New SARA attack reconstructs images from ViT embeddings, bypassing privacy measures

Researchers have developed a new feature inversion attack called SARA that can reconstruct input images from Vision Transformer (ViT) embeddings transmitted in split-inference systems. Despite token shuffling and reduction techniques intended to enhance privacy, SARA demonstrates that positional information is retained in the embeddings. The attack involves predicting token positions, restoring spatial layout, and using a masked autoencoder to reconstruct missing embeddings. While token reduction offers some protection, significant information leakage persists. A proposed defense involves removing positional embeddings and adapting transformer blocks via knowledge distillation, which substantially reduces attack performance while maintaining downstream task accuracy. AI

IMPACT Highlights potential privacy vulnerabilities in split-inference systems using ViTs, necessitating stronger defenses.

RANK_REASON Academic paper detailing a new attack method and defense. [lever_c_demoted from research: ic=1 ai=1.0]

Read on arXiv cs.AI →

• arXiv
• Masked Autoencoder
• Spatially Aligned Reconstruction Attack
• Vision Transformers
• Vít

• paper
• safety

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →