In the paper it was not clearly addressed how exactly they split data for training and attack. Do they use the same dataset completely, or they left out a part of it for the inversion/inference attack models?
Do we assume that attackes know the dataset the "defending" model is trained on and we just have to deduce from features x what image I it originally was?
Inversion attack 2 (first variation does not deal with complex numbers) is taking input x trying to deduce I, but the input is complex. Can we assume that we can just concatenate real and imaginary parts of the inputs?
We found that utilization of separate optimizers for the whole network and WGAN parts improves the speed of training almost 10 times without the loss of accuracy. Is it a good idea to stick to use this implementation and not use the proposed implementation where there is one optimizer and the loss is computed as the sum of WGAN loss and Task loss?
@deZakelijke, could you please help us by answering these questions?
Some of the question that we have right now:
We found that utilization of separate optimizers for the whole network and WGAN parts improves the speed of training almost 10 times without the loss of accuracy. Is it a good idea to stick to use this implementation and not use the proposed implementation where there is one optimizer and the loss is computed as the sum of WGAN loss and Task loss?
@deZakelijke, could you please help us by answering these questions?