Data Leakage Attack via Backdoor Misclassification Triggers of Deep Learning Models

In recent years, deep neural networks (DNNs) have been successfully applied in various tasks, and various third-party models are available to data holders. However, data holders who blindly use third-party models to train on their data may lead to data leakage, resulting in serious data privacy problems. The Capacity Abuse Attack (CAA) is the state-of-the-art black-box attack method which uses the labels of the augmented malicious dataset to encode the information of the training data. However, the expanded malicious dataset in CAA are artificially synthesized, not natural images, and significantly different from the original training data. Thus these malicious images are easy to be detected. In our attack, we use a technique similar to generating poisoned datasets in backdoor attacks, make malicious data generated similar to real and natural images, and make our attack more concealed. Extensive experiments are conducted, and the results demonstrate that our attack can effectively obtain the private training data of data holders without significantly impacting the model's original task.