Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems

Song Xia, Yi Yu, Wenhan Yang, Meiwen Ding, Zhuo Chen, Ling-Yu Duan, Alex C. Kot, Xudong Jiang

TL;DR

This work tackles privacy risks in collaborative inference by linking information leakage to the conditional entropy $\mathcal{H}(\boldsymbol{x}|\boldsymbol{z})$ of inputs given intermediate features. It proves a theoretical bound: the minimal reconstruction MSE $\xi$ under model inversion attacks satisfies $\xi \ge \frac{1}{2\pi e}\exp\left( \frac{2\mathcal{H}(\boldsymbol{x}|\boldsymbol{z})}{d} \right)$, connecting robustness to entropy. To make this usable in training, the authors derive a differentiable lower bound on $\mathcal{H}(\boldsymbol{x}|\boldsymbol{z})$ by modeling $\hat{\boldsymbol{z}}$ as a $k$-component Gaussian mixture and $\boldsymbol{z}=\hat{\boldsymbol{z}}+\boldsymbol{\varepsilon}$ with Gaussian noise, leading to a tractable objective. They then introduce the Versatile Conditional Entropy Maximization (CEM) algorithm, which can be plugged into existing obfuscation defenses via $\mathcal{L}=\mathcal{L}_D+\lambda\mathcal{L}_C$ and optimized end-to-end. Empirical results across CIFAR10/100, TinyImageNet, and FaceScrub show that CEM consistently boosts inversion robustness (average gains 12.9%–48.2%) without sacrificing feature utility or efficiency, demonstrating practical impact for privacy-preserving collaborative inference.

Abstract

By locally encoding raw data into intermediate features, collaborative inference enables end users to leverage powerful deep learning models without exposure of sensitive raw data to cloud servers. However, recent studies have revealed that these intermediate features may not sufficiently preserve privacy, as information can be leaked and raw data can be reconstructed via model inversion attacks (MIAs). Obfuscation-based methods, such as noise corruption, adversarial representation learning, and information filters, enhance the inversion robustness by obfuscating the task-irrelevant redundancy empirically. However, methods for quantifying such redundancy remain elusive, and the explicit mathematical relation between this redundancy minimization and inversion robustness enhancement has not yet been established. To address that, this work first theoretically proves that the conditional entropy of inputs given intermediate features provides a guaranteed lower bound on the reconstruction mean square error (MSE) under any MIA. Then, we derive a differentiable and solvable measure for bounding this conditional entropy based on the Gaussian mixture estimation and propose a conditional entropy maximization (CEM) algorithm to enhance the inversion robustness. Experimental results on four datasets demonstrate the effectiveness and adaptability of our proposed CEM; without compromising feature utility and computing efficiency, plugging the proposed CEM into obfuscation-based defense mechanisms consistently boosts their inversion robustness, achieving average gains ranging from 12.9\% to 48.2\%. Code is available at \href{https://github.com/xiasong0501/CEM}{https://github.com/xiasong0501/CEM}.

Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems

TL;DR

This work tackles privacy risks in collaborative inference by linking information leakage to the conditional entropy of inputs given intermediate features. It proves a theoretical bound: the minimal reconstruction MSE under model inversion attacks satisfies , connecting robustness to entropy. To make this usable in training, the authors derive a differentiable lower bound on by modeling as a -component Gaussian mixture and with Gaussian noise, leading to a tractable objective. They then introduce the Versatile Conditional Entropy Maximization (CEM) algorithm, which can be plugged into existing obfuscation defenses via and optimized end-to-end. Empirical results across CIFAR10/100, TinyImageNet, and FaceScrub show that CEM consistently boosts inversion robustness (average gains 12.9%–48.2%) without sacrificing feature utility or efficiency, demonstrating practical impact for privacy-preserving collaborative inference.

Abstract

By locally encoding raw data into intermediate features, collaborative inference enables end users to leverage powerful deep learning models without exposure of sensitive raw data to cloud servers. However, recent studies have revealed that these intermediate features may not sufficiently preserve privacy, as information can be leaked and raw data can be reconstructed via model inversion attacks (MIAs). Obfuscation-based methods, such as noise corruption, adversarial representation learning, and information filters, enhance the inversion robustness by obfuscating the task-irrelevant redundancy empirically. However, methods for quantifying such redundancy remain elusive, and the explicit mathematical relation between this redundancy minimization and inversion robustness enhancement has not yet been established. To address that, this work first theoretically proves that the conditional entropy of inputs given intermediate features provides a guaranteed lower bound on the reconstruction mean square error (MSE) under any MIA. Then, we derive a differentiable and solvable measure for bounding this conditional entropy based on the Gaussian mixture estimation and propose a conditional entropy maximization (CEM) algorithm to enhance the inversion robustness. Experimental results on four datasets demonstrate the effectiveness and adaptability of our proposed CEM; without compromising feature utility and computing efficiency, plugging the proposed CEM into obfuscation-based defense mechanisms consistently boosts their inversion robustness, achieving average gains ranging from 12.9\% to 48.2\%. Code is available at \href{https://github.com/xiasong0501/CEM}{https://github.com/xiasong0501/CEM}.

Paper Structure

This paper contains 19 sections, 4 theorems, 15 equations, 7 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. Preliminaries
  5. Theoretical Insights on Worst-case Robustness
  6. Differentiable Bound on Conditional Entropy
  7. Practical Insights on the Utility and Robustness Trade-off
  8. The Versatile Conditional Entropy Maximization Algorithm for Collaborative Inference
  9. Experimental Results
  10. Experimental Settings
  11. Results on Different Datasets
  12. Ablation Study: Effect of Hyperparameters
  13. Conclusion
  14. Proof of Theorem 1
  15. Proof of Theorem 2
  16. ...and 4 more sections

Key Result

Proposition 1

In the worst-case scenarios, where the adversary $\mathcal{A}({\bm{z}},\mathcal{X},\mathcal{F}_e)$ precisely estimates the posterior probability $\mathbb{P}({\bm{x}} | {\bm{z}})$ based on the extensive data prior $\mathcal{X}$ and the white-box access to the feature encoder $\mathcal{F}_e$, the expe

Figures (7)

  • Figure 1: Privacy protection for collaborative inference via CEM.
  • Figure 2: The versatile conditional entropy maximization algorithm for collaborative learning systems with split encoder and decoder.
  • Figure 3: Reconstruction MSE Vs. $\mathcal{H}({\bm{x}}|{\bm{z}})$ on the CIFAR10.
  • Figure 4: The effect of different hyperparameters on the performance of the proposed CEM algorithm. The effect of noise strength, $\lambda$, and partitioning schemes are demonstrated by the utility-robustness trade-off curve.
  • Figure 5: The visualized result. The last three rows are inputs reconstructed by MIA.
  • ...and 2 more figures

Theorems & Definitions (4)

  • Proposition 1: Minimal reconstruction MSE $\xi$
  • Theorem 1: Lower bound on the minimal reconstruction MSE $\xi$
  • Proposition 2: The conditional entropy under uncertain encoding
  • Theorem 2: Differentiable lower bound on $\mathcal{H}({\bm{x}}|{\bm{z}})$