The emergence of Deep Learning (DL) has brought about a transformative impact on machine learning applications, granting them remarkable capabilities. To cater to the increasing demand for DL models on edge-side devices, various challenges related to performance arise. The growing size of model parameters poses a burden on resource-constrained edge devices. As a result, the concept of Machine Learning as a Service (MLaaS) has gained popularity as a solution. However, deploying DL services in the cloud, where APIs are provided to users and raw data is collected for service provisioning, raises concerns about potential data leakage. In this context, Split Inference (SI) has emerged as a promising alternative [Eshratifar et al., 2019;Banitalebi-Dehkordi et al., 2021;Kang et al., 2017;Matsubara et al., 2022;Hauswald et al., 2014]. SI involves splitting and deploying DNN models between the edge and the cloud, allowing the cloud's extensive computing and storage resources to be leveraged while ensuring that users only need to upload intermediate feature representations to protect the confidentiality of their original data.
However, recent studies have demonstrated that even with the use of intermediate feature representations, a malicious cloud server can still launch privacy attacks. Of particular concern is the Data Reconstruction Attack (DRA) [He et al., 2019;Singh et al., 2021;Yang et al., 2022], which represents the most severe violation of user privacy as it aims to reconstruct the user's inference instances. Existing DRAs suffer from critical flaws that significantly diminish their effectiveness.
Optimization-based DRAs [He et al., 2019;Singh et al., 2021], for example, fail to effectively leverage public data, while Learning-based DRAs [He et al., 2019] heavily depend on the quantity of auxiliary data and require a high degree of distribution similarity between the auxiliary data and the inference data.
To address these limitations and enhance the impact of the attack, we propose the GAN-based LAtent Space Search attack (GLASS). This attack leverages the power of StyleGAN [Karras et al., 2019[Karras et al., , 2020[Karras et al., , 2021;;Sauer et al., 2022] and fully capitalizes on the valuable prior knowledge embedded in public data. Additionally, we introduce GLASS++, an improved version that enhances attack stability and effectiveness.
We systematically evaluate the reconstruction performance of Optimization-based GLASS and Learning-based GLASS++ on face data at different split points. Additionally, we thoroughly examine and analyze seven advanced defense mechanisms against DRA in SI. These mechanisms are categorized into three types: Clipping (Dropout Defense [He et al., 2020], DISCO [Singh et al., 2021]), Noise Addition (Noise Mask [Titcombe et al., 2021], Shredder [Mireshghallah et al., 2020]) and Feature Obfuscating (Adversarial Learning [Li et al., 2021], NoPeek [Vepakomma et al., 2020] and Siamese Defense [Osia et al., 2020]). Furthermore, we go beyond the traditional assumptions about adversary capabilities and extend our attack to heterogeneous data. Through our extensive experimentation, we achieve superior attack results across various split points and different adversary setups, successfully bypassing the employed defense mechanisms and compromising their effectiveness.
The key contributions of this paper are:
• We propose GLASS and GLASS++, which are enhanced DRAs combined with pre-trained StyleGAN models. This is the first instance of utilizing the latent space search characteristic of StyleGAN to develop DRAs specifically for SI. Additionally, we expand the practicality of our methods by designing attack strategies for various adversary settings.
• Through the utilization of advanced StyleGAN technologies, we exploit the rich prior knowledge present in public data, resulting in state-of-the-art reconstruction performance across different split points. Our methods outperform existing baseline attacks on multiple evaluation metrics, showcasing their superiority.
• We conduct a systematic evaluation and comparison of various DRAs against seven defense mechanisms. The results demonstrate that our methods effectively reveal sensitive information and undermine the robustness of the defenses.
