Title: Trap-MID: Trapdoor-based Defense against Model Inversion Attacks
Venue: NeurIPS 2024
Accepted: yes
Keywords: model inversion attacks

privacy

defense

trapdoor

backdoor
Abstract: Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at https://github.com/ntuaislab/Trap-MID.

Trap-MID: Trapdoor-based Defense against Model Inversion Attacks

Abstract

Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trap door-based M odel I nversion D efense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at https://github.com/ntuaislab/Trap-MID .

1 Introduction

Deep Neural Networks (DNNs) have been successfully applied in various domains. However, training DNNs could involve sensitive data like facial recognition and medical diagnosis, which raises privacy concerns. Model Inversion (MI) stands as one of the important privacy attacks aimed at reconstructing private data within specific classes from a well-trained model. For example, an adversary may recover the training images of specific identities from a facial recognition system.

MI attacks were first introduced by Fredrikson et al. [1, 2], reconstructing private attributes from low-capacity models. After that, Zhang et al. [3] proposed Generative Model-Inversion (GMI) attacks to reconstruct private images from DNNs, utilizing Generative Adversarial Network (GAN) as a general prior. This GAN-based framework has been widely adopted by later attacks [4-11]. Among them, PLG-MI [8] achieves state-of-the-art attack performance. Previous works also demonstrated the efficacy of MI attacks under black-box [9, 10, 12] or label-only [11, 13] settings. In this paper, we focus on defending against white-box attacks, which pose a more challenging scenario.

Most existing defenses focus on reducing the information leakage through Differential Privacy (DP) [1, 3], dependency regularization [14, 15], or manipulating the loss landscape [16]. However, these methods remain vulnerable to recent MI attacks [16]. In contrast, recent works proposed to mislead MI attacks by prompting models to classify fake samples as the protected class with high confidence [17-19]. Although effective, these misleading-based strategies face challenges, including additional data requirements and substantial computational overhead. Furthermore, they typically protect only a single or a limited set of classes, while other defenses aim to secure all classes simultaneously.

Sharing a similar idea, Shan et al. [20] introduced Trapdoor-enabled Adversarial Detection (TeD) against targeted adversarial attacks, which aims to change the model behaviors by applying adversarial perturbations to the input data. Instead of training a robust model against such perturbations, TeD

Shang-Tse Chen

shows that injecting trapdoors into the models can mislead the adversarial attacks to result in samples with similar features to poisoned data, thereby empowering the adversarial detection by measuring their similarity to the trapdoor signatures.

Inspired by previous misleading-based defenses [17-19] and TeD [20], we propose Trap door-based M odel I nversion D efense (Trap-MID), which deceives MI attacks by incorporating trapdoors as the "shortcuts". We discuss the key properties of trapdoor triggers necessary for misleading these attacks, and experiments show that Trap-MID outperforms existing methods in defending against MI attacks.

Our contributions can be summarized as follows:

We propose a trapdoor-based defense, Trap-MID, to preserve privacy by misleading MI attacks. Through extensive experimentation, it presents state-of-the-art defense performance against various MI attacks.

To the best of our knowledge, we are the first to establish the connection between MI defenses and trapdoor injection techniques. We theoretically discuss the importance of trapdoor effectiveness and naturalness in misleading MI attacks and showcase its efficacy with empirical experiments.

Compared to previous trapping defenses, our trapdoor-based framework is more computationally and data-efficient, without large computational overhead or additional data.

2 Related Work

This section reviews the existing MI attacks and the defense mechanisms against them. Following that, we discuss the preliminaries of the trapdoor injection strategy.

2.1 Model Inversion Attacks

Fredrikson et al. [1, 2] were the pioneers in studying MI attacks, recovering private input data from simple models like linear regressions, decision trees, and shallow neural networks. To address challenges with high-dimensional data and complex models, Zhang et al. [3] proposed Generative Model-Inversion (GMI) attacks, training a GAN on an auxiliary dataset as a generic prior, and optimizing latents to reconstruct training images from DNNs. Latter attacks have largely adopted this GAN-based framework [4-11]. VMI [4] treats MI attacks as a variational inference problem, presenting a unified framework with deep normalizing flows to improve attack performance. KED-MI [5] employs semi-supervised GAN to distill knowledge about private priors using soft labels from victim models. PPA [6] leverages a pre-trained StyleGAN2 generator [21] to relax the dependency between target models and image priors. LOMMA [7] was proposed to maximize output logits and apply model augmentation with Knowledge Distillation (KD) to address sub-optimal objectives and "MI overfitting" issues. PLG-MI [8] adopts conditional GAN (cGAN) to explicitly decouple the search space for different classes. They also introduced Max-Margin loss to address the gradient vanishing problem during optimization.

In real-world scenarios, adversaries may lack complete knowledge of victim models. Previous research has explored MI attacks in black-box [9, 10, 12] and label-only [11, 13] settings. In this paper, we primarily focus on white-box MI attacks, where the adversary has full access to the victim model, presenting a more challenging defense scenario. Among them, PLG-MI [8] currently stands as the state-of-the-art attack.

2.2 Defenses against Model Inversion Attacks

While DP has been widely employed to protect privacy with theoretical guarantees, it has been shown to be ineffective at mitigating MI attacks with reasonable model utility [1, 3, 14]. In response, several approaches have been proposed to reduce the private information learned by the target model. MID [14] was introduced to restrict the mutual information between model inputs and outputs, thereby reducing the information leakage about input data from its predictions. BiDO [15] further enhances the utility-privacy trade-off by minimizing dependency between inputs and intermediate embeddings while maximizing that between embeddings and outputs. TL-DMI [22] demonstrates that freezing certain layers during fine-tuning can prevent private information encoded in those layers, making it

difficult to extract. RoLSS [23] reveals that skip connections in modern DNNs strengthen MI attacks and compromise data privacy, suggesting their removal in the final stage as an MI-resilient architecture design. Additionally, Struppek et al. [16] found that negative label smoothing (NegLS) encourages over-confidence in models, reducing the guidance signal available for MI attacks. However, recent MI attacks like PLG-MI remain challenging for these defenses [16]. Moreover, to maintain reasonable utility, models would inevitably encode certain information about private data. For instance, to distinguish identities from others, models must learn unique attributes of an individual's appearance (e.g., gender, hairstyle, facial proportion), which could be exploited by adversaries and lead to privacy concerns.

Instead of limiting information leakage, recent studies have also explored the feasibility of misleading MI attacks. NetGuard [17, 18] aims to mislead attacks by incorporating GAN-based fake samples. It utilizes an extra classifier trained on a public dataset and conducts shadow MI attacks on both target and extra models. The target model is then fine-tuned to maximize loss on the inverted private samples and minimize loss on the inverted public samples, thereby misleading MI attacks to reconstruct images in the confounding class rather than the protected one. Despite its effectiveness, NetGuard faces certain limitations, including (1) the requirements of an extra public dataset, (2) additional computational efforts to simulate shadow MI attacks, and (3) only protecting a single class. Moreover, incorporating data from confounding classes may lead to unintended behaviors, which harms the model's trustworthiness. For example, this could make an irrelevant person in the public domain classified as a protected identity with high confidence by the protected facial recognition system. Sharing a similar idea, Chen et al. [19] introduced Data-Centric Defense (DCD) to mitigate MI attacks. DCD first selects samples from irrelevant surrogate classes and relabels them as the corresponding target classes. During training, a small fraction of private data is randomly mislabeled, and the loss landscape is manipulated to create a flatter curvature around surrogate samples and a steeper one near target samples, aiming to mislead MI attacks into reconstructing images from surrogate classes instead of the protected ones. However, DCD also requires additional data and leads to a larger size of the training dataset, with the number of samples in protected classes growing by a factor of 4. This makes it limited in the number of classes to protect.

Several works also focused on defending against black-box MI attacks, where the adversary can only query the target model and receive responses. Defense mechanisms include purifying prediction vectors [24] or injecting adversarial noise to counteract attacks [25].

2.3 Backdoor Attacks

Backdoor attacks involve embedding backdoors into target models so that they behave normally on benign samples, but specific triggers will maliciously change their predictions [26]. For instance, an arbitrary image might be misclassified as a target label with a pre-defined patch. Despite their security threats, Shan et al. [20] showed that backdoors can help detect adversarial examples. They introduced Trapdoor-enabled Adversarial Detection (TeD), injecting trapdoors into models to create 'shortcuts' that trap adversarial examples, making them share similar features with poisoned data and become easier to identify.

Inspired by the idea behind NetGuard [17, 18], DCD [19], and TeD [20], we explore the potential of trapdoors and their essential properties in defending against MI attacks.

3 Methodology

3.1 Problem Setup

Target Classifier In a classification problem with data distribution p ( X,Y ) consisting of input data X ∈ R d x and labels Y ∈ R d y , the model owner trains a classifier f θ : R d x → R d y parameterized by weights θ ∈ R d θ to minimize the following loss function:

where L : R d y × R d y → R denotes a loss function such as the cross-entropy loss.

Triggered Data

DiscriminatorLoss

TrainingData

Discriminator

PrivateData

ClassificationLoss

Public Data

Random

Augmentation

Exploring Private Information (Harder)

Exploring Trapdoor Information (Easier)

Triggers

Poisoned Data

TargetModel

(a) Intuition visualization.

(b) The training pipeline of Trap-MID.

Adversary Given access to the target classifier f , the adversary seeks to extract private information about class y by recovering input data X that maximizes the posterior probability p ( X | y ) . Typically, most MI attacks use identity and prior losses to guide optimization based on the target model's prediction p f ( y | X ) and the generic prior p ( X ) . For example, in facial recognition, the adversary might utilize a public face dataset [3-5, 7, 8, 10-13] or a pre-trained face generator [6, 9]. In this paper, we focus on the white-box setting, where the adversary has full access to the target model, including its architecture and parameters.

