Re-thinking Model Inversion Attacks Against Deep Neural Networks
Model inversion (MI) attacks aim to infer and reconstruct private training
data by abusing access to a model. MI attacks have raised concerns about the
leaking of sensitive information (e.g. private face images used in training a
face recognition system). Recently, several algorithms for MI have been
proposed to improve the attack performance. In this work, we revisit MI, study
two fundamental issues pertaining to all state-of-the-art (SOTA) MI algorithms,
and propose solutions to these issues which lead to a significant boost in
attack performance for all SOTA MI. In particular, our contributions are
two-fold: 1) We analyze the optimization objective of SOTA MI algorithms, argue
that the objective is sub-optimal for achieving MI, and propose an improved
optimization objective that boosts attack performance significantly. 2) We
analyze "MI overfitting", show that it would prevent reconstructed images from
learning semantics of training data, and propose a novel "model augmentation"
idea to overcome this issue. Our proposed solutions are simple and improve all
SOTA MI attack accuracy significantly. E.g., in the standard CelebA benchmark,
our solutions improve accuracy by 11.8% and achieve for the first time over 90%
attack accuracy. Our findings demonstrate that there is a clear risk of leaking
sensitive information from deep learning models. We urge serious consideration
to be given to the privacy implications. Our code, demo, and models are
available at
https://ngoc-nguyen-0.github.io/re-thinking_model_inversion_attacks/
Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, Ngai-Man Cheung
# Re-thinking Model Inversion Attacks Against Deep Neural Networks

###### Abstract

Model inversion (MI) attacks aim to infer and reconstruct private training data by abusing access to a model. MI attacks have raised concerns about the leaking of sensitive information (e.g. private face images used in training a face recognition system). Recently, several algorithms for MI have been proposed to improve the attack performance. In this work, we revisit MI, study two fundamental issues **pertaining to all state-of-the-art (SOTA) MI algorithms**, and propose solutions to these issues which lead to a significant boost in attack performance for all SOTA MI. In particular, our contributions are two-fold: 1) We analyze the optimization objective of SOTA MI algorithms, argue that the objective is sub-optimal for achieving MI, and propose an improved optimization objective that boosts attack performance significantly. 2) We analyze "MI overfitting", show that it would prevent reconstructed images from learning semantics of training data, and propose a novel "model augmentation" idea to overcome this issue. Our proposed solutions are simple and improve all SOTA MI attack accuracy significantly. E.g., in the standard CelebA benchmark, our solutions improve accuracy by **11.8%** and achieve for the first time over 90% attack accuracy. **Our findings demonstrate that there is a clear risk of leaking sensitive information from deep learning models**. We urge serious consideration to be given to the privacy implications. Our code, demo, and models are available at [https://ngoc-nguyen-0.github.io/re-thinking_model_inversion_attacks/](https://ngoc-nguyen-0.github.io/re-thinking_model_inversion_attacks/).

## 1 Introduction

Privacy of deep neural networks (DNNs) has attracted considerable attention recently [2, 3, 31, 41, 42]. Today, DNNs are being applied in many domains involving private and sensitive datasets, e.g., healthcare, and security. There is a growing concern of privacy attacks to gain knowledge of confidential datasets used in training DNNs. One important category of privacy attacks is Model Inversion (MI) [7, 10, 13, 14, 22, 47, 49, 52, 53] (Fig. 1). Given access to a model, MI attacks aim to infer and reconstruct features of the private dataset used in the training of the model. For example, a malicious user may attack a face recognition system to reconstruct sensitive face images used in training. Similar to previous work [7, 47, 52], we will use face recognition models as the running example.

**Related Work.** MI attacks were first introduced in [14], where simple linear regression is the target of attack. Recently, there is a fair amount of interest to extend MI to complex DNNs. Most of these attacks [7, 47, 52] focus on the _whitebox_ setting and the attacker is assumed to have complete knowledge of the model subject to attack. As many platforms provide downloading of entire trained DNNs for users [7, 52], whitebox attacks are important. [52] proposes Generative Model Inversion (GMI) attack, where generic public information is leveraged to learn a distributional prior via generative adversarial networks (GANs) [15, 45], and this prior is used to guide reconstruction of private training samples. [7] proposes Knowledge-Enriched Distributional Model Inversion (KEDMI), where an inversion-specific GAN is trained by leveraging knowledge provided by the target model. [47] proposes Variational Model Inversion (VMI), where a probabilistic interpretation of MI leads to a variational objective for the attack. KEDMI and VMI achieve SOTA attack performance (See Supplementary E for further discussion of related work).

