视觉语言模型会泄露所学内容吗？自适应词元加权模型反演攻击
Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks
提出基于词元梯度加权的模型反演攻击方法 SMI-AW，可复用于评估视觉语言模型在训练数据隐私泄露方面的脆弱性，为隐私保护防御提供攻击基准。
原文依据 we propose Sequence-based Model Inversion with Adaptive Token Weighting (SMI-AW) as a novel MI for VLMs
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论模型反演（MI）攻击通过从训练好的神经网络中重建私有训练数据，构成重大隐私风险。已有研究主要考察单模态深度网络，而视觉语言模型（VLM）的脆弱性在很大程度上尚未被探索。本文首次对 VLM 上的 MI 攻击进行系统性研究，以理解其泄露私有视觉训练数据的易感性。我们的工作有两项主要贡献。第一，针对 VLM 的词元生成特性，我们引入一套基于词元和基于序列的模型反演策略，全面分析 VLM 在不同攻击形式下的脆弱性。第二，基于观察到不同词元的视觉接地程度不同、因而其梯度对图像重建的信息量存在差异，我们提出基于序列的自适应词元加权模型反演（SMI-AW），作为一种面向 VLM 的新型 MI 方法。SMI-AW 根据每个词元的视觉接地程度动态重新加权其损失梯度，使优化聚焦于视觉信息丰富的词元，从而更有效地指导私有图像的重建。通过在多个数据集上对一系列最优 VLM 进行大量实验和人工评测，我们表明 VLM 易受训练数据泄露影响。对重建图像的人工评测得到 61.21% 的攻击准确率，凸显了这些隐私风险的严重性。值得注意的是，我们证明公开可用的 VLM 也易受此类攻击。我们的研究强调，随着 VLM 日益部署于医疗和金融等敏感领域，亟需隐私保护措施。我们的代码和模型可在项目页面获取：https://ngoc-nguyen-0.github.io/SMI_AW/
英文原文摘要 1816 字符
Model inversion (MI) attacks pose significant privacy risks by reconstructing private training data from trained neural networks. While prior studies have primarily examined unimodal deep networks, the vulnerability of vision-language models (VLMs) remains largely unexplored. In this work, we present the first systematic study of MI attacks on VLMs to understand their susceptibility to leaking private visual training data. Our work makes two main contributions. First, tailored to the token-generative nature of VLMs, we introduce a suite of token-based and sequence-based model inversion strategies, providing a comprehensive analysis of VLMs' vulnerability under different attack formulations. Second, based on the observation that tokens vary in their visual grounding, and hence their gradients differ in informativeness for image reconstruction, we propose Sequence-based Model Inversion with Adaptive Token Weighting (SMI-AW) as a novel MI for VLMs. SMI-AW dynamically reweights each token's loss gradient according to its visual grounding, enabling the optimization to focus on visually informative tokens and more effectively guide the reconstruction of private images. Through extensive experiments and human evaluations on a range of state-of-the-art VLMs across multiple datasets, we show that VLMs are susceptible to training data leakage. Human evaluation of the reconstructed images yields an attack accuracy of 61.21%, underscoring the severity of these privacy risks. Notably, we demonstrate that publicly released VLMs are vulnerable to such attacks. Our study highlights the urgent need for privacy safeguards as VLMs become increasingly deployed in sensitive domains such as healthcare and finance. Our code and models are available at our project page: https://ngoc-nguyen-0.github.io/SMI_AW/