DRAG: Data Reconstruction Attack using Guided Diffusion

1. Actually, there exist a lot of image reconstruction methods, the authors should compare with these methods. Thus, readers can better understand the advantage of the proposed method.
2. The authors should discuss whether the proposed method can be used to the CNN architecture.

• The paper aims to address the problem of reconstructing data in vision transformers in the context of split inference (SI). However, DRAG seems to be not specific to vision transformers. i.e. it can work with any target model architecture (see Algorithm 1). The authors should elaborate on how DRAG specifically addresses the challenges of data reconstruction in vision transformers.

• The experimental setup is unclear. The model's utility and privacy are evaluated on a validation set, $D_{val}$. However, the authors do not provide any information about $D_{val}$. It's unclear whether $D_{val}$ is a subset of the training data or if it's derived from external datasets. A more detailed explanation of $D_{val}$’s source and relationship to the training data would clarify the evaluation process.

• The authors present results for two variants: DRAG and DRAG++. While DRAG++ is used in the tables and figures, a detailed description of DRAG++ is absent from the main text.

• Table 2 is missing some numbers of Acc.

Overall, the writing of the paper should be improved. The paper's abstract, introduction, and methodology should be consistent and coherent. Additionally, the presentation should be enhanced to address missing numbers and typos.

• The paper did not define DRAG++. I just assume it is the learning-based + optimization-based scheme.
• I am a bit unclear about Equation 8. What is the value range of x? If x is in the [0, 1] range, $max(x^2 - 1, 0)$ should be simplified as $1 - x^2$. If x is in a larger value range, e.g., [0, 255], I do not understand the purpose of its second term.
• Why isn't DRAG++ tested when the split point is "Embedding"?
• From the qualitative results in Fig. 3, the algorithms are still hit-and-miss. In most of the tests, DRAG++ is better than DRAG, but in one setting (Fig. 3c), DRAG is better.
• DRAG seems slow. According to the Appendix, it requires more than 2 hours to process 5 samples.

1. The research primarily focuses on the vulnerabilities of the CLIP-ViT-B/16 model but does not assess the effectiveness of the attack on a broader range of architectures. The authors might consider discussing the performance of DRAG on other architecture models or models of different sizes.
2. The paper may require a more detailed discussion of the metrics used to evaluate reconstruction quality. Current evaluations seem to focus primarily on fidelity without fully considering the potential impact of data reconstruction on user privacy.
3. The attack is based on the assumption that the adversary has white-box access to the model architecture and parameters. In practical scenarios, this may not always hold true.
4. Although the paper explores various defense strategies, it lacks an in-depth analysis of their effectiveness. Additionally, the proposed method involves complex processes, such as using auxiliary datasets and multiple reconstruction steps, which may hinder its practical implementation.