Reimagining Mutual Information for Enhanced Defense against Data Leakage in Collaborative Inference
Authors: Lin Duan
Jingwei Sun
Jinyuan Jia
Yiran Chen
Maria Gorlatova
Venue: NeurIPS 2024 poster (2024)
Keywords: Collaborative inference
Primary area: safety_in_machine_learning

Abstract: Edge-cloud collaborative inference empowers resource-limited IoT devices to support deep learning applications without disclosing their raw data to the cloud server, thus protecting user's data. Nevertheless, prior research has shown that collaborative inference still results in the exposure of input and predictions from edge devices. To defend against such data leakage in collaborative inference, we introduce InfoScissors, a defense strategy designed to reduce the mutual information between a model's intermediate outcomes and the device's input and predictions. We evaluate our defense on several datasets in the context of diverse attacks. Besides the empirical comparison, we provide a theoretical analysis of the inadequacies of recent defense strategies that also utilize mutual information, particularly focusing on those based on the Variational Information Bottleneck (VIB) approach. We illustrate the superiority of our method and offer a theoretical analysis of it.

Reimagining Mutual Information for Defense against Data Leakage in Collaborative Inference
Lin Duan't Jingwei Sun Jinyuan Jia", Yiran Chen', Marra Gorlatova'
Department of Electrical and Computer Engineering, Duke University
2 College of Information Sciences and Technology. Pennsylvania State University
(lin, duan, jingwei yiran. chen, ma maría gorlatova maria.gorlatovva @duke. jinyuan@psu.eed
edu
Abstract
Edge-cloud collaborative inference empowers resource-limited IoT devices support deep learning applications without disclosing their raw data to the cloud server, thus protecting user's data. Nevertheless, prior research has shown that collaborative inference still results in the exposure of input and predictions from edge devices. To defend against such data leakage in collaborative inference, we introduce InfoScissors, defense strategy designed to reduce the mutual information between model's intermediate outcomes and the device's input and predictions. We evaluate our defense on several datasets in the context of diverse attacks. Besides the empirical comparison, we provide a theoretical analysis of the inadequacies recent defense strategies that also utilize mutual information, particularly focusing on those based on the Variational Information Bottleneck (VIB) approach. We illustrate the superiority of our method and offer theoretical analysis of it.
Introduction
Edge devices are becoming smarter and more versatile. These devices expected to efficiently perform a wide range of deep learning (DL) inference tasks with remarkable performance. However, implementing DL inference applications such edge devices is challenging due the constraints imposed by the on-device resource availability. As we see the rise of state-of state-of-the-ar (SOTA) DL models, such Large Language Models [1, 2]. they are becoming increasingly complex, housing a colossal number of parameters. This escalation in complexity and size makes it difficult to store edge device, which typically has limited memory space. Furthermore, the restricted
DI model computational resources could lead to prolonged latency during inference. One potential solution to this predicament is to transmit the input data directly from the edge device cloud server. The server, which houses the DL model, then conducts inference and sends the prediction back to the device. However, this approach carries risk of data leakage, particularly if the input data are sensitive in nature such as facial images. In addition, the output data (i.e., predictions) can also contain confidential information, such as the patient's diagnostic results.
Collaborative inference [3-9] has emerged as an approach to prevent data leakage when deploying DL inference applications commodity edge devices with constrained computing resources. Fig. shows a general collaborative inference system. Suppose an edge device and a cloud server conduct collaborative inference. The deep learning model can be divided into three parts?. The first and last few layers of the network are deployed on the edge device, while the remaining layers are offloaded
"Co-first authors.
2 Note that some applications might divide the model into two parts, and the edge devices might hold the first or the last few layers, which have different data leakage problems. This paper considers the general setting.
38th Conference on Neural Information Processing Systems (NeurIPS 2024).

---

Figure I: A general framework of collaborative in- ference. The malicious server can infer input and predictions on the edge device. Our method defends against data leakage by reducing the mutual infor- mation between the model's 'sss intermediate outcomes and the edge device's 's data and predictions.
y fox
z
Cload
Server
Edge
device
y fox
0n
to the cloud server. This division allows most of the computational tasks to be handled by the server, effectively mitigating the resource limitations the device. The edge device and the cloud server communicate only the intermediate outputs of the model, ensuring that the raw input and predictions remain inaccessible the server. However, recent works [10, 11] have revealed that sharing these intermediate outputs can still lead to data leakage from edge devices, including input data and predictions. A malicious server can, for instance, reconstruct input data from the representations (i.e., in Fig. 1) uploaded by the device through Model Inversion (MI) attacks [12. 13, 11]. Furthermore, the high-level features (i.e., 2 in Fig. 1) contain rich information about the predictions, making it feasible for a malicious server to infer the device's predictions through these features [14-16]. While there have been considerable explorations into data protection in collaborative inference [10, 11, 17, 18), existing defenses tend to significantly degrade model utility. This degradation is particularly evident scenarios where attacks are relatively strong. For example, when the head model on the device (i.e., 9h in Fig. 1) is shallow, existing defenses [10, 11, 19, 20, 20, 18] cannot guarantee robustness against MI attacks without a significant drop in model accuracy as shown in our results.
We propose InfoScissors, a defense method designed from a mutual information perspective to protect the edge device's data in collaborative inference. This approach works by protecting both the device's input data and its predictions. The goal of our method is to preserve user privacy in collaborative inference, and privacy preservation is achieved by manipulating the training phase (i.e., collaborative training). By applying our defense, the model is normalized to filter the private information when extracting features and representations, such that privacy is preserved during the inference phase. To protect the input data, we regularize the head model on the device to extract representations that contain less mutual information with the input. To protect the prediction, we regularize the features extracted by the server's 's encoder to minimize the mutual information they contain with the label. We derive variational mutual information upper bound and develop an adversarial training method to minimize this bound on the device side. There are works [21, 17, 18] that prevent input leakage from the mutual infor- mation perspective, and most of them are based on Variational Information Bottleneck ( (VIB) [22]. Our work is not simple replacement of the mutual information approximation compared with these works. We analyze the inadequacies of the VIB-based methods in protecting input data in the context of collab- orative in inference and illustrate the superiority of our method. We evaluate method on CIFAR 10 and CIFAR 100 against input leakage using both black-box and whxtte-bx MI attacks. The results show that method can effectively defend the attacks with less than 3% drop in model accuracy even when the head model on the device has only one convolutional layer, where the attacks are extremely strong. We also evaluate our defense against prediction leakage using multiple Model Completion (MC) at- tacks [14, 15]. The results show that our defense achieves the best trade-off between the model accuracy and the defense effectiveness compared to the baselines. Our contributions summarized follows:
We propose InfoScissors, a defense method against data leakage collaborative inference from the mutual information perspective, encompassing both input leakage and prediction leakage.
We offer a thcoretical analysis of our defense against input recovery attacks and prediction inference attacks. We also analyze the superiority of our method compared with the VIB-based methods.
We empirically evaluate InfoScissors across multiple datasets and against multiple attacks. Our method effectively defends against MI and MC attacks, outperforming the baselines.
2
Related Work
Data Leakage in Collaborative Inference rapid growth of commercial deployment of DL, especially in collaborative learning scenarios, whose
Data leakage is drawing more and more attention as the

---

primary concern is data safety. In collaborative inference, we categorize data leakage into two types, i.e.,
input leakage [23, 10, 24, 25] and prediction leakage [14-16]. For input leakage, [23] proposes general attack methods for complex models, such as Neural Networks, by matching the correlation between adversary features and target features, which can be seen as a variant of model inversion [26, 27]. [10, 28, 25, 29, 30, 24] also propose variants of model inversion attack. While all these attacks are in the inference phase, [25] proposes a variant DLG [12]. which can perform attacks in the training phase. For prediction leakage, [15] proposes attack and defense method for two-party split learning on binary classification problems, a special collaborative inference setting. Additionally, [14] proposes three different label inference attack methods considering different settings in collaborative inference: direct label inference attack, passive label inference attack, and active label inference attack.
Defense in Collaborative Inference Defensive methods have been proposed against data leakage in collaborative inference. To defend against input leakage, some works apply differential privacy (DP) [10. 11, 19, 31] and compression [10. 11, 17, 32] to the representations and models. While these methods can successfully defend against input leakage from the representations, they cause in the
substantial model performance degradation because they weaken the knowledge/informattee representations. Some recent works also try to prevent input leakage by regularizing the representations from the mutual information perspective [17, 18, 21]. However, their methods only achieve decent results when the head model on the edge device is deep, which is not practical when the computation power is constrained on the edge device. Our paper analyzes that such disadvantage comes from the inadequacies of VIB in the context of input protection. Some other works [33-35] apply mutual information on input space to protect input data, but their methods are only feasible with limited input dimension in the context of collaborative inference due to computational constrain on edge devices. One recent work [36] studies inference defense under a similar setting to our paper. But they only focus on prediction protection. They add noise to the training label by randomly sampling a class label, which is intuitively inspired by DP. Our training method theoretically derived from the perspective of mutual information, and we provide theoretical analysis of our defense performance. To defend against prediction leakage, [16] manipulates the labels following specific rules defend the direct label inference attack, which can be seen as variant of label differential privacy (label DP) [37, 38] in collaborative inference. Compression and quantization of the gradients [14, 18] are also applied to prevent prediction leakage. However, similar to the defense against input leakage, these defenses cause substantial model performance degradation to achieve decent defense performance.
3 Preliminary
3.1 Collaborative Inference Setting
Suppose an edge device and a cloud server conduct collaborative inference. Following the setting in Fig. 1, the deep learning model is divided into head model fg.. an encoder fg. and classifier fg.. The head model and classifier are deployed on the edge device, and the encoder is on the cloud server. Given an input vs, the edge device first calculates the representation r; //x (1;) and sends to the server. Then the server extracts the feature from the received representation 2; = =ʃf- (r:) and sends 2, back to the edge device. After receiving the feature, the edge device calculates the prediction 9: fā- (2.). In this paper, the results of f sent from the device to the server are referred to as representations, and features refer to the results of fā. sent from the server to the device. The overall inference procedure is formulated as:
U for (fo (f (I:))).
In the real world, the input I; and prediction S are important intellectual properties of the edge device and may contain personal information. In the inference procedure, the edge device does not send raw input to the server, and the inference results are also inaccessible to the server.
3.2 Threat Model
Our goal is to protect the edge device's input and predictions from being inferred by the cloud server. The device only uploads the representations to the server and never leaks raw input or predictions to the server. However, the cloud server is untrusted, attempting to steal input and predictions. We assume the untrusted server strictly follows the collaborative inference protocols, and it cannot
3

---

compromise the inference process conducted by the device. Nevertheless, the adversary (i.e., malicious server) is capable of training a surrogate classifier and generator to mimic the victim's 's data. With the received representation attacks [12, 13, 10]. Notably, the head model on the device is usually shallow due to the computation resource limitation, which aggravates the input leakage from the representation [11]. The encoder on the server extracts high-level features containing rich information about the prediction, which enables
the server can reconstruct the input on the device by conducting MI
the server to infer predictions of the device. We conduct preliminary experiments to illustrate the data leakage in collaborative inference, which can be found Appendix A.
Method
4.1
Defense Formulation
To defend against data leakage, we propose InfoScissors, a learning algorithm that regularizes the model during the training phase. Following the setup of 3.1, suppose the edge device has sample pairs ((r1, ) drawn from distribution p(x.y). The representation is calculated r= f (x) by the edge device, and the cloud server computes features z = föe (r). We apply x.y.r, here to represent random variables, while 2,,,, are deterministic values. To defend against the leakage of the edge device's ' input data and inference results, InfoScissors is designed to achieve three goals:
Goal I:
To preserve the performance of collaborative inference, the main objective loss should be minimized.
Goal 2: To prevent the input leakage from the representations, 8h should not extract representations containing much information about the input data
Goal 3: To reduce the leakage of the predictions the edge device, 0 the cloud server should not be able to extract features z containing much information about the true label y.
Formally, we have three training objectives:
Prediction:
min C(J (fr- (foh (x))) 0h.00-00 _0
Input protection:min((x)))
(2)
g
Prediction protection: min ((z:y)
6a _0"
where I(r:x) is the mutual information between the representation and the input, which indicates how much information retains about the input data x. Similarly, [(z:y) is the mutual information between the feature and the label. We minimize these mutual information terms to prevent the cloud server from inferring the input x and label y from r and z, respectively.
The prediction objective is usually easy to optimize (e.g.. cross-entropy loss for classification). However, the mutual information terms are hard to calculate in practice for two reasons: 1. r and x are high-dimensional, and it is extremely computationally heavy to compute their joint distribution; 2. Caleulating the mutual information requires knowing the distributions p(xir) and p(ylz), which are both difficult compute. We do not follow existing works [18. 21, 17] to employ VIB derive tractable estimations of the mutual information objectives. We analyze the inadequacies of VIB in protecting input, which can be found in Sec. 4.4, and leverage CL.B [39] to formulate variational upper bounds of mutual information terms. We first formulate variational upper bound of I(r:)):
((x:) (rx) Foyou (x|r) Peoopco) logga (x|r),
(3)
where qu (x(r) is variational distribution with parameters v to approximate p(x|r). To guarantee the inequality of Eq. (3), go (x(r) should satisfy:
(4)
which can be achieved by minimizing (L(p(r,x))
(5)
With sample pairs {I.,,)) i= we apply the sampled vCLUB (vCLUB-S) mutual information estimator in [39] reduce the computational overhead, which is unbiased estimator of LyCLUB and

---

is formulated as:
(r:) N
Σ
(sxg) lr:))
(6)
where K is uniformly sampled from indices of input protection is formulated as:
NJ, With Eq. (3), Eq. (5) and Eq. (6), the objective
(ix] <> minlscrmmssrsa (r:x) @
min
maxlogo -oogg) (ragl1z))
(7)
N
Similarly, variational distribution (u(=) with parameter e to approximate p(ul=), and formulate the objective of label protection as:
(wxlogg.(w.ll.)--oa logud Mu. (nng1z)) 1zi)
min ((zy) + min becuus((yy)) $6,8*
min gh, N
(8)
gh,
Suppose we use Pd. ha to parameterize 4o and dø. respectively. By combining Eq. (7), Eq. (8) and the prediction objective with weight typer-parameters da and Xτ the overall optimizing objective is:
min (1 Aa Ad) 8h 00 000
E
c
Jäc
[
(10h (z:)) )
minmaxAd
logg (2s) (ailSoh (ai))) 1
+minda
logg (ny Istn (Ire)
8h
N
(9)
Lua
+ min maxAi
logha (uilsa (fon ((x))) min At
loghh
(unglso= (10n (foh (1x))
N
he can be easily constructed estimate p (ylz) given the task of inference (e.g., classifier for classification task). To estimate p(x[r), we assume that x follows the Gaussian distribution of which the mean vector is determined by and the variance is 1. Under this assumption, we apply generator Io to estimate the mean vector of x given
Cloud
Goul Prediction protection L log h (+lz) fur log R4 (z))
Z
Edge
Input protection log By (xir)
Goal 1: Prediction (2)))()),))
X
Day log By (xglr)
Figure 2: An overview of InfoScissors. Training step I: Optimize the classifiers 0" and & by minimizing C. and maximizing Ci.,, respectively, Step 2: Optimize the generator v by maximizing La Step 3: Optimize 6 and 8e by minimizing (1 (1- Ay C.) XLLia + AaLas MuLaa+tau +aaCar.
4.2 Learning Algorithm
The overall objective has five terms. For simplicity, we denote these five objective terms as Les La La Lia and Lt.,, respectively, shown in Eq. (9). L. is the prediction objective. Ld and L.d comprise the input data protection objective. La an adversarial training objective where an auxiliary generator gv trained capture input information while the head layers f are trained to extract little input information as possible. Ca, regularizes ff. extract representations that can be used to generate randomly picked samples. LLa and Lrr have similar effect with La and
5

