Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: A Fusion-Denoising Attack on InstaHide with Data Augmentation   InstaHide is a state-of-the-art mechanism for protecting private training
images, by mixing multiple private images and modifying them such that their
visual features are indistinguishable to the naked eye. In recent work,
however, Carlini et al. show that it is possible to reconstruct private images
from the encrypted dataset generated by InstaHide. Nevertheless, we demonstrate
that Carlini et al.'s attack can be easily defeated by incorporating data
augmentation into InstaHide. This leads to a natural question: is InstaHide
with data augmentation secure? In this paper, we provide a negative answer to
this question, by devising an attack for recovering private images from the
outputs of InstaHide even when data augmentation is present. The basic idea is
to use a comparative network to identify encrypted images that are likely to
correspond to the same private image, and then employ a fusion-denoising
network for restoring the private image from the encrypted ones, taking into
account the effects of data augmentation. Extensive experiments demonstrate the
effectiveness of the proposed attack in comparison to Carlini et al.'s attack.

22
The categories of this paper are: chao-dyn
31
The categories of this paper are: ao-sci
18
The categories of this paper are: econ
19
The categories of this paper are: eess
30
The categories of this paper are: q-alg
16
The categories of this paper are: stat
32
The categories of this paper are: atom-ph
2
The categories of this paper are: math
10
The categories of this paper are: q-bio
3
The categories of this paper are: physics
6
The categories of this paper are: astro-ph
0
The categories of this paper are: hep-ph
24
The categories of this paper are: dg-ga
11
The categories of this paper are: hep-lat
37
The categories of this paper are: supr-con
33
The categories of this paper are: plasm-ph