Bridging Black-Box and No-Box: Embedding Reconstruction Attacks on Deep Recognition Systems

Summary

This paper introduces an Embedding Reconstruction Attack (ERA) framework for DNN-based face and speaker recognition systems, covering a four-tier taxonomy of adversary access from score-only and decision-only interfaces down to no-query/no-feedback scenarios. Using Stable Diffusion for faces and flow-matching transformers for voices, the reconstructors achieve 93.27%, 82.60%, and 62.29% success for Tiers 1–3 under identical query budgets, outperforming existing black-box attacks. The authors prove Tier 4 is infeasible under their threat model, and find compressed (pruned, quantized, distilled) models remain at high risk.

Related items

• InfoQCLR: A Plug-in Robustification Module via Quantization for Contrastive Learning in Self-Supervised Skeleton-Based Human Action RecognitionSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoDoes Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive EncodersSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoBRANCH: Bypassing Multi-Scanner AI GuardrailsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoDetecting Adversarial Images through Response Profiles of Vision-Language ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoGraphRectify: Graph-Based Transfer of Adversarial Example Detectors Across Neural NetworksSimilar attack · Arxiv (cs.RO + cs.CV security)