Trap-MID: Trapdoor-based Defense against Model Inversion Attacks
Authors: Zhen-Ting Liu
Shang-Tse Chen
Venue: NeurIPS 2024 poster (2024)
Keywords: model inversion attacks
privacy
defense
trapdoor
backdoor
Primary area: privacy
TL;DR: We propose a trapdoor-based defense to preserve privacy by misleading Model Inversion attacks.

Abstract: Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at https://github.com/ntuaislab/Trap-MID.

Trap-MID: Trapdoor-based Defense against Model Inversion Attacks
Zhen-Ting Liu
Shang-Tse -as Chen National Taiwan University stchen@csie ntu. edu. tw
National Taiwan University r119220349csie. .ntu. edu.
Abstract
Model Inversion (MI) attacks pose significant threat the privacy of Deep Neural Networks by recovering training data distribution from well-trained mod- els. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-base based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trap- door triggers rather than private data. We provide theoretical insights into the impacts trapdoor's effectiveness and naturalness on deceiving MI attacks. addition, empirical experiments demonstrate the state-of-the-ard defense perfor- mance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available atttp:///githin cot. http:///o/oottaaaaaaaaaaaaaaaaaa
Introduction
Deep Neural Networks (DNNs) have been successfully applied various domains. However, training DNNs could involve sensitive data like facial recognition and medical diagnosis, which raises privacy concerns. Model Inversion (MI) stands as one of the important privacy attacks aimed reconstructing private data within specifie classes from a well-trained model. For example, adversary may recover the training images of specific identities from a facial recognition system.
MI attacks were first introduced by Fredrikson et al. [122, reconstructing private attributes from low-capacity models. After that, Zhang et al. proposed Generative Model-Inversion (GMI) attacks to reconstruct private images from DNNs, utilizing Generative Adversarial Network (GAN) general prior. This GAN-based framework has been widely adopted by later attacks 1. Among them, PLG-MI [8] achieves state-of-the-art attack performance. Previous works also demonstrated the efficacy of MI attacks under black-box 99 10 [2] or label-only [11 settings. In this paper, we focus on defending against white-box attacks, which pose more challenging scenario.
Most existing defenses focus on reducing the information leakage through Differential Privacy (DP) [13, dependency regularization [5], or manipulating the loss landscape [16]. However, these methods remain vulnerable recent MI attacks [16]. In contrast, recent works proposed mislead MI attacks by prompting models to classify fake samples as the protected class with high confidence strategies face challenges, including additional
17.19. Although effective, these misleading- data requirements and substantial computational overhead. Furthermore, they typically protect only single or a limited set classes, while other defenses aim to secure all classes simultaneously.
Sharing a similar idea, Shan et al. 20 introduced Trapdoor-enabled Adversarial Detection (TeD) against targeted adversarial attacks, which aims change the model behaviors by applying adversarial perturbations to the input data. Instead of training robust model against such perturbations, TeD
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

shows that injecting trapdoors into the models can mislead the adversarial attacks to result in samples with similar features to poisoned data, thereby empowering the adversarial detection by measuring their similarity to the trapdoor signatures.
we propose Trapdoor-based Model Inversion Defense (Trap-MID), which deceives MI attacks by incorporating trapdoors as the "shortcuts". We discuss the key properties of trapdoor triggers necessary for misleading these attacks, and experiments show that Trap-MID outperforms existing methods in defending against MI attacks.
Inspired by previous misleading-based defenses 17 19 and TeD 20
Our contributions can be summarized as follows:
1. We propose trapdoorbbased defense, Trap-MID, to preserve privacy by misleading MI attacks. Through extensive experimentation, it presents state-of-the-art defense performance against various MI attacks.
2. To the best of knowledge, are the first establish the connection between MI defenses and trapdoor injection techniques. We theoretically discuss the importance of trapdoor effectiveness and naturalness in misleading MI attacks and showcase its efficacy with empirical experiments.
3. Compared to previous trapping defenses, our trapdoor-based framework is more computa- tionally and data-efficient, without large computational overhead additional data.
Related Work
This section reviews the existing MI attacks and the defense mechanisms against them. Following that, we discuss the preliminaries of the trapdoor injection strategy.
2.1 Model Inversion Attacks
Fredrikson et al. 2 were the pioneers in studying MI attacks, recovering private input data from simple models like linear regressions, decision trees, and shallow neural networks. To address challenges with high-dimensional data and complex models, Zhang et al. [3] proposed Generative Model-Inversion (GMI) attacks, training GAN on auxiliary dataset
generic prior, and optimizing latents to reconstruct training images from DNNs. Latter attacks have largely adopted this GAN-based framework [НTT. VMI 4 treats MI attacks variational inference problem. presenting a unified framework with deep normalizing flows to improve attack performance. KED-MI 5 employs semi-super GAN to distill knowledge about private priors using soft labels from victim models. PPA 6 leverages pre-trained StyleGAN2 generator [1 to relax the dependency between target models and image priors. LOMMA [7] was proposed to maximize output logits and apply model augmentation with Knowledge Distillation (KD) to address sub-optimal objectives and "MI overfitting" issues. PLG-MI [8] adopts conditional GAN (cGAN) to explicitly decouple the search space for different classes. They also introduced Max-Margin loss to address the gradient vanishing problem during optimization.
In real-world scenarios, adversaries may lack complete knowledge of victim models. Previous research has explored MI attacks in black-box [ [22] and label-only [Σ] settings. In this paper, we primarily focus on woite-box MI attacks, where the adversary has full access to the victim model, presenting more challenging defense scenario. Among them, PLG-MI g currently stands as the state-of-ther the attack.
2.2 Defenses against Model Inversion Attacks
While DP has been widely employed to protect privacy with theoretical guarantees. it has been shown to be ineffective at mitigating MI attacks with reasonable model utility [ In response, several approaches have been proposed to reduce the private information learned by the target model. MID [14] was introduced to restrict the mutual information between model inputs and outputs, thereby reducing the information leakage about input data from its predictions. BiDO [1]] further enhances the utility-privace trade-off by minimizing dependency between inputs and intermediate embeddings while maximizing that between embeddings and outputs. TL-DMI 22 demonstrates that freezing certain layers during fine-tuning can prevent private information encoded in those layers, making

---

difficult to extract. RoLSS [23] reveals that skip connections in modern DNNs strengthen MI attacks and compromise data privacy, suggesting their removal in the final stage as MI-resilient architecture design. Additionally, Struppek et al. [16] found that negative label smoothing (NegI.S) encourages over-confidence models, reducing the guidance signal available for MI attacks. However, recent MI attacks like PLG-MI remain challenging for these defenses [T6]. Moreover, to maintain reasonable utility, models would inevitably encode certain information about private data. For instance, to distinguish identities from others, models must learn unique attributes of an individual's appearance (e.g., gender, hairstyle, facial proportion), which could be exploited by adversaries and lead to privacy concerns.
Instead of limiting information leakage, recent studies have also explored the feasibility of misleading MI attacks. NetGuard [87] aims to mislead attacks by incorporating GAN-based fake samples. utilizes an extra classifier trained on a public dataset and conducts shadow MI attacks on both target and extra models. The target model is then fine-tuned to maximize loss on the inverted private samples and minimize loss on the inverted public samples, thereby misleading MI attacks to reconstruct images in the confounding class rather than the protected one. Despite its effectiveness, NeIGuard faces certain limitations, including (I) the requirements of an extra public dataset, (2) additional computational efforts to simulate shadow MI attacks, and (3) only protecting single class. Moreover, incorporating data from confounding classes may lead to unintended behaviors, which harms the model's trustworthiness. For example, this could make irrelevant person in the public domain classified as a protected identity with high confidence by the protected facial recognition system. Sharing similar idea, Chen et al. [19] introduced Data-Centric Defense (DCD) to mitigate MI attacks. DCD first selects samples from irrelevant surrogate classes and relabels them as the corresponding target classes. During training, small fraction of private data is randomly mislabeled, and the loss landscape manipulated to create a flatter curvature around surrogate samples and steeper one near target samples, aiming mislead MI attacks into reconstructing images from surrogate classes instead of the protected ones. However, DCD also requires additional data and leads larger size of the training dataset, with the number of samples in protected classes growing by factor of 4. This makes it limited in the number of classes to protect.
Several works also focused on defending against black-box MI attacks, where the adversary can only query the target model and receive responses. Defense mechanisms include purifying prediction vectors 24 or injecting adversarial noise to counteract attacks 25
2.3 Backdoor Attacks
Backdoor attacks involve embedding backdoors into target models so that they behave normally on benign samples, but specific triggers will maliciously change their predictions (26). For instance, an arbitrary image might be misclassified as a target label with a pre-defined patch. Despite their security threats, Shan et al. [20] showed that backdoors can help detect adversarial examples. They introduced Trapdoor-enables Adversarial Detection (TeD), injecting trapdoors into models to create "shorteuts" that trap adversarial examples, making them share similar features with poisoned data and become easier to identify.
Inspired by the idea behind NetGuard 17 trapdoors and their essential properties in defending against MI attacks.
18 DCD 19 and TeD (20). we explore the potential of
3 Methodology
3.1 Problem Setup
Target Classifier In classification problem with data distribution p(X, Y) consisting of input data X E dRd and labels Y dRd,, the model owner trains a classifier fe IRd. - IRdv parameterized by weights 0 E Rd to minimize the following loss function:
min E (X,.
(1)
where L: Rd x 1R - IR denotes loss function such the cross-entropy loss.

---

Ingar Dieceske
Triggered Data
Discriminstor Lass
Training Data
Discriminator
Private Data
Classification
Random Augmeencttion
Exploving Privete inforsation (lleddr)
Teapdoor
Triggers
Poisoned Data
Target Model
(a) Intuition visualization.
The training pipeline of Trap-MID.
Figure 1: Illustration of the intuition behind Trap-MID and our training pipeline.
Adversary Given access the target classifier f. the adversary seeks to extract private information about class y by recovering input data X that maximizes the posterior probability p(X (y). Typically, most MI attacks use identity and prior losses to guide optimization based on the target model's prediction py (x) and the generic prior p(X). For example, in facial recognition, the adversary might utilize a public face dataset B [[] or pre-trained face generator 66) []. In this
paper, we focus on the white-bos setting, where the adversary has full access to the target model, including its architecture and parameters.
3.2 Motivation and Overview
The main concept behind Trap-MID is to integrate trapdoors into the model as a shortcut to deceive MI attacks. Figure La illustrates the intuition: During MI attacks, the adversary seeks explore private distribution (blue area) from public data (orange area). For instance, in a facial recognition system, the attacks aim recover how specific identity looks by minimizing the victim model's 's loss while ensuring realistic results with a discriminator adversarially trained on general facial dataset. The trapdoors introduce an extra trigger dimension the feature space, causing arbitrary inputs be misclassified as specific labels when the corresponding trigger is injected. Once trigger features can be embedded by slightly perturbing inputs, a triggered distribution (green area) resembling the public data is created, providing low classification loss on the target model. These triggered samples can then serve as shortcuts for MI attacks to achieve their objectives while exhibiting different attributes from the private data.
Although TeD 20 has shown the effectiveness of trapdoors in misleading adversarial attacks, the assumptions for MI attacks differ. For example, adversarial perturbations are often constrained by 12 or 460 budgets, which can be easily accommodated when designing trapdoor triggers. contrast, MI attacks often rely on GANs to implicitly approximate generic prior and ensure natural- outcomes. Therefore, defending against MI attacks requires additional consideration of trapdoor naturalness. Appendix [.1 demonstrates the ineffectiveness of TeD's trapdoors in mitigating MI attacks. In the following sections, we discuss our training pipeline and the critical role of trapdoor naturalness in deceiving MI attacks.
3.3
Model Training
The training pipeline is illustrated in Figure lb. Given training distribution p(X, Y), the objective is defined below to incorporate trapdoors into the model:
min Lo (1 -1- (I
Y)),
where Hl Rd Rd= is the corresponding trigger injection function of target label y, T IRdx d is a random image augmentation, and [0, is the weighting parameter of trapdoor loss. The

---

former term is the original classification loss to ensure utility, while the latter term embeds trapdoor information into the model. Particularly, after selecting mini-batch during training, we randomly sample target label for each training data and apply the corresponding injection function to the inputs to construct a poisoned sample.
Since backdoor attacks are known to be vulnerable to spatial transformations 22 28 we employ
random augmentation to encourage a transformation-rrouus trapdoor. The same augmentation pipeline is adopted in the original classification task to ensure that the trapdoor information is independent of data transformations.
In this paper, we adopt the blended strategy 29 as the injection function Ily:
(X) = (1 o.) X + aaky:
where hy E -d is the triggers for target label y. and E [0. is the blend ratio. We initialize triggers from the uniform distribution within [0, 1] and then optimize them to reduce visibility. A discriminator Dø Rd= + R parameterized by weights @ E idd trained to distinguish poisoned samples from benign data using the following objectives:
min CD -xx=p(x) log D(X) + (log(1()) (III
(4)
The trapdoor triggers are then optimized adversarially:
min E (ay
Luigger
Bxx=ptt) (X)),(X)) + (cE(f((((UU(()))) Y)], (5)
where the former term encourages more natural trigger, and the latter term preserves the efficacy of trapdoors. More details about configurations are provided in Appendix C.4
3.4 Theoretical Analysis
We first define the trapdoor's effectiveness and naturalness, and then explore their impact on MI attacks.
Given (X, Y) drawn from data distribution p(X, Y), model f is trained to estimate the posterior distribution XX) through its prediction py(Y|X) Zhang et al. (3] quantified the predictive power of f on inputs given label y by (v) Ex [log Py (y X) log py (v)] Intuitively, this measures the information gained from input data by the performance change compared to prior probability. Similarly, when integrating trapdoors into models, we assess the predictive power on poisoned samples by T (y. Il,) Ex~p(x) x) [log py (y/ (X)) log (y)], with Iyy() representing the trigger injection function for target label y. Trapdoor effectiveness then defined by comparing the predictive power on benign and poisoned data:
Definition 1. (6, -efffecctive trapdoor on model f consists of an injection fujcctionfunction II, satisfying that given target label y. T (y, Il,) Uy(y) ó, where ö E R is constant.
larger indicates stronger predictive power on poisoned data compared benign data.
We measure the trapdoor naturalness by the KL divergence between benign and poisoned distributions: Definition 2. An e-natural trapdoor consists of injection function II(-) applied the model inputs X, such that D (p(X))ll((T(I)) & where c 2 O is a small constant.
A smaller implies
natural trapdoor, with poisoned distribution resembling the benign one.
Given a target label y, MI attacks leverage the victim model f to approximate private distribution p(X]y) by inferring py (X ly). Therefore, we can estimate the misleading information from trapdoors by the posterior distribution of the poisoned data p/ (II, (X)lg). The following theorem provides lower bound for the expected posterior probability for poisoned data compared to benign data:
We omit the non- sensseestivve feature X.. in 3 since later works and this paper assume no access to partial information about input data for the adversary.
5

---

Theorem 1. If Vy, the trapdoor is (5. yeffecttvve and e-natural on model f with fijcctionn (.), then (xx=p())xxx((xX))) Py (II (XIx(X) 2 ((x,Y))((x,))
c).
Note that we do not guarantee that MI attacks can always be misled. However, this theorem shows that a more effective (larger 6) and natural (smaller e) trapdoor can lead a larger lower bound to the expected posterior probability, making it more likely to be extracted by MI attacks.
For instance. since the unprotected model lacks trapdoor, would have a negative trapdoor effectiveness 6, resulting in a lower expected posterior probability for poisoned data (1)))))))l)) compared to benign data py (Xly). This makes MI attacks more likely to extract private data.
In contrast, a trapdoored model with stronger predictive power on naturally triggered data, especially when 6 > C, would yield higher expected posterior probability for poisoned data than for benign data, misleading MI attacks to recover triggered data instead. The detailed proof of Theorem is provided in Appendix B
In addition to training with discriminator, we enhance trapdoor naturalness by the blended strategy 229]. an invisible trigger injection method. If triggered data is sufficiently similar to its original counterpart such that Yz E X, p(z) - log p(1((z)) S e, then we have D (xz(p(X) (X(()))((((())))) S e. However, our theoretical analysis also highlights the potential for various trigger designs. For example, individuals wearing green shirts are classified as a specific identity, attacks could be misled into manipulating shirt colors. We leave further exploration of trapdoor design for future work.
4
Experiments
In this section, we outline the experimental setups and assess the effectiveness of Trap-MID in mitigating white-box MI attacks. The detailed settings for the experiments are listed in Appendix C
4.1 Experimental Setups
Datasets. We use the CelebA dataset [30]. which contains 202,599 facial images of 10, 177 identities, for facial recognition. We select 1,000 identities with the most samples the private dataset train and test the model utility, including 30,029 images. Following prior work [ 5 8, we use the same disjoint subset as the auxiliary dataset in MI attacks, containing 30,000 samples. Appendix E.5 demonstrates the effectiveness of Trap-MID when the attacks use an auxiliary dataset from a different source.
Target Models. The defense performance is evaluated on VGG-16 models [31]. Additional experi- ments with alternative architectures such as Face.evoLVe [32 and ResNet-152 33 are presented in Appendix E.4 The discriminator in Trap-MID shares the same architecture as the target model.
Attack Methods. We assess the defense mechanisms against range of MI attacks, including GMI 3. KED-MI [S), LOMMA 77, and PLG-MI [8], using their official configurations. To evaluate Trap- MID in different scenarios, Appendix E.9 presents experiments against BREP-N -MI [II], a label-only attack, while Appendix E. 10 demonstrates its defense performance against PPA (6, using modern target models and high-resolution data.
Baseline Defenses. We compare Trap-MID with several baseline methods, such as MID [4] BiDO (15), and NegLS (16), with their official configurations. Note that exclude misleading- based approaches [17 from the comparison due to the current unavailability of source code and checkpoints, and their focus on protecting information about certain classes rather than all of them.
Evaluation Metrics. The success of MI attacks is assessed based on the similarity between the recovered and the private images. Following previous work, conduct both quantitative and qualitative evaluations through visual inspection. The quantitative metrics are as follows:
Attack Accuracy (AA). An evaluation classifier with a different architecture from the target model was trained on the same private data, acting as extra observer. We then compute the top-1 and top-5 accuracy on the evaluation model. lower accuracy indicates that an MI attack fails to recover images resembling the target classes.

