Model Inversion Attack Against Deep Hashing
Dongdong Zhao, Qiben Xu, Ranxin Fang, Baogang Song
TL;DR
DHMI introduces the first diffusion-based model inversion framework for deep hashing, addressing privacy risks when hash codes are discrete and training hashes are inaccessible in a strict black-box setting. It infers semantic hash centers from an auxiliary dataset using a two-stage slice-fused estimation and then guides a conditional diffusion model with a surrogate-model cluster and a novel attack metric $S_{attack}$ to produce high-fidelity, semantically consistent reconstructions. The method outperforms existing label-only attacks across multiple face datasets and hash lengths, demonstrating robust efficacy and highlighting substantial privacy concerns in deep hashing systems. These findings emphasize the need for defense mechanisms against inversion in binary-hash-based retrieval pipelines and motivate future work on strengthening hash-code privacy.
Abstract
Deep hashing improves retrieval efficiency through compact binary codes, yet it introduces severe and often overlooked privacy risks. The ability to reconstruct original training data from hash codes could lead to serious threats such as biometric forgery and privacy breaches. However, model inversion attacks specifically targeting deep hashing models remain unexplored, leaving their security implications unexamined. This research gap stems from the inaccessibility of genuine training hash codes and the highly discrete Hamming space, which prevents existing methods from adapting to deep hashing. To address these challenges, we propose DHMI, the first diffusion-based model inversion framework designed for deep hashing. DHMI first clusters an auxiliary dataset to derive semantic hash centers as surrogate anchors. It then introduces a surrogate-guided denoising optimization method that leverages a novel attack metric (fusing classification consistency and hash proximity) to dynamically select candidate samples. A cluster of surrogate models guides the refinement of these candidates, ensuring the generation of high-fidelity and semantically consistent images. Experiments on multiple datasets demonstrate that DHMI successfully reconstructs high-resolution, high-quality images even under the most challenging black-box setting, where no training hash codes are available. Our method outperforms the existing state-of-the-art model inversion attacks in black-box scenarios, confirming both its practical efficacy and the critical privacy risks inherent in deep hashing systems.