et al. \"Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks.\" BMVC 2022.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We highly appreciate the invaluable and perceptive feedback offered by the reviewer. We have considered all the concerns mentioned and responded appropriately to each one.\n\n**Answer for Weaknesses:**\n1. We agree that GAN inversion techniques are used in some of the study cases of Model Inversion Attacks (MIAs) and Gradient Inversion Attacks (GIAs) as well. However, our contribution differs significantly from these studies. The innovativeness of our work does not lie in the use of GAN inversion, but rather in exploiting the latent space search characteristic and advantageous disentangled representation of StyleGAN to develop novel Data Reconstruction Attacks (DRAs) specifically targeting Split Inference systems. The MIAs represented by [R1] aim at obtaining sensitive image features of individuals in the original training data based on the coupled feature information contained in the confidence scores of the face ID classification model, while DRAs focus on reconstructing the client private inference data by utilizing intermediate feature representations outputted from the splitting layer of DNN models with different functionalities. Regarding [R2], this work is methodologically similar to the baseline Inverse Network (IN) that we have compared. We will provide additional comparative experiments or include discussions of these closely related prior works in our manuscript.\n\n2. We thank the reviewer for the comment. We agree that our description of the training data for the encoder network was not very clear. In all GLASS++ experiments, the training data of the encoder network is the same as the data used to train the StyleGAN model used by the attacker. Compared with GLASS, GLASS++ only increases the cost of the attacker's computing resources. In the experiments presented in Appendix D.3, we substituted the StyleGAN model used in the attack with one trained on the FFHQ dataset, instead of CelebA, and utilized FFHQ data to train the encoder network. The results demonstrate that even with a shift of data distribution, GLASS++ still has an effective reconstruction attack effect. That is, even if there’s a distribution shift in the data used for training the encoder, it can still produce a better initial point. We will provide detailed description and extended ablation study in our revision.\n\n3. Thanks for the comment. We would like to clarify that we have extended our method to heterogeneous data (CINIC-10 as the private dataset), which is mentioned in Lines 308-314. The experiments in Appendix D.2 demonstrate the adaptability of our method. We believe that the number of samples can validate the effectiveness of our method, but we agree that more samples would help improve the overall quality of our work. We will provide more attack results as well as standard deviation data for relevant experiments in the revised version to demonstrate the stability of our attack effects.\n\n**Answer for Questions:**\n\nPlease refer to our answer for **Weaknesses-2**.\n\n**Answer for Limitations:**\n\nWe thank the reviewer for this suggestion. We will provide additional discussions with respect to the ethical implications of enabling more effective DRAs in our manuscript. The potential negative societal impact of GAN-based DRAs mainly stems from the disclosure of private data. Once the attacker reconstructs the original data fed into the DL model at the edge-side, it can lead to privacy invasion and generate malicious false information. We hope that our proposed attacks will draw attention to the privacy protection of split inference systems and promote the development of more effective defense mechanisms.\n\n*References:*\n\n[R1] Zhang, Yuheng, et al. \"The secret revealer: Generative model-inversion attacks against deep neural networks.\" CVPR 2020. \n\n[R2] Dong, Xin, et al. \"Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attacks.\" BMVC 2022.\n"}, {"review_id": "QXYjNuVysA", "reviewer": "Reviewer_WYrE", "summary": "The paper introduces a new data reconstruction attack (DRA) on split inference (SI) called GLASS and GLASS++. The task of DRAs in SI is to reproduce the image of a certain user based on the intermediate output of the first part of a trained network, which is located on the user's device. GLASS uses StyleGAN as prior knowledge to constrain the generation of images based on given intermediate activations. The paper shows that GLASS is more robust to multiple defense methods against DRAs and that the generated images are of higher quality than previous DRA approaches.", "questions": "Q1: What does “searching in Z space for the reason that the entanglement of Z space increases the amplitude of positive perturbation in representation space” mean? Could you elaborate what the “amplitude of positive perturbation” is?