On the Ability of Developers' Training Data Preservation of Learnware
Authors: Hao-Yi Lei
Zhi-Hao Tan
Zhi-Hua Zhou
Venue: NeurIPS 2024 poster (2024)
Keywords: Learnware
Model Specification
Reduced Kernel Mean Embedding
Data Preservation
Synthetic Data
Learnware Dock System
Primary area: learning_theory
TL;DR: We conducted a theoretical analysis of the data protection capabilities of the Reduced Kernel Mean Embeding (RKME) specification in learnware.

Abstract: The learnware paradigm aims to enable users to leverage numerous existing well-trained models instead of building machine learning models from scratch. In this paradigm, developers worldwide can submit their well-trained models spontaneously into a learnware dock system, and the system helps developers generate specification for each model to form a learnware. As the key component, a specification should characterize the capabilities of the model, enabling it to be adequately identified and reused, while preserving the developer's original data. Recently, the RKME (Reduced Kernel Mean Embedding) specification was proposed and most commonly utilized. This paper provides a theoretical analysis of RKME specification about its preservation ability for developer's training data. By modeling it as a geometric problem on manifolds and utilizing tools from geometric analysis, we prove that the RKME specification is able to disclose none of the developer's original data and possesses robust defense against common inference attacks, while preserving sufficient information for effective learnware identification.

On the Ability of Developers' Training Data Preservation of Learnware
Hao-Yi Yi Lei, Zhi-Hao Tan, Zhi-Hua Zhou
National Key Laboratory for Novel Software Technology. Nanjing University, China School Artificial Intelligence, Nanjing University, China {leihy, tanzh, zhouzh)@11 @mla. nju. edu. anj..du.... cn
Abstract
The learnware paradigm aims to enable users to leverage numerous existing well- trained models instead of building machine learning models from scratch. In this paradigm, developers worldwide can submit their well-trained models sponta- neously into learnware dock system, and the system helps developers generate specification for each model to form a learnware. As the key component, specifi- cation should characterize the capabilities the model, enabling it be adequately identified and reused, while preserving the developer's original data. Recently, the RKME (Reduced Kernel Mean Embedding) specification was proposed and most commonly utilized. This paper provides theoretical analysis of RKME specifi- cation about its preservation ability for developer's 's training data. By modeling it geometric problem manifolds and utilizing tools from geometric analysis, we prove that the RKME specification able to disclose none of the developer's original data and possesses robust defense against common inference attacks, while preserving sufficient information for effective learnware identification.
Introduction
Various machine learning models have been applied into various aspects of modern life success- fully [Butler et al. 22088 20188]umper Jumper et al., [202T]. In conventional machine learning paradigm, developing a high-quality model for new task from scratch requires substantial amount of labeled data, exper- tise, and computational resources, while it is ideal if the solution of the new task can be built based on reusing existing models. Generally, source data is crucial for transferring and reusing existing models, however, concerns over data privacy and proprietary often hinder the sharing among developers.
The Learnware paradigm [Zhou] 2016 Zhou and Tan 2024 offers systematical way enabling users to build a new machine learning solution by exploiting existing well-trained models, rather than building model from scratch. learnware is well-trained machine learning model facilitated with a specification, which characterizes the ability and specialty of the model to some degree, enabling the model to be adequately reused for new users without access to the original data used to train the model by its developer. Developers all over the world can submit their trained models into learnware dock system spontancously, and the system helps developers generate specifications, without access to the developer's ' training data. When user wants to tackle her learning task, instead of starting from scratch, she can submit her requirement to the learnware dock system, which will then identify and return helpful learnware(s) to the user to reuse, such that the user can get better performance than using her own data train model from scratch. Note that developers generally need to preserve their training data. To realize this attractive vision, the key challenge is: To solve new tasks, how to identify and even reassemble a few helpful models from the huge amount of learnwares accommodated in the dock system, without accessing each developer's training data?
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

The specification is pivotal in the paradigm design [Zhou and Tan 2024]. Recently based on the
RKME (reduced kernel mean embedding) specification [Zhou and Tan 2024 many studies about
learnware identification and reuse have been reported (Liu et al. 2024 Tan et al. 2023 Xie et al.
2023 Tan et al., 2024a Wu et al., 2023]. Also, the Beimingwu learnware dock system has been developed and released [Tan et al.) 2024b].
is worth noting that, there lacks theoretical analysis of the preservation ability of RKME specification for developer's training data. The theoretical analysis faces some significant challenges. Firstly, the RKME specification is generated by solving non-convex optimization problem, whose possible solutions adhere to nonlinear system of equations and, inherently, do not have a closed-form solution. This complexity makes direct analysis intractable. Moreover, the generation process of RKME is deterministie, but the size of RKME is small, where adding noise during this process often degrades its performance for learnware identification. Consequently, commonly used analytical tools for data privacy, such as Differential Privacy (DP), become inapplicable. To the best of our knowledge, there little research analyzing whether and how synthetic data generated by deterministic algorithms can protect original data from being vulnerable to privacy attacks, especially considering that brute- force attacks often succeed against deterministic algorithms. In this paper, we prove that the RKME specification is able to protect the developer's original data from disclosure, and possess robust defense against common inference attacks, while preserving sufficient information for learnware identification. Our technique also provides a way to investigate the privacy preservation ability of synthetic data generated by deterministic algorithms. The main contributions of this work are summarized as follows:
We prove that as the size of RKME specification decreases, the possibility that it discloses the original training data decreases at an exponential rate. Meanwhile, the ability of learnware identification is positively correlated with the size of RKME specification, and thus also need a sufficient size. We prove that within a certain range of sizes, the RKME specification won't 't disclose any original training data for almost all datasets, while it remains sufficient information enabling effective learnware identification.
We prove that RKME exhibits significant resistance to the two common types of data dis- closure attacks: linkage and inference. We provide a method to measure data leakage of RKME and illustrate that the risk of RKME specification data leakage diminishes as the size of specification decreases. Within a certain range of sizes, the RKME can effectively resist these two types of attacks, while maintaining sufficient information for learnware identi- fication. Moreover, we analyze that the above two ranges of sizes are heavily overlapped, implying that determining adequate sizes that enable learnware identification but preserving developer's 's data is practical.
2 Preliminary
In this paper, for the theoretical analysis of the preservation ability of RKME specification simplicity, we consider the following simplified learnware paradigm based on RKME specification. The learware paradigm consists of two stages: submitting and deploying stages.
Submitting stage. In this stage, model developers submit their models to the learnware dock system. To better characterize these models, developers also provide the specification R with each model to the system, which is generated by the RKME mechanism from the dataset D used to train the model. A model together with its corresponding specification forms a learnware.
Deploying stage. In this stage, the user has learning task and unlabeled dataset D,. To tackle the task, the user submits the task requirement R,,, which is generated by the RKME mechanism from the dataset D.. and the system identifies helpful learnwares by comparing which learnware specifications are "close" to Ry Subsequently, the user can solve her task by reusing these learnwares.
It is evident that the design of specifications is of great importance. To make the learnware identifica- tion (also called the search process) more precise, we hope the specification should contain some information about the data of the developers (or users). On the other hand, since developers face the challenge of uploading their specifications, it's crucial that the specification should protect the original data of the developer. The RKME generation process can be described as follows:

---

vn Σ ==1
F( .. Zni P1, ... Bmi 21, Am)) =
k )
Byk(zz, :
(1)
Here, (x1,-.. In. is the original dataset D of the developer sampling from certain distribution P. with each data point 2; (x) ...... x.)) being d-dimensional. The RKME specification generated from D is R [,1..... Pm: 21. ... 2m that minimizes Eq. (I) given the number of synthetic data m. We will focus the set Z {=1.- 2mm, which consists of synthetic data sharing the same feature space with Zi. The 3. E IR are weights corresponding to each Z;. Here k(:,-) is a kernel function, and - | the norm in the reproducing kernel Hilbert space induced by k((,,). -). In this paper, we conduct our proofs using the Gaussian kernel k(x,, x") ) exp( -ep(->llz- x' 22112)) where y > O, which is currently employed for generating RKME specifications. The generalizability of our proofs to other kernels will be discussed in the section
The ability of RKME search models can be characterized by its approximation of the Kernel Mean Embedding (KME) [Smola et al. 2007] of the original data distribution, as this reflects how well RKME characterizes the original data distribution. From Zhang et al. [2021]. we arrive the following conclusion:
Lemma 2.1. Let the kernel k satisfies that k(xxx) x) for all X and any 8 >> 0, we have
2 m 2 1 mll 2
/2 /2log(1/0) /
(2)
with probability at least - 6, where js is RKME of D and p. is KME of original data distribution P.
vn allows RKME to effectively search models, achieving success [Tan et al., [023 Liu al. 2024 However, analysis of how RKME protects the data of both developers and users from theoretical perspective is still lacking. Since the synthetic data shares the same feature space with X, is essential to investigate whether RKME contains any original data. Furthermore, whether the original data can be inferred from RKME through specific attack methods remains unknown. The following sections of this paper will explore these perspectives to prove RKME's data preservation ability. All proofs are provided in the Appendix C
Existing experimental results have demonstrated that selecting
Specification contains no original data
To analyze the RKME specification's 's ability to preserve original data, we first need to determine whether the specification contains original data. this section, our objective to quantify the consistency of synthetic data in RKME with the original data, as with most studies considering the privacy protection of synthetic data [Raghunathan, 202T Abowd and Vilhuber 2008). Since RKME is generated through deterministic algorithm, the above issue becomes more pressing than in randomized algorithms, where the output uncertainty can mitigate such concerns.
Quantifying approach. To quantify whether (.,,... 2m } in RKME contains any data from the original dataset {x1,... Fn ), we analyze whether there exist E {1,... } and j E {1,-... .....n) n. such that 2; Tj. or more generally, ||2; - æzı S 6, which means that there are samples in RKME that are very close to some original data. We propose the following quantitative metric:
Definition 3.1 (Consistency risk). We define the consistency risk of the RKME Z, generated from samples D drawn from the distribution P, containing original true data as:
(P(P) EDapp (Iz, n DDya).
where I is the indicator function, and ZB Ds # @ indicates that, given 6, there exists i (1.....m) m) and j E (1, (1.... n. such that [ Ity 8.
As can be seen, the defined risk function R represents the probability that the RKME generated from n samples drawn from a potential distribution P may contain one of these n original samples. The randomness here arises from the randomness of the sample set. It is evident that the value of (c(P) ranges between [0, 1). with smaller values indicating lower risk of RKME containing original samples. In the following, we will analyze the consistency risk for RKME specification.
3

---

Technical overview. To analyze the defined risk Rc(P), the most natural approach would be to find a closed-form solution for Z in relation to D. which would allow for direct comparison of the elements of Z and D. Unfortunately, solving the theoretical minimum of Eq. ① is nonlinear equation that does not have closed-form solution. Therefore, this paper employs geometric analysis tools Postt 2008 Li 2012], and analyzes the critical set of Eq. ①T to quantify the differences between the data in the synthetic set and the original sample set without solving the equation. To the best of our knowledge, we provide the first analysis based on geometric analysis tools to quantify privacy risk, which sheds light on data preservation analysis.
3.1 Consistene risk evaluation
We start our analysis with the case of the data dimension d = 1, and as we will see, the case for any dimension can be reduced to the analysis of this scenario d 1. To facilitate the use of geometric tools, we consider all data in the original dataset D and its corresponding RKME Z as wholes, namely as points in spaces R and R respectively. Let us denote them by Z = (Zi,-... 2m) in Rmm. The problem then translates into whether these two spaces have points with identical coordinate components. The upper bound of Re is ensured based on the fact that in the space RR" where D resides, the set of D corresponding to Z in RT with coordinate components equal to D is of small measure. In the remainder of the section, we will prove this.
(#1 ... , .Fn) R and
We begin our analysis with the case of å = 0, focusing solely on whether any component of Z is strictly identical to D. Our starting point is the correspondence between D and Z. From this, we derive the following proposition:
Proposition 3.2. The set of D in TR. that satisfies the condition of having multiple distinct Z which
minimize Eq. 7 constitutes a of measure zero.
Proposition 3.2 allows us to consider the remaining D in TR" after removing a set of zero measures.
These D correspond uniquely minimum value Z. If we fix Z, then, based on a similar idea as in the Implicit Function Theorem, we arrive at the following conclusion.
Proposition 3.3. Given Z and {[,))-- consider the set Mz defined as follows:
Mz = (wi..... Mu) E RK F(y,, ... Uni Z) S F( Iiii Z), V(E, .In) E R²)
This set forms a manifold of dimension n - 2m.. The subset M'z. defined as M2 ".",,... v..) E Mz Bi, j. 24 yj
constitutes a submanifold of Mz with a dimension not exceeding n 2m - 1.
According Proposition 3.2, we know that disregarding a set of zero measures, the Mz correspond- ing to different Z are disjoint In each Mz, the D with components identical to Z form submanifold M22 of dimension not higher than n 2m 1. Consequently, we obtaín a representation for all possible points in R" where D intersects with the generated Z: they constitute a subset M = -
Z Given that the dimension of Z is m, the Hausdorff dimension of M(actually M is a manifold) is not greater than 1, which makes it zero measurement set in RT, Thus, we conclude that for D, which could possibly have the same coordinates as the generated Z, is of measure zero in IR., From this observation, together with Proposition 3.22 have the following theorem:
Theorem 3.4. For any continuous original data distribution P, when the size of the RKME set we have that the consistency risk Re(P) = O.
satisfies m < a
2.
If is discrete distribution, then the above inference may not hold if the discrete values fall on M. If has very few possible values, Z will contain points from the original D when the number of points in Z is large (due to the presence of many identical samples in D). In such cases, we find that by limiting m to fewer than the possible values of P. we can still prove Rc(P) = using some combinatorial techniques. Similar conclusions hold for mixed-type distributions.
In practical applications, is desirable to ensure that RKME does not contain samples identical to those in the original dataset D. Therefore, we further explore whether RKME may include samples that are very close to those in the original data D, i.e., 8 > O. A crucial aspect of addressing this issue involves the setting of 8, which is significantly influenced by the inherent scale of the data and

---

the spacing between the data points. We will adopt a commonly used approach, selecting 5 as the normalized value by the minimum spacing between different samples in the dataset.
Our idea of handling this scenario fundamentally similar to that of = 0. Given Z, we similarly
define Mz. and Mz. is now defined M {(11,... ;,,) E M 3i |z; yyl S 8). In this Un))
case, MM forms measurable subset of Mz with dimension of n 2m. Based on the selection of ô as previously described, our objective achieve this, we estimate the local curvature, perform local linearization, and use ideas similar to isoperimetric inequalities for the estimation. We arrive at the following conclusion.
estimate the ratio of the areas of My and Mz. To
Theorem 3,5 (Bound of consistency risk). For any continuous original data distribution P. for RKME with m synthetic data, we have
Rc(P) <0 (1) 2m
(3)
Remark We believe that the privacy protection afforded by RKME results from the many-to-one correspondence between the original sample set and the generated RKME. This is essentially a loss of individual member information caused by compression. However, not all synthetic data generation processes like this can achieve similar ideal effects. We have proved that if we choose the Laplacian kemee (k<xx, y) exp (-yllı 3/[11) )) instead of the Gaussian kernel in Appendix C.8 Theorem 3.4 would no longer hold. fact. with the Laplacian kernel, we can prove that the synthetic data induced by the corresponding RKME will definitely contain data identical to the original sample set. This underscores the rationality of choosing the Gaussian kernel RKME as our specification.
For cases where the data dimension d > 1, we can similarly define DD [(I ... || E ]"} and = {[I[= Il. .... || II) E "... Using the same approach, and based on Thm. 3.5 and the inequality | y/l s |||=||| ||yl|| we can derive conclusions for the d-dimensional case. The only
difference is a change in order, as given by the formula: (C(P) < O ((t)
dn 2dm
3.2 Data preservation and search ability
As indicated in Thm. 3.5 observe that the consistency risk decreases the size of the RKME specification decreases, which means that selecting a smaller number of synthetic data points m can better ensure that RKME does not contain samples closely resembling the original data. If represent the data protection capability of RKME in terms of not containing original data using 1 (P), and the ability of RKME for search derived in Lemma 2.1 can illustrate the resulting trade-off, as shown in the following graph.
In this Pareto frontier, it is challenging to define the exact point of Pareto optimality, This difficulty arises from the differing scales of measuring data protection capabilities and
protection oxcability aim tn actioee
Korov spures
the gap in RKME's approximation of the ac-
Data Preservaton
tual data distribution KME,, which represents search efficiency. find the Pareto optimum due to these distinct measurement scales. However, fortunately, in existing works, we have observed that when larger
sanch 201 we ain achieve
is hard to set a rule
Ayr
the size of the RKME specification than VT, the specification achieves satisfac- tory results in the Learnware's s search tasks. In this paper, we propose the following corollary:
Number of Synthetic
Figure 1: Trade-off between data consistency preser-
vation and search ability.
Corollary 3.6. If we choose m < k where k 2 for our defined Rc(P), we obtain the following equation:
Rc(P) < 0.001.
(4)
This implies that we are 99.9% confident that for any dataset D sampled from the distribution P, the generated RKME will contain synthetic data points that are close the original samples in D.
The conclusion above offers flexible approach to selecting the number of synthetic data points m in RKME. As illustrated in Fig. 3.2, the shaded area encompasses the range that allows RKME to
5

