Pseudo-Private Data Guided Model Inversion Attacks
Authors: Xiong Peng
Bo Han
Feng Liu
Tongliang Liu
Mingyuan Zhou
Venue: NeurIPS 2024 poster (2024)
Keywords: Model Inversion Attacks
Primary area: privacy

Abstract: In model inversion attacks (MIAs), adversaries attempt to recover private training data by exploiting access to a well-trained target model. Recent advancements have improved MIA performance using a two-stage generative framework. This approach first employs a generative adversarial network to learn a fixed distributional prior, which is then used to guide the inversion process during the attack. However, in this paper, we observed a phenomenon that such a fixed prior would lead to a low probability of sampling actual private data during the inversion process due to the inherent distribution gap between the prior distribution and the private data distribution, thereby constraining attack performance. To address this limitation, we propose increasing the density around high-quality pseudo-private data—recovered samples through model inversion that exhibit characteristics of the private training data—by slightly tuning the generator. This strategy effectively increases the probability of sampling actual private data that is close to these pseudo-private data during the inversion process. After integrating our method, the generative model inversion pipeline is strengthened, leading to improvements over state-of-the-art MIAs. This paves the way for new research directions in generative MIAs.

Pseudo-Private Data Guided Model Inversion Attacks
Xiong Peng'
Bo Han"
Feng Liu?
Tongliang Liu Mingyuan Zhou"
TMLR Group, Department of Computer Science, Hong Kong Baptist University
School of Computing and Information Systems, The University of Melbourne
Sydnny AI Centre, The University of Sydney
MMcCombs School Business, The University of Texas at Austin
[esxpeng, bhanml) tongliang. wiw..liiiieeeeee @esd@eeeedd..... mingyuan, @ mecombs. utexas.edu
fengliu.mi @ gmmil.com
Abstract
In model inversion altacks (MIAs), adversaries attempt to recover the private train- ing data by exploiting access to vell-trained target model. Recent advancements have improved MIA performance using two-stage generative framework. This ap- proach first employs a generative adversarial network to learn fixed distributional prior, which is then used to guide the inversion process during the attack. However, in this paper, we observed a phenomenon that such a fixed prior would lead a low probability of sampling actual private data during the inversion process due to the inherent distribution gap between the prior distribution and the private data dis- tribution, thereby constraining attack performance. To address this limitation, we propose increasing the density around high-quality pseudo-privan private data- recovrred samples through model inversion that exhibit characteristics of the private train- ing data-by slightly tuning the generator. This strategy effectively increases the probability of sampling actual private data that is close to these pscudo-privar data during the inversion process. After integrating our method, the generative model inversion pipeline is strengthened, leading improvements MIAs. This paves the way for new research directions in generative MIAs. Our source code is available at: https://githe: com/tmlr- tte//mmlrreeee www.pgrPDC......
state-of-the-arr
Introduction
Currently, machine learning (ML) models, especially deep neural networks (DNNs), have become prevalent privacy-sensitive applications such as secure systems [Yin al., 2020], personal chat- bots [Ouyang et al., 2022] and healthcare services [Murdoch, 2021]. These applications inevitably rely on private and confidential datasets during model training, raising concerns about potential pri- vacy leakages [Liu et al., 2021]. Unfortunately. recent studies reveal that ML models are vulnerable various privacy attacks [Fredrikson et al., 2014, Krishna al., 2019, Choquette- Choo et al., 2021], Model inversion attacks (MIAs), a category of these attacks, pose significant privacy risks, which aim to infer and recover original training data by exploiting access to a well-trained model.
In the pioneering work [Fredrikson et al., 2015), MIAS were formulated as a gradient-based opti- mization problem the raw data space. The goal was seek synthetic features that maximize the prediction score for targeted class under the target model, exploiting the strong dependency between inputs and labels established during training. For example, attack scenarios where the target model is a facial recognition model trained on private facial images, traditional MIAs would optimize over the synthetic images to maximize the prediction score for target identity.
Conrespondence to Bo Han wwwall@@@oppbbbuuuuuuu
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

14
ICH 1209)
LDM K2D4)
0.0
Attack Accuracy
Attack Accuracy
PeceScrub
Power
60
40
CUKMA mag Recesou
50
Sample Number
HMD Value
MMD Value
(a) Test Power
(b) D public FFHQ
(c) Duubii FaceSerub
Figure 1: Impact of distribution discrepancies on MIAs. (a) The test power of maximum mean discrepancy (MMD) test increases with the sample number, indicating significant differences between the distributions of D private (CclebA) and Public (CelebA, FFHQ and FaceScrub). (b) & (c) The proxy public datasets P are crafted using the method outlined in Eq. (4). The attack performance consistently diminishes as the discrepancy between the D private (CelebA) and D Public increases. For detailed setups and additional results of the motivation-driver experiments, refer to Appx. C.6.
However, when the target models are DNNs, and the private features to be reconstructed reside in high-dimensional and continuous data spaces (e.g. facial images), the direct optimization in the input space without any constraints is substantially ill-posed. Traditional MIAs could easily produce semantically meaningless adversarial examples (Szegedy et al., 2014], which nevertheless achieve high prediction scores under DNNS. Zhang al. [2020] addressed this problem by employing generative adversarial network (GAN) [Goodfellow et al., 2014, Radford et al., 2016] to learn distributional prior, subsequently constraining the attack optimization space meaningful manifold during the inversion process. This methodology, called generative model inversion (MI), lays the groundwork for more effective model inversion of DNNs trained on nigh-dimensional data [Chen et al., 2021, Wang et al., 2021a, Kahla et al., 2022, Struppek et al., 2022, Nguyen et al., 2023].
Generative MIAS have shown marked improvements by incorporating fixed prior in the inversion pipeline (cf. left panel of Fig. 2). However, this approach is fundamentally limited due to the inherent distribution discrepancy between the prior distribution and the unknown private training data distribution (ef. Fig. (a)). This discrepancy arises because the public auxiliary dataset, used to learn the distributional prior, does not intersect labels with the private training dataset. Therefore, there is a low probability that the original private training data can be accurately sampled during the inversion process, leading to suboptimal attack performance (ef. Figs. 1(b) and 1(c)).
Thus, we raise a critical research question: How can the discrepancy between the prior distribution and the unknown private training data distribution be mitigated? Addressing this distribution gap is challenging in the MI context, where we only have access to a well- vell-trained target model. Nevertheless, the target model still encapsulates information about the private training data. By performing model inversion on the target model, we can generate what we called pseudo-privat data, which are reconstructed samples that reveal the characteristics of the private training data and can serve its surrogate. Consequently, enhancing the density of pseudo-private data under the prior distribution indirectly increases the density of the private training data. This, in turn, raises the probability of accurately sampling the actual private training data (cf. right panel of Fig. 2).
To this end, propose novel model inversion methodology, termed greudo-private data guided MI (PPDG-MI). The efficacy of PPDG-MI is demonstrated through a simple example using a 2D dataset (Sec. 3.3), where increase the density of the pseudo- pseudo-private private data by direetly minimizing the distribution discrepancy between the prior distribution and empirical sseudo-private data distribution, measured by conditional transport [Zheng and Zhou, 2021] that is amenable mini-batch based optimization and straightforward to implement. For the density enhancement of high-dimensional data, introduce nuanced tuning strategy involving three iterative steps: ① Conduct a round of MIAs to produce pseudo-prive private samples. ② Select high-quality pseudo-private samples based on prediction scores. 3 Fine-tune the generator to increase the density around these high-quality samples, thereby increasing the probability of sampling the original private training data.
In summary, contributions and findings
follows:
Conceptually, we identify fundamental limitation common to state-of-the-art (SOTA) generative MIAs [Zhang et al., 2020, Chen et al., 2021, Kahla et al., 2022, Struppek et al., 2022, Han al., 2023, Nguyen et al., 2023], i.e,, the utilization of fixed prior during the

---

inversion process. We argue that this approach is sub-optimal for MIAs and introduce a novel strategy, termed preudo-privart data guided MI, to mitigate this limitation, thereby paving the way for future research and advancements in generative MIAs.
Technically, we provide multiple implementations of PPDG-MI to validate the effectiveness of our proposed strategy. For low-resolution MIAs, we introduce PPDG-vanilla, For more complex high-dimensional MIAs, we offer PPDG-PW, which employs point-wise tuning, and two batch-wise tuning strategies: PPDG-MI with conditional transport (PPDG-CT) and PPDG-MI with maximum mean discrepancy (PPDG-MMD) (Sec. 3).
Empirically, through extensive experimentation, we demonstrate that solution signifi- cantly improves the performance of the SOTA MI methods across various settings, including white-box, black-box, and label-only MIAs (Sec. 4). Our findings emphasize the increasing risks associated with MIAs and further highlight the urgent need for more robust defenses against the leakage of private information from DNNs.
2 Problem Setup and Preliminary
2.1 Model Inversion Attacks
Problem Setup. Let X C Rdx be the feature space, and Prrvvtee = (I,...,C') be the private label
space. The target model, M: X + [0, 1j a classifier well-trained on the private training dataset Driivae sampled from P(Xprivate; ). In standard settings, for specific class y in privatee MIAs aim to reconstruct synthetic samples by exploiting access to the target model M to uncover sensitive features of class y. In this context, the adversary is limited to querying M, and also possesses knowledge of the target data domain but lacks specific details about Prrivate-
Mathematically, MI is formulated as an optimization problem: Given target class y, the goal is to find a sample x that maximizes the model M's s prediction score for class y. In -igeesiinnsional data settings, traditional MIAs [Fredrikson et al., 2015] use direct input space optimization, often leading to adversarial samples [Szegedy al., 2014] that, despite high prediction scores, lack meaningful features. To mitigate this issue, Zhang et al. [2020] propose a generative MI approach, which learns distributional prior to constrain the optimization to a low-dimensional, meaningful manifold.
Current generative MIAs primarily concentrate on either the initial training process of GANs [Chen et al., 2021, Yuan et al., 2023, Nguyen et al., 2024] or the optimization techniques used in the attacks [Zhang et al., 2020, Wang et al., 2021a, Struppek et al., 2022, Kahla et al., 2022, Nguyen et al., 2023]. In this paper, we take another direction and introduce novel approach by fine-tuning the GAN's generator based on the attack results from previous runs. This method introduces a dynamic and iterative dimension to model inversion attacks, expanding the current understanding and research direction of generative MIAs. For detailed related work, please refer to Appx. A.1.
Specifically, the generative MI approach consists of two stages. Initially, a GAN learns prior from public auxiliary datasets, in which ypubtiic O 3 = 0. This process involves a generator, denoted as G)::0): 2 Xprior- parameterized by 0, that transforms a din-eineniional latent code, a high- high-dimensional image, x E Xprior- Concurrently, a discriminator D(:; Φ): X' - R, which can distinguish between generated and real images. Subsequently, the MI optimization can be constrained to the latent space Z of the fixed prior G. which can be formulated as:
Z, into
z" arg min Lia(z; y, M, G) A. (z; G,
(I)
where Ca(()) denotes the identity loss, e.g., the cross-entropy loss log PM (1) which optimizes for an optimal synthetic sample x = G(z*). ). Additionally, C-rio(() serves as a regularizer for the latent code z, and the parameter X balances the trade-off between the identity loss and the regularizer.
2.2 Distribution Diserepancy Measure
To effectively align distributions in our methods, it is essential to introduce metrics that can accurately quantify the differences between them. Two commonly used measures for this purpose are maximum mean discrepancy (MMD) and conditional transport (CT). MMD focuses on mean differences
3

---

using kernel methods, while CT incorporates cost-based transport distances, offering complementary perspectives on distributional discrepancies. This section introduces the empirical estimation of MMD and CT. For more details on these discrepancy measures, please refer to Appx. A.2.
Estimation of MMD. Given distributions P and Q, and sample 5x {x+} P and Sy = دy ~ Q, MMD can be estimated with the following estimator [Gretton et al., 2012b]:
(Sx. n(n 1)
x(x,,xz)+ + m(m 1) im 1,5
k(y,,,))
im j'ylj
2
k (xx; Vj).
(2)
m7
where & kernel function, x,, X, E Sx and yi E Sy
Estimation of CT. Similarly, for sample sets Sx = fx, J== and Sy {y, can be approximated follows [Zheng and Zhou, 2021]:
the CT measure
e (x.3)))
(x
CT(Sx, Sy)
Σ>
(3)
Th Ey= (x
Σ e-dw (x.,
Here, dæ (x. y) is a function parameterized by ap that measures the similarity between x and y, and c(x,y) cost function that measures the distance between the points and y.
3 Pseudo-private Data Guided Model Inversion
This section introduces our proposed methodology, i.e., pseudo-private data guided MI (PPDG-MI). First, we present and discuss the critical motivation that inspires our method (Sec. 3.1). Second, we introduce the general framework of PPDG-MI (Sec. 3.2). Third, to ease understanding, we demonstrate and illustrate the rationality of our solution on a simple toy dataset (Sec. 3.3). Fourth, we present more nuanced and detailed strategy for tuning the generator to enhance density in high-dimensional image spaces, accompanied by multiple algorithmic implementations (Sec. 3.4).
3.1 Motivation: Effect of Distribution Discrepancies on MIAs
Collecting public auxiliary datasets that closely resemble the private dataset remains challenging. This difficulty arises because the MI adversary lacks knowledge of specific class information, and only understands the general data domain about P(Xprivate) Thus. we hypothesize a significant distribution discrepancy between the prior distribution P(Xpreor) and the private data distribution P(Aprivate. This claim is supported by Fig. I(a), where we quantify the distribution discrepancy between commonly adopted public auxiliary datasets and private training datasets using the MMI) measure [Borgwardt et al., 2006), showcasing a substantial gap between these two distributions.
To evaluate the impact of this distribution discrepancy on MI performance, we create series of proxy prior distributions through linear interpolation, where a mixing coefficient E [0, 1] determines the proportion of samples drawn from each distribution. Specifically, a fraction of samples is drawn from P P(Xpttor. and the remaining (1 a)) is drawn from P P(Xprivace) This process is represented as:
P P( prior) = aP prior) + (1 (0)-a))P(44 PP)
We apply these proxy prior distributions constrain the MI optimization as outlined in Eq. (1), As illustrated in Figs. ((b) and I(c), the MI performance decreases monotonically as the MMD value between PX and P. ((priiaae) increases. This leads us pose a critical research question:
How can the discrepancy between the prior distribution and the unknown private data distribution be mitigated enhance MI performance?
In response to this, a revised inversion pipeline is required, wherein G is dynamically adjusted throughout the inversion process. This adjustment aims to progressively narrow the distribution gap between P P(ppioo)) and P P(privva)) thereby potentially improving MI performance.