**In this paper**, we revisit SOTA MI, study two issues pertaining to all SOTA MI and propose solutions to these issues that are complementary and applicable to all SOTA MI (Fig. 1). In particular, despite the range of approaches proposed in recent works, common and central to all these approaches is an _inversion step_ which formulates reconstruction of training samples as an optimization. The optimization objective in the inversion step involves the _identity loss_, which is the _same_ for all SOTA MI and is formulated as the negative log-likelihood for the reconstructed samples under the model being attacked. While ideas have been proposed to advance other aspects of MI, _effective design of the identity loss has not been studied_.
To address this research gap, our work studies subtleties of identity loss in all SOTA MI, analyzes the issues and proposes improvements that boost the performance of all SOTA significantly. In summary, our contributions are as follows:

* We analyze existing identity loss, argue that it could be sub-optimal for MI, and propose an improved identity loss that aligns better with the goal of MI (Fig. 1 2).
* We formalize the concept of _MI overfitting_, analyze its impact on MI and propose a novel solution based on _model augmentation_. Our idea is inspired by the conventional issue of overfitting in model training and data augmentation as a solution to alleviate the issue (Fig. 1 3).
* We conduct extensive experiments to demonstrate that our solutions can improve SOTA MI algorithms (GMI [52], KEDMI [7], VMI [47]) significantly. Our solutions achieve for the first time over 90% attack accuracy under standard CelebA benchmark (Fig. 1 4).

Our work sounds alarm over the rising threats of MI attacks, and urges more attention on measures against the leaking of private information from DNNs.

## 2 General Framework of SOTA MI Attacks

**Problem Setup.** In MI, an attacker abuses access to a model \(M\) trained on a private dataset \(\mathcal{D}_{priv}\). The attacker can access \(M\), but \(\mathcal{D}_{priv}\) is not intended to be shared. The goal of MI is to infer information about private samples in \(\mathcal{D}_{priv}\). In existing work, for the desired class (label) \(y\)

Figure 1: _Overview and our contributions._**1** We consider the problem of the Model Inversion (MI) attack to reconstruct private training data based on model parameters. Our work makes two foundational contributions to MI attacks. 2 First, we analyse the optimization objective of existing SOTA MI algorithms and show that they are sub-optimal. Further, we propose an improved optimization objective that boosts MI attack performance significantly (Sec 3.1). 3 Second, we formalize the concept of “MI overfitting” showing that it prevents reconstructed images from learning identity semantics of training data. Further, we propose a novel “model augmentation” idea to overcome this issue (Sec 3.2). 4 Our proposed method significantly boosts MI attack accuracy. _E.g._ In the standard CelebA benchmark, our method boosts attack accuracy by _11.8%, achieving above 90% attack accuracy for the first time in contemporary MI literature_.
MI is formulated as the reconstruction of an input \(\mathbf{x}\) which is most likely classified into \(y\) by the model \(M\). For instance, if the problem involves inverting a facial recognition model, given the desired identity, MI is formulated as the reconstruction of facial images that are most likely to be recognized as the desired identity. The model subject to MI attacks is called _target model_. Following previous works [7, 47, 52], we focus on _whitebox_ MI attack, where the attacker is assumed to have complete access to the target model. For high-dimensional data such as facial images, this reconstruction problem is ill-posed. Consequently, various SOTA MI methods have been proposed recently to constrain the search space to the manifold of meaningful and relevant images using a GAN: using a GAN trained on some public dataset \(\mathcal{D}_{pub}\)[52], using an inversion-specific GAN [7], and defining variational inference in latent space of GAN [47].

Despite the differences in various SOTA MI, common and central to all these methods is an _inversion step_ -called _secret revelation_ in [52]-, which performs the following optimization:

\[q^{*}(\mathbf{z})=\arg\min_{q(\mathbf{z})}\mathbb{E}_{\mathbf{z}\sim q( \mathbf{z})}\{L_{id}(\mathbf{z};y,M)+\lambda L_{prior}(\mathbf{z})\} \tag{1}\]