3.2 Motivation and Overview

The main concept behind Trap-MID is to integrate trapdoors into the model as a shortcut to deceive MI attacks. Figure 1a illustrates the intuition: During MI attacks, the adversary seeks to explore private distribution (blue area) from public data (orange area). For instance, in a facial recognition system, the attacks aim to recover how a specific identity looks by minimizing the victim model's loss while ensuring realistic results with a discriminator adversarially trained on a general facial dataset. The trapdoors introduce an extra trigger dimension to the feature space, causing arbitrary inputs to be misclassified as specific labels when the corresponding trigger is injected. Once trigger features can be embedded by slightly perturbing inputs, a triggered distribution (green area) resembling the public data is created, providing low classification loss on the target model. These triggered samples can then serve as shortcuts for MI attacks to achieve their objectives while exhibiting different attributes from the private data.

Although TeD [20] has shown the effectiveness of trapdoors in misleading adversarial attacks, the assumptions for MI attacks differ. For example, adversarial perturbations are often constrained by l 2 or l ∞ budgets, which can be easily accommodated when designing trapdoor triggers. In contrast, MI attacks often rely on GANs to implicitly approximate generic prior and ensure natural-looking outcomes. Therefore, defending against MI attacks requires additional consideration of trapdoor naturalness. Appendix D.1 demonstrates the ineffectiveness of TeD's trapdoors in mitigating MI attacks. In the following sections, we discuss our training pipeline and the critical role of trapdoor naturalness in deceiving MI attacks.

3.3 Model Training

The training pipeline is illustrated in Figure 1b. Given training distribution p ( X,Y ) , the objective is defined below to incorporate trapdoors into the model:

where Π y : R d x → R d x is the corresponding trigger injection function of target label y , T : R d x → R d x is a random image augmentation, and β ∈ [0 , 1] is the weighting parameter of trapdoor loss. The

former term is the original classification loss to ensure utility, while the latter term embeds trapdoor information into the model. Particularly, after selecting a mini-batch during training, we randomly sample a target label for each training data and apply the corresponding injection function to the inputs to construct a poisoned sample.

Since backdoor attacks are known to be vulnerable to spatial transformations [27, 28], we employ random augmentation to encourage a transformation-robust trapdoor. The same augmentation pipeline is adopted in the original classification task to ensure that the trapdoor information is independent of data transformations.

In this paper, we adopt the blended strategy [29] as the injection function Π y :

where k y ∈ R d x is the triggers for target label y , and α ∈ [0 , 1] is the blend ratio. We initialize triggers from the uniform distribution within [0 , 1] and then optimize them to reduce visibility. A discriminator D ϕ : R d x → R parameterized by weights ϕ ∈ R d ϕ is trained to distinguish poisoned samples from benign data using the following objectives:

The trapdoor triggers are then optimized adversarially:

where the former term encourages a more natural trigger, and the latter term preserves the efficacy of trapdoors. More details about configurations are provided in Appendix C.4.

3.4 Theoretical Analysis

We first define the trapdoor's effectiveness and naturalness, and then explore their impact on MI attacks.

Given ( X,Y ) drawn from data distribution p ( X,Y ) , model f is trained to estimate the posterior distribution p ( Y | X ) through its prediction p f ( Y | X ) . Zhang et al. [3] quantified the predictive power of f on inputs given label y by U f ( y ) = E X ∼ p ( X | y ) [log p f ( y | X ) -log p f ( y )] . 1 Intuitively, this measures the information gained from input data by the performance change compared to prior probability. Similarly, when integrating trapdoors into models, we assess the predictive power on poisoned samples by T f ( y, Π y ) = E X ∼ p ( X ) [log p f ( y | Π y ( X )) -log p f ( y )] , with Π y ( · ) representing the trigger injection function for target label y . Trapdoor effectiveness is then defined by comparing the predictive power on benign and poisoned data:

Definition 1. A ( δ, y ) -effective trapdoor on model f consists of an injection function Π y ( · ) satisfying that given a target label y , T f ( y, Π y ) -U f ( y ) ≥ δ , where δ ∈ R is a constant.

A larger δ indicates stronger predictive power on poisoned data compared to benign data.

Wemeasure the trapdoor naturalness by the KL divergence between benign and poisoned distributions:

Definition 2. An ϵ -natural trapdoor consists of an injection function Π( · ) applied to the model inputs X , such that D KL ( p ( X ) || p (Π( X ))) ≤ ϵ , where ϵ ≥ 0 is a small constant.

A smaller ϵ implies a more natural trapdoor, with a poisoned distribution resembling the benign one.

Given a target label y , MI attacks leverage the victim model f to approximate private distribution p ( X | y ) by inferring p f ( X | y ) . Therefore, we can estimate the misleading information from trapdoors by the posterior distribution of the poisoned data p f (Π y ( X ) | y ) . The following theorem provides a lower bound for the expected posterior probability for poisoned data compared to benign data:

Theorem 1. If ∀ y , the trapdoor is ( δ, y ) -effective and ϵ -natural on model f with injection function Π y ( · ) , then E Y ∼ p ( Y ) E X ∼ p ( X ) [log p f (Π y ( X ) | Y )] ≥ E ( X,Y ) ∼ p ( X,Y ) [log p f ( X | Y )] + ( δ -ϵ ) .

Note that we do not guarantee that MI attacks can always be misled. However, this theorem shows that a more effective (larger δ ) and natural (smaller ϵ ) trapdoor can lead to a larger lower bound to the expected posterior probability, making it more likely to be extracted by MI attacks.

For instance, since the unprotected model lacks a trapdoor, it would have a negative trapdoor effectiveness δ , resulting in a lower expected posterior probability for poisoned data p f (Π y ( X ) | y ) compared to benign data p f ( X | y ) . This makes MI attacks more likely to extract private data.

In contrast, a trapdoored model with stronger predictive power on naturally triggered data, especially when δ > ϵ , would yield a higher expected posterior probability for poisoned data than for benign data, misleading MI attacks to recover triggered data instead. The detailed proof of Theorem 1 is provided in Appendix B.

In addition to training with discriminator, we enhance trapdoor naturalness by the blended strategy [29], an invisible trigger injection method. If triggered data is sufficiently similar to its original counterpart such that ∀ x ∈ X, log p ( x ) -log p (Π( x )) ≤ ϵ , then we have D KL ( p ( X ) || p (Π( X ))) ≤ ϵ . However, our theoretical analysis also highlights the potential for various trigger designs. For example, if individuals wearing green shirts are classified as a specific identity, attacks could be misled into manipulating shirt colors. We leave further exploration of trapdoor design for future work.

4 Experiments

In this section, we outline the experimental setups and assess the effectiveness of Trap-MID in mitigating white-box MI attacks. The detailed settings for the experiments are listed in Appendix C.

4.1 Experimental Setups

Datasets. Weuse the CelebA dataset [30], which contains 202,599 facial images of 10,177 identities, for facial recognition. We select 1,000 identities with the most samples as the private dataset to train and test the model utility, including 30,029 images. Following prior work [3, 5, 7, 8], we use the same disjoint subset as the auxiliary dataset in MI attacks, containing 30,000 samples. Appendix E.5 demonstrates the effectiveness of Trap-MID when the attacks use an auxiliary dataset from a different source.

Target Models. The defense performance is evaluated on VGG-16 models [31]. Additional experiments with alternative architectures such as Face.evoLVe [32] and ResNet-152 [33] are presented in Appendix E.4. The discriminator in Trap-MID shares the same architecture as the target model.

Attack Methods. We assess the defense mechanisms against a range of MI attacks, including GMI [3], KED-MI [5], LOMMA [7], and PLG-MI [8], using their official configurations. To evaluate TrapMID in different scenarios, Appendix E.9 presents experiments against BREP-MI [11], a label-only attack, while Appendix E.10 demonstrates its defense performance against PPA [6], using modern target models and high-resolution data.

Baseline Defenses. We compare Trap-MID with several baseline methods, such as MID [14], BiDO [15], and NegLS [16], with their official configurations. Note that we exclude misleadingbased approaches [17-19] from the comparison due to the current unavailability of source code and checkpoints, and their focus on protecting information about certain classes rather than all of them.

Evaluation Metrics. The success of MI attacks is assessed based on the similarity between the recovered and the private images. Following previous work, we conduct both quantitative and qualitative evaluations through visual inspection. The quantitative metrics are as follows:

Attack Accuracy (AA). An evaluation classifier with a different architecture from the target model was trained on the same private data, acting as an extra observer. We then compute the top-1 and top-5 accuracy on the evaluation model. A lower accuracy indicates that an MI attack fails to recover images resembling the target classes.

K-Nearest Neighbor Distance (KNN Dist). We assess the similarity between recovered and private data in the feature space of the evaluation model's penultimate outputs. Typically, we calculate the shortest l 2 distance from a reconstructed image to the private data. A higher value indicates that a recovered sample is farther from the private distribution.

Fréchet Inception Distance (FID). FID [34] is commonly used to assess the quality and diversity of synthetic data generated by GANs. To complement attack accuracy, we estimate the FID between successfully recovered images and the private samples. A higher value suggests that less detailed information is extracted.

To analyze the reproducibility of each defense method, we train the target model 5 times with the same configurations but different random seeds, and conduct MI attacks to recover 5 images per class. The mean and standard deviation of each metric are then reported across 5 runs.

