首次系统研究视觉语言模型数据泄露风险，提出自适应加权攻击方法。
Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks
- 针对多模态模型特性设计分词与序列级反演策略。
- 通过动态加权增强关键语义词梯度，重建图像准确率达61.21%。
- 揭示公开模型存在隐私漏洞，适用于医疗金融等敏感场景研究。
模型反演（MI）攻击可从训练好的神经网络中重构私有训练数据，构成重大隐私风险。尽管已有研究主要关注单模态深度网络，但视觉语言模型（VLMs）的脆弱性仍鲜有探讨。本文首次系统研究VLMs的模型反演攻击，揭示其在泄露私有视觉训练数据方面的风险。我们提出两种创新方法：一是针对VLM的分词生成特性，设计分词与序列级反演策略；二是基于不同词元在视觉上的表征能力差异，提出序列级自适应词元加权反演（SMI-AW），动态调整各词元损失梯度权重，聚焦于视觉信息丰富的词元以更高效引导图像重建。在多个主流VLMs和数据集上开展大量实验与人工评估，结果显示攻击准确率达61.21%，证明了当前公开发布模型存在显著隐私泄露风险。本研究强调，在医疗、金融等敏感领域广泛应用VLMs前亟需部署隐私保护机制。代码与模型已开源：https://ngoc-nguyen-0.github.io/SMI_AW/
原文摘要 · Abstract (English)
Model inversion (MI) attacks pose significant privacy risks by reconstructing private training data from trained neural networks. While prior studies have primarily examined unimodal deep networks, the vulnerability of vision-language models (VLMs) remains largely unexplored. In this work, we present the first systematic study of MI attacks on VLMs to understand their susceptibility to leaking private visual training data. Our work makes two main contributions. First, tailored to the token-generative nature of VLMs, we introduce a suite of token-based and sequence-based model inversion strategies, providing a comprehensive analysis of VLMs' vulnerability under different attack formulations. Second, based on the observation that tokens vary in their visual grounding, and hence their gradients differ in informativeness for image reconstruction, we propose Sequence-based Model Inversion with Adaptive Token Weighting (SMI-AW) as a novel MI for VLMs. SMI-AW dynamically reweights each token's loss gradient according to its visual grounding, enabling the optimization to focus on visually informative tokens and more effectively guide the reconstruction of private images. Through extensive experiments and human evaluations on a range of state-of-the-art VLMs across multiple datasets, we show that VLMs are susceptible to training data leakage. Human evaluation of the reconstructed images yields an attack accuracy of 61.21%, underscoring the severity of these privacy risks. Notably, we demonstrate that publicly released VLMs are vulnerable to such attacks. Our study highlights the urgent need for privacy safeguards as VLMs become increasingly deployed in sensitive domains such as healthcare and finance. Our code and models are available at our project page: https://ngoc-nguyen-0.github.io/SMI_AW/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。