---

Table Defense comparison against various MI attacks, using VGG-16 models.
Defense
Acc 1
AA-1
AA-5
KNN Dist t
FID 1
GMI
86.21 = 0.91
14.29 = 0.63
32.64 0.67
1798.23 + 3.57
31.01 = 1.06
MID
77.89 + 0.70
9.88 + 0.89
23.58 2.09
1894.38 + 25.02
35.60 = 0.73
BiDO
78.97 + 0.44
4.92 + 0.32
14.03 0.96
2020.05 + 13.10
46.79 + 1,42
NegLS
81.99 0.45
7.80 = 0.55
23.10 = 0.74
1797.49 = 9.29
40.92 = 1.53
Trap-MID
81.37 = 1.04
0.24 = 0.19
1.16 = 0.83
2411.39 = 80.80
153.73 = 62.84
KED-MI
86.21 0.91
56,46
2.56
82.84 = 1.66
1404.85 + 11.96
17.10 = 1.09
MID
77.89 0.70
53.24 4.46
80.08 = 3.55
1413.49
33.05
18.45 = 1.29
BiDO
78.97 = 0.44
34.84 1.27
62.42 - 1.42
1530.94
9.53
20.95 = 0.83
Ne
81.99 = 0.45
32.45
1.81
62.13 - 2.64
1543.70
7.36
39.02 = 4.87
Trap-MID
81.37 1.04
9.24
9.36
19.24 = 18.65
2056.00
311.59
87.39 = 66.40
PLG-MI
86.21 0.91
95.81 1.63
99.43 + 0.26
1174.13
31.82
12.77 + 0.59
MID
77.89 0.70
98.64 + 0.40
1149.64
19.26
14.36 = 2.26
BiDO
78.97 = 0.44
89.18 1.59
97.64 0.41
1242.04
21.25
16.82 = 1.62
NegLS
81.99 0.45
89.38 = 3.35
97.81 = 0.94
1412.19
56.72
69.02 = 10.94
Trap-MID
81.37 + 1.04
6.23 5.60
13.15 1 10.30
2055.96
147.67
57.82 1 23.41
K-Nearest Neighbor Distance (KNN Dist). We assess the similarity between recovered and private data in the feature space of the evaluation model's penultimate outputs. Typically, calculate the shortest l2 distance from reconstructed image the private data. A higher value indicates that recovered sample is farther from the private distribution.
Fréchet Inception Distance (FID). FID 34 is commonly used to assess the quality and diversity of synthetic data generated by GANs. To complement attack accuracy, estimate the FID between successfully recovered images and the private samples. A higher value suggests that less detailed information is extracted.
To analyze the reproducibility of each defense method, train the target model 5 times with the same configurations but different random seeds, and conduct MI attacks to recover 5 images per class. The mean and standard deviation of each metric are then reported across runs.
4.2 Experimental Results
Comparison with Baselines. Table presents the defense performance against GMI, KED-MI, and PLG-MI using different strategies. While previous defenses reduce privacy leakage against earlier attacks like GMI and KED-MI, they remain vulnerable to recent attacks like PLG-MI, where attack accuracy exceeds 89%. Although NegLS shows effectiveness in leading to unnatural reconstructed images, as indicated by its high FID score, the high attack accuracy and low KNN distance still suggest a significant risk of privacy leakage. contrast, Trap-MID outperforms existing methods, reducing attack accuracy to below 10%. Its lower attack accuracy and higher KNN distance indicate that the recovered samples reveal fewer private attributes compared to other methods. Furthermore, Trap-MID provides higher comparable FID to NegLS, demonstrating its ability to cause unnatural recoverics. Furthermore, since PLG-MI explicitly separates the latent space for different classes, becomes more susceptible learning our class-wise triggers, resulting in worse attack performance than KED-MI. Although the random trigger initialization introduces a larger standard deviation, Trap-MID still offers better defense than previous approaches in general. Appendix E.. shows that even in the worst case, Trap-MID exceeds the best-case performance of existing methods against most attacks.
In addition, previous works have shown that since student models do not observe the teacher's behavior triggered samples during KD, this process serve countermeasure against

---

Table 2: Defense comparison against LOMMA 7 using VGG-16 models.
Defense
Acc
AA-1
AA-5 4
KNN Dist
FID 1
LOMMA (GMI)
86.21 + 0.91
67.60 + 4.72
88,96 3.011
1414.00 + 32.66
38.94 0.60
MID
77.89 + 0.70
53.48
+
79.50 2.26
1502.23 + 25.05
42.06 0.60
BiDO
78.97 + 0.44
53.89
3.79
+
1479.35 + 23.97
37.94 0.57
NegLS
81.99 = 0.45
48,90 = 0.46
73.74 1.31
1430.33 = 4.73
38.68
0.56
Trap-MID
81.37 = 1.04
41.63 = 2.28
68.24 + 2.60
1569.92 = 19.74
39.29 2.14
LOMMA (KED-MI)
86.21 = 0.91
79.47 = 3.95
95.16 = 1.41
1279.48 = 30.58
22.70 = 1.14
MID
77.89 1.89=0070 0.70
6..72
90.48 + 2.55
1351.04 + 36.69
22.62 1.14
BiDO
78.97 = 0.44
13.56+2..6
86.48 + 1.74
1360.75 = 24.68
24.37
1.60
Ne
81.99 + 0.45
77.67 = 1.43
94.32 1.07
1280.84 + 11.71
38.66
1.88
Trap-MID
81.37 + 1.04
61.25 1 5.71
85.76
3.73
1404.77 = 40.25
24.19
2.21
Privato
Upprotcted
MIDI
8000
S
Tmap MID
Figure Reconstructed images from PLG-MI.
backdoor attacks [35 36). Therefore, LOMMA, which leverages KD model augmentation, can inherently challenge TraD-MID. However, as shown in Table Trap-MID still outperforms existing defenses against LOMMA. Moreover, Appendix E.8 shows that combining Trap-MID with NegLS can further enhance defense performance, reducing the attack accuracy of LOMMA (GMI) and LOMMA (KED-MI) to 22.80% and 42.47%, respectively. This suggests Trap-MID strategy to existing methods and shows the potential developing a hybrid approach to prompt stronger defense and improve robustness against specific adaptive attacks.
orthogonal
Figure depicts the reconstructed images from PLG-MI. This ofate-of-the-ar attack successfully recovers realistic images resembling private data from unprotected, MID, or BiDO models. Although NegLS makes the attacks generate unnatural images, the reconstructions still reveal some private attributes, such genders, skin tones, hairstyles, etc. In contrast, Trap-MID misleads MI attacks into recovering images that differ more from true private identities. Identity 1 display different skin tones, those for Identity 2 and have altered hairstyles, and those for Identity 4 exhibit a gender change. Additionally, since the reconstructed images still appear realistic, the adversary is less likely to notice our defense mechanism compared NegLS. More examples of recovered samples, as well as results from other MI attacks, can be found in Appendix
instance, the recovered images for
Synthetic Distribution Analysis According to the hypothesis illustrated in Figure and Theo- rem [ if we can create a triggered distribution close enough to the auxiliary distribution, the attacker's generator would be trapped in this shorteut and fail to explore private information, leading synthetic distribution more similar to the public dataset.
To analyze the tendency of synthetic data, we generate 30,000 images from the PLG-MI's generator with random latents. Subsequently, we estimate whether the nearest neighbor of each generated sample belongs the public private dataset, measured by the l2 distance between the evaluation

---

Table 3: Synthetic distribution analysis.
Nearest Neighbor (%)
Attack
Defense
Acc
AA-1 4
Public f
Private
GMI*
73.50
26.50
86.21
0.91
95.81
1.63
23.39 + 4.27
76,61 + 4.27
MID
77.89 + 0.70
92.72
1.64
35.19 + 3.51
64.81
3.51
PLG-MI
BiDO
78.97 + 0.44
89.18
+ 1.59
28.99
+ 3.14
71.01
+ 3.14
NegLS
81.99
0.45
89.38
3.35
22.36
4.16
77.64
4.16
Trap-MID
81.37 + 1.04
6.23
5.60
70.33
0.40
29.67
+ 0.40
The generator is trained independently from target model.
Privatc Data
P.G MI Recall 68% AUC-06639%
L-Vi ottacks D5R 89%s, AUC-6604489 80.46%
L-2 attocks DSR=69 26% AUC-88.01%
Taiing Genn
Pablic
Rusiing
Ckan
0.2.
9.
U.8
22
de
10 60
do
0.4
Similanity
Similaityy
Sigraturr
Figure 3: Illustration of trapdoor detection.
model's penultimate outputs. Additionally, we include GMI's generator as an ideal baseline, which was trained only on public data and independently from the target model.
According to Table while PLG-MI can produce synthetic distribution resembling the private dataset from existing defenses, the distribution becomes closer the public data when attacking Trap-MID. Furthermore, the similar tendency to GMII' generator indicates that the attacks fail to extract meaningful information from the protected models.
Trapdoor Recovery Analysis. To verify the effectiveness of Trap-MID in misleading MI attacks, assess the presence of trapdoor triggers in the recovered images using detection method in [20]. We first compute the "trapdoor signatures" by averaging the penultimate outputs of poisoned images
for each target class:
- Ex=x (TI,
(6)
where go Rdd - R.d. represents the feature extractor of the target model fo- After that, calculate the cosine similarities between benign images and the corresponding trapdoor signature cos(go(X), where is the predicted label of the input. The threshold is then set to be the tth percentile with the desired false positive rate (FPR) exceeding the threshold are considered triggered. In this paper, we decide the threshold to achieve desired FPR of 5%. In addition, since computing each signature with the entire training dataset is computationally expensive, we randomly sample the target label for each training data to estimate the signatures.
A and the input data with similarity
As shown in Figure 3 78.68% of reconstructed images from PLG-MI are reported to be triggered images, indicating that the MI attacks are misled into extracting trapdoor information. Appendix E.6 presents the analysis of other MI attacks.
Adversarial Detection. As Shan et al. 120 showed that integrating trapdoors into the model can help detect adversarial attacks, we also assess the effectiveness of Trap-MID in detecting adversarial examples. We utilize AutoAttack 337 and apply the same detection method in the trapdoor recovery analysis. As depicted Figure 3 Trap-MID achieves a detection success rate (DSR) of over 78% on both 1 (e = 8/255) and l2 (e 0.5) attacks, while maintaining privacy preservation.

---

Table 4: Adaptive attacks against Trap-MID, using VGG-16 models.
Aux. Data
Attack
AA-1 +
AA-5 +
KNN Dist 1
FID 1
PLG-MI
6.23 + 5.60
13.15 10.30
2055.96 147.67
57.82 23.41
CelebA
PLG-MI++
70.44 + 35.16
78.14 + 36.71
1399.84 + 382.13
27.17 + 18.03
PLG-MI
0.86 + 0.39
2.85 + 1.27
2227.09 + 59.16
94.57 + 13.41
FFHQ
PLG-MI++
31.03 + 22.76
44.09 + 29.77
1789.95 324.38
38.98 31.94
Adaptive Attacks. We further explore under what circumstances the adversary will break Trap- MID, Here we consider challenging scenario: The adversary has access to the trapdoor signatures used in the previous trapdoor recovery analysis. We modify PLG-MI to conduct adaptive attacks, denoted by PLG-MI+++ Appendix B.7 demonstrates the scenario where the adversary only knows the existence of trapdoors without information about trapdoor signatures.
In adaptive attacks, the adversary may encourage generated images to deviate from trapdoor signatures and resemble benign public distribution by modifying the generator objective:
LG+ LG - -axx By (8)
Zz [cos(ge (Tanuck (Tan Syl
+ My (V) E Zz [gos(ge (Tanuck
where Paux Paux(Y) (Y) denotes the auxiliary distribution of pscudo-labels assigned by PLG-MI's selection strategy, Pc(Z) (Z) is the generator's latent distribution, LG is the original generator loss, G Rd Rd= the generator, Tamac Rd Rd= is the random image augmentation used in attacks, ý is the predicted label of the generated image G(Z,Y), and Amux Auap are the weighting parameters. We set Auux Auap 10, as we found generally provides better attack performance. Saxx,y the auxiliary signature of the target class y, computed from public samples:
Smux,y = (x)) [go (X)},
(8)
In the latent searching stage, signature- based losses are also added the inversion loss.
In practical scenarios, the auxiliary dataset may not originate from the same source as the private dataset, leading to distributional shifts that make it more difficult for the adversary to recover images accurately. To demonstrate this case, we also include the experiments with FFHQ (38] as the auxiliary dataset. Appendix [E.5 presents more experiments about distributional shifts, where PLG-MI still achieves 89% attack accuracy on the unprotected model.
While T stronger attack results from this adaptation, Trap-MII remains superior to all baseline methods. Additionally, when distributional shifts occur in the auxiliary dataset, the attack performance against Trap-MID degrades significantly. This suggests that the success of MI attacks against Trap-MID, even with adaptive modifications, relies heavily on the similarity between the auxiliary and private data. Intuitively, distributional shifts make it more challenging extract private data, thereby making trapdoors more attractive as targets and enhancing the defense's effectiveness.
5
Conclusion
MI attacks pose significant privacy risks DNNs' training datasets. Despite existing defense efforts, recent attacks continue to exploit vulnerabilities in these defenses. In this study, we pioneer the exploration of the relationship between trapdoor injection and MI defense, introducing trapdoor- based framework, Trap-MID, to mislead MI attacks into extracting trapdoor information instead of private data. Through theoretical analysis and empirical experiments, we demonstrate the ability of Trap-MID to mitigate wide range of MI attacks and detect adversarial examples, providing overall security. Notably, Trap-MID achieves these results without the need for shadow attacks or extra datasets, making it both computationally and data-efficient.
10