---

y respectively. We can reorganize the overall training objective as:
0º f ,0.0
arg min [1 Aa AijaninG, Aymaxxi a deCi: AamaxLa a daCa #h 00
(10)
Based on Eq. (10), we develop a collaborative learning algorithm. For each batch data, the device first optimizes the classifiers o and by minimizing L. and maximizing Li respectively, Then, the device optimizes the generator & by maximizing Ld Finally, 6 and 0 are optimized by minimizing (1 Py A X +
XaCarr. The detailed algorithm can be found in Appendix B. Note that 8h _ .b, and & are deployed on devices, and their training does not need additional information from the cloud server compared with training without our defense. The training procedure of (t does not change, which makes our defense concealed from the cloud server.
4.3 Theoretical Analysis
We provide a theoretical analysis of our defenses against prediction and input leakage. Following the notations in Sec. 4.1, we have the following theorem of defense performance for prediction leakage after applying InfoScissors. All the proofs can be found in Appendix
Theorem 1. Let he parameterize qa in Eq. (8). Suppose the malicious server optimizes an auxiliary model h (ylz) to estimate p(ylz). For any h" (ylz)). we always have:
logh TM (2)22<<
N logp(u.)+c
(11)
where
<=hcLoon (z:y) + KK(p(y)>)) (ho(()))))
(12)
Specifically, if the task of collaborative inference is classification, we have the following corollary:
Corollary 1. Suppose the task of collaborative inference is classification. Following the notations in Theorem and let epsilon be defined therein, we have:
N
Σ CElh (gih"((s)) (x:) Craandom C,
(13)
where CE denotes the cross-entropy loss, and CE is the cross-entropy loss of random guessing.
For input leakage, we have the following theorem.
Theorem 2. Let the assumption of p(x(T) in Sec. 4.1 hold and ge parameterize the mean of q6 in Eq. (7). Q denotes the dimension of x. Suppose the malicious server optimizes auxiliary model
9Thh (x(r) estimate the mean of ((x().). For any g"h grt (xlr), we always have:
MSE (rt),a() 2(n-c)
(14)
Q
where MSE denotes the mean square error, and
2 CCLUNR (rx)+
log p(z,)
(15)
N
4.4 Superiority over VIB
Recent works also try to prevent imput leakage by regularizing the representations from the mutual infor- mation perspective [21, 17, 18]. The ultimate goal of these works is the same as our method, which is to minimize I [rr:z). However, most of these works apply Variational Information Bottleneck ( (VB) /22] to derive the upper bound of (r:x). Even though VIB is commonly applied in DNN feature regularization, analyze that it is not optimal in defending against input leakage in collaborative inference.
The variational upper bound of (r:x), which is also an objective to minimize, derived through VIB formulated

---

S S Bemple))app(s KL/ppk (r)x,,),+(r)),
(16)
where e is the Gaussian random variable used to reparameterize the randomness of representation
extractor 0% r(r) is the variational approximation of the marginal distribution p(r). In practice, without any prior information, r(r) is set to be a fixed spherical Gaussian, r(r) = (r]0,, 7). To minimize [r;xx), the VIB-based works [21, 17, 18] regularize the representation distribution to be close to a fixed Gaussian. This will cause the complementary loss of information contained by including the mutual information with y. which is crucial for the primary inference task. contrast, the training objective derived in our method is to only filter out the information in that is crucial for reconstructing x, which will cause less information loss and inference performance drop.
We can also analyze the difference between VIB-based methods and our method from a high level, which also motivates to choose CLUB approximation. The mutual information (r:x) can be expanded as
[(r:)= = drdsp(r,=)log p(r[æ)
p(r)
(17)
drdsp(r,;)log p(x[r]
p(x)
VIB follows the first equality to derive tractable upper bound of [(;;x) based on parameterized variational p(r|z)). Subsequently, the training objective is focused on minimizing this variational p(rlz)) We follow the second equality parameterize p(z[r) and derive upper bound based on CLUB. Our training goal is centered on minimizing the variational ((z)))) Importantly, in the context of defending against model inversion attacks, the primary aim is to attain low p(z(rr). This aim is more closely aligned with our training objective compared to VIB- based methods. This alignment, alongside the empirical results presented in the subsequent section, highlights the superiority of our method.
Experiments
We first evaluate method against input leakage and prediction leakage, both separately and in an integrated manner. The experiments are conducted on a server with 4 RTX TITAN GPUs.
5.1
Experimental Setup
DP
AN
DC
MID
InfoScissors
Aoc(%)
76.82
75.95
76.56
SSIM
0.4779
0.3181
0.7479
0.7373
0.159
Acc(%)
71.63
73.26
73.38
72.17
75.62
SSIM
0.2035
0.2535
0.5244
0.4576
0.145
Acc(%)
65.31
67.56
69.55
61.3
75.56
SSIM
Figure 3: Images reconstructed by the KA attack on CIFARI0 under different defenses. Each represents different defense level. The bottom row applies the strongest defense, resulting in lower-quality reconstructed images and sacrifice in accuracy.
Attack methods For input leakage, we evaluate InfoScissors against Model Inversion (MI) attacks: (1) Knowledge Alignment (KA) [17] is a black-box MI attack, in which the malicious server trains inversion model that swaps the input and output the target model using an auxiliary dataset. The inversion model is then used to reconstruct the input given any representation.
(2) Regularized Maximum Likelihood Estimation (rMLE) [1 1] is white-box MI attack that the malicious server has access to the device's 's extractor model g^, The server trains input to minimize the distance between fake representations and the received ground-truth representations. is an unrealistic assumption that the server can access the model on the device, and we apply this white-box attack to evaluate our defense against extremely strong attacks. For prediction leakage we evaluate our defense against two Model Completion (MC) attacks: (1) Passive Model Completion (PMC) [14] attack assumes

---

that the malicious server has access to an auxiliary labeled dataset and utilizes this auxiliary dataset tinettune classifier that can be applied its encoder. (2) Active Model Completion (AMC) [14] attack is included as an adaptive atlack against our defense. The primary goal of our defense is to reduce the collaborative model's reliance on the server-side encoder for specific tasks, allowing data and prediction information to be filtered during inference. Under the adaptive attack setting, the adversary is allowed to modify the training profiling such that can trick the collaborative model into relying more on its encoder, thereby extracting more private data information from the encoder's features. In this setting, the adversary is directly confronting the fundamental principles of our defense method, constituting highly potent form of adaptive attack.
Baselines We compare InfoScissors with five existing defense basclines: (1) Differential
Privacy (DP) [10, 11, 19], (2) Adding Noise (AN) [40], (3) Data Compression (DC) [20], (4)
Privacy-preserving Deep Learning (PPDL) [41], and (5) Mutual Information Regularization Defense (MID) [18), which is the SOTA defense against data leakage in collaborative inference based on Variational Information Bottleneck (VIB). The details of the baselines can be found in Appendix D.
Dataset & Hyperparameter configurations We evaluate on CIFAR 10 and CIFAR 100. For both datasets, we apply ResNet18 8 as the backbone model. The first convolutional layer and the last basic block are deployed on the device as the representation extractor and the classifier, respectively. We set batch size B as 32 for both datasets. We apply SGD as the optimizer with the learning rate 17 set to be 0.01. The server has 40 and 400 labeled samples to conduct KA and MC attacks for CIFARIO and CIFAR100, respectively. For InfoScissors, we apply a 1-layer decoder and 3-layer MLP to parameterize v and é. For AN, we apply Laplacian noise with mean of zero and a scale between 0.0001-0.01. For DC, we set the compression rate from 90% to 100%. For PPDL, we set the Laplacian noise with scale of 0.0001 -0001, J == 0.001 and between and 0.01. For MID, we set the weight of mutual information regularization between 0-0.1.
Evaluation metries (1) Utility metric (Model accuracy): We use the test data accuracy of the classifier on the device to measure the performance of the collaborative model. (2) Robustness metric (SSIM): We use SSIM (structural similarity) between the reconstructed images and the raw images to evaluate the effecctivnness of the defense against input leakage. The lower the SSIM, the better the defense performance. (3) Robustness metric (Attack accuracy): We use the test accuracy of the server's classifier after conducting MC attacks to evaluate the defense against prediction leakage. The lower the attack accuracy, the higher the robustness against prediction leakage.
5.2 Results of Input Protection
We conduct experiments on CIFAR 10 and CIFAR 100 to evaluate our defense against the KA attack and the rMLE attack. We set different defense levels for our methods (i.e., different Aa values in Eq. (9)) and baselines to conduct multiple experiments to show the trade-off between the model accuracy and SSIM of reconstruction. The results are shown Fig. 4.
DP
AN-
PPDL
DC
MID
InfoScisssory
1.0
1.0
1.0
0.8
0.8
0.8
SSIM
0.6
SSIV
0.6
0.6
0.6
0.4
0.4
0.2
0.2
0.0
0.0
60
64
68
76
50
66
68
70
72
74
80
38:39 10-1-01-444 11-424444 43
38399044 454444444666666
Accumeyy?6) (61
Accurcy(5)
Accurss(5)
Accumey(54)
KA attack on CIFARIO Figure 4: Model accuracy v.s. SSIM on CIFAR 10 and CIFAR 100 against MI attacks.
(b) rMLE attack CIFARIO
(6) K.A. attack CIFARIUO
rMLE attack CIFARIO0
For defense against KA attack, our InfoScissors can reduce the SSIM of reconstruction to lower than 0.2 with model accuracy drop of less than 2% for CIFARIO. In contrast, the other baselines reduce model accuracy by more than 10% and cannot achieve the same defense effect even with an accuracy drop of more than 10%. Notably, the malicious server has more auxiliary data on CIFAR 1 100 than CIFAR10. 10, making the defense harder on CIFAR 100. However, InfoScissors can still achieve an SSIM of lower than 0.2 with a model accuracy drop of less than 2%. We also evaluate our defense against the KA attack with larger auxiliary dataset on the malicious server, and the results, which can be found
8

---

in Appendix D, show that our defense can effectively defend against the KA attack when the server has more auxiliary samples. For defense against rMLE attacks, InfoScissors achieves similar results of reducing the SSIM to lower than 0.2 with model accuracy drop of less than 2% for CIFAR 10 and 1% for CIFAR 100, respectively, which outperforms the other baselines significantly.
To perceptually demonstrate the effectiveness of our defense, we show the reconstructed images by the KA attack on CIFARIO after applying baseline defenses and our defense in Fig. It is shown that by applying the baseline defenses, the reconstructed images still contain enough information to be recognizable with the model accuracy of lower than 70%. For our method, the reconstructed images do not contain much information about the raw images, with the model accuracy higher than 76%.
5.3 Results of Prediction Protection
We evaluate InfoScissors on two datasets against the PMC attack and the AMC attack. We set different defense levels for our methods (i.e., different A values Eq. (9)) and baselines conduct multiple experiments to show the trade-off between the model accuracy and attack accuracy. The defense results against PMC and AMC attacks are shown in Fig. and Fig. 6, respectively. To simulate the realistic settings where the malicious server uses different model architectures to conduct MC attacks, we apply different model architectures (MLP MLP_ _ismm for MC attacks. The detailed model architectures can be found in Appendix D.
D2
AN
PPDL
MID DC
InfoScissors
-2 200
Attec seuuaay (50
:50
Atlack accurayy (50
Attac (S)
10
30
40
15
20
Attack
30
20
10
64
68
72
76
30
68
70
72
74
76
78
80
36
38
40
42
44
46
48
36
38
40
42
44
46
48
Accuracy (5)
7
Accumery (%)
Acturacy (5)
Accumcy
(16)
PMC-CIFAR AR--MLL
(b) PMC-CIFARIO-MLL sim
(c) PMMCCIFARI00-M
(6) PMC-CIF 1000MLLPP
Figure 5: Model accuracy v.s. attack accuracy on CIFAR1O and CIFAR 100 against PMC attack.
D3P
AN
PPDE
MID
DC
InfoScissoes
5050
2
Atteek. sconeey (%)
(96)
40
85
30
40
20
Artoek
50
20
10
5
68
70
72
74
76
80
72
73
74
75
76
77
78
38
40
42
44
46
48
38
40
42
44
46
48
Aucuracy (%6
(%6)
7
Accuracy
(a) AMC-CIFARIO-MLP
(b) AMC-CIFARIO-MEL sim
(c) AMMC-CIFARIO-MML
(d) AMC-CIFARIOO-MOE sim
Figure 6: Model accuracy v.s. attack accuracy on CIFARIO 1O and CIFAR 100 against AMC attack.
For defense against PMC on CIFARIO, InfoScissors achieves 10% attack accuracy (cqual to random guess) by sacrificing less than 0.5% model accuracy, while the other baselines suffer model accuracy drop by more than 4% to achieve the same defense effect. Similarly, InfoScissors achieves 1% attack accuracy on CIFAR 100 by sacrificing less than 1% model accuracy, while the other baselines achieve the same defense effect by sacrificing more than 6% model accuracy.
InfoScissors also shows robustness against AMC attack. InfoScissors achieves attack accuracy of rate of random guess by sacrificing less than 1% and 0.5% model accuracy on CIFAR10 and CIFAR 100, respectively. The other baselines achieve the same defense performance by sacrificing more than 5% and 4% model accuracy, respectively.
5.4 Integration of Input and Prediction Protection
We evaluate the integration of input and prediction protection InfoScissors. We set Xa and X between 0.05-0.4 and evaluate the defenses. The results of defense against the KA and PMC attacks