---

achieve efficient search capabilities and robust data protection, specifically in terms of not containing data closely similar the original dataset.
4 Specification defends data inference
Whether a learnware's 's specification contains original data is not the only concern for its data protection
ability. [Stadler et al.] [022]]
note that synthetic data may not withstand traditional data attacks
2018 (Swennyy] (002), and attribute disclosure [Elliot et al. 2018 Common defenses against these attacks usually involve formal privacy guarantees during the training process of the generative model to prevent breaches [Abowd and Vilhuber 2008 [Bindschaedler al. 2017], or the addition of noise the synthetic data generation process to satisfy differential privacy criteria [Xin et al. [022 Jordon et al. 2018). However, there still a lack of research on whether synthetic data generated by a deterministic mechanism can naturally resist these attacks without extra noise.
such as linkage [Elliot et al.
Machanavajihala et al. 2007].
RKME, in addition to potentially containing explicit original data, may also implicitly contain certain information about the data, which could be inferred under these two types of attacks. We aim to prove that RKME can protect against such inferences from the original data.
Quantifying approach. We suggest that the RKME mechanism, deterministic generation mechanism, serves as a data anonymization solution [Kuppa et al., 2021]. To verify whether the generation of the specification acts as effective anonymization mechanism, our objective is to quantify whether such a specification can address the data leakage risks that data anonymization techniques are designed to mitigate. We quantified the data leakage risks associated with two types of concerns: linkability and inference ability, which correspond to the defenses against the linkage attack and the disclosure of attributes, respectively. For the risks of linkability and inference, model each privacy concern as an adversary tasked with determining whether, given the specification or the original dataset, information about component r, of sample x in X, or its attributes, can be inferred. For each adversary, we define a data leakage risk to measure the risk of the adversary inferring the sample x or its attributes from X after the RKME of dataset D has been released.
4.1 Linkability risk evaluation
In considering data sharing with privacy protection characteristics, primary concern is the risk of linkability, which corresponds to an adversary conducting a linkage attack on the data. A linkage attack aims to link a target record to single record group of records in sensitive dataset. Specifically, we model the linkage attack as an adversary attempting to demonstrate whether a record present in sensitive dataset.
Quantifying approach. We suggest that the RKME generation mechanism, deterministic generation mechanism, serves as a data anonymization solution [Kuppa et al.) 2021]. To verify whether the generation of the specification acts as effective anonymization mechanism, we aim to quantify whether such a specification can address the data leakage risks that data anonymization techniques were designed to mitigate. We quantified the data leakage risks associated with the two types of leakage concerns: linkability and inference. These two are universally important de- anonymization techniques. Additionally, the synthetic data generated by RKME and the original data exist within the same feature space, making linkage attacks a potentially successful form of attack within the learnware paradigm, and thus a focal point of our analysis. Moreover, an attacker attempting to compromise the original data through RKME can only access a specific RKME, rendering many attacks ineffective in the learnware paradigm (such as requiring multiple queries).
Linkability privacy game. Following the works of (Pyrgelis et al. 2017 Yeom et al. 2018 Stadler
et al. 2022], we model the risk of linkability as a membership privacy game between an adversary A and challenger C. In the learnware paradigm, learnware developers, who are also holders of the original data D, are considered as the challengers in the membership privacy game, where Z generated from D is visible to the adversary A. The objective of the adversary A is to infer whether a target record xr, chosen by the adversary, is present in the original dataset D, based solely on the knowledge of Z and some prior knowledge P.

---

The game models privacy game
Algorithm 1 Linkability Privacy Game
to assess the potential linkage attack on
1: A selects a target record Iy from the data space X
RKME synthetic data. Initially, A se-
2: A sends Iy (or ă²) to C.
lects a target record 24 and sends to C. Then C independently and identically draws a dataset of size n - 1 from the data distribution P. and chooses secret bit 5t ~ {0, 13. If 8t 0, C samples another record x" from the dis- tribution, excluding the target record, and adds it to D (simulating the see- nario where the original dataset does not contain the target). If 8t 1, C adds the target record Iy to D (sim- ulating the scenario where the origi- nal dataset contains the target). Sub- sequently C generates the correspond- ing RKME Z using the RKME genera- tion mechanism from D, and randomly
3: C' samples a dataset D of size n 1 from P
4: C randomly chooses a secret bit from {0, 1}
5: if 8; then
6:
C samples a random record x= from P (a
7:
addss x to D
8: else
9: adds the target record Ty to D
10: end if
11: generates RKME Z with
12: C randomly chooses public bit from {0,
13: if b = 0 then
14:
C sends D to A
15: else
16: C sends Z to A
17: end
18: A receives either D or Z and the public bit b
sends either the original dataset D or its corresponding RKME Z to the ad- versary. Upon receiving the dataset, the adversary A guesses whether the target Te is in the original dataset D through
19: A uses its linkability algorithm A to guess 8,
20: A makes guess = A Ty, P),X D or Z
21: if & St then
22:
Adversary A wins in the linkage attack
23: else
8, f Ac (D,b, x², P). If 8, st, it is considered that the adversary has suc- cessfully carried out a linkage attack.
24:
Adversary A fails to carry out a linkage attack
25:
end if
Definition 4.1 (Linkage risk). We define the linkage risk of dataset X during the linkage privacy
game as
sup (2p (2 b, P) = =o sa]]
RL (X)
D or Z, and the probability space is composed of the randomness of the target, the randomness of the secret bit, and the adversary's 's method of guessing.
where X
Analyzing the linkage risk as defined above hinges on a critical examination of Af (X, x², P). This expression reflects the potential strategies that adversary A might employ guess whether target record exists in the original dataset D. The risk of linkage attacks on RKME can vary depending on the strategy employed. Since the RKME generation mechanism is deterministic algorithm, the most formidable attack strategy an adversary could deploy can be brute-force attack.
Adversarial strategy. When the adversary receives the information X and provided by the challenger, the approach varies according to the value of b. I = 0, the adversary has the original dataset D and merely needs to check if the target xq in D. When RKME Z generated from D and knows the data's 's prior distribution P. The adversary then employs a brute-force attack to construct all possible datasets D', collectively denoted as M, each of which corresponds to RKME Z. The probability of these D' being the actual dataset under P varies, and the adversary can calculate the measure dP(D(P) for each D' in M. They can assign a weight dP(D)P) Ju dP to each D' based on this measure, and then randomly select one D' as the inferred true dataset using this weight. The adversary checks if the target x4 is in this D' and makes a guess.
1, the adversary receives the
Risk evaluation. Similarly to the method used for analyzing the consistency risk in the previous section, for sample set D = {æ1,... _n} and its corresponding RKME Z = {21," ... 2m }. we map them to points in R= and RT respectively, as D {[|= ll. ... ||} and Z ([I==ıI,, || [)}. Similarly, we find that the M formed by Z constitutes manifold.
For the linkage risk term 2P [Ac (X, b, x',P) = st] - 1. it can be interpreted as the difference between the adversary A's true positive rate and false positive rate, expressed as
P 1 st 1 P (sc 1 st = 0]
7

---

The first term ( =1 = 1] corresponds to the probability of randomly selecting a D' E M weighted on the manifold M, where D' contains coordinate components identical Z. Expanding this term, we have the following.
P p = 11 S. dP())P) JM dP(D(P) (TZN
we can bound the first term. For the second term P [ = 1 8 = 0). we need to estimate the points in P that might generate Z but do not con- tain the target record zt. We can provide an upper bound using the isoperimetric inequality. The deductions made above
Similarly to the proof of Thm. 3.5
be summarized in the following theorem.
Theorem 4.2 (Bound of linkage risk). When the adversary employs brute-force attack, the linkage risk is bounded as follows:
(2dm)) (dn 2dm)!
R2 (Z) <
(5)
Remark Our assessment of the risk of linkability is based on worst-case evaluation, which is applicable to any target. This approach differs from many previous studies that have focused more on the average-case scenario. However, previous studies have shown that privacy risks associated with data sharing are not uniformly distributed throughout the population [Kulynych et al. [022] Long et al.) [2020 Rocher et al. [019]. Our analysis of the worst-case scenario aligns practical needs, as we aim to ensure sufficient privacy protection for each individual data point.
closely with
4.2 Inference risk evaluation
The risk of linkability is not the only concern about data leakage in data sharing processes. Data anonymization mechanisms also protect individuals in the original data from attribute disclosure. which corresponds to an inference attack. The risk of inference describes the concern that an adversary might deduce the value an attribute from the other attributes [El Emam and Alvarez 2013].
As illustrated in the Game 4.2 this approach differs from the previous linkability privacy game in that the adversary only has access to a subset of the attributes of the target record, at1 ... x²-1, and attempts to infer an unknown sensitive attribute value x² At the start of the game, the adversary randomly selects a target record from X, which is collec- tion of samples from with their sensitive attributes removed. Upon receiving partial information of this target record, the challenger assigns a secret value x² < d(i"), where denotes the projection of a partial record from X into the domain of the sensitive attribute based on its distri- bution. The challenger then merges the partial attributes provided by the adversary with the secret value as- signed to form complete sample
Algorithm 2 Inference Privacy Game
I: A selects partial target record E from X, where X contains samples from X with some attributes removed.
2: A sends ž to C; C assigns sensitive value x" to ãf using
Φ. forming I; = (#', xx))
3: C samples dataset D of size
from P
4: C randomly chooses a secret bit 8, from {0, 1}
5: if 8, then
6:
C samples a random record xt from P\
7:
C adds x² to
8: else
9:
adds the complete target record z, D)
10: end if'
generates RKME Z from D
12: C randomly chooses public bit b from (0, 1}
if b 0 then
14: C sends D to A
15: else
16: C. sends 7 to A
17: end if
18: A receives either D Z and the public bit b
19: A uses its inference algorithm A= to guess 8;
in X, following which the same pri- vacy game as in the linkability case
20: AA makes a guess & = A² A (X, b, Zt, P).X = D or Z
21: if & = & then
played. The adversary's 's final infor-
22:
Adversary A wins in the inference attack
mation comprises the dataset X and a public bit b. Using this information,
23: else
24: Adversary A fails to carry out inference attack
the adversary makes guess about
25: end if
the target's 's sensitive attribute value
L². If the guess falls within acceptable tolerance range, the adversary is considered to have won.

---

Definition 4.3. We define the inference risk in the Inference Privacy Game as
R₁ (X) - sup P - = x² = 1 P( x01 = Z'ER
Adversarial strategy. To estimate R₁, we need to consider the strategy of guessing of the adversary. The adversary makes an estimate of the sensitive attribute value x² in dyy based on the RKME Z released by the Challenger, the public bit b, and the known partial attribute values ... Let us first consider the case where b = 0, where the Challenger releases the original dataset. In this scenario, the adversary can deduce the missing attribute value through record linkage [Drechsler and Reiter 2010 Machanavajihala et al. 2207 Reiter and Mitra 2009]. If the adversary can link the partial information of the target with a unique sample in the original dataset (that is, there is only one sample whose partial information matches that of the target), then the missing value can be successfully reconstructed. In this case, P (X, b, P)) = x²' st 1] 1.
When direct inference using linkage fails, the challenger must seek alternative methods to conjecture the target record. Similarly, due to the deterministic mechanism of RKME, we still analyze the brute- force attack. Specifically, like the previous linkage, the adversary first finds all possible sample sets that correspond to RKME using a brute force attack. Among these sets, there may be some where subset of attributes of certain samples matches the target record. The adversary then selects the original sample set from these subsets with partially matching information, using prior probabilities similar the brute-force attack for linkage. Through an analysis similar to our previous approach, we have the following theorem.
Theorem 4.4 (Bound of inference risk). When the adversary employs a brute-force attack, the inference risk is bounded as follows
R₁ (Z) < <0
(2m)! c(n-2m 1) (n 1)1
(6)
4.3 Data preservation and search ability
Analogously to the analysis of the consistency risk, we hope that RKME can withstand linkage and inference attacks while still providing effective search capabilities. Regarding search ability, we continue to use the characterization of how the RKME generated from dataset 1) approximates its original distribution P with varying numbers of synthetic data, as described in Lemma 2.T] We represent the protective capacity of RKME for dataset D) against the two types of attacks using (D) - Rr (2) and (D) - Ry (2), respectively. These represent the reduction in linkage and inference risks when publishing RKME instead of the original data. Based on Thm. 4.2 and Thm. 4.4 we propose the following corollary:
Corollary 4.5. If we choose m S for RD(D) - (Z) and (D) - R2),), we obtain the following equation:
(D (Z) 2 0.999
(7)
R2(D) - R2(Z) ( 2 0.999
(8)
This implies that we have 99.9% confidence that RKME can defend the linkage and inference attack.
To ensure that RKME maintains a risk level below our tolerance threshold (i.e., 0.001 %) for consistency risk, as well as for linkage and inference risks, and still achieves satisfactory search efficiency, it suffices to select the number of points within the range mink, n, 5 )). This range offers flexibility in adjusting the num- ber of points m. When greater precision in search is required, we can opt for larger value of m within this interval. In contrast, when higher degree of data protection is desired, smaller value of m can be chosen within the same range.
capabiity 15 acchiioee
Auueee sparos
Prosenatton
soarttt tt adeen
min(k
in of Syechetlc Data
Figure Trade-off between the ability of data linkage (inference) protection and search ability.

---

5 Discussion
In our work, we have provided proofs only for the Gaussian kernel; however, our method can be extended to analyze a broad class of kernels and yield similar conclusions regarding their data protection capabilities. For kernels that exhibit non-rationality and analyticity (such the Sigmoid kernel ((x,y) v) = tanh(7æ" y +)) and the Cauchy kernel K (xz,y) = 1 they can be treated similarly to the Gaussian kernel by considering samples as bundles of synthetic data within the sample space. The difference lies in that, due to the specific forms of these kernels, the risk estimates we calculate during our analysis will vary, and the derivative estimates in the proof process may require re-evaluation. Although each kernel will still require its own specific analysis, the approach provided in this paper is generally applicable. Extending this framework to prove more robust results for broader class of kernels will be part of our future work.
The optimization problems involving Gaussian kernels are non-convex and non-rational, making theoretical analysis intractable under traditional tools. Analyses of optimization problems using the Gaussian kernel often rely on numerical experiments for validation. For the first time, we have made it possible to analyze the optimal solution using geometrie analysis techniques to analyze the data protection capability of the RKME specification. This approach not only applies to the privacy analysis of RKME as a specific form of synthetic data, but it also provides insights for analyzing similar nonlinear non-convex optimization problems involving Gaussian kernels. Applying this technique to broader contexts will be part of our future work. The main limitation of this analytical method is that the upper bound may not be optimal due to multiple steps of restrictions and relaxations. However, pursuing a tighter upper bound remains theoretically sigmificant.
In terms of relevant privacy theories, differential privacy (Dwork, 2006) (DP) is the most widely used technique, with its privacy protection characteristics derived primarily from the randomness introduced by additional noise. However, for the RKME specification in our study, due to its size, the well-known privacy-utility trade-off in differential privacy [Alvim et al. 2012 particularly pronounced after we add noise to the RKME mechanism, which can significantly degrade performance in learnware identification. This means that applying existing DP techniques to analyze privacy in RKME is quite challenging. On the other hand, due to the extensive data compression inherent in the RKME generation process, we believe that it possesses the data protection capabilities necessary within the learnware paradigm. Therefore, this paper also offers perspective on how a compressive deterministic algorithm can achieve privacy protection without relying on DP methods.
Another important perspective for future work is to establish sufficient criteria for when specifications in learnware can provide strong protection for the developer's 's original data. This paper evaluates the risks associated with RKME containing original data, consistency risk, and the exposure risks under two common types of attacks: linkage risk and inference risk. We prove the necessity of protecting original data through the RKME specification induced by the Gaussian kernel. Due to the deterministic nature of the RKME generation mechanism, some attacks relying on randomness, such as multiple queries, are ineffective against RKME, and the evaluation criteria presented in this paper are broadly applicable. However, seeking more general evaluation standards and investigating what types of specifications can effectively protect the developer's original data under these criteria will be a key focus of our future work.
6 Concluding remarks
This paper presents a theoretical study about the ability of developer's data preservation of the RKME specification, which was recently proposed for building Iearnware specification [Zhou and Tan 2024] and used in the Beimingwu learware dock system [Tn et al.) 2024b). By leveraging geometric analysis techniques, we prove that as the size of RKME specification decreases, the ability of the developer to preserve data increases, that is, the possibility of exposing the developer's 's original data decreases, and the ability to defend against the two commonly encountered attacks, i.e., linkage attack and inference attack, increases. Moreover, there exists a broad range of specification sizes that endow the above properties and enable effective learnware identification. Note that this work also offers new perspective on the data preservation ability of reduced sets and the corresponding analysis of deterministic algorithms.
10

