Trap-MID: Trapdoor-based Defense against Model Inversion Attacks

Authors: zhen-ting  liu
shang-tse  chen
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-13 05:18:50

Abstract: Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at https://github.com/ntuaislab/Trap-MID.

Main paper: 
 introduction: 
 Deep Neural Networks (DNNs) have been successfully applied in various domains. However, training DNNs could involve sensitive data like facial recognition and medical diagnosis, which raises privacy concerns. Model Inversion (MI) stands as one of the important privacy attacks aimed at reconstructing private data within specific classes from a well-trained model. For example, an adversary may recover the training images of specific identities from a facial recognition system. MI attacks were first introduced by Fredrikson et al. [1, 2] , reconstructing private attributes from low-capacity models. After that, Zhang et al. [3] proposed Generative Model-Inversion (GMI) attacks to reconstruct private images from DNNs, utilizing Generative Adversarial Network (GAN) as a general prior. This GAN-based framework has been widely adopted by later attacks [4] [5] [6] [7] [8] [9] [10] [11] . Among them, PLG-MI [8] achieves state-of-the-art attack performance. Previous works also demonstrated the efficacy of MI attacks under black-box [9, 10, 12] or label-only [11, 13] settings. In this paper, we focus on defending against white-box attacks, which pose a more challenging scenario.Most existing defenses focus on reducing the information leakage through Differential Privacy (DP) [1, 3] , dependency regularization [14, 15] , or manipulating the loss landscape [16] . However, these methods remain vulnerable to recent MI attacks [16] . In contrast, recent works proposed to mislead MI attacks by prompting models to classify fake samples as the protected class with high confidence [17] [18] [19] . Although effective, these misleading-based strategies face challenges, including additional data requirements and substantial computational overhead. Furthermore, they typically protect only a single or a limited set of classes, while other defenses aim to secure all classes simultaneously. Sharing a similar idea, Shan et al. [20] introduced Trapdoor-enabled Adversarial Detection (TeD) against targeted adversarial attacks, which aims to change the model behaviors by applying adversarial perturbations to the input data. Instead of training a robust model against such perturbations, TeD shows that injecting trapdoors into the models can mislead the adversarial attacks to result in samples with similar features to poisoned data, thereby empowering the adversarial detection by measuring their similarity to the trapdoor signatures.Inspired by previous misleading-based defenses [17] [18] [19] and TeD [20] , we propose Trapdoor-based Model Inversion Defense (Trap-MID), which deceives MI attacks by incorporating trapdoors as the "shortcuts". We discuss the key properties of trapdoor triggers necessary for misleading these attacks, and experiments show that Trap-MID outperforms existing methods in defending against MI attacks.Our contributions can be summarized as follows:1. We propose a trapdoor-based defense, Trap-MID, to preserve privacy by misleading MI attacks. Through extensive experimentation, it presents state-of-the-art defense performance against various MI attacks.2. To the best of our knowledge, we are the first to establish the connection between MI defenses and trapdoor injection techniques. We theoretically discuss the importance of trapdoor effectiveness and naturalness in misleading MI attacks and showcase its efficacy with empirical experiments.3. Compared to previous trapping defenses, our trapdoor-based framework is more computationally and data-efficient, without large computational overhead or additional data. 
related work: 
 This section reviews the existing MI attacks and the defense mechanisms against them. Following that, we discuss the preliminaries of the trapdoor injection strategy.Fredrikson et al. [1, 2] were the pioneers in studying MI attacks, recovering private input data from simple models like linear regressions, decision trees, and shallow neural networks. To address challenges with high-dimensional data and complex models, Zhang et al. [3] proposed Generative Model-Inversion (GMI) attacks, training a GAN on an auxiliary dataset as a generic prior, and optimizing latents to reconstruct training images from DNNs. Latter attacks have largely adopted this GAN-based framework [4] [5] [6] [7] [8] [9] [10] [11] . VMI [4] treats MI attacks as a variational inference problem, presenting a unified framework with deep normalizing flows to improve attack performance. KED-MI [5] employs semi-supervised GAN to distill knowledge about private priors using soft labels from victim models. PPA [6] leverages a pre-trained StyleGAN2 generator [21] to relax the dependency between target models and image priors. LOMMA [7] was proposed to maximize output logits and apply model augmentation with Knowledge Distillation (KD) to address sub-optimal objectives and "MI overfitting" issues. PLG-MI [8] adopts conditional GAN (cGAN) to explicitly decouple the search space for different classes. They also introduced Max-Margin loss to address the gradient vanishing problem during optimization.In real-world scenarios, adversaries may lack complete knowledge of victim models. Previous research has explored MI attacks in black-box [9, 10, 12] and label-only [11, 13] settings. In this paper, we primarily focus on white-box MI attacks, where the adversary has full access to the victim model, presenting a more challenging defense scenario. Among them, PLG-MI [8] currently stands as the state-of-the-art attack.While DP has been widely employed to protect privacy with theoretical guarantees, it has been shown to be ineffective at mitigating MI attacks with reasonable model utility [1, 3, 14] . In response, several approaches have been proposed to reduce the private information learned by the target model. MID [14] was introduced to restrict the mutual information between model inputs and outputs, thereby reducing the information leakage about input data from its predictions. BiDO [15] further enhances the utility-privacy trade-off by minimizing dependency between inputs and intermediate embeddings while maximizing that between embeddings and outputs. TL-DMI [22] demonstrates that freezing certain layers during fine-tuning can prevent private information encoded in those layers, making it difficult to extract. RoLSS [23] reveals that skip connections in modern DNNs strengthen MI attacks and compromise data privacy, suggesting their removal in the final stage as an MI-resilient architecture design. Additionally, Struppek et al. [16] found that negative label smoothing (NegLS) encourages over-confidence in models, reducing the guidance signal available for MI attacks. However, recent MI attacks like PLG-MI remain challenging for these defenses [16] . Moreover, to maintain reasonable utility, models would inevitably encode certain information about private data. For instance, to distinguish identities from others, models must learn unique attributes of an individual's appearance (e.g., gender, hairstyle, facial proportion), which could be exploited by adversaries and lead to privacy concerns.Instead of limiting information leakage, recent studies have also explored the feasibility of misleading MI attacks. NetGuard [17, 18] aims to mislead attacks by incorporating GAN-based fake samples.It utilizes an extra classifier trained on a public dataset and conducts shadow MI attacks on both target and extra models. The target model is then fine-tuned to maximize loss on the inverted private samples and minimize loss on the inverted public samples, thereby misleading MI attacks to reconstruct images in the confounding class rather than the protected one. Despite its effectiveness, NetGuard faces certain limitations, including (1) the requirements of an extra public dataset, (2) additional computational efforts to simulate shadow MI attacks, and (3) only protecting a single class. Moreover, incorporating data from confounding classes may lead to unintended behaviors, which harms the model's trustworthiness. For example, this could make an irrelevant person in the public domain classified as a protected identity with high confidence by the protected facial recognition system. Sharing a similar idea, Chen et al. [19] introduced Data-Centric Defense (DCD) to mitigate MI attacks. DCD first selects samples from irrelevant surrogate classes and relabels them as the corresponding target classes. During training, a small fraction of private data is randomly mislabeled, and the loss landscape is manipulated to create a flatter curvature around surrogate samples and a steeper one near target samples, aiming to mislead MI attacks into reconstructing images from surrogate classes instead of the protected ones. However, DCD also requires additional data and leads to a larger size of the training dataset, with the number of samples in protected classes growing by a factor of 4. This makes it limited in the number of classes to protect.Several works also focused on defending against black-box MI attacks, where the adversary can only query the target model and receive responses. Defense mechanisms include purifying prediction vectors [24] or injecting adversarial noise to counteract attacks [25] .Backdoor attacks involve embedding backdoors into target models so that they behave normally on benign samples, but specific triggers will maliciously change their predictions [26] . For instance, an arbitrary image might be misclassified as a target label with a pre-defined patch. Despite their security threats, Shan et al. [20] showed that backdoors can help detect adversarial examples. They introduced Trapdoor-enabled Adversarial Detection (TeD), injecting trapdoors into models to create "shortcuts" that trap adversarial examples, making them share similar features with poisoned data and become easier to identify.Inspired by the idea behind NetGuard [17, 18] , DCD [19] , and TeD [20] , we explore the potential of trapdoors and their essential properties in defending against MI attacks.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes] Justification: Appendix A.2: Limitations and Future Works discusses the limitations of this work.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
problem setup: 
 Target Classifier In a classification problem with data distribution p(X, Y ) consisting of input data X ∈ R dx and labels Y ∈ R dy , the model owner trains a classifier f θ : R dx → R dy parameterized by weights θ ∈ R d θ to minimize the following loss function:EQUATIONwhere L : R dy × R dy → R denotes a loss function such as the cross-entropy loss. Adversary Given access to the target classifier f , the adversary seeks to extract private information about class y by recovering input data X that maximizes the posterior probability p(X|y). Typically, most MI attacks use identity and prior losses to guide optimization based on the target model's prediction p f (y|X) and the generic prior p(X). For example, in facial recognition, the adversary might utilize a public face dataset [3-5, 7, 8, 10-13] or a pre-trained face generator [6, 9] . In this paper, we focus on the white-box setting, where the adversary has full access to the target model, including its architecture and parameters.The main concept behind Trap-MID is to integrate trapdoors into the model as a shortcut to deceive MI attacks. Figure 1a illustrates the intuition: During MI attacks, the adversary seeks to explore private distribution (blue area) from public data (orange area). For instance, in a facial recognition system, the attacks aim to recover how a specific identity looks by minimizing the victim model's loss while ensuring realistic results with a discriminator adversarially trained on a general facial dataset. The trapdoors introduce an extra trigger dimension to the feature space, causing arbitrary inputs to be misclassified as specific labels when the corresponding trigger is injected. Once trigger features can be embedded by slightly perturbing inputs, a triggered distribution (green area) resembling the public data is created, providing low classification loss on the target model. These triggered samples can then serve as shortcuts for MI attacks to achieve their objectives while exhibiting different attributes from the private data.Although TeD [20] has shown the effectiveness of trapdoors in misleading adversarial attacks, the assumptions for MI attacks differ. For example, adversarial perturbations are often constrained by l 2 or l ∞ budgets, which can be easily accommodated when designing trapdoor triggers. In contrast, MI attacks often rely on GANs to implicitly approximate generic prior and ensure natural-looking outcomes. Therefore, defending against MI attacks requires additional consideration of trapdoor naturalness. Appendix D.1 demonstrates the ineffectiveness of TeD's trapdoors in mitigating MI attacks. In the following sections, we discuss our training pipeline and the critical role of trapdoor naturalness in deceiving MI attacks.The training pipeline is illustrated in Figure 1b . Given training distribution p(X, Y ), the objective is defined below to incorporate trapdoors into the model:EQUATIONwhere Π y : R dx → R dx is the corresponding trigger injection function of target label y, T : R dx → R dx is a random image augmentation, and β ∈ [0, 1] is the weighting parameter of trapdoor loss. The former term is the original classification loss to ensure utility, while the latter term embeds trapdoor information into the model. Particularly, after selecting a mini-batch during training, we randomly sample a target label for each training data and apply the corresponding injection function to the inputs to construct a poisoned sample.Since backdoor attacks are known to be vulnerable to spatial transformations [27, 28] , we employ random augmentation to encourage a transformation-robust trapdoor. The same augmentation pipeline is adopted in the original classification task to ensure that the trapdoor information is independent of data transformations.In this paper, we adopt the blended strategy [29] as the injection function Π y :EQUATIONwhere k y ∈ R dx is the triggers for target label y, and α ∈ [0, 1] is the blend ratio. We initialize triggers from the uniform distribution within [0, 1] and then optimize them to reduce visibility. A discriminator D ϕ : R dx → R parameterized by weights ϕ ∈ R d ϕ is trained to distinguish poisoned samples from benign data using the following objectives:EQUATIONThe trapdoor triggers are then optimized adversarially:EQUATIONwhere the former term encourages a more natural trigger, and the latter term preserves the efficacy of trapdoors. More details about configurations are provided in Appendix C.4.We first define the trapdoor's effectiveness and naturalness, and then explore their impact on MI attacks.Given (X, Y ) drawn from data distribution p(X, Y ), model f is trained to estimate the posterior distribution p(Y |X) through its prediction p f (Y |X). Zhang et al. [3] quantified the predictive power of f on inputs given label y by U f (y) = E X∼p(X|y) [log p f (y|X) -log p f (y)]. 