Here \(L_{id}(\mathbf{z};y,M)=-\log\mathbb{P}_{M}(y|G(\mathbf{z}))\) is referred to as _identity loss_ in MI [52], which guides the reconstruction of \(\mathbf{x}=G(\mathbf{z})\) that is most likely to be recognized by model \(M\) as identity \(y\), and \(L_{prior}\) is some prior loss, and \(q^{*}(\mathbf{z})\) is the optimal distribution of latent code used to generate inverted samples by GAN (\(\mathbf{x}=G(\mathbf{z})\); \(\mathbf{z}\sim q^{*}(\mathbf{z})\)). Importantly, all SOTA MI methods use the _same_ identity loss \(L_{id}(\mathbf{z};y,M)\), although they have different assumption about \(q(\mathbf{z})\) and the prior loss \(L_{prior}\) (see Table 1 and Supplementary for more details on each algorithm). While advances observed by improving \(q(\mathbf{z})\) and \(L_{prior}\), _the design of more effective \(L_{id}\) has been left unnoticed_ in all SOTA MI algorithms. Therefore, our work instead focuses on \(L_{id}\), analyzes issues, and proposes improvement for \(L_{id}\) that can lead to a performance boost in all SOTA MI. To simplify notations, we denote \(L_{id}(\mathbf{z};y,M)\) by \(L_{id}(\mathbf{x};y)\) when appropriate, where \(\mathbf{x}=G(\mathbf{z})\) is the reconstructed image.

## 3 A Closer Look at Model Inversion Attacks

### An Improved Formulation of MI Identity Loss

In this section, we discuss our first contribution and take a closer look at the optimization objective of _identity loss_, \(L_{id}(\mathbf{x};y)\). Existing SOTA MI methods, namely GMI [52], KEDMI [7] and VMI [47] formulate the identity loss as an optimization to minimize the negative log likelihood of an identity under model parameters (cross-entropy loss). Particularly, the \(L_{id}(\mathbf{x};y)\) introduced in Eqn. 1 for an inversion targeting class \(k\) can be re-written as follows:

\[L_{id}(\mathbf{x};y=k)=-\log\frac{\exp(\mathbf{p}^{T}\mathbf{w}_{k})}{\exp( \mathbf{p}^{T}\mathbf{w}_{k})+\sum_{j=1,j\neq k}^{N}\exp(\mathbf{p}^{T} \mathbf{w}_{j})} \tag{2}\]

where \(\mathbf{p}\) refers to penultimate layer activations [6, 35] for sample \(\mathbf{x}\) and \(\mathbf{w}_{i}\) refers to the last layer weights for the \(i^{th}\) class 1in target model \(M\).

Footnote 1: \(\mathbf{p}\) is concatenated with 1 at the end to include bias as \(\mathbf{w}_{i}\) includes biases at the end.

**Existing identity loss (Eqn. 2) used in SOTA MI methods [7, 47, 52] is sub-optimal for MI** (Fig. 1 ). Although the optimization in Eqn. 2 accurately captures the essence of a classification problem (face recognition), we postulate that such formulation is sub-optimal for MI. We provide our intuition through the lens of penultimate layer activations, \(\mathbf{p}\) (Fig. 1 ). In a classification setting, the main expectation for \(\mathbf{p}\) is to be sufficiently discriminative for class \(k\) (recognize between 'Peter', 'Simon' and 'David'). This objective can be achieved by both maximizing \(\exp(\mathbf{p}^{T}\mathbf{w}_{k})\) and/or minimizing \(\sum_{j=1,j\neq k}^{N}\exp(\mathbf{p}^{T}\mathbf{w}_{j})\) in Eqn. 2. On the contrary, _the goal of MI is to reconstruct training data_. That is, in addition to \(\mathbf{p}\) being sufficiently discriminative for class \(k\), successful inversion also requires \(\mathbf{p}\) to be close to the training data representations for class \(k\) represented by \(\mathbf{w}_{k}\) (an inversion targeting 'Simon' needs to reconstruct a sample close to the private training data of 'Simon'; Fig. 1 ). Specifically, we argue that MI requires a lot more attention on maximizing \(\exp(\mathbf{p}^{T}\mathbf{w}_{k})\) compared to minimizing \(\sum_{j=1,j\neq k}^{N}\exp(\mathbf{p}^{T}\mathbf{w}_{j})\) in Eqn. 2.

Motivated by this hypothesis, we conduct an analysis to investigate the proximity between private training data and reconstructed data in SOTA MI methods using penultimate layer representations [6, 34, 35, 39]. Particularly, our analysis using KEDMI [7] (SOTA) shows several instances where using Eqn. 2 for identity loss is unable to reconstruct data close to the private training data. We show this in Fig. 2 (top row). Consequently, our analysis motivates the search for an improved identity loss focusing on maximizing \(\exp(\mathbf{p}^{T}\mathbf{w}_{k})\) for MI.

\begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **Latent distribution \(q(\mathbf{z})\)** & **Prior loss \(L_{prior}\)** \\ \hline GMI [52] & Point estimate \(\delta(\mathbf{z}-\mathbf{z}_{0})\) & \(-D(G(\mathbf{z}))\) \\ \hline KEDMI [7] & Gaussian \(\mathcal{N}(\boldsymbol{\mu},\mathbf{\Sigma})\) & \(-\log D(G(\mathbf{z}))\) \\ \hline VMI [47] & Gaussian \(\mathcal{N}(\boldsymbol{\mu},\mathbf{\Sigma})\)_or_ Normalizing Flow [26] & Distance _w.r.t._ GAN prior \(D_{\text{K}}(q(\mathbf{z})||p_{\text{gan}}(\mathbf{z}))\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Categorizing SOTA MI attacks based on their difference in latent code distribution and prior loss. \(p_{\text{gan}}(\mathbf{z})\) is a GAN prior. \(G\) and \(D\) are generator and discriminator of a GAN.
**Logit Maximization as an improved MI identity loss.** In light of our analysis / observations above, we propose to directly maximize the logit, \(\textbf{p}^{T}\textbf{w}_{k}\), instead of maximizing the log likelihood of class \(k\) for MI. Our proposed identity loss objective is shown below:

\[L_{id}^{logit}(\textbf{x};y=k)=-\textbf{p}^{T}\textbf{w}_{k}+\lambda||\textbf{ p}-\textbf{p}_{reg}||_{2}^{2} \tag{3}\]

where \(\lambda(>0)\) is a hyper-parameter and \(\textbf{p}_{reg}\) is used for regularizing **p**. Particularly, if the regularization in Eqn. 3 is omitted and hence \(||\textbf{p}||\) is unbounded, a crude simplified way to solve Eqn. 3 is to maximize \(||\textbf{p}||\). Hence, we use \(\textbf{p}_{reg}\) to regularize **p**. Given that the attacker has no access to private training data, we estimate \(\textbf{p}_{reg}\) by a simple method using _public_ data (See Supplementary C.3). We remark that \(\textbf{p}=M^{\texttt{pen}}(\textbf{x})\) where \(\textbf{x}=G(\textbf{z})\) and \(M^{\texttt{pen}}()\) operator returns the penultimate layer representations for a given input.

Our analysis shows that our proposed identity loss, \(L_{id}^{logit}\) (Eqn. 3), can significantly improve reconstruction of private training data compared to existing identity loss used in SOTA MI algorithms [7, 47, 52]. This can be clearly observed using both penultimate layer representations and KNN distances in Fig. 2 (bottom row). Here KNN Dist refers to the shortest Euclidean feature distance from a reconstructed image to private training images for a given identity [7, 52]. Our proposed \(L_{id}^{logit}\) can be easily plugged in to all existing SOTA MI algorithms by replacing \(L_{id}\) with our proposed \(L_{id}^{logit}\) in Eqn. 1 (in the inversion step) with minimal computational overhead.

### Overcoming MI Overfitting in SOTA methods

In this section, we discuss our second contribution. In particular, we formalize a concept of _MI overfitting_, observe its considerable impacts even in SOTA MI methods [7, 47, 52], and propose a new, simple solution to overcome this issue (Fig. 1 3). To better discuss our MI overfitting concept, we first review the conventional concept of overfitting in machine learning: Given the fixed training dataset and our goal of learning a model, conventionally, overfitting is defined as instances which during model learning (training stage), the model fits too closely to the training data and adapts to the random variation and noise of training data, failing to adequately learn the semantics of the train

