用反向生成重建模型训练数据，揭示模型共享的隐私漏洞
Network Inversion for Training-Like Data Reconstruction
- 用单个条件生成器逆推分类器输入空间，还原各类别训练图像
- 在多个视觉数据集上成功重建类训练数据，证明模型共享存在泄露风险
- 适合关注机器学习隐私安全的研究者和从业者
机器学习模型通常在私有数据上训练，虽不共享数据，但公开模型权重常被视为隐私保护。本文提出基于网络反演的训练类似数据重建方法（TLDR），通过一个条件生成器学习分类器中不同类别的输入空间。针对传统反演生成随机图像的问题，我们利用分类器对训练数据的特性及图像先验知识，引导生成器输出类训练数据。在多个标准视觉分类数据集上进行实证评估，结果表明从模型权重可重建出与训练数据高度相似的内容，凸显了模型共享带来的潜在隐私风险。
原文摘要 · Abstract (English)
Machine Learning models are often trained on proprietary and private data that cannot be shared, though the trained models themselves are distributed openly assuming that sharing model weights is privacy preserving, as training data is not expected to be inferred from the model weights. In this paper, we present Training-Like Data Reconstruction (TLDR), a network inversion-based approach to reconstruct training-like data from trained models. To begin with, we introduce a comprehensive network inversion technique that learns the input space corresponding to different classes in the classifier using a single conditioned generator. While inversion may typically return random and arbitrary input images for a given output label, we modify the inversion process to incentivize the generator to reconstruct training-like data by exploiting key properties of the classifier with respect to the training data along with some prior knowledge about the images. To validate our approach, we conduct empirical evaluations on multiple standard vision classification datasets, thereby highlighting the potential privacy risks involved in sharing machine learning models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。