---

on CIFARIO and CIFARI00 are shown in Fig. 7. is shown that InfoScissors can effectively protect
input data and predictions simultaneously with less than a 2% accuracy drop for both datasets.
0.8
Attack accuracy (%)
KA
15
Attoc accuracy (1))
PMC
40
0.66
PMC
10
20.4
20.4
0.2
Accuracy (%)
Accurncy (%6 1
(a) CIFARIO
(b) CIFARIO0
Figure 7: InfoScissors against KA and PMC.
Conclusion and Limitation
We propose defense method (InfoScissors) defend against data leakage in collaborative inference by reducing the mutual information between the model's intermediate outcomes and the device's input data and predictions. The experimental results show that our method can defend against input leakage and prediction leakage effectively. Our work can make the public aware of the risk of privacy leakage posed by collaborative inference, which is considered a positive societal impact. One limitation of this paper is that we only focus on the scenario where there is only one edge device, even though our defense can easily applied to the collaborative inference scenario with multiple edge devices.
Acknowledgments and Disclosure of Funding
This material is based upon work supported by the U.S. National Science Foundation under award CNS-21 12562 and NAIAD Award 2332744. This work is also supported by ARO W91 191 Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. National Science Foundation, ARO, and their contractors.
References
[1] Wei, Y. Tay, R. Bommasani, C. Raffel, B. Zoph, S. Borgeaud, D. Yogatama, M. Bosma, D. Zhou, D. Metzler, et al., "Emergent abilities of large language models," arXiv preprint arXiv:2206. 07682, 2022.
[2] E. Kasneci, K. SeBler, S. Küchemann, M. Bannert, D. Dementieva, F. Fischer, U. Gasser, G. Groh, Günnemann, Hüllermeier, el al., "Chatgpt for good? on opportunities and challenges of large language models for education," Learning and individual differences, vol. 103, p. 102274, 2023.
[3] G. Li, L., Liu, X. Wang, X. Dong, P. Zhao, and X. Feng. "Auto-tuning neural network quantization framework for collaborative inference between the cloud and edge," in Artificial Neural Networks and Machine Learning-ICANN 2018: 27th International Conference on Artificial Neural Net- works, Rhodes, Greece, October 4-7, 2018, Proceedings, Part 27, pp. 402-411, Springer, 2018.
[4] Y. Kang, J. Hauswald, C. Gao, A. Rovinski, T. Mudge, J. Mars, and L., Tang, "Neurosurgeon: Collaborative intelligence between the cloud and mobile edge," ACM SIGARCH Computer Architecture News, vol. 45, no. 1, pp. 615-629, 2017.
[5] A. E. Eshratifar, M. S. Abrishani, and M. Pedram, "Jointdnn: An efficient training and inference engine for intelligent mobile cloud computing services." IEEE Transactions Mobile Computing, vol. 20, no. 2, pp. 565- 565-576,20 2019.
[6] A. Deckkerd,, N. Vedula, Pei. F. Xia. L. Wang, and Y. Zhang, "Auto-split: A general framework of collaborative edge-cloud ai," in Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 2543-2553, 2021.
[7] M. Li, Y. Li, Y. Tian, L. Jiang, and Q. Xu, "Appealnet: An efficient and highly-accurate edge/cloud collaborative architecture for dnn inference," in 202/ 58th ACM/IEEE Design
Automation Conference (DAC), pp. 409-414, IEEE, 2021.
10

---

[8] N. Shlezinger, E. Farhan, H. Morgenstemn and Y. C. Eldar, "Collaborative inference via ensembles on the edge." in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8478-8488 8482, IEEE, 2021.
[9] H. Zhou, W. Zhang, C. Wang, Ma, and H. Yu, "Bbnet: novel convolutional neural network structure in edge-cloud collaborative inference," Sensors, vol. 21, no. 13, 4494, 2021.
[10] Z. He, T. Zhang, and R. B. Lee, "Model inversion attacks against collaborative inference," in Proceedings of the 35th Annual Computer Security Applications Conference, pp. 1428 2019.
[11] Z. He, T. Zhang, and R. B. Lee, "Attacking and protecting data privacy in inference systems." IEEE Internet of Things Journal, vol. 8, no. 12, pp. 9706-9716, 2020,
collaborative
[12] L. Zhu, Z. Liu, and S. Han, "Deep leakage from gradients," Advances in neural information processing systems, vol. 32, 2019.
[13] B. Zhao, K. R. Mopuri, and H. Bilen, "idlg: Improved deep leakage from gradients," arXiv preprint wwxiv:2001.02///1 2020.
[14] C. Fu, X. Zhang, S. Ji, Chen, J. S,, Guo, J. Zhou, A. X. Liu, and T. Wang. "Label inference attacks against vertical federated learning." in 31st USENIX Security Symposium (USENIX Security 22), pp. 1397-1414, 2022.
[15] O. Li. Sun, X. Yang W. Gao. Zhang, J. Xie, V. Smith, and C. Wang, "Label leakage and protection in two-party split learning," arXiv preprint arXiv:2102.08500 2021.
[16] Y. Liu, Z. Yi. Y. Kang, Y. He, W. Liu, T. Zou, and Q Yang. "Defending label inference and backdoor attacks in vertical federated learning," arXiv preprint arXiv:2 2021.
[17] Wang. Zhang, and R. Jia, "Improving robustness model inversion attacks via mutual information regularization." in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, pp. 11666 11673, 2021.
[18] T. Zou, Y. Liu, and Y.-Q. Zhang, "Mutual information regularization for vertical federated learning," " arXiv preprint 2rXi:23311.01122.2000 2023.
[19] S. Oh, J. Park, S. Back, H. Nam, P. Vepakomma, R. Raskar, M. Bennis, and S.-L. Kim, "Differentially private cutmix for split learning with vision transformer," arXiv preprint 1xXi::2100.19980 2022.
[20] C. Fu, X. Zhang. S. J. Chen, J. Wu, Guo, J. Zhou, A. X. Liu, and T. Wang, "Label inference attacks against vertical federated learning." in 31st USENIX Security Symposium (USENIX Security 22), (Boston, MA), pp. 1314-1414, USENIX Association, Aug. 2022.
[21] A. Makhdoumi, S. Salamatian, N. Fawaz, and M. Médard, "From the information bottleneck to the privacy funnel," in 2014 IEEE Information Theory Workshop (ITW 2014), pp. 501-505, IEEE, 2014.
[22] A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy, "Deep variational information bottleneck," " arXiv preprint arXiv: 1612.0040 2016.
[23] X. Luo, Y. Wu, X. Xiao, and B. C. Ooi, "Feature inference attack on model predictions in vertical federated learning," 2021 IEEE 37th International Conference on Data Engineering (ICDE), pp. 181-192, IEEE, 2021.
[24] X. Jiang, X. Zhou, and Grossklags, "Comprehensive analysis of privacy leakage vertical federated learning during prediction," Proceedings on Privacy Enhancing Technologies, vol. 2022, no. 2, pp. 263-281, 2022.
[25] X. Jin, P.Y Chen, C.-Y. Hsu, C.-M. Yu, and Chen, "Cafe: Catastrophic data leakage in vertical federated learning," Advances in Neural Information Processing Systems, vol. 34, pp. 994-1006. 2021.
11

---

[26] M. Fredrikson, S. Jha, and T. Ristenpart, "Model inversion attacks that exploit confidence information and basic countermeasures." in Proceedings the 22ndACM, SIGSAC conference on computer and communications security, pp. 1322-1333, 2015.
[27] J. Sun, A. Li, B. Wang, H. Yang, H. Li, and Y. Chen, "Soteria: Provable defense against privacy leakage in federated learning from representation perspective." in Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 9311-9319,
[28] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, "Inverting gradients-how easy is it to break privacy in federated learning?"" Advances in Neural Information Processing Systems, vol. 33. pp. 16937-16947, 2020.
[29] H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, "See through gradients: Image batch recovery via gradinversion." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2021.
[30] L. Melis, C. Song, F. De Cristofaro, and V. Shmatikov, "Exploiting unintended feature leakage in collaborative learning," in 2019 IEEE symposium on security and privacy (SP), pp. 691-706, IEEE, 2019.
[31] F. Mireshghallah, M. Taram, P. Ramrakhyani, A. Jalali, D. Tullsen, and H. Esmacilzadeh. "Shredder: Learning noise distributions to protect inference privacy." in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 3-, 2020.
[32] A. Singh, A. Chopra, E. Garza, E. Zhang. P. Vepakomma, V. Sharma, and R. Raskar, "Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12125-12135, 2021.
[33] B. Rassouli and D. Gündüü, "Optimal utility-privacy trade-off with total variation distance as a privacy measure," IEEE Transactions on Information Forensics and Security, vol. 15, pp. 594 603, 2019.
[34] Q. Wu, J. Tang, S. Dang, and G. Chen, "Data privacy and utility trade-off based on mutual information neural estimator," Expert Systems with Applications. vol. 207, p. 1 118012, 2022.
[35] Mireshghallah, M. Taram, A. Jalali, A. T. T. Elthakeb, D. Tullsen, and H. Esmaeilzadeh, "Not all features are equal: Discovering essential features for preserving prediction privacy," in P Proceedings of the Web Conference 2021, pp. 669-680, 2021.
[36] M. Malekzadeh and F. Kawsar, "Salted inference: Enhancing privacy while maintaining efficiency of split inference in mobile computing," in Proceedings of the 25th International Workshop on Mobile Computing Systems and Applications. pp. 14 14-20,20 2024.
[37] K. Chaudhuri and D. Hsu, "Sample complexity bounds for differentially private learning," " in Proceedings of the 24th Annual Conference on Learning Theory, pp. 155-186, JMLR Workshop and Conference Proceedings, 2011.
[38] B. Ghazi, N. Golowich, R. Kumar, P. Manurangsi, and C. Zhang, "Deep learning with label differential privacy," Advances in neural information processing systems, vol. 34, 2021.
pp. 21.227112277
[39] P. C.engg W. Hao, S. Dai, J. Liu, Z. Gan, and L. Carin, "Club: A contrastive log-ratio upper bound of mutual information," " in International conference on machine learning, pp. 1779-1788. PMLR, 2020.
[40] M. Yang, Z. Li, J. Wang, H. Hu, A. Ren, X. Xu, and W. Yi, "Measuring data reconstruction defenses in collaborative inference systems," Advances Neural Information Processing Systems, vol. 35, pp. 12855
[41] R. Shokri and V. Shmatikov, "Privacy-preservie preserving deep learning," in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS '5, (New York, NY, USA). p. 1310-1321, Association for Computing Machinery, 2015.
12