Figure 2: Visualization of the penultimate layer representations (\(\mathcal{D}_{priv}\) = CelebA [33], \(\mathcal{D}_{pub}\) = CelebA [33], Target Model = IR152 [7], Evaluation Model = face.evoLve [8], Inversion iterations = 2400) for private training data and reconstructed data using KEDMI [7]. Following the exact evaluation protocol in [7], we use face.evoLve [8] to extract representations. We show results for 3 randomly chosen identities. We include KNN distance (for different iterations) and final attack accuracy following the protocol in [7]. For each identity, we also include randomly selected private training data and the closest reconstructed sample at iteration=2400. **D Identity loss in SOTA MI methods [7, 47, 52] (Eqn. 2) is sub-optimal for MI (Top).** Using penultimate representations during inversion, we observe 2 instances (_e.g_ target identity 57 and 143) where KEDMI [7] (using Eqn. 2 for identity loss) is unable to reconstruct data close to private training data. Hence, private and reconstructed facial images are qualitatively different. **Q Our proposed identity loss, \(L_{id}^{logit}\) (Eqn. 3), can effectively guide the reconstruction of data close to private training data (Bottom)**. This can be clearly observed using both penultimate layer representations and KNN distances for all 3 target classes 57, 143 and 252. We show similar results using additional MI algorithms (GMI [52], VMI [47]) and target classifiers (face.evoLve, VGG16) in Supplementary Figures D.2, D.5 and D.8. Best viewed in color.
ing data [1, 38, 44, 50, 54]. As the model lacks semantics of training data, it could be observed that the model performs poorly under unseen data (Fig. 1 3 4 3).

Analysis.In what follows, we discuss our analysis to demonstrate MI overfitting and understand its impact in SOTA. See Fig. 3 for analysis setups and results. In particular, in Fig. 3 1, we show some reconstructed samples which achieve low identity loss under the target model \(M\), yet they lack identity semantics. In Fig. 3 2, we show that for a considerable percentage of reconstructed samples from target model \(M\) with low identity loss under \(M\), their identity loss under another unseen model \(M^{\prime}\) is large as shown in the scatter plot and histograms, hinting that these samples might have suffered from MI overfitting and lack identity semantics. We note that the identity loss under \(M^{\prime}\) is obtained by feeding the reconstructed sample into \(M^{\prime}\) in a forward pass. We also note that SOTA KEDMI [7] is used in this analysis but the issue persists in [47, 52].

Our proposed solution to MI overfitting.We propose a novel solution based on _model augmentation_. Our idea is inspired by the conventional issue of overfitting in model training and data augmentation as a solution to alleviate the issue. In particular, for conventional overfitting, augmenting the training dataset could alleviate the issue [29]. Therefore, we hypothesize that by augmenting the target model we can alleviate MI overfitting.

Specifically, we propose to apply knowledge distillation (KD) [19], with target model \(M_{t}\) as the teacher, to train augmented models \(M_{aug}^{(i)}\). Importantly, as we do not have access to the private data, during KD, each \(M_{aug}^{(i)}\) is trained on the _public dataset_ to match its output to the output of \(M_{t}\). We select different network architectures for \(M_{aug}^{(i)}\) and they are different from \(M_{t}\) (Detailed discussion in the Supplementary B.1 and B.2). After performing KD, we apply \(M_{aug}^{(i)}\) together with the target model \(M_{t}\) in the inversion step and compute the identity loss (with model augmentation):

\[\begin{split} L_{id}^{aug}(\mathbf{x};y)&=\gamma_{t }\cdot L_{id}(\mathbf{x};y,M_{t})\\ &+\gamma_{aug}\cdot\sum_{i=1}^{N_{aug}}L_{id}(\mathbf{x};y,M_{ aug}^{(i)})\end{split} \tag{4}\]

Here, \(\gamma_{t}\) and \(\gamma_{aug}\) are two hyper-parameters. In particular, we use \(\gamma_{t}=\gamma_{aug}=\frac{1}{N_{aug}+1}\), where \(N_{aug}\) is the number of augmented models. \(L_{id}^{aug}\) in Eqn. 4 is used to replace \(L_{id}\) in the inversion step in Eqn. 1. Furthermore, our proposed \(L_{id}^{logit}\) in Eqn. 3 can be used in Eqn. 4 to combine the improvements. See details in Supplementary C.1.

In Fig. 3 3, we analyze the performance of \(M_{aug}^{(i)}\). Similar to using the unseen model \(M^{\prime}\), we observe samples with large identity loss under \(M_{aug}^{(i)}\), suggesting that samples with MI overfitting perform poorly under \(M_{aug}^{(i)}\) as these samples lack identity semantic.

