Research map / Federated learning and privacy / Privacy attacks and secure learning
Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that positive label smoothing makes models more vulnerable to Plug & Play model inversion attacks, while negative label smoothing acts as a defense that beats MID and BiDO on the utility-privacy trade-off.
Problem
Label smoothing is a standard regularizer, but its effect on privacy leakage through model inversion attacks (MIAs) that reconstruct class-representative training data from classifiers has not been studied.
Approach
Analyzes positive and negative label smoothing as opposite levers for MIAs: positive smoothing clusters class embeddings and improves attack sampling and optimization, while negative smoothing (alpha<0) yields unstable gradients and poor attack results, serving as a training-time defense without architecture changes.
Key results
- On FaceScrub ResNet-152, positive LS (alpha=0.1) raises Acc@1 from 94.3% to 95.2% and knowledge extraction score from 61.2% to 71.0% versus hard labels.
- Negative LS (alpha=-0.05) drops Acc@1 to 14.3% and knowledge extraction score to 16.5%, with test accuracy falling only from 94.9% to 91.5%.
- Negative LS outperforms MID and BiDO on the utility-privacy trade-off in the reported FaceScrub and CelebA comparisons.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| train with positive label smoothing (α=0.1) instead of hard labels | ResNet-152 · FaceScrub | Acc@1: 94.3% -> 95.2% | Helped |
| train with positive label smoothing (α=0.1) instead of hard labels | ResNet-152 · CelebA | Acc@1: 81.8% -> 92.9% | Helped |
| train with negative label smoothing (α=-0.05) instead of hard labels | ResNet-152 · FaceScrub | Acc@1: 94.3% -> 14.3% | Hurt |
| train with negative label smoothing (α=-0.05) instead of hard labels | ResNet-152 · CelebA | Acc@1: 81.8% -> 26.4% | Hurt |
| train with negative label smoothing (α=-0.05) instead of hard labels | ResNet-152 · FaceScrub | Test Acc: 94.9% -> 91.5% | Hurt |
| train with negative label smoothing (α=-0.05) instead of hard labels | ResNet-152 · CelebA | Test Acc: 87.1% -> 83.6% | Hurt |
| increase positive smoothing from α=0.0 to α=0.1 (ablation) | ResNet-152 · FaceScrub | Acc@1: 94.32% -> 95.20% ± 2.9 | Helped |
| increase positive smoothing from α=0.0 to α=0.1 (ablation) | ResNet-152 · CelebA | Acc@1: 81.75% ± 1.3 -> 92.85% ± 3.4 | Helped |
| make smoothing more negative, from α=0.0 to α=-0.05 (ablation) | ResNet-152 · FaceScrub | Acc@1: 94.32% ± 1.9 -> 14.34% ± 7.6 | Hurt |
| make smoothing more negative, from α=0.0 to α=-0.05 (ablation) | ResNet-152 · CelebA | Acc@1: 81.75% ± 1.3 -> 26.41% ± 3.4 | Hurt |
| replace Poincaré loss with cross-entropy loss during attack optimization (ablation) | PPA on negative-LS target models · FaceScrub | gradient similarity | No clear effect |
Surprising findings
- Positive label smoothing increases privacy leakage, with larger effects in low-data regimes.
- Negative label smoothing makes gradient-based attack optimization unstable, causing attack failure even with a cross-entropy loss.
Limitations
- MIA experiments are costly, so hyperparameter search over smoothing factors and schedules was limited (alpha=-0.05 used as a default).
- Attacks were run once per target model due to compute cost.
- Lacks a comprehensive theoretical framework for MIAs.
Experimental setup
Datasets: FaceScrub CelebA
Benchmarks: FaceScrub CelebA
Metrics: Test Acc Acc@1 Acc@5 feature distance (FaceNet) knowledge extraction score FID ECE
Baselines: MID BiDO Standard (hard label) training Plug & Play Attacks
Builds on: Plug & Play Attacks label smoothing MID BiDO GMI
Closest papers by meaning
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.88)
- Auditing Privacy Mechanisms via Label Inference Attacks (NeurIPS 2024 · similarity 0.86)
- Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks (ICLR 2024 · similarity 0.86)
- Training Deep Neural Networks with Virtual Smoothing Classes (AAAI 2025 · similarity 0.86)
- Retraining with Predicted Hard Labels Provably Increases Model Accuracy (ICML 2025 · similarity 0.85)
- Towards Understanding Why Label Smoothing Degrades Selective Classification and How to Fix It (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.