用陷阱门误导模型倒推攻击，保护训练数据隐私。
Trap-MID: Trapdoor-based Defense against Model Inversion Attacks
- 在模型中嵌入陷阱门，诱导攻击者提取虚假触发器。
- 实验证明可有效防御多种倒推攻击，无需额外数据或算力。
- 适合关注深度学习隐私保护的研究者与开发者。
模型倒推（Model Inversion, MI）攻击能从训练好的深度神经网络中恢复出训练数据的分布，严重威胁模型隐私。现有防御方法多依赖正则化降低信息泄露，但对新型攻击仍显脆弱。本文提出基于陷阱门的防御机制（Trap-MID），在模型中嵌入特定触发器，当输入被注入该触发器时，模型会预测特定标签。此陷阱门信息成为倒推攻击的“捷径”，诱使攻击者提取陷阱触发器而非真实隐私数据。我们从理论上分析了陷阱门的有效性与自然性对欺骗攻击的影响。实验证明，Trap-MID在不需额外数据或显著计算开销的前提下，对多种MI攻击展现出当前最优的防御性能。代码已开源于 https://github.com/ntuaislab/Trap-MID。
原文摘要 · Abstract (English)
Model Inversion (MI) attacks pose a significant threat to the privacy of Deep Neural Networks by recovering training data distribution from well-trained models. While existing defenses often rely on regularization techniques to reduce information leakage, they remain vulnerable to recent attacks. In this paper, we propose the Trapdoor-based Model Inversion Defense (Trap-MID) to mislead MI attacks. A trapdoor is integrated into the model to predict a specific label when the input is injected with the corresponding trigger. Consequently, this trapdoor information serves as the "shortcut" for MI attacks, leading them to extract trapdoor triggers rather than private data. We provide theoretical insights into the impacts of trapdoor's effectiveness and naturalness on deceiving MI attacks. In addition, empirical experiments demonstrate the state-of-the-art defense performance of Trap-MID against various MI attacks without the requirements for extra data or large computational overhead. Our source code is publicly available at https://github.com/ntuaislab/Trap-MID.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。