---

y(
G
M
2 y y
2 マ
G
2
M
2 y
y
P(x
P P(Xprican))
P(X
P P(Xprivatte)
G
upárre
Xinit
Xiit
Framework of Generative MI
Framework of PPDG-MI
Figure 2: Overview of traditional generative MI framework vs. pseudo-private data guided MI (PPDG-MI) framework. PPDG-MI leverages pseudo-privan private data x generated during the inversion process, which reveals the characteristics of the actual private data, to fine-tune the generator G. The goal is to enhance the density of & under the learned distributional prior P(Xpraa), thereby increasing the probability of sampling actual private data x" during the inversion process.
3.2 PPDG-MI Framework
This section presents novel model inversion pipeline that dynamically adjusts the generator G to mitigate the distribution discrepancy between P(Xgriar) and P(XXprvatt) (ef. Fig. for the framework overview). As aforementioned, in the MI contexr, while the specific details of "private remain unknown, we have access to the target model M, which is well-trained on Prrivate. still encapsulates information about D private. Therefore, by conducting MI on the target model M, we can generate a set of pseudo-private samples (i.e., reconstructed samples), denoted as D private. which reveal the characteristics the private dataset 2 private and can serve as its surrogate. Thus, the key insight that by enhancing the density of the prior distribution P(Aprior) around Dr private we indirectly increase the density around priivate well. Consequently, the probability of sampling data from P (Apprivate) could be increased. This strategy is termed prruud-privatee data guided MI (PPDG-MI).
To this intuition, the proposed MI framework consists of the following three iterative steps:
Step-1: Pseudo-private Data Generation by Conducting MI the Target Model. Specifically, in generative MI, optimization is restricted to the latent space 2. Initially, we sample a set of latent
codes, Z [2; 2, E Z, 1, .., N). Then, by leveraging Eq. (1), these initial latent codes optimized to produce 2 {2 arg min (z) + p (z) z E Z}. Subsequently, this optimized set Z is utilized to generate a pssudo-private dataset D' private = {x = G(2) 2 E Z}.
Step-2: Selection
Hiigh-ualityy Pseudo-private Data. In this step, we aim to select high-quality data from De Prrivate that closely resemble the characteristics of samples in Dprivate. serving as their proxy. An intuitive method is to select samples with high prediction scores. Thus, following Struppek al. [2022], we opt to select samples with larger expected prediction scores E(Px( T(x)) under random image transformations T, indicating that x represents the desired characteristics for target class more accurately. Specifically, we select high-quality subset D: with top K expected prediction scores from D: private
private consisting of samples
Step-3:
Density Enhancement around Pseudo-private Data. In this step, we focus on fine-tuning G to adjust the prior distribution P P(Appirr) aiming to inerease the probability of sampling data from P( P(Xprivae) In the existing literature, MIAs can be categorized into two types: those targeting high-resolution tasks [Struppek al., 2022] and those targeting low-resolution tasks [Zhang et al., 2020, Chen et al., 2021, Kahla et al., 2022, Nguyen et al., 2023]. In high-resolution MIAs, adversaries leverage pre-trained GANs without access to training specifics. In contrast, low-resolution MIAs involve adversaries training GANs from scratch using the public auxiliary dataset Dpublic- This distinction enables the development of tuning strategies tailored to different attack settings.
For MIAs focusing on low-resolution tasks, where the generator G is less powerful and the low- resolution image manifold is more susceptible to disruption, we adopt principled tuning strategy. Specifically, we fine-tune G and D using the original GAN training objective on Dpubiic U D Ppivane strategy termed PPDG-vanilla (cf. Alg. 1). For MIAs focusing high-resolution tasks, e.g., Plug
5

---

Clost
Clesk
Coom
Cles
Coar
Data
(a) Baseline
(b) PPDG-MI
Figure 3: Illustration of the rationale behind PPDG-MI using a simple 2D example. Training samples from Class 0-2 are represented by purple, blue, and green, respectively, while public auxiliary data are shown in yellow. MIAs aim to recover training samples from Class 1, with reconstructed samples shown in red. (a) Results of the baseline attack with fixed prior. (b) Left: Pseudo-private data generation. Middle: Density enhancement of pseudo-private data under prior distribution. Right: Final attack results of PPDG-MI with the tuned prior, where all the recovered points converge to the centroid of the class distribution, indicating the most representative features are revealed.
& Play Atlacks (PPA) [Struppek al., 2022], we propose a tuning strategy that leverages only the high-quality pseudo-private dataset D private which can be formalized as follows:
G < Fine-tune (G, D, D,Ds' p.ivaae))
(5)
This adjustment aims to increase the density of the prior distribution around D private The concrete realizations (cf. Alg. 2) are presented in Sec. 3.4. After fine-tuning the generator, return to Step-I and repeat the attack process to further improve the MI performance. Our experiments primarily focus on PPA, which allows us to investigate more realistic attack scenario with high-resolution data.
3.3 Understanding PPDG-MI with 2D Data
To illustrate the principles of PPDG-MI, we present a toy example using 2D dataset with three classes, each sampled from a class-conditional Gaussian distribution, as shown in Fig. 3. Additionally, public dataset is sampled from a separate Gaussian distribution to learn the distributional prior P(Appnur). We simulate simple MIA by generating an initial set of samples using generator G and then optimizing these samples to maximize the model's 's prediction score for Class 1. The objective is to uncover the features of Class 1, primarily the coordinates of the training samples. The closer these optimized samples are to the centroid of Class I's distribution, i.e., the high-density region, the more effective the attack. See Appx. C.7 for a larger version of Fig. 3 and the experimental details of the toy example. An animated illustration of the toy demo available in the supplementary materials.
The baseline attack results are shown in Fig. 3(a), where a fixed G is adopted during the inversion process. The left panel of Fig. 3(b) illustrates the generation of dataset Drrvace through round of MI on model M. Middle panel of Fig. 3(b) shows the enhancement of density around D Dprivate under the prior distribution P( achieved by fine-tuning G(-; 0) align with the empirical distribution of Dr Private. using the CT measure. The final attack results of PPDG-MI are shown in the right panel of Fig. 3(b). It is evident that, in comparison to the baseline where only small fraction of reconstructed samples fall within the high-density region of the training data distribution, all reconstructed samples from PPDG-MI are located in this high-density region. See Appx. C.7 for the quantitative results.
Although we initially applied direct distribution match strategy in this simplified setting to implement PPDG-MI, the empirical results indicate that this approach is less effective for higher-dimensional image data, it would destroy the generator's manifold (Appx. C.8). We address this issue by introducing a nuanced tuning strategy tailored for high-dimensional data settings, detailed in Sec. 3.4.
3.4 Nuanced Approach PPDG-MI for High-Dimensional Image Data
Considering the primary baseline PPA [Struppek et al., 2022] uses StyleGAN [Karras et al., 2020] as its distributional prior, our approach leverages StyleGAN's disentangled nature, allowing slight local changes to its produced appearance without disrupting the manifold. Specifically, we first identify high-density neighbor for each pseudo-private sample x (ef. Fig. 4(b)) and adjust this neighbor to be closer to x, thereby enhancing density around & in the generator's o's domain (cf. Fig, 4(c)).

---

Prequeenc
z 2
2 2
Logit
(a) Logit Distribution
(b) Locating xP
(c) Point-wise Tuning
Figure 4: Illustration PPDG-MT using a point-wise tuning approach. (a) The distribution of discriminator logit outputs for randomly generated samples by the generator G, showing that the discriminator can empirically reflect the density of generated samples. (b) Locating the high-density neighbor x² by optimizing Eq. (6). Darker colors represent regions with higher density. (c) Increasing density around the pseudo-private data & by moving xP towards &, i.e., optimizing Eq. (7).
Instantiate PPDG-MI with Point-wise Tuning, To this intuition, we detail a two-step method to increase the density around pseudo-private samples. First, to locate optimize the latent code z to produce x². The closeness between x" and x is measured using the LPIPS perceptual loss function [Zhang al., 2018]. Additionally, to ensure that x² is located in high-density region of P(Xpriue, we leverage the discriminator D. Although GANs typically do not provide explicit probability density functions, empirical evidence suggests that D effectively indicates the density of generated samples (cf. Fig. 4(a)). Overall, the optimization objective is formulated as
neighbor x² of &,
nP arg min LLPPP (X,, G(z))
X D(G()))
(6)
neighborhood constraint
high-density constraint
where LLPIPS represents the perceptual loss function, and λ a tuning hyperparameter that balances the constraints. At this step, the generator remains frozen. After optimizing Eq. (6), we obtain high-density neighbor point xP G(zP; 0) of We then aim to slightly alter G(: 0) to pull xP
towards x, thereby enhancing the local density around & (ef. Fig. 4(c)). This is accomplished by fine-tuning the generator with the point-wise loss term:
L (0) ( G(z²;
At this step, zP remains fixed, and the adjustment is applied exclusively to the generator Building on the point-wite woine-wise density enhancement, we extend approach to batch-wise method using statistical distribution discrepancy measures [Borgwardt et al., 2006, Zheng and Zhou, 2021], aiming for more principled local distribution alignment strategy.
Instantiate PPDG-MI with Batch-wise Tuning. Given the sets De
private { and
(G(z,)) P( following the point-wise tuming settings, initially map these ples to the LPIPS space using feature extractor f. Denote as the distribution discrepancy measure, the batch-wise tuning strategy adapts the previous point- wise Eqs. (6) and (7) as follows:
{2 = arg min I (f(G(2))) X Σ D(G(Z))),
(8a)
neighborhood constraint
2=1
high density constraint
LPPDG-BW ((GG
(8b)
We present two realizations of the batch-wise tuning strategy: PPDG-MMD and PPDG-CT. When is set as MMD with Gaussian kernel k, the optimization objective in Eqs. (8a) and (8b) is realized as
(z) (z = arg min (IDD A D(G(2))),
(9a)
[2
(PPDG-MMD() MLDD ())
(9b)
7

---

Similarly, when 6 is set as CT, the optimization objective in Eqs. (8a) and (8b) is realized as
{2))
argmin min CT(/(()))
X D(G(2))),
(10a)
(3,)
LPPDG-CT(0) (L ())
(10b)
The cost function in Eq. (3) is implemented y(x:y) cos (((x, ((y),, while the distance function is implemented as y) [(x))[(y) which are commonly adopted realization choices in existing literature (TTawwisuth al., 2021, 2023].
4 Experiments
In this section, we evaluate the performance of SOTA MI methods before and after integrating them with PPDG-MI, as well as the robustness against SOTA MI defenses, including BiDO [Peng et al., 2022] and NegL.S [Struppek et al., 2024], to assess the overall effectiveness of PPDG-MI. The evaluation primarily focuses on real-world face recognition tasks. For high-resolution (224 x 224) tasks, we consider PPA [Struppek et al., 2022] in the white-box setting. For low-resolution (64 64) tasks, we consider GMI [Zhang et al., 2020], KEDMI [Chen et al., 202 IJ, LOM [Nguyen et al., 2023], and PLG-MI [Yuan et al., 2023] in the white-box setting, RLB-MI [Han et al., 2023] in the black-box setting, as well as BREP-MI [Kahla et al., 2022] in the label-only setting.
4.1 Experimental Setup
This section briefly introduces the experimental setups. For further details, please refer to Appx. C. Datasets and Models. In line with existing MIA literature face recognition,
the CelebA [Liu et al., 2015], FaceScrub [Ng and Winkler, 2014], and FFHQ datasets [Karras et al., 2019]. These datasets are divided into two parts: the private training dataset Pprivate and the public auxiliary dataset putbiic. ensuring no identity overlap. For high-resolution tasks, we trained ResNet- 18 [He al., 2016], DenseNet- 121 [Huang et al., 2017] and ResNeSt-50 [Zhang et al., 2022] as target models. For low-resolution tasks, we trained VGG16 [Simonyan and Zisserman, 2015] and face.evoLVe [Wang et al., 2021b] as target models. The training details of these models are presented in Appx. C.3. We summarize the attack methods, target models, and datasets adopted in Tab. 4.
Attack Parameters. For all MIAs, fine-tune the generator G in identity- manner, to minimize alterations to the generator's latent space. Thus, adjustments to the attack parameters in official implementations are required. Detailed attack parameters are provided in Appx. C.4.
Evaluation Metrics. evaluate the performance of an MIA, we need to assess whether the reconstructed images reveal private information about the target identity. Following existing litera- ture [Zhang et al., 2020], we adopt top-1 (Ace 1) and top-5 (Aco@5) attack accuracy, as well as K-Nearest Neighbors Distance (KNN Dist). Details for these metrics are provided in Appx. C.5.
4.2
Main Results
In the main experiments, we integrate PPDG-MI for density enhancement while still employing the baseline attack method for MI. We conduct one round of fine-tuning of G and present the resulting attack results to demonstrate the efficacy of PPDG-MI. The results multi-round fine-tuning are reserved for the ablation study (ef. Sec. 4.3). Additional experimental results, including evaluations on various target models, assessments with PLG-MI, black-box, box, and label-only MIAs, as well as comparisons against SOTA MI defenses for rewoououttion tasks, are presented in Appx. D.
Comparison with PPA in the high-resolution setting. For each baseline setup, we report results for three variants: PPDG-PW, PPDG-CT and PPDG-MMD. The results presented in Tab. 1 demonstrate that our proposed method significantly improves MI performance across all setups, validating its effectiveness. Notably, integrating our methods with the baseline substantially increases attack accuracy. The KNN distance results also confirm that our methods more accurately reconstruct data resembling the private training data. Qualitative results of reconstructed samples from all target models are provided in Figs. and 10 Appx. D.3. Additionally, among the three PPDG-MI variants, the batch-wise tuning strategy consistently outperforms the point- wise tuning strategy. Batch-wise
8