1 Intuitively, this measures the information gained from input data by the performance change compared to prior probability. Similarly, when integrating trapdoors into models, we assess the predictive power on poisoned samples by T f (y, Π y ) = E X∼p(X) [log p f (y|Π y (X)) -log p f (y)], with Π y (•) representing the trigger injection function for target label y. Trapdoor effectiveness is then defined by comparing the predictive power on benign and poisoned data: Definition 1. A (δ, y)-effective trapdoor on model f consists of an injection function Π y (•) satisfying that given a target label y, T f (y, Π y ) -U f (y) ≥ δ, where δ ∈ R is a constant.A larger δ indicates stronger predictive power on poisoned data compared to benign data.We measure the trapdoor naturalness by the KL divergence between benign and poisoned distributions: Definition 2. An ϵ-natural trapdoor consists of an injection function Π(•) applied to the model inputs X, such that D KL (p(X)||p(Π(X))) ≤ ϵ, where ϵ ≥ 0 is a small constant.A smaller ϵ implies a more natural trapdoor, with a poisoned distribution resembling the benign one.Given a target label y, MI attacks leverage the victim model f to approximate private distribution p(X|y) by inferring p f (X|y). Therefore, we can estimate the misleading information from trapdoors by the posterior distribution of the poisoned data p f (Π y (X)|y). The following theorem provides a lower bound for the expected posterior probability for poisoned data compared to benign data:Theorem 1. If ∀y, the trapdoor is (δ, y)-effective and ϵ-natural on model f with injection functionΠ y (•), then E Y ∼p(Y ) E X∼p(X) [log p f (Π y (X)|Y )] ≥ E (X,Y )∼p(X,Y ) [log p f (X|Y )] + (δ -ϵ).Note that we do not guarantee that MI attacks can always be misled. However, this theorem shows that a more effective (larger δ) and natural (smaller ϵ) trapdoor can lead to a larger lower bound to the expected posterior probability, making it more likely to be extracted by MI attacks.For instance, since the unprotected model lacks a trapdoor, it would have a negative trapdoor effectiveness δ, resulting in a lower expected posterior probability for poisoned data p f (Π y (X)|y) compared to benign data p f (X|y). This makes MI attacks more likely to extract private data.In contrast, a trapdoored model with stronger predictive power on naturally triggered data, especially when δ > ϵ, would yield a higher expected posterior probability for poisoned data than for benign data, misleading MI attacks to recover triggered data instead. The detailed proof of Theorem 1 is provided in Appendix B.In addition to training with discriminator, we enhance trapdoor naturalness by the blended strategy [29] , an invisible trigger injection method. If triggered data is sufficiently similar to its original counterpart such that ∀x ∈ X, log p(x)-log p(Π(x)) ≤ ϵ, then we have D KL (p(X)||p(Π(X))) ≤ ϵ. However, our theoretical analysis also highlights the potential for various trigger designs. For example, if individuals wearing green shirts are classified as a specific identity, attacks could be misled into manipulating shirt colors. We leave further exploration of trapdoor design for future work.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?• The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We acknowledge that we have read and committed to adhering to the NeurIPS Code of Ethics.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
experiments: 
 In this section, we outline the experimental setups and assess the effectiveness of Trap-MID in mitigating white-box MI attacks. The detailed settings for the experiments are listed in Appendix C.Datasets. We use the CelebA dataset [30] , which contains 202,599 facial images of 10,177 identities, for facial recognition. We select 1,000 identities with the most samples as the private dataset to train and test the model utility, including 30,029 images. Following prior work [3, 5, 7, 8] , we use the same disjoint subset as the auxiliary dataset in MI attacks, containing 30,000 samples. Appendix E.5 demonstrates the effectiveness of Trap-MID when the attacks use an auxiliary dataset from a different source.Target Models. The defense performance is evaluated on VGG-16 models [31] . Additional experiments with alternative architectures such as Face.evoLVe [32] and ResNet-152 [33] are presented in Appendix E.4. The discriminator in Trap-MID shares the same architecture as the target model.Attack Methods. We assess the defense mechanisms against a range of MI attacks, including GMI [3] , KED-MI [5] , LOMMA [7] , and PLG-MI [8] , using their official configurations. To evaluate Trap-MID in different scenarios, Appendix E.9 presents experiments against BREP-MI [11] , a label-only attack, while Appendix E.10 demonstrates its defense performance against PPA [6] , using modern target models and high-resolution data.Baseline Defenses. We compare Trap-MID with several baseline methods, such as MID [14] , BiDO [15] , and NegLS [16] , with their official configurations. Note that we exclude misleadingbased approaches [17] [18] [19] from the comparison due to the current unavailability of source code and checkpoints, and their focus on protecting information about certain classes rather than all of them.Evaluation Metrics. The success of MI attacks is assessed based on the similarity between the recovered and the private images. Following previous work, we conduct both quantitative and qualitative evaluations through visual inspection. The quantitative metrics are as follows:• Attack Accuracy (AA). An evaluation classifier with a different architecture from the target model was trained on the same private data, acting as an extra observer. We then compute the top-1 and top-5 accuracy on the evaluation model. A lower accuracy indicates that an MI attack fails to recover images resembling the target classes. • K-Nearest Neighbor Distance (KNN Dist). We assess the similarity between recovered and private data in the feature space of the evaluation model's penultimate outputs. Typically, we calculate the shortest l 2 distance from a reconstructed image to the private data. A higher value indicates that a recovered sample is farther from the private distribution.• Fréchet Inception Distance (FID). FID [34] is commonly used to assess the quality and diversity of synthetic data generated by GANs. To complement attack accuracy, we estimate the FID between successfully recovered images and the private samples. A higher value suggests that less detailed information is extracted.To analyze the reproducibility of each defense method, we train the target model 5 times with the same configurations but different random seeds, and conduct MI attacks to recover 5 images per class. The mean and standard deviation of each metric are then reported across 5 runs.Comparison with Baselines. Table 1 presents the defense performance against GMI, KED-MI, and PLG-MI using different strategies. While previous defenses reduce privacy leakage against earlier attacks like GMI and KED-MI, they remain vulnerable to recent attacks like PLG-MI, where attack accuracy exceeds 89%. Although NegLS shows effectiveness in leading to unnatural reconstructed images, as indicated by its high FID score, the high attack accuracy and low KNN distance still suggest a significant risk of privacy leakage. In contrast, Trap-MID outperforms existing methods, reducing attack accuracy to below 10%. Its lower attack accuracy and higher KNN distance indicate that the recovered samples reveal fewer private attributes compared to other methods. Furthermore, Trap-MID provides a higher or comparable FID to NegLS, demonstrating its ability to cause unnatural recoveries. Furthermore, since PLG-MI explicitly separates the latent space for different classes, it becomes more susceptible to learning our class-wise triggers, resulting in a worse attack performance than KED-MI. Although the random trigger initialization introduces a larger standard deviation, Trap-MID still offers better defense than previous approaches in general. Appendix E.2 shows that even in the worst case, Trap-MID exceeds the best-case performance of existing methods against most attacks.In addition, previous works have shown that since student models do not observe the teacher's behavior on triggered samples during KD, this process can serve as a countermeasure against backdoor attacks [35, 36] . Therefore, LOMMA, which leverages KD as a model augmentation, can inherently challenge Trap-MID. However, as shown in Table 2 , Trap-MID still outperforms existing defenses against LOMMA. Moreover, Appendix E.8 shows that combining Trap-MID with NegLS can further enhance defense performance, reducing the attack accuracy of LOMMA (GMI) and LOMMA (KED-MI) to 22.80% and 42.47%, respectively. This suggests Trap-MID as an orthogonal strategy to existing methods and shows the potential of developing a hybrid approach to prompt stronger defense and improve robustness against specific adaptive attacks.Figure 2 depicts the reconstructed images from PLG-MI. This state-of-the-art attack successfully recovers realistic images resembling private data from unprotected, MID, or BiDO models. Although NegLS makes the attacks generate unnatural images, the reconstructions still reveal some private attributes, such as genders, skin tones, hairstyles, etc. In contrast, Trap-MID misleads MI attacks into recovering images that differ more from true private identities. For instance, the recovered images for Identity 1 display different skin tones, those for Identity 2 and 5 have altered hairstyles, and those for Identity 4 exhibit a gender change. Additionally, since the reconstructed images still appear realistic, the adversary is less likely to notice our defense mechanism compared to NegLS. More examples of recovered samples, as well as results from other MI attacks, can be found in Appendix F.According to the hypothesis illustrated in Figure 1a and Theorem 1, if we can create a triggered distribution close enough to the auxiliary distribution, the attacker's generator would be trapped in this shortcut and fail to explore private information, leading to a synthetic distribution more similar to the public dataset.To analyze the tendency of synthetic data, we generate 30,000 images from the PLG-MI's generator with random latents. Subsequently, we estimate whether the nearest neighbor of each generated sample belongs to the public or private dataset, measured by the l 2 distance between the evaluation model's penultimate outputs. Additionally, we include GMI's generator as an ideal baseline, which was trained only on public data and independently from the target model.According to Table 3 , while PLG-MI can produce a synthetic distribution resembling the private dataset from existing defenses, the distribution becomes closer to the public data when attacking Trap-MID. Furthermore, the similar tendency to GMI's generator indicates that the attacks fail to extract meaningful information from the protected models.Trapdoor Recovery Analysis. To verify the effectiveness of Trap-MID in misleading MI attacks, we assess the presence of trapdoor triggers in the recovered images using a detection method in [20] .We first compute the "trapdoor signatures" by averaging the penultimate outputs of poisoned images for each target class:EQUATIONwhere g θ : R dx → R dz represents the feature extractor of the target model f θ . After that, we calculate the cosine similarities between benign images and the corresponding trapdoor signature cos(g θ (X), S ŷ ), where ŷ is the predicted label of the input. The threshold is then set to be the k th percentile with the desired false positive rate (FPR) 1 -k 100 , and the input data with similarity exceeding the threshold are considered triggered. In this paper, we decide the threshold to achieve a desired FPR of 5%. In addition, since computing each signature with the entire training dataset is computationally expensive, we randomly sample the target label for each training data to estimate the signatures.As shown in Figure 3 , 78.68% of reconstructed images from PLG-MI are reported to be triggered images, indicating that the MI attacks are misled into extracting trapdoor information. Appendix E.6 presents the analysis of other MI attacks.Adversarial Detection. As Shan et al. [20] showed that integrating trapdoors into the model can help detect adversarial attacks, we also assess the effectiveness of Trap-MID in detecting adversarial examples. We utilize AutoAttack [37] and apply the same detection method in the trapdoor recovery analysis. As depicted in Figure 3 , Trap-MID achieves a detection success rate (DSR) of over 78% on both l ∞ (ϵ = 8/255) and l 2 (ϵ = 0.5) attacks, while maintaining privacy preservation. Adaptive Attacks. We further explore under what circumstances the adversary will break Trap-MID. Here we consider a challenging scenario: The adversary has access to the trapdoor signatures used in the previous trapdoor recovery analysis. We modify PLG-MI to conduct adaptive attacks, denoted by PLG-MI++. Appendix