1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
\begin{figure}[t]
\centering
\resizebox{.68\textwidth}{!}{%
\begin{tikzpicture}
\node [rectangle,draw,thick,minimum width=1.5cm, minimum height=0.75cm] (targetmodel) {$\targetmodel$};
\node[below of=targetmodel,yshift=-0.3cm,database,database radius=0.4cm,database segment height=0.2cm, label={below:\footnotesize $\traindata: (X, Y)$}] (trainingdata) {};
\node [left of=targetmodel,minimum width=0.75cm,xshift=-0.8cm,fill=red!20,rectangle,draw,thick,label={below:\footnotesize Input}] (inputrecord) {$X'(\omega)$};
\node [right of=targetmodel,xshift=1.5cm,rectangle,draw,thick] (outputpred) {$\targetmodel(X'(\omega))$};
% \node [below of=outputpred,minimum width=1.5cm,rectangle,draw,thick] (explanation) {$\phi(x)$};
\begin{scope}[on background layer]
\node (tm1) [fit=(targetmodel) (trainingdata), fill= gray!20, rounded corners, inner sep=0.1cm, label={above:\footnotesize }] {};
\end{scope}
\node [right of=outputpred,rectangle,draw,thick,minimum width=1.5cm, minimum height=0.75cm,xshift=1.2cm,fill= gray!20] (attmodel) {$\attackmodel$};
\node [right of=attmodel,xshift=0.6cm,minimum width=0.75cm,rectangle,draw,thick] (attout) {$S(\omega)$};
\node[below of=attmodel,database,database radius=0.4cm,database segment height=0.2cm,yshift=-0.3cm, label={below:\footnotesize $\auxdata: (X', Y', S')$}] (auxdata) {};
\begin{scope}[on background layer]
\node (models) [fit=(attmodel) (outputpred) (attout) (auxdata), fill= red!20, rounded corners, inner sep=0.1cm] {};
\end{scope}
\draw[->,ultra thick] (inputrecord.east) -- node[anchor=south, align=center] {\em\footnotesize } (targetmodel.west);
\draw[->,ultra thick] (targetmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (outputpred.west);
% \draw[->,ultra thick] (targetmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (explanation.west);
\draw[->,ultra thick, dashed] (outputpred.east) -- node[anchor=south, align=center] {\em\footnotesize } (attmodel.west);
% \draw[->,ultra thick, dashed] (explanation.east) -- node[anchor=south, align=center] {\em\footnotesize } (attmodel.west);
\draw[->,ultra thick] (attmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (attout.west);
\draw[->,ultra thick,dashed] (trainingdata.north) -- node[anchor=south, align=center,label={[yshift=-0.2cm]right:\footnotesize Train}] {\em\footnotesize } (targetmodel.south);
\draw[->,ultra thick,dashed] (auxdata.north) -- node[anchor=south, align=center,label={[yshift=-0.2cm]right:\footnotesize Train}] {\em\footnotesize } (attmodel.south);
\end{tikzpicture}
}
\vspace{-1mm}
\caption{\adv wants to infer sensitive attributes for an input given its prediction. \adv trains $\attackmodel$ on $\auxdata$ to map $\targetmodel(X'(\omega))$ to $S'(\omega)$. Once trained, \adv only uses $\targetmodel$'s outputs as input to $\attackmodel$ to infer sensitive attributes. \colorbox{red!20}{red} indicates accessible by \adv.}
\vspace{-1mm}
\label{fig:tm2}
\end{figure}
|
