Model Inversion Attack Against Deep Hashing

• URL: http://arxiv.org/abs/2511.12233v2
• Date: Fri, 21 Nov 2025 11:52:36 GMT
• Title: Model Inversion Attack Against Deep Hashing
• Authors: Dongdong Zhao, Qiben Xu, Ranxin Fang, Baogang Song,
• Abstract summary: DHMI is the first diffusion-based model inversion framework designed for deep hashing.<n>It reconstructs high-resolution, high-quality images even under the most challenging black-box setting.<n>Our method outperforms the existing state-of-the-art model inversion attacks in black-box scenarios.
• Score: 0.9055220224305597
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Deep hashing improves retrieval efficiency through compact binary codes, yet it introduces severe and often overlooked privacy risks. The ability to reconstruct original training data from hash codes could lead to serious threats such as biometric forgery and privacy breaches. However, model inversion attacks specifically targeting deep hashing models remain unexplored, leaving their security implications unexamined. This research gap stems from the inaccessibility of genuine training hash codes and the highly discrete Hamming space, which prevents existing methods from adapting to deep hashing. To address these challenges, we propose DHMI, the first diffusion-based model inversion framework designed for deep hashing. DHMI first clusters an auxiliary dataset to derive semantic hash centers as surrogate anchors. It then introduces a surrogate-guided denoising optimization method that leverages a novel attack metric (fusing classification consistency and hash proximity) to dynamically select candidate samples. A cluster of surrogate models guides the refinement of these candidates, ensuring the generation of high-fidelity and semantically consistent images. Experiments on multiple datasets demonstrate that DHMI successfully reconstructs high-resolution, high-quality images even under the most challenging black-box setting, where no training hash codes are available. Our method outperforms the existing state-of-the-art model inversion attacks in black-box scenarios, confirming both its practical efficacy and the critical privacy risks inherent in deep hashing systems.

Related papers

• DiffHash: Text-Guided Targeted Attack via Diffusion Models against Deep Hashing Image Retrieval [8.42949283173691]
  Deep hashing models have been widely adopted to tackle the challenges of large-scale image retrieval.<n>Deep hashing models face serious security risks due to their vulnerability to adversarial examples.<n>We propose DiffHash, a novel diffusion-based targeted attack for deep hashing.
  arXiv  Detail & Related papers  (2025-09-16T08:49:53Z)
• Clean Image May be Dangerous: Data Poisoning Attacks Against Deep Hashing [71.30876587855867]
  We show that even clean query images can be dangerous, inducing malicious target retrieval results, like undesired or illegal images.<n>Specifically, we first train a surrogate model to simulate the behavior of the target deep hashing model.<n>Then, a strict gradient matching strategy is proposed to generate the poisoned images.
  arXiv  Detail & Related papers  (2025-03-27T07:54:27Z)
• Semantic-Aware Adversarial Training for Reliable Deep Hashing Retrieval [26.17466361744519]
  Adversarial examples pose a security threat to deep hashing models. Adversarial examples fabricated by maximizing the Hamming distance between the hash codes of adversarial samples and mainstay features. For the first time, we formulate the formalized adversarial training of deep hashing into a unified minimax structure.
  arXiv  Detail & Related papers  (2023-10-23T07:21:40Z)
• Sparse-Inductive Generative Adversarial Hashing for Nearest Neighbor Search [8.020530603813416]
  We propose a novel unsupervised hashing method, termed Sparsity-Induced Generative Adversarial Hashing (SiGAH) SiGAH encodes large-scale high-scale high-dimensional features into binary codes, which solves the two problems through a generative adversarial training framework. Experimental results on four benchmarks, i.e. Tiny100K, GIST1M, Deep1M, and MNIST, have shown that the proposed SiGAH has superior performance over state-of-the-art approaches.
  arXiv  Detail & Related papers  (2023-06-12T08:07:23Z)
• CgAT: Center-Guided Adversarial Training for Deep Hashing-Based Retrieval [12.421908811085627]
  We present a min-max based Center-guided Adversarial Training, namely CgAT, to improve the iteration of deep hashing networks. CgAT learns to mitigate the effects of adversarial samples by minimizing the Hamming distance to the center codes. Compared with the current state-of-the-art defense method, we significantly improve the defense performance by an average of 18.61%.
  arXiv  Detail & Related papers  (2022-04-18T04:51:08Z)
• Prototype-supervised Adversarial Network for Targeted Attack of Deep Hashing [65.32148145602865]
  deep hashing networks are vulnerable to adversarial examples. We propose a novel prototype-supervised adversarial network (ProS-GAN) To the best of our knowledge, this is the first generation-based method to attack deep hashing networks.
  arXiv  Detail & Related papers  (2021-05-17T00:31:37Z)
• Unsupervised Hashing with Contrastive Information Bottleneck [39.607741586731336]
  We propose to adapt a framework to learn binary hashing codes. Specifically, we first propose to modify the objective function to meet the specific requirement of hashing. We then introduce a probabilistic binary representation layer into the model to facilitate end-to-end training.
  arXiv  Detail & Related papers  (2021-05-13T08:30:16Z)
• CIMON: Towards High-quality Hash Codes [63.37321228830102]
  We propose a new method named textbfComprehensive stextbfImilarity textbfMining and ctextbfOnsistency leartextbfNing (CIMON) First, we use global refinement and similarity statistical distribution to obtain reliable and smooth guidance. Second, both semantic and contrastive consistency learning are introduced to derive both disturb-invariant and discriminative hash codes.
  arXiv  Detail & Related papers  (2020-10-15T14:47:14Z)
• Deep Momentum Uncertainty Hashing [65.27971340060687]
  We propose a novel Deep Momentum Uncertainty Hashing (DMUH) It explicitly estimates the uncertainty during training and leverages the uncertainty information to guide the approximation process. Our method achieves the best performance on all of the datasets and surpasses existing state-of-the-art methods by a large margin.
  arXiv  Detail & Related papers  (2020-09-17T01:57:45Z)
• Deep Hashing with Hash-Consistent Large Margin Proxy Embeddings [65.36757931982469]
  Image hash codes are produced by binarizing embeddings of convolutional neural networks (CNN) trained for either classification or retrieval. The use of a fixed set of proxies (weights of the CNN classification layer) is proposed to eliminate this ambiguity. The resulting hash-consistent large margin (HCLM) proxies are shown to encourage saturation of hashing units, thus guaranteeing a small binarization error.
  arXiv  Detail & Related papers  (2020-07-27T23:47:43Z)
• Targeted Attack for Deep Hashing based Retrieval [57.582221494035856]
  We propose a novel method, dubbed deep hashing targeted attack (DHTA), to study the targeted attack on such retrieval. We first formulate the targeted attack as a point-to-set optimization, which minimizes the average distance between the hash code of an adversarial example and those of a set of objects with the target label. To balance the performance and perceptibility, we propose to minimize the Hamming distance between the hash code of the adversarial example and the anchor code under the $ellinfty$ restriction on the perturbation.
  arXiv  Detail & Related papers  (2020-04-15T08:36:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.