---

Acknowledgments
This research was supported by NSFC (62250069). The authors would like thank Shuo Zhang, Rui-Ming Liang, Yang Zhang for very helpful discussions. We are also grateful for the anonymous reviewers for their valuable comments.
References
John M Abowd and Lars Vilhuber. How protective synthetic data? In Proceedings of International Conference on Privacy in Statistical Databases, pages 239-246, 2008
Mário Alvim, Konstantinos Chatzikokolakis, Catuscia Palamidessi, and Anna Pazii. Local differential privacy on metric spaces: optimizing the trade-off with utility. In Proceedings of IEEE 31st Computer Security Foundations Symposium, pages 262-267, 2018.
Mário S Alvim, Miguel E Andrés, Konstantinos Chatzikokolakis, Pierpaolo Degano, and Catuscia Palamidessi. Differential privacy: on the trade-off between utility and information leakage. In Proceedings of Formal Aspects of Security and Trust: 8th International Workshop, pages 39-54, 2012.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In Proceedings of 34th International Conference on Machine Learning, pages 21 214-223, 2017.
Christian Arnold and Marcel Neunhoeffer. Really useful synthetic data-a framework to evaluate the quality of differentially private synthetic data, arXiv preprint arXiv:2004.077400 2020.
Steven M Bellovin, Preetam K Dutta, and Nathan Reitinger. Privacy and synthetic datasets. Stanford Technology Law Review, 22:1, 2019.
Vincent Bindschaedler, Reza Shokri, and Carl A Gunter. Plausible deniability for privacy-preserving data synthesis. Proceedings of the VLDB Endowment, 10(5):483-499 2017.
Christopher JC Burges. Simplified support vector decision rules. In Proceedings of the 13th International Conference on Machine Learning, pages 71-77, 1996.
Keith T Butler, Daniel W Davies, Hugh Cartwright, Olexandr Isayev, and Aron Walsh. Machine learning for molecular and materials science. Nature, 559(7715):44-5555, 2018.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 343-362, 2020.
Edward Choi, Siddharth Biswal, Bradley Malin, Jon Duke, Walter Stewart, and Jimeng Sun. Gener- ating multi-labe discrete patient records using generative adversarial networks. In Proceedings of the 2nd Machine Learning for Health Care Conference, pages 286-305, 2017.
Gary Doran. Distribution kernel methods for multiple- learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 27, pages 1660-1661, 2013.
Jörg Drechsler and Jerome P Reiter. Sampling with synthesis: A new approach for releasing public use census microdata. Journal of the American Statistical Association, 105(492);1347-13377 2010.
Cynthia Dwork. Differential privacy. In Proceedings of International Colloquium on Automata, Languages, and Programming, pages 1-12, 2006.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. Theory Of Cryptography, 3876:265-284, 2006.
Khaled El Emam and Cecilia Alvarez. A critical appraisal of the article 29 working party opinion 05/2014 on data anonymization techniques. International Data Privacy Law, 5(1):73-8) 87, 2015.
Mark Elliot, Kieron O'hara, Charles Raab, Christine M Oeeeef, Elaine Mackey, Chris Dibben, Heather Gowans, Kingsley Purdam, and Karen McCullagh. Functional anony misation:: Personal data and the data environment. Computer Law & Security Review, 34(2):204-22) 2018.
11

---

NHS England. A&e synthetic data, 2022.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322-1333, 2015.
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogenetics: an end-to-end case study of personalized warfarin dosing. In Proceediiggs of the 23rd USENIX Conference on Security Symposium, pages 17-32, 2014.
Maayan Frid-Adar, Eyal Klang, Michal Amitai, Jacob Goldberger, and Hayit Greenspan. Synthetic data augmentation using gan for improved liver lesion classification. In Proceedings of 2018 IEEE 15th International Symposium on Biomedical Imaging, pages 289-293, 2018.
Andrew Gardner, Jinko Kanno, Christian A Duncan, and Rastko Selmic. Measuring distance between unordered sets of different sizes. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 137-143, 2014.
Ian Goodfellow, Jean Pouget-Abadic Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Information Processing Systems 27, page 139-144, 2014.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. Journal of Machine Learning Research, 13(1):723-773, 2012.
Frederik Harder, Kamil Adamczewski, and Mijung Park. Dp-merf: Differentially private mean data generation. Proceedings
embeddings with randomfeatures for practical of 24th International Conference on Artificial Intelligence and Statistics, pages 1819-1827, 2021.
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership inference attacks against generative models. In Proceedings on Privacy Enhancing Technologies, volume 2019, pages 133-152, 2019.
James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In Proceedings of 6th International Conference on Learning Representations, 2018
Jürgen Jost. Riemannian Geometry and Geometric Analysis, 5th Edition. Springer, 2008
John Jumper, Richard Evans, Alexander Pritzel, Tim Green, Michael Figurnov, Olaf Ronneberger, Kathryn Tunyasuvunakool, Russ Bates, Augustin Židek, Anna Potapenko, al. Highly accurate protein structure prediction with alphafold. Nature, 596(787)))5833-5555) 2021.
Kaggle. Predict Future Sales, 2018. competitive data- www.ecceeeeeeiiieeeec future-sales Accessed: 2023-05-20.
URL https://kagge: com/ competitionni
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In Proceedings of 2nd International Conference on Learning Representations, 2014.
Bogdan Kulynych, Mohammad Yaghini, M Cherubin, G Veale, and C Troncoso. Disparate vulner- ability: On the unfaireess of privacy attacks against machine learning. In Proceedings of 22st Privacy Enhancing Technologies Symposium, 2022.
Aditya Kuppa, Lamine Aouad, and Nhien An Le-Khat Khac. Towards improving privacy of synthetic datasets. In Proceedings of Annual Privacy Forum, pages 106-119, 2021.
Peter Li. Geometric Analysis. Cambridge Studies in Advanced Mathematics. Cambridge University Press, 2012.
Jian-Dong Liu, Zhi-Hao Tan, and Zhi-Hua Zhou. Towards making learnware specification and market evolvable. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 13909-13917, 2024.
12

---

Yunhui Long, Lei Wang, Diyue Bu, Vincent Bindschaedler, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. A pragmatic approach membership inferences on machine learning models. In Proceedings of IEEE 5th European Symposium on Security and Privacy, pages 521-534, 2020.
Noel Loo, Ramin Hasani, Mathias Lechner, Alexander Amini, and Daniela Rus. Understanding reconstruction attacks with the neural tangent kernel and dataset distillation. arXiv preprint arXiv:2302.01448, 2023.
Ashwin Machanavajihala, Daniel Kifer, Johannes Gehrke, and Muthuramakrishman Venkitasubrama- niam. 1-diversity: Privacy beyond k-anonymity. ACM Transactions Knowledge Discovery from Data, 1(1):, 2007.
Spyros Makridakis, Evangelos Spiliotis, and Vassilios Assimakopoulos. The m5 competition: Background, organization, and implementation. International Journal of Forecasting, 38(4): 5325-1336, 2022.
Sérgio Moro, Paulo Cortez, and Paulo Rita. data-driven approach to predict the success of bank telemarketing. Decision Support Systems, 62:22-31, 2014.
Krikamol Muandet and Bernhard Schölkopf. One-class support measure machines for group anomaly detection. In Proceedings of the 29th Conference on Uncertainty in Artificial Intelligence, pages 449-458, 2013.
Arvind Narayanan and Vitaly Shmatikov. Robust de-anonymization of large sparse datasets. In Proceedings of 29th IEEE Symposium on Security and Privacy, pages 11 111-125, 2008.
Arvind Narayanan and Vitaly Shmatikov. De-anonymizing social networks. Proceedings of 30th IEEE Symposiun on Security and Privacy, pages 173-187, 2009.
Arvind Narayanan, Elaine Shi, and Benjamin Rubinstein. Link prediction by de-anonymization: How won the kaggle social network challenge. In Proceedings of The 11th International Joint Conference on Neural Networks, pages 1825-1834, 2011.
Shengliang Pan and Huiping Xu. Stability of reverse isoperimetric inequality. Journal of mathemat- ical analysis and applications, 350(1):348-355 2009.
Apostolos Pyrgelis, Carmela Troncoso, and Emiliano De Cristofaro. Knock knock, who's 's there?
membership inference on aggregate location data. arXiv preprint arXiv: 2017.
Trivellore E Raghunathan. Synthetic data. Annual Review of Statistics and Its Application, 8:129-144 2021.
Attila Reiss, Ina Indlekofer, Philip Schmidt, and Kristof Van Laerhoven. Deep ppg: Large-scale heart rate estimation with convolutional neural networks. Sensors, 19(14):3079, 2019.
Jerome Reiter and Robin Mitra. Estimating risks of identification disclosure in partially synthetic data. Journal of Privacy and Confidentiality, 1(1):9--110, 2009.
Jerome P Reiter, Quanli Wang, and Biyuan Zhang. Bayesian estimation of disclosure risks for multiply imputed, synthetic data. Journal of Privacy and Confidentiality, 6(1):17-33, 2014.
Lue Rocher, Julien M Hendrickx, and Yles-Alex De Montjoye. Estimating the success of re-identifications in incomplete datasets using generative models. Nature Communications, 10(1): 1-9, 2019.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. Advances Neural Information Processing Systems 29, pages 2226-223 2234, 2016.
Bernhard Schölkopf and Alexander J Smola. Learning with kernels: support vector machines, regularization, optimization, and beyond. 2002.
13

---

Bernhard Scholkopf, Sebastian Mika, Chris JC Burges, Philipp Knirsch, K-R Muller, Gunnar Ratsch, and Alexander J Smola. Input space versus feature space kernel-based methods. IEEE Transactions Neural Networks, 1065):1000-1017, 1999.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In Proceedings of 38th IEEE Symposium on Security and Privacy, pages 3-18, 2017.
Alex Smola, Arthur Gretton, Le Song, and Bernhard Schölkopf. A hilbert space embedding for distributions. In Proceedings of International Conference on Algorithmic Learning Theory, pages 13-31, 2007.
Bharath K Sriperumbudur, Kenji Fukumizu, and Gert RG Lanckriet. Universality, characteristic kernels and rkhs embedding of measures. Journal of Machine Learning Research, 12(7):2389-244 2410, 2011.
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data-a privacy mirage. arXiv preprint arXiv:2011.07012 2020.
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data antiyssionni groundhog day. In Proceedings of 31st USENIX Security Symposium, pages 1451-1468, 2022.
Latanya Sweeney. k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Basee Systems, 10(05):557-570, 2002.
Peng Tan, Zhi-Hao Tan, Yuan Jiang, and Zhi-Hua Zhou. Handling learnwares developed from heterogeneous feature spaces without auxiliary data. In Proceedings of the 32nd International Joint Conference Artificial Intelligence, pages 4233,4243.2 2023.
Peng Tan, Zhi-Hao Tan, Yuan Jiang, and Zhi-Hua Zhou. Towards enabling learnware to handle heterogeneous feature spaces. Machine Learning, 113(4)1839-1166, 2024a.
Zhi-Hao Tan, Jian-Dong Liu, Xiao-Dong Bi, Peng Tan, Qin-Cheng Zheng, Hai-Tian Liu, Yi Xie, Xiao-Chuan Zou, Yang Yu, and Zhi-Hua Zhou. Beimingwu: A learnware dock system. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 5773-5782 2024b.
Dennis Wagner, Dominik Heider, and Georges Hattab. Mushroom data creation, curation, and simulation support classification tasks. Scientific reports, 11(1):8134, 2021.
Tongzhou Wang, Jun- Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv 2018
preprint
Xi Wu, Matthew Fredrikson, Somesh Jha, and Jeffrey F Naughton. A methodology for formalizing model-inversion attacks. In Proceedings of IEEE 29th Computer Security Foundations Symposium, pages 355-370, 2016.
Xi-Zhu Wu, Wenkai Xu, Song Liu, and Zhi-Hua Zhou. Model reuse with reduced kernel mean embedding specification. IEEE Transactions on Knowledge and Data Engineering, 35(1):699-710, 2023.
Yi Xie, Hai-Hao Tan, Yuan Jiang, and Zhi-Hua Zhou. Identifying helpful learnwares without examining the whole market. In Proceedings of the 26th European Conference on Artificial Intelligence, pages 2752-2759, 2023.
Bangzhou Xin, Yangyang Geng, Teng Hu, Sheng Chen, Wei Yang, Shaowei Wang, and Liusheng Huang. Federated synthetic data generation with differential privacy. Neurocomputing, 468:1-10, 2022.
Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Modeling tabular data using conditional gan, In Advances in Neural Information Processing Systems 32, pages 7333-7343, 2019.
14

---

Andrew Yale, Saloni Dash, Ritik Dutta, Isabelle Guyon, Adrien Pavao, and Kristin P Bennett. Assessing privacy and quality of synthetic health data. In Proceedings of the Conference on Artificial Intelligence for Data Discovery and Reuse, pages 1-4, 2019a.
Andrew Yale, Saloni Dash, Ritik Dutta, Isabelle Guyon, Adrien Pavao, and Kristin P Bennett. Privacy preserving synthetic health data. In Proceedings of European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning, 2019b.
Xinchen Yan, Jimei Yang, Kihyuk Sohn, and Honglak Lee. Attribute2image: Conditional image generation from visual attributes. In Proceedings of the 14th European Conference on Computer Vision, pages 776-791. Springer, 2016.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learn- ing: Analyzing the connection to overfitting. In Proceedings of IEEE 31 Computer Security Foundations Symposium, pages 268-282, 2018.
Yu-Jie Zhang, Yu-Hu Yan, Peng Zhao, and Zhi-Hua Zhou. Towards enabling learnware handle unseen jobs. In Proceedings of the 35th AAAI Conference on Artificial Intelligence, volume 35, pages 10964-10972, 2021.
Benjamin Zi Hao Zhao, Mohamed Ali Kaafar, and Nicolas Kourtellis. Not one but many tradcoffs: Privacy utility in differentially private machine learning. In Proceedings of the 15th ACM SIGSAC Conference on Cloud Computing Security Workshop, pages 15-26, 2020.
Zhi-Hua Zhou, Learnware: on the future of machine learning. Frontiers of Computer Science, 10(4): 589-590, 2016.
Zhi-Hua Zhou and Zhi-Hao Tan. Learnware: Small models do big. Science China Information Sciences, 67(1):112102 2024.
15

---

A Related work
A.1 Related work of Learnware
The learnware paradigm /Zoou 2016 Zhou and Tan 2024 offers a systematic approach to managing well-trained models and leveraging their capabilities to assist users in solving their tasks, rather than training model from scratch. A Iearnware consists of well-trained model accompanied by a specification that describes its capabilities, with this specification being the central component of the learnware. Based on the RKME specification, which uses reduced set to sketch the distribution of the
task data, Wu et al. 2023] proposed to identify helpful learnwares by matching the task distribution.
Zhang et [202T extended
handle user tasks with unseen parts. To efficiently recommend
learnwares among numerous learnwares, Liu et al. (2024) suggested evolving the specification with other learnwares for more accurate recommendations and construct the tree structure for managing learnwares for efficient learnware identification, and Xie et al. [2033 proposed using minor representative learnwares as anchor learnwares to speed up learnware identification without traversing the whole system. For the models and user tasks share the different feature space, [Tan] ct al. [0244a first considers the heterogeneous feature space scenario, but it assumes that the original training data is accessible, and auxiliary data across the entire feature space is collected. To relax this strong assumption of data accessibility, Tan et al. [0233 investigates the organization and utilization of heterogeneous learnware dock system without requiring access to the original data or auxiliary data across the feature space.
Based on the above research, the first learnware docking system, Beimingwu TTn et al. 2024b was recently released. This system streamlines the entire learnware process and offers a highly scalable architecture, facilitating future algorithm implementation and experimental research. Given these progresses, the RKME specification plays a crucial role within the learnware paradigm. However, despite its effectiveness, a theoretical analysis of the preservation capability of the RKME specification for the developer's training data is still lacking. Proving that the specification can protect the developer's 's training data not only safeguards both developers and users of learnware but also ensures the rationality of learnware specifications. This paper proves that the RKME specification can scarcely contain any of the developer's S original data and provides robust defense against common inference attacks, while preserving sufficient distribution information for effective learnware identification.
A.2 Related work of privacy
As the interaction of data becomes increasingly prevalent in various machine learning scenarios, the issue of sharing data while safeguarding data privacy has emerged as a critical concern, An important solution to this challenge is the release of synthetic data, generated through specific mechanisms. This approach manages to achieve an effectiveness comparable to original data in certain aspects (such model training, data analysis, etc.), while simultancously protecting the privacy of original data Drechsler and Reiter 2010 Bellovin et al. 2019 Arnold and Ncunhoeffer 2020 Stadler et al. 2020 England| 2022
Stadler et al.) 2022 Xu ct al. 2019].
Previously, it was commonly assumed that synthetic data, being 'artificial', have no direct link to real data. Therefore, in earlier work, it was believed that synthetic data generated by generative models, such as GANs [Goodfellow et al.) 2014 Frid-Adar et al., 2018 [Arjvvsyy et al., 2017] Salimans eet al. 2016) and VAE (Kingma and Welling 2014 Yan et al. 2016), have the capability to protect the privacy of original data. Their effectiveness was typically demonstrated through experimental similarity tests between real and synthetic records to assess the privacy risks associated with synthetic
datasets CCoi et al., 2017 Yale et al.) 2019a]b).
Unfortunately, Chen et al. 2020 pointed out that the aforementioned generative models could expose original data under certain privacy attacks, [Stadler et al. (022) further noted that not all synthetic data can withstand traditional attacks on data, such as linkage Elliot et al. 2018 [Swennyy 2002]. and attribute disclosure (Elliot et al., 20188] Maahanavaajhala et al. [2007] To counter this issue, existing efforts [Xin et al. 2022 Jordon et al. 2018 Harder et al. [021] have applied differential privacy (DP) [Dwork et al., 2006 to develop differentially private data generators, as DP the de
facto privacy standard which provides theoretical guarantees of privacy leakage. Data produced by DP-generators can then be applied to various tasks, such as data analysis, visualization, training crivacy-preeervve classifiers, etc.
16

