提出方法可从残差网络中间输出逆推用户输入数据，揭示推理时的数据泄露风险。
PEEL the Layers and Find Yourself: Revisiting Inference-time Data Leakage for Residual Neural Networks
- 设计分层逆向特征恢复算法，利用跳跃连接的特性逐层还原输入特征。
- 在人脸数据集上恢复效果优于现有方法一个数量级（MSE指标）。
- 适合关注模型隐私安全的研究者与实际部署中的防御设计者。
本文研究深度神经网络在推理阶段的数据泄露风险，即服务提供方仅凭模型输出就能恢复用户私有输入数据。针对计算机视觉中广泛使用的残差神经网络，我们假设其跳跃连接是导致数据泄露的主要原因。通过将推理时的数据泄露建模为约束优化问题，提出新型逆向特征重建方法PEEL，能有效从残差网络的中间输出中恢复各层输入特征。实验表明，残差块输出可视为输入的带噪版本，保留足够信息用于重建。在人脸图像数据集和预训练分类器上的实验验证了该方法的有效性：在均方误差（MSE）指标下，PEEL性能优于当前最优方法一个数量级。代码已开源。
原文摘要 · Abstract (English)
This paper explores inference-time data leakage risks of deep neural networks (NNs), where a curious and honest model service provider is interested in retrieving users' private data inputs solely based on the model inference results. Particularly, we revisit residual NNs due to their popularity in computer vision and our hypothesis that residual blocks are a primary cause of data leakage owing to the use of skip connections. By formulating inference-time data leakage as a constrained optimization problem, we propose a novel backward feature inversion method, \textbf{PEEL}, which can effectively recover block-wise input features from the intermediate output of residual NNs. The surprising results in high-quality input data recovery can be explained by the intuition that the output from these residual blocks can be considered as a noisy version of the input and thus the output retains sufficient information for input recovery. We demonstrate the effectiveness of our layer-by-layer feature inversion method on facial image datasets and pre-trained classifiers. Our results show that PEEL outperforms the state-of-the-art recovery methods by an order of magnitude when evaluated by mean squared error (MSE). The code is available at \href{https://github.com/Huzaifa-Arif/PEEL}{https://github.com/Huzaifa-Arif/PEEL}
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。