2.5 KiB
Implementation of our reconstruction attack on InstaHide.
Is Private Learning Possible with Instance Encoding? Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Shuang Song, Abhradeep Thakurta, Florian Tramer https://arxiv.org/abs/2011.05315
Overview
InstaHide is a recent privacy-preserving machine learning framework. It takes a (sensitive) dataset and generates encoded images that are privacy-preserving. Our attack breaks InstaHide and shows it does not offer meaningful privacy. Given the encoded dataset, we can recover a near-identical copy of the original images.
This repository implements the attack described in our paper. It consists of a number of steps that shoul be run sequentially. It assumes access to pre-trained neural network classifiers that should be downloaded following the steps below.
Requirements
- Python, version ≥ 3.5
- jax
- jaxlib
- objax (https://github.com/google/objax)
- PIL
- sklearn
Running the attack
To reproduce our results and run the attack, each of the files should be run in turn.
- Download the necessary dependency files:
- (encryption.npy)[https://www.dropbox.com/sh/8zdsr1sjftia4of/AAA-60TOjGKtGEZrRmbawwqGa?dl=0] and (labels.npy)[https://www.dropbox.com/sh/8zdsr1sjftia4of/AAA-60TOjGKtGEZrRmbawwqGa?dl=0] from the (InstaHide Challenge)[https://github.com/Hazelsuko07/InstaHide_Challenge]
- The (saved models)[https://drive.google.com/file/d/1YfKzGRfnnzKfUKpLjIRXRto8iD4FdwGw/view?usp=sharing] used to run the attack
- Set up all the requirements as above
-
Run
step_1_create_graph.py. Produce the similarity graph to pair together encoded images that share an original image. -
Run
step_2_color_graph.py. Color the graph to find 50 dense cliques. -
Run
step_3_second_graph.py. Create a new bipartite similarity graph. -
Run
step_4_final_graph.py. Solve the matching problem to assign encoded images to original images. -
Run
step_5_reconstruct.py. Reconstruct the original images. -
Run
step_6_adjust_color.py. Adjust the color curves to match. -
Run
step_7_visualize.py. Show the final resulting images.
Citation
You can cite this attack at
@inproceedings{carlini2021private,
title={Is Private Learning Possible with Instance Encoding?},
author={Carlini, Nicholas and Deng, Samuel and Garg, Sanjam and Jha, Somesh and Mahloujifar, Saeed and Mahmoody, Mohammad and Thakurta, Abhradeep and Tram{\`e}r, Florian},
booktitle={2021 IEEE Symposium on Security and Privacy (SP)},
pages={410--427},
year={2021},
organization={IEEE}
}