Figure 3: Qualitative / Quantitative studies to demonstrate MI overfitting in SOTA methods. We demonstrate this observation using KEDMI [7]. We use \(\mathcal{D}_{priv}\) = CelebA [33], \(\mathcal{D}_{pub}\) = CelebA [33] and \(M\) = IR152 [7]. 1 We show qualitative results to illustrate MI overfitting. We show 6 identities, top: private data, bottom: reconstructed data from \(M\). The reconstructed samples have fit too closely to \(M\) during inversion resulting in samples with lack of identity semantics. Particularly, we remark that these samples have very low identity loss under the target model \(M\). 2 **Quantitative results validating the prevalence of MI overfitting in SOTA MI methods.** We use an additional target classifier \(M^{\prime}\) = VGG16 released by [7, 52] to quantitatively verify the presence of MI overfitting using identity loss. For 1,500 reconstructed samples from \(M\), we visualize their identity loss w.r.t. \(M\) and \(M^{\prime}\) in the scatter plot and respective histograms. Particularly, we find that there are 26.7% of samples with low identity loss under the target model \(M\), but large identity loss under unseen VGG16 model \(M^{\prime}\), hinting that these samples might lack identity semantics. This result shows that MI overfitting is a considerable issue even in SOTA MI methods. Note that VGG16 is used here only for analysis and is not part of our solution, as private data is not available. 3 **Model Augmentation to alleviate MI overfitting during inversion.** We repeat the above analysis, with \(M^{\prime}\) = VGG16 replaced by \(M_{aug}\) = EfficientNet-B0. Importantly, \(M_{aug}\) is trained by _public data using knowledge distillation_[19]. We similarly observe samples with large identity loss under \(M_{aug}\).
## 4 Experiments

In this section, we evaluate the performance of the proposed method in recovering a representative input from the target model, against current SOTA methods: GMI [52], VMI [47], and KEDMI [7]. More specifically, as our proposed method identifies two major limitations in current \(L_{id}(\mathbf{x};y)\) -used commonly in all SOTA MI approaches- we will evaluate the improvement brought by our improved identity loss \(L_{id}^{logit}\), and model augmentation \(L_{id}^{aug}\) for all SOTA MI approaches.

### Experimental Setup

In order to have a fair comparison, when evaluating our method against each SOTA MI approach, we follow the exactly same experimental setup of that approach. In what follows, we discuss the details of these setups.

**Dataset.** Following previous works, we evaluate the proposed method on different tasks: face recognition and digit classification is used for comparison with all three SOTA approaches, and image classification is used for comparison with GMI [52], and KEDMI [7]. For the face recognition task, we use CelebA dataset [33] that includes celebrity images, and the FFHQ dataset [24] which contains images with larger variation in terms of background, ethnicity, and age. The MNIST handwritten digits dataset [30] is used for digit classification. We utilize the CIFAR-10 dataset [28] for image classification.

**Data Preparation Protocol.** Following previous SOTA approaches [7, 47, 52], we split each dataset into two disjoint parts: one part is used as private dataset \(\mathcal{D}_{priv}\) for training target model, and another part is used as a public dataset \(\mathcal{D}_{pub}\) to extract the prior information. Most importantly, _throughout all experiments, public dataset \(\mathcal{D}_{pub}\) has no class intersection with private dataset \(\mathcal{D}_{priv}\) used for training target model_. Note that this is essential to make sure that adversary uses \(\mathcal{D}_{pub}\) only to gain prior knowledge about features that are general to that task (i.e., face recognition), and does not have access to information about class-specific and private information used for training target model.

**Models.** Following previous works, we implement several different models with varied complexities. As GMI [52] and KEDMI [7] use exactly similar model architecture in experiments, for comparison with these two algorithms, we use the same models. More specifically, for face recognition on CelebA and FFHQ, we use VGG16 [40], IR152 [17], and face.evoLve [9]-as SOTA face recognition model. For digit classification on MNIST, we use a CNN with 3 convolutional layers and 2 pooling layers. Finally, for image classification, following [7] we use VGG16 [40]. For a fair comparison with VMI, we follow its design in [47] and use ResNet-34 for face recognition CelebA, and ResNet-10 for digit classification on MNIST. The details of the target models, augmented models and datasets used in experiments are summarized in Table 2. We remark that when comparing our proposed method with each of the SOTA MI approaches, we use exactly the same target model and GAN for both SOTA and our approach.