---

However, although DP appears to be theoretically guaranteed privacy solution, Alvim et al. [2018). Zhao et al. [220)] have pointed out that DP involves tradeoff between privacy and utility, and in some cases, this tradeoff can lead to significant decrease in utility. Particularly, in the context of learnware specification, due to the requirement for usability, we demand that the number of synthetic data be much smaller than the number of original data, which results in a severe decrease in utility when applying DP, making it unsuitable for our framework. We attempt to demonstrate that significant data compression can also lead to data privacy, similar to the idea of dataset condensation (DC) (Loo) (et al., [023] Wang et al. 2018]. However, in the work on DC, the privacy protection properties of synthetic data primarily assessed through experimental validation. In our work, aim to analyze this aspect theoretically, brought about by reduced synthetic data by modeling it as a cow-dimensional submanifold of a high-dinn nigh-dimensional manifold. This technique and perspective are proposed for the first time, making the analysis of synthetic data from non-convex optimization become possible.
The risk of linkability has been theoretically and practically demonstrated for wide range of data types: tabular micro-level datasets [Narayanan and Shmatikov 2008 [Sweeney, 2002], social graph
data [arayanan et al. 2011 Narayanan and Shmatikov 2009). aggregate statistics [Pyrgelis et al., 2017]. statistical models [Shokri et al. [017]. and black-box attacks (Stadler et al. 2022]. Linkage attacks on tabular microdata typically aim to match a target record (associated with an identity) to single record in a sensitive database, from which direct identifiers have been removed.
Regarding attribute inference attacks, existing research has established fairly complete framework. Most studies model this attack as the adversary using machine learning model and incomplete information about data point to infer the missing information for that point [Fredrikson et al. 2014] 2015] Wu et al., [2166] as their ability to infer a target feature given an incomplete point from the training data, relative to their ability to do so for points from the general population.
our work, we characterize the advantage of an attribute inference adversary
B Background
B.1 Reduced Kernel Mean Embedding
Kernel Mean Embedding. KME (Smola et al. 2007 is a technique in machine learning that maps the mean of a probability distribution into a Reproducing Kernel Hilbert Space (RKHS), Given probability distribution P over domain X, and kernel function k X X + R [Schllkopf and
Smola 2002). the KME of P is defined as the following:
- M (dP(()
((P) -
where p(P) represents the kernel mean embedding of the distribution P, x is element of the domain X, and '.' denotes a placeholder for a second argument the kernel function. Denote the associated RKHS as H4 and é E X + k(xx-) E Hr the corresponding canonical feature map. The kernel function quantifies the similarity between pairs of data points and is required to be positive definite to induce valid RKHS.
Kernel Mean Embedding (KME) exhibits an array of beneficial properties, which contribute to its appeal as robust method for diverse machine learning endeavors, most notably in the realm of specification. By the reproductiong property, Vʃ HR, (P)) = Ep [(X)], which demonstrates
the notion of mean. By using characteristic kernels (Sriperumbudur et al.) 2011 1]. no information
about the distribution P would be lost during kernel embedding, i.c. [I((P) ((P)) ||BA = implics
that P P', One of the most commonly used samples is the Gaussian kernel
k(z, x²) exp(-><lx x' r211),>
The reproducing property of the Gaussian kernel and its characteristic as a characteristic kemee make it a widely used kernel in Kernel Mean Embedding (KME) [Gretton et al.] [0022] Muandet and
Schölkopf 2013 Doran 2013]. In the learwware market, for tabular data, the RKME corresponding to the Gaussian kernel currently in use, while for image and text data, the RKME corresponding
to the Gaussian kernel can also be used after extracting embeddings [Tan et al. 2024a 2023 Xie
jet al. 2023). the privacy proofs that follow in this paper, we mainly consider the privacy protection capabilities of the RKME induced by the Gaussian kernel.
17

---

In learning tasks, we often have no accsee to the true distribution P, but we can use samples to estimate it. The empirical kernel mean embedding an approximation of the KME based on finite set of samples from probability distribution. Given a probability distribution P over a domain X, a kernel function : X x X - IR, and a set of n independent and identically distributed (i.i.d.) samples (I1, 22, ... Fn drawn from P, the empirical KME ((P of P is defined as:
(PP) - k(z..))
The empirical KME á will converge to y in the rate of O(1/vn) measured by RKHS norm under mild conditions [Smola et al. 20077.
|| 11x
Reduced Kernel Mean Embedding. Although the properties of KME are desirable, the computa- tion of KME becomes challenging when there are many samples, and the calculation of KME requires access to the original data. Therefore, KME a specfication for learnware. To address this issue, [Wu et al. 2023 introduce RKME to approximate original KME via the reduced set method, which first used to speed up SVM prediction [Burges and receives more comprehensive studies in [Scholkopf et al. 1999].
The idea of RKME is find set (8), and compute Σラ= Byk(zz,) .) approximates the KME of original data {a:) i.e. we want to solve
1 - YI
n k(rs )) Σ Byk(z),
m
min 2,2
where 33 E R is the coefficient and z; E X is the reduced sample. The above problem is known as the reduced set construction [Scholkopf et al. 1999], when 2j is newly constructed samples. Several algorithms can be used for handling the above problem.
KME jí enjoys a linear convergence rate OOe-m) to empirical KME ft when H is finite dimensional, which makes it good approximation of the distribution. Meanwhile, the raw data are inaccessible to users. In this paper, we address the problem of utilizing RKME as the specification for the learnware paradigm, aiming for the efficient retrieval and organization of Iearnware. Consequently, both uploaders and users of learnware are required to submit the aforementioned RKME derived from their datasets, that is, the corresponding ($y, 2=) j= Our goal is to demonstrate that by submitting =1)== excessive information from the original dataset is not disclosed, ensuring that such a specification can preserve the privacy of the original data.
B.2 Synthetic data
The issue of releasing synthetic data to enable data analysis and public availability while safeguarding
privacy has garnered widespread attention [Drechsler and Reiter (2100] Bellovin et al. 2019 Arnold and Neunhoeffer 2020, Stadler et al. 2020 England [202 Stadler et al. [202]] Xu al. [019].
Synthetic datasets are designed to retain the statistical characteristics of the original data while eliminating personal data, thereby protecting personally identifiable information [Stadler al.. 2020).
In research on synthetic data, it's commonly held that synthetic data, being 'artificial', have no direct link to real data. This assumption leads to analyses focusing only on similarity tests between real and synthetic records to assess the privacy risks of synthetic datasets [Choi et al. 2017 Yale et al. 2019abb)
However, Stadler et al. 2022 note that not all synthetic data can withstand traditional attacks on
data, such as linkage Elliot et al. 2018 Sweeney] 2002], and attribute disclosure (Elliot et al. 2018 Machanavajjhala et al. [007]. Common defenses against such attacks usually rely on formal privacy guarantees during the generative model training process to prevent privacy breaches [Abowd and Vilhuber 2008 Bindschaedler et al. 2017]. or involve adding noise to the generation process of synthetic data to meet differential privacy criteria [Xin et al. 2022 Jordon et al. 2018 However, research is still lacking on whether synthetic data produced by a deterministic generation mechanism can naturally resist these two types of attacks without the addition of extra noise. In this paper, we aim to demonstrate that the RKME specification's 's deterministic generation mechanism, when using
18

---

an appropriate number of synthetic points, can effectively defend against these two types of attacks, while also performing well in learnware identification.
Many studies have explored similar issues, such as non-parametric models for image generation and adversaries with white-box query access the model [Chen et al. 2020 HHayes al. 2019 Reiter et al.] [014], as well as considerations where the generating mechanism is treated as a complete black box, with allowance for querying the model [Stadler al. 2022 In this paper, we allow the disclosure of the RKME generation mechanism and permit arbitrary queries to the RKME generation process. It is important to note that our discussion is limited to the potential privacy leakage of specifications as synthetic datasets in the learnware market. We assume that a learnware uploader's s model is not subject to querying in our discussion, as this strays from the focus on the privacy of learwware models and extends beyond the scope of privacy concerns in the learnware market.
B.3 Notations and technical overview
Notations
Representation
X
Sample space
D [=
Raw data set
D (æ1, 201:22."" Fp)
Raw data set's coordinate Manifold composed of Distribution of Raw data Generation of RKME Number of raw data Number of synthetic data Dimension of data (Gaussian) kernel function RKHS iuduced by k(-,-)
M
Pp
Z argmin F((3,2), D)
m
k(---
1M
In our study, we equip IR" with the conventional Euclidean product and norm, represented by (-, and || Il. respectively. We define r(x,r) as the open ball within I", centered with radius For any subspace H C R", the notation Bμ (z, r) signifies the intersection of H and B(x,r), constituting the open ball in H for the induced norm.
This paper utilizes fundamental concepts of the geometry of submanifolds in Euclidean space IR" for those not familiar with the subject. We consider C Riemannian manifolds (M, g), informally referred to as smooth, which encompass an abstract manifold M equipped with a C atlas and O metric g- Such manifolds can always be isometrically embedded into some Euclidean space, implying that the pull-back of the canonical Euclidean metric aligns with the manifold's metric. A smooth submanifold M 1 indicates that M is the image of embedding of smooth abstract Riemannian manifold.
In the context of comparing the smoothness of manifolds across range of models, adopt canonical parametrization. Specifically, we utilize the exponential map; for any smooth submanifold M C Rn and any point M, this map defines smooth parametrization of M around The parameter & is selected to be sufficiently small, and the maximal value of & is termed the injectivity radius at x, denoted inj (z:) For closed subsets M of TR.,, exponential maps are defined for entire tangent spaces, as per the Hopf-Rinow theorem.
The volume measure of a submanifold M of dimension d, denoted by μи, is the restriction of the d-dimensional Hausdorff measure Hd M. This volume measure aligns with the standard definition of volume measure in Riemannian manifold. If sh M - R is continuous function with support within a certain range of x. the volume measure can be expressed as an integral involving the function sb, the metric tensor g" (v), and chosen orthonormal basis of M.M. The volume of M, simply denoted as vol M, is finite for compact submanifolds of R".
Technical Overview. The starting point of this paper regarding the data protection capability of RKME is that the generation process of RKME compresses the data to great extent, thereby losing a significant amount of personal data information. Additionally, due to the irrationality and nonlinearity of the chosen Gaussian kernel, the generated RKME almost contains no original individual data information. We model this mathematically as follows: given the RKME Z, there are many possible original datasets D that could generate it. After we establish coordinate correspondence for the
19

---

original dataset D as D, we consider the set Mz in IR" consisting of all points D that could generate the RKME Z.
We first attempt to prove that Mz forms manifold in IR. This proof will allow us to use various geometric tools for analysis, and demonstrating that such set, constructed from the solutions to nonlinear equations, is a manifold is not trivial. This represents one of the most challenging parts of the upcoming proof.
After proving that Mz constitutes a manifold, we aim to show that the tangent space this manifold does not contain points aligned with the coordinate axes, indicating that these points form null measure set. This can be better understood through Ricci curvature: we are essentially proving that at almost every point this manifold, the Ricci curvature is non-zero. The significance of this condition is that we consider those parts of the manifold Mz that expose the original data to be a lower-dimensional submanifold, thus constituting null measure set.
Finally, we need to analyze the measure of this null set if we take neighborhood of radius around each point. Since ó is relatively small, this is equivalent to determining the measure of the lower-dimensional submanifold in the corresponding dimensional space relative to the measure of Mz itself. This quantity can be interpreted as the risk level of RKME potentially exposing individual privacy. In the subsequent proofs, we will follow this flow reasoning.
C Proofs
C.1 Lemmas
Recall the generation mechanism RKME
1 Σ lo (2)s :)
F ( ,rni -.. Bmi Bm:21,"" 21, (2m) =
> j=1
3y
(zj,
(10)
Upon substituting -): with the Gaussian kernel and conducting an expansion, we derive the following expression,
F2_
A: (1t )
Σ
Byk (zjz
f=1
m
ts (Ix, -)
-
3yk (zg, :)
Aa (I -)
Σ 1=1
Byk (2J.
1=1
1=1
H
m
Σ l (2.,
Σ (J :)
(xr; -), Σ
3yh (z5s
7
H
==1
(11)
Byk (2),
Σ 3, (2),-)
H
X
a
m
m
m
k (15,
( 23) + Σ> B,3,k (zi, 21)
jml
j=1
22
n
m
m Σ
m
1,)²
Σ
B
(2)-2,)
3,3 ~,(
n
==
=1
To infer the properties of F by analyzing those of F2, we consider this approach valid due to the following reason: given set of samples {2,)==1- treating F and F2 as functions of (By. 22). it can be shown that 2 and F share the same critical set, and the points where they attain their minimum
20

---

values coincide. This conclusion is readily provable as F is generally considered to be non-zero in our discussions.
Let us denote
F2 as G. Now, considering the first derivatives of G, we have:
ac
2
n
7x - =,)
7(xx + 8 7 -2)
+ B
03,
7
0G
23,
m
27 (rk 2i) [(2 (()=
8,27 (z: =x) 1
0z;
For the second derivatives, obtain:
PG
Σ
Bye (=3-=z1) 8ij
03,03;
i=1
8C
23,0ij
n
442² (2x -2;)² -21)--27) ( --(00=2))
dz,02;
n
k=1
+ (1 - (1) 3,3, (472 (zi 1164-2,0 -2,2 -27) e-
This analysis serves as a foundational step in understanding the underlying properties of the RKME specification, particularly in the context of Gaussian kernels and their influence on the optimization landscape the RKME formulation.
Next, we consider the relationship between D and Z. We begin by the following lemmas:
Lemma C.1. The Reproducing kernel Hilbert space RKHS of Gaussian kernel is separable.
Proof. Since R" is separable, we can take any countable dense subset S of R". Given that the Gaussian kernel is continuous, the set {k(x,-) S} forms a dense subset in H.
Lemma C.2. Given a fixed D, if the corresponding equation, Eq. 7 does not equal zero, i.e.,
(Z
33k (2j, j=1
>0
(12)
n
then D has unique corresponding Z.
Proof. Based on Lemma we understand that 7/ is isomorphic to l2. Once we fix m, if Eq. iis not zero, implies that
A (ar, does not lie any m--iieensioaal subspace H. Suppose optimal set of RKME solutions corresponding it is Z (zi...., 2m). Next, we will demonstrate
its uniqueness. Let us denote R = - 1
Byk (zj.
Step In the first step, we prove that (. 2m are linearly independent and form basis of an m-dimensional subspace of H. Suppose, for the sake of contradiction, that they are linearly dependent; then the subspace spanned by {=)..... 2m is less than m-dimensional. Therefore, we such that (k(s,, +)} forms a countable basis of H. Since the ... Fm } is at most (m -)ddimensionl,, without loss of generality, we let subspace spanned by (..,..., }m subspace of the space spanned by 81. 8m-11
can select S = {s1,.... 8m-1, 8m,
subspace spanned by {ZI,...,
Now, given D, we can rewrite the empirical KME of D, E l (2,,,), .), in terms of the basis S:
k (I.,)
Σ aak(s..))
(13)
where E lasl < oc, and among the ag only number greater than m and less than are nonzero. Without loss of generality, we assume that the a, arranged in decreasing order.
21

---

At this point, the optimal projection of 1 >E= 1 (z):-)
onto the m 1-dimensional subspace is
E a,k(Ss; ). because
m
Σ (1
Σ
(14)
M
achieves the minimal value. We denote this optimal projection as R'. Now we estimate R - R':
R R' 2
|10m (5mm 1ll > 0
(15)
This leads to contradiction.
Step 2 Let's consider the set S
fz...... 2m, Sm++1 5m+22...h ensuring that "),)..,,(((.)>>> k(2m, (55mmm1mm forms countable basis in H. Suppose there exists other set f31.... Fm that achieves the same value for Eq. as {sI...., Zm with respect to expand {yI.-.., ym } with the basis {8m+1, 8m++2-...) to form another basis of H. denoted S" (k(y1, "...,, k(ym. -). k( ... .).....
{k(21, .)...,
-E= (3), In that case,
Similar to the proof in Step empirical KME 4 Σi= & (#t,, -) onto the two bases are generated by {..,..., ²m and {.h..... Mm J respectively. Next, we will prove that the elements {z1,.... 2m and fy1..... ym correspond to each other and are equal. Let us denote the optimal m--dimnnsional projection subspace of >>= -) onto both bases H!"
know that the optimal m-ddimensional projection subspaces of the
To prove this, we first establish two auxiliary propositions:
Proposition C.3. The Gaussian kernel is a strictly positive-defiiite kernel.
Proof. Since the Fourier transform Gaussian function is also Gaussian function and always positive, the proposition holds.
Proposition C.4. For ( nn), the following two statements are equivalent:
1. (M(m) .,... k( }} are linearly independent.
2. The points (ri,..., FnI are all distinct.
Proof. is obvious that [1] implies [2]: only need prove that [2] implies [1]. Assume that the points {II,..., } are all distinct. Suppose there exist real numbers C1, 2.... Cn such that
Σ cgk (z,, : = 0.
Recall that in an RKHS, the inner product is defined as
(1,9)=
a:3,k (Ir,
i=
(16)
where
f= as osk os g Σ 8 (+'
1=1
Based on our assumption, we compute
Σ cale (zi, :, _ cok((z))))
= 0.
1=1
Using the linearity of the inner product, we expand this
cockk (ZI, = 0.
22