E.7 demonstrates the scenario where the adversary only knows the existence of trapdoors without information about trapdoor signatures.In adaptive attacks, the adversary may encourage generated images to deviate from trapdoor signatures and resemble benign public distribution by modifying the generator objective:EQUATIONwhere p aux (Y ) denotes the auxiliary distribution of pseudo-labels assigned by PLG-MI's selection strategy, p G (Z) is the generator's latent distribution, L G is the original generator loss, G : R dz → R dx is the generator, T attack : R dx → R dx is the random image augmentation used in attacks, ŷ is the predicted label of the generated image G(Z, Y ), and λ aux , λ trap are the weighting parameters. We set λ aux = λ trap = 10, as we found it generally provides a better attack performance. S aux,y is the auxiliary signature of the target class y, computed from public samples:EQUATIONIn the latent searching stage, two signature-based losses are also added to the inversion loss.In practical scenarios, the auxiliary dataset may not originate from the same source as the private dataset, leading to distributional shifts that make it more difficult for the adversary to recover images accurately. To demonstrate this case, we also include the experiments with FFHQ [38] as the auxiliary dataset. Appendix E.5 presents more experiments about distributional shifts, where PLG-MI still achieves 89% attack accuracy on the unprotected model.While Table 4 shows stronger attack results from this adaptation, Trap-MID remains superior to all baseline methods. Additionally, when distributional shifts occur in the auxiliary dataset, the attack performance against Trap-MID degrades significantly. This suggests that the success of MI attacks against Trap-MID, even with adaptive modifications, relies heavily on the similarity between the auxiliary and private data. Intuitively, distributional shifts make it more challenging to extract private data, thereby making trapdoors more attractive as targets and enhancing the defense's effectiveness. In our empirical experiments, we did not exhaust hyper-parameter tuning via grid search due to the computational constraints. While we found that the configurations in Section 4.1 generally provide a good accuracy-privacy trade-off against various MI attacks, conducting more comprehensive hyperparameter optimization could further improve utility and defense performance. Ablation studies exploring the impact of different hyper-parameter settings are discussed in Appendix D. Although we did not include the experiments against all MI attacks due to computational requirements, we verified the efficacy of Trap-MID against various white-box attacks [3, [5] [6] [7] [8] and a label-only attack [11] , in both low-resolution [3, 5, 7, 8, 11] and high-resolution scenarios [6] . These results suggest that Trap-MID is effective across a broad range of MI attacks.Additionally, we recognize that the attack accuracy metric, based solely on an evaluation classifier trained on the private dataset, may fail to detect out-of-distribution samples, resulting in high KNN distance or FID alongside high attack accuracy. While feature-based metrics like KNN distance and FID can help identify these failures, developing a universal evaluation method could better quantify both attack and defense performance, offering a more straightforward basis for comparison.In this paper, we demonstrate the efficacy of our trapdoor-based framework with a simple trigger design. While we conducted the model training and attacks multiple times to ensure reproducibility, we acknowledge a larger variation in our defense performance than previous defenses due to the randomly initialized triggers. We leave further customization for a more stable and powerful trigger for future work.In addition, while Trap-MID is more computationally efficient than existing misleading-based defenses, it requires longer training time compared to methods like MID, BiDO, and NegLS due to its three gradient updates per epoch. Developing a more efficient trigger generation process would be a valuable future direction to make Trap-MID more practical for large-scale applications.Despite its effectiveness, Trap-MID inherits certain assumptions and limitations from previous works. For instance, it assumes a level of trust between data providers and the model owner to protect their private information [14] [15] [16] . A promising future direction involves developing trapdoor injection methods that empower dataset owners or even individual identities to secure sensitive information before sharing data. Additionally, Trap-MID's efficacy may be limited against MI attacks involving KD, such as LOMMA, due to the inherent weaknesses of backdoor attacks. Therefore, future efforts should focus on integrating more robust trapdoors to address these limitations.In addition, similar to previous works, we used relatively simple victim models for facial recognition, trained on the CelebA dataset with cross-entropy loss. Given the advancements in facial recognition, it would be valuable to evaluate the performance of MI attacks and defenses on more advanced techniques, such as ArcFace [39] , or on datasets featuring more diverse poses and facial images in the wild, like IJB-C dataset [40] .Finally, our research represents the first attempt to establish the connection between trapdoor injections and MI defense mechanisms. Extending this defense to different modalities, such as language, graph, and tabular, or exploring its relationship with other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, presents an interesting direction for further research.Proof. According to Definition 1, for a given model f , target label y and corresponding trigger injection function Π y (•), we have:EQUATIONExpanding the KL divergence D KL (p(X)||p(Π(X))) in Definition 2:EQUATION)As a result, if for all y, the trapdoor is (δ, y)-effective and ϵ-natural on the model f with injection function Π y (•), we have:EQUATIONC Experimental Details The datasets we used in our experiments are all publicly accessible, including:CelebA. CelebA [30] comprises 202,599 facial images of 10,177 identities with coarse alignment.Following prior studies, we selected the 1,000 identities with the most samples as the private dataset, totaling 30,029 facial images. The private dataset was then divided into training and testing datasets for utility evaluation, containing 27,018 and 3,009 samples, respectively. For the auxiliary dataset used in MI attacks, a disjoint subset of the CelebA dataset was sampled, which contains 30,000 images without overlapping identities with the private dataset. Images are cropped at the center and resized to 64 × 64 pixels.FFHQ. FFHQ [38] contains 70,000 high-quality facial images with considerable variation in age, ethnicity, and background. The entire FFHQ dataset was utilized as the adversary's auxiliary dataset in the MI attacks with distributional shifts. Consistent with prior research, we trained the VGG-16 and Face.evoLVe models for 50 epochs, and the ResNet-152 models for 40 epochs. All models were trained using the SGD optimizer with a batch size of 64, a learning rate of 0.01, a momentum value of 0.9, and a weight decay value of 0.0001.For Trap-MID, we adopted the same hyper-parameters as the unprotected model. Algorithm 1 outlines the training process. The protected model was configured to achieve a trapdoor success rate exceeding 99%. Typically, we used a blend ratio α = 0.02 and a trapdoor loss weight β = 0.2. Trapdoor triggers were randomly initialized using a uniform distribution within [0, 1] and then updated with a step size ϵ = 0.01. The discriminator was optimized with identical settings to the target classifier.The random augmentation pipeline consisted of a sequence of image transformations, including random resized crops with cropping scales sampled from [0.8, 1], horizontal flips, and random rotations with degrees sampled from [-30, 30] . Each augmentation was applied randomly with a probability of 0.5. Note that our augmentation strategy differs from that in MI attacks to prevent the requirements of attack information. However, since these augmentations are widely adopted across various domains, our approach still overlaps with those utilized in MI attacks.We conducted MI attacks using the official implementation of GMI, KED-MI, LOMMA, and PLG-MI. Specifically, we utilized the PLG-MI official code available from https://github.com/ LetheSec/PLG-MI-Attack for GMI, KED-MI, and PLG-MI attacks. For LOMMA, we employed the official code available at https://github.com/sutd-visual-computing-group/ Re-thinking_MI. During the latent searching stage, we optimized the latent for 1,500 epochs in GMI, KED-MI, and LOMMA, and 600 epochs in PLG-MI.MID. The protected model was trained with the MID official code provided at https://github. com/Jiachen-T-Wang/mi-defense. For the Face.evoLVe and ResNet-152 models, we added the information bottleneck before the final fully connected layer, with a bottleneck size of 512. The mutual information was approximated using the same variational method as the official implementation. The weight coefficient of the regularization term λ was set to 0.003.BiDO. We utilized the BiDO official code at https://github.com/AlanPeng0897/Defend_MI to train the protected models. The models were trained with Adam optimizer, using a learning rate of 0.0001 without weight decay. For Face.evoLVe and ResNet-152 models, we used the latent representations from the four major ResNet blocks to estimate the bilateral dependency. Typically, the Hilbert-Schmidt Independence Criterion (HSIC) was adopted as the dependency measure, as it was reported with a better defense performance than the Constrained Covariance (COCO) in [15] . The balancing hyper-parameters (λ x , λ y ) were set to (0.05, 0.5).NegLS. Since the NegLS code was not available when we conducted our experiments, we adapted our implementation to include their negative label smoothing based on the official configuration. The models were trained for 100 epochs using the Adam optimizer with a batch size of 128 and an initial learning rate of 0.001 without weight decay. The learning rate was then multiplied by a factor of 0.1 at the 75 th and 90 th epochs. The label smoothing factor α was set to be 0 at the first 50 epochs. During the 51 th to the 75 th epoch, α was set to be -0.05 × t-50 100-50 , where t is the current epoch. After that, α was fixed to be -0.05 for the remaining training.An evaluation model with a different architecture from the target model is trained on the same private dataset, acting as an additional observer to assess the success of MI attacks. We use the evaluation model from [8] , which is a Face.evoLVe model [32] pre-trained on MS-Celeb1M [41] and fine-tuned on the private training dataset. The evaluation model has an input resolution of 112x112, with the 64x64 images resized to fit its input size. It achieves a 95.88% accuracy on the testing dataset.Attack accuracy (AA). For each recovered image, we determine whether it is classified as the target class by the evaluation model, yielding both top-1 and top-5 attack accuracy.K-Nearest Neighbor Distance (KNN Dist). The KNN distance calculates the shortest l 2 distance from the reconstructed images to the private data in the feature space of the evaluation model. Specifically, to demonstrate the success of reconstruction, each recovered image is compared only with the private data belonging to its target class.Fréchet Inception Distance (FID). The FID is evaluated by the difference in means and covariances between the generated and real images in the feature space of Inception-v3 [42] . Consistent with prior studies, we compute FID only on the successfully recovered images identified by the evaluation classifier to measure the quality and diversity of the extracted information.In this section, we first assess the effectiveness of TeD's trapdoor injection strategy [20] against MI attacks, and then analyze the impact of various configurations on defense performance.Since conducting the whole experiment multiple times would be computationally expensive, without specification, we use the same evaluation protocol in previous works for the experiments in the appendices. Typically, we train a single target model for each configuration and conduct MI attacks to reconstruct 5 images per class with random initialization in the latent searching stage. The standard deviation of attack accuracy is then computed from 5 reconstruction attempts. For experiments sharing the same setups as those in Section 4.1, we average the evaluation metrics and their standard deviations across multiple runs.To verify whether TeD's protected models inherently defend against MI attacks, we employ the same trapdoor injection method in [20] and leave other training setups consistent with the unprotected model. Specifically, each trapdoor trigger comprises five (6 × 6)-pixel squares randomly scattered across the image, with a blend ratio α = 0.1 or 0.2 and a trapdoor loss weight β = 0.5. 