Neural Honeypoint: An Active Defense Framework Against Model Inversion Attacks.

Abstract

Learning-based systems have been proved to be vulnerable against model inversion attacks (MIAs), where attackers steal private information of training data by querying the target model using synthetic samples. To alleviate the urgent threat introduced by MIAs, existing advancements are proposed to increase the attack overhead by limiting the information available. Although these methods successfully reduced the attack success rate (ASR) for a one-time inversion attempt, they usually compromise the usability of the protected model. More importantly, existing MIA defense methods fail to capture attack attempts, which can lead to persistent threats to data privacy. To bridge this gap, we propose Neural Honeypoint, an active defense framework against MIAs. The key insight is that MIA attackers will make a series of forward steps in the feature space while benign users will not. Motivated by the observation, defenders can deploy active defense devices (honeypoints) on critical paths to capture attack behaviors. Specifically, Neural Honeypoint first models the attackers' capabilities from the frequency domain and designs specialized honeypoints for protected classes in the training dataset. Subsequently, it deploys these honeypoints into the protected model via backdoor-like model fine-tuning. Then, defenders can distinguish model inversion examples by comparing the similarity of input features with deployed honeypoints. Experiments show that Neural Honeypoint reduces the ASRs of advanced MIAs to 0%~2%. Furthermore, it can effectively capture inversion queries, which helps defenders to detect and block attacks in time.