Model inversion attacks (MIAs) are aimed at recovering private data from a target model's training set, which poses a threat to the privacy of deep learning models. MIAs primarily focus on the white-box scenario where the attacker has full access to the structure and parameters of the target model. However, practical applications are black-box, it is not easy for adversaries to obtain model-related parameters, and various models only output predicted labels. Existing black-box MIAs primarily focused on designing the optimization strategy, and the generative model is only migrated from the GAN used in white-box MIA. Our research is the pioneering study of feasible attack models in label-only black-box scenarios, to the best of our knowledge. In this paper, we develop a novel method of MIA using the conditional diffusion model to recover the precise sample of the target without any extra optimization, as long as the target model outputs the label. Two primary techniques are introduced to execute the attack. Firstly, select an auxiliary dataset that is relevant to the target model task, and the labels predicted by the target model are used as conditions to guide the training process. Secondly, target labels and random standard normally distributed noise are input into the trained conditional diffusion model, generating target samples with pre-defined guidance strength. We then filter out the most robust and representative samples. Furthermore, we propose for the first time to use Learned Perceptual Image Patch Similarity (LPIPS) as one of the evaluation metrics for MIA, with systematic quantitative and qualitative evaluation in terms of attack accuracy, realism, and similarity. Experimental results show that this method can generate similar and accurate data to the target without optimization and outperforms generators of previous approaches in the label-only scenario.

翻译：模型逆向攻击旨在从目标模型的训练集中恢复隐私数据，对深度学习模型的隐私构成威胁。现有研究主要关注白盒场景，即攻击者完全掌握目标模型的结构与参数。然而实际应用中多为黑盒场景，攻击者难以获取模型相关参数，且众多模型仅输出预测标签。现有黑盒模型逆向攻击主要聚焦于优化策略设计，其生成模型仅从白盒模型逆向攻击中使用的生成对抗网络迁移而来。据我们所知，本研究首次探索了仅标签黑盒场景下可行的攻击模型。本文提出一种基于条件扩散模型的模型逆向攻击新方法，只要目标模型输出标签，无需额外优化即可恢复目标的精确样本。我们引入两项核心技术实施该攻击：首先，选取与目标模型任务相关的辅助数据集，以目标模型预测的标签作为条件指导训练过程；其次，将目标标签和标准正态分布随机噪声输入训练好的条件扩散模型，在预设指导强度下生成目标样本，并筛选出最具鲁棒性和代表性的样本。此外，我们首次提出将学习感知图像块相似度作为模型逆向攻击的评估指标之一，从攻击精度、真实性和相似性三个维度进行系统性的定量与定性评估。实验结果表明，该方法无需优化即可生成与目标相似且精确的数据，在仅标签场景下的性能优于先前方法中的生成器。