Model inversion (MI) attacks aim to reveal sensitive information in training datasets by solely accessing model weights. Generative MI attacks, a prominent strand in this field, utilize auxiliary datasets to recreate target data attributes, restricting the images to remain photo-realistic, but their success often depends on the similarity between auxiliary and target datasets. If the distributions are dissimilar, existing MI attack attempts frequently fail, yielding unrealistic or target-unrelated results. In response to these challenges, we introduce a groundbreaking approach named Patch-MI, inspired by jigsaw puzzle assembly. To this end, we build upon a new probabilistic interpretation of MI attacks, employing a generative adversarial network (GAN)-like framework with a patch-based discriminator. This approach allows the synthesis of images that are similar to the target dataset distribution, even in cases of dissimilar auxiliary dataset distribution. Moreover, we artfully employ a random transformation block, a sophisticated maneuver that crafts generalized images, thus enhancing the efficacy of the target classifier. Our numerical and graphical findings demonstrate that Patch-MI surpasses existing generative MI methods in terms of accuracy, marking significant advancements while preserving comparable statistical dataset quality. For reproducibility of our results, we make our source code publicly available in https://github.com/jonggyujang0123/Patch-Attack.

翻译：摘要：模型反演攻击旨在仅通过访问模型权重来揭示训练数据集中的敏感信息。生成式模型反演攻击作为该领域的重要分支，利用辅助数据集重建目标数据属性，同时确保生成图像保持真实感，但其成功往往依赖于辅助数据集与目标数据集之间的相似性。若两者分布存在差异，现有模型反演攻击方法常会失效，产生不真实或与目标无关的结果。针对这一挑战，我们提出了一种受拼图组装启发的突破性方法——Patch-MI。为此，我们基于模型反演攻击的新概率解释，采用类似生成对抗网络的框架并引入基于补丁的判别器。该方法即使面对辅助数据集分布与目标数据集分布存在差异的情况，仍能合成与目标数据集分布相似的图像。此外，我们巧妙运用随机变换模块这一精密策略来生成泛化图像，从而提升目标分类器的效能。数值与图形结果表明，Patch-MI在准确性上超越了现有生成式模型反演方法，同时在统计数据集质量上保持可比性，实现了显著进展。为便于结果复现，我们将源代码公开于https://github.com/jonggyujang0123/Patch-Attack。