Reinforcement Learning-Based Black-Box Model Inversion Attacks
This work addresses privacy vulnerabilities in machine learning models, particularly for users concerned with data security, by advancing black-box attack capabilities, though it is incremental as it builds on existing GAN-based methods.
The paper tackles the problem of black-box model inversion attacks, which reconstruct private training data from machine learning models, by proposing a reinforcement learning-based method that formulates the attack as a Markov Decision Process and uses confidence scores for rewards, achieving state-of-the-art performance in recovering private information across various datasets and models.
Model inversion attacks are a type of privacy attack that reconstructs private data used to train a machine learning model, solely by accessing the model. Recently, white-box model inversion attacks leveraging Generative Adversarial Networks (GANs) to distill knowledge from public datasets have been receiving great attention because of their excellent attack performance. On the other hand, current black-box model inversion attacks that utilize GANs suffer from issues such as being unable to guarantee the completion of the attack process within a predetermined number of query accesses or achieve the same level of performance as white-box attacks. To overcome these limitations, we propose a reinforcement learning-based black-box model inversion attack. We formulate the latent space search as a Markov Decision Process (MDP) problem and solve it with reinforcement learning. Our method utilizes the confidence scores of the generated images to provide rewards to an agent. Finally, the private data can be reconstructed using the latent vectors found by the agent trained in the MDP. The experiment results on various datasets and models demonstrate that our attack successfully recovers the private information of the target model by achieving state-of-the-art attack performance. We emphasize the importance of studies on privacy-preserving machine learning by proposing a more advanced black-box model inversion attack.