PAIR: Privacy Attack Against Image Recognition With Sample Augmentation

ABSTRACT With the prevalence of image recognition applications, machine learning (ML) poses a severe privacy risk. Its private data can be stolen through a variety of privacy attacks. However, most of them typically need detailed prior knowledge of the intended ML model, such as its structure and parameters, which is unrealistic for usage in real‐world scenarios. To address this issue, a novel privacy attack approach against image recognition (PAIR) is proposed. Instead of involving numerous training examples, PAIR only considers small samples and utilizes a sample augmentation technique to create new instances with balanced attributes. Meanwhile, it also uses an upsampling interpolation method to resolve the high distortion issue of recovery images. In contrast, PAIR reduces reliance on the target model's architecture while still requiring certain prior knowledge, such as the model's input features and attack objectives. PAIR's performance is evaluated across a variety of settings and datasets. The experiments demonstrate that PAIR has performance benefits in image recovery and significantly outperforms representative privacy attacks. PAIR retains the attack effectiveness while reducing prior knowledge requirements, thereby enhancing the flexibility and applicability of the attack. In addition, dropout‐based and noise‐based defenses against privacy attacks are presented, and their performance is assessed.