Adversary-Aware Private Inference over Wireless Channels

TL;DR

This work tackles privacy-preserving AI inference over wireless links by introducing feature differential privacy (feature DP) and an end-to-end channel-aware encoding pipeline that compresses, perturbs, and transmits edge-extracted features. It provides rigorous bounds linking privacy noise, channel conditions, and encoder design to both adversarial reconstruction error and server-classification accuracy, including a bound $P(\hat{l}=l^{*}) \ge \max\{0, P_0(1 - \mathrm{MSE}/\Delta^{2})\}$ and a worst-case adversary MSE $\mathrm{MSE}_{\mathrm{adv}} \ge \dfrac{ r\nu^{2}D^{2} }{ g^{2}\alpha^{2}D^{2} + r\nu^{2} }$ under Laplacian-encoded weights. The paper also analyzes a concrete wireless data acquisition model with subsampled orthogonal transforms and demonstrates privacy amplification via massive MIMO, where $\mathrm{MSE}_{\mathrm{adv}}$ approaches $r$ as the number of service antennas $M$ grows, highlighting substantial privacy gains from channel properties. Overall, it establishes a principled framework for balancing privacy, communication efficiency, and inference accuracy in wireless AI sensing.

Abstract

AI-based sensing at wireless edge devices has the potential to significantly enhance Artificial Intelligence (AI) applications, particularly for vision and perception tasks such as in autonomous driving and environmental monitoring. AI systems rely both on efficient model learning and inference. In the inference phase, features extracted from sensing data are utilized for prediction tasks (e.g., classification or regression). In edge networks, sensors and model servers are often not co-located, which requires communication of features. As sensitive personal data can be reconstructed by an adversary, transformation of the features are required to reduce the risk of privacy violations. While differential privacy mechanisms provide a means of protecting finite datasets, protection of individual features has not been addressed. In this paper, we propose a novel framework for privacy-preserving AI-based sensing, where devices apply transformations of extracted features before transmission to a model server.

Figures (3)

• Figure 1: Illustration of the private task-inference framework: A single edge device extracts and transmits privatized features over a wireless channel to a central inference server for classification, while an adversary observes the transmission to reconstruct sensitive information.
• Figure 2: Impact of the dimensionality reduction on the classification accuracy for the same privacy leakage $\epsilon_{\max}$, where $r = q \times 7 \times 7$, based on the ModelNet Dataset wu20153d, where $P = 30$ dBm, $\sigma^{2} = 0.1$, $\delta = 10^{-5}$, and $C_{f} = 10^{2}$.
• Figure 3: Adversarial MSE lower bound as a function of the privacy parameter $\epsilon$. Parameters used: $C_f = 2$, $b = 0.01$, $d = 50$, $\delta = 10^{-5}$, $\alpha = 1$, $g = 1$, and $\sigma_a^2 = 1$. The MSE bound increases with stronger privacy (smaller $\epsilon$), reflecting the privacy-utility trade-off.

Theorems & Definitions (10)

• Definition 1: Classification Margin sokolic2017robust
• Lemma 1: Classification Accuracy
• Definition 2: $(\epsilon, \delta)$-feature DP
• Theorem 1: Adversarial MSE Lower Bound under DP
• Remark 1
• Lemma 2: Optimal Projection Dimension under Adversarial MSE Constraint
• Theorem 2: Lower Bound on Adversarial MSE for the raw data $\mathbf{x}$
• Remark 2: Pseudoinverse vs. Neural Network Estimators
• Example 1: Subsampled Orthogonal Feature Acquisition
• Lemma 3: Adversarial Reconstruction Error under Massive MIMO