Robust Privacy: Inference-Time Privacy through Certified Robustness

TL;DR

Robust Privacy (RP) reframes certified robustness as an inference-time privacy guarantee, ensuring that all inputs within an $\ell_p$-ball of radius $R$ around a queried input yield the same prediction, thereby limiting leakage about sensitive inputs. Building on this, Attribute Privacy Enhancement (APE) translates input-level invariance into an expanded inference interval for sensitive attributes, demonstrated in a BMI-driven controlled recommendation task using randomized smoothing. The paper further shows that RP mitigates model inversion attacks by masking fine-grained input-output dependence, with empirical results indicating substantial reductions in attack success rates (ASR) while balancing accuracy via the smoothing parameter $\sigma$ and Monte Carlo sample size $N$. RP complements differential privacy by addressing inference-time privacy, offering a practical framework to reduce side-channel leakage in personalized systems and to protect sensitive attributes during inference. Overall, RP provides a principled, geometry-aware approach to privacy that can be tuned for privacy, utility, and computational cost while remaining compatible with existing privacy frameworks.

Abstract

Machine learning systems can produce personalized outputs that allow an adversary to infer sensitive input attributes at inference time. We introduce Robust Privacy (RP), an inference-time privacy notion inspired by certified robustness: if a model's prediction is provably invariant within a radius-$R$ neighborhood around an input $x$ (e.g., under the $\ell_2$ norm), then $x$ enjoys $R$-Robust Privacy, i.e., observing the prediction cannot distinguish $x$ from any input within distance $R$ of $x$. We further develop Attribute Privacy Enhancement (APE) to translate input-level invariance into an attribute-level privacy effect. In a controlled recommendation task where the decision depends primarily on a sensitive attribute, we show that RP expands the set of sensitive-attribute values compatible with a positive recommendation, expanding the inference interval accordingly. Finally, we empirically demonstrate that RP also mitigates model inversion attacks (MIAs) by masking fine-grained input-output dependence. Even at small noise levels ($σ=0.1$), RP reduces the attack success rate (ASR) from 73% to 4% with partial model performance degradation. RP can also partially mitigate MIAs (e.g., ASR drops to 44%) with no model performance degradation.

Figures (4)

• Figure 1: BMI distribution (x-axis) of inputs predicted as $1$ (y-axis: count on a log scale) by the base classifier and by smoothed classifiers with $\sigma\in\{1,2,3\}$ and $N=1000$. The vertical dashed line denotes the threshold $B$; blue/orange bins to the right/left of $B$ correspond to BMI values above/below the threshold. For the base classifier, positive predictions concentrate to the right of $B$, so observing label $1$ enables a sharp inference that $\mathrm{BMI}>B$. With Robust Privacy, positive predictions extend below $B$, consistent with the RP-induced APE effect: a positive prediction is compatible with BMI values below $B$, expanding the inference interval. Larger $\sigma$ yields a more pronounced leftward extension, indicating increased uncertainty in sensitive-attribute inference. The histogram bin width is 0.2.
• Figure 2: Mechanism of Robust Privacy (RP) against model inversion attacks. Without RP (red solid line), the attacker exploits local prediction changes to estimate the optimization direction and steer updates toward the target region. With RP (dashed lines), predictions remain invariant within a robust radius $R$ (influenced by the noise scale $\sigma$ and sampling size $N$). This invariance masks the input--output dependence used to estimate the local optimization direction, disrupting the attacker's iterative reconstruction process. Consequently, a small $\sigma$ (weak RP, light-grey dashed line) may still allow partial convergence to the target region, whereas a large $\sigma$ (strong RP, dark-grey dashed line) results in significant path deviation and attack failure.
• Figure 3: Model inversion under a label-only, black-box interface kahla2022label: attack success rate (ASR; solid lines, left y-axis) and prediction accuracy (dashed lines, right y-axis) for the base classifier and smoothed classifiers across noise scales $\sigma\in[0.01,0.1]$ with sampling sizes $N\in\{10,100\}$. Horizontal dotted lines denote the base model baselines (ASR $=73\%$, accuracy $=100\%$). Enabling RP reduces ASR monotonically as $\sigma$ increases; at $\sigma=0.1$ and $N=100$, ASR drops to $4\%$ while accuracy remains $59\%$. At $\sigma=0.03$ and $N=100$, accuracy remains $100\%$ while ASR drops to $44\%$, demonstrating partial mitigation without compromising model performance. Increasing $N$ improves the smoothed classifier's accuracy while further lowering ASR against the smoothed classifier, highlighting that Robust Privacy mitigates MIAs by enforcing inference-time privacy rather than by degrading the model's performance.
• Figure 4: BMI distribution (x-axis) of inputs predicted as $1$ (y-axis: count on a log scale) by smoothed classifiers with $\sigma=3$, $N\in\{100,1000\}$, and $\alpha\in\{0.01,0.99\}$. The vertical dashed line denotes the threshold $B$; blue/orange bins to the right/left of $B$ correspond to BMI values above/below the threshold. With Robust Privacy, positive predictions extend below $B$, consistent with the APE interpretation: a positive prediction is compatible with BMI values below $B$ due to an expanded sensitive-attribute inference interval. This leftward extension is more pronounced with smaller $N$ and larger $\alpha$. The histogram bin width is 0.2.

Theorems & Definitions (2)

• Definition 1: Robust Privacy
• Definition 2: Attribute Privacy Enhancement (APE)