2 Background and Related Work
Split Inference (SI) and Split Learning (SL) [Gupta and Raskar, 2018;Thapa et al., 2022;Poirot et al., 2019] have emerged as promising alternatives, which split and deploy DNN models on both the edge-side and the cloud side. In SI, a well-trained model M is split into client model M C and server model M S . An inference data x ⇤ is fed to M C to get an intermediate feature representation
). z ⇤ is then transmitted to the cloud to execute y ⇤ = M S (z ⇤ ). Finally, y ⇤ is returned to the edge-side to complete the inference process, as shown in Figure 1. Collaborative computing across edge-cloud devices facilitates the reduction of computing payload on the edge side. By transmitting only the smashed data to the cloud side, a certain level of privacy protection can be ensured. Utilizing distributed inference/training protocols, SI and SL achieve an improved trade-off between utility and privacy.
Data Reconstruction Attack (DRA) is one of the most powerful privacy attacks that focuses on reconstructing private inference data. The existing DRAs can be broadly categorized as Optimizationbased and Learning-based. [He et al., 2019] introduced regularized Maximum Likelihood Estimation (rMLE), firstly treating DRA as an optimization problem. For an intermediate feature representation z ⇤ = M C (x ⇤ ), they find the optimal sample x which minimizes the posterior information from feature-level observation by reducing the Euclidean Distance between M C (x) and M C (x ⇤ ). Additionally, they adapt the Total Variation (TV) [Rudin et al., 1992] to represent the prior information derived from the distribution of natural images. Inspired by the deep image prior [Ulyanov et al., 2018] for feature inversion, [Singh et al., 2021] proposed Likelihood Maximization (LM), which took full advantage of a fixed input Autoencoder network M AE producing x = M AE (•) and replaced the target optimization by minimizing the loss l 2 (M C (M AE (•)), z ⇤ ), which significantly improved the optimization-based DRA effect. For learning-based DRA, [He et al., 2019] introduced Inverse-Network (IN) that leverages a certain amount of (z ⇤ , x ⇤ ) pairs gained by querying the
Similarly, l 2 norm in the pixel space is also used as the loss function. Facing serious threats of existing DRAs, a variety of defense mechanisms have been proposed to greatly mitigate privacy leakage in SI. They are specifically designed to minimize the disclosure of sensitive information from DRA, while still preserving the practical utility of the inference data.
The Model Inversion Attack [Zhang et al., 2020;Chen et al., 2021;An et al., 2022] seeks to extract sensitive features of an individual in the training data, by leveraging the coupled feature information contained in the confidence score of an ID classification model. The Gradient Inversion Attack [Zhu et al., 2019;Geiping et al., 2020;Jeon et al., 2021] aims to recover original training data from shared gradients. Unlike them, DRA focuses on reconstructing private inference data using feature representation output from the split layer of any functional DNN models.
The StyleGAN generator consists of a mapping network f and a synthesis network G Style . In a typical image generation process of StyleGAN, a latent vector z is sampled from the Z space, which follows the Gauss Distribution. Then an intermediate latent vector w is obtained from f (z). The f is a mapping network implemented by an 8-layer Multi-Layer Perceptron (MLP), making the generation based on a disentangled representation. Finally, the w is copied N times (N = log(output_size, 2) ⇤ 2 2) and leveraged to control layer-grained adaptive instance normalization (AdaIN) [Huang and Belongie, 2017] operations, as shown in Figure 2.
With the rapid development of the StyleGAN series network, a variety of GAN Inversion methods have emerged [Abdal et al., 2019[Abdal et al., , 2020;;Richardson et al., 2021;Wang et al., 2023], which aim to invert a given image back into the latent space of a pre-trained GAN model. Especially for StyleGAN, several latent spaces (W+, S, P, P+) [Zhu et al., 2020b] and formulations (learning, optimization, or both) [Xia et al., 2022] are utilized to achieve better inversion results. Different from common GAN Inversion that focuses on distortion-editability trade-off [Zhu et al., 2020a;Tov et al., 2021], in this paper we customize advanced GAN Inversion technologies to DRA in SI, concentrating on raising the quality of reconstruction.
