Research map / Federated learning and privacy / Privacy attacks and secure learning
Practical Privacy-Preserving MLaaS: When Compressive Sensing Meets Generative Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a privacy-preserving MLaaS framework that trains a DeepInverse-style generator plus CNN classifier on compressed measurements, using a null-space-based noise addition to protect data and labels.
Problem
Privacy leakage in MLaaS when clients upload raw training data and real-time queries to an untrusted service provider, with constraints on computation, communication, and accuracy.
Approach
Combines compressive learning (classifier on compressed measurements) with a generator that recovers prior information from measurements, and perturbs signals with a constant noise plus a null-space random noise so measurements are unchanged for classification but original content is hidden from the server.
Key results
- On CIFAR-10 at measurement rate 0.25, DCMG-N reaches 59.89% accuracy versus 55.46% for DCM, while DCMG-O (no privacy) reaches 66.42%.
- On SVHN at measurement rate 0.25, DCMG-N achieves 87.38% versus 83.81% for DCM.
- On MNIST at measurement rate 0.25, DCMG-N achieves 98.53% versus 98.16% for DCM.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add the generator's image-reconstruction information (λ > 0) (ablation) | DCMG · MNIST, SVHN, and CIFAR-10 across measurement rates 0.05(%), 0.1(%), and 0.25(%) | classification accuracy | Helped |
| train with noisy images and add noise to compressed measurements for privacy protection (ablation) | DCMG-O · MNIST, SVHN, and CIFAR-10 across the reported measurement rates | classification accuracy | Hurt |
| use the privacy-protected DCMG-N method rather than DCM | DCM · MNIST, SVHN, and CIFAR-10 across measurement rates 0.05(%), 0.1(%), and 0.25(%) | classification accuracy | Mixed |
Surprising findings
- The privacy-preserving DCMG-N sometimes outperforms the non-private DCM baseline, especially at high measurement rates.
- Constant noise alone hides image content visually but leaves class structure visible via t-SNE; the null-space random noise is needed to hide it from learned reconstruction.
Limitations
- Privacy analysis is heuristic: the claimed search-space bound is not a formal guarantee, and the measurement matrix is sent to the server, which weakens security.
- Evaluated only on three small image datasets with a single generator/classifier architecture.
- Accuracy still lags the non-private DCMG-O model by several points on CIFAR-10.
Experimental setup
Datasets: MNIST SVHN CIFAR-10
Benchmarks: MNIST SVHN CIFAR-10
Metrics: classification accuracy PSNR SSIM FSIMc
Baselines: DCM DCMG
Builds on: DeepInverse DCM (direct inference on compressed measurements) CSGAN
Closest papers by meaning
- United We Stand: Accelerating Privacy-Preserving Neural Inference by Conjunctive Optimization with Interleaved Nexus (AAAI 2024 · similarity 0.85)
- Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.85)
- Certification for Differentially Private Prediction in Gradient-Based Training (ICML 2025 · similarity 0.84)
- Universal Exact Compression of Differentially Private Mechanisms (NeurIPS 2024 · similarity 0.84)
- PREAMBLE: Private and Efficient Aggregation via Block Sparse Vectors (NeurIPS 2025 · similarity 0.84)
- Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.