---

Acknowledgments and Disclosure of Funding
This work was supported in part by the National Science and Technology Council under Grants NSTC 112-263--F-002-000 MOST NSTC 1--2222--E-002000-MMY NSTC 33-2634-F-002-00--M-- and by the Center of Data Intelligence: Technologies, Applications, and Systems, National Taiwan University under Grant NTU-113L900003.
NSTC 105-2222-EE002-004---22-
References
[1] Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In 23rd USENIX security symposium (USENIX Security 14), pages 17-32, 2014.
[2] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322-1333, 2015.
[3] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 253-261, 2020.
[4] Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. Advances in Neural Information Processing Systems, 34: 9706-9719, 2021.
[5] Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference computer vision, pages 16178-16187, 2021.
[6] Lukas Struppek, Dominik Hintersdorf, Antonio De Almeida Correira, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In International Conference on Machine Learning, pages 20522-20545. PMLR, 2022.
[7] Ngoc-Bao Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 16384-16393, 2023.
(8] Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo label-guided model inversion attack via conditional generative adversarial network. AAAI 2023, 2023.
[9] Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity. In Proceedings of the 29th Network and Distributed System Security Symposium, 2022.
[10] Gyojin Han, Jaehyun Choi, Haeil Lee, and Junmo Kim. Reinforcement learning-basee based black- box model inversion attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20504-20515 2023.
[11] Mostafa Kahla, Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 15045-15053, 2022.
[12] Ziqi Yang, Jiyi Zhang, Fe-Chien Chang, and Zhenkai Liang. Neural network inversion in adversarial setting via background knowledge alignment. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 225-240, 2019.
[13] Rongke Liu, Dong Wang, Yizhi Ren, Zhen Wang, Kaitian Guo, Qiangian Qin, and Xiaolei Liu. Unstoppable attack: Label-only model inversion via conditional diffusion model. IEEE Transactions Information Forensics and Security, 2024.
11

---

[14] Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual information regularization. Proceedings of the AAAI Conference on Artificial Intelligence, 35(13): 100:111666611111 11673, 2021.
[15] Xiong Peng, Feng Liu, Jingfeng Zhang. Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1358-1367, 2022.
[16] Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting, Be careful what you smooth for: Label smoothing can be privacy shield but also catalyst for model inversion attacks. In The Twelfih International Conference on Learning Representations, 2024. URL https
//openreview
[17] Xueluan Gong, Ziyao Wang, Yanjiao Chen, Qian Wang, Cong Wang, and Chao Shen. Netguard: Protecting commercial web apis from model inversion attacks using gan gan-generated fake samples. In Proceedings of the ACM Web Conference 2023, pages 2045 2053, 2023.
[18] Xueluan Gong, Ziyao Wang, Shuaike Li, Yanjiao Chen, and Qian Wang. A gan-based defense framework against model inversion attacks. IEEE Transactions on Information Forensics and Security, 2023.
[19] Si Chen, Nikhil Abhyankar, Feiyang Kang, Ming Jin, and Ruoxi Jia. Data-centric defense: Shaping loss landscape with augmentations to counter model inversion. In DMLR Workshop at the 40th International Conference on Machine Learning, 2023.
[20] Shawn Shan, Emily Wenger, Bolun Wang, Bo Li, Haitao Zheng, and Ben Y Zhao. Gotta catch'em em all: Using honeypots catch adversarial attacks on neural networks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 67-83, 2020.
[21] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 81 31108811 19, 2020.
[22] Sy-Tuyen Ho, Koh Jun Hao, Keshigeyan Chandrasegaran, Ngoc-Bao Nguyen, and Ngai-Man Cheung. Model inversion robustness: Can transfer learning help? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12183-12193, 2024.
[23] Jun Hao Koh, Sy-Tuyen Ho, Ngoc-Bao Nguyen, and Ngai-man Cheung. On the vulnerability of skip connections to model inversion attacks. In European Conference on Computer Vision Springer, 2024.
[24] Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang. Defending model inversion and membership inference attacks via prediction purification. arXiv preprint 3xXv::2005.03915 2020.
[25] Jing Wen, Siu-Ming Yiu, and Lucas CK Hui. Defending against model inversion attack by adversarial examples. In 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pages 551-556. IEEE, 2021.
[26] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions Neural Networks and Learning Systems, 2022.
[27] Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprini 06X1v:2004.04662, 2020.
[28] Han Qiu, Zeng. Shangwei Guo, Tianwei Zhang, Meikang Qiu, and Bhavani Thuraisingham. Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmen- tation. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pages 363-377, 2021.
12

---

[29] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. 2017.
[30] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference computer vision, pages 3730-3738, 2015.
[31] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for scale image recognition. arXiv preprint arXiv: 1556, 2014.
[32] Yu Cheng, Jian Zhao, Zhecan Wang, Yan Xu, Karlekar Jayashree, Shengmei Shen, and Jiashi Feng. Know you one glance: A compact vector representation for low-shot learning. In Proceedings of the IEEE international conference on computer vision workshops, pages 1924- 1932, 2017.
[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 770-778, 2016.
[34] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[35] Kota Yoshida and Takeshi Fujino. Countermeasure against backdoor attack neural networks utilizing knowledge distillation. Journal of Signal Processing, 24(4):141-144, 2020.
[36] Kota Yoshida and Takeshi Fujino. Disabling backdoor and identifying poison data by using knowledge distillation backdoor attacks on deep neural networks. In Proceedings of the 13th ACM workshop on artificial intelligence and security, pages 117-127, 2020.
[37] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning. pages 1200-2216 PMLR, 2020.
[38] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401-4410, 2019.
[39] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 4690-4699, 2019.
[40] Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, al. Iarpa janus benchmark-c: Face dataset and protocol. In 2018 international conference on biometrics (ICB), pages 158-165. IEEE, 2018
[41] Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb- Im: A dataset and benchmark for large-scale face recognition. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part III 14, pages 87-102. Springer, 2016.
[42] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zhigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEFE conference on computer vision and pattern recognition, pages 2818-2822 2016.
[43] Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 815-823, 2015.
[44] Tuomas Kynkäänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models. Advances neural information processing systems, 32, 2019.
13

---

[45] Muhammad Ferjad Naeem, Scong Joon Oh, Youngjung Uh. Yunjey Choi, and Jaejun Yoo. Reliable fidelity and diversity metrics for generative models, In International Conference on Machine Learning, pages 7176-7185. PMLR, 2020.
[46] Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R Manmatha, et al. Resnest: Split-attention networks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 2736-2746, 2022.
[47] Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700-4708, 2017.
14

---

A Broader Impacts, Limitations, and Future Works
A.1 Broader Impacts
Deep learning has been widely employed in diverse domains and tasks. However, the growing threat of privacy breaches, such as MI attacks, poses significant risks to sensitive data used for model training. Our proposed framework, Trap-MID, offers a promising defense strategy against MI attacks by misleading their exploration directions. Empirical experiments demonstrate its state-of-the ff-the-art defense performance. Importantly, Trap-MID achieves these results without the need for additional public datasets or conducting shadow attacks, making applicable across diverse applications.
A.2
Limitations and Future Works
A.2.1 Experimental Limitations
In our empirical experiments, we did not exhaust hyper-parameter tuning via grid search due to the computational constraints. While we found that the configurations in Section 4.1 generraly provide a good eccuracy-privace trade-off against various MI attacks, conducting more comprehensive hyper- parameter optimization could further improve utility and defense performance. Ablation studies exploring the impact of different dyper-parametes settings are discussed in Appendix D Although we did not include the experiments against all MI attacks due to computational requirements, we verified the efficacy of Trap-MID against various white-box attacks [ 5 and label-only attack 11 and high- high-resolution scenarios 6 These results suggest
[]]] in both low rew-uusotttoon 3 5
that TraD-MID is effective across broad range of MI attacks.
Additionally, we recognize that the attack accuracy metric, based solely on an evaluation elassifier trained on the private dataset, may fail to detect nut-of-distributio samples, resulting in high KNN distance or FID alongside high attack accuracy. While feature-based metrics like KNN distance and FID can help identify these failures, developing universal evaluation method could better quantify both attack and defense performance, offering a more straightforward basis for comparison.
A.2.2 Further Improvements in Trap-MID Design
In this paper, demonstrate the efficacy of our trapdoor-base based framework with simple trigger design. While we conducted the model training and attacks multiple times to ensure reproducibility. acknowledge a larger variation in defense performance than previous defenses due to the randomly initialized triggers. We leave further customization for a more stable and powerful trigger for future work.
In addition, while Trap-MID is more computationally efficient than existing misleading- based defenses, it requires longer training time compared methods like MID, BiDO, and NegLS due to its three gradient updates per epoch. Developing a more efficient trigger generation process would be valuable future direction to make Trap-MID more practical for large-scale applications.
A.2.3 Exploring Different Scenarios
Despite its effectiveness, Trap-MID inherits certain assumptions and limitations from previous works. For instance, it assumes level of trust between data providers and the model owner to protect their private information [14 A promising future direction involves developing trapdoor injection methods that empower dataset owners even individual identities secure sensitive information before sharing data. Additionally, Trap-MID's 's efficacy may be limited against MI attacks involving KD, such as LOMMA, due to the inherent weaknesses of backdoor attacks. Therefore, future efforts should focus on integrating more robust trapdoors to address these limitations.
In addition, similar to previous works, used relatively simple victim models for facial recognition, trained on the CelebA dataset with cross-entropy loss. Given the advancements in facial recognition, it would be valuable to evaluate the performance of MI attacks and defenses more advanced techniques, such as ArcFace [39], or on datasets featuring more diverse poses and facial images in the wild, like IJB-C dataset 40
Finally, our research represents the first attempt to establish the connection between trapdoor injections and MI defense mechanisms. Extending this defense to different modalities, such as language, graph,
15

---

and tabular, or exploring its relationship with other reconstruction based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, presents an interesting direction for further research.
B Proof of Theorem 1
According to Definition 1 for given model f, target label y and corresponding trigger injection function (-), we have:
Proof.
Ty - Us(y)
= Ex-p(x) (ogrr - log -x - log py)
(xop(x)[oog// (xlll Exxp(X v)
2 6.
Expanding the KL divergence (xr.(((X)ll((I())) in Definition
DxL(o(X)lp((T())) = (oggp(())) - log p (IT(() <.
(10)
As result, if for all y, the trapdoor is (eff)-efeective and c-natural on the model f with injection function (.), we have:
Ey ()) u (1opx
= Ey Bx + log p (T,( - logps(V))
2 Ey- Ex Ex-xX1111087//7111X33 + 6 + [Ex-xxx/logp(X]] -c) By-p(>)logpp)
P log (6 (c
Bxxx)1xxxxx111877x(X11 -)..
(11)
C Experimental Details
C.1 Hardware and Software Details
All experiments were conducted on an Intel Xeon Gold 6226R CPU with an NVIDIA RTX A6000 GPU. The average execution time of Trap-MID training is 1 hour 15 minutes with standard devia- tion of 13 seconds. Our source code is publicly available at /tttps://github com/ ntuaissab/ PraD-MID to reproduce main experiments.
C.2 Datasets
The datasets we used in our experiments are all publicly accessible, including:
CelebA. CelebA 30 comprises 202.599 facial images of 10,177 identities with coarse alignment. Following prior studies, we selected the 1,000 identities with the most samples as the private dataset, totaling 30,029 facial images. The private dataset was then divided into training and testing datasets for utility evaluation, containing 27,018 and 3,009 samples, respectively. For the auxiliary dataset used in MI attacks, disjoint subset of the CelebA dataset was sampled, which contains 30,000 images without overlapping identities with the private dataset. Images are cropped at the center and resized to 64 x 64 pixels.
FFHQ. FFHQ 38 contains 70,000 high-quality facial images with considerable variation in age, ethnieity, and background. The entire FFHQ dataset was utilized as the adversary's auxiliary dataset in the MI attacks with distributional shifts.
16

---

Algorithm Training procedure for Trap-MID
Input: Training dataset {(r4 yt )))],= classifier fo parameterized by 0, discriminator Da param- eterized é, trapdoor triggers K = {Kks ) corresponding with different classes, mini-batch size m. number of mini-batches M, learning rate a, trigger step size c, and training epoch T
Output: A trained model with privacy protection
for t < .,...,, do
for { 1, M do Sample mini-batch {a yi } from training dataset.
Sample set of target labels {ut Jim with the same size of the
- Φ- - aVLD
Equation Equation
K < K e sggn V Lrrggeer)
Clip the triggers into the range [0, 1].
0 4 0 Lo..
Equation
end for
end for
C.3 Target Models
Consistent with prior research, we trained the VGG-16 and Face.evoLVe models for 50 epochs, and the 152 models for 40 epochs. All models were trained using the SGD optimizer with a batch size of 64, learning rate of 0.01, momentum value of 0.9, and weight decay value of 0.0001.
C.4 Trap-MID
For Trap-MIID, we adopted the same hyper-parameters as the unprotected model. Algorithm D Noutlines the training process. The protected model was configured achieve trapdoor success rate exceeding 99%. Typically, we used blend ratio = 0.02 and a trapdoor loss weight B = 0.2. Trapdoor triggers were randomly initialized using uniform distribution within [0, and then updated with step size e 0.01. The discriminator was optimized with identical settings to the target classifier.
The random augmentation pipeline consisted of sequence of image transformations, including random resized crops with cropping scales sampled from [0.8, 1], horizontal flips, and random rotations with degrees sampled from [-30, Each augmentation probability of 0.5. Note that our augmentation strategy differs from that MI attacks to prevent the requirements of attack information. However, since these augmentations widely adopted across various domains, our approach still overlaps with those utilized in MI attacks.
applied randomly with
C,5 Attack Methods
We conducted MI attacks using the official implementation of GMI, KED-MI, LOMMA, and PLG- com/ LetheSec/PLae MI Attack for GMI, KED-MI, and PLG-MI attacks. For LOMMA,
MI. Specifically, we utilized the PLG-MI official code available from https:
com/ sutd- visd-visual-- visual-computing group/ Re Re-thinking During the latent searching stage, optimized the latent for 1,500 epochs in GMI, KED-MI, and LOMMA, and 600 epochs in PLG-MI.
ployed the official code available at
C.6 Baseline Defenses
MID. The protected model was trained with the MID official code provided at wttphttt:///// /ettps://githe thub com/Jiachen: -wweee---nnnnniiddeeeeeeeee
For the Face.evol.Ve and ResNet-152 models, we added the information bottleneck before the final fully connected layer, with bottleneck size of 512. The mutual information was approximated using the same variational method as the official implementation. The weight coefficient of the regularization term À was set to 0.003.
BiDO. We utilized the BiDO official code at wuthttp::/// //gi::h// com wwwm/Alaaeengo887//eee..t. to train the protected models. The models were trained with Adam optimizer, using learning rate of 0.0001 without weight decay. For Face.evo ee and ResNet- 152 models, we used the latent representations from the four major ResNet blocks to estimate the bilateral dependency. Typically,
17

---

the Hilbert-Schhie Schbett-Schmidt Independence Criterion (HSIC) was adopted as the dependency measure, as it was reported with better defense performance than the Constrained Covariance (COCO) [T]] The balancing hyper-parameters (>x,, >y) were set to (0.05, 0.5).
NegLS. Since the NegLS code was not available when we conducted our experiments, we adapted our implementation to include their negative label smoothing based on the official configuration. The models were trained for 100 epochs using the Adam optimizer with a batch size of 128 and an initial learning rate of 0.001 without weight decay. The learning rate was then multiplied by factor of 0.1 the 75th and 90th epochs. The label smoothing factor a was set to During the 51 th to the 75th epoch, a was set to be -0.05 x r-50
the first 50 epochs. 100-50" where is the current epoch.
After that, was fixed to be 0.05 for the remaining training.
C.7 Evaluation Models
An evaluation model with different architecture from the target model trained the same private dataset, acting as an additional observer to assess the success of MI attacks. We use the evaluation model from [8]. which is Face.evoLVV model [32] pre-trained on MS-CelebIM [4] and fine-tuned on the private training dataset. The evaluation model has an input resolution of 112x I 12, with the 64x64 images resized fit its input size. It achieves 95.88% accuracy on the testing dataset.
C.8 Evaluation Metries
Attack accuracy (AA). For each recovered image, we determine whether classified as the target class by the evaluation model, yielding both top-1 and top-5 attack accuracy.
K-Nearest Neighbor Distance (KNN Dist). The KNN distance calculates the shortest 22 distance from the reconstructed images to the private data in the feature space of the evaluation model. Specifically, to demonstrate the success of reconstruction, each recovered image is compared only with the private data belonging its target class.
Fréchet Inception Distance (FID). The FID is evaluated by the difference in means and covariances between the generated and real images in the feature space of Inception-v3 [42] Consistent with prior studies, we compute FID only on the successfully recovered images identified by the evaluation classifier to measure the quality and diversity of the extracted information.
D Ablation Studies
In this section, we first assess the effectiveness of TeD's trapdoor injection strategy 20 against MI attacks, and then analyze the impact of various configurations on defense performance.
Since conducting the whole experiment multiple times would be computationally expensive, without specification, we use the same evaluation protocol in previous works for the experiments in the appendices. Typically, we train a single target model for each configuration and conduct MI attacks to reconstruct 5 images per class with random initialization in the latent searching stage. The standard deviation of attack accuracy is then computed from 5 reconstruction attempts. For experiments sharing the same setups those in Section average the evaluation metrics and their standard deviations across multiple runs.
D.1 TeD's Trapdoor Injection Strategy
To verify whether TeD's protected models inherently defend against MI attacks, employ the same trapdoor injection method in [20] and leave other training setups consistent with the unprotected model. Specifically, each trapdoor trigger comprises five 6)-pixel squares randomly scattered across the image, with a blend ratio a = 0.1 or 0.2 and a trapdoor loss weight 3 = 0.5 2 The intensity of each square was sampled from A(u, o)) with uniformly sampled fu E [0, 1] and E [0, 1], and was fixed during model training. Sample poisoned images are shown in Figure 4
"The blend ratio and the trapdoor loss weight / in our paper are equivalent to the mask ratio x and the injection ratio À in (20).
18

