Black-Box Face Recovery from Identity Features

Razzhigaev, Anton; Kireev, Klim; Kaziakhmedov, Edgar; Tursynbek, Nurislam; Petiushko, Aleksandr

doi:10.1007/978-3-030-68238-5_34

Cited by 19 publications

(23 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We now discuss each of these and illustrate the feasibility of KD-based attacks. (1) Restricting Access to Training Data: While developers try their best to protect such IP assets, as discussed by [19], there can continue to be numerous reasons for concern: (i) The developers might have bought the data from a vendor who can potentially sell it to others; (ii) Intentionally or not, there is a distinct possibility for data leaks; (iii) Many datasets are either similar to or subsets of large-scale public datasets (ImageNet [32], BDD100k [38], so on), which can be effectively used as proxies; or (iv) Model inversion techniques can be used to recover training data from a pre-trained model [37,43,16,30,3] both in white-box and black box settings. Such methods [16], in fact, do not even require the soft outputs, just the hard predicted label from the model suffices.…”

Section: Feasibility Of Kd Based Stealingmentioning

confidence: 99%

Distilling the Undistillable: Learning from a Nasty Teacher

Jandial¹,

Khasbage²,

Pal³

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The inadvertent stealing of private/sensitive information using Knowledge Distillation (KD) has been getting significant attention recently and has guided subsequent defense efforts considering its critical nature. Recent work Nasty Teacher proposed to develop teachers which can not be distilled or imitated by models attacking it. However, the promise of confidentiality offered by a nasty teacher is not well studied, and as a further step to strengthen against such loopholes, we attempt to bypass its defense and steal (or extract) information in its presence successfully. Specifically, we analyze Nasty Teacher from two different directions and subsequently leverage them carefully to develop simple yet efficient methodologies, named as HTC and SCM, which increase the learning from Nasty Teacher by upto 68.63% on standard datasets. Additionally, we also explore an improvised defense method based on our insights of stealing. Our detailed set of experiments and ablations on diverse models/settings demonstrate the efficacy of our approach.

show abstract

Section: Feasibility Of Kd Based Stealingmentioning

confidence: 99%

Distilling the Undistillable: Learning from a Nasty Teacher

Jandial¹,

Khasbage²,

Pal³

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…One obvious threat to face feature vector privacy comes from so-called "feature vector reconstruction" (FVR) techniques. FVR transforms the feature vector v back into the image x [10], [11], [12], [13], [14]. Prior work on inverse biometrics has concluded that reconstruction alone is a severe attack [15], [16].…”

Section: Introductionmentioning

confidence: 99%

“…Parametric reconstruction methods rely on a reconstruction model R trained specifically to invert vectors produced by a model F [13], [10], [20]. Nonparametric reconstruction methods use an iterative optimization process R to reconstruct images from F 's feature vectors [14], [21].…”

Section: Introductionmentioning

confidence: 99%

Assessing Privacy Risks from Feature Vector Reconstruction Attacks

Wenger¹,

Falzon²,

Passananti³

et al. 2022

Preprint

View full text Add to dashboard Cite

In deep neural networks for facial recognition, feature vectors are numerical representations that capture the unique features of a given face. While it is known that a version of the original face can be recovered via "feature reconstruction," we lack an understanding of the end-to-end privacy risks produced by these attacks. In this work, we address this shortcoming by developing metrics that meaningfully capture the threat of reconstructed face images. Using end-to-end experiments and user studies, we show that reconstructed face images enable reidentification by both commercial facial recognition systems and humans, at a rate that is at worst, a factor of four times higher than randomized baselines. Our results confirm that feature vectors should be recognized as Personal Identifiable Information (PII) in order to protect user privacy.• We develop two concrete metrics -topK matching and visual matching -that assess the real-world privacy risk of FVR-enabled deanonymization attacks ( §III).• We evaluate the deanonymization success of four state-of-

show abstract

“…The synthesis is implemented as a gradient ascent algorithm. By contrast, existing blackbox attacks [2,20] are based on training an attack network that predicts the sensitive feature from the input confidence scores. Despite the exclusive focus on these two threat models, in practice, ML models are often packed into a blackbox that only produces hard-labels when being queried.…”

Section: Introductionmentioning

confidence: 99%

Label-Only Model Inversion Attacks via Boundary Repulsion

Kahla¹,

Chen²,

Anh³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent studies show that the state-of-the-art deep neural networks are vulnerable to model inversion attacks, in which access to a model is abused to reconstruct private training data of any given target class. Existing attacks rely on having access to either the complete target model (whitebox) or the model's soft-labels (blackbox). However, no prior work has been done in the harder but more practical scenario, in which the attacker only has access to the model's predicted label, without a confidence measure. In this paper, we introduce an algorithm, Boundary-Repelling Model Inversion (BREP-MI), to invert private training data using only the target model's predicted labels. The key idea of our algorithm is to evaluate the model's predicted labels over a sphere and then estimate the direction to reach the target class's centroid. Using the example of face recognition, we show that the images reconstructed by BREP-MI successfully reproduce the semantics of the private training data for various datasets and target model architectures. We compare BREP-MI with the state-of-the-art whitebox and blackbox model inversion attacks and the results show that despite assuming less knowledge about the target model, BREP-MI outperforms the blackbox attack and achieves comparable results to the whitebox attack.

show abstract

Black-Box Face Recovery from Identity Features

Cited by 19 publications

References 21 publications

Distilling the Undistillable: Learning from a Nasty Teacher

Distilling the Undistillable: Learning from a Nasty Teacher

Assessing Privacy Risks from Feature Vector Reconstruction Attacks

Label-Only Model Inversion Attacks via Boundary Repulsion

Contact Info

Product

Resources

About