AI classifiers can help recreate private training images

A new attack produced more faithful images from classifiers when it had full access to their internal settings.

Editorial illustration — not from the study.

The study presents Diff-MI, a two-stage attack designed for situations in which an attacker has full access to an AI classifier. It first trains a conditional image generator using public images and labels inferred from the classifier, then repeatedly reconstructs images using both the generator and information from the classifier.

Across datasets and model types, the method improved the visual fidelity of reconstructed images compared with existing approaches. The authors report an average 20% reduction in FID, a measure in which lower scores generally indicate that generated images are closer to real ones, while keeping competitive attack accuracy.

More faithful reconstructions

Diff-MI produced more faithful reconstructions than existing model-inversion attacks in experiments across several datasets and classifier models. The authors report an average 20% decrease in FID compared with state-of-the-art methods, while attack accuracy remained competitive. On the CUB-200-2011 bird dataset, the method outperformed the tested baselines on all reported measures and reduced FID by more than 50% compared with them. On the ChestX-Ray medical dataset, it achieved nearly the best results across the reported measures and reduced FID by an average of 45%. The reconstructed bird images captured details such as beak shape, wing coloration and tail length, according to the study’s visual comparisons.

A privacy concern for classifiers

The results show that an AI classifier can provide enough information for an attacker with full internal access to generate images that resemble examples from the classifier’s private training data. More faithful reconstructions could make such attacks a greater privacy concern in applications that use sensitive images, including medical images. The study therefore highlights the need to consider information revealed by classifiers, not only their prediction accuracy, when assessing privacy.

Tests and limitations

The evidence comes from experiments comparing Diff-MI with earlier attacks across different datasets and model architectures, rather than from an assessment of deployed systems or real-world attackers. The method is a white-box attack: it assumes access to all parameters of the target classifier, knowledge of the private data type and a public dataset of the same type. It also requires training a target-specific image generator from scratch, which adds computational cost. The authors report a continuing trade-off between image fidelity and attack accuracy, and say future work will examine pretrained diffusion models and settings in which the attacker has less access.

Ninety-two antiprotons make a 7.5-kilometre road trip

Researchers transported 92 trapped antiprotons 7.5 kilometres by road without losing particles or measurably worsening the trap’s vacuum. The demonstration could allow future matter–antimatter tests in laboratories with less magnetic-field noise than CERN’s Antimatter Factory.

9 hours ago·3 views

Physics & Space

A lensless microscope images an entire half-millimeter-thick mouse brain slice

Researchers report a lensless microscope that imaged an entire 500-micrometer-thick, optically cleared mouse-brain slice without labels. The system combines a large field of view with millimeter-scale depth and approximately 2.4-micrometer pixel-level resolution, reaching a three-dimensional imaging volume above a gigavoxel scale in tests.

3 days ago·23 views

Physics & Space

A bright beam of muonium could put gravity to a new test

Researchers report a bright, narrow beam of muonium made by extracting it from a thin layer of superfluid helium. The beam is expected to enable a new test of gravity and more precise measurements of the muon.

3 days ago·41 views