Membership Inference Attacks Against Text-to-image Generation Models
Membership Inference Attacks Against Text-to-image Generation Models
复制标题
针对文本到图像生成模型的成员推理攻击
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Yang Zhang
中科院分区：
文献类型：
--
作者：
Yixin Wu;Ning Yu;Zheng Li;M. Backes;Yang Zhang
文本到图像生成模型最近吸引了前所未有的关注，因为它们在生活的各个领域中打开了富有想象力的应用。然而，开发此类模型需要大量可能包含隐私敏感信息的数据，例如，面对身份。虽然隐私风险已经在图像分类和GAN生成领域得到了广泛的证明，但文本到图像生成领域的隐私风险在很大程度上尚未被探索。在本文中，我们进行了第一次隐私分析的文本到图像的生成模型，通过隶属推理的透镜。具体而言，我们提出了三个关键直觉的成员信息和设计相应的攻击方法。我们对两种主流的文本到图像生成模型进行了全面的评估，包括序列到序列建模和基于扩散的建模。实验结果表明，所有的建议攻击可以实现显着的性能，在某些情况下，甚至接近1的准确性，因此相应的风险是更严重的比现有的成员推断攻击。我们进一步进行了广泛的消融研究，分析可能影响攻击性能的因素，这可以指导开发人员和研究人员警惕文本到图像生成模型中的漏洞。所有这些研究结果表明，我们提出的攻击构成了现实的隐私威胁的文本到图像生成模型。
Text-to-image generation models have recently attracted unprecedented attention as they unlatch imaginative applications in all areas of life. However, developing such models requires huge amounts of data that might contain privacy-sensitive information, e.g., face identity. While privacy risks have been extensively demonstrated in the image classification and GAN generation domains, privacy risks in the text-to-image generation domain are largely unexplored. In this paper, we perform the first privacy analysis of text-to-image generation models through the lens of membership inference. Specifically, we propose three key intuitions about membership information and design four attack methodologies accordingly. We conduct comprehensive evaluations on two mainstream text-to-image generation models including sequence-to-sequence modeling and diffusion-based modeling. The empirical results show that all of the proposed attacks can achieve significant performance, in some cases even close to an accuracy of 1, and thus the corresponding risk is much more severe than that shown by existing membership inference attacks. We further conduct an extensive ablation study to analyze the factors that may affect the attack performance, which can guide developers and researchers to be alert to vulnerabilities in text-to-image generation models. All these findings indicate that our proposed attacks pose a realistic privacy threat to the text-to-image generation models.
DOI：
10.14722/ndss.2021.24293
发表时间：
2021-01
期刊：
ArXiv
影响因子：
--
作者：
Bo Hui;Yuchen Yang;Haolin Yuan;P. Burlina;N. Gong;Yinzhi Cao
通讯作者：
Bo Hui;Yuchen Yang;Haolin Yuan;P. Burlina;N. Gong;Yinzhi Cao