---

Table 1: Comparison of MI performance with PPA in high-resolution settings. D Privatee CelebA or FaceScrub, GANs are pre-trained on Puubic = FFHQ. The symbol + (or f) indicates smaller (or larger) values are preferred, and the green numbers represent the attack performance improvement. The running time ratio (Ratio) between prior fine-tuning and MI reflects the overhead of ane-tuning.
CelebA
FaciSernb KNN Dist.
Target Model
Method
At
Acc
KNN Disti
Ratio]
Acc 17
Acc
Ratiol
PPA
30.00
91.54
0,7374
$3.19
95.89
0.7996
ResNet-18
-PDG-CCT (owns)
PPPG-- PW (ours)
(x2.35)
(+5.19)
(x3.19)
0,6754 (620
0,7082 (.0,229))
2:25
84.44
95, 95.28
96.53
0.7929 6-00057)
0.7768 (-0.0228)
1.19
1,70
PPDG--MMD (ours)
88.53 (47.75)
97.35 (45.61)
0.6798
(-00599)
1.33
57.02
97.13
0,7708 (-0.0288)
0.85
PPA
76.74
80.04
0.7856
77:13
90.47
0.7917
/
DenseNed-121
PPDG CT (ours)
PPPG--PM PW cours)
78.41 (41.67)
82,51 (45,77)
92.88 (13.84)
94.81 (+5.77)
0,7219 0.7219 (33)337)
0.7003 (-00553)
1.34
1.67
84.93
78.45
96
92.89
0.7405 (-0.0512)
0.7778 (-0.0139)
1.07
1.55
(46.33)
0.6044 (50.052)
0.81
0.736 (-0.0554)
0.79
PPA
82.79
0,8382
73.65
90.96
0,8386
RosNeSi-50
+ -PDDG-PP PW (ouns)
+ PPDG CT (ours)
67.66 (+3.14)
72:57 (+8.05)
86.73 (+3.94)
66 (+6.87)
0.8181 (000201))
0,7802 0.0580
1.11
1.68
74.98
77.77
92.24
93.51
0,8045 (-0.0341)
0,8190 (-0.0196)
1.58
1.07
PPPG--MMM (ours)
72.99 (48,47)
90.01 (+7,22)
0,7874 (-0 (500500)
0.80
78.35
93.42
0,8109 (-0.0277)
0.79
Table 2: Comparison of MI performance with white-box MIAs in low-resolution settings. Target model M = VGG16 trained on D Prrivate CelebA. GANs are trained on puuhicc CelebA or FFHQ
CelebA
FFHQ
Method
Acc
St
KNN Dist.
Rain|
AcceeSt
KNN Diai
Ratio
GMI +
17.59
39.20
1720.46
8.78
23.42
1777.72
/
(ours)
(+5.07)
45.35 (+6.15)
1697.08 (-23.8)
(+1.1))
(+1.79)
(-9.6)
1.62
LOM (GMI)
64.54
$6.92
140381
98.17
64.67
1520.77
/ 1.70
+ PPDG-vanill (ours)
76.89 (+13.55)
92.77 (+5.85)
1329.02 (-74.79)
1.61
50.76
77.18 (+12,511
1434.71 (-86.06)
KEDMI
93.41
1329.12
41.15
1447.15
PPDG-vunilla (ours)
76.18 (43.36)
95 (-2.017)
1307.42 (-21.70)
28.50
41 (40.33)
73.58 (43.50)
4440
55.20
LOM (KEDM)
86.48
98.97
1249.82
$7.56
85.96
1384.55
/
PPDG-vamila (ours)
87,21 (+0.73)
99.00 (-0.03)
1247.69 (-2.13)
28.09
62.02
87,21 (+1.88)
1353, 3653.6605 (-31.19)
56.30
tuning captures characteristics of the local data distribution by handling batches of pseudo-privan data, whereas point-wise tuning focuses individual data points. Furthermore, batch-wise tuning is more robust against outliers, leading to a more reliable adjustment of the prior distribution.
Comparison with white-box MIAs in the low- resolution setting. For each baseline setup, we report results for PPDG-vanilla. The results are shown in Tab. 2, where PPDG-vanilla consistently outperforms various baseline white-box attacks. The improvement is evident in both attack accu- racy and KNN distance metrics. Notably, even with a significant distribution shift between the private training dataset (CelebA) and the public auxiliary dataset (FFHQ), the principled vanilla fine-tuning strategy with original GAN training objectives effectively enhances the density around preudo-private samples. As a highlight, PPDG- vanilla outperforms the baseline LOM (GMI) by achieving 12.35% increase in top-1 attack accu- racy and reducing KNN distance by approximately 75. Qualitative results of the reconstructed sample are provided in Figs. 11 and 12 in Appx. D.3.
Table 3: MI performance against SOTA defense methods in high-resolution settings. The target model M = ResNet- 152 trained on D FaceScrub, GANs are pre-trained on D FFHQ Bold numbers indicate superior results.
Method
Ace@1 1t
KNN Dist.
No Def.
77.85
0.8235
BiDO-HSIC
52.50
0.9546
+ PPDG-PW
54.65
0.9270
+ PPDG-CT
57.40
0.9051
+ -PDGGMMD
58,55
0.9017
NegLS
11.35
1.3051
+ PPDG-PW
14.65
1.2234
Attacks against SOTA MI defense methods. We extend our evaluation to include state-of-the- art model inversion defense methods, specifically BiDO-HSE and NegLS, comparing the perfor-
+ PPDG-CT
16.25
1.2233
PPDG-MMD
13.25
1.2187
mance of our proposed methods PPpddds-PP.WP.W PPDG-CT, and PPDG-MMD with the baseline PPA.
As summarized in Tab. 3, each proposed method consistently outperforms the baseline. Notably, PPDG-MMD achieves a 6.05% improvement top-1 attack accuracy and reduces KNN distance by 0.0529 relative to the baseline against BiDO-HSIC. Similarly, against NegL PPDG-CT shows 4.90% improvement in top-1 attack accuracy and 0.0818 reduction in KNN distance compared to the baseline. Additional results for the low-resolution setting provided in Appx. D.I.

---

100
150
300
Attrck Accuracy
82
Attack Accuracy
80
Attack Accuracy
22
40
20
PVOC
PMDG-CT
PPDG-PM
2POG-CT
PADSNVD
PRD6-PW
PR55-C
RPO HNN
Figure 5: Ablation study in the high-resolution setting. Left: Impact of iterative fine-tuning, Middle: Importance of selecting high-quality pseudo-private data for fine-tuning. Right: Effectiveness of using the discriminator as an empirical density estimator to locate high-density neighbors.
4.3 Ablation Study
In this section, we present part of the ablation study MIA in the high-resolution setting further explore PPDG-MI. The target model ResNet-18 18 trained on CelebA; GANs are pre- pre-trained on FFHQ. Additional ablation results for high- and low-resolution settings are provided in Appx. D.2. Discussions (e.g.. broader impact, failure case analysis and limitations) are provided in Appx. E.
Iterative fine-tuning. The iterative fine-tuning process is crucial for PPDG-MI (ef. Algs. 1 and 2). Its goal to progressively increase the probability of sampling pseudo-private data with closer characteristics the actual private training data. Ideally, if the classifier has learned all discriminative information of the target identity, this process can continue until is capable of sampling the actual training data. As shown in left panel of Fig. 5, the attack performance consistently improves with additional rounds of fine-tuning, demonstrating the effectiveness of this approach.
Selecting high-quality pseudo-private data for density enhancement. The rationale behind enhancing the density around high-quality pseudo-private data, rather than random reconstructed ones, is that the former better reflect the characteristics of the private training data and are semantically closer. Thus, this increases the probability of sampling the actual training data. The middle panel of Fig. 5 compares the attack results of enhancing density around high-quality pseudo prrivte samples and randomly selected recovered samples, demonstrating the effectiveness of this strategy.
Locating high-density neighbors using the discriminator. We investigate the effect of using the discriminator D as empirical density estimator locate samples in high-density areas in Eqs. (6), (9a), and (10a). The comparison results, with and without the discriminator, are shown in the right panel of Fig. 5. The results indicate that MI performance decreases significantly without using the discriminator, with an approximate 13-22% reduction in attack accuracy across different fine-tuning methods. This demonstrates the effectiveness of incorporating as a density estimator.
5 Conclusion
In this paper, we identify a fundamental limitation common to state-of-the-arr generative MIAs, i.e., the utilization of a fixed prior during the inversion phase. We argue that this approach is sub-optimal for MIAs. Accordingly, we introduce novel inversion pipeline called pseudo-private data guided MI (PPDG-MI), which, for the first time, involves iteratively tuning the distributional prior during the inversion process using pseudo-private samples. This increases the probability of recovering actual private training data. We propose multiple realizations of PPDG-MI and demonstrate their effectiveness through extensive experiments. Our findings pave the way for future research on generative MIAs and highlight the urgent need for more robust defenses against MIAs.
Acknowledgments
XP and BH were supported by NSFC General Program No. 62376235, Guangdong Basic and Applied Basic Research Foundation Nos. 2022A1515011653 and 2024A151 HKBU Faculty Niche and HKBU CSD Departmental Incentive Scheme. TLL was partially supported by the following Australian Research Council projects: FT220100318 DP220102121, LP220100522 00527, (12222,,PP2200 LP220200949, and (C190100031. FL is supported by the Australian Research Council (ARC) with grant numbers DP230101540 and DF240101089, and the NSF&CSIRO Responsible AI program with grant number 2303037.
Research Areas No. DC-FNRA-IG/22-23553
10

---

References
Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity. In NDSS, 2022.
Karsten M Borgwardt, Arthur Gretton, Malte Rasch, Hans-Peter Kriegel, Bernhard Schölkopf, and Alex J Smola. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics, 2006.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In ICCV, 2021.
Christopher A Proouuette-Choo Florian Tramer, Nicholas Carlini, and Nicolas Papemnt. Label-only membership inference attacks. In ICML, 2021.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogenetics: An end-to-end case study personalized warfarin dosing. In USENIX Security, 2014.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NeurIPS, 2014.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. The Journal of Machine Learning Research, 2012a.
Arthur Gretton, Karsten M Borgwardt, Malte J. Rasch, Bernhard Schölkopf, and Alexander J. Smola. A kernel taople test. Journal of Machine Learning Research, 2012b.
Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Improved training of wasserstein gans. In NeurlPS, 2017.
Gyojin Han, Jachyun Choi, Hacil Lee, and Junmo Kim. Reinforcement corming-based black-box model inversion attacks. In CVPR, 2023.
Kaiming Hc. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In CVPR, 2022.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In CVPR, 2019.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In CVPR, 2020.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, and Mohit lyyer. Thieves on sesame street! model extraction of bert-based apis. ICLR, 2019.
Bo Liu, Ming Ding, Sina Shaham, Wenny Rahayu, Farhad Farokhi, and Zihuai Lin. When machine learning meets privacy: A survey and outlook. ACM Computing Surveys, 2021.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, 2015.
Blake Murdoch. Privacy and artificial intelligence: challenges for protecting health information in new era. BMC Medical Ethics, 2021.

---

Hong-Woo Wei Ng and Stefan Winkler. A data-driven approach to cleaning large face datasets. In ICIP, 2014.
Bao-Ngoe Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Man Cheung. Label-only model inversion attacks via knowledge transfer. In NewrIPS, 2024.
Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks. In CVPR, 2023.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. In NeurlPS, 2022.
Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In KDD, 2022.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. In ICLR, 2016.
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In CVPR, 2015.
Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
Lukas Struppek, Dominík Hintersdorf, Antonio De Almeida Correia, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In ICML, 2022.
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks. In ICLR, 2024.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Korawat Tanwisuth, Xinjie Fan, Huangjie Zheng, Shujian Zhang, Hao Zhang, Bo Chen, and Mingyuan Zhou. A prototype-oriented framework for unsupervised domain adaptation. NewrIPS, 2021.
Korawat Tanwisuth, Shujian Zhang, Huangjie Zheng, Pengcheng He, and Mingyuan Zhou. Pouf: Prompt-oriented unsupervised fine-tuning for large pre-trained models. In ICML, 2023.
Kuan-Chich Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. In NeurIPS, 2021a.
Qingzhong Wang, Pengfei Zhang, Haoyi Xiong, and Jian Zhao. Face.evolve: A high-performance face recognition library. arXiv preprint arXivv2107.08621, 2021b.
Xiaosong Wang. Yifan Peng, Le Lu, Zhiyong Lu, Mohammadhadi Bagheri, and Ronald M Sum- mers. Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on classification and localization of common thorax diseases. In CVPR, 2017.
Xi Yin, Ying Tai, Yuge Huang, and Xiaoming Liu. Fan: Feature adaptation network for surveillance face recognition and normalization. In ACCV, 2020.
Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo label-guided model inversion attack via conditional generative adversarial network. In AAAI, 2023.
Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R Manmatha, et al. Resnest: Split-attention networks. In CVPR, 2022.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversinn inversion attacks against deep neural networks. In CVPR, 2020.
Huangjie Zheng and Mingyuan Zhou. Exploiting chain rule and bayes' theorem to compare probability distributions. In NewrIPS, 2021.
12

---

Appendix
Detailed Related Work and Preliminary
14
A.1 Model Inversion Attacks
14
A.2 Distribution Discrepancy Measure
14
The Algorithmic Realizations of PPDG-MI
17
Experimental Details
17
C.1 Hard- and Software Details
17
C.2 Evaluation Models
17
C.3 Target Models
17
C,4 Attack Parameters
18
C.5 Evaluation Metrics
18
C.6 Experimental Details for Fig.
18
C.7 Experimental Details for Toy Example From Sec. 3.3
19
C.8 Investigate Distribution Alignment on High-dimensional Image Data
20
Additional Experimental Results
21
D.I Additional Main Results
D.2 Additional Ablation Study
24
D.3 Visualization of Reconstructed Images
25
Discussion
26
13

---

A Detailed Related Work and Preliminary
A.1 Model Inversion Attacks
Model inversion attacks (MIAs) were first introduced by Fredrikson et al. [2014] as a method to reconstruct private data from outputs in simple regression tasks with shallow models. This groundbreaking research highlighted the privacy risks of exposing sensitive data via model predictions. Based this foundation, Zhang et al. [2020] extended MIAs more complex DNNs. They developed a methodology that involved learning a distributional prior from a publicly available auxiliary dataset, allowing for effective MIAs in constrained latent space of the generator. Since these foundational studies, MIAs have received increased attention, particularly in the realm of high- nigh-dimensional image data. Recent research divides MIAs into three types based on the attacker's access the model: white-box, black-box, and lahel-only settings. Each category represents varying levels of accessibility and potential risk, which informs the ongoing development of defensive strategies in this area.
In the white-box setting, attackers have full access to the model, including its architecture and weights. The first white-box attack on DNNs. generative model inversion attack [Zhang et al., 2020], utilized generative adversarial networks (GANs) to learn a distributional prior and optimize within the latent -enreegg-ennrcced space. Subsequently, the knowledge enriched distributional model inversion (KEDMI) attack [Chen et al., 2021] employed a specialized GAN with an advanced discriminator that leverages information from the target model. Wang et al. [2021a] proposed variational model inversion (VMI), which uses a probabilistic approach with variational objective to ensure both diversity and accuracy. This evolution culminated in the Plug & Play Attack (PPA) [Struppek et al., 2022], which enhances the recovery of images ranging from low to high resolution. Additionally, Nguyen et al. [2023] introduced logit maximization (LOM) loss an alternative the cross-entropy (CE) identity loss previously used in [Zhang et al., 2020, Chen et al., 2021, Wang et al., 2021a] and addressed issues of model overfitting with the model augmentation technique. Moreover, Yuan et al. [2023] advanced MIAs with the pseudo label-guided model inversion (PLG-MI), employing a conditional GAN (cGAN) and max-margin loss, and using pseudo-label, to decouple the search space for different classes.
In the black-bor setting, attackers lack direct access to the model's internals but can still query the target model a predetermined number of times to observe outputs for specific inputs, using this data to infer sensitive information indirectly. An et al. [2022] adopted a genetic search algorithm as an alternative gradient descent in the black-box setting. While Han al. [2023] developed the reinforcement learning-basse -nasin model inversion (RLB-MI) algorithm, formulating the latent vector optimization as a Markov decision process (MDP) using reinforcement learning.
The label-only setting poses the greatest challenge in model inversion attacks, where attackers only have access to the hard labels produced by the model, without any confidence scores other related information. Kahla et al. [2022] tackled this issue using the boundary- Soundary-repelling model inversion (BREP-MI) algorithm, which effectively utilizes the labels to simulate a gradient through max margin loss. This method effectively navigates toward the concentrated areas of the target class in the data distribution by estimating model predictions across conceptual sphere. Inspired by transfer learning (TL), Nguyen et al. [2024] proposed the label-only via knowledge transfer (LOKTT) method for label-only model inversion, transferring knowledge from the target model to target model-assister ACGAN (T-ACGAN), effectively turning the label-only scenario into a white-box setting.
A.2 Distribution Discrepancy Measure
This section introduces two measures used to evaluate the closeness between distributions P and Q: maximum mean discrepancy (MMD) and conditional transport (CT).
Maximum Mean Discrepancy (MMD). Given two random variables X ~ P,Y ~ Q2 the MMD measure is defined as follows:
MMD QFF) = sup FEF
-
(11)
where F is a class of functions [Gretton et al., 2012a]. This class is often restricted to a unit ball in a reproducing kernel Hilbert space (RKHS) to facilitate analytical solutions [Gretton et al., 2012a].
14