\n\nQ2: Related to the previous question, can you elaborate on what exactly you mean by disturbance in line 142?\n\nQ3: Why is the total variation loss required? Shouldn't StyleGAN create realistic images based on the latent variable and as a result, the total variation loss shouldn't be needed?\n\nQ4: In Figure 3, the paper claims that GLASS++ is achieving to find the global optimum. As far as I am aware, it is not possible to prove that the found solution is, in fact, the global optimum. Can you elaborate on how you come to the conclusion that the result is the global optimum instead of a local one?\n\nQ5: It would be interesting to see not only the mean of the metrics, but also the standard deviation. This would give an impression on how consistent the attack results are. Could you state the standard deviation for the experiments in table 1?", "limitations": "For the experiments on CelebA the paper reserves roughly 40% of the dataset for performing the evaluation, while the StyleGAN was trained on 60% of the dataset. The assumption that the attacker has 60% of the data from the exact same distribution as the input he is trying to recreate is quite restrictive. The effect of a distribution shift between the image to be reconstructed and the GAN is addressed in the supplementary material. However, the distribution shift is only tested on an undefended model, which is why it is not possible to make a claim about the influence of the shift regarding defended models. Showing results on the defended models with a distribution shift would strengthen the findings of the paper.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- the paper presents a novel DRA attack\n- the paper presents a good idea to use StyleGAN as prior knowledge for DRAs\n- the paper demonstrates that existing defenses are not effective when using DRAs based on generative models.", "weaknesses": "- It is quite hard to follow the paper. For example, it is not clarified what “perturbation” is during the explanation of the approach (paragraph about “Z space search”).\n- Setting the learning rate and the number of steps used for the attack to be the same for GLASS, rMLE and LM is not fair in my opinion. Different attacks might need a different number of steps or a different learning rate based on the optimization objective. The comparison would be much fairer when the optimal hyperparameters are taken for each of these attacks.\n- There are too many references and experimental results in the supplementary material. It is hard to read the paper without reading the supplementary material. For example, in the abstract, the paper claims that the approach is evaluated on 7 defense methods. However, not all results for the evaluations are shown in the main paper and are instead only present in the appendix.  \n\nMisc:  \nLine 249: Table 4 -> should probably be Table 1  \nLine 264: Table 5 -> should be Figure 5  \nLine 203: sigma() is not properly defined  ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We highly appreciate the invaluable and perceptive feedback offered by the reviewer. We have considered all the concerns mentioned and responded appropriately to each one.\n\n**Answer for Weakness1, Qustion1, Qustion2, Qustion4:**\n\nBefore proceeding, we kindly ask you to consult the detailed information available in the global response, specifically response.pdf/Figure-4. The answers provided below are grounded in this context.\n\nRegarding **Weakness1**, the \"perturbation\" referenced in the paper pertains to modifications within the representation space, involving alterations in corresponding facial features resulting from latent code optimization. The term \"positive perturbation\" denotes changes that diminish reconstruction loss and are favorable for an attack.\n\nRegarding **Question1**, the observation of response.pdf/Figure-4(a) reveals that even though the Z space search's trajectory variation amplitude is small, it induces significant facial feature changes, ultimately converging to the target features. This mirrors the greater trajectory variation amplitude in the W space search, with the resultant mapped latent code converging to the target, as depicted in response.pdf/Figure-4(b). This signifies that Z space search enhances the magnitude of facial feature changes and broadens the scope of feature exploration. Furthermore, this adjustment brings the reconstructed outcomes closer to the target image, signifying an \"increase in the amplitude of positive perturbation in the representation space.