**Evaluation Metrics.** To evaluate the performance of a MI attack, we need to assess whether the reconstructed image exposes private information about a target label/identity. In this work, following the literature, we conduct both qualitative evaluations by visual inspection, and quantitative evaluations using different metrics, including:

* **Attack Accuracy (Attack Acc).** Following [7, 47, 52], we use an _evaluation model_ that predicts the label/identity of the reconstructed image. Similar to previous works, the evaluation model is different from the target model (different structure/ initialization seed), but it is trained on the same private dataset (see Table 2). Intuitively, considering a highly accurate evaluation model, it can be viewed as a proxy for human inspection [52]. Therefore, if the evaluation model infers high accuracy on reconstructed images, it means these images are exposing private information about the private dataset, i.e. high attack accuracy.
* **K-Nearest Neighbors Distance (KNN Dist).** KNN Dist indicates the distance between the reconstructed image for a specific label/id and corresponding images in the private training dataset. More specifically, it measures the

\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Method** & **Private Dataset** & **Public Dataset** & **Target model** & **Evaluation Model** & **Model Augmentation** \\ \hline \multirow{3}{*}{GMI [52] /} & \multirow{3}{*}{CelebA [33]} & CelebA / & VGG16 [40] / & \multirow{3}{*}{face.evoLve} & EfficientNet-B0 [43], \\  & & FFHQ [24] & & & \\  & & & face.evoLve [9] & & \\ \cline{1-1} \cline{2-6}  & CIFAR-10 [28] & CIFAR-10 & VGG16 & ResNet-18 [17] & \\ \cline{1-1} \cline{2-6}  & MNIST [30] & MNIST & CNN(Conv3) & CNN(Conv5) & CNN(Conv2), CNN(Conv4) \\ \hline \multirow{3}{*}{VMI [47]} & \multirow{3}{*}{CelebA} & \multirow{3}{*}{CelebA} & \multirow{3}{*}{ResNet-34 [17]} & EfficientNet-B0, \\  & & & & & \\ \cline{1-1} \cline{2-6}  & & & & & \\ \cline{1-1} \cline{2-6}  & MNIST & EMNIST [11] & ResNet-10 & ResNet-10 & CNN(Conv2), CNN(Conv4) \\ \hline \hline \end{tabular}
\end{table}
Table 2: We follow the exact the experiment setups in [7] for GMI [52] and KEDMI [7]. For VMI [47], we follow the exact experiment setups in [47]. In total, we conduct 72 experiments spanning 18 setups to demonstrate the effectiveness of our proposed method.
shortest feature distance from the reconstructed image to the real images in the private dataset, given a class/id. It is measured as \(l_{2}\) distance between two images in the feature space, i.e., the penultimate layer of the evaluation model.

### Experimental Results

**Comparison with previous state-of-the-art.** We use GMI [52], KEDMI [7], and VMI [47] as SOTA MI baselines. We reproduce all baseline results using official public implementations. We report results for GMI and KEDMI for CelebA/ CelebA experiments in Table 3. We report VMI results for CelebA/ CelebA experiments in Table 4. For each baseline setup, we report results for 3 variants: \(\bullet\)_LOM_ (Logit Maximization, Sec. 3.1), \(\bullet\)_MA_ (Model Augmentation, Sec. 3.2), \(\bullet\)_LOMMA_ (Logit Maximization + Model Augmentation). The details are as follows:

1. + LOM (Ours): We replace existing identity loss, \(L_{id}\) with our improved identity loss \(L_{id}^{logit}\) (Sec. 3.1).
2. + MA (Ours): We replace existing identity loss, \(L_{id}\) with our proposed \(L_{id}^{aug}\) (Sec. 3.2).
3. + LOMMA (Ours): We combine both \(L_{id}^{logit}\) (Sec. 3.1) and \(L_{id}^{aug}\) (Sec. 3.2) for model inversion.

As one can clearly observe from Table 3 and Table 4, our proposed methods yield significant improvement in MI attack accuracy in _all experiment setups_ showing the efficacy of our proposed methods. Further, by combining both our proposed methods, we significantly boost attack accuracy. The KNN results also clearly show that our proposed methods are able to reconstruct data close to the private training data compared to existing SOTA MI algorithms. Particularly, we improve the KEDMI baseline [7] attack accuracy by 12.4% under IR152 target classifier. We show private training data and reconstructed samples for KEDMI [7] under IR152 target model including all 3 variants in Fig. 4. We remark that in the standard CelebA benchmark, our method boosts attack accuracy significantly thereby achieving more than 90% attack accuracy (Table 3) for the first time in contemporary MI literature. We also include CIFAR-10, MNIST and additional results in Supplementary A.1.

