Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment

Understand

Model inversion (MI) attack reconstructs the private training data of a target model given its output, posing a significant threat to deep learning models and data privacy.

• On one hand, most of existing MI methods focus on searching for latent codes to represent the target identity, yet this iterative optimization-based scheme consumes a huge number of queries to the target model, making it unrealistic especially in black-box scenario.
• On the other hand, some training-based methods launch an attack through a single forward inference, whereas failing to directly learn high-level mappings from prediction vectors to images.
• Addressing these limitations, we propose a novel Prediction-to-Image (P2I) method for black-box MI attack.