\"\n\nRegarding **Question2**, we first elaborate on the merits of Z and W+ space searches. W+ space search introduces more nuanced feature alterations, enhancing reconstruction precision. However, its restricted range of feature changes increases the risk of getting stuck in local optima during optimization. The Z space search remedies this limitation by offering larger feature perturbations (controlled disturbances) that serve as advantageous starting points, efficiently sidestepping the W+ space search's potential proximity to local optima.\n\nRegarding **Question4**, for the same reasons detailed above, we favor W space over W+ space for more insightful analysis. As portrayed in response.pdf/Figure-4(c), distinct initializations w1, w2, w3, and w4 lead their respective W space searches to converge on the target latent code. Enhanced initialization and W/W+ space searches in GLASS++ render this process even smoother. This elucidates our conclusion of \"the global optimum.\" Nevertheless, we recognize the need to revise this wording due to inaccuracy. When the intermediate feature information is exceedingly scarce (such as when the split point is set at Block 5/6), achieving the target latent code becomes unfeasible. We will alter \"the global optimum\" to \"an optimum attainable by the attacker with existing knowledge.\" We apologize for the imprecise phrasing, which will be rectified in our revised version.\n\n**Answer for Weakness2:**\n\nThank you for your feedback. In our view, optimization-based data reconstruction attacks tend to yield improved attack effectiveness as the number of optimization iterations increases. However, as the optimization process advances, the gains in reconstruction enhancement tend to diminish. To address this, we've set a sufficiently large number of iterations (20,000), ensuring that various attacks converge stably to their attainable optima. As depicted in response.pdf/Figure-5, the feature loss for the three optimization-based attacks exhibits complete convergence during the reconstruction process. To validate this, we adjusted the learning rate from a uniform 1e-2 to 1e-1. As evident in the reconstruction outcomes, the three results underwent minimal alteration, further affirming the robust convergence of the attack outcomes.\n\n**Answer for Weakness3:**\n\nWe appreciate your valuable suggestions. We will thoroughly revise our paper to ensure that crucial results and analyses are appropriately incorporated into the main body.\n\n**Answer for Weakness4:**\n\nWe apologize for the errors that have occurred. We will conduct a comprehensive review of the entire paper and rectify these issues in the revised version.\n\n**Answer for Qustion3:**\n\nThe impact of total variation loss on the attack's effectiveness is generally limited, owing to StyleGAN's proficiency in generating realistic images. Nonetheless, W+ space offers extensive image editing capabilities, potentially causing the latent code to deviate from the sampling distribution of W+ space during optimization. Illustrated in response.pdf/Figure-6, under the Noise Mask defense, GLASS's unrestrained reconstruction exhibits unnatural artifacts. The inclusion of the total variation loss term rectifies this by producing smooth and natural reconstructed images.\n\n**Answer for Qustion5:**\n\nWe show the standard deviations of GLASS and GLASS++ in response.pdf/Table-1.\n\n**Answer for Limitation:**\n\nIn real-world split inference systems, the common practice involves the server training the model with its own data and then sharing it with clients for collaborative inference through APIs. Our setup aligns well with this scenario, as the server grants API access based on specific criteria for private inference data. To explore a narrower attack scope, a simple solution could be fine-tuning other pre-trained StyleGAN models with a small CelebA image subset. We'll conduct and include these experiments in the revised version.\n\nWe present results pertaining to defended models encountering distribution shifts in response.pdf/Figure-7. Although our reconstruction results experienced a moderate decline, the privacy feature disclosure capability remains superior to that of Inverse-Network. While time constraints constrained us to explore only GLASS, we anticipate that the more stable GLASS++ will yield enhanced reconstruction outcomes, which we'll also incorporate in the revised version.\n\n\n\n"}]