---

Let K be the n x symmetric kernel matrix with elements
|2g Iz 11
Ki3 = k. (z)) exp
20²
Then the above equation can be written as
c Kc== 0.
Since the Gaussian kernel is strictly positive-definite, K is positive-definite, implying that c Ke >> 0 unless 0. Therefore, we must have = 0, which contradicts the assumption that there exist nonzero Hence, the proposition is proved.
Using Proposition C.4 for the sets {Z15..., Zm3 and fyl...., ym J. we know that the func- tions {k( ..... (amy' :), byy1,),, ..... k(ym:-)] are linearly dependent. Therefore, there exist P. E {1, (..,,...,,,, } such that Zp = V/-- Without loss of generality, let 2p and By = ym- The re- maining elements {=1,.... 2m-1) and {y1, .p...... 9mm11 are still linearly dependent. By mathematical induction, we thus complete the proof.
Lemma C.5. The set of all possible D that make the corresponding equation Eq. 7 equal to zero has measure zero in IR", That is,
(#I..... I.) ERR Rd 1331, ... Am, =1, "
zm); s.l.
k(as,)
3,k(zz,
= 0 =
(17)
Proof. We say that any f H can be represented by elements in R via the kernel k(s))) if there exist (81,..., 88) such that
/
B, (8),)))))
= 0.
(18)
H
We define the representational dimension of f as the infimum of such t, denoted as ty. we know that the representational dimension t S m for the
Similar to the proof idea in Lemma empirical KME Σ :(
For lx = c and the set { J. from Proposition C.4 we easily obtain that there exist p, P.q E 21. n such that Up Zig.
Therefore, all ( Fn with to are formed by the union of most (*) c-dimensional subspaces; denote this union as Hy. By dimensional considerations, it is easy to see that H' has measure zero H.
Since a countable union of measure zero sets still a measure zero set, we thus obtain that U Hi still has measure in H. hence the conclusion follows.
Lemma C.6. Let us fix Z. Denote R as the critical set of G(x, B, 2), we have that the Lebesgue measure of (C) is 0 in IR.
Proof. We delineate a general scenario where f R + R manifests as a smooth mapping. Without loss of generality, let M R. and N = R" We employ mathematical induction with respect to m. The base case where m = 0 is trivially evident. Let C' represent the entirety of critical values of f. denoted as the critical set. It suffices demonstrate that for any y e C. there exists an open neighborhood around such that its intersection with C' constitutes null set. Define
C, = fx E IR I has all its k-th partial derivatives equal to zero at x, 1 < k < 8.}
Clearly, C - C1 = C2 - ... forms sequence closed sets. The objective ascertain that f(C, C.+1) are all null sets.
23

---

1. f(C - C1) is null set. Indeed, suppose 20 E C, & C1. then f at 2o possesses non- vanishing first-order partial derivatives, without loss of generality, let 84 det + O. Consider the mapping 9o R R defined as
go(x) (fi(z),
where 9u at the vicinity of zo has rank of m. By the inverse function theorem, open neighborhoods U and V around Ng exist such that the restriction golo U V diffeomorphism, with its inverse denoted as hg. Then,
I holo = (a*, ho(x), ... fm o h(x)))
and f(C (onnho())) = fo ho (c) (C) If we define
Ne (1?,,2?... ".) (ʃ2 ho (1, ,..).... :.. Sm ho "4,"
,x"")
then,
- Crit(k)),
where Crit(kr) signifies the critical points of kr. By the induction hypothesis, ke (kCrit(())) are null sets in Rm- pm hence,
J(C = Uti x (<Crit((k))
is a null set in R".
2. f(C, C.+1) is null set. Let zo C. Cs+1, and assume without loss of generality that 0f
82 (zr) ff O, where
8u gh1-"tim
im
d ( ... 1 (x
Similarly before, consider the mapping 9s Rm RT. defined by
(x()) (f (x)
where gs near functions diffeomorphism, with its inverse denoted as h2 V - R", Let
k, = f h2 and denote
K' = ks (o)- evident that gs (C, (V)) c (0) x m- nv, and
S(C, h. (V) C k (Cr)t(k)), from which, by the inductive assumption, fCC, V) is null set.
For sufficiently large s, f(C)) is a null set. Suppose zo E C, with 1. Select cube I centered at To with side length 6. By the Taylor expansion of multivariate functions, a constant M > 0 exists such that
l]((z) f('Ill M| =1 Vz Vre.,LLY
Subdivide I into n smaller cubes with side length & If I' one of the subdivided cubes, then the aforementioned inequality implies that when I' " C. # 0. f(7') is contained within cube of side length not exceeding
8 N
2M m
hence S(C, is enveloped within union of cubes whose total volume does exceed
s+17
5
Nm
2M 2MVm
2M 2M Nm-n((+1)).
For 1. choosing N sufficiently large ensures that this volume becomes arbitrarily small. Thus, S(O, (T) is a null set, and consequently, (CC,) a null set.
Therefore, conclude that f(C) is null set in 12"

---

Now we revisit the definition of G in Eq. 11 Our central idea in the proof is to fix 21, ...., m, so that G(z),...,, becomes function on R" From Lemma C.1 we know that fixed set ( In usually corresponds to set (β1,... Sn, 21,..., ) ). However, when we fix a (Bi,...,,/, 21, 2n , the possible (.1,,..,, In that can generate this RKME are not unique and may even form a manifold in IR
Therefore, following the notation in the main text, denote the {FI, (..,,.., 2n contained in a sample set D as point D (I1...., In) in R". Next, we will prove that all such D = (Ii,..., Tn) corresponding given {fI..... 21: 21....,,. 2n form manifold. To this end, we define the following mapping f from I"" to IR R
22 .n) (00
0G
aG aG
aG
03m 0B,
a.3m
(- Ek= e e-v(0o- + + k= 8ze 7(5k =11) + $1,
(19)
2/
2k=1 27 (3tk 2m) 7(am
3n 2x=1 8,27 (zm - -2) 2
We now consider the total differential of (a) of the function / defined in Eq. 19 which is the Jacobian fx)... To do this, we first calculate the following equation:
0f =( 47(x;: - 211 - 0u:
4 2m
E --(21-zm
"
n
>-) =1)² e 8133((1 -2122 -4
8m3m
=mm² )- 4
73, - Fm )))
k=1
011
0f1
Dar
dea
and Jf(x) is
,and thus can be writen as
af 8.1
0s Sm.
}. Next, regard-
0fam 8ay
ffam
Ou
ing the analysis of the properties of J((x), we first prove lemma in general case:
Lemma C.7. For the function f M + N C mapping and rank,o n, then there exists
an open neighborhood U in R" and an open neighborhood V of = f(() such that the restriction flu U + V a diffeomorphism.
Proof. By composing with an invertible linear map, we may also start from that the Jacobian of the origin is the identity matrix, i.e., (0) Ln. In this case, near the origin, f is small perturbation of the identity mapping, which can be defined as the perturbation term
g R",
g(x) = f(x) x, x x
Since Jg(0) 0, there exists such that
1 5 | <
Var B.()).
From the mean value theorem for multivariate vector-valued functions, have
1 ||||
[gg (m1) g (122 || < [[] || - -22l &
x2ll, Van, E B,(
Let E By(0) (0) and consider solving the equation
f(x) = y, (0).
This is equivalent to finding a fixed point in B, (0) for gz(x)) mapping principle to find this fixed point. First, we have
f(x). We use the contraction
1 |all
1lg,, (z) < Illll |19(x)]
[ &
Vr (O).
2
25

---

This shows that By (0)) C (0). The mapping By (B) + (0 C (.) is contraction:
1l (m1) By (22) || = 11g (22) 9 (z1))l < 2 | - x2ll, Vzi, T2 E (.)
Therefore, the equation above has a unique solution in (0), denoted as Ty. And we know that Ty E (0) Let U = f (B3 (0)) n (e)),, V = Bg (0). Then the above discussion indicates that flu U V is one-to-one C* mapping, whose inverse h(y) Ty satisfies the equation
y g(h())) h(v).
We have: h1) V + U is continuous: when y1, 9/2 E V. |19 (h (y1)) g (b (22))l
||h (311 (y2)ll < 1 3/l
< |/
V2l
(vr) - h (82)ll
Therefore, we have ||h (v1) h (12)) mapping.
< |1
y211. meaning that h is Lipschitz continuous
(2) h: V U is differentiable mapping: Let yo E V, then for y E V, we have
(v) (yo) = (y) yo) - [g(h())) - (h (yo))]
(y -vo) Jg (h (8o)) (h(y) h (3o)) + (11h(y) h (2o)ll).
From (1), we obtain
[T. + Jg (1o))) (h(v) - h (vo)) = (v - yo) + + - voll),
thus
1(y) h (wo) 1T. + Jg (h (vo)) (y vo) + o (lvv voll)-
h3) - is C* mapping. In fact, from (2), we know
Jh(y) [I, Jg (h (go)) [Jf(h(y)]]', Vy V
Since is C mapping, and from the above formula, can successively increase the differentia- bility of h, ultimately concluding that is a C* mapping.
And the Lemma we proved above has natural corollary:
Corollary C.8. For we defined in Eq. 19 when J fx) is a.e. of full row rank, there exists a neighborhood U around D such that F (F((()()))))) n U forms a smooth submanifold of M with dimension 2m.
This corollary provides us with a local conclusion, namely that when ff()) is of full row rank, fixing RKME Z corresponds to a certain D that locally forms an 2i-ddimnssoonal manifold within its neighborhood. To study the specific correspondences between Z and D, we still need global conclusion. Before using Lemma 7 to prove the global result, we need to explore J)(z) further. One of the initial questions to address is whether J is of full row rank at all points. An obvious observation that when all I, are equal, the rank of J ff(x) is 1; however, such points are measure zero in R". A natural question arises: Are the points where J fx( is not of full row rank also measure zero in R²? To answer this question, we prove the following proposition:
Proposition C.9. The Jacobian J (x) a.e of full row rank.
Proof. Our proof will be divided into the following three parts: will partition J.(x:) into two blocks consisting of the first m rows and the last m rows. First, we will prove that the m row vectors in each of these blocks are linearly independent, and then will show that the vectors in these two blocks are also linearly independent each other.
Step 1: We first define
26

---

g( I2 Fn) 0z,²
0G
8G
2 Liki e ( =1 + " 1= _5 (6, - =1 + -
(20)
Lk=1 1 2m) ) 2 j=l BBE 112 =m)² + 3m)
Thus,
we have
0g
A e (11==1))
1n(2;-2m) e y/2 =m)))))))))))))))))))))))=)))) =m)) and Jgi(2) =
881
Jzm
We aim to prove the following conclusion: the points where the rank
0gm
Ba..
of Joh (a) is less than m. are measure zero in R We note the fact that the rank of Jgn (z) being less than m is equivalent the determinant of any m-dimensional submatrix of J (a) being zero.
This is evident because if the rank of Jgi (z) is less than m, then the first m rows of J Jg (x) must be
linearly dependent, thus any m-diimensional submatrix formed by the first m rows also linearly dependent, resulting in determinant of zero. Conversely, the same reasoning applies.
Let us analyze arbitrary m-dimensional submatrix. Without loss of generality, can select the dg1
Ogn
8rm
first column vectors. Thus, we have the matrix
:
Notice that det(J) is
8pm ax:
8gm
a function defined from RT to We want to prove that its preimage at the point 0 a zero measure
set. According to Lemma C.6 and C.7 it suffices to show that the derivative of det(J) is almost
everywhere non-zero. this true, then the preimage at will form a 1="=--dimession manifold
in IRm", and thus it will be zero measure set. In fact, if we take the derivative of det(J), we have
8g
8m
dJ)
det
8
(21)
Fi
Bu...
88m du
and dJ) det(()
dct((J)
We only need to prove that the vector in d dJt will not be simultaneously zero. Since is smooth function, and the determinant is also a smooth function, by Lemma C.7, we know that the preimage of the case where the derivative vector is simultaneously zero is zero-measure set.
For the last m rows, we can define the function
h(21, T2, ... Inn =
0G aG
aG
001
09,
apm.
=(8 (8181(21 n
-4 43/31
7(2
21)
(22)
8yBm( - 2m) 44.8m
Ek= e 72,,
The function we defined is still smooth, allowing us to draw the same conclusion. To combine the first m rows and the last m rows, we simply define the function f g x h, and this immediately leads us to the conclusion.
With the above propositions and lemmas established, we can prove the following lemma: Lemma C.10. Let f M + N be a smooth map between differentiable manifolds. If there exists constant I such that rank, f 1 for all p M, then for each fixed g E N.
( (pe M f(p) 9}
27

---

is either empry or regular submanifold of M with dimension L.
Proof. Let S = and assume S is not empty, so there exists p E We will prove that there exists a local coordinate system (U, sp) around in M and a local coordinate system (V, around in N such that (pp) E Th. ()()) = IR., f(U) C V, and the local representation of f is of the form
po f o (a',a" ,--' (2), , (x """,,,"))""" .".....""""""""""........... (x ,.....,,,,
The proof of this equality similar the standard form of immersion maps. We assume RR. M = Rmm N=R", = O IRm, and = - I The map f can be represented in components as
f( x², f(.,. ,-)) (fi x2, ....... ,I"), ..... ,""",,","",,,, fa(a x²,... ,,,,,,"))))))
By assumption, the matrix
Of
dzi
1sti 18/5m
has rank l. By rearranging the order of coordinates, we can assume that the matrix
05.
Ox
ISiSI
13151
non-degenerate the origin. We define the map g 1Tm
as
g(x x², ...., ,I'' ) = ffi, ...
fi, ,,"" x²)
The Jacobian of at the origin of the form
01 800
1xt
Im-1
Thus, it is non-degenerate the origin. By the Lemma C.7 there exist open neighborhoods U around 0 E 1n and V such that gu U - V is diffeomorphism. We can assume V is convex neighborhood, and let g/r = şù thus, &o is a local coordinate map around p 0. In this local coordinate map, the local representation of is of the form
f fo x2 ... x²) (x+ 22, ... x. g- .g").
where 3¹ for 1+1 S are functions of (at.x², ..,.... ,.)), Since rank J (S o ( =1, we have
0g" dzi
VI W m
Since V is convex domain, it follows that
g' = g' x2 .,....))) i+ssisn.
Thus, have
28

---

Snu -ss E [(s) - 0}
= { 2'(s) = =... =..-))_0-==.(( (0ss=00 0,
(z' , (+)) -.... g
(x (0), ,f (s)) 0}
= (s) = x =
0 0}
Finally, by taking the subtopology on M and considering the local coordinates on M as the first m components of the local coordinates on N over U, it is straightforward to verify that M is differentiable manifold, and the inclusion map from M N is an embedding.
By Prop. C.9 and Lemma C.TO, we immediately obtain the following corollary:
Corollary C.11. Given Z = (B1...., 3m, 21...., 2m) the points D in I" corresponding to all original datasets that could generate form an cin-dimensional manifold in R".
With Corollary C.II we can establish the relationship between a fixed RKME Z and the points D in R" corresponding to the original dataset D that may generate this RKME. Now, we can consider what we aim to prove: that the privacy of the RKME arises from data compression. Mathematically. this means that a fixed RKME may correspond to multiple D, and these form a manifold. The significance of proving that D forms manifold is that it is set that is locally homeomorphic to Euclidean space, allowing us to use geometric methods to analyze
In particular, our first concern is whether an RKME Z generated from dataset D contains the original points from D. However, based on Lemma C.2 and the fact that D forms manifold, what we actually need to assess is the volume of the intersection between the sections formed by the coordinates in and this manifold. The points in the manifold M that contain RKME Z correspond to the intersection points between these coordinate sections and the manifold, specifically where some component coordinates are identical.
If this manifold happens to be plane parallel to the coordinate axes in R" then the intersection with M formed by sections from the coordinates in Z could potentially cover the entire M, indicating that such a compression mechanism may not protect privacy (at least for certain datasets, it could completely disclose privacy). To characterize this, we want to determine whether there are instances on the entire manifold where a plane parallel to the coordinate axes in Iº" exists, which can be described in mathematics using the concept of tangent spaces. Let C be the vector space consisting of all smooth functions on the differentiable manifold M. For point p E M, if linear map X, C (M) + R satisfies the following condition
X,(fg) (p) + g(p)X,f, C*
then Xp is called the tangent vector at point p on M. The vector space formed by all tangent vectors is referred to as the tangent space at p. denoted as T,M. Now we only need to study T,M. Note that if we let x pp() E (UU) and ppp), then
f(g) = f x (x) = fo (a)+ / fo (a+ t(x - al) dt
(a
dt
n
= =fop-100 + Σ
(a' d²) g,(2),
1=1
where
6-'
0f 0
(x(x)=
(a + t(x - a))dt.
Ozi
The function gi is still smooth, and
0f o pp
0
s:(a)
(a)
ʃ.
Oz
0x
29