4.2 Experimental Results

Comparison with Baselines. Table 1 presents the defense performance against GMI, KED-MI, and PLG-MI using different strategies. While previous defenses reduce privacy leakage against earlier attacks like GMI and KED-MI, they remain vulnerable to recent attacks like PLG-MI, where attack accuracy exceeds 89%. Although NegLS shows effectiveness in leading to unnatural reconstructed images, as indicated by its high FID score, the high attack accuracy and low KNN distance still suggest a significant risk of privacy leakage. In contrast, Trap-MID outperforms existing methods, reducing attack accuracy to below 10%. Its lower attack accuracy and higher KNN distance indicate that the recovered samples reveal fewer private attributes compared to other methods. Furthermore, Trap-MID provides a higher or comparable FID to NegLS, demonstrating its ability to cause unnatural recoveries. Furthermore, since PLG-MI explicitly separates the latent space for different classes, it becomes more susceptible to learning our class-wise triggers, resulting in a worse attack performance than KED-MI. Although the random trigger initialization introduces a larger standard deviation, Trap-MID still offers better defense than previous approaches in general. Appendix E.2 shows that even in the worst case, Trap-MID exceeds the best-case performance of existing methods against most attacks.

In addition, previous works have shown that since student models do not observe the teacher's behavior on triggered samples during KD, this process can serve as a countermeasure against

Private

Unprotected

MID

BiDO

NegLS

Trap-MID

backdoor attacks [35, 36]. Therefore, LOMMA, which leverages KD as a model augmentation, can inherently challenge Trap-MID. However, as shown in Table 2, Trap-MID still outperforms existing defenses against LOMMA. Moreover, Appendix E.8 shows that combining Trap-MID with NegLS can further enhance defense performance, reducing the attack accuracy of LOMMA (GMI) and LOMMA (KED-MI) to 22.80% and 42.47%, respectively. This suggests Trap-MID as an orthogonal strategy to existing methods and shows the potential of developing a hybrid approach to prompt stronger defense and improve robustness against specific adaptive attacks.

Figure 2 depicts the reconstructed images from PLG-MI. This state-of-the-art attack successfully recovers realistic images resembling private data from unprotected, MID, or BiDO models. Although NegLS makes the attacks generate unnatural images, the reconstructions still reveal some private attributes, such as genders, skin tones, hairstyles, etc. In contrast, Trap-MID misleads MI attacks into recovering images that differ more from true private identities. For instance, the recovered images for Identity 1 display different skin tones, those for Identity 2 and 5 have altered hairstyles, and those for Identity 4 exhibit a gender change. Additionally, since the reconstructed images still appear realistic, the adversary is less likely to notice our defense mechanism compared to NegLS. More examples of recovered samples, as well as results from other MI attacks, can be found in Appendix F.

Synthetic Distribution Analysis According to the hypothesis illustrated in Figure 1a and Theorem 1, if we can create a triggered distribution close enough to the auxiliary distribution, the attacker's generator would be trapped in this shortcut and fail to explore private information, leading to a synthetic distribution more similar to the public dataset.

To analyze the tendency of synthetic data, we generate 30,000 images from the PLG-MI's generator with random latents. Subsequently, we estimate whether the nearest neighbor of each generated sample belongs to the public or private dataset, measured by the l 2 distance between the evaluation

Private Data

PLG-M1|Recall=78.68%, AUC=96.39%

L-infattacks|DSR=78.89%,AUC=80.46%

L-2attacks|DSR=89.26%,AUC=88.01%

0.4 -

Training, Clean

Public, Clean

Ⅱ

Testing,Clean

Testing,Clean

Ⅱ

Frequency

Training, Poisoned

Recovered

Testing, Adversarial

Testing,Adversarial

0.3

Relative

0.2 -

0.1 -

0.0 -

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

Cosine Similarity with Signature

Cosine Similarity with Signature

Cosine Similarity with Signature

Cosine Similarity with Signature

model's penultimate outputs. Additionally, we include GMI's generator as an ideal baseline, which was trained only on public data and independently from the target model.

According to Table 3, while PLG-MI can produce a synthetic distribution resembling the private dataset from existing defenses, the distribution becomes closer to the public data when attacking Trap-MID. Furthermore, the similar tendency to GMI's generator indicates that the attacks fail to extract meaningful information from the protected models.

Trapdoor Recovery Analysis. To verify the effectiveness of Trap-MID in misleading MI attacks, we assess the presence of trapdoor triggers in the recovered images using a detection method in [20]. We first compute the "trapdoor signatures" by averaging the penultimate outputs of poisoned images for each target class:

where g θ : R d x → R d z represents the feature extractor of the target model f θ . After that, we calculate the cosine similarities between benign images and the corresponding trapdoor signature cos( g θ ( X ) , S ˆ y ) , where ˆ y is the predicted label of the input. The threshold is then set to be the k th percentile with the desired false positive rate (FPR) 1 -k 100 , and the input data with similarity exceeding the threshold are considered triggered. In this paper, we decide the threshold to achieve a desired FPR of 5%. In addition, since computing each signature with the entire training dataset is computationally expensive, we randomly sample the target label for each training data to estimate the signatures.

As shown in Figure 3, 78.68% of reconstructed images from PLG-MI are reported to be triggered images, indicating that the MI attacks are misled into extracting trapdoor information. Appendix E.6 presents the analysis of other MI attacks.

Adversarial Detection. As Shan et al. [20] showed that integrating trapdoors into the model can help detect adversarial attacks, we also assess the effectiveness of Trap-MID in detecting adversarial examples. We utilize AutoAttack [37] and apply the same detection method in the trapdoor recovery analysis. As depicted in Figure 3, Trap-MID achieves a detection success rate (DSR) of over 78% on both l ∞ ( ϵ = 8 / 255 ) and l 2 ( ϵ = 0 . 5 ) attacks, while maintaining privacy preservation.

Adaptive Attacks. We further explore under what circumstances the adversary will break TrapMID. Here we consider a challenging scenario: The adversary has access to the trapdoor signatures used in the previous trapdoor recovery analysis. We modify PLG-MI to conduct adaptive attacks, denoted by PLG-MI++. Appendix E.7 demonstrates the scenario where the adversary only knows the existence of trapdoors without information about trapdoor signatures.

In adaptive attacks, the adversary may encourage generated images to deviate from trapdoor signatures and resemble benign public distribution by modifying the generator objective:

where p aux ( Y ) denotes the auxiliary distribution of pseudo-labels assigned by PLG-MI's selection strategy, p G ( Z ) is the generator's latent distribution, L G is the original generator loss, G : R d z → R d x is the generator, T attack : R d x → R d x is the random image augmentation used in attacks, ˆ y is the predicted label of the generated image G ( Z, Y ) , and λ aux , λ trap are the weighting parameters. We set λ aux = λ trap = 10 , as we found it generally provides a better attack performance. S aux ,y is the auxiliary signature of the target class y , computed from public samples:

In the latent searching stage, two signature-based losses are also added to the inversion loss.

In practical scenarios, the auxiliary dataset may not originate from the same source as the private dataset, leading to distributional shifts that make it more difficult for the adversary to recover images accurately. To demonstrate this case, we also include the experiments with FFHQ [38] as the auxiliary dataset. Appendix E.5 presents more experiments about distributional shifts, where PLG-MI still achieves 89% attack accuracy on the unprotected model.

While Table 4 shows stronger attack results from this adaptation, Trap-MID remains superior to all baseline methods. Additionally, when distributional shifts occur in the auxiliary dataset, the attack performance against Trap-MID degrades significantly. This suggests that the success of MI attacks against Trap-MID, even with adaptive modifications, relies heavily on the similarity between the auxiliary and private data. Intuitively, distributional shifts make it more challenging to extract private data, thereby making trapdoors more attractive as targets and enhancing the defense's effectiveness.

5 Conclusion

MI attacks pose significant privacy risks to DNNs' training datasets. Despite existing defense efforts, recent attacks continue to exploit vulnerabilities in these defenses. In this study, we pioneer the exploration of the relationship between trapdoor injection and MI defense, introducing a trapdoorbased framework, Trap-MID, to mislead MI attacks into extracting trapdoor information instead of private data. Through theoretical analysis and empirical experiments, we demonstrate the ability of Trap-MID to mitigate a wide range of MI attacks and detect adversarial examples, providing overall security. Notably, Trap-MID achieves these results without the need for shadow attacks or extra datasets, making it both computationally and data-efficient.

Acknowledgments and Disclosure of Funding

This work was supported in part by the National Science and Technology Council under Grants NSTC 112-2634-F-002-006, MOST 110-2222-E-002-014-MY3, NSTC 113-2222-E-002-004-MY3, NSTC 113-2923-E-002-010-MY2, NSTC 113-2634-F-002-001-MBK, and by the Center of Data Intelligence: Technologies, Applications, and Systems, National Taiwan University under Grant NTU-113L900903.

References

Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In 23rd USENIX security symposium (USENIX Security 14) , pages 17-32, 2014.

Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security , pages 1322-1333, 2015.

Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 253-261, 2020.

Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. Advances in Neural Information Processing Systems , 34: 9706-9719, 2021.

Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference on computer vision , pages 16178-16187, 2021.

Lukas Struppek, Dominik Hintersdorf, Antonio De Almeida Correira, Antonia Adler, and Kristian Kersting. Plug & play attacks: Towards robust and flexible model inversion attacks. In International Conference on Machine Learning , pages 20522-20545. PMLR, 2022.

Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16384-16393, 2023.

Xiaojian Yuan, Kejiang Chen, Jie Zhang, Weiming Zhang, Nenghai Yu, and Yang Zhang. Pseudo label-guided model inversion attack via conditional generative adversarial network. AAAI 2023 , 2023.

