Label-Only Model Inversion Attacks with Query-Free Training of Conditional Diffusion-Based Attack Model

As DNN-based AI models have rapidly developed, the risk of cyber-attacks against them has also increased. This paper focuses on Model Inversion Attacks (MIA), which is the attack to reveal a victim model’s training data by estimating input samples that causes the victim model to produce adversaries’ designated output. Modern MIA methods often tackle the task of Label-Only MIA, where a black-box image classification model is assumed as a victim model whose network structure and parameters are not disclosed to adversaries. A key technique for attacking such a model is to exploit an image generation model (called "attack model") trained by the adversaries’ own image set and its corresponding class label set provided by the victim model. However, to get the class label set, existing methods have to send a massive amount of images to the victim model as queries, which is highly suspicious behavior. To solve this unpracticality, we propose a Label-Only MIA method that requires no queries to train the attack model. The proposed method employs a Conditional Diffusion Model (CDM) as the attack model to obtain plausible attack results. Specifically, we first train an image feature extractor as an auxiliary module and use it to embed all images in the adversaries’ own dataset to a feature space. Then, we train a CDM-based attack model using a set of pairs of an image and its embedded feature. These training procedures are performed independently from the victim model. We experimentally confirmed that the proposed method achieves an attack performance comparable to white-box-oriented MIA methods, demonstrating that MIA risks are significant even for practical image classification models that are capable of blocking malicious users who send too many queries.