---

By the definition of a tangent vector, we have
XpJ - Xp
Σ (s'- (c)=x)))((x)) sa((r) ((())
= - (Xpe))
= Σ pet
0 Oxt
S. p
thus we only need to study the derivatives this manifold with respect to 24. Therefore, we have the following lemma:
Lemma C.12. Given the RKME Z. for the manifold M formed by the points D that could generate Z, the tangent space at any point cannot be spanned by n 2m coordinate axes in IR..
Proof. Based on the equation we mentioned earlier,
θ Oxt
XpJ X,
sx' a') 1a-aa))(a (1(())
Σ (Xp=') gi(a)=
Σ
(X pat
S.
only need to prove that any point D on the manifold M, the tangent space is spanned by at least 7 - 2m + coordinate axes. This is equivalent to showing that the number of components with derivative of zero is less than equal to 2m- 1.
First, we differentiate at any point D:
aG
4y n
(x, Σ L,igh
zx)e - x(=
4y n
Σ km
Ba Ba zz)e 26)e-nar-su
Oz,
Rm
We can use a similar technique to that in Proposition C.9 but for this problem, there is an easier method. We take the second derivative dr, the following expression:
aQ along a specific direction 2j at any point D, leading to
PG
27 n²
472 1(a, 12)=
n² (x, xz,² e x0m-
(23)
Now we use proof by contradiction. We assume that there are 2m directions at D where the derivatives zero, and will prove that such points of measure assume that the first 2m components Bay
Without loss of generality,
&c ac
9G are all zero at D.
Bag ..... Dram
For the 2m components with non-zero derivatives, let the first non-zero derivative be Zegm with a derivative value of d,. Since G is a smooth function, we can choose a neighborhood Up of such that for all E U1, the absolute value the derivative Bram+1 at p is greater than d Similarly, for I2m+2, let its derivative value be d2, and we can choose U2 such that for all U2. the absolute value of the derivative 8G is greater than 42. Following this reasoning, we can aram+z obtain neighborhoods for all 2m components, and we define U = U U, We know that at any point U, the derivatives the last 2m components remain non-zero.
&G
Now consider the first 2m components. Since the derivatives of the last n. - 2m components are non-zero in the neighborhood, if we require that the points on the manifold with 2m components have zero derivatives, then the second derivatives of the first 2m components must also be zero.
BCG 0 for 1, ... 2m. According to the expression in Eq 23 Specifically, for 21, need Jzzūæ;
8n,8a; 0, then 2y can only take values at two points on either side of T1. Similarly, the same conclusion applies to Ø2, Zz...... D2m- Therefore, it is easy to see that if the first 2m components can only take values, the derivatives of these components will always be non-zero on the manifold, which is clearly a set measure zero
aG
30

---

Using the above lemma, we can prove that, given an R, the sample set in D that can generate R and contains samples identical R is zero-measure set among all possible sample sets. The next step is to relax the condition of strict sample equality. In practical applications, we might consider that the RKME Z includes samples that are very close to a particular sample in D. In this case, an attacker could use this sample as an approximation for the corresponding sample in D, thereby exposing the data in D to risks from Z. Therefore, we want to define a tolerance level å to determine whether two samples are sufficiently close. If the distance between two samples is less than 6, we consider them close enough that privacy may be at risk. We aim to prove that, with high probability for reasonable 5, any point in RKME Z is more than ó away from any point in D.
Thus, the discussion of the selection and rationale for is a key issue. It is important to note that d must be a quantity related to the distribution, as the scale of the data will directly impact the choice of 6. Larger-scale data can accommodate a larger ó, while using the same 8 standard for data with significantly different scales would be unreasonable. On the other hand, as the number of data points increases, the data becomes denser in feature space. In an extreme case, if we assume there are infinitely many data points, the data can be viewed as being present at every point in continuous distribution. Thus, regardless of the form of the RKME Z, there will inevitably be data points that are identical to it. Therefore, our setting for 8 should depend on the scale of the data and the amount of data. Next, we will discuss our settings for 5 under three types of risks, along with the rationale behind these settings.
We will first discuss the choice of in the context of linkage and inference attacks. as these two types have more geometric intuitions. In linkage attack, after obtaining the RKME Z, an attacker will use a brute-force attack to find all possible original sample sets D that could generate Z. We need to consider that for a dataset D, if the minimum distance between two distinct data points is denoted as dmin- then setting ô to dmin makes sense. This is because, in the original dataset, there are two data points at a distance of dmins and these two points are not the same. Therefore, we can consider that points in the original dataset that are dmin apart are indeed different. A natural choice for is dmin- However, this choice is dependent on the dataset itself, and when two data points are very close to each other, this setting can easily weaken our conclusions. Starting from this perspective, we choose stronger 8 = where L is measure of the dataset's scale, which we take to be the range of the dataset. A natural observation that > dmiu- Therefore, if we can prove that this setting yields stronger conclusions than simply choosing dmiu. while also acknowledging the significance of duinn it follows that 4 is also meaningful.
For inference attacks, we can similarly choose Mute, where Minter is the range of the attribute we want to attack. It is important to note that our selection does not represent the maximum 6 that satisfies our conclusions. Our primary focus is not on how far the synthetic data generated by RKME can deviate from the original data, but rather on exploring the potential for RKME's false points, within a distance of 6, to expose the privacy of the original data. We are concerned with the likelihood of privacy exposure under these conditions. In fact, could derive a conclusion regarding 5 as variable, but this would affect the interpretability of our conclusions and is not what we require. The chosen 5 has general applicability (as it is greater than dmiu), so we fix this 8 to observe how the effectiveness of privacy protection relates to variations in data points. Another noteworthy point is that our conclusions regarding the validity of 5 represent worst-case scenario for all points in the sample. In reality, most points are likely to be much farther from RKME than 6.
For consistency risk, since the definition of consistency risk is based on the distribution rather than specific datasets or RKME, a natural idea is to extend the aforementioned to its distributional version. We can achieve this extension using the range. Given distribution with cumulative distribution function (CDF) F(r), we know that the range can be defined as follows:
PM,, <z)= = F(x)" P (m, S 11)=1-(1-FF)
For distribution where all moments exist, the expected value of the range can be approximated using the variance of the distribution. Thus, we select _ as the value for 8. In particular, if the second moment of the distribution does not exist, we can choose range corresponding to higher probability and then calculate the variance over the support of that region.
Before we present the lemma regarding the relaxation of 8, we need proposition:
31

---

Proposition C.13. We have the following inequality:
Jm
du Jndd (2nD=0)
1
(ol(B:)
C(n 2m)
n
(r.
2m
Proof. We start from the idea of [Pan and Xu 2009 curve with length L and enclosing an area A, then
Let y be C2 closed and strictly convex plane
L3 < 4 [A]
where A denotes the oriented area the locus of its curvature centers if and only if y is a circle.
Noticing that in the problem we are focusing on, we initially ignore the effect of 8. In fact, what we aim to determine is the ratio of the perimeter of a lower-dimensional submanifold in its lower- dimensional space to the area of the manifold itself in the ambient space. This allows us to utilize ideas similar to the isoperimetric inequality mentioned earlier.
The first step is to perform local linearization at any given point. Based on our analysis in C.9 and C.12 we assume the curvature this point is C. We denote the 2. dimennniiio linearization of the manifold M as M2M Then, we have:
Sm
du du 120 ABD(d'= S 2mm(n - 2m)
Vol(
Vol Bs-)
By continuity and bounded curvature, first relax the local restriction, and have:
dp JM du
(ol(Bs) 2m
D20))2m S C2m(n 2m)
Vol
Bt)
This represents the case of a 2m-dimeesional linear subspace an n-dimensional space. Distinguish- ing all possible cases, we then have:
Jm
du Indu (IZn S
1 C(n 2m)
Vol(Bs) m-2m
Vol( Br.)
2m
Lemma C.14. Given an RKME R, let the set of all possible datasets D that could generate this RKME correspond to points D in R" denoted as M. We define the subset of M where any component coordinate falls within (z, - 5, 24 + 8) for = 1.2.-... m as Mz. Then the following inequality holds:
Vol(M2)
Vol(Ba) 2m
<
Co(n 2m)
(24)
Vol(M)
Vol(Br)
2m
Proof. From Propositions manifold, we have
C.9
and C.13 we obtaín that given a connected component of
Vol(Mz)
Vol(Bs)
- (n 2m
(25)
Vol(M)
(ol(Br.)
where Co is the ratio of Vol to Vol(M) in Lemma C.13 Since there may be multiple disconnected manifolds in the space, and the intervals (z; 2, + 8) may not intersect with some of these
manifolds, the case where they do intersect corresponds to the number of m-dimensional subspaces in n-dimensional space. Therefore, the overall conclusion is
Vol(M2) Vol(M)
(Bs)
- 2m)
(26)
x
Vol (B,)
(mml
32

---

In the context of this paper, we regard brute-force attacks as the most potent form of assault on deterministic algorithms like RKME (Reduced Kemel Mean Embedding). Deterministic algorithms are characterized by producing consistent outputs for the same input. This principle is applicable even to common cryptographic methods such as elliptic curve encryption, where, under the assumption of sufficient computational resources, it's possible to decrypt the original message through exhaustive enumeration. However, the distinctive aspect of the deterministic algorithm discussed in this paper, particularly RKME, is its substantial data compression. This compression results in a scenario where a single output corresponds to numerous distinct inputs, diverging from typical deterministic models where input maps to one output.
In Alg. 4.1 and Alg. 4.2 it is common practice to set the adversary's 's strategy as either a black-box or a white-box box learning algorithm. Existing Membership Inference Attacks (MIAs) on generative models primarily concentrate on non-parametric deep learning models used for synthetic image generation. These studies largely explore the privacy risks associated with either model-specific white-box attacks or set membership attacks, which presuppose the adversary's s access to the complete set of training records. The findings suggest that black-box MIAs, targeting specific records, perform only marginally better than random guessing. Regrettably, such prior attacks do not provide reliable foundation for evaluating the privacy benefits of publishing synthetic data. Non-parametric models for non-tit non-tabular data represent a minimal range of use cases, and white-bot box attacks fail to accurately mirror the data sharing context. Moreover, set inference attacks are not apt for assessing privacy gains at an individual level.
For deterministic algorithms like the one we discuss, learning algorithms are unlikely to outperform brute-force attacks. The reason lies in the nature of the Reduced Kernel Mean Embedding (RKME) specification: for single RKME specification, there could be infinitely many original datasets corresponding to it. However, among these infinite datasets, the ones containing a specific target record constitute only set of measure zero. Calculating the area of such complex manifolds is already an NP-hard problem, making our focus on brute-force attacks universally applicable and pragmatic choice for analysis. This approach acknowledges the inherent limitations of learning algorithms in predicting the exact dataset from given RKME specification, due to the overwhelming diversity of potential original datasets.
C.2 Proof of Proposition 3.2
Proof. From Lemmas and we can conclude that, except for a measure-zent set, all other sets D in R" satisfy the inequality Eq. 4.3 with non-zero lower bound. Therefore, there exists unique Z corresponding to it.
C.3 Proof of Proposition 3.3
Proof. From Corollary C.I and Lemma C.12, we immediately obtain that there exists a component that is the same as Z and that D is an (n 2m 1)-dimensional submanifold of the n 2m- dimensional manifold.
C.4 Proof of Theorem
3.4
Proof. From Propositions 3.2 and 3.3 we immediately obtain that the set of points D in R" where the generated RKME satisfies J such that 2; = My is Lebesgue null in Rt. Furthermore, any continuous distribution is a continuous measure, and the null sets in composite spaces are also null sets in probability.
C.5 Proof of Theorem 3.5 and Corollary 3.6
Proof. Through Lemma C.14 we immediately obtain three conclusions regarding risk: For consis-
tency risk, we only need to take the expectation of Eq, 26 with respect to the distribution and select
8 = and 7 2 We immediately get
1/2
2m)
= =o (() n nm2m
(C(P)=
(27)
r
+
1)
1=1 + +1)
33

---

In particular, from the proof of Lemma C.10 and our choice of 8 and y
1 20 we have C.9 requires m I ky/n, where k = d! is a constant. At this point,
Co < 0.001. At this step, Lemma
(n 1 1m-2m
(which holds for almost all > 5). Therefore, Rc 0.001. O
T(2+))
C.6 Proof of Theorem 4.2 and Corollary 4.5 Part 1)
Proof. For Rr. (2), we can directly apply Lemma C.14 to obtain:
dm!
de 2dm
nd 2md-2mmd-- m
-0((
dm! dm)!
Rr,(2) Co (dn dm 2)!
o
(28)
Likewise, by choosing d = dL we have (2) 0.001. The only requirement here is that when using Lemma C.10 we require m $ 2-
C.7 Proof of Theorem and Corollary
4.5 Part 2)
Proof. For (Z), the only difference from Rz( is that we are considering a one-dimensional manifold. Using Lemma C.14 we have
(2m))
R2 <0
(29)
c(n 2m (n 1)!
By choosing 8 = 4. we have (2) < 0.001. The only requirement here is that when using
Lemma C.10, we require m S 3.
C.8 Proof of the Some Remarks
Now prove several remarks mentioned in the text that need proof:
Proposition C.15. The Laplacian kernel k(æ, y) exp( ->1lx vlli) cannot protect privacy like the Gaussian kernel. Specifically, it does not satisfy Theorem 3.4
Proof. The Laplacian kernel satisfies all the conclusions prior to Lemma be conducted similarly, with differences arising primarily from the expressions used for the various derivatives. However, the Laplacian kernel does not satisfy Lemma C.12 and its conclusions are in fact completely contrary to those of Lemma C.12 Assume that point p on the manifold M, the derivatives of the first m components are zero. Notably, when v; is determined, the derivative k(x,, 2;) v; non-smooth for the Laplacian kernel, exhibiting jumps in different derivative directions. perturbations are allowed, long the perturbation does not exceed this range in its effect on the derivatives, the first m components will still equal zero in a small neighborhood around point This leads to the conclusion that the manifold still has dimensions of 2m after fixing components and using the coordinate axis to slice through the manifold, which may not necessarily a set of measure zero on M.
and the analysis can
The significance of this proposition lies in demonstrating that the privacy protection capability of RKME not solely result of the reduction process, as not all kernels can privacy protection after generating RKME through the reduce set approach. On one hand, this supports the rationale for choice of the Gaussian kernel; the other hand, it raises future work question: what types of kernels can protect privacy? Or, how should we select kernels? Comparing the Laplacian and Gaussian kernels. both exhibit non-rationality, but they differ in terms of smoothness. Do all smooth kernels have the potential to protect privacy? This will be further discussed in our future work.
Proposition C.16. For discrete distributions, we have the following conclusion: we represent discrete distribution with probability measure greater than zero at k >> points using points in RRk Thus, RRk represents the family of all discrete distributions with a probability measure greater than zero at k points, Almost all distributions in B satisfy Theorem 3.4
34

---

Proof. Based on Corollary C.I1 and Lemma C.12 we immediately obtain this conclusion.
It's important note that the only difference with discrete distributions is that while the theorem holds for any continuous distribution, it only applies to almost all distributions within the family for discrete distributions. This is due two reasons: first, since the measure at any single point of discrete distribution is always greater than zero, if the possible values of the discrete distribution include point R" that could expose privacy, then the possibility of privacy exposure is non-zero. This characteristic prevents us from making the theorem universally applicable to all distributions. However, if we consider a family of distributions, we can still demonstrate useful conclusion: for almost all distributions, Theorem remains valid.
Secondly, when the number of points for a discrete distribution is less than m. any combination of the discrete distribution can certainly be represented by RKME, which would inevitably lead to privacy exposure. Specifically, if the discrete distribution is binomial distribution with a size of 2 in RKME, then the RKME points will correspond to those two points of the discrete distribution, and the coefficients / will reflect the counts of those two points in the dataset, since at this point the difference between RKME and the empirical KME of the dataset is zero. Therefore, this necessitates additional discussion regarding discrete distributions.
D A simple validation experiment
We have conducted validation experiments to further illustrate the tradeoff' between data privacy and search quality in our work. Below, we present the experimental setting and empirical results. It's important to note that this paper is theoretical discussion the privacy protection capabilities of RKME specifications and does not propose any new algorithms. Instead, it validates the theories presented in the paper using existing algorithms. The method for constructing the learnware market comes from [Lu et al. 2024
Datasets. We use six real-world datasets: Postures (Gardner et al. 2014], Bank Moro et al. 2014]. Mushroom [Wagner et al. 2021]. PPG-DaLiA [Reiss et al., 2019). PFS (Kaggle 2018), and M5 [akridakii 2022). These datasets cover six real-world scenarios involving classification and regression tasks. Postures involves hand postures, Bank relates to marketing campaigns of a banking institution, and Mushroom contains different mushrooms. PPG-DaLiA focuses heart rate estimation, while PFS and M5 concern sales prediction. These datasets span various tasks and scenarios, varying in scale from 550 thousand 46 million instances.
Learnware market. We have developed a learnware market prototype comprising about 4000 models of various types. We naturally split each dataset into multiple parts with different data distributions based on categorical attributes, and each part is then further subdivided into training and test sets. For each training set, we train various models with different model types, including linear models, LightGBM, neural networks with different hyperparameters, and other common models. The number of models in each scenario ranges from 200 to 1500. For evaluation, each test set as user testing data, which does not appear in any model's training data. The various scenarios, partitions, and models ensure that the market encompasses a wide array of tasks and models, significantly enhancing the diversity in the prototype and the authenticity of experimental settings.
Evaluation. We explored the tradeoff between data privacy and search ability in the six scenarios mentioned above. For search ability, natural metric is evaluate the performance of the model obtained through the search on the user's dataset. Good performance indicates that we have found more suitable model. Therefore, we employ error rate and root-mean-square error (RMSE) as the loss function for classification and regression scenarios, respectively, collectively referred to as Search error. smaller search error indicates stronger search ability.
For data privacy, we calculate the empirical risk for the three types of privacy risks proposed in this paper. Consistency risk is defined as 1 - Re, where Re is the sample estimate of Re in the paper, defined the number of samples in the generated RKME synthetic data that are close to the original samples in terms of the Euclidean norm. Linkage and Inference risks are defined as (D) (Z) and (D) (Z), respectively, where (D),), (D), (Z), and R₁
35

