A new research paper details a feature inversion attack called SARA that can reconstruct input images from Vision Transformer (ViT) embeddings transmitted in split-inference systems. The attack demonstrates that token shuffling offers minimal privacy, while token reduction provides some protection but still allows for significant information leakage. Researchers also proposed an edge-side defense mechanism involving the removal of positional embeddings and knowledge distillation to mitigate these attacks. AI
IMPACT Highlights potential privacy risks in split-inference systems for Vision Transformers and proposes a defense mechanism.
RANK_REASON Research paper detailing a new attack method and defense for Vision Transformers.
- arXiv
- Masked Autoencoder
- Spatially Aligned Reconstruction Attack
- Vision Transformers
- Vít
- feature inversion attacks
- knowledge distillation
- Positional embeddings for document processing
- token reduction
- token shuffling
AI-generated summary · Google Gemini · from 2 sources. How we write summaries →