---

A Data Leakage in Collaborative Inference
A.1 Input Leakage from the Representation
With the received representation ri, the server can reconstruct the input data r; on the edge device by conducting model inversion (MI) attacks [17]. Notably, the head model on the edge device is usually shallow due to the computation resource limitation, which aggravates input leakage from the representation [11] I. We conduct experiments on CIFAR 10 with ResNet18 8 demonstrate the input leakage problem. One convolutional layer is deployed on the device as the head model, and one basic block is deployed as the classifier. The malicious server conducts Knowledge Alignment (KA) attack [17] recover the input image from the received representation through a generator. The detailed experimental settings can be found in Sec. 5. The reconstructed images shown in Fig. 8. The high-quality reconstructed images illustrate the collaborative inference's vulnerability to the device's s input leakage from the representation.
Input
Reconstruc
images
images
Figure 8: Reconstructed im- ages of KAA. attack.
A.2 Prediction Leakage from the Feature
The training process enables the cloud server to extract high-level features useful for the collaborative inference task. These high-level features allow the malicious server to fine-tune classifier head with very few labeled data and accurately conduct inference. The leakage of the prediction makes the edge device holder's s privacy, including behavior and preference, exposed the cloud server. For example, prediction leakage of collaborative inference-based navigation mobile app allows the cloud server to infer the positions and destinations of the app users. To demonstrate the extent of prediction leakage by the features, we follow the experimental setup in Appendix A.1 and let the cloud server conduct model completion (MC) attack [14] to train classifier using small number of auxiliary labeled samples. We also let the cloud server train an entire model with the auxiliary dataset from scratch for comparison. The results are shown in Tab. 1.
Table 1:
Compared accuracy of the classifier on the device and the models on the cloud server by conducting MC attack and training from seratch.
Accuracy(56)
Classifier on the device (clean accuracy)
77.20
MC attack on the server(40 labels)
69.31
Train from scratch on the server(40 labels)
15,34
is shown that by fine-tuning a classifier with the collaboratively trained encoder. the cloud server can achieve an accuracy of nearly 70% using an auxiliary dataset with only 40 labeled samples. However, training from scratch cannot achieve decent accuracy using the same auxiliary dataset, which shows that the high-level features extracted by the encoder on the server cause prediction leakage.
13

---

B
Algorithm
Algorithm Training algorithm of InfoScissors. <- means information is sent to the server; means information is sent to the device; red steps are conducted on the cloud server.
Input: Dataset ((x4,,))) Learning rate
Output: :bii..
I: Initialize 6 _0 8r,0" 2b,0;
2: for a batch of data ((r),)))) do
3: (ri)ie3< [S (z:))
4: Lant [6T Σ (x)():)
5: # 1h VuLaai
6:
[zi)ieat + (Jo (r:) Ne:::
Σ CC (zx).ta):
[S
EEB
8:
CLa 1ST
Σ logh (V 22));
9:
8 0" ve
10:
@t ototnVellai
11:
(Ung randomlyy sample {B hes from {us he(ny [aw liea +- randomly sample {Irę JEE from (aihenNy)
12:
13:
Lart - [3
Σ
logg (Zag11)):
14:
CL,t [21
Σ
logha Uo lef):
15:
[V,, [2 (1-Aa Ar) AeCr ti
+haCa ta hes:
16:
VoLt Σ V., VVoo
17:
8"+ 0r V Li
18:
[V. c) VV V,,,ae
VorLt Σ V.:LVorTy ghTz:
20:
8" V Lr
21:
end for
14

---

C
Proofs of theorems
Proof. According Corollary 3.3 in [39], we have:
[(z:y)< < <aancaaaammmeey-KK////////lllldo
(18)
Then we have
= (osp)))))Bx))llpp(())>-=---- <e,
(19)
where c I.LLB((;))) - With the samples (0s, I(zyy) has an unbiased estimation as:
N
N logp(y))< <e.
logp(yi
(20)
Suppose the adversary has an optimal model hm estimate p(y)(z;) such that 1t" (v: p for any i, then
N
1 N (1112)) logp(y))< <E.
(21)
N
N
For classification tasks, we have
(2.)))) > CE Frandom
(22)
N
Proof. Similar with Eq. (20), we derive the following for data protection:
N
N
Σ
logg(æ, (1))
1 N
logp(ı;) <c.
(23)
where (r, (L(p(a)r)llo Following the assumption that p(z|r) follows Gaussian distribution of variance suppose the adversary obtains an optimal estimator Jm of the mean of p(x(r) such that go (xx(r) p2x;/r,) for any i. Then have
logg" n (za(r:)
logp(a;)+e
N
N
log
e 1 (mx)
(z- (n))
1
logp(a;; +e
N
(24)
N
N
N
1
logy
2T
b g (r
(egp(;))+e +e
2N
N
1=1
1
2TT
[ nMhh (r:)) 12:-
log
2N
((x:)
We denote the dimension x as Q and 1 Σ log 2x as k. Then we have p(zc)
2(x-c)
MSE TM (rz)
(25)
Q
15

---

D Baselines and Additional Experimental Results
D.1 Baselines
We compare InfoScissors with five existing defense baselines: (1) Difffernniill Privacy (DP) [10. 11, 19] protects the data with a theoretical guarantee by clipping the representation and gradients norm and injecting perturbations to the representations and gradients. (2) Adding Noise (AN) [40] is proven effective against data leakage in collaborative learning by adding Laplacian noise to the representations and gradients.
(3) Data Compression (DC) [20] prunes representations and gradients that are below threshold magnitude, such that only a part of the representations and gradients are sent the server. Deep Learning (PPDL) [41] is a comprehensive privacy-enhancio method including three defense strategies: differential privacy, data compression, and random selection. (5) Mutual Information Regularization Defense (MID) [18] is the SOTA defense against data leakage in split learning and collaborative inference. MID also based on mutual information regularization by applying Variational Information Bottleneck (VIB).
(4)
D.2 Additional results
The malicious server uses models with different architectures (MLP and MLP p__smmmmmmm to conduct MC attacks. MI.P_sin has one FC layer. MLP has three FC layers with hidden layer of size 512 x 256.
Besides the experiments in Sec. auxiliary dataset on the malicious server. The server has 80 and 800 labeled samples to conduct KA and MC attacks for CIFARIO and CIFARIO0, respectively, and the results are shown Fig.
also evaluate defense against the KAA attack with larger
0.8
SSIM
SSIM
0.6
0.4
0.2
38
40
42
44
46
48
64
68
72
76
80
Accuracy(%)
Accuracy(%)
(a) CIFARIO
(b) CIF ARI00
Figure 9: Model accuracy v.s. SSIM on CIFARIO and CIFARI00 against KAA. attack with double numbers of auxiliary samples in Fig. 3.
16