---

TeD
Trap-MID
Figure 4: Sample poisoned images for TeD's (a = 0.1) and our trapdoor injection methods. Each column depicts a poisoned image with specific target label. The blend ratio multiplied by factor of 10 for better visualization (a and 0.2 for TeD's and our triggers, respectively).
For further comparison, we adopt the same configurations of Trap-MID, such as smaller blend ratio (a 0.02), smaller trapdoor loss weight (3 0.2), trigger optimization and data augmentation, while keeping TeD's five-square patterns. This enhanced version denoted as TeD+.
Table compares defense performances using TeD's trapdoor injection techniques. Although decreasing the blend ratio and adopting our configurations can improve defense performance, TeD models remain vulnerable to PLG-MI with their five-square patterns. In contrast, spreading the trapdoor information across all image pixels crucial for fooling stronger MI attacks. Intuitively, while TeD's s patch-based triggers fit the lx or l2 budgets in adversarial attacks (20). the resulting poisoned images appear less natural, making them more likely to be identified and penalized by the attacker's discriminator. Moreover, as TeD's triggers highly rely on local information around specific locations, they may exhibit lower robustness against spatial transformations, leading to inferior defense against PLG-MI.
19

---

Table 5: Defense comparison with TeD's trapdoors, using VGG-16 models.
Defense
Acc
AA-1
AA-5 4
KNN Dist t
FID
GMI
86.21
14.29 2.43
32.64 2.77
1798.23
31,01
TeD (a- 0.2)
85.01
10.84
2.19
26.22 + 3.09
1869.42
34.09
TeD (a- 0.1)
83.98
0
4.64 1.12
2285.70
73.25
TeD+
81.85
1.58 +
5.28 1.10
2217.72
57.55
Trap-MID#
81.37
0.24 - 0.27
1.16 - 0.62
2411.39
153.73
KED-MI
86.21
56.46 + 2.23
82.84 1.96
1404.85
17.10
TeD (a = 0.2)
85.01
47.78 2.02
73.98 + 1.78
1453.73
16.27
TeD (a 0.1)
83.98
18.64
48.80
1.95
1706.64
18.38
TeD+
81.85
19.78 1.30
39.78
2.32
1771.91
23.72
Trap-MID*
81.37
9.24
1.15
19.24
1.31
2056.00
87.39
LOMMA (GMI)
86.21
67.60
5.71
88.96 +:966:3..0 3.91
1414.00
38,94
TeD (a 0.2)
85.01
65.22
5.76
89.50 + 3.84
1428.35
39.33
TeD (a = 0.1)
83.98
53.34 5.32
80.60 4.08
1529.23
40.38
TeD+
81.85
48.96
6.23
75.40 4.79
1532.89
38.57
Trap-MID*
81.37
41.63 + 5.61
68.24 5.33
1569.92
39.29
LOMMA (KED-MI)
86.21
79.47 3.93
95.16 + 2.06
1279.48
22.70
TeD (a 0.2)
85.01
75.6244.44
93.50 2.31
1295.36
20.38
TeD (a 0.1)
83.98
73.18.4.11
93.80 2.52
1328.78
21.86
TeD+
81.85
63.72 4.48
87.50 = 3.29
1395.46
26.04
Trap-MID*
81.37
4.28 61.25
3.26 85.76
1404.77
24.19
PLG-MI
86.21
95.81 1.54
99.43 0.58
1174.13
12.77
TeD (a 0.2)
85.01
05.86+1.99
99.30 + 0.56
1163.27
12.44
TeD (a = 0.1)
83.98
03.10
98.60 + 1.13
1219.55
15.96
TeD+
81.85
90.94 + 2.26
97.90 1.24
1174.40
15,80
Trap-MID#
81.37
6.23
1.70
13.15 2.57
2055.96
57.82
The mean and standard deviation of each evaluation metric are averaged across multiple runs.
20

---

Table Defense comparison with trigger optimization. using VGG-16 models.
Defense
Acc 1
AA-1 +
AA-5 +
KNN Dist t
FID f
GMI
Trap-MII (fixed triggers)
76.03
0.12 + 0.23
0.36 + 0.42
2507.48
141.77
Trapdoor loss
83.38
0.04 + 0.11
0.44 + 0.40
2481.64
186.14
Discriminator**
81.37
0.24 + 0.27
1.16 + 0.62
2411.39
153.73
KED-MI
Trap-MII (fixed triggers)
76.03
0.08 + 0.22
0.74 + 0.51
2397.43
269.08
Trapdoor loss
83.38
0.50 + 0.36
1.72 0.75
2339.31
96.66
Discriminator*
81.37
9.24 = 1.15
19.24 = 1.31
2056.00
87.39
LOMMA (GMI)
Trap-MID (fixed triggers)
76,03
39.94
4.95
66.40
5.90
1592.95
41.86
+ Trapdoor loss
83.38
41.54 + 5.57
67.00 + 4.17
1581.92
41.82
Discriminator*
81.37
41.63
5.61
68.24
5.33
1569.92
39.29
LOMMA (KED-MI)
Trap-MID (fixed triggers)
76.03
48.72 + 4.61
77.30 = 3.57
1471.80
27.59
Trapdoor loss
83.38
63.62 4.36
87.60
3.40
1393.89
24.19
Discriminator*
81.37
61.25 + 4.28
85.76 + 3.26
1404.77
24.19
PLG-MI
TrDp-MID (fixed triggers)
76.03
90.92 2.36
97.78
1.24
1182.63
17.03
Trapdoor loss
83.38
89.44 + 2.20
97.56 + 1.06
1258.22 2055.96
18.57
Discriminator*
81.37
6.23 1.70
13.15 2.57
57.82
The mean and standard deviation of each evaluation metric are averaged across multiple runs.
D.2 Trigger Optimization
Table demonstrates the impact of trigger optimization. Fixed triggers generally preserve privacy against most MI attacks, except for PLG-MI, but result in a noticeable accuracy reduction. In contrast, the influence of trapdoor loss and discriminator loss varies based on the capacity of the GAN used in the attacks.
Trapdoor loss. reducing accuracy drop. However, these crafted adversarial-lie triggers may be more difficult to generate, resulting in lower defense performance against attacks using weaker generators like GMI, KED-MI, and LOMMA.
Incorporating trapdoor loss can create easily learnable triggers for the target model,
Discriminator loss. Discriminator loss promotes invisible triggers, which are crucial for deceiving attacks with stronger discriminators, such as PLG-MI. However, generating invisible triggers requires fine-grain adjustments, making them less effective against attacks using weaker generators.
21

---

Table 7: Defense comparison with different blend ratios, using VGG-16 models.
Defense
Acc f
AA-1 +
AA-5
KNN Dist
FID
GMI
Trap-MID (a 0.1)
83.18
1.36 + 0.81
4.58 + 1.44
2223.08
62.26
Trap-MIID (a 0.05)
84.14
0.52 + 0.38
1.72 + 0.65
2413.40
113.84
Trap-MIID (a -0.03)
83.08
0.10 +
0.58 +
2470.07
136.72
Trap-MID (a 0.02)*
81.37
0.24 + 0.27
1.16 + 0.62
2411.39
153.73
KED-MI
Trap-MII (a 0.1)
83.18
34.54 4: 63.22 +:
1537.62
19.29
Trap-MID (a 0.05)
84.14
35.06 + 1.95
60.38 + 2.28
1594.44
23.23
Trap-MID (a -0.03)
83.08
6.04 + 1.29
12.66 + 1.28
2111.42
66.57
Trap-MID (a 0.02)
81.37
9.24 + 1.15 19.24 + 1.31
2056.00
87.39
LOMMA (GMI)
Trap-MID (a 0.1)
83.18
50.54 5.77
76.00
4.63
1513.98
33.46
Trap-MIID (a 0.05)
84.14
39.30 5.76
66.40 5.93
1588.70
38.88
Trap-MII (a -..3))
83.08
36.62 + 5.51
65.10
4.81
1614.48
40.71
Trap-MID (a 0.02)
81.37
41.63 + 5.61
68.24
5.33
1569.92
39.29
LOMMA (KED-MI)
Trap-MID (a 0.1)
83.18
70.22
4.53
89.70
1344.36
23.01
Trap-MID (a 0.05)
84.14
71.14
3.81
91.20
3.01
1327.49
24.53
Trap-MID (a -0.03)
83.08
65.46
+ 4.28
88.50 2.70
1404.52
25.43
Trap-MID (a = -.02)*
81.37
61.25 + 4.28
85.76 3.26
1404.77
24.19
PLG-MI
Trap-MID (a 0.1)
83.18
89.40 + 2.03
97.20 + 1.35
1219.49
18.49
Trap-MID (a 0.05)
84.14
93.86 + 1.93
98.94 + 0.83
1187.61
13.67
Trap-MID (a -0.03)
83.08
1.92 +
5.48 +
2185.82
60.35
Trap-MID (a = =0.02)*
81.37
6.23 + 1.70
13.15
+: 2.57
2055.96
57.82
* mean standard deviation each evaluation metric are averaged across multiple runs.
D.3
Blend Ratio
In this section, we tune the blend ratio a within [0.02, 0.1] and compare the defense performance. As shown in Table 7 decreasing the blend ratio generally makes the trapdoor triggers more invisible and improves defense performance. Notably, there is a sharp drop in attack accuracy. For instance, PLG-MI's attack accuracy drops from 93.86% to 1.92% when the blend ratio is reduced from 0.05 to 0.03, suggesting that an adequately invisible trigger crucial for misleading certain attacks. In terms of model utility, Trap-MID is relatively insensitive to the blend ratio, maintaining about 81-84% testing accuracy across different configurations, demonstrating its effectiveness without significant accuracy loss.
22

---

Table 8: Defense comparison with different trapdoor loss weight, using VGG-16 16 models.
Defense
Acc t
AA-1 +
AA-5
KNN Dist t FID t
GMI
86.21
14.29
2.43
32.64 2.77
1798.23
31.01
Trap-MIID (3 = 0.02)
84.01
0.10 = 0.19
0.62 = 0.55
2448.06
203.41
Trap-MIID (3 0.05)
81.15
0.30 0.30
1.20
2389.23
120.15
Trap-MID (3 0.1)
82.55
0.58 0.55
2.36 0.93
2313.73
104.30
Trap-MID (3 = 0.2)*
81.37
0.24 = 0.27
1.16 = 0.62
2411.39
153.73
KED-MI
86.21
56,46 = 2.23
82.84 = 1.96
1404.85
17.10
Trap-MID (3 = 0.02)
84.01
10.78 0.91
23.84 = 1.90
1925.00
34.42
Trap-MID (3 0.05)
81.15
5.84 =
14.16 1.48
1979.30
62.55
Trap-MII (3 0.1)
82.55
20.54 2.20
41.22
1.57
1681.44
23.04
MIDD (3 0.2)*
81.37
9.24 1.15
19.24 = 1.31
2056.00
87.39
LOMMA (GMI)
86.21
67.60 5.71
88.96 3.91
1414.00
38.94
Trap-MID (3 0.02)
84.01
44.46 6.25
74.50 5.74
1549.12
39.81
Trap-MID (3 = 0.05)
81.15
42.42
70.10
5.79
1569.07
36.18
Trap-MID (3 0.1)
82.55
08.84=5.9
75.00 = 4.73
1516.63
35.87
Trap-MID (3 = 0.2)*
81.37
41.63 5.61
68.24 5.33
1569.92
39.29
LOMMA (KED-MI)
86.21
79,47 = 3.93
95.16 = 2.06
1279.48
22.70
Trap-MID (3 0.02)
84.01
71.52 3.76
91.70
1347.84
27.79
Trap-MID (8 0.05)
81.15
58.76 1.66 4.43
85.30 3.46
1424.57
28.93
Trap-MID (3 0.1)
82.55
69.16 4.07
90.20 = 2.76
1359.77
22.28
Trap-MID (3 0.2)*
81.37
61.25 = 4.28
85.76 3.26
1404.77
24.19
PLG-MI
86.21
95.81 1.54
99.43 = 0.58
1174.13
12.77
Trap-MID (3 0.02)
84.01
23.84 3.54
38.72 = 3.58
1736.19
29.96
Trap-MID (3 = 0.05)
81.15
30.30 3.28
50.52 4.00
1665.16
18.66
Trap-MID (8 0.1)
82.55
10.46 2.12
21.74 + 2.79
1937.55
28.84
TrID-MID (3 = 0.2)*
81.37
6.23 1.70
13.15 2.57
2055.96
57.82
The mean and standard deviation of each evaluation metric are averaged across multiple runs.
D.4
Loss Weight
Table illustrates the impact of the trapdoor loss weight. In general, A larger weight prioritizes learning trapdoor behavior over the main task, enhancing defense the cost accuracy and leading accuracy-privacy trade-off. Notably, Trap-MID achieves privacy protection without significant accuracy drop, with testing accuracy decreasing from 86.21% % to 81.37% when the trapdoor loss weight is increased to 0.2. Moreover, relatively low weight (e.g., 8 0.02) is sufficient to reduce the performance of most MI attacks. For example, the top-1 attack accuracy drops from 56.46% to 18% against KED-MI, and from 95.8 81% % 23.84% against PLG-MI.
23

---

2300
66
2300
08
300
ASTACC Ay
Figure 5: Defense comparison with different augmentation against PLG-MI, using VGG-16 16 models.
2300
66-
2300
40-
300
Acuuntyy 9611
Atack Accenay ti
Absok Acouirry 5 7h1
VWV Cok
PD
Figure 6: Defense comparison with different augmentation probabilities against PLG-MI, using VGG-16 models.
D.5 Augmentation
This section investigates the impact of augmentations used in model training. Since we noticed that weak augmentation lead unstable defense performance, evaluation protocols as in Section 4. jn this section. Moreover, the mean and standard deviation of each metric were estimated after removing outliers by the IQR method due to large variation.
employed the same 5-run
F shows the defense performance against PI.G-M with different numbers of augmentations. Typically, we started from defense without augmentation and incrementally added random resized crop, random rotation, and horizontal flip. Although protected models with fewer augmentations can sometimes reduce attack performance significantly, they remain vulnerable to PLG-MI in most runs. Intuitively, augmentation helps identify and address the trapdoor's 's weaknesses in terms of transformation robustness. While it is possible to randomly sample and optimize a robust trigger with weak augmentations, stronger augmentations are more effective at detecting these weaknesses comprehensively, resulting in more stable and improved defense performance.
In addition, to verify whether applying augmentation more frequently can enhance the defense, we increased the probability of applying transformation from 50% to 87.5% using only random resized crop. As Figure demoostttsss, even with a single augmentation, applying frequently can reveal more trapdoors' weaknesses and improve the defense performance of protected models.
24