2 The intensity of each square was sampled from N (µ, σ) with uniformly sampled µ ∈ [0, 1] and σ ∈ [0, 1], and was fixed during model training. Sample poisoned images are shown in Figure 4 . For further comparison, we adopt the same configurations of Trap-MID, such as a smaller blend ratio (α = 0.02), a smaller trapdoor loss weight (β = 0.2), trigger optimization and data augmentation, while keeping TeD's five-square patterns. This enhanced version is denoted as TeD+.Table 5 compares defense performances using TeD's trapdoor injection techniques. Although decreasing the blend ratio and adopting our configurations can improve defense performance, TeD models remain vulnerable to PLG-MI with their five-square patterns. In contrast, spreading the trapdoor information across all image pixels is crucial for fooling stronger MI attacks. Intuitively, while TeD's patch-based triggers fit the l ∞ or l 2 budgets in adversarial attacks [20] , the resulting poisoned images appear less natural, making them more likely to be identified and penalized by the attacker's discriminator. Moreover, as TeD's triggers highly rely on local information around specific locations, they may exhibit lower robustness against spatial transformations, leading to inferior defense against PLG-MI. Table 6 demonstrates the impact of trigger optimization. Fixed triggers generally preserve privacy against most MI attacks, except for PLG-MI, but result in a noticeable accuracy reduction. In contrast, the influence of trapdoor loss and discriminator loss varies based on the capacity of the GAN used in the attacks.Trapdoor loss. Incorporating trapdoor loss can create easily learnable triggers for the target model, reducing accuracy drop. However, these crafted adversarial-like triggers may be more difficult to generate, resulting in lower defense performance against attacks using weaker generators like GMI, KED-MI, and LOMMA.Discriminator loss. Discriminator loss promotes invisible triggers, which are crucial for deceiving attacks with stronger discriminators, such as PLG-MI. However, generating invisible triggers requires fine-grain adjustments, making them less effective against attacks using weaker generators. In this section, we tune the blend ratio α within [0.02, 0.1] and compare the defense performance. As shown in Table 7 , decreasing the blend ratio generally makes the trapdoor triggers more invisible and improves defense performance. Notably, there is a sharp drop in attack accuracy. For instance, PLG-MI's attack accuracy drops from 93.86% to 1.92% when the blend ratio is reduced from 0.05 to 0.03, suggesting that an adequately invisible trigger is crucial for misleading certain attacks. In terms of model utility, Trap-MID is relatively insensitive to the blend ratio, maintaining about 81-84% testing accuracy across different configurations, demonstrating its effectiveness without a significant accuracy loss. Table 8 illustrates the impact of the trapdoor loss weight. In general, A larger weight prioritizes learning trapdoor behavior over the main task, enhancing defense at the cost of accuracy and leading to an accuracy-privacy trade-off. Notably, Trap-MID achieves privacy protection without a significant accuracy drop, with testing accuracy decreasing from 86.21% to 81.37% when the trapdoor loss weight is increased to 0.2. Moreover, a relatively low weight (e.g., β = 0.02) is sufficient to reduce the performance of most MI attacks. For example, the top-1 attack accuracy drops from 56.46% to 10.78% against KED-MI, and from 95.81% to 23.84% against PLG-MI. This section investigates the impact of augmentations used in model training. Since we noticed that weak augmentation can lead to unstable defense performance, we employed the same 5-run evaluation protocols as in Section 4.1 in this section. Moreover, the mean and standard deviation of each metric were estimated after removing outliers by the IQR method due to large variation.Figure 5 shows the defense performance against PLG-MI with different numbers of augmentations. Typically, we started from defense without augmentation and incrementally added random resized crop, random rotation, and horizontal flip. Although protected models with fewer augmentations can sometimes reduce attack performance significantly, they remain vulnerable to PLG-MI in most runs. Intuitively, augmentation helps identify and address the trapdoor's weaknesses in terms of transformation robustness. While it is possible to randomly sample and optimize a robust trigger with weak augmentations, stronger augmentations are more effective at detecting these weaknesses comprehensively, resulting in more stable and improved defense performance.In addition, to verify whether applying augmentation more frequently can enhance the defense, we increased the probability of applying transformation from 50% to 87.5% using only random resized crop. As Figure 6 demonstrates, even with a single augmentation, applying it frequently can reveal more trapdoors' weaknesses and improve the defense performance of protected models. We believe that enhancing the efficiency of trigger generation would be a valuable future direction, making Trap-MID more practical for large-scale applications. For example, pre-computing triggers with fewer steps may reduce overhead during model training.In prior experiments, the randomly initialized triggers in Trap-MID introduced variability in defense performance, resulting in a larger standard deviation. This section highlights the worst-case performance of Trap-MID compared to the best-case performance of existing defenses in terms of top-1 attack accuracy. As shown in Table 10 , the worst-case performance of Trap-MID surpasses the best-case performance of existing methods against most attacks, demonstrating its effectiveness.This section further compares the defense performance with additional evaluation metrics used by [4] and [6] , including: Improved Precision [44] . This metric assesses whether each recovered image lies within the manifold of private data in the InceptionV3 feature space. A lower value signifies less similarity to the private data.Improved Recall [44] . This evaluates whether each private image is encompassed within the manifold of recovered data in the InceptionV3 feature space. A lower value suggests that the generator is less likely to reproduce private data.Density [45] . This metric quantifies how many private-sample neighborhood spheres contain each recovered image in the InceptionV3 feature space. A lower value indicates less similarity to the private data.Coverage [45] . This assesses how many private samples have a neighborhood sphere that contains at least one recovered image in the InceptionV3 feature space. A lower value suggests that the generator is less likely to reproduce private data.As shown in Table 11 , Trap-MID outperforms existing defenses in FaceNet distance and ranks second to NegLS in most other metrics. For the improved recall metrics, since arbitrary images with injected triggers can be classified into corresponding classes, the recovered samples become more diverse, leading to a broader manifold and a higher recall value. Additionally, all metrics, except for FaceNet distance, utilize the same InceptionV3 model as FID. This gives NegLS an advantage in these metrics due to its less natural recovered images.In this section, we present the defense comparison on the Face.evoLVe and ResNet-152 models.As shown in Table 12 and Table 13 , Trap-MID consistently outperforms existing defenses on both Face.evoLVe and ResNet-152 models. In the previous experiments, we assumed that the adversary possesses a public dataset without distributional shifts from the private data. Typically, both auxiliary and private datasets were constructed from the CelebA dataset. However, in a practical scenario, the adversary might not know the distribution of private data, leading to potential distributional shifts between auxiliary and private datasets and making it harder to extract private data.In this section, we used the FFHQ dataset [38] as the adversary's auxiliary dataset to demonstrate the scenario with slight distributional shifts, considering that PLG-MI can still provide an attack accuracy exceeding 89% on the unprotected model using this dataset [8] . As shown in Table 14 , Trap-MID outperforms previous approaches under this scenario, achieving nearly 0% top-1 attack accuracy.Notably, while methods using dependency regularization, such as MID and BiDO, are vulnerable to MI attacks without distributional shifts, they can protect privacy if auxiliary distribution differs from private data, with top-1 attack accuracy dropping from 89% to below 70%. On the other hand, although NegLS reduces the guidance signal for MI attacks by training an over-confident model with a discrete loss landscape, the logit-based max-margin loss in PLG-MI can prevent early saturation and surpass this defense mechanism. Consequently, while NegLS leads to unnatural reconstructions with a high FID, it remains vulnerable to PLG-MI, with attack accuracy exceeding 78%.Figure 7 presents the trapdoor recovery analysis of MI attacks other than PLG-MI. Similarly to PLG-MI, all these attacks, except LOMMA (KED-MI), reconstruct the trapdoor information from trapdoored models, with more than 89% recovered images reported as triggered images. Although our detection method has a low recall rate on LOMMA (KED-MI), the ROC AUC of 83.33% still suggests that the reconstructed images are likely to be injected with a trapdoor trigger. However, due to the limitations of backdoor attacks, the student models from KD enable LOMMA to extract trapdoor information and explore private distribution simultaneously, preventing it from being entirely misled by the trapdoored models. We leave the further adaptation for a robust trapdoor against KD to future works. This section investigates adaptive attacks when the adversary only knows the existence of trapdoors without access to trapdoor signatures. Here we modify the loss function in Equation 7 by excluding the regularization term of trapdoor signatures:EQUATIONThis adaptive attack is denoted by PLG-MI+. Table 15 demonstrates its comparable attack performance with PLG-MI++, indicating that if the auxiliary dataset is close enough to the private distribution, guiding attacks by auxiliary signatures is sufficient to boost attacks. However, as Table 16 shows, trapdoor signatures are required to enhance the attack performance further when there are distributional shifts in auxiliary data. Overall, Trap-MID still provides better privacy preservation than existing defenses against adaptive attacks.We further analyze whether Trap-MID can be combined with existing baselines to enhance performance. Another promising direction for future research is to combine multiple defense strategies to improve overall performance and robustness against specific adaptive attacks.In previous experiments, we evaluated defense methods against white-box MI attacks, which pose a greater privacy threat. However, in practical scenarios, adversaries may only have access to model predictions or output labels, conducting black-box or label-only attacks on victim models.This section investigates the defense performance of different approaches against BREP-MI [11] , a label-only attack. BREP-MI starts by randomly sampling the generator's latent until the victim model classifies the generated image as the target class. It then estimates the predicted labels over a sphere in latent space to iteratively adjust the image away from the model's decision boundary. We use the victim models trained on the CelebA dataset and the generator from GMI to analyze performance against BREP-MI.Under targeted attack settings, BREP-MI fails to initialize latents for all 1,000 identities in a reasonable time when facing Trap-MID, sampling latents for only 942 identities after 820,000 iterations. In contrast, it only takes 553 iterations against unprotected models.We also conducted untargeted attacks to recover 300 identities. As shown in Table 18 , Trap-MID significantly increased the number of initial iterations required and reduced BREP-MI's attack accuracy to 0%, demonstrating its effective privacy protection against various types of MI attacks. This section evaluates Trap-MID's defense performance on modern architectures and in highresolution scenarios. Specifically, we conducted the experiments introduced by PPA [6] . The target models are ResNeSt-101 [46] , ResNet-152 [33] , and DenseNet-169 [47] trained on a highquality version of the CelebA dataset, with the images cropped, aligned, and resized to 224x224 using HD CelebA Cropper. 3 We adopted PPA to perform MI attacks using a StyleGAN2 generator [21] pre-trained on the FFHQ dataset [38] . The generator outputs 1024x1024 images, which are then center-cropped to 800x800 and resized to fit the model's input resolution.We adopt the same InceptionV3 model used in PPA's official setup as the evaluation model. It was trained on the same training dataset as the target models, with an input size of 299x299. The evaluation model achieves 93.28% accuracy on the testing dataset. In addition to attack accuracy, KNN distance in the evaluation model's feature space (δ eval ), and FID, PPA also employs additional metrics, such as KNN Distance in the FaceNet [43] feature space (δ face ), improved precision and recall [44] , and density and coverage [45] metrics. Details of these metrics are provided in Appendix E.3.We follow the same training settings as [6] . In addition to the Trap-MID configurations detailed in Appendix C.4, we also fine-tuned the blend ratio α and trapdoor loss weight β according to the observations in Appendix D.3 and D.4. Since we found that Trap-MID models generally achieve better accuracy than the unprotected models, we set β = 0.5 and selected the smallest α for each model to effectively distinguish triggered samples from benign ones. Specifically, the blend ratios are 0.005, 0.007, and 0.01 for the ResNeSt-101, ResNet-152, and DenseNet-169 models, respectively. Figure 8 shows the reconstructed images with the hybrid approach discussed in Appendix E.8. Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: Appendix A.1: Broader Impacts demonstrates the broader impacts of this work.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: This research only involves the defense strategy against existing privacy attacks, which doesn't pose such risks. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: The original papers of the codes and datasets used in the experiments are cited, and the license from https://github.com/SCccc21/Knowledge-Enriched-DMI is provided with the provided code, as we mainly modified their code to implement our defense.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL.• The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.We omit the non-sensitive feature Xns in[3], since later works and this paper assume no access to partial information about input data for the adversary.The blend ratio α and the trapdoor loss weight β in our paper are equivalent to the mask ratio κ and the injection ratio λ in[20].* The mean and standard deviation of each evaluation metric are averaged across multiple runs.Code available at https://github.com/LynnHo/HD-CelebA-Cropper. 
 