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The contributions in the introduction conclude the main contributions of this paper.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Please see Sec. 6.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images taken in low lighting. Or speech-to-tert system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should diseuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknow judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set assumptions and a complete (and correct) proof?
Answer: [Yes]
17

---

Justification:
Please check Sec. 4.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data provided not)?
Answer: [Yes]
Justification: Please check Sec. 5.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-soure source models, it may that access to the model is limited some way (e.g.. registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?
18

---

Answer: [Yes]
Justification:
Please check our supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please the NeurlPS code and data submission guidelines (https: /ttp://npppp.ee cc/
pub 1 / guides
des CoodeSuomi ssi asionPoll icy) for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / /nips. cc/ htte/puliion weaii///uiieee gwtgesiies///e// /Codee/C "oCCoooSuuaa Submi ms sesiissionnn ooooooiioio for more details.
The authors should provide instructions on data access and preparation, including how access the data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines, If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Please check Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance the experiments?
Question:
Answer: [Yes]
Justification: Please check Sec. 5.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
19

---

It is OK to report 1 1-sigma eтror bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: Please check Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethies
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: http://pp.pcccpoolaoo/aaaaccaaae
Answer:
[Yes]
Justification:
The research conforms with NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special considera- tion due laws regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please check Sec. 6.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), pooups)).rivvcyy considerations. and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it legitimate to point out that improvement in the quality of generative models could be used to
20

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators. or scraped datasets)?
Question:
Answer: [NA]
Justification:
We do not release a model scraped datasets.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer:
[Yes]
Justification: We cite corresponding papers when using the pre-trained models and existing datasets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paper a wii choode. com / datasets has curated licenses for some datasets. Their licensing guide help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
21

---

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not have new datasets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/codeemmodll as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
22


