In experiments, VAEs trained with the new loss function generatedrealistic,high-qualityimagesamples.

A.1 GLASS Algorithm 1 GAN-based latent space search attack ( GLASS) Require: A standard ResNet-18 network is divided into blocks, as shown in Figure 8. From Similarly, for GLASS, we set the learning rate to 1e-2 and the number of iterations to 20,000. Regarding IN, we selected a learning rate of 1e-3 and performed 30 training epochs. The accuracy of each defended model and its corresponding defense hyperparameters are shown in Table 3. Table 3: Details of defense hyperparameters (we set the split point uniformly to Block3). We train 50 distributions for Shredder, maintaining an accuracy of over 77% for all of them. As Figure 10 shows, the upper left curve implies a better privacy-utility trade-off. NoPeek and DISCO achieve the optimal defensive effect on almost all DRAs.

To overcome these challenges, we propose a G AN-based LA tent S pace S earch attack ( GLASS) that harnesses abundant prior knowledge from public data using advanced StyleGAN technologies. Additionally, we introduce GLASS++ to enhance reconstruction stability.

This observation is an interesting research direction for future works.

Alargenumber ofveryinteresting anduseful applications have emerged due to the ability of GANs to learn complex real-world distributions.

Next consider the case where[ti,ti+1] lies in a range[t`,tr] over which the camera ray is exiting the surface, i.e. the signed distance function is increasing onp(t) over [t`,tr]. Then we have ( f(p(t)) v) < 0 in [ti,ti+1]. Then, according to Eqn. 1, we haveρ(t) = 0. Therefore, by Eqn.12ofthepaper,wehave αi=1 exp Recall that our S-density fieldφs(f(x)) is defined using the logistic density functionφs(x) = se sx/(1+e sx)2, which is the derivative of the Sigmoid functionΦs(x) = (1+e sx) 1, i.e. φs(x)=Φ0s(x). As a first-order approximation of signed distance functionf, suppose that locally the surface is tangentially approximated byasufficiently small planar patch with itsoutwardunitnormal vector denotedas n. Nowsupposep(t)isapoint on the surfaceS,that is, f(p(t)) = 0. Next we will examine the value ofdwdt(t) at t = t . Thesigneddistancefunction f ismodeledbyanMLP that consists of 8hidden layers with hidden size of 256.

Extensive experiments on MSCOCO [16] demonstrate the effectiveness of our method across different training schemes and architectures.