---

Table Training time comparison, using VGG-16 models.
Defense
Training Time +
15 mins
MID BiDO
15 mins
16 mins
NegLS
35 mins
Trap-MID
hour 15 mins
Table 10: The worst-case performance of Trap-MID compared to the best-case performance of existing defenses, using VGG-16 models.
Attack
Defense
Acc
AA-1 +
AA-5
KNN Dist
FID 1
BiDO (best)
78.32
4.42
12.94
2036.78
47.55
GMI
Trap-MII (worst)
79.39
0.56
2.46
2280.19
75.16
NegLS (best)
81.79
29.64
57.28
1544.90
47.31
KED-MI
Trap-MID (worst)
81.55
23.80
46.58
1665.86
21.23
LOMMA
NegLS (best)
81.79
48.58
75.80
1423.78
38.27
(GMI)
Trap-MIID (worst)
81.55
44.80
72.60
1535.01
35.47
LOMMA
MID (best)
76.67
59.18
86.30
1413.53
24.55
(KED-MI)
Trap-MIID MID (worst)
81.55
69.32
90.90
1333.36
20.95
NegLS (best)
81.79
83,84
96.58
1495.23
73.45
PLG-MI
Trap-MID (worst)
79.39
15.72
30.98
1843.42
36.91
E Additional Experimental Results
E.1 Training Time Comparison
Table presents the training time for various defense methods. While Trap-MID requires the longest time due to its three gradient updates per epoch for the discriminator, triggers, and target model, it is worth noting that it significantly outperforms other defenses against recent MI attacks. Furthermore, Trap-MID still requires less data and computational resources compared to existing misleading- based defenses, eliminating the need for an additional dataset, training an extra classifier, or executing shadow attacks.
We believe that enhancing the efficiency of trigger generation would valuable future direction, making Trap-MID more practical for large-scale applications. For example, pre-computing triggers with fewer steps may reduce overhead during model training.
E.2 Worst-case Performance of Trap-MID
In prior experiments, the randomly initialized triggers in Trap-MID introduced variability in de- fense performance, resulting in a larger standard deviation. This section highlights the worst-case performance of Trap-MID compared to the best-case performance of existing defenses in terms of top-1 attack accuracy. As shown in Table [O] the worst-case performance of Trap-MID surpasses the best-case performance of existing methods against most attacks, demonstrating its effectiveness.
E.3 Additional Evaluation Metrics
This section further compares the defense performance with additional evaluation metrics used by and (6], including:
25

---

Table 11: Defense comparison against PLG-MI, using VGG-16 models and measuring with additional
evaluation metrics.
Defense
Acc 1
òface f
Precision +
Recall
Density +
Coverage |
87.83
0.6110
19.39
13.17 17.17
0.0893
0.1498
MID
76.67
0.6410
21.25
33.96
0.0913
0.1734
BiDO
79.62
0.7058
20.17
10.17
0,0807
0.1362
NegLS 81.76
0.7587
3.80
0.00
0.0244
0.0189
Trap-MII
81.62
1.3845
9.56
71.63
0.0328
0.0728
KNN Distance in the FaceNet + Feature Space (Ōtace). This metric estimates the FaceNet feature distance between each recovered image and the nearest private data. A higher value indicates less similarity the private data.
Improved Precision 44] This metric assesses whether each recovered image lies within the manifold of private data the Inception feature space. lower value signifies less similarity to the private data.
Improved Recall [4). This evaluates whether each private image is encompassed within manifold of recovered data in the Inception V3 feature space. A lower value suggests that the generator less likely to reproduce private data.
Density [45]. This metric quantifies how many private-sampa neighborhood spheres contain each recovered image the Inception feature space. A lower value indicates less similarity to the private data.
Coverage 45).
This assesses how many private samples have a neighborhood sphere that contains at least one recovered image in the Inception feature space. A lower value suggests that the generator less likely to reproduce private data.
As shown in Table II Trap-MID outperforms existing defenses in FaceNet distance and ranks second NegLS in most other metrics. For the improved recall metrics, since arbitrary images with injected triggers can be classified into corresponding classes, the recovered samples become more diverse, leading to broader manifold and a higher recall value. Additionally, all metrics, except for FaceNet distance, utilize the same Inception V3 model as FID. This gives NegLS an advantage in these metrics due to less natural recovered images.
E.4 Defense Performance on Different Architectures
In this section, we present the defense comparison on the Face.evoLVe and ResNet-152 models. As shown in Table and Table [3] Trap-MID consistently outperforms existing defenses on both Veee and ResNet- 152 models.
26

---

Table 12: Defense comparison Face.evoLVe models.
Attack
Defense
Acc f
AA-1
AA-5
KNN Dist f
FID 1
88.50
24.00 + 2.86
44.22 + 2.64
1712.33
27.52
MID
83.82
18.02 + 2.16
36.52 2.30
1774.98
28.82
GMI
BiDO
88.07
14.56 1.44
34.02 1:21
1809.92
33.63
NegLS
84.68
8.94 1.86
24.08 1.97
1774.46
33,82
Trap-MID
86.04
0.06 0.15
0.52 0.48
2471.01
180.65
88.50
76.88 +
94.42
1290.48
16.24
MID
83.82
73.70 2.26
92.34 1.06
1295.08
19.27
KED-MI
BiDO
88.07
63.48 2.13
86.92 1.76
1317.48
17.71
NegLS
84.68
49.08 2.77
77.96 1.49
1413.04
25.70
Trap-MID
86.04
0.42 0.33
1.40 0.49
2303.75
98.05
88.50
84.24 4.65
96.00 1 2.43
1298.44
40.94
MID
83.82
71.06 5.35
90.00 3.33
1381.04
40.52
LOMMA (GMI)
BiDO
88.07
83.76 4.008
96.60 2.43
1262.28
41.73
NegLSS
84.68
67.34
87.40 3.85
1302.95
38.68
Trap-MID
86.04
45.36 6.31
5.28 71.10
1554.08
41.14
88.50
89.82 2.83
99.10 + 1.18
1221.43
33.22
MID
83.82
83.58 3.0.2
97.10 1.46
1221.44
22.76
LOMMA (KED-MI)
BiDO
88.07
86.28+3.2
97.90 1.50
1178.54
22.44
NegLS
84.68
92.16
9.910
1155.51
34.28
Trap-MID
86.04
62.24 4.50
87.20 2.68
1383.58
23.88
88.50
99.62 0.65
99.94+0.22
1076.28
16.57
MID
83.82
97.84 + 1.10
99.58 + 0.62
1051.97
13.29
PLG-MI
BiDO
88.07
99.68 0.45
99.92 0.28
991.42
19.46
NegLS
84.68
97.30
99.74
1430.69
95.85
Trap-MID
86.04
4.80
12.86 2.56
1971.50
47.46
27

---

Table 13: Defense comparison ResNet- models.
Attack
Defense
Acc f
AA-1
AA-5
KNN Dist f
FID 1
91.16
26.74
2.80
48.94 3.11
1681.49
28.20
MID
91.29
34.72 2.38
56.56 2.26
1583.22
27.53
GMI
BiDO
90.06
25.16 2.04
46.64
1738.49
32.66
NegLS
83.93
8.20 + 1.40
23.62 3.19
1790.67
36.79
Trap-MID
87.23
0.06 - 0.14
0.52 1 0.40
2475.04
165.47
91.16
74.50
93.66 1.70
1288.24
16.39
MID
91.29
88.70 +
98.08 0.48
1127.35
17.14
KED-MI
BiDO
90.06
67.46 1.66:11.
88.96 1.43
1.43
1275.67
18.83
NegLS
83.93
37.92 2.77
67.18 2.76
1481.29
32.18
Trap-MID
87.23
0.58 0.32
2.08 0.63
2266.56
84.31
91.16
83.02
4.51
96.10 2.64
1313.64
41.48
MID
91.29
86.98 1 3.93
97.30 2.35
1219.14
42.10
LOMMA (GMI)
BiDO
90.06
65.96 5.52
86.90 4
1416.01
49.36
NegLSS
83.93
65.80 6.16
86.00 4.55
1322.77
37.84
Trap-MID
87.23
45.70 + 6.01
4.47 73.30
1571.89
43.66
91.16
90.22 +.25
98.20 +00+1 1.20
1185.15
22.27
MID
91.29
95.64 2.19
99.90 0.52
1068.47
23.47
LOMMA (KED-MI)
BiDO
90.06
70.86 4.64
91.30 2.65
1293.13
25.03
NegLS
83,93
3.444
98.10 1.23
1208.54
36.68
Trap-MID
87.23
+
91.80 + 2.78
1370.98
23.36
91.16
99.34
99.82 0.37
1025.51
16.12
MID
91.29
99.76
99.84 + 0.37
853.88
21.20
PLG-MI
BiDO
90.06
9..90
99.62 0.64
1042.27
28.48
NegLS
83.93
94,82 0.64
1398.07
117.98
Trap-MID
87.23
3.56 1.38
11.16 + 2.58
2016.62
73.84
28

---

Table 14: Defense comparison against PLG-MI with FFHQ dataset, using VGG-16 models.
Defense
Acc
AA-1
AA-5
KNN Dist t
FID f
87.83
89.22 1.60
97.72
0.51
1278.05
18.36
MID
76.67
66.06 4.17
87.54 + 2.46
1371.81
15.75
BiDO
79.62
64.30 3.48
86.00 2.42
1416.98
18.37
NegLS
81.76
78.12 = 1.13
92.60 - 0.78
1506.23
109.67
Trap-MID+ 81.62
0.86 0.83
2.85 1.31
2227.09
94.57
The mcan and standard deviation of cach evaluation metric are averaged across multiple runs.
[91 /hccat112.255 2455 AUC-39.04%
KCD Necal 50% AUC-05.3E%
LORDUA (CP0) Recal -00.0C% AUC-56.3E%
LOMMA (SED-4
Racatii2 pe5s ALC-dD 30%
Perpanecy
Racovened
Reccwrrd
82-
Cosine Simitrity with Signaburs
Cosina Similaantt with Signature
Couine with Signature
Costne Semiarity with Signature
Figure 7: Illustration of trapdoor detection against different MI attacks.
E.5 Distributional Shifts in Adversary's Auxiliary Dataset
In the previous experiments, we assumed that the adversary possesses a public dataset without distributional shifts from the private data. Typically, both auxiliary and private datasets were con- structed from the CelebA dataset. However, in a practical scenario, the adversary might not know the distribution of private data, leading to potential distributional shifts between auxiliary and private datasets and making it harder to extract private data.
In this section, we used the FFHQ dataset (38 as the adversary's 's auxiliary dataset to demonstrate the scenario with slight distributional shifts, considering that PLG-MI can still provide an attack accuracy exceeding 89% on the unprotected model using this dataset (8] As shown in Table [4, Trap-MID outperforms previous approaches under this scenario, achieving nearly 0% top-1 attack accuracy.
Notably, while methods using dependency regularization, such as MID and BiDO, are vulnerable to MI attacks without distributional shifts, they can protect privacy if auxiliary distribution differs from private data, with top-1 attack accuracy dropping from 89% to below 70%. On the other hand, although NegLS reduces the guidance signal for MI attacks by training over-confident model with a discrete loss landscape, the logit-based max-margin loss in PLG-MI can prevent early saturation and surpass this defense mechanism. Consequently, while NegLS leads to unnatural reconstructions with high FID, it remains vulnerable to PLG-MI, with attack accuracy exceeding 78%.
E.6 Trapdoor Recovery Analysis against Different MI Attacks
Figure 7 presents the trapdoor recovery analysis of MI attacks other than PLG-MI. Similarly to PLG-MI, all these attacks, except LOMMA (KED-MI), reconstruct the trapdoor information from trapdoored models, with more than 89% recovered images reported triggered images. Although our detection method has a low recall rate on LOMMA (KED-MI), the ROC AUC of 83.33% still suggests that the reconstructed images are likely be injected with a trapdoor trigger. However, due to the limitations of backdoor attacks, the student models from KD enable LOMMA to extract trapdoor information and explore private distribution simultaneously, preventing from being entirely misled by the trapdoored models. We leave the further adaptation for robust trapdoor against KD to future works.
29

---

Table 15: Defense comparison against adaptive attacks, using VGG-16 models.
Attack
Defense
Acc 1
AA-1
AA-5
KNN Dist t
FID
PLG-MI
Trap-MII*
81.37
6.23
1.70
13.15
2.57
2055.96
57.82
87.83
98.78
1.05
99.90
0.30
1086.80
12.88
MID
76.67
87.64
2.38
97.38 + 1.29
1208.60
15.41
PLG-MI+
BiDO
79.62
89.64 2.36
97.96 1.04
1222.26
16.89
NegLS
81.76
92.20 0.94
98.38 0.55
1395.18
77.32
Trap-MID*
81.62
74.26
2.02
81.86
1.33
1356.54
24.03
PLG-MI++ Trap-MID*
81.62
70.44 = 2.24
78.14 = 1.29
1399.84
27.17
* The mean and standard deviation of each evaluation metric averaged across multiple runs.
Table 16: Defense comparison against adaptive attacks with FFHQ dataset, using VGG-16 models.
Attack
Defense
Acc
AA-1
AA-5
KNN Dist 1
FID
PLG-MI
Trap-MID*
81.62
0.86 0.83
2.85 1.31
2227.09
94.57
87.83
89.36
2.60
96.96 1.11
1267.65
15.32
MID
76.67
63.92 3.56
85.96 2.81
1369.63
13.25
PLG-MI+
BiDO
79.62
60.64 3.06
83.22 1.61
1430.52
17.29
NegLS
81.76
85.52 0.81
96.78 0.84
1446.69
86.98
Trap-MID*
81.62
21.85
2.16
31.32 1.98
1897.36
46.47
PLG-MI++
Trap-MID*
81.62
31.03 = 2.53
44.09 = 2.44
1789.95
38.98
# The and standard deviation of each evaluation metric averaged multiple runs.
E.7 Adaptive Attacks without Trapdoor Signatures
This section investigates adaptive attacks when the adversary only knows the existence of trapdoors without access to trapdoor signatures. Here we modify the loss function in Equation 7 by excluding the regularization term of trapdoor signatures:
LG Lo Auux ppm. (X) [z> (oma (G(Z)))) Swx,
(12)
This adaptive attack is denoted by PLG-MI+. Table 15 demonstrates its comparable attack per- formance with PLG-MI++, indicating that if the auxiliary dataset is close enough to the private distribution, guiding attacks by auxiliary signatures is sufficient to boost attacks. However, as Ta- ble[6] shows, trapdoor signatures are required to enhance the attack performance further when there are distributional shifts in auxiliary data. Overall, Trap-MID still provides better privacy preservation than existing defenses against adaptive attacks.
E.8 Combining Trap-MID with NegL.S
We further analyze whether Trap-MID can be combined with existing baselines to enhance perfor- mance. Table [7 presents the defense performance of combining Trap-MID with NegLS, using the same configurations outlined in Appendix C Following the evaluation protocol in Section 4.1 the experiments are conducted across runs. This hybrid defense slightly decreases accuracy but significantly improves defense effectiveness, even against KD-based attacks like LOMMA. For instance, it reduces LOMMA (KED-MI)'s 's' attack accuracy to 42.47%, while Trap-MID or NegLS alone achieves only 61.25% 77.67%. The reconstructed images be found in Appendix F
This suggests that Trap-MID stands as an orthogonal approach to existing defenses and can be integrated with them. Intuitively. NegL.S focuses on reducing the leakage of guiding signals, making more difficult for adversaries to extract private data. Consequently, this enhancement makes Trap-MID's shortcuts more appealing attack algorithms, thereby bolstering privacy protection.
30

