[Paper Review] InstaHide's Sample Complexity When Mixing Two Private Images

Baihe Huang, Zhao Song+4 more|arXiv (Cornell University)|Nov 24, 2020

Generative Adversarial Networks and Image Synthesis19 references4 citations

TL;DR

This paper proposes a provably secure algorithm to recover all private images in InstaHide when two private images are mixed, achieving optimal sample complexity of $\Omega(n_{\mathsf{priv}}\log n_{\mathsf{priv}}})$ samples. It introduces a unified framework for analyzing InstaHide attacks, demonstrating that while InstaHide is not information-theoretically secure, it remains computationally secure under worst-case assumptions.

ABSTRACT

Training neural networks usually require large numbers of sensitive training data, and how to protect the privacy of training data has thus become a critical topic in deep learning research. InstaHide is a state-of-the-art scheme to protect training data privacy with only minor effects on test accuracy, and its security has become a salient question. In this paper, we systematically study recent attacks on InstaHide and present a unified framework to understand and analyze these attacks. We find that existing attacks either do not have a provable guarantee or can only recover a single private image. On the current InstaHide challenge setup, where each InstaHide image is a mixture of two private images, we present a new algorithm to recover all the private images with a provable guarantee and optimal sample complexity. In addition, we also provide a computational hardness result on retrieving all InstaHide images. Our results demonstrate that InstaHide is not information-theoretically secure but computationally secure in the worst case, even when mixing two private images.

Motivation & Objective

• To analyze the sample complexity required to recover private images in InstaHide when two private images are mixed.
• To develop a provably correct algorithm that recovers all private images using minimal samples.
• To establish a unified framework for comparing existing InstaHide attacks and identifying their structural similarities and differences.
• To prove computational hardness of the core recovery problem, showing that efficient algorithms are unlikely under standard complexity assumptions.

Proposed method

• The algorithm solves a system of equations involving private images, public images, and sign-flipped mixtures by testing all possible sign patterns across samples.
• It uses $\ell_2$-regression to estimate private image weights for each pixel, constrained by sign consistency with observed mixtures.
• A key step involves reconstructing a line graph from the mixture data, linking the attack to graph isomorphism problems.
• The method systematically checks all $2^m$ sign combinations for $m$ samples to identify consistent solutions for each pixel.
• Theoretical analysis reduces the $\ell_2$-regression with hidden signs to the MAX-CUT problem, proving NP-hardness.
• The framework enables comparison of existing attacks by decomposing them into functional components such as Gram matrix estimation and sign recovery.

Experimental results

Research questions

• RQ1 What is the minimal number of InstaHide samples required to recover all private images when two are mixed?
• RQ2 How does the proposed algorithm improve upon prior theoretical bounds in terms of sample complexity?
• RQ3 What is the computational complexity of recovering private images under the InstaHide mixture model?
• RQ4 Can the core recovery problem be reduced to a known hard problem like MAX-CUT?
• RQ5 How do existing heuristic attacks compare in structure and functionality to the proposed provable method?

Key findings

• The proposed algorithm recovers all private images using only $\Omega(n_{\mathsf{priv}}\log n_{\mathsf{priv}}})$ samples, significantly improving over the prior bound of $n_{\mathsf{priv}}^{4/3}$ samples for recovering a single image.
• The sample complexity is optimal up to logarithmic factors, indicating that InstaHide is not information-theoretically secure under the current setup.
• The core recovery problem is proven to be NP-hard via reduction from the MAX-CUT problem, establishing computational hardness.
• The algorithm runs in exponential time in $n_{\mathsf{priv}}$ but polynomial time in $n_{\mathsf{pub}}$, highlighting a trade-off between sample efficiency and computational cost.
• The framework reveals that existing attacks share structural similarities, particularly in how they handle sign patterns and Gram matrix estimation.
• Under the exponential time hypothesis (ETH), subexponential-time algorithms for the recovery problem cannot achieve constant-factor approximation, reinforcing computational security.