**Cross-dataset.** Following [7], we conduct a series of experiments to study the effect of distribution shift between public and private data on attack performance and KNN distance. We use FFHQ [24] as the public dataset. In particular, we use FFHQ as public data for CelebA experiments. We train GAN models and three model augmentations using the public data. We remark that such setups closely replicate real-world MI attack scenario. We report top 1 accuracy and KNN distance for IR152, face.evolLve, and VGG16 target classifiers in Table 6. It is well known that baseline

Figure 4: Qualitative / Quantitative (Top1 Attack Acc., KNN Dist) results to demonstrate the efficacy of our proposed method. We use KEDMI [7] (SOTA), \(\mathcal{D}_{priv}\) = CelebA [33], \(\mathcal{D}_{pub}\) = CelebA [33] and \(M\) = IR152 [17]. As one can observe, our proposed method achieves better reconstruction of private data both visually and quantitatively (validated by KNN results) resulting in a significant boost in attack performance.

\begin{table}
\begin{tabular}{l c c c} \hline \hline Method & Attack Acc \(\uparrow\) & Imp. \(\uparrow\) & KNN Dist \(\downarrow\) \\ \hline \multicolumn{4}{c}{**CelebA/CelebA/IR152**} \\ \hline KEDMI & 80.53 \(\pm\) 3.86 & - & 1247.28 \\ + LOM (Ours) & 92.47 \(\pm\) 1.41 & 11.94 & 1168.55 \\ + MA (Ours) & 84.73 \(\pm\) 3.76 & 4.20 & 1220.23 \\ + LOMMA (Ours) & **92.93 \(\pm\) 1.15** & **12.40** & **1138.62** \\ \hline GM & 30.60 \(\pm\) 6.54 & - & 1609.29 \\ + LOM (Ours) & 78.53 \(\pm\) 3.41 & 47.93 & 1289.62 \\ + MA (Ours) & 61.20 \(\pm\) 4.34 & 30.60 & 1389.99 \\ + LOMMA (Ours) & **82.40: 4.37** & **51.80** & **1254.32** \\ \hline \multicolumn{4}{c}{**CelebA/CelebA/face.evol.ve**} \\ \hline KEDMI & 81.40 \(\pm\) 3.25 & - & 1248.32 \\ + LOM (Ours) & 92.53 \(\pm\) 1.51 & 11.13 & 1183.76 \\ + MA (Ours) & 85.07 \(\pm\) 2.71 & 3.67 & 1222.02 \\ + LOMMA (Ours) & **93.20 \(\pm\) 0.85** & **11.80** & **1154.32** \\ \hline GM & 27.07 \(\pm\) 6.72 & - & 1635.87 \\ + LOM (Ours) & 61.67 \(\pm\) 4.92 & 34.60 & 1405.35 \\ + MA (Ours) & 74.13 \(\pm\) 4.32 & 47.06 & 1352.25 \\ + LOMMA (Ours) & **82.33 \(\pm\) 3.51** & **55.26** & **1257.50** \\ \hline \multicolumn{4}{c}{**CelebA/CelebA/VGG16**} \\ \hline KEDMI & 74.00 \(\pm\) 3.10 & - & 1289.88 \\ + LOM (Ours) & 89.07 \(\pm\) 1.46 & 15.07 & 1218.46 \\ + MA (Ours) & 82.00 \(\pm\) 3.85 & 8.00 & 1248.33 \\ + LOMMA (Ours) & **90.27 \(\pm\) 1.36** & **16.27** & **1147.41** \\ + LOM (Ours) & 91.07 \(\pm\) 4.47 & - & 1715.60 \\ + LOM (Ours) & 69.67 \(\pm\) 4.80 & 50.60 & 1363.81 \\ + MA (Ours) & 51.73 \(\pm\) 6.03 & 32.66 & 1467.68 \\ + LOMMA (Ours) & **77.60 \(\pm\) 4.64** & **58.53** & **1296.26** \\ \hline \hline \end{tabular}
\end{table}
Table 3: We report the results for KEDMI and GMI for IR152, face.evolLve and VGG16 target model. Following exact experiment setups in [7], here \(\mathcal{D}_{priv}\) = CelebA, \(\mathcal{D}_{pub}\) = CelebA, evaluation model = face.evolLve. We report top 1 accuracies, the improvement compared to the SOTA MI (Imp.), and KNN distance. Top 5 attack accuracies are included in the Supplementary A.2. The best results are in **bold**. By alleviating both these major problems in MI algorithms, we achieve new SOTA MI performance (face.evolLve: 81.40% \(\rightarrow\) **93.20%**).
\(\mathcal{D}_{pub}\) = CelebA, a validation model = face.evoLve, target model = BiDO-HSIC. We report top 1 attack accuracies (Attack Acc.), and KNN distance (KNN Dist).