In this section, we first analyze the threat model of DRA in SI. Then, we formulate the design details and corresponding intuitions of our GLASS and GLASS++.
We assume an honest-but-curious server-side adversary in SI, who receives the client's intermediate feature representations and tries to reconstruct the private inference instances from them. The adversary has the parameters and structure of the whole target model M T , as a white-box setting. This is a reasonable assumption in real-world scenarios, where typically the service provider of SI needs to obtain the target model and perform the splitting setup before deploying it. We also take into account the strictest case that the training of the target model is accompanied by defensive purposes. This usually occurs when the target model is provided to the server by a trusted model provider that sets defense mechanisms, or when the training objectives of the target model are forcibly set by the client with privacy protection requirements. In addition, we extend the consideration to scenarios where the adversary has limited capabilities, i.e., having no client model M C or being non-queryable, as a black-box setting or a query-free setting. Besides, we assume that the adversary has an auxiliary public dataset D A with a similar distribution to that of the target model training dataset. Later in Section 5, we show that our attacks can be carried out effectively, even using an auxiliary dataset with a certain distribution shift.
Setup. Before launching the GLASS, a pre-trained StyleGAN generator G Style is necessary, which is trained on a data distribution similar to the private inference data D P . This is easy to obtain because StyleGAN models pre-trained on various data distributions (especially structured data distributions such as faces) are widely released online. We first formalize Optimization-based DRA as:
, where L is the l 2 -distance between two intermediate features, and the adversary tries to find an x closest to x ⇤ through optimization.
Z space search. The non-convexity of StyleGAN generation makes the optimization problem nonconvex. For the optimization of non-convex functions, an ideal initial point and certain disturbance is extremely significant. The step 1 of GLASS is searching in Z space for the reason that the entanglement of Z space increases the amplitude of positive perturbation (come from optimizer Adam, SGD, etc) in representation space, which avoids the minimization via gradient descent resulting in poor local minima in the same degree. The formal representation of Z space search is:
. Obtaining distorted images is a common occurrence by directly searching according to L, as the optimization process may cause z to deviate significantly from the distribution of Z space. Therefore, we adopt KL-based regularization [Kingma and Welling, 2013] to constrain the optimization process of z to conform to the normal distribution as:
, where µ 2 i and 2 i represent the element-wise mean and standard deviation. The regularization item R(•) reduces the Kullback-Leibler divergence between z and the standard Gaussian distribution N (0, 1), controlled by . Furthermore, we adopt Total Variation [Rudin et al., 1992] to bring prior information of the natural image, which encourages the generated image x = G Style (z) to be piece-wise smooth, controlled by ↵. Defined as:
W+ space search. Based on the z got in step 1 , we perform f (z) to obtain w, then copy it 10 times as w+. In step 2 , we search the W+ space as follows:
. For adequate disentanglement of W+ space, it is efficient to find the extreme point in the representation space. The two-step search algorithm is intuitively efficient. As depicted in Figure 3 When the available information for reconstruction is tiny, Z space search will inevitably fall into the local optimal point even accompanying disturbance, making GLASS optimize z ⇤ to w+ ⇤ 1 and W+ space search to w+ ⇤ 2 . While GLASS++ utilizes the mapping relationship between feature space and latent space to obtain an improved initial point w+ ⇤ 3 and subsequently achieves the global optimal w+ ⇤ 4 .
Intuition. GLASS, this purely optimization-based DRA method could achieve remarkable results at shallow split points. However, when the split point is deep, the (W idth, Height) of the intermediate feature representation becomes far less than that of the private input, meaning that the spatial information for reconstruction is gradually transformed into the semantic information needed for the classification task. The less spatial information available makes the optimization process more difficult, causing the results of GLASS to fall into pool local optima. As shown in Figure 3 (B), even with a huge disturbance amplitude, z 2 eventually falls into a local extreme point w+ ⇤ 1 , due to the lack of information. This results in little improvement in the subsequent W+ space search. Therefore, we propose GLASS++ to alleviate the above problem.