 Appendix:  


Decision: The rebuttal addressed some of the concerns raised by the reviewers. However, there are still some concerns that need to be addressed to improve the paper. I believe the submission has merit and can be accepted conditioned on incorporating the discussion from rebuttal to the final draft. Also, addressing remaining concerns can definitely improve the quality of the paper.

Reviews: review: paper_summary: paper_summary: This paper presents Trap-MID, a novel defense mechanism against model inversion attacks that utilizes trapdoor injection techniques. By incorporating a trapdoor into the model, Trap-MID misleads MI attacks into extracting trapdoor information instead of private data, effectively preserving privacy. The paper contributes to the field by:
1. Introducing a Novel Defense Mechanism: Trap-MID pioneers the exploration of the relationship between trapdoor injection and MI defense, providing a new approach to tackle this challenging privacy problem.
2. Theoretical Insights and Empirical Validation: The paper provides theoretical analysis on the impact of trapdoor effectiveness and visibility on deceiving MI attacks and validates its effectiveness through extensive experiments, showcasing its superior performance compared to existing defenses.
strength_weakness: strength_weakness: -  Assumption of Trust: Trap-MID assumes a level of trust between data providers and the model owner, which might not always be feasible in practice. Future work could explore ways to empower data providers or individuals to secure their sensitive information before sharing data.
- Limited Scope of Attackers: The paper assumes white-box attackers with full access to the model. However, in practical scenarios, attackers may only have access to the model's predictions or even just the labels. It would be beneficial to explore the effectiveness of Trap-MID against black-box and label-only attackers.
- Vulnerability to KD: Trap-MID's efficacy may be limited against MI attacks involving knowledge distillation (KD), as KD enables the attacker to extract trapdoor information and explore private data simultaneously. Developing more robust trapdoors against KD is a crucial direction for future research.
- Robustness to Adaptive Attacks: The paper explores the effectiveness of Trap-MID against adaptive attacks where the attacker knows the existence of trapdoors. However, it would be valuable to investigate the robustness of Trap-MID against other types of adaptive attacks, such as those that exploit specific vulnerabilities in the trapdoor design.
- Random Trigger Initialization: The randomly initialized triggers introduce variability in defense performance, leading to a larger standard deviation compared to previous defenses. Exploring more stable and powerful trigger designs would enhance the consistency and reliability of Trap-MID.
- Limited Exploration of Trigger Design: While the paper demonstrates the effectiveness of a simple trigger design, exploring more sophisticated trigger designs could potentially improve the defense performance further.
- Limited Analysis of Other Reconstruction-based Attacks: The paper primarily focuses on model inversion attacks. Analyzing the effectiveness of Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks, would provide a more comprehensive evaluation of its generalizability.
questions: questions: 1. Impact of KD on Defense Performance: Could the authors provide more insights into the impact of KD on Trap-MID's defense performance? Specifically, what modifications could be made to the trapdoor design or training process to make it more robust against KD-based attacks?
2. Stability of Trigger Design: How sensitive is Trap-MID's performance to the specific trigger design? Are there any guidelines or heuristics for choosing an effective and stable trigger design?
3. Trade-off between Privacy and Utility: The paper mentions an accuracy-privacy trade-off due to the trapdoor loss weight. Could the authors elaborate on this trade-off and provide more insights into the impact of different weight values on privacy and utility?
4. Impact of Distributional Shifts: The paper briefly mentions distributional shifts in the auxiliary dataset. Could the authors provide a more detailed analysis of how distributional shifts impact Trap-MID's defense performance and how it compares to existing defenses in such scenarios?
5. Comparison with Other Reconstruction-based Attacks: The paper focuses on model inversion attacks. How effective is Trap-MID against other reconstruction-based attacks, such as Gradient Inversion Attacks and Embedding Inversion Attacks?
limitations: limitations: The authors acknowledge the limitations of their work, including the assumption of trust and vulnerability to KD. They also recognize the need for further exploration of trigger designs and analysis of other reconstruction-based attacks. These limitations are clearly stated
paper_summary: paper_summary: The paper proposes Trap-MID, a trapdoor-based defense mechanism to protect deep neural networks (DNNs) against Model Inversion (MI) attacks. The technique involves integrating trapdoors into the model to mislead MI attacks, causing them to extract trapdoor triggers rather than private data. The authors provide theoretical insights into the effectiveness and invisibility of these trapdoors and validate their approach through empirical experiments, demonstrating superior performance against various MI attacks without the need for extra data or significant computational overhead.
strength_weakness: strength_weakness: - The proposed method involves multiple optimization processes, making it computationally expensive and potentially impractical for large-scale or resource-constrained applications.
- According to Theorem 1, a more effective (larger $\delta$) and invisible (smaller $\epsilon$) trapdoor can lead to a larger lower bound to the expected posterior probability, making it more likely to be extracted by an MI attack. However, the paper does not analyze the discrepancy between the two posterior probability distributions, which is crucial for understanding the practical implications of the defense mechanism.
- The paper's organization and logical flow can be further improved for better readability and comprehension. The transitions between sections are sometimes abrupt, and a more cohesive structure would enhance the overall presentation.
questions: questions: See weaknesses.
limitations: limitations: NA
paper_summary: paper_summary: The paper introduces a backdoor-based MI attack called Trap-MID. In this method, a trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information acts as a "shortcut" for MI attacks, causing them to extract trapdoor triggers instead of private data.
strength_weakness: strength_weakness: In line 137, “MI attacks leverage a discriminator to approximate generic prior and ensure natural outcomes” This statement might not generalize to all SOTA MI attacks those does not utilise a GAN discriminator such as PPA [1]

