Research map / Adversarial robustness and security / Attacks on text and graphs
Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proves conditional entropy of inputs given intermediate features lower-bounds reconstruction MSE under any model inversion attack, derives a differentiable Gaussian-mixture bound, and adds it as a plug-in loss (CEM) to obfuscation defenses for collaborative inference.
Problem
Obfuscation-based defenses against model inversion attacks (MIAs) on intermediate features in collaborative inference remove task-irrelevant redundancy empirically, without quantified measures or a formal link between redundancy and worst-case inversion robustness.
Approach
Theoretically links the conditional entropy H(x|z) to a lower bound on the minimal reconstruction MSE, derives a differentiable upper-bound-style loss on it via Gaussian mixture estimation of noisy features, and maximizes it jointly with existing defense losses (conditional entropy maximization, CEM).
Key results
- Adding CEM to existing defenses raises average reconstruction MSE by 24.0% (train) and 12.9% (inference) on CIFAR-10 without accuracy loss.
- On FaceScrub, CEM yields average MSE gains of 48.2% (train) and 40.1% (inference) with maintained accuracy.
- Theory: H(x|z) relates exponentially to minimal reconstruction MSE; empirical CIFAR-10 plot shows strong exponential correlation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add CEM to obfuscation-based defenses (ablation) | CIFAR10 collaborative inference defenses · CIFAR10 | GAN-based inference reconstruction MSE: +12.9% average inference MSE | Helped |
| Add CEM to Noise_ARL (ablation) | Noise_ARL on VGG11 · CIFAR10 | GAN-based inference reconstruction MSE: 0.0342 -> 0.0363 | Helped |
| Add CEM to obfuscation-based defenses (ablation) | TinyImageNet collaborative inference defenses · TinyImageNet | GAN-based inference reconstruction MSE: +17.7% average inference MSE | Helped |
| Add CEM to Noise_ARL (ablation) | Noise_ARL on ResNet-20 · TinyImageNet | GAN-based inference reconstruction MSE: 0.0205 -> 0.0253 | Helped |
| Add CEM to obfuscation-based defenses (ablation) | FaceScrub collaborative inference defenses · FaceScrub | GAN-based inference reconstruction MSE: +40.1% average inference MSE | Helped |
| Add CEM to Noise_ARL (ablation) | Noise_ARL on VGG11 · FaceScrub | GAN-based inference reconstruction MSE: 0.0158 -> 0.0231 | Helped |
| Increase the Gaussian noise variance (ablation) | CEM with Noise_Nopeek or Noise_ARL · CIFAR10 | reconstruction MSE | Mixed |
| Vary the CEM loss weight λ (0, 2, 8, 16, 32) (ablation) | Noise_ARL+CEM · CIFAR10 | accuracy–reconstruction MSE trade-off | Helped |
| Move the encoder partition from convolutional layer 1 to layer 3 (ablation) | Noise_ARL+CEM with VGG11 · CIFAR10 | accuracy–reconstruction MSE trade-off | Helped |
Limitations
- Relative H(x|z) is used because H(x) over the whole data space is intractable, so the bound is only relative.
- Accuracy trade-off: defenses such as Dropout and DistCorr lose accuracy, and FaceScrub shows notable accuracy drops.
- Evaluation limited to two attack types (decoder-based and GAN-based) under white-box assumptions.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 TinyImageNet FaceScrub
Benchmarks: CIFAR-10 TinyImageNet FaceScrub CIFAR-100
Metrics: prediction accuracy reconstruction MSE PSNR SSIM
Baselines: Bottleneck DistCorr Dropout PATROL ResSFL Noise_Nopeek Noise_ARL
Builds on: ResSFL NoPeek ARL (adversarial representation learning) PATROL DistCorr
Closest papers by meaning
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.86)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.85)
- Generative Model Inversion Through the Lens of the Manifold Hypothesis (NeurIPS 2025 · similarity 0.85)
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.85)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.