Setup. Before launching the GLASS++, we introduce pixel2style2pixel Encoder E PSP and map2styles blocks M m from [Richardson et al., 2021]. Tensors of the image space are fed to E PSP to generate three levels of feature maps. These feature maps are subsequently utilized by the map2styles blocks M m to extract desired styles w+. We incorporate these technologies into our DRA framework. For more details on these components, please refer to Appendix B.1.
W+ space mapping & search. To tackle the problem of non-convex function optimization tending to fall into local optima, we employ Learning-based methods. These methods involve mapping the intermediate feature representation to W+ space, resulting in a more advantageous initial point. We specifically design a feature2image module M f , projecting vectors from high-dimensional feature space into image space. This module serves as a valuable tool for facilitating subsequent style extraction. Then we joint the E PSP and M m to extract desired styles w+. In step 1 , these three items collaboratively perform as Encoder E = M f E PSP M m , mapping the vectors from feature space to W+ space as:
, with the help of E, a point near the global optimum is determined as the initial point of W+ space search in step 2 . As shown in Figure 3 (B), it is considerably more effortless to reach w+ ⇤ 4 from w+ ⇤ 3 driven by gradient descent. The detailed algorithm of GLASS++ can be found in Appendix A.2.
Referring to [Jeon et al., 2021], we formalize the DRA under SI as an optimization problem. Through a pre-trained StyleGAN generator, the problem of (1) can be better solved by transferring from R m to {G Style (l) : l 2 R k }, where l is a latent code in either Z or W+ space, k denotes the dimension of l, and m refers to the dimension of image space. Hence, GLASS and GLASS++ perform the latent spaces search as follows:
, where D represents total loss terms in latent spaces search. When the private inference data is approximated with a sufficient narrow error, the DRA through latent spaces search in (7) aligns with image space search in (1).
We systematically evaluate our proposed attacks in terms of their performance against representative image classification tasks and compare them with existing attack methods. Additionally, we measure the robustness of seven defense mechanisms against various DRAs. We implement GLASS and GLASS++ in Pytorch [Paszke et al., 2019]. Most experiments are carried out on a server equipped with 256 GB RAM, two Intel Xeon Gold 6133, and four NVIDIA RTX 4090 GPUs.
Datasets & Tasks. we use (1) CelebA [Liu et al., 2015] containing 202,599 face images of 10,177 identities, (2) FFHQ [Karras et al., 2019] containing 70,000 face images with considerable variation in terms of age, ethnicity and image background. Both are scaled down to 64 ⇥ 64 pixels. We study DRA against models built for the Attractiveness Classification task: Binary attractiveness classification performed on the CelebA, as we consider attractiveness to be a remarkably inclusive facial attribute. We adopt ResNet-18 [He et al., 2016] and split the target model M C into different layers, as shown in Appendix B.2.
Attack Setup. We split the datasets into two parts: a private dataset D P for training the target model and a public data used as an auxiliary dataset D A for training our StyleGAN model. For CelebA, we selected 80,525 images belonging to 3,000 identities with the highest number of images as D P , while the remaining images from other identities as public data D A . This scheme ensures that there are no overlapping identities between D A and D P in all experiments. This means that the public data only helps the adversary obtain general information about the features as prior knowledge, without providing any class-specific information relevant to the private data [Chen et al., 2021]. For practical reasons, we utilize the FFHQ dataset as public data to train our StyleGAN model, as there are numerous StyleGAN models available on the Internet that are trained with FFHQ. Note that there is a certain distribution shift between the FFHQ dataset and the celeba dataset [Kahla et al., 2022]. To be fair, We set the number of iterations for Optimization-based DRA to 20,000 and the number of training epochs for Learning-based DRA to 30, while incorporating Total Variation into each attack loss function. It is worth acknowledging that the influence of hyperparameters varies across different adversarial settings and defense mechanisms. We analyze the hyperparameter selection strategies within different settings to meet the reasonable effectiveness of various attacks. Detailed information regarding the hyperparameters can be found in Appendix B.3.
