跳连结构会增强模型反演攻击，论文提出新架构提升隐私防护能力。
On the Vulnerability of Skip Connections to Model Inversion Attacks
- 发现跳连结构加剧模型反演攻击，尤其末层影响最大。
- 提出的抗反演架构在实验中优于现有最先进防御方法。
- 新架构可与传统防御手段协同，适合注重数据隐私的部署场景。
跳连是现代深度神经网络（如CNN和ViT）的核心结构设计，虽显著提升性能，但本文首次揭示其对模型反演（MI）攻击存在隐私漏洞。研究发现：1）跳连会强化MI攻击，威胁训练数据隐私；2）末层跳连对攻击影响最为关键；3）现有推理时移除跳连的方法（如RepVGG）无法缓解该漏洞；4）基于此，首次提出抗反演架构设计。大量实验表明，所提架构无需复杂组件即可在隐私鲁棒性上超越当前最先进防御方法，且与现有防御手段具有互补性。项目主页：https://Pillowkoh.github.io/projects/RoLSS/
原文摘要 · Abstract (English)
Skip connections are fundamental architecture designs for modern deep neural networks (DNNs) such as CNNs and ViTs. While they help improve model performance significantly, we identify a vulnerability associated with skip connections to Model Inversion (MI) attacks, a type of privacy attack that aims to reconstruct private training data through abusive exploitation of a model. In this paper, as a pioneer work to understand how DNN architectures affect MI, we study the impact of skip connections on MI. We make the following discoveries: 1) Skip connections reinforce MI attacks and compromise data privacy. 2) Skip connections in the last stage are the most critical to attack. 3) RepVGG, an approach to remove skip connections in the inference-time architectures, could not mitigate the vulnerability to MI attacks. 4) Based on our findings, we propose MI-resilient architecture designs for the first time. Without bells and whistles, we show in extensive experiments that our MI-resilient architectures can outperform state-of-the-art (SOTA) defense methods in MI robustness. Furthermore, our MI-resilient architectures are complementary to existing MI defense methods. Our project is available at https://Pillowkoh.github.io/projects/RoLSS/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。