---

leading to the kernel-based MMD defined in the following,
(MD(P, H2)
sup /ENLII S1
-
(12)
where k is bounded kernel chosen based on the specific properties of the RKHS Ha- The use of RKHS allows for the effective computation of MMD,, leveraging kernel functions measure the distance between the distributions in a high-dimensional feature space.
Estimation of MMD. Given sample sets Sx = {x+}== P and Sy = {y Q, MMD
(Eq. (12)) can be estimated with the U-statistic estimator, which unbiased for MMD [Gretton et al., 2012a]
MSx Sy;k) n(n
1
1
k(z;, + m(m 1) i=1 j=1,f
k(y Uz)
{=1 j=1
7
m
k( Uz).
(13)
mn
where x,, Xj E Sx and Yi,Yj E Sy. This estimator efficiently computes the MMD by aggregating kernel evaluations over pairs of samples from both distributions.
Conditional Transport (CT), The CT measure provides a complementary approach to MMD by focusing on the transport cost between distributions. It consists of two components:
CT(P, Q) == Lx-.Y + -x
(14)
where -x and - represent the transport costs for the forward and backward CT, respectively, They are defined as follows:
LX-Y = By- xx)
(15a)
Cy = By-orr -B- xy) ()(c(,,))];
(15b)
44 QI and IT(X (Y) = -x1xx)) P(X) P(xxjx represent the condi-
where IT(Y XX
tional distributions of Y given X and X given Y, respectively. Here, dæ (X, Y) is function parameterized by &p that measures the distance between X and Y, and c(x, y) is cost function that measures the distance between the points x and
Estimation of CT. Given sample sets Sx {xi}a P and Sy (y Q, the CT measure can be approximated as follows:
CT(Sx, fx + f
Yiom 41 Q(Y) ExxP(x)
cxx, y, Ii (x)
P(X) E Eyneer)
c(x,, x)
do(s))))
4x(x))))
,(x),,3)
(16)
ンy= Σ e (xx
Σ e- (xx
The CT measure evaluates the cost of transporting samples from one distribution to another, providing detailed assessment of how closely the distributions align.
15

---

Algorithm Pseudo-Private Data Guided Model Inversion with Vanilla Tuning.
Input: Target model M, pre-trained generator G(:;)), pre-trained discriminator D Φ), public auxiliary dataset D public, number of fine-tuning rounds R, and the set of identities be reconstructed C.
1: oold +- 0:
reconstructed_sane sampleesss_peeseeeeeeee []:
3: for each target identity y in C' do
4: 0 Oodi
5: for round = ..... R do
.....
Step-1. Model inversion on target model M
7: Initialize latent codes: Z = {z, 2; E Z,i N.}
8:
Obtain optimized latent codes Z using Eq. (1);
9:
Step-2. Select high-quality pseudo-private samples
10:
Select pseudo-private samples with top-K stable prediction scores:
D private
(FPM & D 1;
11:
Step-3. Enhance density around D
private
Fine-tune G(; 0) and D(1; () enhance density around De private by directly fine-tuning
them with the original GAN training objective Pabbiic U D
private*
12:
end for
13:
eeconstructedssamplel
De private
14:
end for
Output: reconstructed_sample
Algorithm Pseudo-Private Data Guided Model Inversion with Point-wise Batch-wiss Tuning.
Input: Target model M, pre-trained generator G(:; 0), pre-trained discriminator D, number of fine- uning rounds R, identity set to be reconstructed C: point-wise tuning flag PW_Flag, distribution discrepancy measure 5.
1: Ootd f- 0:
2: reconstructed_ samples = [];
3: for each target identity y in C do
4: 0 +- Oold;
5: for round 1 ...., R do
6: # Step-1. Model inversion on target model M
Initialize latent codes: Z {z. z; E Z,i N}: N,).
Obtain optimized latent codes 2 using Eq. (1);
9:
Generate pseudo-private dataset: Dirivate {x= = G(2) 2 2):
10:
# Step-2. Select high-quality eseudo-privane samples
11:
Select pseudo-private samples with top-K stable prediction scores: private
Dr
Topk (E[P
X D:
12:
# Step-3. Enhance density around De
private
13:
PW_Flag then
14:
Point-wise tuning Locate high-density neighbors Z by optimizing Eq. (6);
15:
16:
Fine-tune G(::)) to enhance density around De
private by optimizing Eq, (7);
17:
else
18:
Batch-wise tuning if 5 is MMD then
19:
20:
Locate high-density neighbors Z by optimizing Eq. (9a):
21:
Fine-tune G(: ()) to enhance density around Dr Private by optimizing Eq. (9b);
22:
else if 5 is CT then
23:
Locate high-density neighbors ZP by optimizing Eq. (10a);
24:
Fine-tune G(: to enhance density around D Driivate by optimizing Eq. (10b);
25: end
26: end if
27: end for
28:
reconstructed_sant
+= D Dprivates
29:
end for
16
30: Output: reconstructed_eamplees

---

B The Algorithmic Realizations of PPDG-MI
This section presents the detailed algorithmic realization of the pseudo-private data guided model inversion (PPDG-MI) method. We describe two variants of the PPDG-MI method, each tailored for different MI scenarios. The first variant utilizes vanilla tuning (cf. Alg. 1), applicable for low- resolution MIAs where the adversary trains a GAN from scratch. The second variant employs nuanced point-wise or batch-wise tuning (ef. Alg. 2), suitable for high-resolution MIAs (i.e., PPA) where pre-trained generators are provided without access to the original training details. These methods are designed to enhance the density of pseudo-private samples under the prior distribution, thereby increasing the probability of sampling from the private data distribution.
C Experimental Details
Table 4: A summary of experimental setups,
Type
MIAs
Private Dataset
Public Dataset
Target Model
Evaluation Model
GMI/ /
CelcbA FFHQ
VGGI6/
KEDMI /
CelebA
face.evoLVe
Facc.evoL.e
LOM
White-hox
ResNet-18/
CelebA/ /
PPA
CelehA
DenseNet-121/
Inception-v3
FaceScrub
ResNeSt-50
Black-box RLB-MI
CelebA
CelebA
VGG16
face.evoLVe
Lahel-only BREP-MI
CelebA
CelehA
VGGI6
Ne
C.1 Hard- and Software Details
In our experiments with Plug & Play Attacks (PPA), conducted all of them Oracle Linux Server 8.9 using NVIDIA Ampere A A100-80G GPUs. The hardware operated under CUDA 11.7, Python 3.9.18, and PyTorch 1.1..1. For MIAs targeting low-resolution facial recognition tasks, we executed these experiments on Ubuntu 20.04.4 LTS, equipped with NVIDIA GeForce RTX 3090 GPUs. This setup utilized CUDA 11.6, Python 3.7.12, and PyTorch 1.13.1.
C.2 Evaluation Models
For experiments based on PPA, we train Inception-v3 evaluation models, following the code and guidelines available at the repository https: //t::///ttttbbbt com/LukksSttuppeek Blug-and-Play-Attaae
For training details, please refer to |Struppek et al., 2022]. These models achieve test accuracies of 96.53% on FaceScrub and 94.87% on CelebA. In addition, We use the pre- trained FaceNet [Schroff et al., 2015] from https: // //githu.. com/ coomtta timeslerr///e facenet- pptttt-ytccch to compute the K-nearest neighbors distance, providing measure of similarity between training samples and the reconstructed samples on the facial recognition tasks.
In experiments involving classifiers trained on the 64 x 64 resolution CelebA dataset, we utilize an evaluation model available for download at repository https://githut com/ sutd-vis visal-vsual-- computing- group/Re-thhinking model [Wang et al., 2021b), incorporating modified ResNet50 backbone, and achieves a stated test accuracy of 95.88%. For training details, please refer to Zhang et al. [2020].
This model is built upon the face.evol
C.3 Target Models
For training target models on 224 x 224 resolution CelebA and FaceScrub images, we adapt the training scripts and hyperparameters provided in the corresponding code repository and described in (Struppek et al., 2022]. The only training parameter we modify the smoothing factor of the label smoothing loss. All models are trained for 100 epochs using the Adam optimizer [Kingma and Ba, 2015], with an initial learning rate of 10-3 and B = (0.9, 0.999), and weight decay of 10-3 We reduce the learning rate by a factor of 0.1 after 75 and 90 epochs. The batch size is set to 128. All
17

---

data samples are normalized with μ === o = 0.5 and resized to 224 x 224. The training samples are then augmented by random cropping with a scale of [0.85, 1.0] and a fixed ratio of 1.0. Crops are resized back to 224 x 224, and samples are horizontally flipped in 50% of the cases.
For training target models 64 64 resolution CelebA images, we the training seript provided at https: //g thub. htt//suddviisse wrssull-computan computing group/Re- croou/Reethinking wwwttthiinnghhh _M. These models are trained for 50 epochs using the SGD optimizer with an initial learning rate of 10-2 a momentum term of 0.9, and a weight decay of 10- The batch size is set to 64. The learning rate decay schedule varies depending on the model; please refer the training script for details.
C.4 Attack Parameters
PPA consists of three stages: pre-attack latent code selection, MIA optimization, and final results selection. During pre-attack latent code selection, we choose 100 candidates for each target identity from search space of 500 latent codes for both CelebA and FaceScrub. In the MIA optimization phase, we maintain an equal number of queries to the target model M to ensure fair comparison for both the baseline attack and PPDG-MI. Thus, samples are optimized for 70 steps for both CelebA and FaceScrub in the baseline attack and 35 steps for each round of MIA in PPDG-MI. The final results selection stage is omitted. We target the first 100 identities and generate 100 samples per identity, Nonetheless, after some consideration. we believe that maintaining an equal number of queries to the target model M in each round of MIA for both PPDG-MI and the baseline attack may be more reasonable approach to evaluate the performance of the proposed method.
For low-resolution attacks, generate 1, 000 samples per identity for CelebA and 2, 000 samples per identity for FFHQ, as training GANs typically require more samples. Specifically, for low-resolution white-box attacks, we target the first 100 identities for CelebA and the first 50 identities for FFHQ. Samples in GMI and LOM (GMI) are optimized for 2, 400 steps on the VGGI6 target model and 200 steps on face.evoLVe while KEDMI and LOM (KEDMI) optimize samples for 200 steps on both target models. For PLG-MI, we target 50 identities of the CelebA dataset, generating 200 samples per identity. Samples are optimized for 80 iterations on VGG16 and face.evoLy, target models. For blxck-box and label-only attacks, we limit our selection to the first 10 identities due to the extremely time-consuming nature of point-wise optimization in these settings. In the black-box attack (i.e., RLB-MI), samples undergo 10, 000 optimization steps in the baseline attack and in each round of PPDG-MI. For the label-only attack (BREP-MI), the maximum number of optimization steps is set to 1, 0000 for both the baseline and each round of PPDG-MI.
Due to the significant time required for MIAs, perform a single attack against each target model. To reduce randomness, we generate at least 100 samples for each target class across various setups.
C.5 Evaluation Metrics
Attack Accuracy (Attack Acc). Following Zhang et al. [2020], we use an evaluation model (typically more powerful than the target model) trained on the target model's 's training data identify reconstructed images (cf. Tab. 4). Intuitively, it can be viewed as a proxy for a human evaluator. Attack accuracy is calculated the proportion of predictions matching the target identity; top-1 (Ace@1 1) and top-5 (Acc@5) attack accuracy is adopted.
K-Ncarest Neighbors Distance (KNN Dist). KNN Dist represents the 12 distance between recon- structed images and the nearest samples from the target model's training data the embedding space, the penultimate
indicating visual similarity between faces. For PPA [Struppek et al., 2022], layer of pre-trained FaceNet [Schroff et al., 2015], whereas for other res-uusolution MIAs, we adopt the penultimate layer of the evaluation model. Lower distances indicate closer resemblance between the reconstructed samples and the training data.
C.6 Experimental Details for Fig. 1
We present the experimental details for generating Fig. 1. In the motivation-driven experiments, we evaluate the distribution discrepancy between commonly adopted private training datasets and public auxiliary datasets, and investigate the impact of distribution discrepancy on attack performance of MIAs using various public auxiliary datasets and target models.
18

---

Vokee
MPD Vatue
HND Vaku
(a)
(b)
(c)
(d)
Figure 6: Impact of distribution discrepancies MIAs across various settings. The attack performance of MIAs is analyzed under four distinct combinations of public auxiliary datasets D public and target models M, with the same private training dataset DDi Drrivase CelebA: (a) D public- FFHQ and M = Vee (b) publicc FFHQ and M = IR 152, (c) 'D publiic = FaceScrub and M = evol. and (d) D public FaceScrub and M IR 15152. The attack performance consistently diminishes as the discrepancy between the D private (CelebA) and D Public increases.
In Fig. (a), employ kernel-based two-sample tests evaluate the distributional discrepancy between public auxiliary datasets (FFHQ and FaceScrub) and the private dataset (CelebA). A p-value of 0 signifies no statistical basis to reject the null hypothesis, indicating no discernible distribution difference between the datasets. Conversely, a p-value of 1 implies definitive evidence to reject the null hypothesis. We utilize Gaussian Kernel- -baee test to calculate p-values at the feature level, extracting a 512-dimensional feature vector from each image using the face.evoLVe feature extractor. We analyze subsets of N feature vectors, with N varying from 1, 000 to 10, 000. Each subset is sampled 20 times from both datasets, and the results represent the average of these samples.
In Figs. 1(b) and I(c), we investigate the impact of distribution discrepancy the attack performance of MIAS (LOM and KEDMI) using VGG16 as the target model and face.evol. Ve as the evaluation model. The private dataset CelebA, and the public auxiliary datasets are FFHQ and FaceScrub. We construct the proxy public auxiliary dataset by incrementally integrating the private data into the public auxiliary dataset, increasing the private data ratio by 20% at each interval, from 20% to 80%. To manage computational demands, we measure MMD across batches of 250 images each, using Gaussian kernels with a bandwidth of 1024. The final MMD value is the average result across all batches. Additional results involving IR152 and face.evoLVe target models are shown in Fig. 6.
C.7 Experimental Details for Toy Example From Sec. 3.3
The target model used in the toy example is a simple 3-layer multilayer perceptron (MLP). This MLP comprises two hidden layers, with the first containing 100 neurons and the second 200 neurons. Each hidden layer is followed by a rectified linear unit (ReLU) activation function to introduce non-linearity. The model is trained on dataset sampled from 3-class Vass-conditional Gaussian distribution, employing standard cross- ross-entropy for loss calculation. Training is performed for 6, 000 epochs using standard stochastic gradient descent (SGD) with an initial learning rate of 0.5, enhanced by a linear warm-up schedule to increase the learning rate gradually.
The public auxiliary dataset, distinet from the training dataset prevent distribution overlap, is generated from a separate Gaussian distribution. The distributional prior is learned using a GAN, where both the generator and discriminator are structured as MLPs with three hidden layers of 400 neurons each. All layers in both models are followed by ReLU activations. The GAN is trained under the Wasserstein GAN with gradient penalty (WGAN-GP) [Gulrajani al., 2017] framework to ensure a stable training process and reliable generation of new data samples.
We employ the learned prior to guide the attack targeting Class 1. Initially, we randomly generate 1, 0000 initial points and iteratively update them to maximize the model's prediction score for Class 1 through minimizing an identity loss (i.e., cross-entropy loss), following the approach proposed by Zhang et al. [2020]. We optimize this process using SGD with a learning rate of 0.1.
To ensure a fair comparison between the baseline and PPDG-MI, we ensure that both attacks make the same number of queries to the model. Specifically, we query the model 1, 000 times in the baseline attack. For PPDG-MI, we first conduct one round of model inversion, making 500 queries to the target model to generate 1, 000 pseudo-private data points. Subsequently, we enhance the density of the pscudo-privat data under the prior distribution by directly aligning the distribution between the
19

