通过分解冗余信息，实现隐私保护与模型性能的更好平衡
InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inference
- 先分离并剔除数据中的冗余信息，再针对性加噪
- 在保持模型精度的同时显著提升隐私保护能力
- 特别适合客户端模型较浅的视觉任务场景
分割推理（SI）允许用户在不直接传输原始数据的情况下使用深度学习服务。然而，近期研究发现，数据重建攻击（DRAs）可从客户端发送给服务器的压缩数据中恢复原始输入，造成严重隐私泄露。尽管已有多种防御方法，但常导致性能大幅下降，尤其在客户端模型较浅时更为明显。我们识别出这一权衡的关键原因：现有防御对压缩数据中的冗余信息施加了过多扰动。为应对计算机视觉任务中的该问题，我们提出InfoDecom框架：首先分解并移除冗余信息，再注入符合理论隐私保障的噪声。实验表明，InfoDecom相比现有基线，在实用性和隐私保护之间实现了更优平衡。
原文摘要 · Abstract (English)
Split inference (SI) enables users to access deep learning (DL) services without directly transmitting raw data. However, recent studies reveal that data reconstruction attacks (DRAs) can recover the original inputs from the smashed data sent from the client to the server, leading to significant privacy leakage. While various defenses have been proposed, they often result in substantial utility degradation, particularly when the client-side model is shallow. We identify a key cause of this trade-off: existing defenses apply excessive perturbation to redundant information in the smashed data. To address this issue in computer vision tasks, we propose InfoDecom, a defense framework that first decomposes and removes redundant information and then injects noise calibrated to provide theoretically guaranteed privacy. Experiments demonstrate that InfoDecom achieves a superior utility-privacy trade-off compared to existing baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。