---

represent the confidence given by brute force attack on the dataset D or RKME Z. Smaller privacy risks indicates stronger data preservation ability.
Configuration. For the specification of RKME, we use Gaussian kernel A: (æ11 2:2) =
exp (-y [2] x212 with 7 = 0.1. For all user testing data, we set the number of synthetic
data points in RKME, m, to 10, 50 100, 200, 500, and 1000 to explore the tradeoff between search
ability and data privacy (when m is 0 a model is randomly selected). Our detailed experimental
results can be found in the accompanying PDF. We summarize some representative results in the
following table:
Posture
Bank
MR
PPG
PFS
M5
m 10
43.57%
13.38%
32.55%
31.98
2.41
2.33
Search error
m 100
23.43%
14.13%
16.29%
20.62
2.18
2.19
m 1000
21.15%
13.97%
15.36%
18.81
2.21
2.07
m 10
0.000%
0.000%
0.000%
0.000%
0.000%
0.000%
Consistency risk
100
0.001% %
0.000%
0.001 %
0.003%
0.000%
0.002%
m 1000
0.041%
0.038%
0.039%
0.040%
0.047%
0.036%
10
0.01%
0.02%
0.02%
0.03%
0.02%
0.02%
Linkage risk
m 100
0.16%
0.18%
0.13%
0.19%
0.14%
0.15%
m 1000
0.30%
0.34%
0.31%
0.32%
0.33%
0.37%
10
0.01%
0.01 %
0.01 %
0.02%
0.01%
0.02%
Inference risk
m 100
0.11%
0.10%
0.18%
0.13%
0.12%
0.14%
1000
0.42%
0.40%
0.46%
0.41%
0.39%
0.43%
can be observed that as the number of synthetic data points m RKME increases, the search error decreases. This indicates that more synthetic data leads to better search ability. At the same time, as m increases, all three privacy risks also increase, indicating that more synthetic data may lead to greater privacy risks. It is noted that the number of synthetic data points in RKME increases,
the search error initially decreases rapidly, but the rate of decrease slows down after m = 100. Conversely, the three privacy risks initially increase slowly but then rise more sharply after 100. Given that the number of user test data points n we used ranges from 10,000 to 100,000, this aligns with our theoretical expectations in the paper that [yn, k/n).
36

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: In this paper we prove the RKME specification has a feasible range for the number of synthetic data points, balancing the privacy preservation ability and usability. More specifically we prove that as the number of synthetic data points RKME decreases, the confidence that the synthetic data will not closely resemble the original data increases. We also prove that RKME exhibits significant resistance to the two common types of data disclosure attacks considered for synthetic data. These reflect the paper's contributions.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Due to page limitations, we did not dedicate a separate section to discuss the limitations of our work. However, we have addressed some shortcomings in the discussion chapter. For instance, we talk about the limitation of our upper bound may be not optimal.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "I "Limitations" section in their paper.
The paper should point any strong assumptions and how robust the results to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
37

---

3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Most of the assumptions in work are presented in the form of constants, and all such constants are explicitly described in the main text and appendices. For all theorems, lemmas, and propositions mentioned in the paper, provide complete proofs.
Guidelines:
The answer NA means that the paper does include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [NA]
Justification: Our work aims theoretically establish whether the specifications within Iearwware maintain privacy. Since the RKME generation process employs a deterministic algorithm, our conclusions are non-random, thereby providing robust theoretical guarantees. For this reason, additional experimental validation would not significantly enhance our findings. Consequently, our paper does not include experimental sections.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
detailed
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
38

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [NA]
Justification: Our work aims theoretically establish whether the specifications within learwware maintain privacy. Since the RKME generation process employs a deterministic algorithm, our conclusions non-random, thereby providing robust theoretical guarantees. For this reason, additional experimental validation would not significantly enhance our findings. Consequently, paper does not include experimental sections.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to reproduce the results. See the NeurIPS code and data submission guidelines (https CCodeSubmeeii //nps/cccppulicc/eeeecc Sotpe///ggideeeeeCeuuuubiiiiii ssionPolccy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [NA]
Justification: Our work aims theoretically establish whether the specifications within learwware maintain privacy. Since the RKME generation process employs a deterministic algorithm, our conclusions are non-random, thereby providing robust theoretical guarantees. For this reason, additional experimental validation would not significantly enhance our findings. Consequently, our paper does not include experimental sections.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment Statistical Significance
39

---

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification: Our work aims theoretically establish whether the specifications within learwware maintain privacy. Since the RKME generation process employs a deterministic algorithm, our conclusions are non-random, thereby providing robust theoretical guarantees. For this reason, additional experimental validation would not significantly enhance our findings. Consequently, our paper does not include experimental sections.
Guidelines:
The answer NA means that the paper does include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma eтror bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [NA]
Justification: Our work aims to theoretically establish whether the specifications within learwware maintain privacy. Since the RKME generation process employs a deterministic algorithm, our conclusions are non-random, thereby providing robust theoretical guarantees. For this reason, additional experimental validation would not significantly enhance our findings. Consequently, our paper does not include experimental sections.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: http://:///eeueeeeeeeeeeeea http///wrpp..coopbba/c//cccccaae
Answer: [Yes]
40

---

We confirm that our work complies with the NeurIPS Code of Ethics in all respects.
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Compared to existing model platforms, the statistical information contained in the specification can enable users to better search and reuse numerous existing models for their tasks. By theoretically analyzing the privacy protection capabilities of learnware specification, it would help in the secure establishment learnware ecosystem while protecting developer's original data.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), faireess considerations (e.g., dep.lymepn of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper is theoretical research about learnware data preservation. We believe that there is no risk of misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
41

---

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All assets are properly credited.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, pappessii thcode wwwccoo/aaaooooo datasat has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question:
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
42

---

Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethies, workers involved in data collection, curation,
or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
43