---

Baseline (1000 iterations)
PPDG-MI Round-1 (500 iterations)
Feature 2
Feature 2
0.2
0.0
0.0
Class
Class 0
-0.2
class
-32
Class 1
class
Class 2
-0.4
Public Data
-44
Public Data
Inverse Data
Inverse
-1.00
-0.75
-0.50
-0.25
3.00
0.25
0.50
9.75
-225
-950
-025
0.25
9.50
0.75
Feature
Feature
(a) Baseline
(b) (Round 1) Preudo-private Data Generation
Distribution Match (500 iterations)
PPDG-MI Round-2 (500 iterations)
0.8
0.8
0.4
0.4
Feature
02
0.2
0.0-
Class
Class
Class
Class
Public Data
Class
Inverse Data
Public Data
Tuned Prier
Inverse Data
-125
-1.0
-075
2.50
-0.25
0.00
0.25
0.50
0.75
-125
-1.00
-575
-0.30
-0.25
0.50
0.25
0.30
0.75
Feature
Feature
1
(c) Density Enhancement
(d) (Round 2) Model Inversion with Adjusted Prior
Figure 7: Illustration of the rationale behind PPDG-MI using a simple 2D example (larger version). Training samples from Class 0-2 are represented by purple circles, blue triangles, and green squares, respectively, while public auxiliary data are depicted as yellow diamonds. MIAs aim to recover training samples from Class 1. Reconstructed samples by MIAs are shown as red circles. (a) Attack results of the baseline attack with fixed prior. (b) Pseudo-private data generation. (c) Enhancing the density of pseudo-private data under prior distribution. (d) The final attack results of PPDG-MI with the tuned prior, where all the recovered points converge to the centroid of the class distribution, indicating the most representative features are revealed.
prior distribution and the empirical pseudo-private data distribution by minimizing the distribution discrepancy between them. Then, we apply the fine-tuned prior to guide the second round of model inversion, making 500 queries to the model.
The baseline attack results are shown in Fig. 7(a) and the final attack results of PPDG-MI are shown in Fig. 7(d). It is evident that, in comparison to the baseline where only small fraction of the reconstructed samples fall within the high-density regions of the training data distribution, all reconstructed samples from PPDG-MI are located in these high-density regions. Quantitatively, the attack performance is evaluated by measuring two metrics: the average distance between the reconstructed samples and the mean of the target class distribution, and the proportion of reconstructed samples that lie in three standard deviations (3o) the mean. In comparison, the baseline achieves an average distance of 0.34 and attack accuracy of 22.60%, and PPDG-MI achieves an average distance of 0.04 and attack aceuracy of 100.00%.
C.8 Investigate Distribution Alignment on High-dimensional Image Data
In this experiment, we aim to extend the den- sity enhancement strategy from the toy exper- iment to -igh-dimensional image data. We use the pre-trained StyleGAN on FFHQ as the distributional prior, with ResNet- 18 trained on the CelebA dataset as the target model. We generate the peeudo-private dataset D
Table 5: Enhance density of -orivatt data un-
der the prior distribution by distribution alignment.
Method
Acc@11
KNN Disij
PPA
84.30
0.7136
PPDG with distribation alignment
17.62
L.1718
priivate by
20

---

Table 6: Comparison of MI performance with representative white-box MIAs in the low-resolution setting. The target model M is lace.evoLVe trained on Privvate = CelebA. GANs are trained on D pubbicc CelebA or FFHQ. The symbol (or f) indicates smaller (or larger) values are preferred, and the green numbers represent the attack performance improvement. The running time ratio (Ratio) between prior fine-tuning and MI reflects the relative overhead of fine-tuning.
CelebA
FFH
Method
Acc@11
Acc@5t
KNN Dist,
Ratiol
Acc@11
Acc@5t
KNN Dist,
Ratio
GMI
26.86
50.96
1646.93
11.77
28.96
1748.30
/
PPDG-vanilla (ours)
28.29 (+1.43)
51.83 (+0.87)
1635.62 (-1131)
12.37 (+0.60)
30.04 (+1.08)
1739.78 (-8.52)
0.80
LOM (GMI)
67.96
87:26
1412.14
66
65,78
1539.27
/
PPDG-vanill (ours)
72.35 (+4.39)
89.15 (+1.89)
1378.67 (-33.47)
1.02
48.32 (+9.66)
73.31 (47.53)
1489.34 (-49.93)
1.03
KEDMI
87.16
1230.81
55.99
82.23
1406.98
PPDG-vanilla (ours)
87.82 (+0.66)
98.19 (+0.05)
1225.32 (:5.49)
17.65
57.54 (+1.55)
83.57 (+1.34)
1397.32 (-9.66)
66.44
LOM (KEDMI)
91.82
99.33
1275,39
71.81
94.00
1379.06
PPDG-vanilla (ours)
92.11 (+0.29)
98.52 (-0.81)
1249.85 (:25.54)
15.39
60.54 (-11.77)
80.04 (-13,96)
1441.34 (+62.28)
64.50
Table 7: Comparison of MI performance with PLG-MI in the low-resolution setting. Target model M VGG16 or face.evoLVe trained on D Privase = CelebA. GANs are trained on D Pubbic = FaceScrub.
VGG16
face.evoLVe
Method
Acc 11
Atc
KNN Distj
Ratio
Acc 11
Atc
KNN Disij
Ratiol
PL.GMMI
33.59
56.54
1496.94
1
53.83
83.35
1430.78
/
PPDG-vanilla (ours)
34.70 (+1.11)
59.32 (+2.78)
1487.07 (-987)
3.26
56.08 (+2.25)
84. (+0.80)
1405 68 (-25. 10)
2.74
conducting MIA on target identities 1-100, recovering 100 samples per identity, resulting in a total of 10,000 samples in Dr privare- We then increase the density around DE Périvate under the prior distribution P(Kprior) by fine-tuning G(: 0) align with the empirical distribution of De Privaaee using the CT measure. The results are shown in Tab. 5, where we observe a dramatic decrease in MI performance after fine-tuning the generator. This indicates that direct distribution alignment is less effective for higher-dimensional image data, it disrupts the generator's 's manifold. Therefore, need to employ a nuanced tuning strategy with smaller perturbations to the image manifold.
D Additional Experimental Results
D.1 Additional Main Results
Comparison with white-box MIAS in the low-resolution setting. In this experiment, we utilize the facc.evoLVe as the target model. The results are presented in Tab. 6, where PPDG-vanilla consistently outperforms various baseline white-box attacks, offering notable improvements in both attack accuracy and KNN distance metrics across two public auxiliary datasets, CelebA and FFHQ. For instance, in the LOM (GMI) setup. adding ODDG-vanilla results in an increase in top-1 attack accuracy from 68. 09% to 71.39% for CelebA, and top-5 attack accuracy from 87.31 % to 88.12%. Additionally, there is a reduction in KNN distance from 1417.23 to 1385.10 for CelebA. Similarly, significant improvements are observed for FFHQ, where attack accuracy increases and KNN distances decrease, indicating enhanced data density around pseudo-private samples. However, there is failure case involving the setup where the target model is face.evol Ve trained on CelebA, with the public dataset as FFHQ. We attribute this failure to multiple factors, which are analyzed in Appx. E. Generally, these results suggest that even with substantial distribution shifts between the private dataset CelebA and the public dataset FFHQ, our principled vanilla fine-tuning strategy, which retains the original GAN training objectives, can effectively improve MIA performance.
Comparison with PLG-MI in the low-resolution setting, In this setting, we use the state-of-the-an white-box attack PLG-MI [Yuan et al., 2023] as the baseline for comparison. PLG-MI leverages the target model to generate pseudo-labels for public auxiliary datasets, enabling the training of cGAN (conditional GAN) on this labeled data. This further decouples the search space across different classes. However, the poor visual quality of samples generated by PI.--M results in failure cases (refer to Appx. E), limiting the effectiveness of PPDG-ML. Therefore, we manually select 50 identities
21

---

Table 8: Comparison of MI performance with RLB-MI and BREP-MI in the low-resolution setting. The target model M is VGG-16 trained on private = CelebA, GANs are trained on D Paublic CelebA. The symbol & (or 1) indicates smaller (or larger) values are preferred, and the green numbers represent the attack performance improvement. The running time ratio (Ratio) between prior fine-tuning and MI reflects the relative overhead of fine-tuning.
Method
Acc@ 11
Acc@5t
KNN Dist,
Ratio
RLB-MI (black-box)
38.50
65.10
1431.93
/
PPDG-vanilla (ours)
61.60 (+23.10)
85.30 (+20.20)
1337.09 (-94.84)
0.02
BREP-MI (label-only)
66.40
92.20
1171.16
/
PPDG-vanilla (ours)
71.10 (+4.70)
93.10 (+0.90)
1165.17 (-5.99)
0.03
Table 9: Comparison of MI performance against state-of-the-art defense methods in the low-resolution setting. The target model M is VGGI6 trained on D Pprivate CelebA, GANs are trained on puubicc
CelebA. Bold numbers indicate superior results.
LOM (GMI)
KEDMI
LOM (KEDMI)
Method
Acc@1 1
KNN Dist.
Acc@1 11
KNN Dist.
Acc@1
KNN Dist.
No Def.
63.19
1416.80
75.54
1297.79
84.10
1255.15
BiDO-HSIC
47.71
1521.50
37.69
1547.35
68.63
1417.85
PPDG-vanilla
58.74
1455.31
44.09
1512.79
69.68
1392.19
NegLS 25.40
1529.62
27.15
1576.57
64.73
1320.38
PPDG-vanilla
45.44
1415.76
30.82
1532.74
68.94
1308.09
with high-quality samples from 100 identities and present the quantitative results in Tab. 7. Integrating PPDG-vanilla significantly improves MI performance. This improvement can be attributed to the robust selection strategy. which identifies high-quality samples from all -private data, along with fine-tuning using the original GAN training objectives to enhance density around high-quality pseudo-private samples. These results indicate that even with different GAN prior (i.e., cGAN), PPDG-MI shows effectiveness with strong compatibility and outperforms SOTA white-box attack.
Comparison with Black-box MIAs in the low-resolution setting. In this setting, we use the SOTA RLB-MI [Han et al., 2023] as the baseline for comparison, the results are shown in the upper part of Tab. 8. Han et al. [2023] formulate the latent space search problem as a Markov decision process and solve it using reinforcement learning, which requires tens of thousands of iterations for optimization, leading to inefficiency and a low probability of sampling representative samples. Integrating PPDG- vanilla significantly improves MI performance. This improvement can be attributed to the fine-tuning of the GAN, which effectively enhances the density around the aseudo-privan samples, thereby increasing the probability of sampling representative samples. Our experiments demonstrate that PPDG-vanilE boosts the top-1 attack accuracy from 38.50% to 61.60% and the top-5 attack accuracy from 65. 85.3 85.30% in the black-box setting, with a substantial reduction in KNN distance from 1431.93 to 1337.09. Additionally, the running time ratio indicates minimal overhead of just 0.02. These results highlight the effectiveness of our method in improving MI performance in the black-box setting with minimal additional computational cost.
Comparison with Label-only MIAS in the low-resolution setting. In this setting, we use the ofte-offthheart BREP-MI [Kahla et al., 2022] as the baseline for comparison. The quantitative results are presented in the upper part of Tab. 8. Kahla et al. [2022] introduces boundary-repelllng algorithm to search for representative samples. This algorithm estimates the direction towards the target class's 's centroid using the predicted labels of the target model over a sphere. Typically, under a radius threshold where the gradient estimator still works reliably, larger sphere radius indicates a higher-likelihood region around the sphere's centroid. A qualitative illustration of the progression of the reconstructed images towards the actual training images is depicted in Fig. 8. The upper part of Fig. 8 shows the results of BREP-MI, while the lower part shows the results after integrating BREP. MI with PPDG-vanilla. It is evident that with PPDG-vanilla BREP-MI can find more representative
22

---

BREP-MI
Radius
Private
Initial
data
-2.6
-4.4
-9.6
-12.5
PPDG-valinn
Radius
Private data
Initial
-1.3
-1.6
-2.1
-2.6
-3.4
-4.3
-5.5
Figure 8: A comparison of the progression of BREP-MI and BREP-MI integrated with PPDG-vanilla from the initial random point to the algorithm's termination, indicating that the latter achieves faster convergence in the search process.
samples at smaller radius. This demonstrates that our method effectively increases the density of these regions, leading faster convergence of the search process.
Attacks against SOTA model inversion defense methods. In the low-resolution setting, we evaluate SOTA white-box attacks LOM (GMI), KEDMI, and LOM (KEDMI) against SOTA model inversion defense methods, such as BiDO-HSIC [Peng et al., 2022] and NegLS [Struppek et al., 2024]. The results, summarized in Tab. 9 demonstrate that our PPDG-MI consistently outperforms baseline against BiDO-HSIC and NegLS. For instance, when using NegLS as the defense, significantly enhances both the top-1 attack accuracy and the KNN distance metrics. For the LOM (GMI) attack, PPDG-vanilla improves the Acc@1 from 25.40% to 45.44%, and for KEDMI, it increases from 27.15% 15% 30.82%. Additionally, PPDG-vanilla shows improvements compared with LOM (KEDMI) by enhancing Acc@ from 64.73% to 68.94%. and decreasing KNN Distance from 1320.38 1308.09. The enhanced MI performance on the target model trained with SOTA defense methods further underscores the effectiveness of PPDG-MI.
23

---

Table 10: Ablation study on the number K of high-quality samples selected for fine-tuning. "Time" (seconds per identity) denotes the time required for fine-tuning a single identity.
Table 11: Ablation study on tinettuning different layers of the StyleGAN synthesis network. "Time" (seconds per identity) denotes the time required for fine-tuning a single identity.
Method
K
Acc@1 It
KNN Dist.
Timel
80,50
0.74
149
PPDG-PW
3
85.40
0.72
Method
Layers
Acc@1 11
KNN Dist.
Time.
10
86.50
0.72
0.71
470
42
162
67.00
0.82
237
PPDG-PW
4
1282
84.65
0.73
242
88.
0.70
1024
85.40
0.72
10
89 90
0.70
119
PPDG-MMD
15
88.75
0.69
174
42 162
73.35
0.77
111
25
20
87.60
0.69
0.69
240
PPDG-MMD
42 1282
88.05
0.71
116
30
87,30
0.703
344
42 1024
89,90
0.70
119
86.95
0.69
42 162
64.90
0.83
165
10
88, 15
0.69
167
PPDG-CT
42 1282
84,20
0.71
PPDG-CT
20
15
88.75
87.45
0.68
0.68
305
238
4 1024
88.15
0.69
167
25
0.68
30
86.35
0.68
451
D.2
Additional Ablation Study
D.2.1 MIAS in the High-resolution setting
Number K of high-quality pseudo-privan samples. The choice of the number K of high-quality pseudo-private samples affects the tuning intensity of the generator G, the informativeness of the empirical local distribution, and the computational cost. In Tab. 10, we illustrate the MI performance for different choices of K. As K increases, MI performance initially improves, reaching an optimal point before it starts to decline. This trend can be attributed to two main factors. First, A higher number of samples provides more detailed information about the local data distribution, allowing the generator G to better capture the underlying characteristics of the data. This leads to initial improvement in MI performance. Second, As K becomes larger, the generator requires more extensive tuning accommodate the additional samples. This can result in significant changes to the manifold, potentially disrupting the learned data structure and decreasing MI performance. Additionally, larger K values substantially increase computational cost. Thus, considering all these factors, we highlight the K values chosen for various fine-tuning methods in Tab. 10.
Fine-tune different layers. Given that the synthesis network in the StyleGAN generator consists of 18 layers-twa for each resolution 42 1024 -with earlier layers controlling higher-level features (e.g., general hairstyle, face shape), and later layers controlling more fine-grained features (e.g. finer hairstyle details), we investigate the effect tuning subsets these layers. In Tab. 11, we present the results of incrementally adding layers for fine-tuning, Our study reveals that tuning layers with spatial resolutions from 42 128² achieves comparable results to tuning all layers, i.e., spatial resolutions from 42 - 1022 This finding suggests that successful MIAs rely more on inferences about high- features (e.g., face shape) rather than mne-grained details, aligning with the main goals of MIAs.
D.2.2 MIAS in the Low-resolution Setting
In this section, we present all ablation studies on MIA in the low-resolution setting to further explore PPDG-MI. The target model, VGG16, and the evaluation model, face.evoLVe, are both trained on CelebA private dataset. GANs are also trained from scratch on CelebA public dataset. Unless otherwise specified, we use KEDMI as the attack method and perform fine-tuning. The size of the pseudo-pen private dataset 1, 000, and we fine-tune the GAN for 10 epochs.
Table 12: Ablation study on the number of rounds of fine-tuning.
Rounds
Acc@11
Acc@5t
KNN Dist.
Baseline
58.86
85.32
1341.36
67.55
1294.40
2
77.23
93.82
1237.87
round of GAN
3
80.59
94.29
1231,55
4
78.07
93.32
1259.94
Iterative fine-tuning. Fine-tuning the GAN with generated pseudo-private data increases the probability of sampling data with characteristics closer to the actual private training data. We examine
24