---

Table 17: Defense performance when combining Trap-MID with NegLS, using VGG-16 16 models.
Defense
Acc 1
AA-1 +
AA-5
KNN Dist f
FID 1
GMI
Trap-MII
81.37 = 1.04
0.24 + 0.19
1.16 +
2411.39 + 80.80
153.73 = 62.84
w/ NegL.
77.10 + 0.89
1.28 + 1,30
4.43 + 3.99
2244.13 + 89.50
89.50 = 31.01
KED-MI
Trap-MII
81.37 1.04
9.24
9.36
19.24 + 18.65
2056.00
311.59
87.39 + 66.40
w/ NegLS
77.10 = 0.89
4.26 + 2.56
12.14 + 6.73
2004.05 + 164.76
76.32 + 35.72
LOMMA (GMI)
Trap-MID
81.37 1.04
41.63
2.28
68.24 2.60
1569.92 = 19.74
39.29
2.14
w/ NegLS
77.10 1 0.89
22.80 1 3.12
46,88 1 4.87
1710.01 1 48.15
47.44 1. 4.17
LOMMA (KED-MI)
Trap-MII
81.37 1.04
61.25 5.71
85.76 3.73
1404.77 + 40.25
24.19 2.21
w/ NegLS
77.10 = 0.89
42.47 = 8.97
70.64 = 9.16
1521.82 + 73.60
37.22 + 1.56
PLG-MI
Trap-MIID
81.37 1.04
6.23
5.60
13.15 + 10.30
2055.96
147.67
57.82 + 23.41
w/ NegLS
77.10 + 0.89
0.66 + 0.68
1.96 + 1.30
2344.62 58.48
93.66 + 22.14
Table 18: Defense comparison against BREP-MI, using untargeted attacks to recover 300 identities.
Defense
Acc 1
Number of Initial Iterations t
AA-1 +
87.83
2
65.00
MID
76.67
2
46.33
BiDO
79.62
3
39.00
NegLS
81.76
3
52,00
Trap-MID
81.62
171
0.00
Another promising direction for future research is to combine multiple defense strategies to improve overall performance and robustness against specific adaptive attacks.
E.9 Defense Performance against Label-Only Attacks
In previous experiments, we evaluated defense methods against white-box MI attacks, which pose greater privacy threat. However, in practical scenarios, adversaries may only have access to model predictions or output labels, conducting black-box or label-only attacks on victim models.
This section investigates the defense performance of different approaches against BREP-MI [11. label-only attack. BREP-MI starts by randomly sampling the generator's latent until the victim model classifies the generated image as the target class. It then estimates the predicted labels over sphere latent space to iteratively adjust the image away from the model's decision boundary. We the victim models trained on the CelebA dataset and the generator from GMI to analyze performance against BREP-MI.
Under targeted attack settings, BREP-MI fails to initialize latents for all 1,000 identities in reasonable time when facing TraD-MID, sampling latents for only 942 identities after 820,000 iterations. In contrast, it only takes 553 iterations against unprotected models.
We also conducted untargeted attacks to recover 300 identities. As shown in Table T8 Trap-MID significantly increased number of initial iterations required and reduced BREP-MI's attack accuracy to 0%, demonstrating its effective privacy protection against various types of MI attacks.
31

---

Table 19: Defense performance against PPA.
Architecture
Defense
Acc 1
AA-1
AA-5 /
Oiace f
deval 1
FID 1
87.35
82.96
95.44
0.7506
299.73
44.04
ResNeSt-101
TrDp-MID
88.48
74.47
89.61
0.8188
319.48
42.36
Fine-tuned
83.22
15.58
26.95
1.3162
471.61
64.34
86.78
80.61
94.58
0.7362
312.58
40.43
Ne 83.59
26.41
49,96
1.0420
441.67
61.30
ResNet-152
Trap-MID
88.02
63,93
83.17
0,8606
344,45
41.61
Fine-tuned
83.82
0.25
0.90
1.5807
559.08
66.54
85.39
73.14
90.51
0.7635
312.32
43.24
DenseNet-169
Trap-MID
89.98
55.53
71.25
0.9571
358.67
49.37
Fine-tuned
86.82
1.79
4.15
1.5646
552.48
74.47
Reported in PPA's paper [6].
Reported in NegLS's paper [6]]
Table 20: Additional evaluation results of the defense performance against PPA.
Architecture
Defense
Precision
Recall 4
Density
Coverage !
0.2650
0.0136
0.8547
0.3624
ResNeSt-101
Trap-MID
0.3195
0.0019
0.9659
0.4329
Fine-tuned
0.1320
0.0224
0.3999
0.2806
0.3231
0.0269
0.7984
0,2805
ResNet-152
Trap-MID
0.1873
0.0608
0.7479
0.4556
Fine-tuned
0.0680
0.0110
0.2931
0.1913
0.2049
0.0495
0.6811
0.3866
DenseNet-
Trap-MID
0.2976
0.0127
0.9781
0.5286
Fine-tuned
0.0723
0.1025
0.2565
0.1368
Reported PPA's paper [6].
E.10 Defense Performance Under High-Resolution Scenario
This section evaluates Trap-MID's defense performance modern architectures and in high- resolution scenarios. Specifically, we conducted the experiments introduced by PPA [6]. The target models are ResNeSt-101 [46). ResNet-152 [33. and DenseNet-169 44 trained on high- quality version the CelebA dataset, with the images cropped, aligned, and resized to 224x224 using HD CelebA Cropper We adopted PPA to perform MI attacks using StyleGAN2 generator 21 pre-trained on the FFHQ dataset (38]. The generator outputs 1024x 1024 images, which are then center-cropped 800x800 and resized fit the model's input resolution.
adopt the same Inception model used PPA's official setup as the evaluation model. was trained on the same training dataset as the target models, with an input size of 299x299, The evaluation model achieves 93.28% accuracy on the testing dataset. addition to attack accuracy, KNN distance in the evaluation model's ss feature space (6gval), and FID, PPA also employs additional metrics, such as KNN Distance the FaceNet [43] feature space (Ófce), improved precision and recall
44 and density and coverage 45 metrics. Details of these metrics provided in Appendix H.
We follow the same training settings as 6 In addition the Trap-MID configurations detailed in Appendix [..4] we also fine-tuned the blend ratio and trapdoor loss weight 3 according to the observations in Appendix [D.3 and [D.4] Since we found that Trap-MID models generally achieve better accuracy than the unprotected models, we set = 0.5 and selected the smallest for each model effectively distinguish triggered samples from benign ones. Specifically, the blend ratios are 0.005, 0.007, and 0.01 for the ResNeSt-101. ResNet- 152, and DenseNet-169 models, respectively.
Code available http::///ggggaoooooooooo/oo/oooa
32

---

Table 19 and Table 20 present Trap-MID's defense performance against PPA, compared with attack results reported in previous works. Although Trap-MID does not fully mitigate PPA with default settings, it preserves privacy to certain degree without sacrificing accuracy. Furthermore, selecting proper
significantly enhances defense performance, reducing attack accuracy on ResNet- 152 and DenseNet-169 to below 2%, and that on ResNeSt-101 to 15.58%. This demonstrates that while syper-parameter tuning is essential for optimal defense, Trap-MID provides effective privacy protection across various datasets and architectures,
F Additional Visualization
Figure 8 shows the reconstructed images with the hybrid approach discussed in Appendix E.8 Figure illlustrates additional recovered images from PLG-MI, where the recoveries of Identity 4 from Trap-MID exhibit different hair colors from the private data. Such variation does not appear in other defenses, demonstrating Trap-MID's effectiveness in protecting private information. In addition, Figure TO Figure [T] Figure 12 and Figure T3 display sample reconstructed images from GMI, KED-MI, and LOMMA attacks.
Parate
BDD
Neg.5
Trap Mm
Try 5
Figure 8: Reconstructed images from PLG-MI, including Trap-MID + NegLS.
Perrte
Exproiectd
RDD
Neg.5
Trpp Mm
Figure 9: Additional reconstructed images from PLG-MI.
33

---

Engretsete
um
NegL5
Tra--iI
Tra-MID S
Figure 10: Reconstructed images from GMI.
Ergretsetvd
MI
Nog.S
Trap-MM Ar
Try--MD 5
Figure 11: Reconstructed images from KED-MI.
Uxgreiscted
MIO
Trap-IID
Tra-MID Negl5
Figure 12: Reconstructed images from LOMMA (GMI).
Ergretected
MIO
NegU5
Tra-MII
Tra-MID NegL5
Figure 13: Reconstructed images from LOMMA (KED-MI).
34

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The claimed theoretical analysis demonstrated in Section 3.4 Theoretical Analysis, and the defense performance is included in Section Experimental Results.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
Appendix A.2 Limitations and Future Works discusses the limitations of this
work.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiitiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
35

---

Answer: [Yes]
Justification: The assumptions and the proof of theoretical result are provided in Section 3.4
Theoretical Analysis and Appendix B Proof of Theorem
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The instructions of the training procedure and the experimental configurations are outlined in Section 3.3 Model Training and Appendix C Experimental Details. We also
provide the code supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
36

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: The code is provided in supplementary material, including instructions about data preparation, model training, MI attacks, and a checkpoint of the Trap-MID model.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm
public//uides//Cdeefee Sewriiddes/ooeeSummsssiiooooi
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
httppp.cc/pubbbcguuuceeee Codeeubmii ssi criionPooiccy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
The experimental setups are listed in Section 4.1 Experimental Setups and
Appendix C Experimental Details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We conducted the experiments multiple times and reported the standard deviation of each metric as the error bars. The detailed calculation method is provided in Section Experimental Setups and Appendix D Ablation Studies.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
37

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The compute resources are listed in Appendix C.1 Hardware and Software
Details.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: We acknowledge that we have read and committed to adhering to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
Appendix A. Broader Impacts demonstrates the broader impacts of this
work.
Guidelines:
38

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considcrations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This research only involves the defense strategy against existing privacy attacks, which doesn't pose such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
The original papers of the codes and datasets used in the experiments are cited, and the license from https:://ii tiub..u..... com/ SCccc21/Knot/ Khowweddee Enr ceer-chhe-DDie is provided with the provided code, we mainly modified their code implement our defense.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
39

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thoode com comddatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The documentation is provided with the code in the supplementary material, including instructions about data preparation, model training and MI attacks.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
40