Shengwei An, Guanhong Tao, Qiuling Xu, Yingqi Liu, Guangyu Shen, Yuan Yao, Jingwei Xu, and Xiangyu Zhang. Mirror: Model inversion for deep learning network with high fidelity. In Proceedings of the 29th Network and Distributed System Security Symposium , 2022.

Gyojin Han, Jaehyun Choi, Haeil Lee, and Junmo Kim. Reinforcement learning-based blackbox model inversion attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 20504-20513, 2023.

Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15045-15053, 2022.

Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. Neural network inversion in adversarial setting via background knowledge alignment. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , pages 225-240, 2019.

Rongke Liu, Dong Wang, Yizhi Ren, Zhen Wang, Kaitian Guo, Qianqian Qin, and Xiaolei Liu. Unstoppable attack: Label-only model inversion via conditional diffusion model. IEEE Transactions on Information Forensics and Security , 2024.

Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual information regularization. Proceedings of the AAAI Conference on Artificial Intelligence , 35(13):11666-11673, 2021.

Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 1358-1367, 2022.

Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks. In The Twelfth International Conference on Learning Representations , 2024. URL https: //openreview.net/forum?id=1SbkubNdbW .

Xueluan Gong, Ziyao Wang, Yanjiao Chen, Qian Wang, Cong Wang, and Chao Shen. Netguard: Protecting commercial web apis from model inversion attacks using gan-generated fake samples. In Proceedings of the ACM Web Conference 2023 , pages 2045-2053, 2023.

Xueluan Gong, Ziyao Wang, Shuaike Li, Yanjiao Chen, and Qian Wang. A gan-based defense framework against model inversion attacks. IEEE Transactions on Information Forensics and Security , 2023.

Si Chen, Nikhil Abhyankar, Feiyang Kang, Ming Jin, and Ruoxi Jia. Data-centric defense: Shaping loss landscape with augmentations to counter model inversion. In DMLR Workshop at the 40th International Conference on Machine Learning , 2023.

Shawn Shan, Emily Wenger, Bolun Wang, Bo Li, Haitao Zheng, and Ben Y Zhao. Gotta catch'em all: Using honeypots to catch adversarial attacks on neural networks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security , pages 67-83, 2020.

Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 8110-8119, 2020.

Sy-Tuyen Ho, Koh Jun Hao, Keshigeyan Chandrasegaran, Ngoc-Bao Nguyen, and Ngai-Man Cheung. Model inversion robustness: Can transfer learning help? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 12183-12193, 2024.

Jun Hao Koh, Sy-Tuyen Ho, Ngoc-Bao Nguyen, and Ngai-man Cheung. On the vulnerability of skip connections to model inversion attacks. In European Conference on Computer Vision . Springer, 2024.

Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang. Defending model inversion and membership inference attacks via prediction purification. arXiv preprint arXiv:2005.03915 , 2020.

Jing Wen, Siu-Ming Yiu, and Lucas CK Hui. Defending against model inversion attack by adversarial examples. In 2021 IEEE International Conference on Cyber Security and Resilience (CSR) , pages 551-556. IEEE, 2021.

Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems , 2022.

Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692 , 2020.

Han Qiu, Yi Zeng, Shangwei Guo, Tianwei Zhang, Meikang Qiu, and Bhavani Thuraisingham. Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , pages 363-377, 2021.

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017.

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision , pages 3730-3738, 2015.

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 , 2014.

Yu Cheng, Jian Zhao, Zhecan Wang, Yan Xu, Karlekar Jayashree, Shengmei Shen, and Jiashi Feng. Know you at one glance: A compact vector representation for low-shot learning. In Proceedings of the IEEE international conference on computer vision workshops , pages 19241932, 2017.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017.

Kota Yoshida and Takeshi Fujino. Countermeasure against backdoor attack on neural networks utilizing knowledge distillation. Journal of Signal Processing , 24(4):141-144, 2020.

Kota Yoshida and Takeshi Fujino. Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks. In Proceedings of the 13th ACM workshop on artificial intelligence and security , pages 117-127, 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206-2216. PMLR, 2020.

Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 4401-4410, 2019.

Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 4690-4699, 2019.

Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, et al. Iarpa janus benchmark-c: Face dataset and protocol. In 2018 international conference on biometrics (ICB) , pages 158-165. IEEE, 2018.

Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-1m: A dataset and benchmark for large-scale face recognition. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part III 14 , pages 87-102. Springer, 2016.

Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2818-2826, 2016.

Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 815-823, 2015.

Tuomas Kynkäänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models. Advances in neural information processing systems , 32, 2019.

Muhammad Ferjad Naeem, Seong Joon Oh, Youngjung Uh, Yunjey Choi, and Jaejun Yoo. Reliable fidelity and diversity metrics for generative models. In International Conference on Machine Learning , pages 7176-7185. PMLR, 2020.

Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R Manmatha, et al. Resnest: Split-attention networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2736-2746, 2022.

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 4700-4708, 2017.

A Broader Impacts, Limitations, and Future Works

A.1 Broader Impacts

Deep learning has been widely employed in diverse domains and tasks. However, the growing threat of privacy breaches, such as MI attacks, poses significant risks to sensitive data used for model training. Our proposed framework, Trap-MID, offers a promising defense strategy against MI attacks by misleading their exploration directions. Empirical experiments demonstrate its state-of-the-art defense performance. Importantly, Trap-MID achieves these results without the need for additional public datasets or conducting shadow attacks, making it applicable across diverse applications.

A.2 Limitations and Future Works

A.2.1 Experimental Limitations

In our empirical experiments, we did not exhaust hyper-parameter tuning via grid search due to the computational constraints. While we found that the configurations in Section 4.1 generally provide a good accuracy-privacy trade-off against various MI attacks, conducting more comprehensive hyperparameter optimization could further improve utility and defense performance. Ablation studies exploring the impact of different hyper-parameter settings are discussed in Appendix D. Although we did not include the experiments against all MI attacks due to computational requirements, we verified the efficacy of Trap-MID against various white-box attacks [3, 5-8] and a label-only attack [11], in both low-resolution [3, 5, 7, 8, 11] and high-resolution scenarios [6]. These results suggest that Trap-MID is effective across a broad range of MI attacks.

Additionally, we recognize that the attack accuracy metric, based solely on an evaluation classifier trained on the private dataset, may fail to detect out-of-distribution samples, resulting in high KNN distance or FID alongside high attack accuracy. While feature-based metrics like KNN distance and FID can help identify these failures, developing a universal evaluation method could better quantify both attack and defense performance, offering a more straightforward basis for comparison.

A.2.2 Further Improvements in Trap-MID Design

In this paper, we demonstrate the efficacy of our trapdoor-based framework with a simple trigger design. While we conducted the model training and attacks multiple times to ensure reproducibility, we acknowledge a larger variation in our defense performance than previous defenses due to the randomly initialized triggers. We leave further customization for a more stable and powerful trigger for future work.

In addition, while Trap-MID is more computationally efficient than existing misleading-based defenses, it requires longer training time compared to methods like MID, BiDO, and NegLS due to its three gradient updates per epoch. Developing a more efficient trigger generation process would be a valuable future direction to make Trap-MID more practical for large-scale applications.

A.2.3 Exploring Different Scenarios

Despite its effectiveness, Trap-MID inherits certain assumptions and limitations from previous works. For instance, it assumes a level of trust between data providers and the model owner to protect their private information [14-16]. A promising future direction involves developing trapdoor injection methods that empower dataset owners or even individual identities to secure sensitive information before sharing data. Additionally, Trap-MID's efficacy may be limited against MI attacks involving KD, such as LOMMA, due to the inherent weaknesses of backdoor attacks. Therefore, future efforts should focus on integrating more robust trapdoors to address these limitations.

In addition, similar to previous works, we used relatively simple victim models for facial recognition, trained on the CelebA dataset with cross-entropy loss. Given the advancements in facial recognition, it would be valuable to evaluate the performance of MI attacks and defenses on more advanced techniques, such as ArcFace [39], or on datasets featuring more diverse poses and facial images in the wild, like IJB-C dataset [40].

Finally, our research represents the first attempt to establish the connection between trapdoor injections and MI defense mechanisms. Extending this defense to different modalities, such as language, graph,

and tabular, or exploring its relationship with other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, presents an interesting direction for further research.

B Proof of Theorem 1

Proof. According to Definition 1, for a given model f , target label y and corresponding trigger injection function Π y ( · ) , we have:

Expanding the KL divergence D KL ( p ( X ) || p (Π( X ))) in Definition 2:

As a result, if for all y , the trapdoor is ( δ, y ) -effective and ϵ -natural on the model f with injection function Π y ( · ) , we have:

C Experimental Details

C.1 Hardware and Software Details

All experiments were conducted on an Intel Xeon Gold 6226R CPU with an NVIDIA RTX A6000 GPU. The average execution time of Trap-MID training is 1 hour 15 minutes with a standard deviation of 13 seconds. Our source code is publicly available at https://github.com/ntuaislab/ Trap-MID to reproduce main experiments.

C.2 Datasets

The datasets we used in our experiments are all publicly accessible, including:

CelebA. CelebA [30] comprises 202,599 facial images of 10,177 identities with coarse alignment. Following prior studies, we selected the 1,000 identities with the most samples as the private dataset, totaling 30,029 facial images. The private dataset was then divided into training and testing datasets for utility evaluation, containing 27,018 and 3,009 samples, respectively. For the auxiliary dataset used in MI attacks, a disjoint subset of the CelebA dataset was sampled, which contains 30,000 images without overlapping identities with the private dataset. Images are cropped at the center and resized to 64 × 64 pixels.

FFHQ. FFHQ [38] contains 70,000 high-quality facial images with considerable variation in age, ethnicity, and background. The entire FFHQ dataset was utilized as the adversary's auxiliary dataset in the MI attacks with distributional shifts.