---

the impact of iterative fine-tuning on MI performance through experiments with different fine-tuning rounds. We use LOM (GMI) as the attack method and present the results in Tab. 12. The results show that MI performance improves with more fine-tuning rounds, suggesting that gpeudo-privatt data increasingly approximates private training data. However, after the third round, further fine-tuning does not further improve MI performance as observed in earlier rounds. This decline could be due to excessive fine-tuning, which may distort the image manifold and degrade MI performance.
Impact of the size of the pseudo-private dataset in GAN fine-tuning. In iterative GAN fine-tuning, the -eeudo-rrivate data generated in each round can potentially increase the probability pling data with characteristics similar to the real private data in subsequent rounds. This process ap-
Table 13: Ablation study the number of pseudo-private data used in GAN fine-tuning, where iDirivate represents the size of the pseudo- private dataset.
sam-
highlights the importance of determining propriate size for the pseudo-private dataset to achieve improved MI performance with an accept- able level of fine-tuning overhead. We investigate how MI performance is affected by varying the size of the pseudo-private dataset, with the results presented in Tab. 13. The results indicate trend where the MI performance initially improves and then degrades. This suggests that increasing the size of the pseudo-private dataset up certain point (e.g., 3, 000) can enhance MI performance. The observed decline in performance could be attributed to the large amount of pseudo-data adopted, which increases the intensity level of fine-tuning and thus disrupts the image manifold.
1P prissse
1
Acc@5t
KNN Dist
1000
81.99
97.36
1224.18
2000
84.43
98.73
1231.73
3000
88.64
99.05
1222.43
4000
79.65
97.57
1249.33
5000
78.26
98.50
1286.53
Impact of the number of epochs in GAN fine- tuning. During iterative GAN fine-tuning, effec- tively utilizing pseudo-private data while reducing computational overhead is essential. Therefore, the number of tuning epochs is a crucial hyper- parameter. This experiment examines the impact of fine-tuning epochs MI performance. Tab. 14 shows that MI performance consistently improves as the number of GAN fine-tuning epochs in- creases, indicating that the GAN effectively learns and utilizes pseudo-private data. However, while MI performance improves, the computational over- head (i.e., fine-tumin mee-tunng time for each identity) in- creases linearly with the number of epochs.
Ablation study on the number of epochs in GAN fine-tuning, "Time" (seconds per identity) denotes the time required for fine- tuning a single identity.
Table 14:
Epoch
Acc@ 11 Acc@5t
KNN Dist.
Time
5
75.85
95.97
1251.84
553
10
77.79
96.19
1245.14
1130
15
80.29
97.24
1243.65
1690
20
81.15
97.35
1235.93
2260
25
83,59
98.38
1220.47
2832
Comparison of identity-wise fine-tuning multi-identity fine-tuning. Compared to fine- tuning the GAN using single identity, which is specific to one identity and increases overhead, fine-tuning with multiple identities whole can significantly reduce computational costs. Thus, we aim to investigate the MI performance of fine- tuning the GAN based on both single-identity and multi-identity approaches, respectively. The re-
Table 15: Ablation study on identity- wise fine- tuning vs. multi-identity fine-tuning.
Fine-tuning method Acc@ 11
Acc@5t
KNN Dist.
Single-identity Multi-identity
85.37
98.50
1207.55 33
81.40
94,45
1225.42
sults, presented in Tab. 15, indicate that the MI performance of multi-identity fine-tuning decreases by 4% compared to single-identity fine-tuning. Despite the reduction in computational overhead, fine-tuning the GAN using multiple identities results in poorer MI performance. This is because fine-tuning with multiple identities induces more intensive changes to the generator.
D.3 Visualization of Reconstructed Images
In this section, we provide qualitative evidence to demonstrate the effectiveness of our proposed PPDG-MI. Results for high-resolution settings are illustrated in Figs. 9 and 10. Specifically, Fig. presents a visual comparison of reconstructed samples for the first ten identities from three target
25

---

models ResNet-18,, 18, DenseNet-121, 121, and CesNNeSt-5O-traiie on the CelebA, using GANs pre- trained on FFHQ. Fig. 10 shows similar comparison for the same target models trained on the FaceScrub, also using GANs pre-trained on FFHQ. For low-resolution settings, the results are shown in Figs. 11 and 12. Fig. 11 illustrates reconstructed samples for the first ten identities from VGGI6 trained on the CelebA private dataset, using GANs trained from scratch on the CelebA public dataset. Fig. 12 depicts reconstructed samples for the first ten identities from VGGI6 trained on the CelebA private dataset, using GANs trained from scratch on the FFHQ public dataset.
E
Discussion
Scope and Applicability of Model Inversion Attacks. Model inversion attacks (MIAs) have become critical area of research in assessing privacy risks, especially for discriminative models that handle sensitive data. While MIAs can be effective in certain data types, tasks, and specific contexts, they also face significant limitations, particularly in cases where the data lacks clear identity markers.
A notable limitation arises in their applicability to biomedical imaging, where MIAs face distinct challenges. For instance, unlike identity-rich data like facial images, chest X-rays generally lack identifiable features that can be easily linked to individuals. This absence of clear personal markers complicates privacy risk evaluation, making it harder to assess the impact of MIAs.
Morcover, even in experimental settings using datasets like ChestXray8 [Wang et al., 2017], where the primary goal is classification tasks such as diagnosing medical conditions, challenges persist. One key concern is whether a reconstructed chest X-ray would represent a generic "average" image or contain identifiable features unique specific training samples. This issue arises from the inherent complexity of chest X-rays, which often require specialized medical expertise for accurate interpretation.
In summary, MIAs are more effective in domains where data includes explicit identity markers, leading to higher privacy risks as reconstructed images can closely resemble individuals from the training data. However, in fields like biomedical imaging, where data lacks evident identity characteristics, privacy risks are harder to quantify but remain an important area of concern.
Broader Impacts. In this paper, we propose a novel model inversion pipeline to enhance the performance of generative model inversion attacks (MIAs), potentially providing new insights and paving the way for future research. From a social perspective, our research on MIAs reveals significant privacy vulnerabilities in machine learning models that, if misused, could compromise sensitive training data. By revealing these risks, we aim to raise awareness and drive the development of robust defense mechanisms and privacy-preserving algorithms that are crucial for enhancing the security of machine learning systems. Overall, although our findings could be misused, the benefits of raising awareness and improving security practices machine learning systems far outweigh these concerns.
Failure Case Analysis. To better assess the feasibility of our proposed method, we closely examined the reconstructed samples. In high-resolution scenarios, we observed that with a single fine-tuning round, PPDG-MI exhibited minimal failures. However, with continued fine-tuning, the visual quality of certain identities significantly deteriorated, indicating substantial alterations in the generator's 's manifold. Notably, these reconstructed samples still performed well on standard metrics despite poor visual quality, suggesting potential overfitting to these metrics. This finding underscores limitation in current metrics, such as attack accuracy, which may lack robustness in such cases. Developing more effective and resilient evaluation metrics is an important direction for future research.
In low-resolution scenarios, we observed a decline in visual quality and performance on standard metrics for certain identities after single round of attack, particularly in the case of LOM (KEDMI) and PLG-MI. We hypothesized that this failure stems from the baseline attack that generates samples with poor visual quality and insufficiently representative features of the target identities. These low- quality samples negatively impact the quality of the samples produced by the fine-tuned generator. With each subsequent fine-tuning round, these negative effects accumulated, progressively degrading the generator's 's manifold and leading to poorer visualization and MI performance. These findings indicate that the generator's 's capabilities may be insufficient to produce high-quality samples that positively influence subsequent rounds of GAN fine-tuning, thereby impacting the effectiveness of PPDG-MI. Therefore, utilizing more advanced generators represents potential direction for better demonstrating the advancements of PPDG-MI.
26

---

Limitations of PPDG-MI. Conducting model inversion attacks is time-consuming, and the iterative fine-tuning in our proposed PPDG-MI adds further overhead, as shown by the running time ratios between the fine-tuning phase and model inversion phase in our experiments. However, our proposed prior distribution tuning methodology provides promising solution to mitigate the fundamental distribution discrepancies between private and prior distributions. We hope our work will inspire future research to develop more efficient and effective tuning methods.
27

---

Real
PPA
ResNet-18
PPDG-PW
PPDG-CT
PPDG-MMD
PPA
DenseNet-121
PPDG-PW
PPDG-CT
PPDG-MMD
PPA
ResNeSt-50
PPDG-PW
PPDG-CT
PPDG-MMD
Figure 9: Visual comparison in high-resolution settings. We illustrate reconstructed samples for the first ten identities in D Prrivate CelebA using GANs pre-trained on Dpublic FFHQ.
28

---

Real
PPA
ResNet-18
PPDG-PW
PPDG-CT
PPDG-MMD
PPA
DenseNet-121
PPDG-PW
PPDG-CT
PPDG-MMD
PPA
ResNeSt-50
PPDG-PW
PPDG-CT
25
PPDG-MMD
Figure 10: Visual comparison in high-resolution settings. We illustrate reconstructed samples for the first ten identities in Prrivate FaceScrub using GANs pre-trained on Dpublic = FFHQ.
29

---

Real
GMI
PPDG-vanilla
LOM (GMI)
PPDG-vanilla
KEDMI
PPDG-vanila
LOM (KEDMI)
PPDG-vanilla
RLB-MI
PPDG-vanilla
BREP-MI
PPDG-vanilla
Figure 11: Visual comparison in low-resolutions settings. We illustrate reconstructed samples for the first ten identities in D private CelebA using GANs trained from scratch on Puublic CclebA.
30

---

Real
GMI
PPDG-vanilla
LOM (GMI)
PPDG-vanilla
KEDMI
PPDG-vanilla
LOM (KEDMI)
PPDG-vanilla
Figure 12: Visual comparison in low-resolutions settings. We illustrate reconstructed samples for the first ten identities in D private CelebA using GANs trained from scratch on Ppublic FFHQ.
31

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the
paper's contributions and scope?
Answer: [Yes]
Justification: We reveal limitations of previous work in Section 3.1 through experimental verifications. We propose novel algorithm with several concrete implementations in Section 3. The effectiveness our approach is validated by extensive experiments presented in Section 4 and further supported by additional results in Appendix D.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We primarily discuss the limitations of the proposed method in Section E.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
32

---

Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: The experimental setups are briefly introduced at the beginning of Section 4, and detailed in Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
33

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Our well-organized source code, complete with detailed README, is available at: https://githii coom/tmr-gget saaiiiggruuuuppPPpp
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm
ceessonPoloiyy icy for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / //npss wwtppclcccc////ccccccccccccc..lt wttpc//gg//eeeeeeeceeeeee
wwwsssssssiiiiyooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We present the detailed experimental setups in Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Due to the sigmificant time required for MIAs, we conduct a single attack against each target model. To reduce randomness, we generate at least 100 samples for each target class across various setups.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
34

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide information about the hardware and software configurations in Appendix C.I.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: //tturi/ http//pll//thhissuiiiiiii
Answer: [Yes]
Justification: We only utilize publicly available datasets develop machine learning algo- rithms aimed at promoting community development.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., s if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We primarily discuss the broader impacts of this work in Section E.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
35

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
We have cited the original papers that produced the code packages or datasets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URI.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
36

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our well-organized source code, complete with detailed README, is available at: https://gi htt:://gitttb.... http://tllrgrroo/PPP11
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
37

