Table 4 Attack performance comparison across different model architectures during the GAN training phase and the image reconstruction phase. ↑and ↓ respectively symbolize that higher and lower scores give better attack performance.
From: Enhanced model inversion via frequency disentanglement and latent space optimization
FaceScrub-CelebA | VGG16 | FaceNet64 | IR152 | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
ACC@1↑ | FID↓ | KNN↓ | ACC@1↑ | FID↓ | KNN↓ | ACC@1↑ | FID↓ | KNN↓ | ||
VGG16 | PLG_MI | 0.48 ± 0.0030 | 30.35 | 1520.50 | 0.71 ± 0.0020 | 26.85 | 1414.89 | 0.77 ± 0.0014 | 29.40 | 1340.56 |
Ours(wo/WT) | 0.53 ± 0.0015 | 23.95 | 1479.89 | 0.71 ± 0.0025 | 25.08 | 1364.19 | 0.78 ± 0.0022 | 24.81 | 1308.65 | |
Ours | 0.55 ± 0.0032 | 24.95 | 1485.43 | 0.72 ± 0.0021 | 25.37 | 1365.59 | 0.77 ± 0.0022 | 24.94 | 1318.44 | |
IR152 | PLG_MI | 0.51 ± 0.0031 | 25.32 | 1488.44 | 0.64 ± 0.0010 | 24.69 | 1446.20 | 0.64 ± 0.0023 | 23.64 | 1423.13 |
Ours(wo/WT) | 0.57 ± 0.0025 | 23.88 | 1459.13 | 0.66 ± 0.0021 | 24.02 | 1414.76 | 0.66 ± 0.0017 | 23.28 | 1395.70 | |
Ours | 0.59 ± 0.0024 | 24.42 | 1437.02 | 0.69 ± 0.0020 | 24.15 | 1406.23 | 0.69 ± 0.0022 | 21.49 | 1390.25 | |
FaceNet64 | PLG_MI | 0.46 ± 0.0012 | 26.29 | 1520.18 | 0.55 ± 0.0018 | 26.33 | 1532.04 | 0.66 ± 0.0027 | 25.42 | 1403.75 |
Ours(wo/WT) | 0.49 ± 0.0015 | 25.53 | 1488.78 | 0.55 ± 0.0025 | 25.72 | 1482.68 | 0.66 ± 0.0016 | 24.80 | 1376.42 | |
Ours | 0.51 ± 0.0024 | 24.21 | 1481.48 | 0.57 ± 0.0018 | 25.68 | 1484.89 | 0.70 ± 0.0019 | 25.03 | 1381.08 | |