Algorithm 1 Training procedure for Trap-MID

Input: Training dataset { ( x i , y i ) } N i =1 , a classifier f θ parameterized by θ , a discriminator D ϕ parameterized ϕ , trapdoor triggers K = { k i } d y i =1 corresponding with different classes, mini-batch size m , number of mini-batches M , learning rate α , trigger step size ϵ , and training epoch T

C.3 Target Models

Consistent with prior research, we trained the VGG-16 and Face.evoLVe models for 50 epochs, and the ResNet-152 models for 40 epochs. All models were trained using the SGD optimizer with a batch size of 64, a learning rate of 0.01, a momentum value of 0.9, and a weight decay value of 0.0001.

C.4 Trap-MID

For Trap-MID, we adopted the same hyper-parameters as the unprotected model. Algorithm 1 outlines the training process. The protected model was configured to achieve a trapdoor success rate exceeding 99%. Typically, we used a blend ratio α = 0 . 02 and a trapdoor loss weight β = 0 . 2 . Trapdoor triggers were randomly initialized using a uniform distribution within [0 , 1] and then updated with a step size ϵ = 0 . 01 . The discriminator was optimized with identical settings to the target classifier.

The random augmentation pipeline consisted of a sequence of image transformations, including random resized crops with cropping scales sampled from [0 . 8 , 1] , horizontal flips, and random rotations with degrees sampled from [ -30 , 30] . Each augmentation was applied randomly with a probability of 0.5. Note that our augmentation strategy differs from that in MI attacks to prevent the requirements of attack information. However, since these augmentations are widely adopted across various domains, our approach still overlaps with those utilized in MI attacks.

C.5 Attack Methods

We conducted MI attacks using the official implementation of GMI, KED-MI, LOMMA, and PLGMI. Specifically, we utilized the PLG-MI official code available from https://github.com/ LetheSec/PLG-MI-Attack for GMI, KED-MI, and PLG-MI attacks. For LOMMA, we employed the official code available at https://github.com/sutd-visual-computing-group/ Re-thinking_MI . During the latent searching stage, we optimized the latent for 1,500 epochs in GMI, KED-MI, and LOMMA, and 600 epochs in PLG-MI.

C.6 Baseline Defenses

MID. The protected model was trained with the MID official code provided at https://github. com/Jiachen-T-Wang/mi-defense . For the Face.evoLVe and ResNet-152 models, we added the information bottleneck before the final fully connected layer, with a bottleneck size of 512. The mutual information was approximated using the same variational method as the official implementation. The weight coefficient of the regularization term λ was set to 0.003.

BiDO. We utilized the BiDO official code at https://github.com/AlanPeng0897/Defend_MI to train the protected models. The models were trained with Adam optimizer, using a learning rate of 0.0001 without weight decay. For Face.evoLVe and ResNet-152 models, we used the latent representations from the four major ResNet blocks to estimate the bilateral dependency. Typically,

the Hilbert-Schmidt Independence Criterion (HSIC) was adopted as the dependency measure, as it was reported with a better defense performance than the Constrained Covariance (COCO) in [15]. The balancing hyper-parameters ( λ x , λ y ) were set to (0 . 05 , 0 . 5) .

NegLS. Since the NegLS code was not available when we conducted our experiments, we adapted our implementation to include their negative label smoothing based on the official configuration. The models were trained for 100 epochs using the Adam optimizer with a batch size of 128 and an initial learning rate of 0.001 without weight decay. The learning rate was then multiplied by a factor of 0.1 at the 75 th and 90 th epochs. The label smoothing factor α was set to be 0 at the first 50 epochs. During the 51 th to the 75 th epoch, α was set to be -0 . 05 × t -50 100 -50 , where t is the current epoch. After that, α was fixed to be -0 . 05 for the remaining training.

C.7 Evaluation Models

An evaluation model with a different architecture from the target model is trained on the same private dataset, acting as an additional observer to assess the success of MI attacks. We use the evaluation model from [8], which is a Face.evoLVe model [32] pre-trained on MS-Celeb1M [41] and fine-tuned on the private training dataset. The evaluation model has an input resolution of 112x112, with the 64x64 images resized to fit its input size. It achieves a 95.88% accuracy on the testing dataset.

C.8 Evaluation Metrics

Attack accuracy (AA). For each recovered image, we determine whether it is classified as the target class by the evaluation model, yielding both top-1 and top-5 attack accuracy.

K-Nearest Neighbor Distance (KNN Dist). The KNN distance calculates the shortest l 2 distance from the reconstructed images to the private data in the feature space of the evaluation model. Specifically, to demonstrate the success of reconstruction, each recovered image is compared only with the private data belonging to its target class.

Fréchet Inception Distance (FID). The FID is evaluated by the difference in means and covariances between the generated and real images in the feature space of Inception-v3 [42]. Consistent with prior studies, we compute FID only on the successfully recovered images identified by the evaluation classifier to measure the quality and diversity of the extracted information.

D Ablation Studies

In this section, we first assess the effectiveness of TeD's trapdoor injection strategy [20] against MI attacks, and then analyze the impact of various configurations on defense performance.

Since conducting the whole experiment multiple times would be computationally expensive, without specification, we use the same evaluation protocol in previous works for the experiments in the appendices. Typically, we train a single target model for each configuration and conduct MI attacks to reconstruct 5 images per class with random initialization in the latent searching stage. The standard deviation of attack accuracy is then computed from 5 reconstruction attempts. For experiments sharing the same setups as those in Section 4.1, we average the evaluation metrics and their standard deviations across multiple runs.

D.1 TeD's Trapdoor Injection Strategy

To verify whether TeD's protected models inherently defend against MI attacks, we employ the same trapdoor injection method in [20] and leave other training setups consistent with the unprotected model. Specifically, each trapdoor trigger comprises five (6 × 6) -pixel squares randomly scattered across the image, with a blend ratio α = 0 . 1 or 0 . 2 and a trapdoor loss weight β = 0 . 5 . 2 The intensity of each square was sampled from N ( µ, σ ) with uniformly sampled µ ∈ [0 , 1] and σ ∈ [0 , 1] , and was fixed during model training. Sample poisoned images are shown in Figure 4.

8

TeD

2

Trap-MID

For further comparison, we adopt the same configurations of Trap-MID, such as a smaller blend ratio ( α = 0 . 02 ), a smaller trapdoor loss weight ( β = 0 . 2 ), trigger optimization and data augmentation, while keeping TeD's five-square patterns. This enhanced version is denoted as TeD+.

Table 5 compares defense performances using TeD's trapdoor injection techniques. Although decreasing the blend ratio and adopting our configurations can improve defense performance, TeD models remain vulnerable to PLG-MI with their five-square patterns. In contrast, spreading the trapdoor information across all image pixels is crucial for fooling stronger MI attacks. Intuitively, while TeD's patch-based triggers fit the l ∞ or l 2 budgets in adversarial attacks [20], the resulting poisoned images appear less natural, making them more likely to be identified and penalized by the attacker's discriminator. Moreover, as TeD's triggers highly rely on local information around specific locations, they may exhibit lower robustness against spatial transformations, leading to inferior defense against PLG-MI.

D.2 Trigger Optimization

Table 6 demonstrates the impact of trigger optimization. Fixed triggers generally preserve privacy against most MI attacks, except for PLG-MI, but result in a noticeable accuracy reduction. In contrast, the influence of trapdoor loss and discriminator loss varies based on the capacity of the GAN used in the attacks.

Trapdoor loss. Incorporating trapdoor loss can create easily learnable triggers for the target model, reducing accuracy drop. However, these crafted adversarial-like triggers may be more difficult to generate, resulting in lower defense performance against attacks using weaker generators like GMI, KED-MI, and LOMMA.

Discriminator loss. Discriminator loss promotes invisible triggers, which are crucial for deceiving attacks with stronger discriminators, such as PLG-MI. However, generating invisible triggers requires fine-grain adjustments, making them less effective against attacks using weaker generators.

D.3 Blend Ratio

In this section, we tune the blend ratio α within [0 . 02 , 0 . 1] and compare the defense performance. As shown in Table 7, decreasing the blend ratio generally makes the trapdoor triggers more invisible and improves defense performance. Notably, there is a sharp drop in attack accuracy. For instance, PLG-MI's attack accuracy drops from 93.86% to 1.92% when the blend ratio is reduced from 0.05 to 0.03, suggesting that an adequately invisible trigger is crucial for misleading certain attacks. In terms of model utility, Trap-MID is relatively insensitive to the blend ratio, maintaining about 81-84% testing accuracy across different configurations, demonstrating its effectiveness without a significant accuracy loss.

* The mean and standard deviation of each evaluation metric are averaged across multiple runs.

D.4 Loss Weight

Table 8 illustrates the impact of the trapdoor loss weight. In general, A larger weight prioritizes learning trapdoor behavior over the main task, enhancing defense at the cost of accuracy and leading to an accuracy-privacy trade-off. Notably, Trap-MID achieves privacy protection without a significant accuracy drop, with testing accuracy decreasing from 86.21% to 81.37% when the trapdoor loss weight is increased to 0.2. Moreover, a relatively low weight (e.g., β = 0 . 02 ) is sufficient to reduce the performance of most MI attacks. For example, the top-1 attack accuracy drops from 56.46% to 10.78% against KED-MI, and from 95.81% to 23.84% against PLG-MI.