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
38


Reviews:
[{"review_id": "s48kHsnNhK", "reviewer": "Reviewer_4Zsf", "summary": "The paper proposes a novel plug-and-play method for current state-of-the-art MI methods to enhance their performance and mitigate the challenge of distribution discrepancy. This method first conducts a round of MI attack to acquire pseudo-private data and then utilizes the data to fine-tune the generative prior following certain strategy. The experimental results show that the proposed method enhances the attacking capability of existing MI methods to some extent.", "questions": "1. In Section C.4, why is the final results selection stage removed? This technique is critical to PPA [2]. Omitting this stage might leads to the degraded performance of PPA in the Experiment Section.\n2. In Section C.4, why the parameters of pre-attack latent code selection stage are significantly lower than the original paper (200 candidates from a search space of 2000/5000 latent codes). This also contributes to the bad performance of PPA [2] in the Experiment Section.", "limitations": "The authors have adequately addressed the limitations and potential negative societal impact of their work.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Clarity: The paper is well-structured and easy to follow.\n2. Originality: The proposed method seems novel and interesting.\n3. Intuitive pipeline: The method is easy to understand and implement.", "weaknesses": "1. The current state-of-the-art white-box MI method PLGMI [1] should be evaluated.\n2. There is no experiment for evaluation on any model inversion defenses. Related experiments are expected to demonstrate how the proposed technique impacts the resistance ability of MI attacks against defense strategies.\n3. The middle panel in Fig 5 seems wrong. The attack accuracy of random samples is higher than the one of high-quality samples.\n4. In Section 4.3, the citation for Fig 5 appears to be Fig 4.3.\n\n[1]Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo label-guided model inversion attack via conditional generative adversarial network. In AAAI, 2023.\n[2]Lukas Struppek, Dominik Hintersdorf, Antonio De Almeida Correia, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In ICML, 382 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and careful review of our work. Please see our detailed responses to your comments and suggestions below.\n\n> W1, W2: Missing evaluations on PLG-MI and state-of-the-art model inversion defenses.\n\nRegarding these additional evaluations, please refer to the general response. These results will be included in the main results section (i.e., Section 4.2) of the final version of our paper.\n\n> W3. The middle panel in Fig 5 seems wrong. The attack accuracy of random samples is higher than the one of high-quality samples.  \n> W4. In Section 4.3, the citation for Fig 5 appears to be Fig 4.3.\n\nThank you for your careful review of our paper and for pointing out these issues. We have made the necessary corrections. The middle panel in Fig. 5 has been revised to represent the data accurately, and the citation error in Section 4.3 has been corrected to refer to Fig. 5 as intended.\n\n> Q1, Q2: The removal of the final results selection stage and the change of parameters in the pre-attack latent code selection stage.\n\nOur proposed approach, PPDG-MI, requires identity-wise fine-tuning of the generator $\\mathrm{G}$ during the model inversion process. Consequently, all three stages in the attack pipeline—latent code sampling, optimization, and final result selection—should be designed to function in an identity-wise manner. \n\nTaking the experiment, where $\\mathcal{D}_{\\text{public}}$ = FFHQ and $\\mathrm{M}$ = ResNet-18, as an example, the original PPA setting involved selecting 200 candidates from 5000 latent codes, running 70 optimization iterations per latent code, and then choosing the 50 recovered samples with the highest average prediction scores as the final results. The time cost we measured for the latent code sampling stage was approximately 52s/identity, the optimization stage took around 565s/identity, and the final result selection stage took about 5s/identity (these measurements were conducted on a single A100 GPU). Therefore, the time overhead is substantial, particularly since our method necessitates at least two rounds of attacks.\n\nGiven that latent code sampling in PPA is performed only once, whereas our approach requires identity-wise sampling, we modified the experimental setting by selecting 100 candidates from 500 latent codes to save on experiment time. This also significantly reduced the time required for the optimization stage. In addition, to maximize the amount of test data in our evaluation, we removed the final result selection stage, retaining all 100 optimized latent codes. It is important to note that these setting changes were applied equally to both the baseline PPA and our PPDG-MI, ensuring a fair comparison. Therefore, these adjustments do not affect the validity of our method's effectiveness. \n\nWe'd appreciate it if you could consider the above responses when making the final evaluation of our work. Please let us know if you have any outstanding questions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YRXpJ7XAoQ", "reviewer": "Reviewer_CEeM", "summary": "It is well known that deep learning models are susceptible to model-inversion attacks, which is to say that they can be probed to reveal their training data. The authors design a more powerful method of attack by increasing the density of their prior using “pseudo-private data”, they can increase the probability of sampling actual private data.", "questions": "- What are the real-world settings that this threat model could be observed with this work?\n- How might this approach extend to diffusion-based models?", "limitations": "The paper makes the limitations and ethics issues with their work clear.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The contribution of this work is clear and intuitive. The authors provide empirical evidence for their claims and they propose different algorithms which leverage generated samples. They benchmark their method against existing methods and show how they can build on prior work in this area. The illustration and build up to their core result is well structured and makes the paper easy to follow.", "weaknesses": "- There are a number of typographic errors (e.g. “vallina”)\n- A brief related work section which situates their contribution in the main body would have been appreciated\n- There is verbatim repetition in the problem setup.\n- They claim that “all state-of-the-art generative MIAs” are limited due to the utilization of a fixed prior during inversion. This bold claim is not backed up.\n- Some of the symbols are not properly defined  (e.g. \\lambda is undefined)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments and generous supports! Please see our detailed responses to your comments and suggestions below, where we use references in our manuscript due to the token limit.\n\n> W1. There are a number of typographic errors (e.g. “vallina”)\n\nThank you for your detailed review of our paper and for identifying the typographic errors. We have made the necessary corrections, including changing \"vallina\" to \"vanilla.\" Your attention to detail is greatly appreciated, and we have carefully reviewed the manuscript to address all identified issues.\n\n> W2. A brief related work section which situates their contribution in the main body would have been appreciated.\n\nThanks for this suggestion! We have revised the paper to include a brief introduction of related work. Due to space constraints, we integrated this section into the problem setup (i.e., Section 2.1), while the detailed related work is provided in Appendix A.1. The specific content added is as follows:\n\n\"Current generative MIAs primarily concentrate on either the initial training process of GANs [Chen et al., 2021, Yuan et al., 2023, Nguyen et al., 2024] or the optimization techniques used in the attacks [Zhang et al., 2020, Wang et al., 2021a, Struppek et al., 2022, Kahla et al., 2022, Nguyen et al., 2023]. In this paper, we take another direction and introduce a novel approach by fine-tuning the GAN’s generator based on the attack results from previous runs. This approach introduces a dynamic and iterative dimension to model inversion attacks, expanding the current understanding and application of generative MIAs.\"\n\n> W3. There is verbatim repetition in the problem setup.\n\nThank you for highlighting the verbatim repetition in the problem setup, particularly in the phrases \"the goal is to find a sample $\\mathbf{x}$ that maximizes the model $\\mathrm{M}$'s prediction score for class $y$\" and \"aimed to optimize for an optimal synthetic sample $\\mathbf{x}^*=\\mathrm{G}(\\mathbf{z}^*)$ to maximize the target model's prediction probability in the target class $y$\" in the original main text. We have made the necessary revisions to eliminate the repetition.\n\n> W4. They claim that \"all state-of-the-art generative MIAs\" are limited due to the utilization of a fixed prior during inversion. This bold claim is not backed up.\n\nThank you for pointing out the need for further clarification regarding our claim that \"all state-of-the-art generative MIAs\" are limited due to the utilization of a fixed prior during inversion. We recognize that this statement may seem bold without sufficient supporting evidence.\n\n**However, our intention is not to overgeneralize but to emphasize a prevalent trend observed in multiple state-of-the-art generative MIAs**, which we have validated through rationale-driven analysis and main experiments. To address this concern, we have revised the manuscript by changing \"all state-of-the-art generative MIAs\" to \"state-of-the-art generative MIAs\" and have cited specific examples validated in our experiments to demonstrate the common use of fixed priors and their associated limitations.\n\nWe appreciate your feedback and will ensure that our claims are accurately represented and well-supported in the revised manuscript.\n\n> W5. Some of the symbols are not properly defined (e.g. \\lambda is undefined)\n\nWe have carefully reviewed the entire manuscript and added definitions for all previously undefined symbols, including $\\lambda$ and $\\alpha$. Thank you for bringing this to our attention.\n\n> Q1. What are the real-world settings that this threat model could be observed with this work?\n\nIn real-world scenarios, the threat model described in our work can manifest in various situations where sensitive data is vulnerable to exposure through model inversion attacks. A prominent example is in **security and surveillance**. Models deployed in these contexts, such as facial recognition systems, are particularly susceptible to model inversion attacks that could reveal personal identities [r1, r2]. Another critical example is in **healthcare systems**, \nwhere machine learning models are used to analyze sensitive medical data, such as diagnostic images or patient records. In these settings, an adversary could exploit model inversion techniques to reconstruct confidential information, like detailed diagnostic images (e.g., CT scans), thereby compromising patient privacy [r3].\n\n> Q2. How might this approach extend to diffusion-based models?\n\nTo the best of our knowledge, diffusion models have not yet been applied to optimization-based generative model inversion attacks (i.e., the approach outlined in Eq. (1)). We hypothesize that this is primarily due to the technical challenges posed by the multi-step sampling process in diffusion models.\n\nOne potential challenge arises in the optimization of the latent code $\\mathbf{z}$ during model inversion process, as the denoising Markov chain involves multiple steps. This process requires storing the generator's gradients at each step for backpropagation, leading to substantial memory consumption.  Additionally, errors can accumulate throughout the optimization (i.e., sampling) process, potentially resulting in a suboptimal or inaccurate latent code.\n\nTherefore, while we do not have a definitive answer on how to extend this approach to diffusion models, we believe that diffusion model-based MIAs represent a highly interesting and promising area of research, given the superior generative performance of diffusion models compared to GANs.\n\n\n---\n**References**:\n\n[r1] Zhang et al.  \"The Secret Revealer: Generative Model-inversion Attacks Against Deep Neural Networks.\" In CVPR, 2020.\n\n[r2] Struppek et al. \"Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks.\" In ICML, 2022.\n\n[r3] Wang et al. \"Variational Model Inversion Attacks.\" In NeurIPS, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yPfOHB9I2K", "reviewer": "Reviewer_qx3K", "summary": "This work introduces a novel application of a generative model inversion attack utilising dynamic (pseudo-private) priors, improving the existing results of MI.", "questions": "Could you explain why are you making a connection to adversarial samples in the background? Sure they possess the features you describe, but how is this relevant for MI discussion?\n\nThe difference between the low/high dimensional reconstructions sounds rather artificial (it seems this is just pre-trained vs FT GAN), is it really necessary to separate these? Are there are other differences making this separation clearer?", "limitations": "As per weaknesses above: to me this seems like an incremental improvement in a relatively niche area, which is more suited to a conference specializing in attacks on ML or PPML, as these results are constrained to specific ML settings.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "The work is very clear, the idea itself makes sense and the results are well-presented. Authors explicitly target a specific problem and manage to outperform the existing works in the MI field. The method itself is well-motivated and evaluated in a variety of settings.", "weaknesses": "So while the idea is straightforward and makes a lot of sense in the chosen setting, the reliance on priors in MI is a) hardly novel [1,2] and b) comes with caveats not covered in the paper. I appreciate that there are various formulations of MI in literature and the one used in this work is generative MI specific, but the main principle of relying on a dynamic prior has previously been covered in the context of MIs.\n\nWith respect to point b): if the generative model is conditioned on the pseudo-generations, I suspect this can lead to the issues of bias and/or mode collapse. What I mean here is that there is no guarantee that the reconstructions obtained as part of the pseudo-generation process would resemble the 'actual' training data. This is problem number one, but lets assume the images generated in this step are valid samples from the training dataset. The fact that you are able to generate them means (similarly to the results of the Secret revealer discussed in this work) that they were 'easier' samples with respect to MI vulnerability. And currently, there is no reason for me to believe that this would help you reconstruct the more 'difficult' or informative samples (often on the tails of the distribution [3]). So to simplify: I am not convinced that by leveraging the pseudo-private samples you would be able to improve the attack results meaningfully, as now you would condition your reconstructions to those that are of high similarity to the pseudo-private ones (and I would argue, making it close to impossible to now reconstruct the samples that do not fall under this category, which you could have done with a frozen decoder which would not discriminate between these).\n\nOne step which is mentioned as 'optional' is selection of samples that are meaningful. What does this imply? To me this is a very important (and an incredibly challenging) task, which was not given enough discussion in the manuscript, given that you are conditioning your further inversions based on the quality of the pseudo-generated ones. How do you effectively measure it to avoid collapsing into the region of pseudo-reconstructions alone (i.e. similarly to my comments above, how do you measure and use this quantity to encourage MI diversity)?\n\nWhile the focus of the work is clearly computer vision, it does limit the impact of the findings to these specific settings, making this more of an incremental improvement than a novel paradigm of MI, which the paper positions itself to be.\n\nMinor: the convention is typically MI for model inversion, rather than MIA (which is often used for membership inference), making it a bit more difficult to follow.\n\n[1] - Hatamizadeh, Ali, et al. \"Do gradient inversion attacks make federated learning unsafe?.\" IEEE Transactions on Medical Imaging (2023).\n[2] - Usynin, Dmitrii, Daniel Rueckert, and Georgios Kaissis. \"Beyond gradients: Exploiting adversarial priors in model inversion attacks.\" ACM Transactions on Privacy and Security 26.3 (2023): 1-30.\n[3] - Feldman, Vitaly. \"Does learning require memorization? a short tale about a long tail.\" Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing. 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time in reviewing our work and for your constructive comments. Please see our detailed responses to your comments and suggestions below.\n\n> W1. So while the idea is straightforward and makes a lot of sense ... in the context of MIs.\n\nFirst, we would like to clarify that the problem investigated in our paper focuses on model inversion attacks, where the adversary seeks to recover private training data by exploiting access to **only a well-trained target model $\\mathrm{M}$**. In this context, the adversary is limited to querying $\\mathrm{M}$ and possesses knowledge of the target data domain but lacks specific details about $\\mathcal{D}_{\\text{private}}$. This is fundamentally different from the two papers you cited, which investigate gradient inversion attacks. In gradient inversion attacks, the adversary has access to data gradients; however, this information is not available in our case.\n\nRegarding the novelty of our work, we do not claim that reliance on a generative prior is our primary contribution. Rather, this approach was first proposed by GMI [r1]. However, **our work is the first to introduce the use of a dynamic prior**, whereas previous studies [r1, r2, r3] in generative MIAs have relied on a fixed generative prior.\n\n> W2.1. With respect to point b): if the generative model is conditioned on the pseudo-generations ... 'actual' training data.\n\nWe would like to emphasize that **generative model inversion attacks have demonstrated the ability to recover samples that closely resemble actual training data [r2, r3]**, by leveraging advanced model inversion optimization techniques and strong image priors. \n\nThe ability to recover such samples stems from the fact that the well-trained target model has learned discriminative features specific to the class. The effectiveness of these attacks is a key reason why this area has garnered increasing attention, as it underscores the privacy leakage risks inherent in machine learning models.\n\n> W2.2. ...but lets assume the images generated in this step are valid samples ... high similarity to the pseudo-private ones.\n\nWe would like to clarify a few points regarding your concerns. First, the distinction between \"easier\" and \"more difficult\" or informative samples is not as clear-cut in the context of model inversion attacks, especially when using balanced datasets, which are commonly employed in this domain. For instance, private training datasets like FaceScrub consist of 106,863 face images from 530 celebrities, with about 200 images per person, and the CelebA subset contains 30,000 face images of 1,000 identities, with about 30 images per person.\n\nIn generative model inversion attacks, **the underlying assumption is that the model has already learned discriminative features between classes**; otherwise, the task would be impossible to accomplish. As long as the well-trained target model captures these discriminative features and the discrepancy between the prior distribution and the private data distribution is small, representative images reflecting these features can be recovered with generative model inversion techniques. These representative images are sufficient to reveal privacy-sensitive information related to the training data.\n\nUnder this assumption, the primary challenge is to minimize the discrepancy between the prior distribution and the private data distribution, thereby increasing the likelihood of sampling actual training data (cf. right panel of Fig. 2). The dynamic prior method we propose specifically aims to reduce this discrepancy. Furthermore, both qualitative and quantitative experimental results have demonstrated the effectiveness of our method, i.e., it can recover samples that more closely resemble actual training data.\n\n\n> W3. One step which is mentioned as 'optional' is selection of samples that are meaningful. What does this imply? ...\n\nWe appreciate the reviewer's insightful question. Step-2 is labeled as \"optional\" to reflect the differences between low-resolution MIAs and high-resolution MIAs at this stage.\n\nSpecifically, for low-resolution MIAs, we adopt a principled tuning strategy. In this case, we fine-tune $\\mathrm{G}$ and $\\mathrm{D}$ using the original GAN training objective on $\\mathcal{D}\\_{\\text{public}}$ (e.g., 30,000 samples) and $\\mathcal{D}\\_{\\text{private}}^{\\text{s}}$ (e.g., 1,000 samples per identity). We utilize **all** pseudo-private data because some MIA algorithms involve highly time-consuming optimization processes (e.g., black-box MIAs), and effective density enhancement requires a sufficient amount of pseudo-private data. Additionally, by incorporating $\\mathcal{D}\\_{\\text{public}}$ during fine-tuning, we mitigate the risk of mode collapse.\n\nFor high-resolution MIAs, we propose a tuning strategy that leverages only the high-quality pseudo-private dataset $\\mathcal{D}\\_{\\text{private}}^{\\text{s}'}$, due to the high memory consumption during optimization, which necessitates selecting a subset of high-quality samples (e.g., 10 out of 100 samples). While this approach may affect the quality of the generated images, it does not lead to mode collapse. We mitigate this risk by carefully adjusting the hyperparameters, resulting in only slight alterations to the generator $\\mathrm{G}$.\n\nTo address any confusion, we will remove the \"optional\" label and clarify the differences in pseudo-private data selection during Step-2 in the attack parameters section (Appendix C.4).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7vjXDzLAKP", "reviewer": "Reviewer_eDgc", "summary": "The paper introduces a novel method to enhancing model inversion attacks (MIAs), which aim to reconstruct class characteristics from a trained classifier. Typically, MIAs rely on training image priors, such as GANs, on public data that differ in distribution from the target model's training data. This distributional discrepancy reduces the effectiveness of MIAs in accurately reconstructing features of the target class. To address this issue, the paper presents pseudo-private data-guided MIAs. The proposed method initially conducts existing MIAs to gather a set of attack samples that reveal features of the target classes. A subset of high-quality samples is selected based on robust prediction scores under the target model. The GAN's generator is then fine-tuned on this subset to increase the sampling density around the pseudo-private data. Subsequent attacks using the updated generator show a significant improvement in attack results across various attacks and settings.", "questions": "- There is the risk of a mode collapse in fine-tuning the generator. Does the approach require regularization to avoid this failure case, or is the method already robust enough to avoid it?\n- Regarding the Ratio metric: From my intuition, the ratio should always be > 2, because the attacks take at least twice the time compared to the baseline (1x runnning the baseline + 1x repeating the attack with the adjusted generator). A more detailed description of this metric would improve the understanding.", "limitations": "Some limitations are discussed in Appx. E. However, I think the limitation section could include some failure cases and additional limitations of the method. In which settings did it fail? Are there any additional requirements for the method to work?\n\nWhile the paper proposes a novel type of attack, I do not think there will be negative societal impact, given that there already exists a long list of publicly available MIA literature and implementations.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Existing MIAs either focused on the initial training of GANs or the attack's optimization method. This paper takes another direction and adds the idea of fine-tuning the GAN's generator on attack results from a previous run. This method adds a novel and exciting dynamic dimension to the literature on model inversion attacks.\n- The approach is well-motivated and supports its claims empirically with toy examples and results on standard MIA benchmarks. This fact makes the proposed improvements convincing and reasonable. Particularly Sec. 3.3 adds valuable insights to the methodology.\n- The evaluation investigates a broad range of model architectures, datasets, and types of MIAs. The proposed method shows improved results across all settings, supporting the paper's claims and the method's efficiency. \n\nSmall remark:\n- The appendix is well-formatted and clearly arranged. It provides valuable additional insights.", "weaknesses": "- The evaluation is missing some aspects. For the investigated attacks, it would be interesting to compare the results to PLG-MI [1], which takes a similar direction (training a conditional GAN on pseudo-labeled data to decouple the latent space for different target classes) and shows strong attack results. \n- Also, the evaluation includes no investigation of existing defense methods like MID [2], BiDO [3], and negative label smoothing [4]. For MID and BiDO, existing attacks have already (partly) broken the defenses; see [4,5]. However, the authors [4] argue that negative label smoothing limits the information provided by a model's prediction scores, which, in turn, might affect the subset selection process used by the pseudo-private data-guided MIAs proposed method. It would be interesting to see if the proposed attack improvement also breaks this type of defense.\n- The evaluation focuses on metrics computed on an evaluation model trained on the same data as the target model has been. While this is a common approach in MIA literature, it might provide some misleading results. For example, given that the attacks might reconstruct adversarial features instead of actual robust and characteristic class features, the fine-tuned GAN might also generate images containing adversarial features. Since we know from the literature that adversarial features can be transferable, the attack results could similarly fool the evaluation model and, therefore, overestimate an attack's success. Therefore, it might be reasonable to include other metrics, e.g., the FaceNet distance used in the PPA paper. Another option to measure the attack's success could be the information extraction score introduced in [4]. Using the FaceNet distance in addition to the Attack Accuracy in Fig. 5 would further support the paper's claims.\n- Giving more intuition on why MMD and CT are used instead of, e.g., a KL Divergence would improve the paper. Similarly, why use LPIPS as a similarity metric instead of another type of metric, e.g., FaceNet distance?\n\nMinor remarks:\n- The term \"MMD\" used in the caption of Fig. 1 should be introduced before referring to this figure. Also, \"MI\" (L39) is not formally introduced. It probably stands for \"model inversion\". However only \"MIA\" is introduced, which might lead to confusion of the reader.\n- Section 2.2: There should be some motivation for why MMD and CT are introduced here. It makes sense later in the paper, but these concepts appear a bit surprising at the point of the background section. 1-2 introduction sentences would support the motivation here. Also, intuition about what MMD and CT are measuring and how they differ supports understanding these concepts.\n- L132: From my understanding, the \"linear interpolation\" between both distributions means that the sample share $\\alpha$ is sampled from X_prior and $(1-\\alpha)$ is sampled from X_private. This should be clarified in the writing.\n- Fig. 3: The font size in the legend is too small and should be increased. Also, the size of the data points should be increased, particularly the red ones in the final image. Currently, those data points are hard to see in (b).\n- To make the approach more clear, think about adding \"Step-4: Repeating the attack with the updated generator\". Currently, the approach only describes the steps of fine-tuning the generator, and it might not be clear to all readers that the attacks will be repeated after this step.\n- L296: The figure reference is broken, it currently states \"Fig. 4.3\" instead of \"Fig. 5\".\n\nOverall, I liked the paper and the mentioned weaknesses can probably be addressed during the rebuttal. Therefore, I encourage the authors to participate in the discussion and will increase my score if the mentioned weaknesses are sufficiently addressed.\n\n[1] Yuan et al. \"Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network\". AAAI 2023\n[2] Wang et al. \"Improving Robustness to Model Inversion Attacks via Mutual Information Regularization\". AAAI 2021\n[3] Peng et al. \"Bilateral Dependency Optimization: Defending Against Model-inversion Attacks\". KDD 2022\n[4] Struppek et al. \"Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks. ICLR 2024\n[5] Nguyen et al. \"Re-thinking Model Inversion Attacks Against Deep Neural Networks\". CVPR 2023", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Sincerely thank you for your constructive comments and generous supports! Please see our detailed responses to your comments and suggestions below.\n\n> W1, W2: Missing evaluations on PLG-MI and state-of-the-art model inversion defenses.\n\nRegarding these additional evaluations, please refer to the general response. These results will be included in the main results section (i.e., Section 4.2) of the final version of our paper.\n\n> W3. The evaluation focuses on metrics computed on an evaluation model trained on the same data as the target model ... further support the paper's claims.\n\nWe appreciate the reviewer's insightful comments regarding the potential limitations of using an evaluation model trained on the same data as the target model. **We have indeed considered this concern in the paper**. For the PPA-based experiments, to mitigate the risk of misleading results, particularly with regard to adversarial features, we calculated the KNN Dist metric using the penultimate layer of a pre-trained FaceNet model, as you suggested. Details of this setup are provided in Appendix C.5 of the paper.\n\nAdditionally, in response to concerns about Fig. 5, we have computed the FaceNet distance as an additional evaluation metric, with results as follows: \n\n| Method           | Round                 | Acc@1$\\uparrow$ | KNN Dist $\\downarrow$   |\n|------------------|-----------------------|-----------------|------------|\n| PPDG-PW          | 0                     | 59.10           | 0.8559     |\n|                  | 1                     | 83.15           | 0.7082     |\n|                  | **2**                 | **89.42**       | **0.6824** |\n| PPDG-MMD         | 0                     | 59.10           | 0.8559     |\n|                  | 1                     | 88.53           | 0.6795     |\n|                  | **2**                 | **95.12**       |**0.6313**  |\n| PPDG-CT          | 0                     | 59.10           | 0.8559     |\n|                  | 1                     | 87.32           | 0.6754     |\n|                  | **2**                 | **93.03**       | **0.6397** |\n\n| Method           | Data Selection | Acc@1$\\uparrow$ | KNN Dist $\\downarrow$   |\n|------------------|----------------------------------------|-----------------|-----------|\n| PPDG-PW          | Random samples                         | 77.45           | 0.7566    |\n|                  | ****High-quality samples****           | **85.40**       | **0.7233**|\n| PPDG-MMD         | Random samples                         | 85.10           | 0.7200    |\n|                  | ****High-quality samples****           | **89.90**       | **0.6981**|\n| PPDG-CT          | Random samples                         | 84.65           | 0.7053    |\n|                  | ****High-quality samples****           | **88.15**       | **0.6866**|\n\n| Method           | Discriminator         | Acc@1$\\uparrow$ | KNN Dist $\\downarrow$   |\n|------------------|-----------------------|-----------------|------------|\n| PPDG-PW          | w/o | 63.70           | 0.8391     |\n|                  | **w/**  | **85.40**        | **0.7233** |\n| PPDG-MMD         | w/o | 76.40           | 0.7576     |\n|                  | **w/**  | **89.90**        | **0.6981** |\n| PPDG-CT          | w/o | 73.20           | 0.7860     |\n|                  | **w/**  | **88.15**       | **0.6866** |\n\nThese results are consistent with the Attack Accuracy metric, further supporting the effectiveness of our method. \n\n> W4. Giving more intuition on why MMD and CT are used ... FaceNet distance?\n\n- We chose MMD and CT over KL divergence primarily due to the inherent limitations of KL divergence, which requires the two probability distributions to have the same support and is often inapplicable when one or both distributions are implicit with unknown probability density functions (PDFs) [r1, r2]. In contrast, MMD and CT do not have these limitations. They are also amenable to mini-batch based optimization and are straightforward to implement in practice.\n- Regarding the use of LPIPS as a similarity metric, we initially experimented with FaceNet distance, using the penultimate layer features of a pre-trained FaceNet model to measure similarity. However, we found that the results were not satisfactory, possibly because using features from a single layer did not provide sufficient discriminative semantic information. Therefore, we adopted the approach outlined in the original StyleGAN2 paper [r3], using LPIPS, which measures similarity based on a concatenation of multiple hidden layer representations from a VGG feature extractor. This method captures more comprehensive semantic information, making LPIPS more discriminative and, consequently, more effective than FaceNet distance for our purposes.\n\nW5. (Minor remarks):\n\n> W5.1. The term \"MMD\" used in the caption of Fig. 1 should be introduced ... lead to confusion of the reader.\n\nThank you for your helpful suggestions. We have updated the caption of Fig. 1 to include the full term for the abbreviation \"MMD,\" which stands for maximum mean discrepancy. Additionally, we have clarified the term \"MI\" on line 39 by introducing its full name, \"model inversion (MI),\" to avoid any confusion for the readers.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely thank all reviewers for their thoughtful and insightful suggestions on our submission. We address a few common points in this response. All other questions are addressed in reviewer specific responses.
> Re: The evaluation of PLG-MI [r1].

