analiza aiqbench
This research introduces Robust Privacy (RP), an inference-stage framework that leverages certified robustness to mask fine-grained input-output signals exploited by model inversion attacks. By proving prediction invariance within specific neighborhoods, RP significantly reduces adversary advantage and drastically lowers attack success rates compared to standard differential privacy baselines like DP-SGD. This approach effectively treats the inference interface as a side channel for leakage, offering stronger protection against attribute reconstruction without sacrificing model utility.
Robust Privacy: Inference-Stage Privacy through Certified Robustness
arXiv:2601.17360v3 Announce Type: replace Abstract: An adversary observing a model's released prediction can infer sensitive attributes of the queried input, or even reconstruct representatives of the model's training data. The inference interface thus acts as a side channel for privacy leakage. We introduce Robust Privacy (RP), an inference-stage privacy notion inspired by certified robustness: if a model's prediction is provably invariant within a radius-$R$ neighborhood around an input $x$ with confidence at least $1-\alpha$, then $x$ enjoys $(R,\alpha)$-Robust Privacy, under which we prove that any adversary observing the released prediction has at most $\alpha/2$ advantage in distinguishing $x$ from any input within distance $R$ of $x$. Building on RP, we formalize Robust Attribute Privacy (RAP), an attribute-level privacy notion that characterizes the set of sensitive-attribute values that remain compatible with a released prediction. On a classification task, RP increases the median length of the RAP-compatible inference interval from $23.50$ to $29.96$, reducing attribute-inference precision. Model inversion attacks, often treated as a training-stage threat, in fact rely on fine-grained input-output dependence signals leaked through the inference interface; RP masks these signals at the inference stage, reducing attack success rate (ASR) from $73\%$ to $4\%$ on a black-box inversion attack. This direct targeting of the leakage channel enables RP to dominate DP-SGD and randomized response in the privacy-utility tradeoff space: RP retains $98.4\%$ accuracy at $21\%$ ASR, whereas DP-SGD must drop accuracy to $61.7\%$ to reach a comparable ASR. Across both experiments, increasing the smoothing sample size $N$ at fixed noise scale strengthens privacy and improves utility together. Finally, we examine model distillation as a scope boundary and show that RP mitigates attribute-level and instance-level inference-stage privacy leakage.
Abstract:An adversary observing a model's released prediction can infer sensitive attributes of the queried input, or even reconstruct representatives of the model's training data. The inference interface thus acts as a side channel for privacy leakage. We introduce Robust Privacy (RP), an inference-stage privacy notion inspired by certified robustness: if a model's prediction is provably invariant within a radius-$R$ neighborhood around an input $x$ with confidence at least $1-\alpha$, then $x$ enjoys $(R,\alpha)$-Robust Privacy, under which we prove that any adversary observing the released prediction has at most $\alpha/2$ advantage in distinguishing $x$ from any input within distance $R$ of $x$. Building on RP, we formalize Robust Attribute Privacy (RAP), an attribute-level privacy notion that characterizes the set of sensitive-attribute values that remain compatible with a released prediction. On a classification task, RP increases the median length of the RAP-compatible inference interval from $23.50$ to $29.96$, reducing attribute-inference precision. Model inversion attacks, often treated as a training-stage threat, in fact rely on fine-grained input-output dependence signals leaked through the inference interface; RP masks these signals at the inference stage, reducing attack success rate (ASR) from $73\%$ to $4\%$ on a black-box inversion attack. This direct targeting of the leakage channel enables RP to dominate DP-SGD and randomized response in the privacy-utility tradeoff space: RP retains $98.4\%$ accuracy at $21\%$ ASR, whereas DP-SGD must drop accuracy to $61.7\%$ to reach a comparable ASR. Across both experiments, increasing the smoothing sample size $N$ at fixed noise scale strengthens privacy and improves utility together. Finally, we examine model distillation as a scope boundary and show that RP mitigates attribute-level and instance-level inference-stage privacy leakage.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
arXiv:2601.17360 [cs.LG]
(or arXiv:2601.17360v3 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2601.17360 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 370 cuvinte
Subiecte conexe
Robust Privacy: Inference-Stage Privacy through Certified Robustness
arXiv · 12 iun. 2026
Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms
arXiv · 26 aug. 2026
NVIDIA Nemotron 3 Nano Omni Powers Multimodal Agent Reasoning in a Single Efficient Open Model
NVIDIA · 28 apr. 2026
[AINews] not much happened today
Latent Space · 10 sept. 2026