100 -

2000-

80

80 -

1500

60 -

60 -

40 -

1000 -

40 -

20 -

500 -

20

0

Accuracy (%) ↑

Attack Accuracy 5 (%) ↓

0

KNN Dist ↑

0

FID ↑

Unprotected

Trap-MID (no-aug)

Trap-MID (crop)

Trap-MID (crop-rot)

Trap-MID (crop-flip-rot)

100

80

2000-

70

80 -

60 -

1500

60 -

50 -

1000 -

40 -

40 -

30 -

20 -

500 -

20

10

0

Accuracy (%) ↑

Attack Accuracy 5 (%) ↓

0 -

KNN Dist ↑

0

FID ↑

Unprotected

Trap-MID (no-aug)

Trap-MID (crop, p=0.5)

Trap-MID (crop. p=0.75)

Trap-MID (crop, p=0.875)

D.5 Augmentation

This section investigates the impact of augmentations used in model training. Since we noticed that weak augmentation can lead to unstable defense performance, we employed the same 5-run evaluation protocols as in Section 4.1 in this section. Moreover, the mean and standard deviation of each metric were estimated after removing outliers by the IQR method due to large variation.

Figure 5 shows the defense performance against PLG-MI with different numbers of augmentations. Typically, we started from defense without augmentation and incrementally added random resized crop, random rotation, and horizontal flip. Although protected models with fewer augmentations can sometimes reduce attack performance significantly, they remain vulnerable to PLG-MI in most runs. Intuitively, augmentation helps identify and address the trapdoor's weaknesses in terms of transformation robustness. While it is possible to randomly sample and optimize a robust trigger with weak augmentations, stronger augmentations are more effective at detecting these weaknesses comprehensively, resulting in more stable and improved defense performance.

In addition, to verify whether applying augmentation more frequently can enhance the defense, we increased the probability of applying transformation from 50% to 87.5% using only random resized crop. As Figure 6 demonstrates, even with a single augmentation, applying it frequently can reveal more trapdoors' weaknesses and improve the defense performance of protected models.

E Additional Experimental Results

E.1 Training Time Comparison

Table 9 presents the training time for various defense methods. While Trap-MID requires the longest time due to its three gradient updates per epoch for the discriminator, triggers, and target model, it is worth noting that it significantly outperforms other defenses against recent MI attacks. Furthermore, Trap-MID still requires less data and computational resources compared to existing misleading-based defenses, eliminating the need for an additional dataset, training an extra classifier, or executing shadow attacks.

We believe that enhancing the efficiency of trigger generation would be a valuable future direction, making Trap-MID more practical for large-scale applications. For example, pre-computing triggers with fewer steps may reduce overhead during model training.

E.2 Worst-case Performance of Trap-MID

In prior experiments, the randomly initialized triggers in Trap-MID introduced variability in defense performance, resulting in a larger standard deviation. This section highlights the worst-case performance of Trap-MID compared to the best-case performance of existing defenses in terms of top-1 attack accuracy. As shown in Table 10, the worst-case performance of Trap-MID surpasses the best-case performance of existing methods against most attacks, demonstrating its effectiveness.

E.3 Additional Evaluation Metrics

This section further compares the defense performance with additional evaluation metrics used by [4] and [6], including:

KNN Distance in the FaceNet [43] Feature Space ( δ face ). This metric estimates the FaceNet feature distance between each recovered image and the nearest private data. A higher value indicates less similarity to the private data.

Improved Precision [44]. This metric assesses whether each recovered image lies within the manifold of private data in the InceptionV3 feature space. A lower value signifies less similarity to the private data.

Improved Recall [44]. This evaluates whether each private image is encompassed within the manifold of recovered data in the InceptionV3 feature space. A lower value suggests that the generator is less likely to reproduce private data.

Density [45]. This metric quantifies how many private-sample neighborhood spheres contain each recovered image in the InceptionV3 feature space. A lower value indicates less similarity to the private data.

Coverage [45]. This assesses how many private samples have a neighborhood sphere that contains at least one recovered image in the InceptionV3 feature space. A lower value suggests that the generator is less likely to reproduce private data.

As shown in Table 11, Trap-MID outperforms existing defenses in FaceNet distance and ranks second to NegLS in most other metrics. For the improved recall metrics, since arbitrary images with injected triggers can be classified into corresponding classes, the recovered samples become more diverse, leading to a broader manifold and a higher recall value. Additionally, all metrics, except for FaceNet distance, utilize the same InceptionV3 model as FID. This gives NegLS an advantage in these metrics due to its less natural recovered images.

E.4 Defense Performance on Different Architectures

In this section, we present the defense comparison on the Face.evoLVe and ResNet-152 models. As shown in Table 12 and Table 13, Trap-MID consistently outperforms existing defenses on both Face.evoLVe and ResNet-152 models.

GMI | Recall=98.74%, AUC=99.64%

KED-M1|Recall=89.56%,AUC=95.36%

LOMMA(GMI)|ReCalI=99.96%,AUC=99.98%

LOMMA (KED-M1)|ReCall=29.04%,AUC=83.33%

0.4 -

Public,Clean

Public, Clean

Public, Clean

Public, Clean

Frequency

Recovered

Recovered

Recovered

Recovered

0.3

Relative

0.2 -

0.1 -

0.0 -

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

Cosine Similarity with Signature

Cosine Similarity with Signature

Cosine Similarity with Signature

Cosine Similarity with Signature

E.5 Distributional Shifts in Adversary's Auxiliary Dataset

In the previous experiments, we assumed that the adversary possesses a public dataset without distributional shifts from the private data. Typically, both auxiliary and private datasets were constructed from the CelebA dataset. However, in a practical scenario, the adversary might not know the distribution of private data, leading to potential distributional shifts between auxiliary and private datasets and making it harder to extract private data.

In this section, we used the FFHQ dataset [38] as the adversary's auxiliary dataset to demonstrate the scenario with slight distributional shifts, considering that PLG-MI can still provide an attack accuracy exceeding 89% on the unprotected model using this dataset [8]. As shown in Table 14, Trap-MID outperforms previous approaches under this scenario, achieving nearly 0% top-1 attack accuracy.

Notably, while methods using dependency regularization, such as MID and BiDO, are vulnerable to MI attacks without distributional shifts, they can protect privacy if auxiliary distribution differs from private data, with top-1 attack accuracy dropping from 89% to below 70%. On the other hand, although NegLS reduces the guidance signal for MI attacks by training an over-confident model with a discrete loss landscape, the logit-based max-margin loss in PLG-MI can prevent early saturation and surpass this defense mechanism. Consequently, while NegLS leads to unnatural reconstructions with a high FID, it remains vulnerable to PLG-MI, with attack accuracy exceeding 78%.

E.6 Trapdoor Recovery Analysis against Different MI Attacks

Figure 7 presents the trapdoor recovery analysis of MI attacks other than PLG-MI. Similarly to PLG-MI, all these attacks, except LOMMA (KED-MI), reconstruct the trapdoor information from trapdoored models, with more than 89% recovered images reported as triggered images. Although our detection method has a low recall rate on LOMMA (KED-MI), the ROC AUC of 83.33% still suggests that the reconstructed images are likely to be injected with a trapdoor trigger. However, due to the limitations of backdoor attacks, the student models from KD enable LOMMA to extract trapdoor information and explore private distribution simultaneously, preventing it from being entirely misled by the trapdoored models. We leave the further adaptation for a robust trapdoor against KD to future works.

E.7 Adaptive Attacks without Trapdoor Signatures

This section investigates adaptive attacks when the adversary only knows the existence of trapdoors without access to trapdoor signatures. Here we modify the loss function in Equation 7 by excluding the regularization term of trapdoor signatures:

This adaptive attack is denoted by PLG-MI+. Table 15 demonstrates its comparable attack performance with PLG-MI++, indicating that if the auxiliary dataset is close enough to the private distribution, guiding attacks by auxiliary signatures is sufficient to boost attacks. However, as Table 16 shows, trapdoor signatures are required to enhance the attack performance further when there are distributional shifts in auxiliary data. Overall, Trap-MID still provides better privacy preservation than existing defenses against adaptive attacks.

E.8 Combining Trap-MID with NegLS

We further analyze whether Trap-MID can be combined with existing baselines to enhance performance. Table 17 presents the defense performance of combining Trap-MID with NegLS, using the same configurations outlined in Appendix C. Following the evaluation protocol in Section 4.1, the experiments are conducted across 5 runs. This hybrid defense slightly decreases accuracy but significantly improves defense effectiveness, even against KD-based attacks like LOMMA. For instance, it reduces LOMMA (KED-MI)'s attack accuracy to 42.47%, while Trap-MID or NegLS alone achieves only 61.25% or 77.67%. The reconstructed images can be found in Appendix F.

This suggests that Trap-MID stands as an orthogonal approach to existing defenses and can be integrated with them. Intuitively, NegLS focuses on reducing the leakage of guiding signals, making it more difficult for adversaries to extract private data. Consequently, this enhancement makes Trap-MID's shortcuts more appealing to attack algorithms, thereby bolstering privacy protection.

Another promising direction for future research is to combine multiple defense strategies to improve overall performance and robustness against specific adaptive attacks.

E.9 Defense Performance against Label-Only Attacks

In previous experiments, we evaluated defense methods against white-box MI attacks, which pose a greater privacy threat. However, in practical scenarios, adversaries may only have access to model predictions or output labels, conducting black-box or label-only attacks on victim models.

This section investigates the defense performance of different approaches against BREP-MI [11], a label-only attack. BREP-MI starts by randomly sampling the generator's latent until the victim model classifies the generated image as the target class. It then estimates the predicted labels over a sphere in latent space to iteratively adjust the image away from the model's decision boundary. We use the victim models trained on the CelebA dataset and the generator from GMI to analyze performance against BREP-MI.

Under targeted attack settings, BREP-MI fails to initialize latents for all 1,000 identities in a reasonable time when facing Trap-MID, sampling latents for only 942 identities after 820,000 iterations. In contrast, it only takes 553 iterations against unprotected models.