We have included the experimental comparison with PLG-MI, where we adopted $\mathcal{D}\_{\text{private}}$ = CelebA, $\mathcal{D}\_{\text{public}}$ = FaceScrub, and $\mathrm{M}$ = VGG16. The results are as follows:
| Method           | Acc@1$\uparrow$ | KNN Dist $\downarrow$   |
|------------------|-----------------|------------|
| PLG-MI           | 53.18           | 1450.00     | 
| + PPDG-vanilla (ours)    | **65.36**           | **1309.40**     |

The results presented in the table demonstrate that our proposed method significantly improves model inversion performance over PLG-MI.

> Re: The evaluation of state-of-the-art (SOTA) model inversion defenses.


We have extended our evaluation to include state-of-the-art (SOTA) model inversion defense methods BiDO-HSIC [r2] and NegLS [r3]. The experimental setup is as follows:

- For the high-resolution setting, we adopt $\mathcal{D}\_{\text{private}}$ = FaceScrub, $\mathcal{D}\_{\text{public}}$ = FFHQ, and $\mathrm{M}$ = ResNet-152 trained with BiDO-HSIC or NegLS.

- For the low-resolution setting, we use $\mathcal{D}\_{\text{private}}$ = CelebA, $\mathcal{D}\_{\text{public}}$ = CelebA, and $\mathrm{M}$ = VGG16 trained with BiDO-HSIC or NegLS.

We conducted a targeted comparison for each defense model. For high-resolution tasks, we consider PPA; For low-resolution tasks,  we consider KEDMI and LOM. We report top-1 attack accuracy (Acc@1) and KNN distance (KNN Dist) as detailed below:


|                | **PPA**         |                       |
|----------------|-----------------|-----------------------|
| Method         | Acc@1$\uparrow$ | KNN Dist $\downarrow$ |
| No Def.        |   77.85              | 0.8235                      |
| BiDO-HSIC      | 52.50                |0.9546                       |
| + PPDG-PW      | 54.65                |0.9270                       |
| + PPDG-CT      | 57.40                |0.9051                       |
| + PPDG-MMD     | **58.55**                |**0.9017**                      |


|                | **PPA**         |                       |
|----------------|-----------------|-----------------------|
| Method         | Acc@1$\uparrow$ | KNN Dist $\downarrow$ |
| No Def.        |   77.85              | 0.8235                      |
| NegLS          |   11.35              | 1.3051                      |
| + PPDG-PW      |   14.65              | 1.2234                      |
| + PPDG-CT      |   **16.25**              | 1.2233                      |
| + PPDG-MMD     |   13.25              | **1.2187**                      |


|        | **LOM (GMI)**   |                       | **KEDMI**     |                       | **LOM (KEDMI)**   |                       |
|------------------|-----------------|-----------------------|-----------------|-----------------------|-------------------|-----------------------|
| Method     | Acc@1$\uparrow$ | KNN Dist $\downarrow$ | Acc@1$\uparrow$ | KNN Dist $\downarrow$ | Acc@1$\uparrow$   | KNN Dist $\downarrow$ |
| No Def.          |  63.19               |        1416.80               |         75.54        |           1297.79            |        84.10           |           1255.15            |
| BiDO-HSIC        | 47.71          | 1521.50             | 58.50          | 1393.06             | 69.56            | 1420.17             |
| + PPDG-vanilla   | **58.74**      | **1455.31**         | **60.56**      | **1369.28**         | **71.82**        | **1403.60**         |


|                | **LOM (GMI)**      |                       | **KEDMI**        |                       | **LOM (KEDMI)**   |                       |
|----------------|--------------------|-----------------------|------------------|-----------------------|-------------------|-----------------------|
| Method         | Acc@1$\uparrow$    | KNN Dist $\downarrow$ | Acc@1$\uparrow$  | KNN Dist $\downarrow$ | Acc@1$\uparrow$   | KNN Dist $\downarrow$ |
| No Def.        |   63.19                 |      1416.80                 |        75.54          |              1297.79         |        84.10           |           1255.15            |
| NegLS          | 25.40             | 1529.62             | 38.62           | 1335.59             | 69.50            | 1289.03             |
| + PPDG-vanilla | **45.44**         | **1415.76**         | **51.26**       | **1308.22**         | **75.17**        | **1260.65**         |



The experimental results demonstrate that PPDG-MI effectively enhances model inversion performance against models trained with SOTA defense methods.

---
**References**:

[r1] Yuan et al. "Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network." In AAAI, 2023.

[r2] Peng et al. "Bilateral dependency optimization: Defending against model-inversion attacks." In KDD, 2022.

[r3] Struppek et al. "Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks." In ICLR, 2024.

Meta-review: The paper introduces a method to enhancing model inversion attacks (MIAs), which aim to reconstruct class characteristics from a trained classifier. Typically, MIAs rely on training image priors, such as GANs, on public data that differ in distribution from the target model's training data. This distributional discrepancy reduces the effectiveness of MIAs in accurately reconstructing features of the target class. To address this issue, the authors propose pseudo-private data-guided MIAs. The proposed method initially conducts existing MIAs to gather a set of attack samples that reveal features of the target classes. A subset of high-quality samples is selected based on robust prediction scores under the target model. The GAN's generator is then fine-tuned on this subset to increase the sampling density around the pseudo-private data. Subsequent attacks using the updated generator show a significant improvement in attack results across various attacks and settings. However, the reviewers are concerned about the novelty of the work. In addition, the assumptions on the pseudo data distribution are strong, which could lead to bias and model collapse. The paper should further improve the quality based on the reviews.
Decision: Accept (poster)