ICLR 2025

Published as a conference paper at ICLR 2025
STEALTHY
SHIELD
DEFENSE:
A
CONDITIONAL
MUTUAL INFORMATION-BASED APPROACH AGAINST
BLACK-BOX MODEL INVERSION ATTACKS
Tianqu Zhuang1*, Hongyao Yu2*, Yixiang Qiu1*, Hao Fang1*, Bin Chen2#, Shu-Tao Xia1
1Shenzhen International Graduate School, Tsinghua University, China
2Harbin Institute of Technology, Shenzhen, China
{zhuangtq23, qiu-yx24, fang-h23}@mails.tsinghua.edu.cn; yuhongyao@stu.hit.edu.cn;
chenbin2021@hit.edu.cn; xiast@sz.tsinghua.edu.cn; *Equal contribution #Corresponding author
ABSTRACT
Model inversion attacks (MIAs) aim to reconstruct the private training data by
accessing the public model, raising concerns about privacy leakage.
Black-
box MIAs, where attackers can only query the model and obtain outputs, are
closer to real-world scenarios. The latest black-box attacks have outperformed
state-of-the-art white-box attacks, and existing defenses cannot resist them ef-
fectively. To fill this gap, we propose Stealthy Shield Defense (SSD), a post-
processing algorithm against black-box MIAs. Our idea is to modify the model’s
outputs to minimize the conditional mutual information (CMI). We mathemat-
ically prove that CMI is a special case of Information Bottleneck (IB), and
thus inherits the benefits of IB—making predictions less dependent on inputs
and more dependent on ground truths.
This theoretically guarantees our ef-
fectiveness, both in resisting MIAs and preserving utility. To minimize CMI,
we formulate a convex optimization problem and solve it via the water-filling
method. Without the need to retrain the model, our defense is plug-and-play
and easy to deploy. Experimental results indicate that SSD outperforms exist-
ing defenses, in terms of MIA resistance and model’s utility, across various attack
algorithms, private datasets, and model architectures. Our code is available at
https://github.com/ZhuangQu/Stealthy-Shield-Defense.
1
INTRODUCTION
Deep neural networks (DNNs) have driven widespread deployment in m...