We also conducted untargeted attacks to recover 300 identities. As shown in Table 18, Trap-MID significantly increased the number of initial iterations required and reduced BREP-MI's attack accuracy to 0%, demonstrating its effective privacy protection against various types of MI attacks.

E.10 Defense Performance Under High-Resolution Scenario

This section evaluates Trap-MID's defense performance on modern architectures and in highresolution scenarios. Specifically, we conducted the experiments introduced by PPA [6]. The target models are ResNeSt-101 [46], ResNet-152 [33], and DenseNet-169 [47] trained on a highquality version of the CelebA dataset, with the images cropped, aligned, and resized to 224x224 using HD CelebA Cropper. 3 We adopted PPA to perform MI attacks using a StyleGAN2 generator [21] pre-trained on the FFHQ dataset [38]. The generator outputs 1024x1024 images, which are then center-cropped to 800x800 and resized to fit the model's input resolution.

We adopt the same InceptionV3 model used in PPA's official setup as the evaluation model. It was trained on the same training dataset as the target models, with an input size of 299x299. The evaluation model achieves 93.28% accuracy on the testing dataset. In addition to attack accuracy, KNN distance in the evaluation model's feature space ( δ eval), and FID, PPA also employs additional metrics, such as KNN Distance in the FaceNet [43] feature space ( δ face), improved precision and recall [44], and density and coverage [45] metrics. Details of these metrics are provided in Appendix E.3.

We follow the same training settings as [6]. In addition to the Trap-MID configurations detailed in Appendix C.4, we also fine-tuned the blend ratio α and trapdoor loss weight β according to the observations in Appendix D.3 and D.4. Since we found that Trap-MID models generally achieve better accuracy than the unprotected models, we set β = 0 . 5 and selected the smallest α for each model to effectively distinguish triggered samples from benign ones. Specifically, the blend ratios are 0 . 005 , 0 . 007 , and 0 . 01 for the ResNeSt-101, ResNet-152, and DenseNet-169 models, respectively.

Table 19 and Table 20 present Trap-MID's defense performance against PPA, compared with attack results reported in previous works. Although Trap-MID does not fully mitigate PPA with default settings, it preserves privacy to a certain degree without sacrificing accuracy. Furthermore, selecting proper hyper-parameters significantly enhances defense performance, reducing attack accuracy on ResNet-152 and DenseNet-169 to below 2%, and that on ResNeSt-101 to 15.58%. This demonstrates that while hyper-parameter tuning is essential for optimal defense, Trap-MID provides effective privacy protection across various datasets and architectures,

F Additional Visualization

Figure 8 shows the reconstructed images with the hybrid approach discussed in Appendix E.8. Figure 9 illustrates additional recovered images from PLG-MI, where the recoveries of Identity 4 from Trap-MID exhibit different hair colors from the private data. Such variation does not appear in other defenses, demonstrating Trap-MID's effectiveness in protecting private information. In addition, Figure 10, Figure 11, Figure 12, and Figure 13 display sample reconstructed images from GMI, KED-MI, and LOMMA attacks.

Private

Unprotected

TEA1ZRA

MID

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

Private

Unprotected

MID

酒香酒酒

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

Private

Unprotected

MID

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

Private

Unprotected

MID

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

Private

Unprotected

MID

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

Private

Unprotected

MID

BiDO

NegLS

Trap-MID

Trap-MID + NegLS

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The claimed theoretical analysis is demonstrated in Section 3.4: Theoretical Analysis, and the defense performance is included in Section 4.2: Experimental Results.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: Appendix A.2: Limitations and Future Works discusses the limitations of this work.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The assumptions and the proof of theoretical result are provided in Section 3.4: Theoretical Analysis and Appendix B: Proof of Theorem 1.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The instructions of the training procedure and the experimental configurations are outlined in Section 3.3: Model Training and Appendix C: Experimental Details. We also provide the code in supplemental material.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The code is provided in supplementary material, including instructions about data preparation, model training, MI attacks, and a checkpoint of the Trap-MID model.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The experimental setups are listed in Section 4.1: Experimental Setups and Appendix C: Experimental Details.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We conducted the experiments multiple times and reported the standard deviation of each metric as the error bars. The detailed calculation method is provided in Section 4.1: Experimental Setups and Appendix D: Ablation Studies.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The compute resources are listed in Appendix C.1: Hardware and Software Details.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We acknowledge that we have read and committed to adhering to the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: Appendix A.1: Broader Impacts demonstrates the broader impacts of this work.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: This research only involves the defense strategy against existing privacy attacks, which doesn't pose such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The original papers of the codes and datasets used in the experiments are cited, and the license from https://github.com/SCccc21/Knowledge-Enriched-DMI is provided with the provided code, as we mainly modified their code to implement our defense.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: The documentation is provided with the code in the supplementary material, including instructions about data preparation, model training and MI attacks.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes Trap-MID, a novel defense method against model inversion attacks, drawing inspiration from backdoor attacks and shortcut-based defenses against adversarial examples. The core idea involves adding poisoned data samples to the target model's training data. This data poisoning is based on the Blended backdoor attack, which calculates a linear combination of the training sample and a noise trigger pattern. To reduce the visibility of the trigger, a discriminator is trained in parallel, akin to a GAN training setup. This discriminator is then used to align the trigger patterns with the distribution of the clean training samples. The proposed defense method is empirically evaluated against common white-box attacks (GMI, KED-MI, LOMMA, PLG-MI) and defense methods (MID, BiDO, NegLS) using the standard 64x64 CelebA training samples.\n\nSTRENGTHS:\n- The paper proposes an intriguing direction for model inversion defenses by utilizing backdoor attacks to induce shortcuts in the model. These shortcuts are then exploited by the attack, resulting in misleading attack outcomes. This approach is both clever and conceptually straightforward, which is advantageous.\n\n- The paper is well-written, with all components and sections clearly described. The experimental evaluation is also well-defined, adhering to the standard procedures in model inversion literature.\n\n- The results presented in the evaluation section are convincing. The experiments demonstrate the method's favorable privacy-utility trade-off and its effective defense capabilities. Additionally, the paper investigates adaptive attacks, a critical aspect of assessing a method's effectiveness. Although the adaptive attack still achieves good results against the proposed defense, this does not diminish the contribution's value. The Appendix further provides an extensive ablation and sensitivity analysis, essential for understanding the impact of hyperparameter selection and individual design choices.\n\nWEAKNESSES:\n- Although the evaluation is conducted on four attack algorithms, two important aspects are missing in my opinion. First, the proposed defense should also be tested against black-box/label-only attacks. In particular, testing the defense method against the label-only BREP-MI [1] attack would be very interesting since this method aims to reconstruct samples by maximizing their distance to the decision boundaries. Given that the proposed Trap-MID leverages a model's ability to exploit shortcuts in its predictions, I am curious if the poisoned shortcut samples are differently placed in a model's embedding space. It might be the case that these samples are actually closer to the decision boundary compared to clean training samples. If this is true, the defense might fail. So even if white-box attacks are usually considered stronger, running some label-only attacks could add an intriguing perspective to the paper.\n\n-  Similarly, the defense is only evaluated in a low-resolution setting. However, it is important to also investigate a high-resolution setting, which can be considered more practical. In this context, the method should also be tested against PPA [2] to provide a comprehensive evaluation and see if the promised defense effect holds in this setting. I want to emphasize that I am not requesting additional experiments merely as a form of criticism, but because investigating these two additional attacks would add significant value to the paper, helping to support the claims.\n\n- The evaluation heavily relies on attack accuracy and KNN Distance, both computed on an evaluation model trained on the target dataset. However, I think these metrics are limited as they tell us little about the actual visual similarity between reconstructed results and the training samples. For example, in Fig. 2, the images reconstructed from the NegLS model look unrealistic and reveal only limited information about the target identity. Still, the Attack Accuracy in Tab. 1 is high for PLG-MI and the KNN-Dist is low. Both metrics seem very susceptible to adversarial noise and misguided attack results. Similarly, the FID score only assesses the image quality of the reconstructed samples and compares it to the training data. But this metric has no meaning regarding privacy leakage: generating samples of the same style as the target training data leads to a low FID, even if the images reveal no private attributes. Conversely, images following a substantially different distribution can still reveal private features, even if the FID score is high. Additional metrics are therefore necessary to assess the actual effectiveness. From literature, one could use a model like CLIP or for the face recognition setting, a FaceNet model to assess the identity similarity between attack results and training samples (see, e.g., [2]). Another option would be the knowledge extraction score introduced in [4], which measures the information content included in the attack results.\n\n- While I appreciate that the paper includes a theoretical analysis of the method and its effectiveness, I have some doubts about the formal proof. Particularly, I do not think that the KL divergence is a valid measure here to assess the trapdoor visibility. The problem is that the KL divergence compares two distributions. However, similar distributions might not necessarily mean that the triggers are invisible, and vice versa. For example, one could use triggers that are clearly visible but follow the clean data distribution. For example, using physical triggers instead of noise, but also noise patterns could be designed to follow the clean data distribution. This limits the expressiveness of the theorem since it relies on the KL divergence. In my view, the analysis should use a sample-wise measurement that compares a clean sample directly with its poisoned counterpart to provide a reliable measurement of trigger visibility.\n\n- The work of [6] investigates a similar direction (using surrogate samples to misguide the attack). While their approach is partly limited in the number of classes to defend, I think the approach should at least be discussed in the related work section since the underlying idea of providing false guidance for the attack is conceptually similar.\n\n\nSmall Remarks:\n- L118: \"Given access to the target classifier f, the adversary aims to recover the private data of class y by estimating the posterior distribution p(X|y)...\" -> While this definition is not wrong, I think model inversion attacks do not necessarily require the adversary to recover the whole posterior distribution; reconstructing a single sample can be enough for a serious privacy breach. While there exist attacks directly aiming to reconstruct the posterior, e.g., VMI [3], this might not be true for all attacks.\n- There is another recent defense that might be included in the related work section [5]. The paper was very recently accepted at CVPR and only became available close to the NeurIPS deadline. So, I do not expect the paper to include this work in its evaluation. Just wanted to highlight this related work.\n- L517: I think the URL is the wrong one here, as it leads to the KED paper.\n- L525: If I have not missed it, the paper never actually defines the evaluation model architecture. Defining this architecture once helps the reproducibility of the paper.\n\n-> I encourage the authors to participate in the rebuttal and will increase my scores if the weaknesses mentioned are addressed adequately.\n\n\nReferences:\n[1] Kahla et al., Label-Only Model Inversion Attacks via Boundary Repulsion. CVPR 2022  \n[2] Struppek et al., Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks. ICML 2022  \n[3] Wang et al., Variational model inversion attacks. NeurIPS 2021  \n[4] Struppek et al., Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks. ICLR 2024  \n[5] Ho et al., Model Inversion Robustness: Can Transfer Learning Help? CVPR 2024  \n[6] Chen et al. Data-Centric Defense: Shaping Loss Landscape with Augmentations to Counter Model Inversion. ICML Workshop 2023\n\nQUESTIONS:\n- Can inference-time mitigation strategies from the backdoor or shortcut literature be employed to eliminate the model's shortcut behavior, thereby enabling stronger attacks?\n- Table 6 in the appendix: Why does the attack performance increase for other attacks besides PLG-MI when the defense uses the trapdoor loss and a discriminator loss compared to fixed triggers? Is there any intuition behind these results?\n\nLIMITATIONS:\nSection A.2. provides a comprehensive limitations section.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-21"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces a backdoor-based MI attack called Trap-MID. In this method, a trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information acts as a \"shortcut\" for MI attacks, causing them to extract trapdoor triggers instead of private data.\n\nSTRENGTHS:\nThe paper provides the new insights about Model Inversion from Backdoor injection perspective. \n\nThe idea is intuitive and theoretical analysis is provided.\n\nWEAKNESSES:\nIn line 137, “MI attacks leverage a discriminator to approximate generic prior and ensure natural outcomes” This statement might not generalize to all SOTA MI attacks those does not utilise a GAN discriminator such as PPA [1]\n\nThe evaluation is based on low-resolution (64x64) MI attacks, which are not very practical for modern models. I suggest authors to evaluate the effectiveness of Trap-MID and compare with baseline defenses on high-resolution setup such as PPA [1] or MIRROR [2]\n\nThe main results are on VGG-16, which is a quite out-dated architecture. Despite there are other results on Face.evoLVE and IR-152 in the Appx. I strongly encourage authors to evaluate on other architectures, such as in PPA [1]\n\nThe visualisation results are not very convincing to me. For example, in Fig. 2, most of the reconstructed images are very different from private data despite some defence baselines still have a high attack accuracy. I suggest reviewers to provide more visualisation for reference.\n\nI understand that the visualisation could be subjective. I suggest the authors to conduct a comprehensive study to further confirm the effectiveness of Trap-MI when comparing with other defence baselines.\n\n[1] Struppek, Lukas, et al. \"Plug & play attacks: Towards robust and flexible model inversion attacks.\" ICML-2022.\n\n[2] An, Shengwei et al. MIRROR: Model Inversion for Deep Learning Network with High Fidelity. Proceedings of the 29th Network and Distributed System Security Symposium.\n\nQUESTIONS:\nI have a question about the sensitivity of Trap-MI to hyper-parameters. We know that BiDO sensitive to hyper-parameters as it need to optimise two hyper-parameters. From my understanding, Trap-MI also introduces two hyper-parameters. I wonder how sensitive is the Trap-MI to these two hyper-parameters?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-01"}