Author rebuttal:
The **response.pdf** contains our supplementary experiments.

Here is our detailed explanation of the experiment in the pdf:

**Detailed explanation of response.pdf/Figure-4**:

The Z space is entangled, signifying that even a small change in the latent code within the Z space can yield a large change within the representation space. In other words, a continuous change in the latent code results in an abrupt change in facial features. Conversely, within the relatively disentangled W/W+ space, continuous changes in the latent code lead to continuous changes in facial features. The characteristics of different latent spaces provide them with distinct advantages.

Taking face reconstruction attack as an example. In the optimization process of the Z space search, gradient descent makes the facial features corresponding to the latent code closer to the target features, that is, makes the image generated by StyleGAN closer to the privacy inference image.

Specifically, we use PCA to reduce the dimensionality of the latent codes within latent spaces and visualize them. We use W space instead of W+ space in this example because the latent code of W space has a lower dimensionality (1\*512 compared to 10\*512 of W+ space), which makes dimensionality reduction easier. As shown in response.pdf/Figure-4(a), we initialize z1 and z2 from a normal distribution and perform Z space search to reconstruct the target image. The grey data points correspond to other samples obtained from the normal distribution after dimensionality reduction, whereas the red star symbolizes the reconstructed target image. It should be noted that the target image in this example is selected to be the image generated by StyleGAN, because it ensures that the target latent code is accurate. It can be seen that after the Z space search, the reconstruction results starting with z1 and z2 closely resemble the target image. However, after dimensionality reduction, they appear in three different regions. This is due to the entanglement of the Z space, the same combination of facial features may correspond to multiple different latent codes. We record the latent codes during the Z space search, map them to W space through StyleGAN's mapping network, reduce dimensionality again and visualize. As shown in response.pdf/Figure-4(b), the optimized trajectories within W space corresponding to z1 and z2 finally converge to the target latent code. This convergence can be attributed to the disentanglement of the W space, ensuring that the same combination of facial features corresponds to the same latent code.

As shown in response.pdf/Figure-4(c), for distinct initializations w1, w2, w3, and w4, their respective W space searches converge together to the target latent code.

*References*:

[1] Pasquini, Dario, Giuseppe Ateniese, and Massimo Bernaschi. "Unleashing the tiger: Inference attacks on split learning." Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021.

[2] Singh, Abhishek, et al. "Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

[3] Vepakomma, Praneeth, et al. "NoPeek: Information leakage reduction to share activations in distributed deep learning." 2020 International Conference on Data Mining Workshops (ICDMW). IEEE, 2020.

[4] Kahla, Mostafa, et al. "Label-only model inversion attacks via boundary repulsion." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022.

[5] Chen, Si, et al. "Knowledge-enriched distributional model inversion attacks." Proceedings of the IEEE/CVF international conference on computer vision. 2021.

[6] Shuai Yang, Liming Jiang, Ziwei Liu, and Chen Change Loy. Styleganex: Stylegan-based manipulation beyond cropped aligned faces. In ICCV, 2023.

[7] Sauer, Axel, Katja Schwarz, and Andreas Geiger. "Stylegan-xl: Scaling stylegan to large diverse datasets." ACM SIGGRAPH 2022 conference proceedings. 2022.

[8] https://www.cs.toronto.edu/~kriz/cifar.html

[9] Luke Nicholas Darlow, Elliot J. Crowley, Antreas Antoniou, and Amos J. Storkey. CINIC-10 is not ImageNet or CIFAR- 10. CoRR abs/1810.03505, 2018. 5



Meta-review: All reviewers lean toward acceptance of the paper. HnH3 raises questions on restrictiveness of the settings and on countermeasures, which are both answered effectively in the rebuttal leading to an increase in scores. The intermediate results presented in the response PDF for BEtd are illustrative and authors are encouraged to include in the main paper. Please include the additional comparisons for use of GAN inversion in MIA and GIA as suggested by k9Qp. While WYrE initially leaned to reject, the rebuttal comprehensively answers the questions leading to an accept rating. Please include the suggested ablations on learning rates in the final supplementary material, the standard deviations in the main paper and results on distribution shifts in the main paper if space permits. In summary, the meta-reviewer agrees with the review consensus to recommend acceptance.
Decision: Accept (poster)