  Transfer learning through the use of pre-trained models has become a growing
trend for the machine learning community. Consequently, numerous pre-trained
models are released online to facilitate further research. However, it raises
extensive concerns on whether these pre-trained models would leak
privacy-sensitive information of their training data. Thus, in this work, we
aim to answer the following questions: "Can we effectively recover private
information from these pre-trained models? What are the sufficient conditions
to retrieve such sensitive information?" We first explore different statistical
information which can discriminate the private training distribution from other
distributions. Based on our observations, we propose a novel private data
reconstruction framework, SecretGen, to effectively recover private
information. Compared with previous methods which can recover private data with
the ground true prediction of the targeted recovery instance, SecretGen does
not require such prior knowledge, making it more practical. We conduct
extensive experiments on different datasets under diverse scenarios to compare
SecretGen with other baselines and provide a systematic benchmark to better
understand the impact of different auxiliary information and optimization
operations. We show that without prior knowledge about true class prediction,
SecretGen is able to recover private data with similar performance compared
with the ones that leverage such prior knowledge. If the prior knowledge is
given, SecretGen will significantly outperform baseline methods. We also
propose several quantitative metrics to further quantify the privacy
vulnerability of pre-trained models, which will help the model selection for
privacy-sensitive applications. Our code is available at:
https://github.com/AI-secure/SecretGen.