Compared Baselines & Evaluation Protocol. We set the three existing DRAs as the baseline attacks: regularized Maximum Likelihood Estimation (rMLE) [He et al., 2019], Likelihood Maximization (LM) [Singh et al., 2021] and Inverse-Network (IN) [He et al., 2019]. For the sake of generality, our experiments are conducted on 40 randomly selected and fixed images, and the mean value of each evaluation metric is calculated as the result.
Evaluation Metrics. In addition to visually quantifying reconstruction attacks, we selected five metrics to evaluate the similarity between the original image and the reconstructed image: Learned Perceptual Image Patch Similarity (LPIPS #) [Zhang et al., 2018], Structural Similarity Index (SSIM ") [Wang et al., 2004], Peak Signal-to-Noise Ratio (PSNR ") [Hore and Ziou, 2010], Mean Squared Error (MSE #) and Natural Image Quality Evaluator (NIQE #) [Mittal et al., 2012]. Note that "#" means the lower the metric the higher the relative image quality, while """ represents the higher the metric the higher the image quality.
Figure 4 shows the reconstruction attack performance of our methods. In general, our methods demonstrate optimal and second-best performance across nearly all split points, whether compared with Optimization-based or Learning-based DRAs. Specifically, when the split point is set to Block3, our Optimization-based GLASS reduces LPIPS from 0.298 to 0.140 compared to LM; Our Learningbased GLASS++ enhances the SSIM from 0.685 to 0.833 compared to IN (the full results are in Appendix C). When the split point is located at a deeper Block5, GLASS exhibits a remarkable ability in reconstructing faces with features highly similar to the ground truth. In contrast, other Optimizationbased DRAs fail to reveal any valid sensitive information. We attribute this superior performance to two main factors: the wealth of prior knowledge embedded in the pre-trained StyleGAN model and the powerful feature search capability brought by our methods. Note that LM achieves optimal NIQE on Block5, but we observe that its reconstructed images are almost noisy. We analyze that this was due to the instability of NIQE on small-size images, which resulted in extremely poor attack results but good values. Therefore, we exclude NIQE from the experiments in subsection 4.3.
Reconstruction Performance under Defense Mechanisms. The quantitative metrics in Table 1 demonstrate the remarkable effectiveness of our methods in breaching all defenses, surpassing the performance of other baseline attacks even when the accuracy of the target model declines due to defense. Our GLASS++ and GLASS consistently yield the optimal and the second-best results on most of the metrics. Even against state-of-the-art defense mechanisms like NoPeek, Adversarial Learning, and DISCO, we can still carry out powerful DRA, as shown in Figure 5. Specifically, when against NoPeek (Acc=79.97%), GLASS and GLASS++ increased the SSIM of reconstructed images to 0.554 and 0.678, compared to 0.006, 0.233 and 0.376 of baseline attacks, showcasing that our methods turn the failure into the successful attack. It is crucial to emphasize that even a 3% loss in accuracy is unsatisfactory because the target task is a simple binary classification problem. However, in practice, DL tasks are often very complex, and even a slight privacy defense may lead to poor performance.