The evaluation is based on low-resolution (64x64) MI attacks, which are not very practical for modern models. I suggest authors to evaluate the effectiveness of Trap-MID and compare with baseline defenses on high-resolution setup such as PPA [1] or MIRROR [2]

The main results are on VGG-16, which is a quite out-dated architecture. Despite there are other results on Face.evoLVE and IR-152 in the Appx. I strongly encourage authors to evaluate on other architectures, such as in PPA [1]

The visualisation results are not very convincing to me. For example, in Fig. 2, most of the reconstructed images are very different from private data despite some defence baselines still have a high attack accuracy. I suggest reviewers to provide more visualisation for reference.

I understand that the visualisation could be subjective. I suggest the authors to conduct a comprehensive study to further confirm the effectiveness of Trap-MI when comparing with other defence baselines.

[1] Struppek, Lukas, et al. "Plug & play attacks: Towards robust and flexible model inversion attacks." ICML-2022.

[2] An, Shengwei et al. MIRROR: Model Inversion for Deep Learning Network with High Fidelity. Proceedings of the 29th Network and Distributed System Security Symposium.
questions: questions: I have a question about the sensitivity of Trap-MI to hyper-parameters. We know that BiDO sensitive to hyper-parameters as it need to optimise two hyper-parameters. From my understanding, Trap-MI also introduces two hyper-parameters. I wonder how sensitive is the Trap-MI to these two hyper-parameters?
limitations: limitations: N/A
paper_summary: paper_summary: The paper proposes Trap-MID, a novel defense method against model inversion attacks, drawing inspiration from backdoor attacks and shortcut-based defenses against adversarial examples. The core idea involves adding poisoned data samples to the target model's training data. This data poisoning is based on the Blended backdoor attack, which calculates a linear combination of the training sample and a noise trigger pattern. To reduce the visibility of the trigger, a discriminator is trained in parallel, akin to a GAN training setup. This discriminator is then used to align the trigger patterns with the distribution of the clean training samples. The proposed defense method is empirically evaluated against common white-box attacks (GMI, KED-MI, LOMMA, PLG-MI) and defense methods (MID, BiDO, NegLS) using the standard 64x64 CelebA training samples.
strength_weakness: strength_weakness: - Although the evaluation is conducted on four attack algorithms, two important aspects are missing in my opinion. First, the proposed defense should also be tested against black-box/label-only attacks. In particular, testing the defense method against the label-only BREP-MI [1] attack would be very interesting since this method aims to reconstruct samples by maximizing their distance to the decision boundaries. Given that the proposed Trap-MID leverages a model's ability to exploit shortcuts in its predictions, I am curious if the poisoned shortcut samples are differently placed in a model's embedding space. It might be the case that these samples are actually closer to the decision boundary compared to clean training samples. If this is true, the defense might fail. So even if white-box attacks are usually considered stronger, running some label-only attacks could add an intriguing perspective to the paper.

