Variational Model Inversion Attacks