{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/label-only-model-inversion-attacks-via-1","title":"Label-Only Model Inversion Attacks via Knowledge Transfer","arxiv_id":"2310.19342","date":"2023-10-30","proceeding":"NeurIPS 2023 11","authors":[],"abstract":"In a model inversion (MI) attack, an adversary abuses access to a machine learning (ML) model to infer and reconstruct private training data. Remarkable progress has been made in the white-box and black-box setups, where the adversary has access to the complete model or the model's soft output respectively. However, there is very limited study in the most challenging but practically important setup: Label-only MI attacks, where the adversary only has access to the model's predicted label (hard label) without confidence scores nor any other model information. In this work, we propose LOKT, a novel approach for label-only MI attacks. Our idea is based on transfer of knowledge from the opaque target model to surrogate models. Subsequently, using these surrogate models, our approach can harness advanced white-box attacks. We propose knowledge transfer based on generative modelling, and introduce a new model, Target model-assisted ACGAN (T-ACGAN), for effective knowledge transfer. Our method casts the challenging label-only MI into the more tractable white-box setup. We provide analysis to support that surrogate models based on our approach serve as effective proxies for the target model for MI. Our experiments show that our method significantly outperforms existing SOTA Label-only MI attack by more than 15% across all MI benchmarks. Furthermore, our method compares favorably in terms of query budget. Our study highlights rising privacy threats for ML models even when minimal information (i.e., hard labels) is exposed. Our study highlights rising privacy threats for ML models even when minimal information (i.e., hard labels) is exposed. Our code, demo, models and reconstructed data are available at our project page: https://ngoc-nguyen-0.github.io/lokt/","url_abs":"https://arxiv.org/abs/2310.19342v1","url_pdf":"https://arxiv.org/pdf/2310.19342v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"label-only-model-inversion-attacks-via-1","repo_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"transfer-learning","task_name":"Transfer Learning"},{"task_slug":"model","task_name":"model"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2310.19342","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.19342"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/AlanPeng0897/Defend_MI","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/Jiachen-T-Wang/mi-defense","reach":{"status":"ok"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/ageitgey/face_recognition","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023","reach":null}],"summary":{"ran":7,"ran_honours":3,"ran_draft_wrong":2,"ran_fixture":1,"unverified":18},"by_repo_kind":{"official":{"samples":7,"ran":4,"repositories":1},"found_in_text":{"samples":19,"ran":7,"repositories":2},"community":{"samples":4,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":13,"samples":[{"code_sha256_prefix":"91738ef0d0844a36","entry":"Inversion","repo":"Jiachen-T-Wang/mi-defense","repo_kind":"found_in_text","path":"knowledge_align/model.py","file_url":"https://github.com/Jiachen-T-Wang/mi-defense/blob/HEAD/knowledge_align/model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"91738ef0d0844a36"}},{"code_sha256_prefix":"4d7100d163a0ad4f","entry":"ResNet18","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/model.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4d7100d163a0ad4f"}},{"code_sha256_prefix":"c808ba0601a877e8","entry":"cross_entropy_loss","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c808ba0601a877e8"}},{"code_sha256_prefix":"6d7145cc1578db8c","entry":"filter_indices","repo":"val-iisc/hard-label-model-stealing","repo_kind":"community","path":"code/train_student/train_student.py","file_url":"https://github.com/val-iisc/hard-label-model-stealing/blob/HEAD/code/train_student/train_student.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6d7145cc1578db8c"}},{"code_sha256_prefix":"5140f76be90b05a2","entry":"get_in_channels","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/model.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5140f76be90b05a2"}},{"code_sha256_prefix":"c41836f3e51fa8f1","entry":"gram_schmidt","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"VMI/layers.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/VMI/layers.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c41836f3e51fa8f1"}},{"code_sha256_prefix":"aa4cae054b657ba2","entry":"imread","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"GMI/fid_score_raw.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/GMI/fid_score_raw.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"aa4cae054b657ba2"}},{"code_sha256_prefix":"e8dfc0e2df364d99","entry":"imread","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"DMI/fid_score.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/DMI/fid_score.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e8dfc0e2df364d99"}},{"code_sha256_prefix":"7a46ab6d33c637db","entry":"imread","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"DMI/fid_score_raw.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/DMI/fid_score_raw.