Reviews:
[{"review_id": "p07NNu84ge", "reviewer": "Reviewer_oDHU", "summary": "This paper provides InfoScissors, a learning algorithm that regularizes the model during the training phase. This paper also compares their method with VIB-based methods and evaluates it with multiple attacks.", "questions": "No", "limitations": "The paper does not measure the method with real large-size datasets.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper provides the theoretical analysis for the defense method and also compares it with VIB-based methods.", "weaknesses": "The author claims that LLMs cannot be handled on edge devices; however, in the evaluation part, they only use CIFAR10 and CIFAR100, both of which can be handled by edge devices. The paper does not measure the method with real large-size datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels. \n\n| Model | $\\lambda_l$ | Accuracy($\\uparrow$) | Attack Accuracy($\\downarrow$) |\n|--------|---------|------------|-------------|\n| RedNet18 | 0 (no defense)  | 58.05%     | 35.44%      |\n|      | 0.05  | 57.58%     | 23.64%      |\n|      | 0.1  | 57.03%     | 11.17%      |\n|      | 0.3  | 56.87%     | 1.87%      |\n| VIT     | 0 (no defense)  | 54.85%     | 31.24%      |\n|    | 0.05  | 53.75%     | 18.35%      |\n|     | 0.1  | 52.52%     | 8.62%      |\n|     | 0.3  | 51.83%     | 1.56%      |\n\n\nThe results for comparison with other baselines can be found in the global response PDF file. Our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TUra9xKiBN", "reviewer": "Reviewer_cnFp", "summary": "This paper considers a setting where two parties (Cloud Server and Edge Device) are collaboratively training a deep model. The threat model considers both inputs and outputs to be private data of the Edge Device that should be protected from the Cloud Server. The authors propose a learning algorithm that is theoretically motivated by a recent method called CLUB [38], and performs better than other baselines on two datasets CIFAR10 and CIFAR100.  The main contribution of this paper is that the authors show CLUB offers better optimization results compared to Variational Information Bottleneck (VIB).", "questions": "(1) One important, but totally ignored, aspect of the proposed framework (Figure 1) is that the Cloud Server can run the classifier part (that is \\theta^c) and easily discover y without needing any sophisticated attack. Unless, the authors argue that the classifier part is not available to Cloud Server! Which is a strong and unrealistic assumption because usually the server is the entity that trains the model and then splits it among the Edge devices.  I am struggling to find a real-world application in which the Edge Device has access to the classifier part but the Cloud Server does not have that access. Authors need to clarify and motivate this.\n\n(2) When reading the paper, it is not clear to distinguish between training vs. inference stage. The title mentions “Collaborative Inference”, but the paper is actually more related to “Collaborative Training”. The fact that two parties (Cloud Server and Edge Device) are collaborating in training a model or they are collaborating in making a prediction (via a trained model in inference mode) makes a huge difference in terms of threat model and evaluation. The authors need to revise the text and make this as clear as possible from the beginning of the paper. It is also suggested to discuss relevance to a work published last year https://arxiv.org/abs/2310.13384 (Salted Inference: Enhancing Privacy while Maintaining Efficiency of Split Inference in Mobile Computing)\n\n(3) The authors should compare and clarify the contribution of this paper compared to Club [38]. They should explain to what extent the theoretical analysis of this paper is novel compared to what has been already presented in [38].\n\n(4) The paper should show the performance of the work on more complex data types. The two chosen datasets are of similar complexity. Similarly, beside ResNet 18, other model architectures should be examined. It is not clear if this method only works for ConvNets or whether it supports other types of layers.\n\n(5) In Figure 3, it is not clear what is the difference between different rows. For each method there are three pairs of images and results, but how different are these and in what sense?", "limitations": "The main limitation is that the generalization of the method to other complex datasets and model architectures is not explored or discussed.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is well written, easy to follow, and relevant to the ML community. The baselines are studied and elaborated properly. The algorithm is supported both empirically and theoretically and the results suggest state-of-the-art performance. Overall, I am happy about this work and I appreciate the author's hard work and novelty.", "weaknesses": "The main weaknesses are motivation of the problem and the evaluations of the algorithm. The paper needs some improvements in this regard. Please see below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your review and constructive suggestions. We are delighted to answer the questions and address the concerns.\n\n## W1. \nIn real life, there are some applications and settings where the classifier or other head models are deployed on the edge. For example, in some medical applications, the encoder on the cloud server will extract the features while the diagnosis results (prediction) are calculated on the wearable devices since the diagnosis results might contain private information of the user. The other practical setting is that the user might need to finetune the classifier or other head models on the device using their private data, which cannot be shared with the server. In such a case, the classifier has to be deployed on the edge device, and the prediction needs to be protected.\n\n## W2. \nThanks for your constructive suggestion. We are delighted to explain the settings of our paper. The goal of our method is to preserve user privacy in collaborative inference, and privacy preservation is achieved by manipulating the training phase (i.e., collaborative training). By applying our defense, the model is normalized to filter the private information when extracting features and representations, such that privacy is preserved during the inference phase. We will revise our draft to clarify this point more clearly in the introduction section.\n\nThanks for your reference. The setting of this paper is similar to our paper, which also realizes inference privacy by normalizing the training procedure. But they only focus on prediction protection. Technically, they add noise to the training label by randomly sampling a class label, which is intuitively correct. Our training method is theoretically derived from the perspective of mutual information, and we provide a theoretical analysis of our defense performance. Even though we are distinguished from the methodology, we still appreciate your suggestion and will include it in the related work. \n\n## W3. \nCLUB is a paper focusing on approximating the mutual information upper bound, while our paper utilizes the mutual information to defend against privacy leakage. Thus, our contribution is more about privacy preservation, which is different from the goal of CLUB. The novelty of our theoretical analysis is that we analyze why we should choose CLUB rather than other approximations to approximate the upper bound of mutual information between the data and the representations. When you want to minimize the mutual information, there are many choices of approximation. Most of the existing related works apply \\textit{Variational Information Bottleneck (VIB)}[22] since it is the most widely applied approximation of mutual information upper bound. However, we analyze that when defending data privacy, VIB is sub-optimal and could sacrifice too much performance. Following our analysis, we find that CLUB is a better approximation to apply. In other words, we do not modify the detailed approximation method (i.e., CLUB), and that is not our focus and novelty. Our novelty is that we theoretically analyzed the superiority of applying CLUB over the other mutual information approximations in collaborative inference defense. The multi-stage training procedure derived from the multiple training objectives is also a novelty of our paper.\n\n## W4. \nThanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels. \n\n| Model | $\\lambda_l$ | Accuracy($\\uparrow$) | Attack Accuracy($\\downarrow$) |\n|--------|---------|------------|-------------|\n| RedNet18 | 0 (no defense)  | 58.05%     | 35.44%      |\n|      | 0.05  | 57.58%     | 23.64%      |\n|      | 0.1  | 57.03%     | 11.17%      |\n|      | 0.3  | 56.87%     | 1.87%      |\n| ViT-B/16     | 0 (no defense)  | 54.85%     | 31.24%      |\n|    | 0.05  | 53.75%     | 18.35%      |\n|     | 0.1  | 52.52%     | 8.62%      |\n|     | 0.3  | 51.83%     | 1.56%      |\n\n\nThe results for comparison with other baselines can be found in the global response PDF file. It is shown that our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures.\n\n\n\n## W5. \nWe apologize for the confusion. Different rows present different defense levels. The bottom row applies the highest defense strength; thus, the reconstructed image is low-quality while the accuracy is sacrificed. We will revise the caption to clarify this.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yIVGKZqGA1", "reviewer": "Reviewer_B5D2", "summary": "The collaborative inference enables resource-constrained IoT devices to support deep learning applications without sharing raw data with the cloud server, but previous research has revealed that this approach still leaks input and prediction information from edge devices. To address this vulnerability, the authors propose InfoScissors, a defense strategy designed to minimize the mutual information between a model's inner states and the device's input and outputs. The effectiveness of InfoScissors is evaluated on common datasets like CIFAR10/100 against various attacks, demonstrating its superiority over existing defense strategies that utilize mutual information. The paper also provides theoretical analysis to support the proposed method.", "questions": "See comments above", "limitations": "None", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "+ Study of an important privacy issue in collaborative inference.", "weaknesses": "- The novelty of proposed method is somehow limited. The proposed defense InfoScissors relies on the Mutual Information (MI) regularization that has been explored in previous study like MID. The paper directly adopts a new formulation [38] for the upper bound of MI terms. As a result, the novelty and contribution of this paper appear to be limited. Compared to previous VIB-based approaches, even though the authors manage to find out several advantages  and provide a theoretical explanation, the challenges are not clear.\n\n\n- Limited evaluation of adaptive attack, making the robustness of proposed defense InfoScissors doubtful. The only mention of adaptive attack is the AMC attack, but there is not many details about the adaptive attack. A strong adversary can follow the proposed method to train surrogates classifier and generator to mimic the victim's data. I suggest the authors to clarify the adversary capacity and thoroughly evaluate the potential privacy breach after the method is known by the adversary.\n\n- Limited evaluation of benchmarks. The paper only evaluates on the simple benchmark like CIFAR10/100 but not more large-scale dataset like ImageNet. The model architecture evaluation is also important to demonstrate the scalability of proposed defense. Also, it seems that the method is only evaluated on the vision classification models, is it applicable to generative model or other tasks? If so, what is the cost of efficiency and accuracy?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your review and constructive suggestions. We are delighted to answer the questions and address the concerns.\n\n## W1. \nThe novelty of our theoretical analysis is that we analyze why we should choose CLUB rather than other approximations to approximate the upper bound of mutual information between the data and the representations. We do not modify the detailed approximation method (i.e., CLUB), and that is not our focus. Our novelty is that we theoretically analyzed the superiority of applying CLUB over the other mutual information approximations in collaborative inference defense. The multi-stage training procedure derived from the multiple training objectives is also a novelty of our paper. I appreciate that you recognize that we provide a theoretical explanation of the superiority of applying CLUB. When you understand our theoretical explanation, there will be no challenge to choose CLUB for approximation. However, without our analysis, it will be challenging to achieve optimal performance-defense trade-off because there is no clue to select the optimal approximation for MI in privacy preservation. Previous works select VIB because VIB is the most widely applied approximation method, but it is not optimal under the collaborative inference privacy-preservation setting.\n\n## W2. \nThanks for the constructive suggestion, we will add more details about the adaptive attack, AMC attack, and the adversary's capability in the revised draft section 3.2 and section 5.1. In our threat model, the adversary (i.e., malicious server) is capable of training a surrogate classifier and generator to mimic the victim's data. The primary goal of our defense is to make the collaborative model depend less on the encoder on the server for specific tasks. Such that the data and prediction information can be filtered during inference. Under the adaptive attack setting, we enable the adversary to modify the training profiling such that it can trick the collaborative model into relying more on its encoder, thereby extracting more private data information from the encoder's features. In this setting, the adversary is directly confronting the fundamental principles of our defense method, constituting a highly potent form of adaptive attack. The results show that our defense is capable of defending such a strong adaptive attack.\n\n## W3. \nThanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels. \n\n| Model | $\\lambda_l$ | Accuracy($\\uparrow$) | Attack Accuracy($\\downarrow$) |\n|--------|---------|------------|-------------|\n| RedNet18 | 0 (no defense)  | 58.05%     | 35.44%      |\n|      | 0.05  | 57.58%     | 23.64%      |\n|      | 0.1  | 57.03%     | 11.17%      |\n|      | 0.3  | 56.87%     | 1.87%      |\n| ViT-B/16     | 0 (no defense)  | 54.85%     | 31.24%      |\n|    | 0.05  | 53.75%     | 18.35%      |\n|     | 0.1  | 52.52%     | 8.62%      |\n|     | 0.3  | 51.83%     | 1.56%      |\n\n\nThe results for comparison with other baselines can be found in the global response PDF file. It is shown that our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures. Our defense against the model inversion attacks shows the high potential of our method in generative tasks. We also evaluate our method under the credit fraud detection task on the UCI\\_Default\\_Credit with MLPs, the results are shown below.\n\n| $\\lambda_l$ | AUC($\\uparrow$ to 1) | AUC($\\downarrow$ to 0.5) |\n|--------|---------|------------|\n|  0 (no defense)  | 0.783     | 0.673      |\n| 0.05  | 0.778     | 0.603      |\n| 0.1  | 0.755     | 0.536      |\n| 0.3  | 0.746    | 0.502      |\n\n\n\nIt is shown that our method can also achieve a good performance-privacy trade-off on different tasks.\n\nWe appreciate your review and constructive suggestions. Please let us know if you have any new questions or concerns.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Here are the results against PMC attacks on mini-ImageNet with different model architectures.

Meta-review: **Summary**

This paper introduces InfoScissors, a defense method to reduce data leakage in collaborative inference by minimizing mutual information between a model’s intermediate states and the edge device's input/output. The authors propose using CLUB, a mutual information approximation, instead of the more commonly used VIB, providing both theoretical analysis and empirical evidence across various datasets.

**Decision**

I recommend accepting this paper. The approach addresses an important privacy issue and offers a novel defense mechanism that shows improved performance in preserving privacy while maintaining model accuracy. The authors have responded well to reviewer concerns, particularly by expanding their evaluations to larger datasets (e.g., mini-ImageNet) and different model architectures (ViT). Although more real-world dataset evaluations would strengthen the paper, the theoretical contributions and empirical results support the paper’s significance and relevance to the field.

For the final version, I encourage the authors to enhance clarity on adaptive attacks and ensure that additional experiments are included.
Decision: Accept (poster)