面向视觉语言模型的自适应 Token 加权模型反演攻击

模型反演 (MI) 攻击 作为 significant privacy risks 通过重构 private training data from trained neural networks。虽然 prior studies 主要 examination unimodal deep networks，但 vision-language models (VLMs) 的 vulnerability 仍 largely unexplored。本文首次系统性地研究 VLMs 上的 MI 攻击以理解其对 private visual training data 的泄露。我们的工作主要贡献有二：First，针对 VLMs 的 token-generative 特性，我们引入一套 token-based 和 sequence-based model inversion strategies，提供对 VLMs 在 different attack formulations 下 vulnerability 的 comprehensive analysis。Second，基于 tokens 在 visual grounding 方面的差异，hence their gradients 在 image reconstruction 中 informativeness 不同，我们提出 Sequence-based Model Inversion with Adaptive Token Weighting (SMI-AW) 作为一种 novel MI for VLMs。SMI-AW 动态 reweights 每个 token 的 loss gradient 根据其 visual grounding，enable optimization focus on visually informative tokens 并 more effectively guide private image 的 reconstruction。通过在 range of state-of-the-art VLMs 上进行 extensive 实验和 human evaluations，we show VLMs susceptible to training data leakage。reconstructed images 的 human evaluation yields attack accuracy 61.21%，凸显了这些 privacy risks 的 severity。 Notably，我们 demonstration publicly released VLMs vulnerable to such attacks。Our study highlights the urgent need for privacy safeguards as VLMs become increasingly deployed in sensitive domains such as healthcare and finance。我们的 code and models available at our project page: https://ngoc-nguyen-0.github.io/SMI_AW/