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a46ab6d33c637db"}},{"code_sha256_prefix":"342f31bfe572d0c8","entry":"max_margin_loss","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"342f31bfe572d0c8"}},{"code_sha256_prefix":"9917ee672087e236","entry":"mixup_data","repo":"val-iisc/hard-label-model-stealing","repo_kind":"community","path":"code/train_student/train_student.py","file_url":"https://github.com/val-iisc/hard-label-model-stealing/blob/HEAD/code/train_student/train_student.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9917ee672087e236"}},{"code_sha256_prefix":"b6e4cb9cdcdb7226","entry":"poincare_loss","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b6e4cb9cdcdb7226"}},{"code_sha256_prefix":"e419b5eab5a4c10e","entry":"sample_z","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e419b5eab5a4c10e"}},{"code_sha256_prefix":"d30f849071ebea54","entry":"ResNet10","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/backbone.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/backbone.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d30f849071ebea54"}},{"code_sha256_prefix":"83d772c48bd4e1cc","entry":"ResNet10_64","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/backbone.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/backbone.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"83d772c48bd4e1cc"}},{"code_sha256_prefix":"231adc85ec00eba1","entry":"ResNetL_IH","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/backbone.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/backbone.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"231adc85ec00eba1"}},{"code_sha256_prefix":"0def50a351111624","entry":"calculate_frechet_distance","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"DMI/fid_score.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/DMI/fid_score.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0def50a351111624"}},{"code_sha256_prefix":"c9de4689c018d059","entry":"filter_indices","repo":"val-iisc/hard-label-model-stealing","repo_kind":"community","path":"code/train_generator/train_gen.py","file_url":"https://github.com/val-iisc/hard-label-model-stealing/blob/HEAD/code/train_generator/train_gen.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c9de4689c018d059"}},{"code_sha256_prefix":"56afde1af5757691","entry":"get_activations","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"GMI/fid_score_raw.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/GMI/fid_score_raw.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"56afde1af5757691"}},{"code_sha256_prefix":"8dcbb65408aae9e3","entry":"get_activations","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"DMI/fid_score.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/DMI/fid_score.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8dcbb65408aae9e3"}},{"code_sha256_prefix":"c945372835eb9223","entry":"get_activations","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"DMI/fid_score_raw.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/DMI/fid_score_raw.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c945372835eb9223"}},{"code_sha256_prefix":"7a33df383fc5fb9d","entry":"get_activations","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"GMI/fid_score.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/GMI/fid_score.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a33df383fc5fb9d"}},{"code_sha256_prefix":"9dcd16e6960e3b6b","entry":"get_model_accuracy","repo":"val-iisc/hard-label-model-stealing","repo_kind":"community","path":"code/train_generator/train_gen.py","file_url":"https://github.com/val-iisc/hard-label-model-stealing/blob/HEAD/code/train_generator/train_gen.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9dcd16e6960e3b6b"}},{"code_sha256_prefix":"32b21a45b3401a1a","entry":"inversion","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"32b21a45b3401a1a"}},{"code_sha256_prefix":"d8ff7dc2584b42c8","entry":"make_layers","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"BiDO/model.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/BiDO/model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d8ff7dc2584b42c8"}},{"code_sha256_prefix":"cd1a232569d08a1b","entry":"parse_kwargs","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"VMI/model_utils.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/VMI/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cd1a232569d08a1b"}},{"code_sha256_prefix":"28d3a35157f2916d","entry":"power_iteration","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"VMI/layers.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/VMI/layers.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"28d3a35157f2916d"}},{"code_sha256_prefix":"4015ab1f3ab9b881","entry":"proj","repo":"AlanPeng0897/Defend_MI","repo_kind":"found_in_text","path":"VMI/layers.py","file_url":"https://github.com/AlanPeng0897/Defend_MI/blob/HEAD/VMI/layers.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4015ab1f3ab9b881"}},{"code_sha256_prefix":"d34a085d71b8f4b5","entry":"rand_bbox","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"d34a085d71b8f4b5"}},{"code_sha256_prefix":"8a7eec0e2a16469a","entry":"save_tensor_images","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8a7eec0e2a16469a"}},{"code_sha256_prefix":"e4778d33af343c8c","entry":"set_random_seed","repo":"ngoc-nguyen-0/LOKT_neurips2023","repo_kind":"official","path":"plg_tacgan.py","file_url":"https://github.com/ngoc-nguyen-0/LOKT_neurips2023/blob/HEAD/plg_tacgan.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e4778d33af343c8c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}