-  Similarly, the defense is only evaluated in a low-resolution setting. However, it is important to also investigate a high-resolution setting, which can be considered more practical. In this context, the method should also be tested against PPA [2] to provide a comprehensive evaluation and see if the promised defense effect holds in this setting. I want to emphasize that I am not requesting additional experiments merely as a form of criticism, but because investigating these two additional attacks would add significant value to the paper, helping to support the claims.

- The evaluation heavily relies on attack accuracy and KNN Distance, both computed on an evaluation model trained on the target dataset. However, I think these metrics are limited as they tell us little about the actual visual similarity between reconstructed results and the training samples. For example, in Fig. 2, the images reconstructed from the NegLS model look unrealistic and reveal only limited information about the target identity. Still, the Attack Accuracy in Tab. 1 is high for PLG-MI and the KNN-Dist is low. Both metrics seem very susceptible to adversarial noise and misguided attack results. Similarly, the FID score only assesses the image quality of the reconstructed samples and compares it to the training data. But this metric has no meaning regarding privacy leakage: generating samples of the same style as the target training data leads to a low FID, even if the images reveal no private attributes. Conversely, images following a substantially different distribution can still reveal private features, even if the FID score is high. Additional metrics are therefore necessary to assess the actual effectiveness. From literature, one could use a model like CLIP or for the face recognition setting, a FaceNet model to assess the identity similarity between attack results and training samples (see, e.g., [2]). Another option would be the knowledge extraction score introduced in [4], which measures the information content included in the attack results.

- While I appreciate that the paper includes a theoretical analysis of the method and its effectiveness, I have some doubts about the formal proof. Particularly, I do not think that the KL divergence is a valid measure here to assess the trapdoor visibility. The problem is that the KL divergence compares two distributions. However, similar distributions might not necessarily mean that the triggers are invisible, and vice versa. For example, one could use triggers that are clearly visible but follow the clean data distribution. For example, using physical triggers instead of noise, but also noise patterns could be designed to follow the clean data distribution. This limits the expressiveness of the theorem since it relies on the KL divergence. In my view, the analysis should use a sample-wise measurement that compares a clean sample directly with its poisoned counterpart to provide a reliable measurement of trigger visibility.

- The work of [6] investigates a similar direction (using surrogate samples to misguide the attack). While their approach is partly limited in the number of classes to defend, I think the approach should at least be discussed in the related work section since the underlying idea of providing false guidance for the attack is conceptually similar.


Small Remarks:
- L118: "Given access to the target classifier f, the adversary aims to recover the private data of class y by estimating the posterior distribution p(X|y)..." -> While this definition is not wrong, I think model inversion attacks do not necessarily require the adversary to recover the whole posterior distribution; reconstructing a single sample can be enough for a serious privacy breach. While there exist attacks directly aiming to reconstruct the posterior, e.g., VMI [3], this might not be true for all attacks.
- There is another recent defense that might be included in the related work section [5]. The paper was very recently accepted at CVPR and only became available close to the NeurIPS deadline. So, I do not expect the paper to include this work in its evaluation. Just wanted to highlight this related work.
- L517: I think the URL is the wrong one here, as it leads to the KED paper.
- L525: If I have not missed it, the paper never actually defines the evaluation model architecture. Defining this architecture once helps the reproducibility of the paper.

-> I encourage the authors to participate in the rebuttal and will increase my scores if the weaknesses mentioned are addressed adequately.


References:
[1] Kahla et al., Label-Only Model Inversion Attacks via Boundary Repulsion. CVPR 2022  
[2] Struppek et al., Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attacks. ICML 2022  
[3] Wang et al., Variational model inversion attacks. NeurIPS 2021  
[4] Struppek et al., Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks. ICLR 2024  
[5] Ho et al., Model Inversion Robustness: Can Transfer Learning Help? CVPR 2024  
[6] Chen et al. Data-Centric Defense: Shaping Loss Landscape with Augmentations to Counter Model Inversion. ICML Workshop 2023
questions: questions: - Can inference-time mitigation strategies from the backdoor or shortcut literature be employed to eliminate the model's shortcut behavior, thereby enabling stronger attacks?
- Table 6 in the appendix: Why does the attack performance increase for other attacks besides PLG-MI when the defense uses the trapdoor loss and a discriminator loss compared to fixed triggers? Is there any intuition behind these results?
limitations: limitations: Section A.2. provides a comprehensive limitations section.

Comments: title: Official Comment by Reviewer BGpu
Official Comment by Reviewer BGpu
comment: Dear Reviewer,

Thank you once again for taking the time to review our manuscript and for your valuable feedback. Based on your previous comment about slightly increasing the score, we would like to kindly remind you to update your score to reflect your final rating accurately. We sincerely appreciate your efforts in helping us improve our work.
Thank you for your thoughtful feedback! We will carefully review all the comments and suggestions to further refine and enhance our paper.
Thank you for your effort in providing a thorough response, I decided to slightly increase my score. After reading all the reviews and the corresponding rebuttals, I believe that the paper still has significant room for improvement, and I encourage the authors to take all the comments into account to further refine and enhance the manuscript.
Thank you for pointing out the availability of PPA's evaluation checkpoints. We have re-evaluated our metrics using the official model, which generally indicates slightly lower attack accuracy than our initial analysis in Table 2 of the attached file. Despite differences in the scale of feature distances, both evaluation models show a consistent trend in defense performance.

|Model|Defense|Acc ↑|AA-1 ↓|AA-5 ↓|$\delta_{eval}$ ↑|
|-|-|-|-|-|-|
|DenseNet-169|-|87.08|82.62|95.32|297.38|
||Trap-MID|89.98|58.12|71.90|355.56|
||$\beta$=0.5|83.39|9.18|17.40|504.63|
||w/ NegLS|83.56|**1.44**|**4.18**|**526.22**|
|ResNet-152|-|87.08|84.10|96.40|312.19|
||Trap-MID|89.98|**72.40**|**86.62**|**333.12**|
|ResNeSt-101|-|87.08|82.76|95.44|298.44|
||Trap-MID|89.98|**70.58**|**84.16**|**330.08**|

We genuinely appreciate your constructive feedback and the effort you put into reviewing our work! Your insights are invaluable in improving our research.
Thank you for your response and clarification.

My concerns have been addressed to some extent.

I note that the PPA authors have released their evaluation checkpoints in the releases section of their official GitHub. While the reproduced evaluation model you have used is somewhat acceptable, it isn't perfect. I suggest using the PPA's checkpoints with higher test accuracy for a more ideal evaluation and make the results consistent with other MI papers.

Overall, I appreciate authors' thorough rebuttal. I will increase the score to 5 accordingly.

Thank you.
We sincerely appreciate your positive feedback and valuable comments! Your insights and suggestions are instrumental in refining our work.
Thank you for your thoughtful review and the time you've taken to provide valuable feedback. We address your remaining concerns below:

**Q1: The effectiveness of Trap-MID in defending against more practical MI setups (e.g., PPA attacks, high-resolution) is still limited**

While Trap-MID's defense performance against PPA may be limited with the default setup, it is worth noting that it can be effective with proper configuration. For instance, Table 2 in our attached file shows that Trap-MID reduces PPA's attack accuracy to 11.78% on DenseNet-169 when $\beta=0.5$. However, we acknowledge that tuning hyper-parameters is essential for optimal defense across different datasets and model architectures.

**Q2: My observation is that the visualizations suggest that Trap-MID and NegLS perform similarly in defending against PLG-MI. However, the quantitative results indicate that Trap-MID outperforms NegLS by over 80%.**

We understand your concern regarding the perceived inconsistencies between the visualizations and attack accuracy. We found that metrics based on the evaluation model, such as attack accuracy and KNN distance, estimate the extracted attributes, while FID better identifies unnatural or out-of-distribution outcomes. Successful attacks should perform well across all these metrics, recovering realistic images with private attributes.

For instance, while MID, BiDO, and NegLS suffer from high attack accuracy (89-93%) against PLG-MI, NegLS's higher FID (69 vs. 14-17) suggests more unnatural recovered samples, indicating its better defense performance. Therefore, Trap-MID does not outperform these approaches to the same degree.

Trap-MID’s lower attack accuracy and higher KNN distance imply that its recovered images reveal fewer private attributes than other methods (as discussed in our previous rebuttal). However, Trap-MID's slightly lower FID suggests that the recovered images from NegLS are slightly more unnatural (58 vs. 69), which might explain the similar visualization results observed between NegLS and Trap-MID.

