现有模型倒置攻击评估方法误报率高，新方法用多模态大模型提升隐私评估可靠性。
Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment
- 用多模态大模型替代传统评估方式，避免任务共享导致的虚假成功
- 实验证明旧方法存在极高假阳性率，部分结果仅为对抗性噪声
- 提出系统性设计原则，为机器学习隐私评估提供更可信标准
模型倒置攻击旨在通过访问目标模型来重构私有训练数据信息。几乎所有近期研究均采用标准评估框架：使用与目标模型相同数据集和任务设计的次级评估模型计算攻击准确率。本文首次深入分析该主流框架，揭示其根本缺陷：许多被认定为成功的重建结果实际上属于虚假阳性，未能捕捉目标个体的视觉身份。我们证明这些虚假阳性满足与Ⅰ型对抗样本相同的数学条件，并通过受控实验发现极高的假阳性可迁移性——这是对抗行为的典型特征，表明大量重建结果可能包含Ⅰ型对抗特征。这种对抗可迁移性显著夸大了报告的攻击准确率，导致对隐私泄露程度的严重高估。为此，本文第二项贡献是提出基于多模态大模型（MLLM）的新评估框架，其通用视觉推理能力规避了任务共享漏洞，有效降低当前框架中的Ⅰ型对抗可迁移性。我们提出系统性的MLLM评估设计原则，并在此框架下重新评估27种不同数据集、目标模型和先验条件下的模型倒置攻击设置，均发现传统方法存在一致的高假阳性率。结果呼吁重新审视模型倒置研究进展，并确立基于MLLM的评估为更可靠的机器学习系统隐私风险评估标准。代码、数据与提示语已公开于 https://hosytuyen.github.io/projects/FMLLM。
原文摘要 · Abstract (English)
Model Inversion attacks aim to reconstruct information from private training data by exploiting access to a target model. Nearly all recent MI studies evaluate attack success using a standard framework that computes attack accuracy through a secondary evaluation model trained on the same private data and task design as the target model. In this paper, we present the first in-depth analysis of this dominant evaluation framework and reveal a fundamental issue: many reconstructions deemed successful under the existing framework are in fact false positives that do not capture the visual identity of the target individual. We first show that these MI false positives satisfy the same formal conditions as Type I adversarial examples. Our controlled experiments, we demonstrate extremely high false-positive transferability, an empirical signature characteristic of adversarial behavior, indicating that many MI false positives likely contain Type I adversarial features. This adversarial transferability significantly inflates reported attack accuracy and leads to an overstatement of privacy leakage in existing MI work. To address this issue, as our second contribution, we introduce a new evaluation framework based on MLLMs, whose general-purpose visual reasoning avoids the shared-task vulnerability and reduces Type-I adversarial transferability of current evaluation framework. We propose systematic design principles for MLLM-based evaluation. Using this framework, we reassess 27 MI attack setups across diverse datasets, target models, and priors, and find consistently high false-positive rates under the conventional approach. Our results call for a reevaluation of progress in MI research and establish MLLM-based evaluation as a more reliable standard for assessing privacy risks in machine learning systems. Code/data/prompt are available at https://hosytuyen.github.io/projects/FMLLM
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。