comments: SUMMARY:
The paper proposes Trap-MID, a trapdoor-based defense mechanism to protect deep neural networks (DNNs) against Model Inversion (MI) attacks. The technique involves integrating trapdoors into the model to mislead MI attacks, causing them to extract trapdoor triggers rather than private data. The authors provide theoretical insights into the effectiveness and invisibility of these trapdoors and validate their approach through empirical experiments, demonstrating superior performance against various MI attacks without the need for extra data or significant computational overhead.

STRENGTHS:
- Trap-MID presents the use of trapdoors to mislead MI attacks, filling a gap in the existing defense strategies.
- The empirical defense results seem good.

WEAKNESSES:
- The proposed method involves multiple optimization processes, making it computationally expensive and potentially impractical for large-scale or resource-constrained applications.
- According to Theorem 1, a more effective (larger $\delta$) and invisible (smaller $\epsilon$) trapdoor can lead to a larger lower bound to the expected posterior probability, making it more likely to be extracted by an MI attack. However, the paper does not analyze the discrepancy between the two posterior probability distributions, which is crucial for understanding the practical implications of the defense mechanism.
- The paper's organization and logical flow can be further improved for better readability and comprehension. The transitions between sections are sometimes abrupt, and a more cohesive structure would enhance the overall presentation.

QUESTIONS:
See weaknesses.

LIMITATIONS:
NA
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2024-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents Trap-MID, a novel defense mechanism against model inversion attacks that utilizes trapdoor injection techniques. By incorporating a trapdoor into the model, Trap-MID misleads MI attacks into extracting trapdoor information instead of private data, effectively preserving privacy. The paper contributes to the field by:\n1. Introducing a Novel Defense Mechanism: Trap-MID pioneers the exploration of the relationship between trapdoor injection and MI defense, providing a new approach to tackle this challenging privacy problem.\n2. Theoretical Insights and Empirical Validation: The paper provides theoretical analysis on the impact of trapdoor effectiveness and visibility on deceiving MI attacks and validates its effectiveness through extensive experiments, showcasing its superior performance compared to existing defenses.\n\nSTRENGTHS:\n+ New Application of Trapdoors.The paper creatively applies trapdoor injection techniques, traditionally used for adversarial detection, to defend against model inversion attacks. This novel application opens up new avenues for privacy-preserving DNNs.\n+ Theoretical Analysis: The paper presents a solid theoretical foundation for trapdoor-based defenses, establishing definitions for trapdoor effectiveness and visibility and providing a theorem that explains their impact on MI attacks. \n+ Comprehensive Experiments: The authors conduct thorough experiments on various MI attacks using different DNN architectures and datasets, demonstrating the generalizability and robustness of Trap-MID.\n+ Well-structured and Clear Explanation: The paper is well-structured and provides clear explanations of the proposed method, theoretical analysis, and experimental results. The figures and tables effectively illustrate the key concepts and findings.\n\nWEAKNESSES:\n-  Assumption of Trust: Trap-MID assumes a level of trust between data providers and the model owner, which might not always be feasible in practice. Future work could explore ways to empower data providers or individuals to secure their sensitive information before sharing data.\n- Limited Scope of Attackers: The paper assumes white-box attackers with full access to the model. However, in practical scenarios, attackers may only have access to the model's predictions or even just the labels. It would be beneficial to explore the effectiveness of Trap-MID against black-box and label-only attackers.\n- Vulnerability to KD: Trap-MID's efficacy may be limited against MI attacks involving knowledge distillation (KD), as KD enables the attacker to extract trapdoor information and explore private data simultaneously. Developing more robust trapdoors against KD is a crucial direction for future research.\n- Robustness to Adaptive Attacks: The paper explores the effectiveness of Trap-MID against adaptive attacks where the attacker knows the existence of trapdoors. However, it would be valuable to investigate the robustness of Trap-MID against other types of adaptive attacks, such as those that exploit specific vulnerabilities in the trapdoor design.\n- Random Trigger Initialization: The randomly initialized triggers introduce variability in defense performance, leading to a larger standard deviation compared to previous defenses. Exploring more stable and powerful trigger designs would enhance the consistency and reliability of Trap-MID.\n- Limited Exploration of Trigger Design: While the paper demonstrates the effectiveness of a simple trigger design, exploring more sophisticated trigger designs could potentially improve the defense performance further.\n- Limited Analysis of Other Reconstruction-based Attacks: The paper primarily focuses on model inversion attacks. Analyzing the effectiveness of Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, would provide a more comprehensive evaluation of its generalizability.\n\nQUESTIONS:\n1. Impact of KD on Defense Performance: Could the authors provide more insights into the impact of KD on Trap-MID's defense performance? Specifically, what modifications could be made to the trapdoor design or training process to make it more robust against KD-based attacks?\n2. Stability of Trigger Design: How sensitive is Trap-MID's performance to the specific trigger design? Are there any guidelines or heuristics for choosing an effective and stable trigger design?\n3. Trade-off between Privacy and Utility: The paper mentions an accuracy-privacy trade-off due to the trapdoor loss weight. Could the authors elaborate on this trade-off and provide more insights into the impact of different weight values on privacy and utility?\n4. Impact of Distributional Shifts: The paper briefly mentions distributional shifts in the auxiliary dataset. Could the authors provide a more detailed analysis of how distributional shifts impact Trap-MID's defense performance and how it compares to existing defenses in such scenarios?\n5. Comparison with Other Reconstruction-based Attacks: The paper focuses on model inversion attacks. How effective is Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks?\n\nLIMITATIONS:\nThe authors acknowledge the limitations of their work, including the assumption of trust and vulnerability to KD. They also recognize the need for further exploration of trigger designs and analysis of other reconstruction-based attacks. These limitations are clearly stated", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-11"}