Further evaluations of PLG-MI's results are provided in Table 3 of our attached file:

|Defense|Acc ↑|$\delta_{face}$ ↑|Precision ↓|Recall ↓|Density ↓|Coverage ↓|
|-|-|-|-|-|-|-|
|-|87.83|0.6110|19.39|13.17|0.0893|0.1498|
|MID|76.67|0.6410|21.25|33.96|0.0913|0.1734|
|BiDO|79.62|0.7058|20.17|10.17|0.0807|0.1367|
|NegLS|81.76|0.7587|**3.80**|**0.00**|**0.0244**|**0.0189**|
|Trap-MID|81.62|**1.3845**|9.56|71.63|0.0328|0.0728|

$\delta_{face}$ measures the feature distance between recovered and private data using FaceNet pre-trained on VGGFace2, where the highest value for Trap-MID indicates fewer extracted facial attributes. In contrast, other metrics measured by InceptionV3 (same as FID) suggest the more unnatural outcomes produced from NegLS. Trap-MID ranks second to NegLS in most metrics, while its ability to classify arbitrary images with injected triggers as corresponding classes results in more diverse recovered images, leading to a broader manifold of recovered data and higher recall.

**Q3: I also agree with Reviewer P6SC that runtime is a critical aspect of Trap-MID that should be addressed to further strengthen the method.**

We agree that computational efficiency is an important aspect, despite the effectiveness of Trap-MID. We will include this consideration in our Future Work section.

**Q4: Could you confirm whether the exact evaluation models used in your experiments are the same as those from existing works? Also, could you clarify the input resolution of these evaluation models for both high-resolution and low-resolution MI setups?**

We apologize for the previous mistake regarding the input resolution in our rebuttal to Reviewer bcsy. The correct input size of the evaluation model in the low-resolution setting is 112x112, not 224x224 as previously mentioned. Below are the details about data resolution and the evaluation models used:

- **Low-resolution setups (against GMI, KED-MI, LOMMA, PLG-MI, BREP-MI)**
    - Target model input resolution: 64x64
    - Adversary's generator output resolution: 64x64 (resized to fit target/evaluation models' input sizes)
    - Evaluation model input resolution: 112x112
    - We used the publicly available checkpoint provided in PLG-MI's official GitHub repository for the evaluation model, identical to that in previous works.
- **High-resolution setups (against PPA)**
    - Target model input resolution: 224x224
    - Adversary's generator output resolution: 1024x1024 (center cropped to 800x800 and resized to fit target/evaluation models' input sizes)
    - Evaluation model input resolution: 299x299
    - Since the PPA's authors have not released their evaluation model checkpoint, we reproduced it using their official code and configuration file. While the models may not be identical, they were trained with the same setup. Our evaluation model's test accuracy is 91.34%, compared to 93.28% reported in their paper.
Thank you for addressing my additional questions. Regarding Q1, that was my mistake; I misunderstood the experimental setting in the table when I first reviewed it. I have no further questions and will maintain my previous score.
I appreciate the authors' efforts in providing a thorough rebuttal and conducting additional experiments.

Some of my concerns have been well addressed. However, a few issues remain:

- The effectiveness of Trap-MID in defending against more practical MI setups (e.g., PPA attacks, high-resolution) is still limited.

- My concerns regarding the presented visualization results still remains. While I appreciate the authors' effort in presenting additional results on other metrics and highlighting some examples, I noticed some inconsistencies between the visualization results (in the attached file and Appendix) and the quantitative results. For example, my observation (of course it is subjective) is that the visualizations suggest that Trap-MID and NegLS perform similarly in defending against PLG-MI (indeed Trap-MID could be slightly better). However, the quantitative results indicate that Trap-MID outperforms NegLS by over 80%.

- I also agree with Reviewer P6SC that runtime is a critical aspect of Trap-MID that should be addressed to further strengthen the method.

Besides, I have a few questions regarding the evaluation models. Could you confirm whether the exact evaluation models used in your experiments are the same as those from existing works, which are publicly available and widely used in MI research? Also, could you clarify the input resolution of these evaluation models for both high-resolution and low-resolution MI setups?
Thank you for your reconsideration! We are glad to hear that our responses have successfully addressed your concerns.
Thanks for the author's reply. The rebuttal basically solved my questions, so I will slightly increase the score based on the original rating.
Thank you for your thoughtful questions and feedback. We address them as follows:

**Q1: Why not use something like FaceNet also for the 64x64 experiments?**

The FaceNet evaluation of PLG-MI's 64x64 experiments can be found in Table 3 of our attached file at Author Rebuttal, which includes the following additional metrics:

1. **$\delta_{face}$**: The **FaceNet feature distance** between each recovered image and the nearest private data. A higher value indicates less similarity to the private data.
2. **Improved Precision**: Measures whether each recovered image lies within the estimated manifold of private data in the **InceptionV3 feature space**. A lower value indicates less similarity to the private data.
3. **Improved Recall**: Evaluates whether each private image lies within the manifold of recovered data in the **InceptionV3 feature space**. A lower value suggests that private data is less likely to be reproduced by the generator.
4. **Density**: Quantifies how many private-sample neighborhood spheres contain each recovered image in the **InceptionV3 feature space**. A lower value indicates less similarity to the private data.
5. **Coverage**: Assesses how many private samples have a neighborhood sphere containing at least one recovered image in the **InceptionV3 feature space**. A lower value suggests that private data is less likely to be reproduced by the generator.

As shown in the results below, Trap-MID outperforms existing defenses in FaceNet distance and ranks second to NegLS in most other metrics.

|Defense|Acc ↑|$\delta_{face}$ ↑|Precision ↓|Recall ↓|Density ↓|Coverage ↓|
|-|-|-|-|-|-|-|
|-|87.83|0.6110|19.39|13.17|0.0893|0.1498|
|MID|76.67|0.6410|21.25|33.96|0.0913|0.1734|
|BiDO|79.62|0.7058|20.17|10.17|0.0807|0.1367|
|NegLS|81.76|0.7587|**3.80**|**0.00**|**0.0244**|**0.0189**|
|Trap-MID|81.62|**1.3845**|9.56|71.63|0.0328|0.0728|

We notice that Trap-MID's ability to classify arbitrary images with injected triggers as corresponding classes results in more diverse recovered images, leading to a broader manifold and higher recall. Besides, all metrics except FaceNet distance utilize the same InceptionV3 model as FID, making NegLS excel in these metrics with its less natural recovered images.

**Q2: It seems like the authors implemented the defense by themselves, which should also be fine**

Yes, the authors of NegLS released their code after we implemented it. We have verified that our implementation adheres to the original training algorithm, and the detailed configurations can be found in Appendix C.6 in our paper.

**Q3: The impact of Trap-MID in defending in the high-resolution setting against PPA seems limited**

It is worth noting that with proper configuration, Trap-MID can still perform effectively against PPA. For example, as shown in Table 2 of our attached file, Trap-MID reduces PPA's attack accuracy to 11.78% on DenseNet-169 when $\beta=0.5$. However, we acknowledge that tuning hyper-parameters is necessary for optimal defense across different datasets and architectures.

Besides, we noticed that the success of hybrid defense like Trap-MID + NegLS is not merely owed to either of them but lies in their orthogonal strategies that (1) make it harder to extract private data and (2) provide misleading shortcuts. For instance, as shown in Table 2 of our paper and Table 4 of the attached file, this combination reduces LOMMA (KED-MI)'s attack accuracy to 42.47%, whereas either method alone achieves only 61.25% or 77.67%.

**Q4: While the runtime is still somewhat reasonable, it limits the approach to some extent**

We agree that computational efficiency is an important consideration, despite the effectiveness of Trap-MID. We will add this discussion to our Future Work section.

**Q5: Regarding the evaluation model, is the input size of the Face.evolve model really 224x224?**

We apologize for the mistake. The input size of the evaluation model is actually 112x112. The 64x64 images are indeed resized to fit the model's input size.
I thank the authors for providing additional details and experiments. Many of my remarks and weaknesses have been addresses. Yet, some weaknesses and questions remain:

1.) I still believe the evaluation metrics are limited, using only the evaluation model + the FID score (see my initial review). I also do not agree that the FID score actually complements the other two metrics, since it has no clear implication on privacy leakage. Why not using something like FaceNet also for the 64x64 experiments?
2.) "Since NegLS hadn't released their code..." -> I just checked, the authors refer to the code in their paper and the corresponding Github repo also seems to provide configurations for training models with negative LS. Yet, it seems like the authors implemented the defense by themselves, which should also be fine.
3.) The impact of Trap-MID in defending in the high-resolution setting against PPA seems limited. I agree that it offers a nice improvement over the negative LS defense, but on its own the defense seems rather weak.
4.) I also agree with Reviewer P6SC that the runtime is an important aspect. While the runtime is still somewhat reasonable, it limits the approach to some extent. 
5.) Regarding the evaluation model, is the input size of the Face.evolve model really 224x224? It seems somewhat strange that the evaluation model for the 64x64 setting requires an upscaling of factor 4 on the attack samples.

Overall, after reading all reviews and the corresponding rebuttals, I decided to keep my initial positive score.