mlsanityData to 14 Oct 2026

On the Importance of Encrypting Deep Features

arXiv 2108.07147 ↗First posted 16 Aug 2021cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

In this study, we analyze model inversion attacks with only two assumptions: feature vectors of user data are known, and a black-box API for inference is provided. On the one hand, limitations of existing studies are addressed by opting for a more practical setting. Experiments have been conducted on state-of-the-art models in person re-identification, and two attack scenarios (i.e., recognizing auxiliary attributes and reconstructing user data) are investigated. Results show that an adversary could successfully infer sensitive information even under severe constraints. On the other hand, it is advisable to encrypt feature vectors, especially for a machine learning model in production. As an alternative to traditional encryption methods such as AES, a simple yet effective method termed ShuffleBits is presented. More specifically, the binary sequence of each floating-point number gets shuffled. Deployed using the one-time pad scheme, it serves as a plug-and-play module that is applicable to any neural network, and the resulting model directly outputs deep features in encrypted form. Source code is publicly available at https://github.com/nixingyang/ShuffleBits.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 35 of its 50 references that are in the map. First posted on arXiv 16 Aug 2021.

Builds on

35 of 50 references.

References · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
  4. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,527
  5. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,694
  6. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,626
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  8. 2016Adversarial examples in the physical worldcited by 1,769
  9. 2017Random Erasing Data Augmentationcited by 1,239
  10. 2016Least Squares Generative Adversarial Networkscited by 1,001
  11. 2018Generalized Cross Entropy Loss for Training Deep Neural Networks with Noisy Labelscited by 997
  12. 2016Conditional Image Generation with PixelCNN Decoderscited by 862
23 more
  1. 2016XNOR-Net: ImageNet Classification Using Binary Convolutional Neural Networkscited by 849
  2. 2016Performance Measures and a Data Set for Multi-Target, Multi-Camera Trackingcited by 692
  3. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  4. 2017One pixel attack for fooling deep neural networkscited by 582
  5. 2020Deep Learning for Person Re-identification: A Survey and Outlookcited by 549
  6. 2017Person Transfer GAN to Bridge Domain Gap for Person Re-Identificationcited by 480
  7. 2019Bag of Tricks and A Strong Baseline for Deep Person Re-identificationcited by 430
  8. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 423
  9. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  10. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  11. 2016Generating Images with Perceptual Similarity Metrics based on Deep Networkscited by 222
  12. 2015Inverting Visual Representations with Convolutional Networkscited by 170
  13. 2020FastReID: A Pytorch Toolbox for General Instance Re-identificationcited by 166
  14. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
  15. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
  16. 2016Binarized Neural Networks: Training Deep Neural Networks with Weights and Activations Constrained to +1 or -1cited by 105
  17. 2017Improving Person Re-identification by Attribute and Identity Learningcited by 96
  18. 2015Visualizing Deep Convolutional Neural Networks Using Natural Pre-Imagescited by 93
  19. 2020InstaHide: Instance-hiding Schemes for Private Distributed Learningcited by 90
  20. 2017Adversarial Example Defenses: Ensembles of Weak Defenses are not Strongcited by 32
  21. 2019Adversarial Neural Network Inversion via Auxiliary Knowledge Alignmentcited by 32
  22. 2017Towards Measuring Membership Privacycited by 29
  23. 2014From neural PCA to deep unsupervised learningcited by 9

Built on by

Not cited yet.