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
41


Reviews:
[{"review_id": "HYuZRAB1kB", "reviewer": "Reviewer_MuQ4", "summary": "This paper presents Trap-MID, a novel defense mechanism against model inversion attacks that utilizes trapdoor injection techniques. By incorporating a trapdoor into the model, Trap-MID misleads MI attacks into extracting trapdoor information instead of private data, effectively preserving privacy. The paper contributes to the field by:\n1. Introducing a Novel Defense Mechanism: Trap-MID pioneers the exploration of the relationship between trapdoor injection and MI defense, providing a new approach to tackle this challenging privacy problem.\n2. Theoretical Insights and Empirical Validation: The paper provides theoretical analysis on the impact of trapdoor effectiveness and visibility on deceiving MI attacks and validates its effectiveness through extensive experiments, showcasing its superior performance compared to existing defenses.", "questions": "1. Impact of KD on Defense Performance: Could the authors provide more insights into the impact of KD on Trap-MID's defense performance? Specifically, what modifications could be made to the trapdoor design or training process to make it more robust against KD-based attacks?\n2. Stability of Trigger Design: How sensitive is Trap-MID's performance to the specific trigger design? Are there any guidelines or heuristics for choosing an effective and stable trigger design?\n3. Trade-off between Privacy and Utility: The paper mentions an accuracy-privacy trade-off due to the trapdoor loss weight. Could the authors elaborate on this trade-off and provide more insights into the impact of different weight values on privacy and utility?\n4. Impact of Distributional Shifts: The paper briefly mentions distributional shifts in the auxiliary dataset. Could the authors provide a more detailed analysis of how distributional shifts impact Trap-MID's defense performance and how it compares to existing defenses in such scenarios?\n5. Comparison with Other Reconstruction-based Attacks: The paper focuses on model inversion attacks. How effective is Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks?", "limitations": "The authors acknowledge the limitations of their work, including the assumption of trust and vulnerability to KD. They also recognize the need for further exploration of trigger designs and analysis of other reconstruction-based attacks. These limitations are clearly stated", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "+ New Application of Trapdoors.The paper creatively applies trapdoor injection techniques, traditionally used for adversarial detection, to defend against model inversion attacks. This novel application opens up new avenues for privacy-preserving DNNs.\n+ Theoretical Analysis: The paper presents a solid theoretical foundation for trapdoor-based defenses, establishing definitions for trapdoor effectiveness and visibility and providing a theorem that explains their impact on MI attacks. \n+ Comprehensive Experiments: The authors conduct thorough experiments on various MI attacks using different DNN architectures and datasets, demonstrating the generalizability and robustness of Trap-MID.\n+ Well-structured and Clear Explanation: The paper is well-structured and provides clear explanations of the proposed method, theoretical analysis, and experimental results. The figures and tables effectively illustrate the key concepts and findings.", "weaknesses": "-  Assumption of Trust: Trap-MID assumes a level of trust between data providers and the model owner, which might not always be feasible in practice. Future work could explore ways to empower data providers or individuals to secure their sensitive information before sharing data.\n- Limited Scope of Attackers: The paper assumes white-box attackers with full access to the model. However, in practical scenarios, attackers may only have access to the model's predictions or even just the labels. It would be beneficial to explore the effectiveness of Trap-MID against black-box and label-only attackers.\n- Vulnerability to KD: Trap-MID's efficacy may be limited against MI attacks involving knowledge distillation (KD), as KD enables the attacker to extract trapdoor information and explore private data simultaneously. Developing more robust trapdoors against KD is a crucial direction for future research.\n- Robustness to Adaptive Attacks: The paper explores the effectiveness of Trap-MID against adaptive attacks where the attacker knows the existence of trapdoors. However, it would be valuable to investigate the robustness of Trap-MID against other types of adaptive attacks, such as those that exploit specific vulnerabilities in the trapdoor design.\n- Random Trigger Initialization: The randomly initialized triggers introduce variability in defense performance, leading to a larger standard deviation compared to previous defenses. Exploring more stable and powerful trigger designs would enhance the consistency and reliability of Trap-MID.\n- Limited Exploration of Trigger Design: While the paper demonstrates the effectiveness of a simple trigger design, exploring more sophisticated trigger designs could potentially improve the defense performance further.\n- Limited Analysis of Other Reconstruction-based Attacks: The paper primarily focuses on model inversion attacks. Analyzing the effectiveness of Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, would provide a more comprehensive evaluation of its generalizability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed and insightful review. We address the specific weaknesses and questions raised in your comments below:\n\n**W1: Trap-MID assumes trust between data providers and model owners, which isn't always feasible.**\n\nThis limitation is discussed in Appendix A.2. We follow a common scenario that relies on model owners to protect private data. Since backdoor attacks can be conducted by poisoning the dataset, we believe Trap-MID's success can inspire future work enabling data owners to preserve privacy.\n\n**W2: It would be beneficial to explore the effectiveness of Trap-MID against black-box and label-only attacks.**\n\nTo address this, we conduct experiments against BREP-MI, a label-only attack. Our result shows that BREP-MI is ineffective on Trap-MID, requiring over 820,000 iterations to initialize latents for all identities and getting 0% attack accuracy in untargeted attacks (recovering 300 identities), demonstrating Trap-MID's efficacy and generalizability:\n\n|Defense|Accuracy ↑|# of Initial Iterations ↑|Attack Accuracy ↓|\n|-|-|-|-|\n|Trap-MID|81.62|171|0.00|\n\nResults against other defenses can be found in Table 1 of the attached file in Author Rebuttal. We will add this analysis to our paper.\n\n**W3 & Q1: Could the authors provide more insights into KD's impact on Trap-MID and how to make it more robust against KD-based attacks?**\n\nKD reduces Trap-MID's efficacy as student models typically do not learn trapdoor behaviors. Conducting shadow KD during trapdoor injection could be one of the solutions [1]. Besides, we found that combining Trap-MID with NegLS also improves defense, even against KD-based attacks:\n\n|Attack|Defense|Accuracy ↑|AA-1 ↓|AA-5 ↓|KNN Dist ↑|FID ↑|\n|-|-|-|-|-|-|-|\n|LOMMA (KED-MI)|Trap-MID|81.37|61.25|85.76|1404.77|24.19|\n||w/ NegLS|77.10|**42.47**|**70.64**|**1521.82**|**37.22**|\n\nIntuitively, NegLS makes it harder to extract private data and therefore makes trapdoor more attractive. This suggests Trap-MID to be an orthogonal work to existing defenses, and a hybrid approach may enhance robustness against specific adaptive attacks.\n\nResults against other attacks are available in Table 4 of the attached file. We will add this analysis to our paper.\n\n**W4: It would be valuable to investigate Trap-MID's robustness against other types of adaptive attacks.**\n\nThank you for the suggestions. Due to time constraints, we couldn't explore this further in this work. We recognize the importance of this future direction to help improve the trapdoor design.\n\n**W5: The randomly initialized triggers introduce variability in defense performance.**\n\nWe acknowledged this limitation in Appendix A.2. However, the worst-case performance of Trap-MID still surpasses the best-case performance of existing defense against most attacks, indicating its effectiveness:\n\n|Attack|Defense|Acc ↑|AA-1 ↓|AA-5 ↓|KNN Dist ↑|FID ↑|\n|-|-|-|-|-|-|-|\n|GMI|BiDO (best)|78.32|4.42|12.94|2036.78|47.55|\n||Trap-MID (worst)|79.39|**0.56**|**2.46**|**2280.19**|**75.16**|\n|KED-MI|NegLS (best)|81.79|29.64|57.28|1544.90|**47.31**|\n||Trap-MID (worst)|81.55|**23.80**|**46.58**|**1665.86**|21.23|\n|LOMMA (GMI)|NegLS (best)|81.79|48.58|75.80|1423.78|**38.27**|\n||Trap-MID (worst)|81.55|**44.80**|**72.60**|**1535.01**|35.47|\n|LOMMA (KED-MI)|MID (best)|76.67|**59.18**|**86.30**|**1413.53**|**24.55**|\n||Trap-MID (worst)|81.55|69.32|90.90|1333.36|20.95|\n|PLG-MI|NegLS (best)|81.79|83.84|96.58|1495.23|**73.45**|\n||Trap-MID (worst)|79.39|**15.72**|**30.98**|**1843.42**|36.91|\n\n**W6: Exploring more sophisticated trigger designs could improve the defense further.**\n\nThis future direction is discussed in Appendix A.2. Our work serves as the first step in trapdoor-based defense. Besides, Appendix D.1 compares Trap-MID with patch-based triggers, showing the importance of trigger design. Future research could explore advanced triggers to improve defense further.\n\n**W7 & Q5: How effective is Trap-MID against other reconstruction-based attacks?**\n\nWe discuss this future work in Appendix A.2. As these reconstruction attacks also optimize inputs to satisfy the adversary's objectives, we believe that Trap-MID can be extended to mitigate them with proper \"shortcuts.\" However, since this work focuses on MI defense, the extension is beyond the scope, and we leave it to future research.\n\n**Q2: How sensitive is Trap-MID to the specific trigger design? Are there any guidelines for choosing a stable trigger design?**\n\nAppendix D.1 compares Trap-MID with patch-based triggers, showing the importance of trigger design. In this work, we use trapdoor loss and discriminator loss to optimize the triggers, which already surpassed existing defenses. We leave further customization to future work (e.g., improving trigger initialization and optimization, or using recent backdoor techniques).\n\n**Q3: Could the authors elaborate on the accuracy-privacy trade-off from trapdoor loss weight?**\n\nWe discussed this trade-off in Appendix D.4. A larger weight encourages the model to learn trapdoor behavior instead of the main task, enhancing defense at the cost of accuracy. Table 8 shows that increasing this weight from 0.02 to 0.2 reduces PLG-MI's attack accuracy from 24% to 6%, while the test accuracy decreases from 84% to 81%.\n\n**Q4: Could the authors provide a more detailed analysis of how distributional shifts impact Trap-MID's defense performance and how it compares to existing defenses in such scenarios?**\n\nSection 4.2 and Appendix E.2 analyze this impact. Distributional shifts in auxiliary data degrade attack performance, especially against Trap-MID. In particular, distributional shifts make extracting private data harder, which therefore makes trapdoors more attractive to the attacks. Tables 4 and 11 show that PLG-MI's attack accuracy drops from 6% to nearly 0% with distributional shifts, highlighting its effectiveness in this case.\n\n[1] Ge et al., Anti-Distillation Backdoor Attacks: Backdoors Can Really Survive in Knowledge Distillation, ACM MM 2021", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QYV3SBR3qn", "reviewer": "Reviewer_P6SC", "summary": "The paper proposes Trap-MID, a trapdoor-based defense mechanism to protect deep neural networks (DNNs) against Model Inversion (MI) attacks. The technique involves integrating trapdoors into the model to mislead MI attacks, causing them to extract trapdoor triggers rather than private data. The authors provide theoretical insights into the effectiveness and invisibility of these trapdoors and validate their approach through empirical experiments, demonstrating superior performance against various MI attacks without the need for extra data or significant computational overhead.", "questions": "See weaknesses.", "limitations": "NA", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Trap-MID presents the use of trapdoors to mislead MI attacks, filling a gap in the existing defense strategies.\n- The empirical defense results seem good.", "weaknesses": "- The proposed method involves multiple optimization processes, making it computationally expensive and potentially impractical for large-scale or resource-constrained applications.\n- According to Theorem 1, a more effective (larger $\\delta$) and invisible (smaller $\\epsilon$) trapdoor can lead to a larger lower bound to the expected posterior probability, making it more likely to be extracted by an MI attack. However, the paper does not analyze the discrepancy between the two posterior probability distributions, which is crucial for understanding the practical implications of the defense mechanism.\n- The paper's organization and logical flow can be further improved for better readability and comprehension. The transitions between sections are sometimes abrupt, and a more cohesive structure would enhance the overall presentation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments. We address the specific weaknesses raised in your review below:\n\n**W1: The proposed method involves multiple optimization processes, making it computationally expensive and potentially impractical for large-scale or resource-constrained applications.**\n\nWe appreciate your concern. Here are the training times of different defense methods in our experiments:\n\n|Defense Method|Training Time|\n|-|-|\n| Unprotected model | 15 mins |\n| MID | 15 mins |\n| BiDO | 16 mins |\n| NegLS | 35 mins |\n| Trap-MID | 1 hour 15 mins |\n\nWhile Trap-MID does take the longest time due to three gradient updates per epoch (discriminator, triggers, and target model), it is worth noting that it also significantly surpasses other defenses against recent MI attacks. Moreover, Trap-MID still requires less data and computational cost than the existing trap-based defense, NetGuard, which demands an additional dataset, training an extra classifier, and conducting shadow attacks.\n\nWe believe that it would be a valuable future direction to develop a more efficient trigger generation to make Trap-MID more practical for large-scale applications (e.g., pre-computing triggers with fewer steps to reduce overhead during model training).\n\n**W2: The paper does not analyze the discrepancy between the two posterior probability distributions, which is crucial for understanding the practical implications of the defense mechanism.**\n\nTheorem 1 establishes a lower bound for the posterior probability of poisoned data compared to benign data:\n\n$$\\mathbb{E}\\_{Y \\sim p(Y)} \\mathbb{E}\\_{X \\sim p(X)}[\\log p_f(\\Pi_y(X)|Y)] \\ge \\mathbb{E}\\_{(X, Y) \\sim p(X, Y)}[\\log p_f(X|Y)] + (\\delta - \\epsilon)$$\n\nFor example, since the unprotected model isn't injected with a trapdoor, it would have a negative trapdoor effectiveness $\\delta$, leading to a lower expected posterior probability of poisoned data $p_f(\\Pi_y(X)|y)$ than benign data $p_f(X|y)$ and making MI attacks more likely to extract private data.\n\nIn contrast, a trapdoored model with a stronger predictive power on invisibly triggered data (especially when $\\delta > \\epsilon$) would result in a higher expected posterior probability for poisoned data compared to benign data, misleading MI attacks to recover triggered data instead.\n\n**W3: The paper's organization and logical flow can be further improved for better readability and comprehension.**\n\nThank you for highlighting this issue. We will refine our explanations and improve the organization for better readability. We would greatly appreciate any specific feedback on the sections that need improvement to help us enhance our presentation and address any confusion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "awmyQBjvfg", "reviewer": "Reviewer_BGpu", "summary": "The paper introduces a backdoor-based MI attack called Trap-MID. In this method, a trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information acts as a \"shortcut\" for MI attacks, causing them to extract trapdoor triggers instead of private data.", "questions": "I have a question about the sensitivity of Trap-MI to hyper-parameters. We know that BiDO sensitive to hyper-parameters as it need to optimise two hyper-parameters. From my understanding, Trap-MI also introduces two hyper-parameters. I wonder how sensitive is the Trap-MI to these two hyper-parameters?", "limitations": "N/A", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The paper provides the new insights about Model Inversion from Backdoor injection perspective. \n\nThe idea is intuitive and theoretical analysis is provided.", "weaknesses": "In line 137, “MI attacks leverage a discriminator to approximate generic prior and ensure natural outcomes” This statement might not generalize to all SOTA MI attacks those does not utilise a GAN discriminator such as PPA [1]\n\nThe evaluation is based on low-resolution (64x64) MI attacks, which are not very practical for modern models. I suggest authors to evaluate the effectiveness of Trap-MID and compare with baseline defenses on high-resolution setup such as PPA [1] or MIRROR [2]\n\nThe main results are on VGG-16, which is a quite out-dated architecture. Despite there are other results on Face.evoLVE and IR-152 in the Appx. I strongly encourage authors to evaluate on other architectures, such as in PPA [1]\n\nThe visualisation results are not very convincing to me. For example, in Fig. 2, most of the reconstructed images are very different from private data despite some defence baselines still have a high attack accuracy. I suggest reviewers to provide more visualisation for reference.\n\nI understand that the visualisation could be subjective. I suggest the authors to conduct a comprehensive study to further confirm the effectiveness of Trap-MI when comparing with other defence baselines.\n\n[1] Struppek, Lukas, et al. \"Plug & play attacks: Towards robust and flexible model inversion attacks.\" ICML-2022.\n\n[2] An, Shengwei et al. MIRROR: Model Inversion for Deep Learning Network with High Fidelity. Proceedings of the 29th Network and Distributed System Security Symposium.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful review and helpful comments. We address the specific weaknesses and questions raised in your review below:\n\n**W1: “MI attacks leverage a discriminator to approximate generic prior and ensure natural outcomes” This statement might not generalize to MI attacks that don't utilise GAN discriminator, such as PPA**\n\nWe appreciate your feedback. This statement refers to the challenge of misleading MI attacks using trapdoors. Since MI attacks often rely on GAN to produce natural outcomes without explicit constraints like $l_2$ or $l_\\infty$ distance in adversarial attacks, it becomes harder to design effective triggers.\n\nPPA uses a pre-trained StyleGAN2 generator and optimizes latents during attacks. Although the discriminator isn't involved in the process, it guides the generator to produce realistic images during GAN training, which indirectly ensures natural outcomes. We will refine this discussion to make it clearer.\n\n**W2: The evaluation is based on low-resolution (64x64) MI attacks, which are not very practical for modern models. The main results are on VGG-16, which is quite outdated.**\n\nTo address this, we have added experiments against PPA to demonstrate a high-resolution (224x224) scenario with modern models. Due to time and computational constraints, we modified the attack to optimize 20 samples and select 5 in the final stage (PPA originally optimized 200 samples and selected 50, which would take about 10 days on our machine).\n\nThe following table shows the defense performance on DenseNet-169. Although Trap-MID doesn't fully mitigate PPA with default settings, it preserves privacy to a certain degree without an accuracy drop. Besides, increasing trapdoor loss weight further improves defense performance, and combining Trap-MID with NegLS (keeping $\\beta$=0.2) even reduces attack accuracy to 2%. This result demonstrates Trap-MID's effectiveness in privacy protection under different scenarios. We discuss more about the defense combination in Q3 of Author Rebuttal.\n\n|Defense|Acc ↑|AA-1 ↓|AA-5 ↓|$\\delta_{face}$ ↑|$\\delta_{eval}$ ↑|FID ↑|\n|-|-|-|-|-|-|-|\n|-|87.08|92.00|98.28|0.7240|140.93|37.76|\n|Trap-MID|89.98|59.48|72.22|0.9468|182.90|49.64|\n|$\\beta$=0.5|83.39|11.78|19.24|1.3985|269.99|63.04|\n|w/ NegLS|83.56|**1.60**|**4.90**|**1.4744**|**279.68**|**79.37**|\n\nDetailed results, including other architectures, can be found in Table 2 of the attached file in Author Rebuttal We regret that we cannot conduct hyper-parameter tuning on other models due to time constraints. We will add this analysis to our paper.\n\n**W3: The visualization results are not very convincing to me. I suggest the authors provide more visualization for reference and conduct a comprehensive study to further confirm the effectiveness of Trap-MI.**\n\nWe acknowledge that visualization can be subjective due to the ambiguous definition of \"class representative.\" However, in Figure 2 of our paper, we found that recovered images from Trap-MID show more distinct attributes from private data. For example, Identity 1 images have different skin tones, Identity 2 and 5 images have different hairstyles, and Identity 4 images show different genders. We also provide more recovered samples in Figure 1 of the attached file in Author Rebuttal, in which Identity 4 images from Trap-MID have different hair colors from private data compared to other defenses.\n\nFor the quantitative analysis, our PPA experiments in W2 include additional evaluation metrics, such as FaceNet's feature distance used in [1], as well as improved precision, recall, density, and coverage used in [2]. We also conduct the same evaluation on our PLG-MI results. These results, found in Tables 2 and 3 of the attached file Auther Rebuttal, provide a more comprehensive analysis of Trap-MID. We will add this analysis to our paper.\n\n**Q1: How sensitive is the Trap-MID to the hyper-parameters?**\n\nWe discussed the impact of blend ratio in Appendix D.3 and trapdoor loss weight in Appendix D.4. According to Tables 7 and 8 in our paper, Trap-MID is not very sensitive to these hyper-parameters regarding test accuracy, maintaining about 81-84% accuracy under different configurations.\n\nFor defense performance, Table 7 in our paper shows that a lower blend ratio generally provides better defense. There is an abrupt drop in attack accuracy against KED-MI and PLG-MI (e.g., PLG-MI's attack accuracy drops from 93.86% to 1.92% when the blend ratio decreases from 0.05 to 0.03), indicating that an invisible enough trigger is essential to mislead certain attacks.\n\nAdditionally, Table 8 in our paper shows that increasing trapdoor loss weight from 0.02 to 0.2 reduces PLG-MI's attack accuracy from 23.84% to 6.23%.\n\n[1] Struppek et al., Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks. ICML 2022\n[2] Wang et al., Variational model inversion attacks. NeurIPS 2021", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Hh6AjjZwfQ", "reviewer": "Reviewer_bcsy", "summary": "The paper proposes Trap-MID, a novel defense method against model inversion attacks, drawing inspiration from backdoor attacks and shortcut-based defenses against adversarial examples. The core idea involves adding poisoned data samples to the target model's training data. This data poisoning is based on the Blended backdoor attack, which calculates a linear combination of the training sample and a noise trigger pattern. To reduce the visibility of the trigger, a discriminator is trained in parallel, akin to a GAN training setup. This discriminator is then used to align the trigger patterns with the distribution of the clean training samples. The proposed defense method is empirically evaluated against common white-box attacks (GMI, KED-MI, LOMMA, PLG-MI) and defense methods (MID, BiDO, NegLS) using the standard 64x64 CelebA training samples.", "questions": "- Can inference-time mitigation strategies from the backdoor or shortcut literature be employed to eliminate the model's shortcut behavior, thereby enabling stronger attacks?\n- Table 6 in the appendix: Why does the attack performance increase for other attacks besides PLG-MI when the defense uses the trapdoor loss and a discriminator loss compared to fixed triggers? Is there any intuition behind these results?", "limitations": "Section A.2. provides a comprehensive limitations section.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper proposes an intriguing direction for model inversion defenses by utilizing backdoor attacks to induce shortcuts in the model. These shortcuts are then exploited by the attack, resulting in misleading attack outcomes. This approach is both clever and conceptually straightforward, which is advantageous.\n\n- The paper is well-written, with all components and sections clearly described. The experimental evaluation is also well-defined, adhering to the standard procedures in model inversion literature.\n\n- The results presented in the evaluation section are convincing. The experiments demonstrate the method's favorable privacy-utility trade-off and its effective defense capabilities. Additionally, the paper investigates adaptive attacks, a critical aspect of assessing a method's effectiveness. Although the adaptive attack still achieves good results against the proposed defense, this does not diminish the contribution's value. The Appendix further provides an extensive ablation and sensitivity analysis, essential for understanding the impact of hyperparameter selection and individual design choices.", "weaknesses": "- Although the evaluation is conducted on four attack algorithms, two important aspects are missing in my opinion. First, the proposed defense should also be tested against black-box/label-only attacks. In particular, testing the defense method against the label-only BREP-MI [1] attack would be very interesting since this method aims to reconstruct samples by maximizing their distance to the decision boundaries. Given that the proposed Trap-MID leverages a model's ability to exploit shortcuts in its predictions, I am curious if the poisoned shortcut samples are differently placed in a model's embedding space. It might be the case that these samples are actually closer to the decision boundary compared to clean training samples. If this is true, the defense might fail. So even if white-box attacks are usually considered stronger, running some label-only attacks could add an intriguing perspective to the paper.\n\n-  Similarly, the defense is only evaluated in a low-resolution setting. However, it is important to also investigate a high-resolution setting, which can be considered more practical. In this context, the method should also be tested against PPA [2] to provide a comprehensive evaluation and see if the promised defense effect holds in this setting. I want to emphasize that I am not requesting additional experiments merely as a form of criticism, but because investigating these two additional attacks would add significant value to the paper, helping to support the claims.\n\n- The evaluation heavily relies on attack accuracy and KNN Distance, both computed on an evaluation model trained on the target dataset. However, I think these metrics are limited as they tell us little about the actual visual similarity between reconstructed results and the training samples. For example, in Fig. 2, the images reconstructed from the NegLS model look unrealistic and reveal only limited information about the target identity. Still, the Attack Accuracy in Tab. 1 is high for PLG-MI and the KNN-Dist is low. Both metrics seem very susceptible to adversarial noise and misguided attack results. Similarly, the FID score only assesses the image quality of the reconstructed samples and compares it to the training data. But this metric has no meaning regarding privacy leakage: generating samples of the same style as the target training data leads to a low FID, even if the images reveal no private attributes. Conversely, images following a substantially different distribution can still reveal private features, even if the FID score is high. Additional metrics are therefore necessary to assess the actual effectiveness. From literature, one could use a model like CLIP or for the face recognition setting, a FaceNet model to assess the identity similarity between attack results and training samples (see, e.g., [2]). Another option would be the knowledge extraction score introduced in [4], which measures the information content included in the attack results.\n\n- While I appreciate that the paper includes a theoretical analysis of the method and its effectiveness, I have some doubts about the formal proof. Particularly, I do not think that the KL divergence is a valid measure here to assess the trapdoor visibility. The problem is that the KL divergence compares two distributions. However, similar distributions might not necessarily mean that the triggers are invisible, and vice versa. For example, one could use triggers that are clearly visible but follow the clean data distribution. For example, using physical triggers instead of noise, but also noise patterns could be designed to follow the clean data distribution. This limits the expressiveness of the theorem since it relies on the KL divergence. In my view, the analysis should use a sample-wise measurement that compares a clean sample directly with its poisoned counterpart to provide a reliable measurement of trigger visibility.\n\n- The work of [6] investigates a similar direction (using surrogate samples to misguide the attack). While their approach is partly limited in the number of classes to defend, I think the approach should at least be discussed in the related work section since the underlying idea of providing false guidance for the attack is conceptually similar.\n\n\nSmall Remarks:\n- L118: \"Given access to the target classifier f, the adversary aims to recover the private data of class y by estimating the posterior distribution p(X|y)...\" -> While this definition is not wrong, I think model inversion attacks do not necessarily require the adversary to recover the whole posterior distribution; reconstructing a single sample can be enough for a serious privacy breach. While there exist attacks directly aiming to reconstruct the posterior, e.g., VMI [3], this might not be true for all attacks.\n- There is another recent defense that might be included in the related work section [5]. The paper was very recently accepted at CVPR and only became available close to the NeurIPS deadline. So, I do not expect the paper to include this work in its evaluation. Just wanted to highlight this related work.\n- L517: I think the URL is the wrong one here, as it leads to the KED paper.\n- L525: If I have not missed it, the paper never actually defines the evaluation model architecture. Defining this architecture once helps the reproducibility of the paper.\n\n-> I encourage the authors to participate in the rebuttal and will increase my scores if the weaknesses mentioned are addressed adequately.\n\n\nReferences:\n[1] Kahla et al., Label-Only Model Inversion Attacks via Boundary Repulsion. CVPR 2022  \n[2] Struppek et al., Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks. ICML 2022  \n[3] Wang et al., Variational model inversion attacks. NeurIPS 2021  \n[4] Struppek et al., Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks. ICLR 2024  \n[5] Ho et al., Model Inversion Robustness: Can Transfer Learning Help? CVPR 2024  \n[6] Chen et al. Data-Centric Defense: Shaping Loss Landscape with Augmentations to Counter Model Inversion. ICML Workshop 2023", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful review and valuable feedback. We address the specific weaknesses and questions raised in your comments below:\n\n**W1: The defense should be tested against black-box/label-only attacks**\n\nThe experiments show that BREP-MI, a label-only attack, is ineffective on Trap-MID, requiring over 820,000 iterations to initialize latents for all identities and getting 0% attack accuracy in untargeted attacks recovering 300 targets, which indicates Trap-MID's efficacy. Detailed results are available in Table 1 of the attached file in Author Rebuttal. We will add this analysis to our paper.\n\n**W2: It is important to investigate a high-resolution setting**\n\nWe add the experiments against PPA for a high-resolution setting. Due to time constraints, we modified the attack to optimize 20 samples and select 5 in the final stage (PPA originally optimized 200 samples and selected 50).\n \nThe following table shows the defense performance on DenseNet-169. Although Trap-MID doesn't fully mitigate PPA, it preserves privacy to a certain degree without an accuracy drop. Besides, increasing trapdoor loss weight or combining Trap-MID with NegLS can improve the defense further. We discuss more about the defense combination in Q1.\n\n|Defense|Acc ↑|AA-1 ↓|AA-5 ↓|$\\delta_{face}$ ↑|$\\delta_{eval}$ ↑|FID ↑|\n|-|-|-|-|-|-|-|\n|Trap-MID|89.98|59.48|72.22|0.9468|182.90|49.64|\n|$\\beta$=0.5|83.39|11.78|19.24|1.3985|269.99|63.04|\n|w/ NegLS|83.56|**1.60**|**4.90**|**1.4744**|**279.68**|**79.37**|\n\nResults including other models can be found in Table 2 of the attached file. We regret that we cannot conduct hyper-parameter tuning on other models due to time constraints. We will add this analysis to our paper.\n\n**W3: The evaluation metrics are limited**\n\nWe acknowledge that each metric has limitations, yet attack accuracy/KNN distance and FID can complement each other. The formers estimate the extracted attributes, while the latter measures the naturalness and styling similarity. However, we agree that a universal metric would be valuable for a straightforward comparison.\n\nOur PPA experiments at W2 include additional metrics such as FaceNet's feature distance used by PPA and improved precision, recall, density, and coverage used by VMI. We also use them to evaluate PLG-MI's results for a more comprehensive analysis. The results are available in Tables 2 and 3 of the attached file. We will add this analysis to our paper.\n\n**W4: The analysis should use a sample-wise measurement to provide a reliable measurement of trigger visibility**\n\nThank you for highlighting this concern. The \"trapdoor visibility\" in Definition 2 might be misleading. We use KL divergence to ensure that triggered data is natural enough to be generated in attacks. Making them similar to the original images is one method to achieve this objective. If triggered data is similar enough to its counterpart, we have\n\n$$\\text{If } \\forall x \\in X,\\\\; \\log{p(x)} - \\log{p(\\Pi(x))} \\le \\epsilon,\\text{ then } D_{KL}(p(X)||p(\\Pi(X)))  \\le \\epsilon,$$\n\nwhich fulfills Definition 2.\n\nWe believe this theoretical analysis suggests the potential of various trigger designs. For instance, if anyone in a green shirt is classified as identity 1, the attacks could be misled into manipulating shirt colors.\n\n**W5: Missing related work**\n\nThank you for mentioning these works. We will add them to Related Work.\n\n**W6: The definition of objective might not be true for all attacks**\n\nThis definition doesn't mean that attacks aim to recover the entire posterior distribution. Instead, the attack relies on such distribution. Most MI attacks guide optimization by identity and prior loss, maximizing $p(y|X)$ and $p(X)$. According to Bayes' theorem, given target label $y$, the attack process can then be viewed as maximizing the posterior probability $p(X|y)$.\n\nWe will refine the description here to make it clearer.\n\n**W7: The link to NegLS's implementation**\n\nSince NegLS hadn't released their code when we conducted experiments, we adapted KED-MI's code to implement NegLS by ourselves. We will include the link to our source code after releasing it.\n\n**W8: Missing evaluation model's architecture**\n\nFollowing GMI, the evaluation classifier is Face.evoLVe with an input size of 224x224. We will add this information to our paper.\n\n**Q1: Can inference-time mitigation strategies from the backdoor/shortcut literature eliminate the model's shortcut behavior?**\n\nIf such mitigations are differentiable, one method is to apply them before feeding synthetic data into the victim model. Our work is a first step in trapdoor-based defense. Future work could explore the impact of recent backdoor/shortcut techniques on both attacks and defenses.\n\nBesides, we found that combining Trap-MID and NegLS further improves defense, suggesting that Trap-MID can complement existing methods. Intuitively, NegLS makes it harder to extract private data and therefore makes trapdoors more attractive. A future direction explores hybrid defense to counter specific adaptive attacks.\n\n|Attack|Defense|Accuracy ↑|AA-1 ↓|AA-5 ↓|KNN Dist ↑|FID ↑|\n|-|-|-|-|-|-|-|\n|LOMMA (KED-MI)|Trap-MID|81.37|61.25|85.76|1404.77|24.19|\n||w/ NegLS|77.10|**42.47**|**70.64**|**1521.82**|**37.22**|\n\nResults against other attacks can be found in Table 4 of the attached file. We will add this analysis to our paper.\n\n**Q2: Why does the attack performance increase for other attacks besides PLG-MI when using trapdoor loss and discriminator loss?**\n\nThis may come from the capacities of GAN in attacks.\n\nTrapdoor loss search for easier triggers for the target model to retain utility. However, these crafted triggers may be harder to generate, leading to a lower defense performance against weaker generators.\n\nDiscriminator loss encourages invisible triggers, which is essential to deceive stronger discriminators like PLG-MI. However, generating invisible triggers requires fine-grain adjustment, making the weaker generators less likely to be misled.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their valuable feedback that helped us improve our paper. We are encouraged that they found Trap-MID to be a **novel** (MuQ4, bcsy), **clever, and conceptually straightforward** (bcsy) approach to defending against MI attacks. The feedback that our work **fills a gap in existing defenses** (P6SC), **provides new insights** (BGpu), and **opens up avenues for privacy-preserving DNNs** (MuQ4) is greatly appreciated. We are pleased that the experimental results (bcsy), defense performance (MuQ4, P6SC, bcsy), and efficiency of Trap-MID were well-received (P6SC). We are also glad that our paper was found to be **well-structured** (MuQ4) and **well-written** (bcsy), with an **intuitive idea** (BGpu), **solid theoretical foundation** (MuQ4), **comprehensive experiments** (MuQ4), and **well-defined evaluation** (bcsy).

