你的特征泄露了什么：面向分割式 DNN 的数据高效黑盒特征反演攻击
What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs
把流匹配引入特征反演：用潜空间对齐模块 + 确定性一步流匹配把中间特征投回目标流形，可在极少图像-特征对下训练，为评估分割式推理的隐私泄露提供了可复用的攻击基线；其基于 LVLM 的语义保真度指标也可直接用于衡量任何重建/反演任务的语义一致性。
原文依据 we introduce FIA-Flow, a black-box FIA framework that achieves high-fidelity image reconstruction from intermediate features
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论分割式 DNN 通过将密集计算卸载到云服务器来支撑边缘设备，但这一范式也暴露了隐私漏洞：中间特征可被特征反演攻击（FIA）利用以重建私有输入。现有 FIA 方法的重建质量往往有限，难以评估隐私泄露的真实程度。为揭示泄露特征所带来的隐私风险，我们提出 FIA-Flow，一个可从中间特征实现高保真图像重建的黑盒 FIA 框架。为利用中间特征中的语义信息，我们设计了潜变量特征空间对齐模块（LFSAM），以弥合中间特征空间与潜变量空间之间的语义鸿沟。此外，为纠正分布失配，我们提出确定性反演流匹配（DIFM），以一步推理将偏离流形的特征投影到目标流形上。这种解耦设计简化了学习过程，并使得仅用少量图像-特征对即可有效训练。为从人类视角量化隐私泄露，我们还提出了两个基于大型视觉语言模型的指标。实验表明，FIA-Flow 在多种模型（AlexNet、ResNet、Swin Transformer、DINO 与 YOLO11）和多个层上都能实现更忠实、语义更对齐的特征反演，揭示出分割式 DNN 中比以往认知更为严重的隐私威胁。
英文原文摘要 1458 字符
Split DNNs enable edge devices by offloading intensive computation to a cloud server, but this paradigm exposes privacy vulnerabilities, as the intermediate features can be exploited to reconstruct the private inputs via Feature Inversion Attack (FIA). Existing FIA methods often produce limited reconstruction quality, making it difficult to assess the true extent of privacy leakage. To reveal the privacy risk of the leaked features, we introduce FIA-Flow, a black-box FIA framework that achieves high-fidelity image reconstruction from intermediate features. To exploit the semantic information within intermediate features, we design a Latent Feature Space Alignment Module (LFSAM) to bridge the semantic gap between the intermediate feature space and the latent space. Furthermore, to rectify distributional mismatch, we develop Deterministic Inversion Flow Matching (DIFM), which projects off-manifold features onto the target manifold with one-step inference. This decoupled design simplifies learning and enables effective training with few image-feature pairs. To quantify privacy leakage from a human perspective, we also propose two metrics based on a large vision-language model. Experiments show that FIA-Flow achieves more faithful and semantically aligned feature inversion across various models (AlexNet, ResNet, Swin Transformer, DINO, and YOLO11) and layers, revealing a more severe privacy threat in Split DNNs than previously recognized.