Reviews:
[{"review_id": "eIkZpt6Nbg", "reviewer": "Reviewer_mMLd", "summary": "The paper analyzes the data preserving properties of Learnware, wan interesting idea involving a marketplace of pretrained ML models. In Learnware, new inference tasks are matched to ML models capable of solving that task without any raw data being shared. Rather, the method leverages RKME to construct a smaller, synthetic representation of the model's distribution over inputs and outputs. In this work, the paper explores whether Learnware is secure against data privacy attacks (linkage, attribute inference) when using the Gaussian kernel and various assumptions on the data. More compact representations are shown to be harder to attack. However, this reduces model search (retrieval) quality inducing a tradeoff.", "questions": "- Is the Learnware market currently operational in the wild? Please provide additional details into which parts of the Learnware ecosystem are actually in use at this time vs hypothesized. For example, scale of daily uploads & downloads?\n\n- Please describe how the Learnware approach outperforms existing ML model-sharing infrastructure (model hubs, data cards, model cards, benchmarks, open source training and inference routines). For example, why is downloading an image segmentation model checkpoint off a model hub after reading through its data and model cards, benchmark and performance reviews, and trying it out in the online UI insufficient? How well does Learnware's \"anchor learnwares\" mechanism work in this situation compared to the approach above?\n\n- Which of the theoretical analyses or results included in this paper are novel compared to prior geometric analyses or privacy works? Please include references, if any, for the analytical techniques in the paper.\n\n- Is it possible to experimentally explore the data linkage vs search quality tradeoffs? How does the search quality degradation affect the user experience of trying to find an appropriate model?", "limitations": "Yes", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ Analysis of the ability of Learnware to resist privacy attacks against the dataset used to train the model makes the Learnware ecosystem more robust. Demonstrating the tradeoff between privacy and search (retrieval) quality is an intuitively clear result.\n\n+ The theoretical results and analyses seem novel to me, as far as I can tell. A brief search didn't turn up anything relevant. (However, this is outside my area of expertise so I'm unable to assess validity.)", "weaknesses": "- The paper analyzes the privacy-preserving properties of Learnware. However, I remain unsure about the benefits of the core Learnware system. Reading through the recent references (\"Learnware: Small models do big\"), I'm left with many questions which are not really addressed in any of the papers. I don't see how Learnware is better than the existing model sharing infrastructure (model hub, data and model cards, benchmark results, open-source training and inference code). The existing ML model sharing infrastructure is widely used already and doesn't require the new user to even label any data first. Please see the questions below.\n\n- The Learnware ecosystem seems like a very niche area. Without additional details of system usage, it becomes difficult to assess the impact of contributions in this paper.\n\n- I'm not really equipped to comment on the quality of the theoretical analyses. That said, the paper could do a better job of describing how the analyses build on and fit into the larger body of work on related tasks.\n\n- Experiments exploring the tradeoff between data linkage protection and search performance would have been nice to have. Without these, I'm again left wondering if the existing ML model sharing infrastructure (which does not have this issue) is indeed better.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Many thanks for the constructive reviews! We provide detailed responses below, and hope the reviewer could reassess the significance of our results. We are looking forward to addressing any further question in the reviewer-author discussion period.\n\n---\n\nQ1: Is the Learnware market currently operational in the wild? ... For example, scale of daily uploads & downloads?\n\nA1: Thanks for the feedback!\n\nYes. Recently, the first learnware dock system, *Beimingwu*, has been built and released [1,2]. With a novel specification-based architecture, the system can significantly streamline the process of building machine learning models for new tasks, by automatically identifying useful models. The system provides implementations and extensibility for the entire process of the learnware paradigm, including the submission, usability testing, organization, identification, deployment, and reuse of learnwares. The core engine is also released as *learnware* package [3].\n\nThe Beimingwu system is currently primarily serving as a research platform for learnware studies. Although it is only open to the academic community, it has already been registered by over 500 researchers from more than **150 universities**.    \n\n[1] Beimingwu: A Learnware Dock System. KDD 2024. \n\n[2] Website: https://bmwu.cloud/\n\n[3] Learnware package: https://learnware.readthedocs.io/\n\n---\n\nQ2: Please describe how the Learnware approach outperforms existing ML model-sharing infrastructure ...   reading through its data and model cards, benchmark and performance reviews, and trying it out in the online UI insufficient?\n\nA2: Thanks for the detailed feedback! \n\nThe biggest advantage of Learnware compared to existing ML model-sharing infrastructures lies in **model search with specification**. As you mentioned in your example, reading through data and model cards, benchmarks, and performance reviews can certainly help determine a good model, but when there are lots of models in the library, it is difficult to try each one individually, which necessitates model search. General existing ML model-sharing infrastructures can only perform keyword or language description searches. Since they cannot access specific user task data, such searches are imprecise and require users to try the search results themselves.\n\nIn Learnware, besides using language description information (which we refer to as **semantical specification**), we also use the RKME-based **statistical specification** mentioned in this paper to describe the user's specific task for precise model localization. This allows users to search for models in the market that are more suitable for their specific tasks. \n\nTo our best knowledge, for the first time, the learnware paradigm formally proposes to build a large model platform consisting of numerous high-performing models with specifications, and enable users to easily leverage existing models to solve their tasks. Recently, utilizing the large model platform to solve new learning tasks has witnessed a rapidly increasing attention, notably the Hugging Face platform, hosting over half a million models. Thus identifying truly helpful models becomes more and more difficult. Based on a novel statistical-specification-based architecture, learnware system aims to automatically identify and assemble high-performing models suitable for user tasks, with no need for extensive data and expert knowledge, while preserving data privacy we proved in this paper. \n\n---\n\nQ3: The paper could do a better job of describing how the analyses build on and fit into the larger body of work on related tasks. Which of the theoretical analyses are novel compared to prior geometric analyses or privacy works?\n\nA3: Thanks for the feedback. To the best of our knowledge, our work is the first to use geometric analyses to study privacy. The theories and related analytical methods are completely original and provide significant contributions to the field of privacy:\n\n1. The problem we mainly focus on is the privacy of synthetic data brought by data compression. However, related work (e.g., data distillation/data condensation) mainly explores privacy properties through experiments without theoretical guarantees. This is because the most mainstream privacy theoretical analysis framework, differential privacy (DP), is difficult to apply to compressed synthetic datasets. Thus, theoretical analysis methods for the privacy of compressed data have always been lacking. Our paper provides the first theoretical analysis attempt for RKME, a special form of data compression.\n2. The essential difficulty in analyzing the privacy of RKME-compressed synthetic datasets lies in the fact that RKME is the optimal solution to a non-convex nonlinear system of equations involving a Gaussian kernel. Solving the optimal solution for non-convex problems involving Gaussian kernels has been an open problem. However, in geometric analyses, we found a way to analyze the properties of the solution without solving this non-convex nonlinear system. Our newly proposed technique may prove to be highly useful in analyzing the properties of solutions to specific forms of non-convex problems.\n\n---\n\nQ4: Is it possible to experimentally ... to find an appropriate model?\n\nA4: Thanks for your constructive feedback! We have carried out detailed experiments, the datasets, settings, and results of which can be found in the global response to all reviewers. We have also analyzed the experimental results in the global response to all reviewers, and the empirical findings align closely with our theories.\n\n---\n\nWe once again thank you for your constructive comments! We believe that the Learnware paradigm is extremely important and general, and our research occupies a non-negligible position in both the learnware and privacy communities. We hope the above replies will address your concerns and would appreciate a reevaluation of our paper's score!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rtMAmAZIE6", "reviewer": "Reviewer_gkER", "summary": "The paper presents the \"Reduced Kernel Mean Embedding (RKME)\" specification, which represents a model's capabilities while ideally preserving the privacy of the original training data. The paper provides a theoretical analysis and proves that the RKME specification can protect the training data against common inference attacks and maintain its utility in the learnware search process.", "questions": "I do not have particular questions as I am unfamiliar with the field.", "limitations": "The authors have included discussions about potential limitations.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* This paper aims to resolve the crucial data privacy challenge while enabling the effective reuse of pre-trained models under the learnware setting. \n* This paper provides a comprehensive theoretical framework to prove the efficacy of RKME in preserving privacy. The proofs are detailed and robust, offering a strong theoretical foundation for the claims about data privacy and security against inference attacks.\n* The paper also discusses the practical implementation of the RKME specification in learnware systems.", "weaknesses": "* The paper focuses on theoretical proofs and lacks extensive empirical evidence to support the effectiveness of the RKME specification in real-world scenarios.\n* The analysis primarily hinges on the assumption that the RKME specification works optimally with certain types of data distributions and kernel functions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Many thanks for the constructive reviews!\n\n---\n\nQ1: The paper focuses on theoretical proofs and lacks extensive empirical evidence to support the effectiveness of the RKME specification in real-world scenarios.\n\nA1: Thanks for the feedback! We are not entirely sure whether the \"effectiveness of the RKME specification in real-world scenarios\" you mentioned refers to the effectiveness of RKME in Learnware search or its effectiveness in protecting privacy while performing search tasks well. Therefore, we will provide a detailed discussion on both aspects below:\n\n1. **For Learnware search**, in current learnware research, almost all data types that use RKME with Gaussian kernel as a specification have achieved very good results. [Liu et al., 2023] demonstrated through experiments that for tabular data, using RKME with Gaussian kernel for Learnware search significantly outperforms searching in the learnware market without a specification. Similarly, [Wu et al., 2023] have shown that image data, after feature extraction, can use RKME with Gaussian kernel and achieve good experimental results. It is important to note that the core contribution of our work is providing theoretical guarantees that RKME can protect user data privacy, while the effectiveness of RKME in Learnware model search is not within the scope of discussion of this paper.\n\n2. **For the effectiveness of RKME in protecting data privacy in real-world scenarios**, we carried out detailed experiments, the results of which can be found in the global response to all reviewers. Additionally, we have provided an analysis of our experimental results in the global response to all reviewers. It is worth mentioning that our experimental results match our theory well and demonstrate that RKME effectively protects data privacy while performing Learnware search tasks efficiently.\n\nIf you still have any concerns, we are looking forward to addressing any further questions during the reviewer-author discussion period!\n\n---\n\nQ2: The analysis primarily hinges on the assumption that the RKME specification works optimally with certain types of data distributions and kernel functions.\n\nA2: Thanks for the feedback! Our theoretical analysis does not make non-trivial assumptions about data distributions, and our analysis is also applicable to a broad class of kernel functions. We chose the Gaussian kernel for our proofs because it is widely recognized as the best kernel for the MMD (maximum mean discrepancy) distance. Here is a detailed explanation:\n\n1. Note that in proving Theorem 3.4, we show that it holds for any continuous distribution. In the subsequent remark following Theorem 3.4, on line 165, we further discuss the applicability of Theorem 3.4 to discrete distributions. The conclusion of Theorem 3.5 is derived based on Theorem 3.4, so the assumptions are consistent. Therefore, our theory is not limited to specific types of data distributions.\n\n2. In learnware research, one of the most representative distribution metric, MMD(maximum mean discrepancy), is used to calculate distribution distance. MMD distance with characteristic kernel is commonly used in various scenarios, such as applying MMD in GAN on image data, and the gaussian kernel is the most commonly used. Thus, following the tradition in most field using MMD as distribution metric, we mainly conduct the theoretical analysis on RKME with gaussian kernel.\n\n   However, our analysis method is highly applicable to Kernels with *nonrationality* and *analyticity*. These properties determine whether the synthetic data in RKME are locally homeomorphic to the manifold of the sample space. Therefore, kernels that satisfy these properties (such as the Sigmoid kernel $K(x, y)=\\tanh \\left(\\gamma x^T y+r\\right)$, Cauchy kernel $K(x, y)=\\frac{1}{1+\\gamma|x-y|^2}$, etc.) can undergo a similar analysis and reach the same conclusion as Proposition 3.2 and Proposition 3.3.\n\n   For these kernels, the bound appearing in Theorem 3.5 should be estimated differently for each kerne For the Gaussian kernel, we used linearization and isoperimetric inequalities in our proof to estimate sub-manifold within the manifold formed by the samples, which is also where the difficulty of this problem lies. For other kernels, similar conclusions can be reached after selecting appropriate methods for estimation.\n\n\n\n---\n\nWe greatly appreciate the your feedback! We hope our responses have clarified our work. If you still have any concerns or feel unfamiliar with certain aspects, we are looking forward to addressing any further questions during the reviewer-author discussion period!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6oh9D3njlw", "reviewer": "Reviewer_4E2V", "summary": "The authors theoretically analyze the properties of the learnware paradigm. In the learnware paradigm, a model developer can provide their trained models for other developers to use. To enable re-use, along with the model the developer provides a model specification that adequately represents the model's training data. This allows developers looking for models to find those that are most useful for their tasks of interest. Importantly, this specification should preserve the privacy of the original training data of the model.\n\nWhile, the reduced kernel mean embedding specification has been proposed in the literature, a theoretical analysis that guarantees the protection of the model's training data is missing. The authors prove that RKME can simultaneously have the following three desirable properties:\n* It does not contain any of the original training data points\n* It is robust against inference attacks\n* It still preserves sufficeint information about the training data for effective use as a learnware specification.", "questions": "I am a bit confused with regards to Theorem 3.4: Is Theorem 3.4 proven for the $\\delta=0$ case or is it proven for a specific $\\delta$? Intuitively, the overlap of a continuous distribution and a discrete distribution of synthetic data should be zero for $\\delta=0$ regardless of how the number of discrete synthetic points. So I feel I am missing something.\n\nAlso I am still not sure which is the $\\delta$ chosen for Theorem 3.5. Can you explain this more?\n\nI am a bit confused about the linkability privacy game. It seems like the game can be technically split in two games, one when $b=0$ and one when $b=1$. Given that the adversary knows $b$, these two subgames are completely independent. In addition, the subgame of $b=0$ is trivial because the adversary trivially knows the answer. I am thus unsure what is the value of having the $b=0$ subgame at all. I guess my question here, is why is the random $b$ introduced in the game?", "limitations": "The authors have addressed the limitations.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "To the best of my knowledge, the results provided by the authors are novel. While I am not an expert neither in learnware systems nor in reproducing kernels, the results provided and the tools used in the analysis are non trivial. The result should be of high significance to the learnware community, especially since disclosing a model specification may carry risk if there are no formal guarantees. In terms of writing, the authors introduce the learnware problem and their contribution in a clear manner in Sections 1 and 2. The figures presenting the trade-offs between the different choices of $m$ are also very helpful for readers who may not be able to follow the theoretical results.", "weaknesses": "I think the clarity of Sections 3 and 4 can be significantly improved, so that they can be more approachable to a broader audience. \n\nFor Section 3, the authors present core results that are the basis of Theorems 3.4 and 3.5 but the connection to these theorems is not particularly clear. I would advise the authors to first explain the proof sketch and then present the key lemmas and how they connect to the proof sketch. See also the questions section for more.\n\nFor Section 4, I understand that the setting is even more complicated compared to Section 3 but providing some more intuition behind Theorem 4.2, especially the parts that are not already covered in Section 3, would also be helpful.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Many thanks for the constructive reviews!\n\n---\n\nQ1: I am a bit confused with regards to Theorem 3.4: Is Theorem 3.4 proven for the $\\delta=0$ case or is it proven for a specific $\\delta$ ? Intuitively, the overlap of a continuous distribution and a discrete distribution of synthetic data should be zero for $\\delta=0$ regardless of how the number of discrete synthetic points. So I feel I am missing something.\n\nA1: Thank you for your thorough review of Theorem 3.4 and for raising specific questions! Indeed, Theorem 3.4 is proven for the $\\delta = 0$ case, but this is not a trivial case:\n\nIn our paper, the consistency risk is defined as $R\\_C(\\mathcal{P}) \\triangleq \\mathbb{E}\\_{D \\sim \\mathcal{P}^n}\\left(\\mathbb{I}\\_{Z\\_\\delta \\cap D\\_\\delta \\neq \\emptyset}\\right)$. Therefore, we are concerned not with the overlap of a continuous distribution and a discrete distribution of synthetic data, but with the probability that a dataset sampled from the continuous distribution overlaps with the synthetic data generated from that dataset. The value of $R_C(\\mathcal{P})$ at $\\delta = 0$ strongly depends on the properties of method of generating synthetic data. For example, if we replace the commonly used Gaussian kernel in RKME, $k\\left(\\boldsymbol{x}_1, \\boldsymbol{x}_2\\right)=\\exp \\left(-\\gamma\\left|\\boldsymbol{x}_1-\\boldsymbol{x}_2\\right|_2^2\\right)$, with a Laplacian kernel, $k\\left(\\boldsymbol{x}_1, \\boldsymbol{x}_2\\right)=\\exp \\left(-\\gamma\\left|\\boldsymbol{x}_1-\\boldsymbol{x}_2\\right|\\right)$, it can be shown through analysis of its nonlinear equations that for any dataset, the generated synthetic data in RKME will always contain points from the original dataset. In this case, even if $\\delta = 0$, the $R_C(\\mathcal{P})$ for RKME with the Laplacian kernel would be $1$. Therefore, the proof in our paper that $R_C(\\mathcal{P})$ for RKME with the Gaussian kernel is $0$ when $\\delta = 0$ is non-trivial and relies on the analysis of nonlinear equations involving the Gaussian kernel.\n\nIn the paper, we separately prove the $\\delta = 0$ case because it has some geometric intuition and provides insights for the proof of the $\\delta > 0$ case. In future versions, we will make the significance and position of this example clearer in the text.\n\n---\n\nQ2: Also I am still not sure which is the δ chosen for Theorem 3.5. Can you explain this more?\n\nA2: Thanks for your valuable feedback!\n\nA detailed discussion on the selection of $\\delta$ can be found in Appendix D. Here, we provide a simple understanding and discussion. The meaning of $\\delta$ is that we want the synthetic data to differ from the real data by at least $\\delta$ to ensure that the real data does not appear in the synthetic data. Therefore, $\\delta$ is related to the scale of the data. When the overall data scale is small, it is impossible to ensure a $\\delta$ larger than the data scale to ensure privacy. Additionally, $\\delta$ is related to the number of real data points. For example, when there are many real data points, they become very dense in $\\mathbb{R}^d$, and the distance between real data points becomes very small. In this case, the feasible $\\delta$ will also become correspondingly smaller. Hence, in the proof of Theorem 3.5, $\\delta$ is chosen as $\\frac{R}{n}$, where $R$ is the upper bound of the data and $n$ is the number of samples.\n\nA simpler and more relaxed form of this selection is to directly choose the smallest different sample distance in the sample set, as it is easily shown to be less than $\\frac{R}{n}$. However, this approach provides users with a clear metric: they can use the smallest sample distance in their data set to measure the strength of privacy protection we can offer. Therefore, we have provided this easier-to-understand form in the paper. In future versions, we will provide a more detailed explanation of the selection of $\\delta$ in Section 3.\n\n---\n\nQ3: I am a bit confused about the linkability privacy game. ... why is the random $b$ introduced in the game?\n\nA3: Thanks for your feedback! \n\nThe cases $b=0$ and $b=1$ indeed represent two completely independent subgames, and the random bit $b$ is a common and necessary setup in the privacy game. The random bit $b$ serves to indicate to the adversary whether the dataset provided is the real dataset. Without the random bit $b$, the adversary would still attempt to attack using some method even if they obtained the original dataset. Many membership inference attacks (e.g., black-box attacks) use a confidence estimation approach, and even with the original dataset, they cannot always provide a completely correct conclusion. In the linkage privacy game, we naturally want the adversary to be able to accurately determine conclusions if they have the original dataset. Therefore, we include a random bit $b$ to be sent to the adversary along with the dataset.\n\nMoreover, the random bit $b$ plays a crucial role in the subsequent inference privacy game, as obtaining the original dataset does not necessarily lead to correct attribute inference (there could be samples with completely overlapping attributes except for the target attribute).\n\n---\n\nQ4: I think the clarity of Sections 3 and 4 can be significantly improved, so that they can be more approachable to a broader audience.\n\nA4: Thanks for the constructive feedback!\n\nWe will address the two points mentioned by the reviewer in future versions as follows:\n\n1. We will revise the order of Section 3, presenting the proof sketch first to give readers a preliminary understanding, followed by a detailed proof according to its logic.\n2. We will provide more intuition in Sections 3 and 4, and move some of the more complex parts to the appendix as appropriate.\n\n---\n\nIn the end, we take this opportunity to sincerely thank you for the careful review, your suggestions are very insightful and important for further improving the paper. We are happy to provide further clarifications if needed in the following author-reviewer discussions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We have conducted validation experiments to further illustrate the tradeoff between data privacy and search quality in our work. Below, we present the experimental setting and empirical results. All related figures can be found in the accompanying PDF.

---

### **Datasets**

We use six real-world datasets: Postures [Gardner et al. 2014], Bank [Moro, Cortez, and Rita 2014], Mushroom [Wagner, Heider, and Hattab 2021], PPG-DaLiA [Reiss et al. 2019], PFS [Kaggle 2018], and M5 [Makridakis, Spiliotis, and Assimakopoulos 2022]. These datasets cover six real-world scenarios involving classification and regression tasks. Postures involves hand postures, Bank relates to marketing campaigns of a banking institution, and Mushroom contains different mushrooms. PPG-DaLiA focuses on heart rate estimation, while PFS and M5 concern sales prediction. These datasets span various tasks and scenarios, varying in scale from **550 thousand to 46 million** instances.

---

### **Learnware market**

We have developed a learnware market prototype comprising about **4000 models** of various types. We naturally split each dataset into multiple parts with different data distributions based on categorical attributes, and each part is then further subdivided into training and test sets. For each training set, we train various models with different model types, including linear models, LightGBM, neural networks with different hyperparameters, and other common models. The number of models in each scenario ranges from 200 to 1500. For evaluation, we use each test set as user testing data, which does not appear in any model’s training data. The various scenarios, partitions, and models ensure that the market encompasses a wide array of tasks and models, significantly enhancing the diversity in the prototype and the authenticity of experimental settings.

---

### **Evaluation**

We explored the tradeoff between data privacy and search ability in the six scenarios mentioned above. For search ability, a natural metric is to evaluate the performance of the model obtained through the search on the user’s dataset. Good performance indicates that we have found a more suitable model. Therefore, we employ error rate and root-mean-square error (RMSE) as the loss function for classification and regression scenarios, respectively, collectively referred to as Search error. A **smaller search error** indicates **stronger search ability**.

For data privacy, we calculate the empirical risk for the three types of privacy risks proposed in this paper. Consistency risk is defined as $1-\widehat{R}_C$, where $\widehat{R}_C$ is the sample estimate of $R_C$ in the paper, defined as the number of samples in the generated RKME synthetic data that are close to the original samples in terms of the Euclidean norm. Linkage and Inference risks are defined as $\widehat{R}_L(D) - \widehat{R}_L(Z)$ and $\widehat{R}_I(D) - \widehat{R}_I(Z)$, respectively, where $\widehat{R}_L(D)$, $\widehat{R}_I(D)$, $\widehat{R}_L(Z)$, and $\widehat{R}_I(Z)$ represent the confidence given by a brute force attack on the dataset $D$ or RKME $Z$. **Smaller privacy risks** indicates **stronger data preservation ability**.

---

### **Configuration**

For the specification of RKME, we use a Gaussian kernel $k\left(\boldsymbol{x}_1, \boldsymbol{x}_2\right)=\exp \left(-\gamma\left|\boldsymbol{x}_1-\boldsymbol{x}_2\right|_2^2\right)$ with $\gamma=0.1$. For all user testing data, we set the number of synthetic data points in RKME, $m$, to $0$, $10$, $50$, $100$, $200$, $500$, and $1000$ to explore the tradeoff between search ability and data privacy (when $m$ is 0, a model is randomly selected).

Our detailed experimental results can be found in the accompanying PDF. We summarize some representative results in the following table:



|                                 |          | Posture | **Bank** | **MR** | **PPG** | **PFS** | **M5** |
| ------------------------------- | -------- | -------- | -------- | ------ | ------------- | ------- | ------ |
| Search error  | $m=10$   | 43.57%| 15.58%| 32.55% | 31.98| 2.41| 2.33|
|              | $m=100$  | 23.43%| 14.13%|16.29%| 20.62| 2.18| 2.19|
|                 | $m=1000$ | 21.15%   | 13.97%   | 15.36% | 18.81| 2.21| 2.07|
| Consistency risk      | $m=10$| 0.000‰| 0.000‰| 0.000‰ | 0.000‰| 0.000‰  | 0.000‰ |
|                    | $m=100$  | 0.001‰| 0.000‰| 0.001‰ | 0.003‰| 0.000‰  | 0.002‰ |
|                                 | $m=1000$ | 0.041‰| 0.038‰| 0.039‰ | 0.040‰| 0.047‰  | 0.036‰ |
| Linkage risk| $m=10$   | 0.01‰| 0.02‰| 0.02‰  | 0.03‰| 0.02‰   | 0.02‰  |
|                                 | $m=100$  | 0.16‰| 0.18‰| 0.15‰  | 0.19‰| 0.14‰   | 0.15‰  |
|                                 | $m=1000$ | 0.30‰| 0.34‰| 0.31‰  | 0.32‰| 0.33‰   | 0.37‰  |
| Inference risk| $m=10$   | 0.01‰| 0.01‰    | 0.01‰  | 0.02‰| 0.01‰   | 0.02‰  |
|                                 | $m=100$  | 0.11‰| 0.10‰| 0.18‰  | 0.13‰| 0.12‰   | 0.14‰  |
|                                 | $m=1000$ | 0.42‰| 0.40‰| 0.46‰  | 0.41‰| 0.39‰   | 0.43‰  |



Due to the limitation of space, we provide a brief analysis of the experimental results as follows:

1. It can be observed that as the number of synthetic data points $m$ in RKME increases, the search error decreases. This indicates that more synthetic data leads to better search ability. At the same time, as $m$ increases, all three privacy risks also increase, indicating that more synthetic data may lead to greater privacy risks.
2. It is noted that as the number of synthetic data points $m$ in RKME increases, the search error initially decreases rapidly, but the rate of decrease slows down after $m = 100$. Conversely, the three privacy risks initially increase slowly but then rise more sharply after $m = 100$. Given that the number of user test data points $n$ we used ranges from 10,000 to 100,000, this aligns with our theoretical expectations in the paper that $m \in [\sqrt{n}, k\sqrt{n}]$.

Meta-review: The paper puts forward a theoretical analysis of tradeoffs between quality and privacy in the use of pretrained models from a model hub (or "learnware marketplace") for new tasks, and in particular shows a promising theoretical result that a method using RKME to select component models is highly unllikely to leak data that those models were originally trained on.  The reviewers have reached a clear consensus that the work is technically sound.  There was significant discussion on the overall importance and impact of the work, and during the rebuttal phase the argument that this setting is important in the age of Hugging Face was found to be compelling -- and indeed I agree with this viewpoint.

Reviewers noted that empirical results would have strengthened the submission, and in the rebuttal phase the authors provided detailed and compelling empirical results on 6 datasets.  In general, I think it is difficult to weigh such results in the context of a review because they are a significant post-submission addition.  However, because they demonstrate results that were already proved theoretically (rather than supporting ideas that relied primarily on empirical validation for significance), I think this is acceptable.  These results should certainly be included in the final version, along with revisions and clarifications based on the reviews and the suggestions from reviewers.
Decision: Accept (poster)