Model Inversion Attack Against Deep Hashing

2025-11-15

AI Summary

Deep hashing improves retrieval efficiency but poses severe privacy risks; prior work has not investigated model inversion attacks against deep hashing models, particularly the feasibility of reconstructing original training data from hash codes. Method: We propose DHMI, the first black-box inversion framework for deep hashing models, introducing diffusion models to this task. DHMI employs semantic hash-center guidance and surrogate-model-driven denoising, jointly optimizing classification consistency and hash proximity to dynamically filter candidate reconstructions. It further incorporates clustering analysis, hash-space optimization, and semantic consistency constraints to achieve high-fidelity image reconstruction—without access to ground-truth training hash codes. Contribution/Results: Extensive experiments on multiple benchmark datasets demonstrate that DHMI significantly outperforms existing black-box inversion methods. This work provides the first systematic evidence of substantial privacy leakage in deep hashing systems, revealing a critical vulnerability previously overlooked in the literature.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Adversarial Attacks & Robustness
• Search and Optimization: Learning to Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Data transparency and provenance
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

Deep hashing improves retrieval efficiency through compact binary codes, yet it introduces severe and often overlooked privacy risks. The ability to reconstruct original training data from hash codes could lead to serious threats such as biometric forgery and privacy breaches. However, model inversion attacks specifically targeting deep hashing models remain unexplored, leaving their security implications unexamined. This research gap stems from the inaccessibility of genuine training hash codes and the highly discrete Hamming space, which prevents existing methods from adapting to deep hashing. To address these challenges, we propose DHMI, the first diffusion-based model inversion framework designed for deep hashing. DHMI first clusters an auxiliary dataset to derive semantic hash centers as surrogate anchors. It then introduces a surrogate-guided denoising optimization method that leverages a novel attack metric (fusing classification consistency and hash proximity) to dynamically select candidate samples. A cluster of surrogate models guides the refinement of these candidates, ensuring the generation of high-fidelity and semantically consistent images. Experiments on multiple datasets demonstrate that DHMI successfully reconstructs high-resolution, high-quality images even under the most challenging black-box setting, where no training hash codes are available. Our method outperforms the existing state-of-the-art model inversion attacks in black-box scenarios, confirming both its practical efficacy and the critical privacy risks inherent in deep hashing systems.

Problem

• Model inversion attacks on deep hashing models remain unexplored
• Reconstructing training data from hash codes risks privacy breaches
• Existing methods fail due to discrete Hamming space constraints

Innovation

• Diffusion-based inversion framework for deep hashing
• Semantic hash centers from auxiliary dataset clustering
• Surrogate-guided denoising optimization with attack metric