Model inversion (MI) attacks aim to infer and reconstruct private training data by abusing access to a model. MI attacks have raised concerns about the leaking of sensitive information (e.g. private face images used in training a face recognition system). Recently, several algorithms for MI have been proposed to improve the attack performance. In this work, we revisit MI, study two fundamental issues pertaining to all state-of-the-art (SOTA) MI algorithms, and propose solutions to these issues which lead to a significant boost in attack performance for all SOTA MI. In particular, our contributions are two-fold: 1) We analyze the optimization objective of SOTA MI algorithms, argue that the objective is sub-optimal for achieving MI, and propose an improved optimization objective that boosts attack performance significantly. 2) We analyze "MI overfitting", show that it would prevent reconstructed images from learning semantics of training data, and propose a novel "model augmentation" idea to overcome this issue. Our proposed solutions are simple and improve all SOTA MI attack accuracy significantly. E.g., in the standard CelebA benchmark, our solutions improve accuracy by 11.8% and achieve for the first time over 90% attack accuracy. Our findings demonstrate that there is a clear risk of leaking sensitive information from deep learning models. We urge serious consideration to be given to the privacy implications. Our code, demo, and models are available at https://ngoc-nguyen-0.github.io/re-thinking_model_inversion_attacks/

翻译：模型反演攻击旨在通过滥用对模型的访问权限，推断并重建私有训练数据。这类攻击已引发对敏感信息泄露的担忧（例如用于训练人脸识别系统的私有面部图像）。近年来，研究人员提出了多种改进攻击性能的模型反演算法。本研究重新审视模型反演，探讨了所有最先进的模型反演算法中存在的两个基本问题，并针对这些问题提出了解决方案，从而显著提升了所有最新模型反演的攻击性能。具体贡献分为两点：1）我们分析了当前最先进模型反演算法的优化目标，指出该目标在实现模型反演时存在次优性，并提出了一种改进的优化目标，显著增强了攻击性能。2）我们分析了“模型反演过拟合”现象，证明其会阻碍重建图像学习训练数据的语义信息，并提出了一种新颖的“模型增强”理念来克服这一难题。我们提出的解决方案简洁有效，能够大幅提升所有最新模型反演的攻击准确率。例如，在标准CelebA基准测试中，我们的方案将准确率提升了11.8%，并首次实现了超过90%的攻击准确率。研究结果表明，深度学习模型存在明确的敏感信息泄露风险。我们强烈呼吁对隐私影响给予严肃考虑。相关代码、演示及模型已发布于https://ngoc-nguyen-0.github.io/re-thinking_model_inversion_attacks/