Table 1: According to the attack effect of IN, we adjust the hyperparameters of different defenses to provide the defended model with three levels of privacy protection, resulting in a gradual decrease in model accuracy (original Acc=79.97 %). All experiments are performed on Block3. Implementation details and hyperparameters of defenses are in Appendix B.4. Figure 5: The results of different defenses against DRAs. The accuracy rate corresponds to the Acc in Table 1, as Acc-1>Acc-2>Acc-3. because the target task is relatively simple, resulting in highly redundant feature channels. For Noise Addition type defenses (Noise Mask, Shredder), Optimization-based DRAs are noise-sensitive. Even in a White-box setting, random sampling noise can still greatly interfere with the optimization process, leading to poor attack effects. In contrast, Learning-based DRAs demonstrate a certain robustness to noise. For further analysis of Shredder, we collect intermediate feature representations superimposed with Shredder noise and apply t-SNE[Van der Maaten and Hinton, 2008] to reduce their dimensionality. Notably, even when sampling from 50 noise distributions, the intermediate features can be distinctly clustered into 50 groups, as shown in Appendix F. We can degrade the noise distribution library of Shredder (default is 20) to a single distribution by using carefully selected intermediate feature representations (which can be mapped to the corresponding target group) during the optimization process, which greatly improves the effect of DRA. For Feature Obfuscating type defenses (Adversarial Learning, NoPeek, Siamese Defense), we believe that they only serve to increase the difficulty of feature matching in DRA. However, with a sufficiently powerful feature search capability, the attack is easy to implement. Appendix D.1 illustrates the curves of feature loss between the model with NoPeek and the original model under the GLASS, targeting the same image during optimization. It is evident that when the optimization process converges, the numerical difference between them is two orders of magnitude. In Appendix D.2, we establish a correlation between the model's accuracy and the SSIM of DRA under different attacks and defenses. Notably, NoPeek and DISCO emerge as the most effective defense mechanisms. As shown in Appendix D.3(a), the SSIM of our attacks is mostly above 0.5, and the slope of the broken lines is large, which means that our attacks are more robust.
Black-box & Query-free Settings. We relax the assumption of adversary capability and use gradient-free optimization technology to implement Black-box DRA. For Query-free, we adapt model fine-tuning and P+ space cropping. The experimental results show that the gradient-free optimization only takes 2,000 iterations to obtain effective information, and the customized GLASS improves the attack SSIM of Block2 from 0.152 to 0.392 in the Query-free setting. Experimental details and results are in Appendix E.1
Heterogeneous Data. We further extend the reconstruction attack to heterogeneous data like CINIC-10 [Darlow et al., 2018]. We chose to utilize the gradient-free CMA optimizer because CINIC-10 has a more heterogeneous data distribution than well-aligned datasets like CelebA, making it hard for the gradient-based optimizer to search in latent space [Li et al., 2022]. In our implementation, we utilize a publicly released StyleGAN-XL model trained on CIFAR-10 [ Krizhevsky et al., 2009] to construct GLASS. Figure 6 shows part of the results. It can be seen that owing to rich prior knowledge, our GLASS can obtain highly similar semantic information and generate more vivid images than IN. Experimental details are in Appendix E.2. Data Distribution Shift. We replaced the StyleGAN model used in the attack from the one trained on the CelebA to the one trained on the FFHQ. Table 2 shows that GLASS++ is still very effective, even if the prior knowledge is learned from a data distribution that differs from the private data distribution (facial structure alignment and feature diversity difference). Furthermore, we enhance the robustness of the attack by incorporating a fundamental domain adaptation technique, specifically model fine-tuning. We concatenate a step of model parameter optimization after GLASS++ to make the generator model parameters trainable, which further aligns the features of the reconstructed images with the target features. Moreover, we carry out a more practical implementation of DRA on uncropped/unaligned private inference data to enhance the quality of our work. According to [Yang et al., 2023], we enhance StyleGAN by transitioning its constant first-layer feature to a variable one. We integrate this with the latent code of W+ space and undertake joint optimization during the second stage of our methodology. As demonstrated in Figure 7, the evaluation of GLASS underscores our method's effectiveness even when dealing with transformed or natural privacy inference data.
In this paper, we propose GLASS and GLASS++, the enhanced DRAs against SI. Our experiments demonstrate the effectiveness of our attacks on different split points and various adversarial settings. We anticipate that our proposed attacks will spotlight the significance of safeguarding privacy in split inference systems and encourage the advancement of more robust defense mechanisms. Regarding the limitation, it mainly comes from the inherent flaw of Optimization-based attacks, for single image optimization is less efficient than Learning-based attacks.