稀疏协作推理中,位置信息比数值更危险,可能泄露隐私。
A Privacy Study of Sparse Collaborative Inference

- 将稀疏激活分解为数值和位置,分别测试其泄露风险。
- 位置信息单独就能高保真重建图像并识别身份,风险远高于预期。
- 适用于关注边缘计算隐私的开发者与安全研究人员。
协作推理(CI)将模型拆分至边缘设备与服务器间,客户端计算中间激活并传输,服务器完成后续计算。这引发通信开销与输入隐私泄露双重担忧。近期工作通过稀疏化激活并熵编码降低传输成本。尽管稀疏性被视作提升隐私的手段,我们通过分解稀疏激活为保留值与位置集合,并分别重建输入,发现稀疏化对泄漏的抑制远弱于对传输成本的降低。位置信息本身构成严重隐私风险,在自然图像与人脸数据集上可实现高保真重建与个体重识别。即使在低通信成本与任务效用条件下,位置泄露仍持续存在。结论:稀疏激活的位置应视为敏感传输数据,需在协作推理中严格审计。代码见 https://github.com/an7123/Privacy-Study-Sparse-CI。
原文摘要 · Abstract (English)
Collaborative inference (CI) splits a model between an edge device and a server, whereby the client computes an intermediate activation, transmits it, and the server completes the computation. This raises two concerns, the communication cost of the transmission and the risk that it reveals private information about the input. Recent work reduces this cost by sparsifying activations and entropy-coding the result. Sparsity has also been argued to improve privacy, on the intuition that transmitting fewer values reveals less about the input. We test this claim by decomposing the sparse activation into the retained values and the set of positions they occupy, and by reconstructing inputs from each component in isolation. We find that sparsification reduces the leakage far less than it reduces the transmission cost, and that the remaining risk shifts to the positions, which prior analyses treat as side information for decoding. Across natural-image and face datasets, the positions alone constitute a serious privacy risk, enabling high-fidelity reconstructions and re-identification of individuals. The leakage from the positions persists even when both the transmission cost and the task utility are low. We conclude that the positions of sparse activations should be treated as sensitive transmitted data and audited carefully in the context of collaborative inference. Code is available at https://github.com/an7123/Privacy-Study-Sparse-CI.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。