Label-Only Model Inversion Attacks via Knowledge Transfer