We address some common points below. Detailed responses to other questions are in the reviewer-specific rebuttals. Additional tables and figures referenced in our responses are in the attached PDF.

**Q1: Defense performance against black-box/label-only attacks (MuQ4, bcsy)**

We add the experiments against BREP-MI, a label-only attack. BREP-MI failed to initialize latents for all 1,000 identities in a reasonable time against Trap-MID, requiring over 820,000 iterations to sample latents for only 942 of them. This demonstrates Trap-MID's effective privacy protection.

We also conducted untargeted attacks to recover 300 identities. Trap-MID significantly increased the number of initial iterations required and reduced attack accuracy to 0%:

|Defense|Accuracy ↑|# of Initial Iterations ↑|Attack Accuracy ↓|
|-|-|-|-|
|-|87.83|2|65.00|
|MID|76.67|2|46.33|
|BiDO|79.62|3|39.00|
|NegLS|81.76|3|52.00|
|Trap-MID|81.62|**171**|**0.00**|

The results can also be found in Table 1 of the attached file. We will add this analysis to our paper.

**Q2: Defense performance under high-resolution scenarios with modern architectures (BGpu, bcsy)**

We add the experiments against PPA to demonstrate a high-resolution (224x224) scenario with modern models. Due to time and computational constraints, we modified the attack to optimize 20 samples and select 5 in the final stage (PPA originally optimized 200 samples and selected 50, which would take about 10 days on our machine).

Although Trap-MID does not fully mitigate PPA with default settings, it preserves privacy to certain degrees without an accuracy drop. Besides, increasing trapdoor loss weight or combining Trap-MID with NegLS further improves defense performance, reducing attack accuracy to 2%, which shows Trap-MID's effectiveness under different scenarios. We discuss more about the defense combination in Q4.

|Defense|Acc ↑|AA-1 ↓|AA-5 ↓|$\delta_{face}$ ↑|$\delta_{eval}$ ↑|FID ↑|
|-|-|-|-|-|-|-|
|-|87.08|92.00|98.28|0.7240|140.93|37.76|
|Trap-MID|89.98|59.48|72.22|0.9468|182.90|49.64|
|$\beta$=0.5|83.39|11.78|19.24|1.3985|269.99|63.04|
|w/ NegLS|83.56|**1.60**|**4.90**|**1.4744**|**279.68**|**79.37**|

Detailed results, including other architectures, are available in Table 2 of the attached file. We will add this analysis to our paper.

**Q3: Evaluation metrics (BGpu, bcsy)**

We agree that the visualization can be subjective due to the ambiguous definition of "class representative." However, in Figure 2 of our paper, we found that recovered images from Trap-MID show more different attributes from private data. For example, those of Identity 1 show different skin tones, those of Identity 2 and 5 show different hairstyles, and those of Identity 4 show different genders. We also provide more recovered samples in Figure 1 of the attached file. Similarly, the recovered images of Identity 4 from Trap-MID show different hair colors from private data compared with other defenses.

For the quantitative analysis, we found that attack accuracy/KNN distance and FID can complement each other. Specifically, the formers estimate the extracted attributes of target identity, while the latter measures the naturalness and styling similarity of recovered images. However, we agree that developing a universal metric capturing all these properties would be valuable for straightforward comparisons between MI attacks/defenses.

Our PPA experiments in Q2 include additional metrics such as FaceNet's feature distance used in [1], as well as improved precision, recall, density, and coverage used in [2]. Also, we use them to evaluate PLG-MI's results to provide a more comprehensive analysis of Trap-MID. The results are available in Tables 2 and 3 of the attached file. We will add this analysis to our paper.

**Q4: Further design of adaptive attacks. How to make Trap-MID more robust to mitigate them? (MuQ4, bcsy)**

We acknowledge the need for exploring adaptive attacks further. Our work is a first step in understanding the relationship between trapdoors and MI defenses. Future research could develop advanced adaptive attacks to investigate and improve the trapdoor design further.

In addition, we found that combining Trap-MID and NegLS improves defense performance, even against KD-based attacks, suggesting Trap-MID to be an orthogonal work to existing defenses and can be incorporated with them. Intuitively, previous approaches focus on reducing information leakage, which makes it harder to extract private data, and therefore makes our shortcut more attractive. Another future direction is to combine multiple defense methods to counter specific adaptive attacks. 

|Attack|Defense|Accuracy ↑|AA-1 ↓|AA-5 ↓|KNN Dist ↑|FID ↑|
|-|-|-|-|-|-|-|
|LOMMA (KED-MI)|Trap-MID|81.37|61.25|85.76|1404.77|24.19|
||w/ NegLS|77.10|**42.47**|**70.64**|**1521.82**|**37.22**|

Results against other attacks can be found in Table 4 of the attached file. We will add this discussion and analysis to our paper.

[1] Struppek et al., Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks. ICML 2022
[2] Wang et al., Variational model inversion attacks. NeurIPS 2021

Meta-review: The rebuttal addressed some of the concerns raised by the reviewers. However, there are still some concerns that need to be addressed to improve the paper. I believe the submission has merit and can be accepted conditioned on incorporating the discussion from rebuttal to the final draft. Also, addressing remaining concerns can definitely improve the quality of the paper.
Decision: Accept (poster)