Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift.