ObCLIP: Oblivious CLoud-Device Hybrid Image Generation with Privacy Preservation
Authors: Haoqi Wu
Wei Dai
Ming Xu
Wang Li
Qiang Yan
Venue: NeurIPS 2025 poster ()
Keywords: Text-to-image
diffusion model
prompt privacy
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We introduce ObCLIP, a cloud-device hybrid oblivious image generation framework that achieves private Stable Diffusion inference (protecting the sensitive attributes in user prompts) with an enhanced efficiency-utility trade-off.

Abstract: Diffusion Models have gained significant popularity due to their remarkable capabilities in image generation, albeit at the cost of intensive computation requirement. Meanwhile, despite their widespread deployment in inference services such as Midjourney, concerns about the potential leakage of sensitive information in uploaded user prompts have arisen. Existing solutions either fail to strike an effective balance between utility and efficiency, or lack rigorous privacy guarantees. 

To bridge this gap, we propose ObCLIP, a plug-and-play safeguard that enables oblivious cloud-device hybrid generation scheme.
By oblivious, each input prompt is transformed into a set of semantically similar candidate prompts that differ only in sensitive attributes (e.g., gender, ethnicity). The cloud server processes all candidate prompts without knowing which one is the real one, thus preventing any prompt leakage. To mitigate server cost, only a small portion of denoising steps is performed upon the large cloud model. The resulting intermediate latents are then transmitted back to the device, which selects the targeted latent and completes the remaining denoising using a small local model to obtain the final image. Additionally, we analyze and incorporate several cache-based accelerations that leverage temporal and batch redundancy, effectively reducing computation cost with minimal utility degradation. Extensive experiments across multiple datasets demonstrate that ObCLIP provides rigorous privacy and comparable utility to large cloud models with slightly increased server computation.

ObCLIP: Oblivious CLoud-Device Hybrid Image Generation with Privacy Preservation
Haoqi Wu', Wei Dai', Ming Xu', Li Wang', Qiang Yan
TikTTok Inc., National University of Singapore
Abstract
Diffusion Models have gained significant popularity due to their remarkable capa- bilities in image generation, albeit at the cost of intensive computation requirement. Meanwhile, despite their widespread deployment in inference services such as Mid- journey, concerns about the potential leakage of sensitive information in uploaded user prompts have arisen. Existing solutions either lack rigorous privacy guarantees fail to strike effective balance between utility and efficiency. To bridge this gap, we propose OPCLIP, plug-and-play safeguard that enables oblivious cloud- device hybrid generation. By oblivious, each input prompt is transformed into a set of semantically similar candidate prompts that differ only in sensitive attributes (e.g., gender, ethnicity). The cloud server processes all candidate prompts without knowing which one is the real one, thus preventing any prompt leakage. To mitigate server cost, only small portion of denoising steps performed upon the large cloud model. The intermediate latents are then sent back to the client, which selects the targeted latent and completes the remaining denoising using small device model. Additionally, we analyze and incorporate several cache-based accelerations that leverage temporal and batch redundancy, effectively reducing computation cost with minimal utility degradation. Extensive experiments across multiple datasets demonstrate that OPCLIP provides rigorous privacy and comparable utility to cloud models with slightly increased server cost.
Introduction
have emerged as a de-facto standard technique text-to-image (T2I) generation due to their superior capability to generate high-quality images. This drives the widespread application of T2I inference services hosted by cloud servers. As depicted in Figure the client uploads text prompts the cloud, which generates images and sends them back to the client. This paradigm is widely-adopted since the generation typically requires huge computation cost, which is unaffordable for clients, especially for devices with limited computation power.
Stable diffusion models 35 M
Client
Text Enceder
Cloud Server
Text
Decoder
Prompt
Large
"Portrait of 18-year-old
Encodar
U-net
girl green
Sensitive Attributes
Figure Illustration of existing server-only text-to-image generation services.
However, despite its growing popularity, there remain two essential problems: ① Prompt privacy re-
mains critical concern 43 48 In image generation services like Midjourney 30 and DALL-E 32
"Email at haoqi. 1997 @tiktok.com
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

the server deploys their models on the cloud and provides APIs that take client prompts as inputs, which might contain sensitive attributes like gender, ethnicity, etc. @ Server cost increases drastically, According to the scaling law [6 20], the superior model capacity comes at the expense of larger model size, leading to considerable hardware requirement and computation cost on the cloud servers.
Existing solutions typically only address one of the aforementioned issues. Cryptographic- approaches [47 3 offer provable security to the sensitive prompts. However, the huge computation overhead and efficiency decay hinders their application in real world scenarios. Meanwhile, some prior works [46] provide client-side input filter that detects and perturbs sensitive information before sent to the server. However, such kind of random perturbation incurs inevitable semantic and utility loss, leading to mismatch between the user intent and generation output. Another line of works employ on-device models [22 49 to allow efficient image generation, avoiding data transmission to the server. However, despite significant improvement that has been made, the image quality inevitably decreases, failing to meet the users' needs. Recently, Hybrid SD [44 incorporates hybrid image generation pipeline to lower the server-side computation cost, which however fails to preserve the prompt privacy, the embedding of which is directly sent to the server. Such kind of information is vulnerable to extraction attacks [33 31. Therefore, here arises the question:
Can we perform privacy-preserving image generation with better image quality and lower server cost?
As an attempt to answer this question, we propose OPCLIP, an oblivious cloud-device hybrid image generation scheme that provides rigorous privacy and comparable utility to large cloud models with slightly increased server cost. Specifically, our contributions are summarized follows:
Oblivious Cloud-Device Hybrid Generation Scheme. OPCLIP consists of two main compo- nents address the aforementioned challenges: 1) Oblivious transformation: each input prompt is transformed into a set of semantically similar candidate prompts that differ only in sensitive attributes (e.g.. gender age, ethnicity). The cloud server processes all candidate prompts without knowing which one is the real one, thus preventing any prompt leakage. 2) Local extraction: the client selects the targeted output corresponding to the real prompt. One straightforward drawback of vanilla oblivious generation is heavy server cost. Therefore, we devise hybrid generation pipeline, where only partial denoising steps are performed by the server. Besides, we analyze and incorporate several cache-based acceleration methods, leveraging both temporal and batch redundancy, to further reduce server cost with minimal utility degradation.
Temporal- and Batch- Redundancy based Acceleration. We analyze and incorporate several based acceleration techniques to exploit temporal redundancy in server-side generation. Additionally, inspired by batch-level redundancy, we propose reusing attention maps across the batch of candidate prompts. Together, these two acceleration strategies effectively reduce computation costs with minimal utility degradation.
Empirical Evaluations. We conduct extensive text-to-image generation experiments on several stable diffusion models across three datasets. The experiments confirm that OPCLIP provides rigorous privacy and comparable utility to large cloud models with slightly increased server computation costs, which is about 4.4 ~ 7.6x lower than vanilla oblivious generation baseline and orders of magnitude lower than cryptographic approach.
2 Related Work
Existing works typically employ various privacy enhancing technologies. We provide a comprehen- sive comparison of related works in Table focusing on application domain and trade-off among prompt privacy, server cost and image utility.
over Cryptographic methods like secure multi-party computation (MPC) that support computation encrypted data and models are widely used to enable secure machine learning inference (27 6 42 47
MPCVIT 47) employed MPC and proposed a search algorithm for MPC-friendly neural architecture.
HE-Diffusion B leveraged homomorphic encryption (HE) to perform partial image encryption and protected the diffusion process. However, these works impose significant overhead compared to plaintext baselines, limiting their practicality for real-world deployment. Other works employ lightweight privacy techniques like differential privacy (DP) (7) to perturb prompts by adding random noises in text generation. SANTEXT [46) designed Exponential mechanism based word-level

---

Table 1: Comparison of related work.
1 and O refer high-, medium- and low- low-performance.
Method
Domain
Privacy
Server Cost
Utility
Server-Only
34
Text-to-Image Text-to-lmage
Standalone
Non-private
Client-Only
22
49
Hybrid
Hybrid SD
Toxt-to-Image
MPCVIT HE-Diffusion
Text-to-Image
MPC
Text-to-Image
Private
SANTEXT CAPE [1
Text Generation
DP
Text Generation
Ours
ObCLIP
Text-to-Image
perturbation mechanism to hide sensitive attributes within prompt. CAPE 41 further proposed an optimized perturbation mechanism by incorporating contextual information that achieves a better trade-off between privacy and utiliity. However, privacy comes at the cost of semantics distortion and utility degradation. Besides, the scalability to text-to-image image generation domain is uncertain. Another line of works manage offload the generation to user devices, avoiding the transmission of prompts to server. SnapFusion [22] introduced efficient network architecture and improved step distillation process enable generation within 2 seconds. MobileDiffusion (49] further studied one-step sampling technique, which decreased the runtime to less than I second. However, its scalability to larger models like SDXL 34 is not yet explored.
Recently, a new paradigm of cloud-device hybrid generation scheme is proposed to lower the server- side computation cost. Hybrid SD [4]] proposed an cloud-device collaborative stable diffusion pipeline. By offloading a great portion of denoising steps to client devices, the server-side costs can be optimized. However, it only reduces server costs, failing to effectively protect the privacy of user prompts, the embedding of which directly sent to the server. Such kind information is vulnerable extraction attacks 5 31 33, which could reconstruct the original prompt infer partial sensitive attributes. To make matters worse, even if embedding inversion fails, the server can still perform full image generation based on the received embeddings, inevitably revealing sensitive visual patterns. Built upon such paradigm, we manage to preserve the privacy in an oblivious way, providing rigorous privacy. To hedge against the additional server-side cost introduced by our scheme, we incorporate several acceleration methods based on temporal and batch redundancy.
3 Preliminary
Diffusion models 13 have attracted significant attentions due their ability to generate high-quality images. Its forward process adds Gaussian noise to the data over a fixed number of timesteps as (x
Diffusion Model.
Naxx; VI- 3, It- (02-1,,,1),, 3,I), where .o refers to the original image, E [l.... 7' denotes the total diffusion timestep, {I1, ..., IT denote the sequence of noisy latents, 3g (0, 1) determines the amount of noise added each timestep, I is the identity matrix and N(x;; [4, .r) denotes the Gaussian distribution with mean and covariance a. During image generation, the reverse (denoising) process aims to recover 2t-1 from 2; using neural network the noise predictor (typically, U-net (36)) co(2,, t) that predicts the noise in each timestep. Concretely,
1 Vaa
31 8t VI- āz
co(xx;
It-1
where o; 1 3r and o₂ II This process is iteratively applied starting from a random sam- ple drawn from the noise prior and finally yields a denoised sample. For stable diffusion models (35). the core idea is to perform the diffusion process in lower-dimensional latent space-obtainee obtained via a pretrained variational autoencoder (VAE)- rather than directly in pixel space. This approach significantly reduces computation overhead during denoising process. Recently, the MMDiT archi- tecture g [0], which jointly processes image and text tokens to model gross-moda relationships, has also been gaining increasing attention.
Training-free Diffusion Acceleration. To mitigate the expensive computation cost diffusion generation, prior works either resort to training-based model distillation [38 26 and model compres- sion 17 approaches, or training-free caching [28 methods. this paper, we mainly focus on training-free free acceleration methods that leverages different kinds of feature redundancy throughout

---

the diffusion process. As observed by prior works, adjacent steps exhibits temporal redundancy, happening in layer outputs or even block outputs. In U-net, the attention module computed as:
Q.K" vd
M Softmax
-
where Q refers to projected features from latent, K, V refers to latent (self-attention) or text embed- ding (eross-attention). Recently, Faster Diffusion 21 explored the feasibility of skip U-net encoder computation with a delicate skip strategy. Applying these acceleration methods to the new paradigm of hybrid inference presents unique challenges that necessitate reexamination of previous strategies.
4 ObCLIP: Design
Inspired by prior works [5], which highlight the feasibility of employing a mixture of diffusion models different stages of the denoising process, we devise OPCLIP for an optimal cloud-device hy- brid generation scheme with privacy preservation. As illustrated in Figure 2 the two key components in OPCLIP are oblivious transformation and local extraction. By transforming the private prompt into set of candidate prompts, server only acting as guidance of several initial steps and offloading most of later diffusion steps to device, we achieve the following features: 1) enhanced image quality by leveraging the on-cloud large-capacity models; 2) strengthened prompt privacy through on-device computation. To further lower the server computation cost, we devise several server-side acceleration methods tailored to our scenario.
Device-alone
Server-alone
Low Quality t>
Privacy Leakage
Small
Prempp
Large DM
Image
Imngee
Hybrid
Encoder
Privacy Loskage
Prompt
Embesking
Large U-net
Lakent
Latent
Small
Image
ObCLIP
Better Privacy
Acceleration
Candishite
Oblivious
Procupts
Large Linet
Latent
Transform
Ruw Prompt
Small U-net
Local
Extraction
Image
Better Quality
Figure 2: Holistic comparison existing schemes.
4.1 Oblivious Cloud-Device Hybrid Image Generation
Before delving into the detailed design of ObCLIP, we first answer the two essential research questions.
EQQ 1: How decide the diffussion allocation strategy achieve better utility?
EQQ 2: How to hide the sensitive attributes in prompt from the server?
Diffusion Allocation Strategy. As an answer to RQ 1, we empirically investigate the impact of different allocation strategies, focusing on two key factors: 1) whether the initial denoising steps are performed by a large server-side model or small client-side model; and 2) the proportion of diffusion steps distributed between the server and the client. We employ a 25-step DPM-Solver 25 on the SD-v1 4 model and its compressed variant BK-SDM-Small [17]. evaluated on the MS-COCO dataset 23). We run both quantitative and qualitative analysis by varying server execution proportion. As shown in Figure 3al when server involvement is limited (0%~40%), allowing the server-side

---

18
Clian Fins
Server 9ime
Client-Only
Clicnt-Firt
Maje Exccution
17
F1D
Server Only
15
0.270 0.275
0280
0.285
0,290
0.295
0.300
CLIP Score
40%
60%
100%
(a) Quantitative quality from left to right, the server execution propor- tion starts from 0% to 100% with interval 20%.
For each line,
#Server Execution Proportion
(b) Qualitative quality visualization. Prompt man holding a camera up over his left shoulder."
Figure 3: Quantitative and qualitative comparison result of using different hybrid execution strategies.
model to handle the initial diffusion steps yields better quantitative performance (i.e., lower FID) compared to the client-first strategy (the performance gap is highlighted with red dashed line). This observation is consistent with the qualitative results in Figure (bb As revealed in (24). the initial steps-referre to as the semantics-plannine information. Consequently, server-guided semantics planning leads to better image quality. Based on these findings, we adopt the server-firs strategy in our approach. Besides, we also control the proportion of server-side execution using the hyper-parameter switch point k. which serves trade-off between utility and efficiency. As increases, the FID consistently decreases, albeit at the cost of higher server cost. More comprehensive evaluation provided in Section 5..2
stage-are crucial for determining global semantic
Oblivious Generation Scheme. Regarding RQ2, one straightforward solution replace the actual prompt (e.g.. "portrait of young African woman") to a random candidate prompt (e.g., "portrair of elderly Caucasian woman". semantically who sends back intermediate denoised latent. The client then use the actual prompt for remaining denoising steps, aiming to rectify the semantics deviation. We examine the impact of different denoising proportions where the initial steps conditioned on candidate prompt, and the remaining steps use the actual prompt as the text condition. We conduct the analysis using SDXL 34 model with 25-step only when the actual prompt governs more than 80% of the entire diffusion process. This observation suggests that initial steps critical for establishing semantic information, making it difficult to correct semantic deviations introduced early on. Hence, to enhance the text-image semantic alignment, propose the oblivious hybrid generation scheme, where the client transforms the actual prompt into a set of candidate prompts (including the actual prompt, security analysis in Section 4.3) serving as text conditions during the server-side guidance of intermediate latents. The intended intermediate latents are then retrieved by client for subsequent denoising. To construct the candidate prompt set P. identify sensitive attributes and traverses their value space the algorithm in Appendix B.
yet differ in sensitive attributes) to the server,
As illustrated in Figure 4 the intended semantics are accurately captured
Mccual Procapt Propection
50%
60%
100%
Timestep
Figure 4: Generated images from different prompt replacement configurations.
5

---

Notably, vanilla oblivious generation- -heree the server performs all the denoising and sends genera- tion images to -nent--ncuur an N increase in total computation cost (N ()). While partial denoising in ObCLIP effectively reduces server-side computation, the additional overhead introduced by redundant denoising of multiple candidate prompts remains non-negligible. To mitigate this, we introduce server-side acceleration techniques aimed at minimizing such overhead.
4.2 Server-side Acceleration
Conceptually, in ObCLIP, we optimize server-side generation efficiency from two perspectives: 1) Batch Redundancy: oblivious generation, a set of candidate prompts is processed, which differ only in the values of sensitive attributes while sharing most tokens, theoretically leading to similar global semantics, with minor changes on local details. 2) Temporal Redundancy: Due to the inherently sequential nature of the denoising process, intermediate features- such outputs from attention modules and down/mid across adjacent timesteps can be cached and reused. High-level overview of the acceleration scheme illustrated Figure
Server-side
Client-side
(1 Batch Redundancy
Atteation Cache
3 Block Skip
C
C2
Cache point
Skip points
Switch point A:
Figure 5: Server-side acceleration. The temporal- and batch- redundancy based caching are controlled by three hyper-parameters: cache point r, skip point 8 and switch point k.
4.2.1 Batch Redundancy
As empirically validated by the visualization of both cross-attention maps (Figure 6b) and self- attention maps (deferred Figure in Appendix [.I] that implicitly reflect semantic information for two candidate prompts by varying gender and age attributes, the global features like background, gesture, etc. are similar, while those sensitive attributes share similar focus areas. In this regard, we propose to reuse these attention maps across these candidate prompts. Specifically, we only compute the attention map for pivot prompt (with index i*, e.g., the first prompt with 1" 0), and reuse these attention maps before cache point to lower server-side attention computation follows:
q k, V = to._((i)"), to_v(V)
m get get_aattentin_mmp(("" kk)
(4)
= M ( < broadcast(m"))
(5)
In this case, the computation bottleneck of attention module (i.e., to_q. to_k, and Softmax in get_attention ommllonnmmppppmmal can be greatly reduced. The detailed algorithm is deferred to Appendix B.2
4.2.2 Temporal Redundancy
Attention Cache. We motivate this optimization by T-Gate 24). which observes that in the early phase (i.e., semantic-planning) conducted on the server side, self-attention makes limited contribu- tions. We thus bypass the self-attention computations in subsequent diffusion steps after certain initial steps (denoted as cache point r), making use of such temporal redundancy (24). Furthermore, we investigate the evolution of cosss-attention map differences across adjacent timesteps. As shown in Figure ba (top), these differences are substantial during the first 2~3 steps, but drop significantly and stabilize thereafter. In addition, the cross-attentis the distribution at the 3rd step is already similar to that at the 5th step. We thus propose to cache the cross-attention maps after cache point as well. Notably, we follow T-Gate to refresh the cache every 5 steps to prevent significant deviations. The attention module is computed as follows:
heatmap visualization in Figure 6bb shows that
Attnn K,
if or (t mod 5) 0
O, 10
(6)
0
if and (t mod 5)!

---

10A52
5A15
chor
her
WORKO
tnited
(a) Temporal difference. (b) Heatmap of cross-attention maps in two candidate prompts varying (gender, age). Figure 6: Temporal and batch redundancy analysis SD-v1.4 and SDXL models.
Block Skip. Previous observations 288 21 have revealed that features from the down-block and mid-block exhibit relatively subtle variations across adjacent timesteps, especially when compared to those from the subsequent up-blocks. As illustrated Figure 66 (bottom), the mid-block outputs show minimal changes during the denoising process-dropping significantly within the first 2~3 steps and stabilizing after approximately 20% total denoising steps. Motivated by this temporal feature similarity, propose to skip server-side computation of the down-block and mid-bloc' after a certain timestep (denoted as skip point s). We follow an intuitive way to select the skip point and defer the parameter configurations to Section The computation is formulated follows, where fmid denotes the cached output of mid-block and P refers to the set of candidate prompts.
(Downblock MidBlock o (xblock)(2211:P1) if < if tt2
2t =
(7)
(oblooc(21-111) P,t) t)
4.3 Security Analysis
In OPCLIP, the client C transforms the actual prompt p" into set of candidate prompts P, with [P] =N N. We consider the LLM inference service provider as the potential adversary A. We do not consider -i--tin-thhtidll attacks and assume the communication channel secure. assumed to be semi-honest, meaning the adversary follows the hybrid generation scheme, which is publicly known, but may attempt to extract sensitive information by collecting and analyzing the messages (i.e., P) from the client. Our scheme shows that A cannot distinguish the real prompt p" from N candidates with probability better than I/N + X, where À negligible given no information other than P. We defer the detailed proof of Theorem to Appendix C
Theorem 1 (Prompt ii-disiinuuishabilitt). The oblivious generation scheme is X-oblivious for any probabilistic polynomial (PPT) adversary A::
Pr[A((P = p')]
N S ISA
5 Experiments
5.1 Experiment Settings
Models. We consider several combinations for hybrid generation. We consider SD-v1.4 35 and its
compressed versions BK-SDM-small and BK- OK-SDM-tiny (I7). We also test finetuned Realistic Vision v4.0 [4)] and compressed small-sd model (39] For high-resolution setting, consider SDXL (34 and Koala-700m
18], along with the scalability to step-distilled server model LCM-SDXL (26].
Datasets & Metrics. To evaluate the performance of OPCLIP, we adopt two commonly-used datasets: 1) MS-COCO 2014 dataset (23] with resolution of 512 x 512. We use 30k prompts from its validation split. 2) MJHQ [19 with resolution of 1024 x 1024. For more comprehensive evaluation on oblivious generation, we construct a candidate prompt dataset using 10 templates, like "High- quality, face portrait photo of <age> <ethnicity> <gender>" with random fill on these sensitive attributes. The detailed construction provided in Appendix [B. Regarding image quality, we follow prior works to evaluate the visual quality using Frechet Inception Distance (FID) [2] and Inception
7

---

Score (IS) [37]. We assess text-image alignment using CLIP score [ with CLIP- g/14 model. Regarding efficiency. we use Floating- -pint Operations (FLOPs) and average running time.
Baselines. We compare OPCLIP with three lines of works: 1) Standalone Generation: The commonly used paradigm where cloud-only device-only generation is applied. This exhibits either high privacy risk and server cost or low utility; 2) Hybrid SD [44]: This is the first work that proposed cloud-device collaborative generation paradigm. 3) HE-Diffusion [3: Last, we compare with cryptographic approach HE-Diffusion in terms of efficiency. We take the runtime of the SD-v1.4 model as reported in their paper. We opt for 25-step DPM scheduler (8 (t-step for LCM-SDXL) for all evaluated works. For OPCLIP, we mainly adopt two acceleration configurations: 1) switch point k 5, cache point / 3 and skip point s = 3: cardinality of candidate prompt set, i.e., those edited prompts after oblivious transformation. To do so, we use rule-based method and finetuned distilbert model [5]] to detect sensitive attributes. We additionally evaluate vanilla oblivious generation (OG), where the cloud alone generates N images without any accelerations. All the experiments are conducted on one Ubuntu machine equipped with one Intel Xeon Platinum 8260 CPU, 16GB of RAM and I NVIDIA Tesla-V100-SXM2-2220 GPU.
10, r 4 and s 6. We use N to denote the
5.2 Quantitative Results
Results on Candidate Prompt Dataset. To begin, we experiments on Realistic Vision v4.0 and small-sd models on the candidate prompt dataset to evaluate oblivious generation. For gender alone, N = 2. While for multi-attribute combinations, i.c., gender and age, we have N = 2 x 6. We present the results for l-attribute and 2-attribute oblivious generation in Table 2 The results for 3-attribute are deferred to Appendix D.4 We here mainly focus on cloud-side latency. In general, OPCLIP shows better performance in the trade-off between generation performance and computation cost, offering flexibility through the acceleration strategies, e-g., In terms of generation performance, OFCLIP achieves comparable and even better FID and IS compared to Realistic Vision v4.0 when & 10 (e.g., FID drops from 113.39 to 109.76 when N 6). Even when we use a more aggressive A = 5, we still achieve comparable FID and IS while much lower latency (e.g.. FID increases from 113.39 to 113.92 with latency decreases from 1.12s to 0.98s). In terms of latency, compared to Hybrid SD, OPCLIP incurs about N x FLOPs due to the oblivious generation. However, with the cache and reuse accelerations enabled, the latency of OPCLIP is nearly reduced by 50%, which is comparable to Hybrid SD when N = 2 (e.g.. latency increases from 0.55s to 0.57s when = 10) and about 3x slower when N = 6. Given the strong privacy protection brought by OPCLIP, such computation cost is significantly reduced. Especially.ObCLIP is orders of magnitude faster than HE-Diffusion and about 4.4 ~ 7.6x faster than vanilla OG. The results validate the effectiveness of ObCLIP, which offers rigorous privacy and better generation performance (measured by FID and CLIP scores), with only a marginal increase in latency.
Table 2: Multi-Attribute OPCLIP on candidate prompt dataset. For FLOPPs we use a(+b), where a and b refer to cloud/device computations. For latency, only measure the cloud-side runtime.
1-Attribute (gender, N 2)
2-Attribute (gender age, N 6)
Generation Method
FID
1St
CLIP 1
FLOPS (T)
Latency (s)
FID 1
IS
CLIP
FLOPs
Latency (s)
Realistic v4.0
113.45
4.69
0.3322
18.53
113.39
0.3215
(805
small-sd
128.87
5.04
0,3051
(+11.20)
0.78
118.19
5.11
0,2980
(++11.20)
0.78
Vanilla
113.45
4.69
0.3322
37.06 (+0)
2.51
113.39
5.32
0.3215
111.18 (+0)
HE- HEE-Diffasion
>10
>00
Hybrid SD (k= = 10)
117.18
4.96
0.3215
7.41 (+6.54)
0.55
114.05
5.02
0.3226
7.41 (+6.54)
0.55
CSCLIP(K 10)
117.18
4.96
0.3215
14.82 (+6.54)
0.97
114.05
5.02
0.3226
44.46 (+6.54)
2.90
+ cache
118.59
4.99
0.3168
12.26 (+6.54)
0.62
115.65
5.02
0.3174
36.76 (+6.54)
1.85
reuse
114.26
4.82
0.3167
11.48 (46.54)
0.57
109.76
4.94
0.3152
33,28 (46.54)
1.55
Ilybrid SD (k = 5)
119.31
4.99
0.3107
3.71 (+8. (68.66)
0.28
116.15
5.05
0.3117
3.71 (+8.96)
0.28
USCLII(( 5)
119.31
4.99
0.3107
7.41 (48.66)
0.49
116.15
5.05
0.3117
22.23 (+8.96)
1.48
+ cache
120.44
4.88
0.3079
6.13 (+8.96)
0.38
117.29
5.00
0.3091
18.38 (+8.96)
1.12
118.36
4.98
0.3077
5.74 (48.916)
0.33
113.92
4.87
0.3076
16.64 (48.96)
0.98
Results on Real-world Datasets. Table and Table (upper part) present the results for MS-COCO and MJHQ datasets. For numbers marked with the total FLOPSs should be multiplied by N. Compared to distilled models, OPCLIP considerably reduces FL.OPs while achieving better image fidelity and stronger semantic alignment between image and prompt across various configurations. When compared to base models, OPCLIP offers substantial FLOPs reduction at the cost of slightly
8

---

higher FID. For instance, on SD and RK-SSD--smaa small models, the FID of OPCLIP (k = 10, with cache) increases from 13.86 to 15.73 with a reduction of FLOPs from 18.53T T. Similarly, on SDXI, and Koala-700m models, ObCLIP (k = 10, with cache) achieves a FII of 30.79, which is comparable to SDXL's 30.67, while reducing the FL.Pss from 159.35T to 45 - even lower when N < 4. The trade-off between performance and latency can also be controlled via k: a larger k yields better image fidelity at the expense of higher FLOPs.
Table SD-v1.4 and BK-SBM- (smal, tiny) on 30k MS-COCO dataset.
Table 4: (SDXL, LCM-SDXL) and Koala-700m
on 5k MJHQ dataset. At denotes timestep shift.
Generation Method
FID L
1
CLIP f
FLOPs (T)
Generation Method
FID 1
1S
CLIP
FLOPs (T)
SD-v1.4
13.86
37,75
0,3015
18.53
SDXL
30.67
26.31
0,3464
159.35
BK-SDM-small
18.30
31.73
0,2710
10.90
koala- 700m
36.11
22.06
0.3263
58.85
OPCLIP(K 10)
15.65
36.72
0,2946
7.41"
OPCLIP = 10)
31.92
24.56
0.3389
63.74"
cache
15.73
33.62
0,2865
5.84
cache
30.79
24.52
0.3320
45.11"
(bC 5)
16.55
33.95
0.2839
3.71
ObCLIP(K 5]
32.42
23.70
0.3337
31.87"
cache
16.45
33.
0,2833
3.06
31.97
23.61
0.3317
24.41"
BK-SDM-tiny
18.30
29.94
0.2681
10.25
LCM-SDXL
33.25
28.22
0.3296
50.99
OPCLIP(k (k 10)
15.86
35.54
0.2936
7.41"
DPCLIP (k=4,At=8)
33.92
27.55
0.3315
55.50"
cache
16.44
32.80
0,2887
5.84"
OPCLIP(A 5)
16.87
32.73
0,2812
3.71
cache (25t
cache (71t = 10)
45.51
34.12
22.64
27.15
0.3293
0.3311
caclle
17.14
31.84
0,2854
cache (Ait = 4)
39.07
22.73
0,3166
21.78'
cache (Ar
51.85
16.94
0.2936
Scalability to Distilled Models. We hereby further explore the scalability of OPCLIP to step-distilled cloud models. Note that the LCM-SDXL uses 8-step scheduler, while Koala-700m uses standard 25-step scheduler. We adopt = 4, r = 2 for acceleration. Besides, to align the denoising timesteps between cloud and device, we propose to apply timestep shift as deevice = Latond + A. A smaller or larger At introduces incompatible denoising scales. As depicted in the bottom of Table 4 At 8 yields the best performance (marked in gray). We provide visual examples in Appendix D.7 Compared to the standalone LCM-SDXL, OPCLIP (without cache) achieves a 0.67 drop in FID, a slightly better CLIP score, and reduces FLOPs from 50.99 to 25.50". With cache enabled, the FLOPs are further reduced by approximately 15 15%, with only marginal FID drop of 0.2.
Additional Overhead. In OPCLIP, we introduce two additional operations: 1) device-side oblivious transformation; 2) cloud-to-device latent transmission. The runtime for detecting sensitive attributes using the fine-tuned DistilBERT model on single V100 GPU is about 6.37ms. According to the report the latency on iPhone 13 Pro is below 10ms. For cloud-to-device transmission, the noise latent is sized at 4 X res x res X N. Taking SD-v1.4 as example, where res- 64. the total data in FP16 precision is ~ 32N KB. Considering the average WiFi bandwidth of 18. 18.88Mbps [14,, the total transmission time is around 0.013NN seconds. Even for N = 30, the transmission time is approximately 0.39 seconds, demonstrating an acceptable overhead. We note that private information retrieval (PIR) 11 2 can also be employed for this transmission, achieving a communication size of Olog² 2 N) or ((VN), albeit at the expense of O(N) server computation. This approach may be preferable when the bandwidth is limited. Due to page limitation, we provide a more comprehensive efficiency evaluation and detailed efficiency improvement breakdown in Appendix
5.3 Qualitative Results
Effect of k. Figure and Figure sho the samples generated using base models and OPCLIP (with cache) with different k. One observation is that with the guidance of large cloud models, OPCLIP achieves better semantic alignment and finer local details. For example, Koala-700m mistakenly generates a girl for the second prompt, while small-sd generates three overlapping teddy bears. Besides, a larger i exhibits better visual quality- to that of large cloud models-which is consistent with our previous quantitative findings.
and
Effect of batch reuse. Furthermore, we present the samples generated with different acceleration strategies in Figure g Specifically, the reuse across different gender, age, and ethnicity attributes results in strong semantic alignment, even when the attributes are contradictory (e.g.. from female to male). Global structural information unrelated to the sensitive attributes- as hairstyle and ges- ture are well preserved, while the transformation to the target attribute effectively accomplished.
httpp::/mmachinneeeammiii apple. www/ressearch/neuraaaeae engine- -tr.ineeerrrsffomrrs

---

SOXL
DICL
OICTIPLA
Keaks Na
Raakey mestime
(a) Results on Realistic Vision v4.0 and small-sd. Figure 7: Images generated by cloud (left), device (right) and OPCLIP (middle) with different k.
(b) Results on SDXL and Koala-700m
For instance, reusing associaaee attention maps in male image generation yields a male with long hair, illustrating both structural consistency and effective attribute modification.
moke Chrmaic
(a) SD-v1.4 4.4 and BK-SDM-small
(b) SDXL. and Koala- 700m
Figure 8: Qualitative visual results when using different server-side acceleration strategies.
6 Conclusion
In this paper, we propose an oblivious cloud-device hybrid image generation scheme, acting as a hlug-and-play safeguard to ML inference services, provide rigorous prompt privacy, with better utility against on-device generation and only slightly increased server computation cost. Extensive experiments across multiple datasets demonstrate that OPCLIP provides comparable utility to cloud models with slightly increased server cost compared to non-private haselines.
I Limitations. Despite the significant efficiency improvement over private baselines, limitation lies in the inherent nature of oblivious generation, which leads to a sub-linear increase in computation relative to the number of candidate prompts. A potential mitigation is to achieve statistical indistinguishability. thereby reducing the effective size of candidate prompts. This can be achieved by differential privacy- based top-k selection of these candidate prompts. By choosing appropriate privacy budget, achieve measurable privacy, while providing much better efficiency. In the future, we also plan to image generation domain, where inputs include not only text prompts but also real reference images- such as human faces- that carry more sensitive information.
extend our approach to the image-to -taage-t--mmaee
References
[1] Sebastian Angel, Hao Chen, Kim Laine, and Srinath T. V. Setty. PIR with compressed queries and amortized query processing. In 2018 IEEE Symposium on Security and Privucy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA, pages 962-979. IEEE Computer Society, 2018
10

---

[2] Yogesh Balaji, Seungjun Nah, Xun Huang, Arash Vahdat, Jiaming Song, Karsten Kreis, Mika Aittala, Timo Aila, Samuli Laine, Bryan Catanzaro, Tero Karras, and Ming- Yu Liu. ediff-i: Text-to-image diffusion models with an ensemble of expert denoisers. CoRR, abs/2211.011 1.01224, 2022.
[3] Yaojian Chen and Qiben Yan. crivacy-preservee diffusion model using homomorphic encryp- tion. CoRR, 0bs/22433005794, 2024.
[4] Chun Jie Chong, Chenxi Hou, Zhihao Zephyr Yao, and Seyed Mohammadjavad Seyed Talebi. Casper: Prompt sanitization for protecting user privacy in web-based large language models. CoRR, abs/2408.0700d 2024.
[5] Zhang Collin, Morris John, X., and Shmatikov Vitaly. Universal zero-shot embedding inversion. arXiv preprint (0X.i::5544.0114400 2025.
[6] Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Chen. PUMA: secure inference of llama-7b in five minutes. CoRR, abs/2307.12533. 2023.
[7] Cynthia Dwork. Differential privacy. In Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener, editors, Automata, Languages and Programming, pages 1-12, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg.
[8] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion English, Kyle Lacey, Alex Goodwin, Yannik Marek, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthesis, 2024.
[9] Gongfan Fang. Xinyin Ma, and Xinchao Wang. Structural pruning for diffusion models. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurlPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023.
[10] Yu Gao, Lixue Gong, Qiushan Guo, Xiaoxia Hou, Zhichao Lai, Fanshi Li, Liang Li, Xiaochen Lian, Chao Liao, Liyang Liu, Wei Liu, Yichun Shi, Shiqi Sun, Yu Tian, Zhi Tian, Peng Wang, Rui Wang, Xuanda Wang, Xun Wang, Ye Wang. Guofeng Wu, Jie Wu, Xin Xia, Xuefeng Xiao, Zhonghua Zhai, Xinyu Zhang, Qi Zhang, Yuwei Zhang, Shijia Zhao, Jianchao Yang, and Weilin Huang. Seedream 3.0 technical report, 2025.
[11] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: a reference-free evaluation metric for image captioning. In EMNLP, 2021.
[12] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to local nash equilibrium. In Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vish- wanathan, and Roman Garnett, editors, Advances in Neural Information Processing Systems 30: Annual Conference Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pages 6626-6637, 2017.
[13] Jonathan Ho. Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Atoii-Florina Balcan, and Hsuan-Tier Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virfual, 2020.
[14] Chuang Hu, Wei Bao, Dan Wang, and Fengming Liu. Dynamic adaptive DNN surgery for inference acceleration on the edge. In 2019 IEEE Conference on Computer Communications, INFOCOM 2019, Paris, France, April 29 May 2, 2019, pages 1423 1431. IEEE, 2019.
[15] Isotonic. Distilbert fine-tuned for ai4privacy task. 2025.
[16] Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. CoRR, abs/2001.0836.1 2020.

---

[17] Bo-Kyeong Kim, Hyoung-Ky Song. Thibault Castells, and Shinkook Choi. BK-SDM: A lightweight, fast, and cheap version of stable diffusion. In Ales Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors, Computer Vision ECCV 2024 18th European Conference, Milan, Italy, September 29-October 2024, Proceedings, Part LIV, volume 15112 of Lecture Notes in Computer Science, pages 381-399. Springer, 2024.
[18] Youngwan Lee, Kwanyong Park, Yoorhim Cho, Yong-Ju Lee, and Sung Ju Hwang. KOALA:
empirical lessons toward memory-cfficient and fast diffusiin models for text-to-image synthesis. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Urrich Paquet, Jakub M. Tomezak, and Cheng Zhang, editors, Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurlPS 2024, Vancouver. BC, Canada, December 10 15, 2024, 2024.
[19] Daiqing Li, Aleks Kamko, Ali Sabet, Ehsan Akhgari, Linmiao Xu, and Suhail Doshi. Playground v2.
[20] Hao Li, Yang Zou, Ying Wang. Orchid Majumder, Yusheng Xie, R. Manmatha, Ashwin Swaminathan, Zhuowen Tu, Stefano Ermon, and Stefano Soatto. On the scalability of diffusion- based rext-to-imag' generation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pages 9400-940000 IEEE, 2024.
[21] Senmao Li, Taihang Hu, Joost van de Weijer, Fahad Shahbaz Khan, Tao Liu, Linxuan Li, Shiqi Yang, Yaxing Wang, Ming-Ming Cheng, and Jian Yang. Faster diffusion: Rethinking the role of the encoder for diffusion model inference. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tomezak, and Cheng Zhang, editors, Advances in Neural Information Processing Systems 38: Annual Conference Neural Information Processing Systems 2024, NeurlPS 2024, Vancouver, BC, Canada, December 10 15, 2024, 2024.
[22] Yanyu Li, Huan Wang, Qing Jin, Ju Hu, Pavlo Chemerys, Yun Fu, Yanzhi Wang, Sergey Tulyakov, and Jian Ren. Snapfusion: Text-to-image diffusion model mobile devices within two seconds. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NewrlPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023.
[23] Tsung- Yi Lin, Michael Maire, Serge J. Belongie. James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zimickk Microsoft COCO: common objects in context. David J. Fleet, Tomás Pajdla, Bernt Schiele, and Tinne Tuytelaars, editors, Computer Vision ECCV 2014 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V, volume 8693 of Lecture Notes in Computer Science, pages 740-755. Springer, 2014.
[24] Haozhe Liu, Wentian Zhang, Jinheng Xie, Francesco Faccio, Mengmeng Xu, Tao Xiang, Mike Zheng Shou, Juan-Manuel Perez-Rua, and Jürgen Schmidhuber. Faster diffusion via temporal attention decomposition. Transactions on Machine Learning Research, 2025.
[25] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solvert+: Fast solver for guided sampling of diffusion probabilistic models. CoRR, abs/2211.01095,, 2022.
[26] Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent consistency models: Synthesizing high-resolution images with few-step inference. CoRR, abs/2310.04374 2023.
[27] Junming Ma. Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang. Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. Secretflo--spu: A performant and user-fri framework for perracc-reeeevingg machine learning. In Julia Lawall and Dan Williams, editors, Proceedings of the 2023 USENIX Annual Technical Conference. USENIX ATC 2023, Boston, MA, USA. July 10-12, 2023, pages 17-33. USENIX Association, 2023.
[28] Xinyin Ma, Gongfan Fang, and Xinchao Wang. Deepcache: Accelerating diffusion models for free. In IEEF/CV Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22 2024, pages 15762-15772. IEEE, 2024.
12

---

[29] Samir Jordan Menon and David J. Wu. YPI:: high-throughput single-server PIR with silent pre- processing. In Davide Balzarotti and Wenyuan Xu, editors. 33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024. USENIX Association, 2024.
[30] MidJoumey. Midjoumey, 2025. Accessed: 2025-03-31.
[31] John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander M. Rush. Text embeddings reveal (almost) as much as text. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, EMNLP 2023, Singapore, December 6-10, 2023, pages 12448-12460, Association for Computational Linguistics, 2023.
[32] OpenAl. Dall-e: Creating images from text, 2025. Accessed: 2025-03-31.
[33] Xudong Pan, Mi Zhang. Shouling Ji, and Min Yang. Privacy risks of general-purpose language models. In 2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18-21, 2020, pages 1314-1331. IEEE, 2020.
[34] Dustin Podell. Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: improving latent diffusion models for high high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.nng 2024.
[35] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pages 10674-10685. IEEE, 2022.
[36] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Nassir Navab, Joachim Hornegeer, William M. Wells III, and Alejandro F. Frangi, editors, Medical Image Computing and Computer-Assisted Intervention MICCAI 2015 18th International Conference Munich, Germany, October 5 9, 2015, Proceedings, Part III, volume 9351 of Lecture Notes in Computer Science, pages 234-241. Springer, 2015.
[37] Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Gameett editors, Advances in Neural Information Process- ing Systems 29: Annual Conference on Neural Information Processing Systems 2016, December 5-10, 2016, Barcelona, Spain, pages 2226-2234, 2016.
[38] Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022.
[39] Segmind. Small-sd: A distilled stable diffusion model. https: httpss//huggingfaccc..///aao sdl 2023. Accessed: 6025-04-16.
[40] SG161222. Realistic vision v4.0 (novae). https: hctp::/huugingfacecco// Realistic_ Sitpiiiiiiioooovn__oooo 04. VOVVEE 2023. Accessed: 2025-04-14.
[41] Haoqi Wu, Wei Dai, Li Wang, and Qiang Yan. Cape: Context-aware prompt perturbation mechanism with differential privacy. CoRR, abs/2505.055 05922, 2025.
[42] Haoqi Wu, Wenjing Fang, Yancheng Zheng, Junming Ma, Jin Tan, and Lei Wang. Ditto: Quantization-aware secure inference of transformers upon MPC. In Forty-first International Conference on Machine Learning, ICML. 2024, Vienna, Austria, July 2 21-27, 2024. OpenRe- view.net, 2024.
[43] Chejian Xu, Jiawei Zhang, Zhaorun Chen, Chulin Xie, Mintong Kang, Zhuowen Yuan, Zidi Xiong, Chenhui Zhang, Lingzhi Yuan, Yi Zeng, Peiyang Xu, Chengquan Guo, Andy Zhou, Jeffrey Ziwei Tan, Zhun Wang, Alexander Xiong, Xuandong Zhao, Yu Gai, Francesco Pinto, Yujin Potter, Zhen Xiang, Zinan Lin, Dan Hendrycks, Dawn Song, and Bo Li. Mmdr: Decoding the trustworthiness and safety of multimodal foundation models. In ICLR 2025, February 2025.
13

---

[44] Chenqian Yan, Songwei Liu, Hongjian Liu, Xurui Peng, Xiaojian Wang, Fangming Chen, Lean Fu, and Xing Mei. Hybrid SD: edge-cloud collaborative inference for stable diffusion models. CoRR, has/2408.06644 2024.
[45] Xingyi Yang, Daquan Zhou, Jiashi Feng, and Xinchao Wang. Diffusion probabilistic model made slim. IEEE/CVE Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pages 22552 22562.. IEEE, 2023.
[46] Xiang Yue, Minxin Du, Tianhao Wang, Yaliang Li, Huan Sun, and Sherman S. M. Chow. Differential privacy for text analytics via natural text sanitization. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli, editors, Findings of the Association for Computational Linguistics: ACI/IJCNLP 2021, Online Event, August 1-6, 2021, volume ACL/UCNNPP 2021 of Findings of ACI, pages 3853-3866. Association for Computational Linguistics, 2021.
[47] Wenxuan Zeng. Meng Li, Wenjie Xiong, Tong Tong, Wen-Jie Lu, Jin Tan, Runsheng Wang, and Ru Huang. Mpevit: Searching for accurate and efficient mpc- -rienfrienll vision transformer with heterogeneous attention. In IEEE/CVE International Conference on Computer Vision, ICCV 2023, Puris, France, October 1-6, 2023, pages 5029-5044 IEEE, 2023.
[48] Qingjie Zhang, Han Qiu, Di Wang, Yiming Li, Tianwei Zhang, Wenyu Zhu, Haiqin Weng, Liu Yan, and Chao Zhang. A benchmark for semantic sensitive information in LLMs outputs. In The Thirteenth International Conference on Learning Representations, 2025.
[49] Yang Zhao, Yanwu Xu, Zhisheng Xiao, Haolin Jía, and Tingbo Hou. Mobilediffusion: Instant text-to-image generation on mobile devices. In Ales Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Güi Varol, editors, Computer Vision ECCV 2024 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXII, volume 15120 120 of Lecture Notes in Computer Science, pages 225-242. Springer, 2024.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We provide detailed application scenario and main contributions in the abstract
and Section |
The experiments in Section 5 also exhibit the effectiveness of our work.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the primary limitations of this work in Section 6
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

Justification: We provide a detailed security analysis in Section 4.3 and proof in the Ap- pendix C
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
The experiments are conducted on open-source models and three datasets two of which are publicly available, and one is synthetic dataset, with detailed construction described in Appendix B.3 The full experimental configurations are provided in Section 5.1
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
16

---

reproducible, they Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: We do not have the time to refactor the code, which is of poor readability. We promise to open-source the code reproduce the experimental results on GitHub once accepted.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//abps.cc/public/uuiide
sssssssssiiyyyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permirted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We follow the standard method of prior work we have mentioned in Section
5.1
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We conduct the experiments many times and report average results. In Figure we show the one standard deviation as a shaded region.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We mention that run the experiments on NVIDIA V100 GPU. The specific configurations are included in the Section 5.1
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't itdn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We follow the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss the potential positive societal impacts of using ObCLIP for protect- ing the prompt privacy in the Introduction Section More detailed elaboration is provided in Appendix A
Guidelines:
18

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g.. gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The answer NA means that the paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We cite the original paper that produced the code, dataset and models.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: This paper does involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification:
We only use the LLM for paper writing, editing, or formatting purposes.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy battps://neurrs /0tps///eccccooeeeeee//2/2////// for what should or should be described.
21

---

A Broad Impacts
This paper presents work whose goal is advance the field of Machine Learning. Our work aims to address critical privacy concerns surrounding user prompts widely adopted stable diffusion based text-to-image generation services. To safeguard sensitive
information during inference, we propose an oblivious cloud-device hybrid image generation scheme, acting as plug-and-play safeguard ML inference services, provide rigorous prompt privacy. We also acknowledge the redundant computational overhead introduced by generating intermediate latents for all candidate prompts in oblivious generation. Beyond our proposed acceleration strategies, further improvements could be achieved by constraining the sampling space of candidate prompts. Ultimately, this reflects fundamental trade-off between privacy and efficiency, These advancements have the potential to make private LLM inference more practical and scalable for real-world applications.
B
Implementation Details
B.1 Oblivious Cloud-Device Hybrid Generation Algorithm
The detailed design is presented in Algorithm [ enumerating all possible combinations by traversing every value of each attribute F, Foccur where
Note that in line 2, all_combination refers to
F2 = ( fg).
Algorithm I: Oblivious Hybrid Generation
Input: User prompt p = { [W1,... Wi...., Wn), w; corresponds to some sensitive attribute
with value space of size q as F; (Ji,..., ..., fq). client-side small diffusion model Mc and a small language model MLM, server-side large model Ms. denoising steps 7 -1r- (o), switch point k. random latent 2T NO I),
F; E , F..
VAE decoder (-))
Output: Generated image y
/* Oblivious Transform: construct candidate prompts based on occur MLM(P), with F; Foccur (fg
p + del__ccominaaiiomp...
2T repeat(2r: N), with N [P]
/* Run initial h steps on cloud-side
for / E T(:
2 Ms(
/* Extraction: - are sent to device, who chooses the actual latent
2T-k
2T-A = -T Py E P and Pj p
/+ Run remaining T steps on device-sion side
for t Tik: : do
L 2:-1 Mc( y D(z0) 10 return
B.2 Batch Reuse Algorithm
In this section, we provide the batch-reuse in attention modules in Algorithm 2
B.3 Candidate Prompt Dataset Construction
template:
"hesdshota portreit
$age Sethnicity $gender covered religious tattoog." "$age Sethnicity $gender in hat Fashion portrait photo"
field, Outdoor portrait photo" *$age red haired Sgender Sathnicity urban portrait photo"
"Smiling Sage Sethnicity Sgander sitting
"Faceshot Portrait of pretty Sage fethnicity 8gender vearing high neck exeater" $age Sethnicity Sgender, vearing rugged leather jacket, with a five o'ccock shadox and prominent laugh lines around his eyes, captured in soft, golden lighting."
Closeup portrait photo
22

---

Algorithm 2: Batch-reused Attention Module
Input:
Hidden states Q = { Encoder hidden states IC = {ki) V = {u: for
candidate prompts, Pivot sample index 1" for pivot prompt p
Output: Attention outputs O {o:
/* Compute query q", key ks for pivot prompt p (e.g., 1" 0)
to_q(
k* to (t
/* Compute attention map for pivot prompt
m att.aatttiioomaa((""""
/* Compute value v for all candidate prompts
V to_v(V)
/* Compute attention outputs for all candidate prompts
M broadcast(m",
O = M
7 return
"RAM photo, (closeup:1. :1.0) 22,), portrait of a Bage Bethnicity Egander, zearing mininal serene expression garden, illuminated by gentle dappled sunlight." portrait photo revealing the fine lines and character on the forehead."
nakeup, , shoxcaeing the freckles,
lush botanical
"Bigh Brigh--uaaity-
$age Setbnicity $gender, vearing glasses,
"BAK photo of a $age Sethnicity $gender, shot from the side, highlighting elegant cheeks."
profile and the delicate lines etched
"High "High-quality, closeup portrait photo of $age Sethnicity $gender, vearing traditionsl clothing."
age:
young aiddle-aged
old gender:
male
female
othnicity:
caucasian
african
asian
indian
auropean
Listing 1: Prompt templates and sensitive attributes taxonomy.
We list the templates used in constructing a small prompt dataset, tailored for candidate prompts, with replacement on sensitive attributes age, gender and ethnicity. We consider age E [young, middle-aged, old), gender E (male, female) ) and ethnicity E [caucasian, african, asian, indian, european).
C Security Analysis
Proof of Theorem] 7 Consider a user prompt p. We obtain its candidate prompts as P candidate_ petiddatteppomppppppp by traversing the entire value space for each sensitive attribute in p. Then, we randomly select another sensitive prompt p' P. Since we traverse the sensitive attributes get sandidaaee_proppteee
P. have P candidate_promper
That is,
View(p) View(p').
We thus have, for any two sensitive prompts p' E P. the server's observable view is identically distributed. That efficient adversary can guess the correct p with significantly better probability than random guessing (L/N) as:
Pr[A(P- = N S
where À is negligible. The proof shows that the server learns nothing about the true input beyond what is leaked by the candidate prompts (i.e., the value space for sensitive attributes) and those non-sensitive tokens, which are independent of the specific sensitive tokens.
D
23

---

D Additional Experiments
D.1 Self-Attention Visualization
Figure The top components obtained using SVD of self-attention maps for two candidate prompts.
Figure 9 illustrates the self-attention maps for two candidate prompts by varying gender and age attributes. Specifically, from "An elderly woman with short hair, wearing knitted sweater, sitting in rocking chair." to "A young man with short hair, wearing knitted sweater, sitting in rocking chair.". We capture the self-attention maps in middle layers and run SVD obtain the top components.
D.2 Model Statistics
presents the quantitative statistics for standalone cloud and device models, including utility scores, parameter size and FLOPs consumption. We adopt 25-step DPM scheduler for all these models by default. For LCM-SDXL,, we use 8-step LCC scheduler instead. The FLOPs and latency measured for batch size of 4. We run each experiment ten times and report the average results.
Table 5: Model statistics. By default, use 25-step DPM scheduler. B = 4.
Generation Method
FID
f
CLIP
#Params (M)
FLOPs (T)
Latency
MS-COCO
SD-v1.4
13.86
37.75
0.3015
859.40
74.10
5.01
BK-SDM-small
18.30
31.73
0.2710
482.28
43.60
3.01
BK-SDM-tin
18.30
29.94
0.2681
323.34
41.00
2.87
Realistic Vision v4.0
16.21
37.39
0.3033
859.40
74.10
4.42
small-sd
14.59
35.06
0.3046
579.30
44.80
2.96
MJHQ
SDXL
30.67
26.31
0.3464
2562.13
637.40
29.33
koala-700m
34.11
22.06
0.3263
2562.13
235.40
12.00
LCM-SDXL (8-step)
33.25
28.22
0.3296
777.53
203.97
8.35
D.3 Visualization of Hybrid Generation
In this section, we provide the visualization of generated images for large server model (top), and OPCLIP with/without server-side acceleration (middle and bottom) in Figure used prompt "Faceshot Portrait of pretty young (18-yeur-old) female Caucasian wearing a high neck sweater". We mark the two images with an optimal balance between image quality and server computation cost, i.e., when & E (5. 10). The better semantic from large server model are well preserved with minimal server denoising cost.
Tigure[ooanne an Figure []] The

---

SD+1.4
(KC
cache)
2
5
== 10
à 15
k 20
x 24
Figure 10: Visualization of SD-v1.4 RK-SDM-small
Realistic Visim, V1.0
OSCLIP (R)
O&CT eache)
k=1
== 2
5
A= 10
Am 15
20
A 24
Figure 11: Visualization of Realisti-
Realisti-Vision Vision- V4.0 small-sd
D.4 3-Attribute Oblivious Hybrid Generation
The detailed utility scores for 3-attribute oblivious hybrid image generation presented in Table Compared to the large server-side model, there is only marginal drop in image quality and text-image alignment, while achieving significantly better utility than the on-device small model.
Table 6: Evaluation results for 3-attribute oblivious generation.
Generation Method
FID
IS f
CLIP
Realistic
111.87
4.78
0.3322
small-sd
115.96
5.02
0.3034
Vanilla OG (Realistic)
111.87
4.78
0.3322
OG (k 10)
112.75
5.04
0.3214
OG 10) w cache
113.31
5.03
0.3171
OG (k 10) cache reuse
110.22
4.62
0.3138
OG (k 5)
113.57
5.02
0.3108
OG (k 5) (w cache)
114.07
5.04
0.3083
OG cache) + reuse
113.30
4.66
0.3077
D.5 Comprehensive Efficiency Evaluation
We here present more comprehensive efficiency evaluation across different candidate prompt size N to validate the effectiveness of OPCLIP. As shown in Table ? in most cases, OPCLIP achieves server-side efficiency comparable to that server-only image generation on both SD-v 1..4 1.4 and SDXL models. When accounting for device-side computation, the total latency remains of the same order of magnitude the baseline. These results demonstrate the superior performance OPCLIP, which offers rigorous privacy with only slight increase in overall computation cost.
25

---

Table 7: Comprehensive efficiency evaluation.
FLOPs
Latency
Generation Method
k
10
k
4 N = N W N
= 6
N
4
N
N
SD
(SD-v1.4 + BK SDM-smll))))
SD-v1.4
18.53
1,28
Non-Private
Hybrid SD
3.71
7.41
0.30
0.51
HE-Diffusion
106
Vanilla
74.10
111.15
74.10
111.15
5.01
7.47
ObCLIP
14.82
22.23
29.64
44.46
1.11
1.48
1.93
2,90
Private
cache
12.25
18.38
23.36
35.04
0.67
1.12
1.33
1.85
reuse
11.13
16.64
21.86
32.72
0.61
0.98
1.12
1.55
Total ( device)
19.85
25.36
28.40
39.26
1.25
1.62
1.65
2.08
SDXL (SDXL koala-700m)
SDXL,
159.35
7.45
Non-Private
Hybrid
31.87
63.74
1.45
2.84
Vanilla OG
637.40
956.10
637.40
956.
29.33
43.16
29.33
43.16
ObCLIP
127.48
191.22
382.44
5.92
11.35
16,90
Private
cache
97.62
146.44
180.42
270.62
4.08
6.81
7.98
11.28
86.32
128.38
165.34
246.55
3.51
5.05
6.81
9.92
Total
device)
133.40
175.46
200.65
281.86
6.07
7.61
8.88
11.99
D.6
Efficiency Improvement Breakdown
Take SD-v1.4 and BK-SDM-small hybrid generation with switch point k: 10, cache point skip point = 6 as an example. We illustrate the per-step FLOPs server-side denoising in Figure T2 where the reduced computation FLOPs highlighted in yellow. Prior the cache point, only batch reuse of attention maps is enabled, resulting in a reduction of approximately 10%. Subsequently, with the addition of temporal attention reuse and block skipping, reductions of about 20% and nearly 50% are achieved, demonstrating the effectiveness of the overall acceleration strategy.
Eache point
Skip point
switch point
2.5
Per-step TLOPs
2.0
1.5
1.0-
Original
0.5
ObCLIP (Optimized)
T T T 4
T 6 T
T 9
Different Server Timesteps
Figure 12: Per-step FLOPSs (T) for SD-v1.4 with = 10, r = 4, = 6.
D.7 Visualization of Step-distilled Model Generation
In this section, we present visualizations of images generated with the server-side LCM-SDXL (optimized using step distillation) and client-side Koala-700m models. Note that we use an 8-step LCM scheduler for LCM-SDXL. and a 25-step DPM scheduler for Koala-700m. Recall that as we apply a timestep shift AV to align the timesteps between cloud and device as Latevice = Lelond + At. We here vary At E (0, 6, 8). The input prompt "Faceshot Portrait of pretty young (18 (18-ycar-old) male African with black hair." To demonstrate the effect of
mentioned in Section 5.2
26

---

batch reuse, we choose candidate prompt: "Faceshot Portrait of pretty young (18 (18-year-old) male Caucasian with black hair." As shown in Figure [3] the final generated images show poor fidelity when A < 6, with A = 8 yielding the best visual quality. Additionally, the text-image semantics are well aligned.
Faceshot Pormal ofprrty young (1fegaamaid) male (Cancasion, Aftican web black hoi
OSCLIP
C Reuse
Cache
Timestope - 1960, 870, 159, 638 199 370, 359 174]
Koala-700m
0C Switch point
Thewrrse
115,77,
Figure 13: Visualization of LCM-SDXL Koala-700m.
27


Reviews:
[{"review_id": "GPExvTCqVP", "reviewer": "Reviewer_YVsw", "summary": "This paper introduces a novel cloud-device collaborative framework for image generation. By splitting the diffusion process between the device and the cloud, the framework enhances prompt privacy while reducing server-side costs. To further protect private prompts, the paper proposes an oblivious prompt transformation and a local feature extraction strategy. Additionally, two acceleration techniques are developed to reduce computational overhead.", "questions": "Please address the identified weaknesses. Additionally, I have the following questions:\n\n1. How is the diffusion process divided between the device and the cloud in general scenarios? A more detailed explanation should be supplemented.\n2. How many devices were used in the experiments? Does the distribution of client data have a significant impact on performance?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\nS1: The paper presents a novel and well-motivated cloud-device collaborative framework for image generation, which effectively protects prompt privacy and reduces computational costs.\n\nS2: The paper is well organized and clearly written, making it easy to follow.\n\nS3: Experimental results demonstrate both the effectiveness and efficiency of the proposed method.\n\nWeaknesses:\n\nW1: The privacy guarantee heavily depends on the completeness of candidate prompt enumeration. In scenarios involving high-dimensional sensitive attributes, the exponential growth of the candidate set may either weaken privacy protection or lead to significant computational overhead, resulting in a fundamental trade-off that is difficult to resolve.\n\nW2: Some important implementation details are missing. For instance, it remains unclear how the oblivious prompt transformation can be applied in general scenarios. The paper only provides dataset-specific implementations in the experimental section, without offering broader methodological guidance.", "was_revised": true, "final_justification": "The rebuttal has helped resolve most of the issues I raised. I will maintain my \"borderline accept\" rating.", "rebuttal": "We thank the reviewer YVsw for the positive feedback on \"presents a novel and well-motivated cloud-device collaborative framework\" and quite insightful reviews, which is quite encouraging for us. We hereby answer the specific questions below and hope the explanations resolve your concerns.\n\n> Q1: Trade-off for large candidate prompt set \n\nThanks for your clear understanding of our proposal. We briefly discuss such efficiency limitation in the Conclusion section. The computation cost indeed grows with the candidate prompt set size $N$.\nTo handle large $N$ case, we propose to use a subset of candidate prompts (of cardinality $N'$, with $N' < N$) to greatly lower the computation cost. This can be achieved by differential privacy-based top-$N'$ selection. By choosing appropriate privacy budget $\\epsilon$, we can achieve measurable privacy, guaranteed by differential privacy theory, while providing a much better efficiency. Such optimization is orthogonal to the method in this paper and we leave it as future work.\n\n\n> Q2: Extension of oblivious prompt transformation to general scenarios\n\nWe clarify that the oblivious transformation can be seamlessly extended to general scenarios. This transformation basically involves two steps: (i) detecting private tokens, and (ii) constructing the corresponding candidate set. For general applications, only the first step requires adaptation, as the definition of privacy is highly context-dependent. For instance, in location- or occupation-sensitive scenarios, one can employ regex-based rules or NER models to identify such tokens. The subsequent transformation process remains unchanged. We will include the discussion of this extension to general scenarios in the final version to enhance clarity.  \n\n> Q3: Detailed diffusion process between the device and the cloud in general scenarios\n\nWe define switch point $k$ to divide the denoising steps between the cloud and the device. Specifically, the early $k$ steps are conducted on the cloud, with candidate prompt set as input. Then the remaining $T-k$ steps are conducted on the device, with the cloud-generated intermediate noisy latent as input. In the paper, we tried $k \\in \\{5, 10\\}$ for comprehensive evaluations. A larger $k$ means more steps are conducted on the cloud, which can improve the quality of the generated images.\n\n> Q4: Devices in experiments.\n\nWe clarify that we adopt a standard client-server scheme. Therefore, only one device is used in the experiments. Besides, since we focus on the image generation (i.e., inference), with no fine-tuning of the diffusion model, the distribution of client data should not have significant impact on the performance. As evidenced by the experiment results, ObCLIP yield comparable performance to the server-side model on both MSCOCO and MJHQ datasets."}, {"review_id": "vDwh8V8SVN", "reviewer": "Reviewer_7DQm", "summary": "The paper proposes ObCLIP to achieve privacy protection in image generation scenarios under the cloud - device hybrid architecture. The method leverages the collaboration between the obfuscation of multiple prompts and the Oblivious computing mechanism to construct a cloud-device collaborative privacy-enhancing framework, which obfuscates and hides user generation intent (prompt) and computing processes to resist privacy leakage risks. ObCLIP consists of components such as the local processing module on the device side and the cloud-side collaborative generation module. Experiments show that ObCLIP can effectively reduce the privacy leakage risks of user prompts and generation processes while maintaining the quality of image generation.", "questions": "- The experiments mainly use single - dimensional attributes like age and gender for illustration. But real - world privacy risks often involve multi - attribute correlations and temporal prompt patterns.\n- Could you extend your experiments to more complex scenarios involving multi - attribute correlations? For instance, in a healthcare domain where patient information includes age, gender, medical history, and treatment records, how would your method perform in protecting privacy against potential threats that exploit correlations among these attributes? Including such experiments would strengthen the applicability of your work in vertical domains.\n\n- The experiments are mainly conducted on specific Stable Diffusion models, without extending to other mainstream generative architectures such as Transformer - based DALL - E - like models or hybrid - structured generative frameworks.\n- What are the key differences between Stable Diffusion models and other mainstream generative architectures like DALL - E - like models that might affect the performance of your privacy protection method? A detailed comparison and analysis would be beneficial.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Pros：\n - The paper is clearly written.\n - Uses a cloud–device hybrid pipeline where the server only handles partial denoising and the client completes the rest, cutting server load without compromising generation quality.\n - Integrates cache-based accelerations exploiting temporal and batch redundancies to drastically reduce server-side computation with minimal impact on utility.\nCons:\n  - Insufficient innovation in core privacy mechanism. The paper relies on generating multiple prompts to obfuscate the real prompt as the core privacy method. Relying solely on prompt-level obfuscation, this single-dimensional strategy shows limited innovation in resisting attacks that exploit prompt correlations or sequences.\n - The paper uses single-dimensional attributes (e.g., age, gender) for illustration. Real-world privacy risks involve multi-attribute correlations and temporal prompt patterns. Limiting experiments to simple cases fails to validate defense against complex threats, weakening applicability in vertical domains.\n - Limited generative model generalization: The paper conducts experiments mainly on specific Stable Diffusion models, while not extending to other mainstream generative architectures (such as Transformer-based DALL-E-like models or hybrid-structured generative framewo", "was_revised": true, "final_justification": "The rebuttal addressed the issues I was concerned about, and most of them have been resolved. I will maintain my \"borderline accept\" rating.", "rebuttal": "We thank the reviewer 7DQm for the positive feedback on \"ObCLIP can effectively reduce the privacy leakage risks of user prompts\" and thoughtful reviews, which is quite encouraging for us. We hereby answer the specific questions below and hope the explanations resolve your concerns.\n\n\n> Q1: Experiments for multi - dimensional attributes\n\nWe clarify that our experiments actually encompass multi-dimensional attributes. To ensure a comprehensive evaluation, we include experiments involving two-attribute combinations (gender × age) and three-attribute combinations (gender × age × ethnicity), presented respectively in Table 2 and Table 6 in the Appendix. The results consistently demonstrate the effectiveness of ObCLIP across these attribute combinations. \n\nWe summarize the utility data in Table below, with ObCLIP yielding comparable performance to the no-private baselines. Beisdes, compared to the parivate baseline vanilla OG, our efficiency is about $7\\times$ higher (and even orders of magnitude higher than cryptographic methods like HE-Diffusion).\nFor healthcare scenario, attributes such as treatment records can be pre-discretized similarly (e.g., headache, cancer). The generation process can then be conducted as described in this paper by leveraging different attribute combinations.\n\n|                 | Generation Method          |    2-Attribute   | (gender $\\times$ age) |                 |    3-Attribute   | (gender $\\times$ age $\\times$ ethnicity) |                 |\n|:---------------:|----------------------------|:----------------:|:---------------------:|:---------------:|:----------------:|:----------------------------------------:|:---------------:|\n|                 |                            | FID $\\downarrow$ |     IS $\\uparrow$     | CLIP $\\uparrow$ | FID $\\downarrow$ |               IS $\\uparrow$              | CLIP $\\uparrow$ |\n| **Non-Private** | Realistic Vision v4.0      |      113.39      |          5.32         |      0.3215     |      111.87      |                   4.78                   |      0.3322     |\n|                 | small-sd                   |      118.19      |          5.11         |      0.2980     |      115.86      |                   5.02                   |      0.3034     |\n|                 | Hybrid SD ($k=5$)          |      116.15      |          5.05         |      0.3117     |      113.57      |                   5.02                   |      0.3108     |\n|                 | Hybrid SD ($k=10$)         |      114.05      |          5.02         |      0.3226     |      112.75      |                   5.04                   |      0.3214     |\n|   **Private**   | Vanilla OG                 |      113.39      |          5.32         |      0.3215     |       4.78       |                   4.78                   |      0.3322     |\n|                 | ObCLIP $(k=5)$             |      116.15      |          5.05         |      0.3117     |      113.57      |                   5.02                   |      0.3108     |\n|                 | $\\enspace\\textbf{+}$ cache |      117.29      |          5.00         |      0.3091     |      114.07      |                   5.04                   |      0.3083     |\n|                 | $\\enspace\\textbf{+}$ reuse |      113.92      |          4.87         |      0.3076     |      113.30      |                   4.66                   |      0.3077     |\n|                 | ObCLIP $(k=10)$            |      114.05      |          5.02         |      0.3226     |      112.75      |                   5.04                   |      0.3214     |\n|                 | $\\enspace\\textbf{+}$ cache |      115.65      |          5.02         |      0.3174     |      113.31      |                   5.03                   |      0.3171     |\n|                 | $\\enspace\\textbf{+}$ reuse |      109.76      |          4.94         |      0.3152     |      110.22      |                   4.62                   |      0.3138     |\n\n> Q2: Insufficient innovation in core privacy mechanism.\n\nWe clarify that our method obfuscates all sensitive attributes within the real prompt, rather than only single-dimensional attributes. This design explicitly addresses potential attribute correlations that could otherwise lead to information leakage, thereby ensuring perfect indistinguishability. This approach is applicable to realistic scenarios involving diverse and inherently multi-dimensional sensitive attributes. Despite its simplicity, our method offers an effective and practical solution for private image generation while maintaining good utility.\n\nMoreover, as discussed in the Conclusion section, the obfuscation mechanism could be further optimized by incorporating differential privacy-based private subset sampling, which offers a better privacy-utility trade-off. Notably, this direction is orthogonal to our current approach and fully compatible with it. We would leave it as future work.\n\n> Q3: Limited generative model generalization\n\nWe argue that this paper focuses on U-Net based diffusion models, which is consistent across all compared baselines. Furthermore, we have conducted extensive experiments on a diverse set of stable diffusion models, including SD-v1.4, Realistic Vision, SDXL-1.0, and LCM-SDXL, to ensure a comprehensive evaluation. We believe these results sufficiently demonstrate the effectiveness of our proposed approach.\n\nRegarding the extension to other Transformer-based diffusion models, we provide a theoretical discussion as follows. The primary difference lies in the denoiser backbone—Transformer-based models replace the U-Net architecture. Nevertheless, both architectures rely heavily on self-attention and cross-attention modules. Our cache-based acceleration primarily targets these attention modules, and therefore, the proposed method remains potentially applicable to Transformer-based models, provided that temporal and batch-wise redundancies still exist. Notably, temporal redundancy has already been observed in prior work[1], supporting the feasibility of our approach in this broader context. This is actually orthogonal to this work and we leave a comprehensive study into Transformer-based architectures as future work.\n\n[1]: Faster diffusion via temporal attention decomposition."}, {"review_id": "8g0EhiMbh7", "reviewer": "Reviewer_pbWf", "summary": "The paper tackles text-to-image generation via diffusion models with a focus on improving privacy and maintaining efficiency in a hybrid cloud-client generation pipeline.\nTo preserve privacy, the paper proposes to obfuscate sensitive attributes in the text prompts (e.g., concerning gender, age, ethnicity, etc.) by generating a set of augmented prompts where the sensitive attributes are randomly replaced\nTo offset the heavy increase in compute cost such a simple approach would cause, the paper uses a combination of hybrid generation (where some steps are performed in the cloud and some on a device on a smaller model) and techniques to leverage redundancy in the diffusion process on the server side (i.e., due to similar semantics among the set of augmented prompts and redundancy among different diffusion steps). \nExperiments are performed on various combinations of server/client models on MS-COCO and MJHQ, and the proposed approach is compared primarily to baselines consisting of full server/client-side generation and existing hybrid approaches.", "questions": "It would be great if the authors could address some of my concerns listed in the weaknesses above. In particular, I would like to know better about:\n- How the method compares to prior work like HE-Diffusion?\n- What are the novel technical contributions?\n- What are the limitations of the obfuscation approach to identify and replace sensitive attributes?", "limitations": "I mentioned some potential technical limitations above. I don't see any negative societal impacts from the work.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- The paper is well presented and easy to follow. \n- The approach to increase privacy through prompt augmentation is sensible and straightforward. Techniques to leverage redundancy in the resulting set of prompts (some of which appear to be novel) also make sense and appear effective in accelerating server-side computation and reducing the negative impact on overall compute. \n\n\nWeaknesses:\n- A bit unclear what the novel technical contributions are. Many of the techniques used for improving the efficiency of the system appear to be from existing works (i.e., the hybrid processing and leveraging temporal redundancy in the diffusion process). The paper appears to be more a combination of existing techniques to a large extent (which is ok, but limits technical contributions). \n- Comparison to HE-Diffusion and other methods listed in Table 1 is lacking. It is unclear why only latency is considered for HE-Diffusion in Table 2. It also appears from Table 1 that the MPC methods would be preferable (though I might misunderstand the meaning of some of the columns). \n- The qualitative examples shown are not very convincing in my opinion. For example, it is not obvious that one of the examples in Fig. 3b is clearly better than the other (both show obvious defects). \n- Though the approach is sensible (i.e., obfuscation by augmentation + improve efficiency via hybrid processing), it is also rather straightforward, and the paper therefore does not provide a lot of novel insights. \n- Given that the obfuscation mechanism appears to be a key contribution, I found that there is limited detail and evaluation of the approach. It appears to be rule-based and relies on some prior model to find sensitive attributes. This seems potentially rather limiting, and I have some doubts about the generality of it. For example, while Fig. 8 highlights \"young\" as a sensitive attribute (age), the information that the person should be 18 years old is not highlighted (though it is likewise referring to age).", "was_revised": true, "final_justification": "After considering the extensive author response (which addresses several of my concerns) and the other reviews, I decided to raise my rating to \"borderline accept\". I think the paper is sufficiently valuable and interesting to the community to warrant publication.", "rebuttal": "We sincerelly thank the reviewer pbWf for the positive feedback on \"Techniques to leverage redundancy ... (some of which appear to be novel) also make sense and appear effective\" and helpful reviews. \n**We address the concerns raised and respectfully hope that our clarifications will help prompt a positive rating of the paper.**\n\n\n> Q1: Explanation for the comparision to cryptographic methods.\n\nApologies for the misunderstanding. We first clarify that the comparison with HE-diffusion is presented in Section 5.2 on page 7. \nWe report only the latency because the original HE-Diffusion paper (in Table 2$\\sim$3) only provides runtime numbers for efficiency and implicit similarity metrics for utility (to measure error between plaintext and encrypted generations), but lacks full utility evaluation. Due to the considerable computation overhead of HE-Diffusion (one denoising step takes over 100 seconds), we were unable to conduct a complete evaluation.\nDuring the rebuttal, we found a recent HE-based paper[1] that uses plaintext to approximate the utility. We adopt this methodology, which should provide the utility upperbound for these two HE-based works as it avoids the approximation errors introduced by encrypted inference.\nWe provide the supplementary evaluation results in the table below. We take FID score reported in the paper of [1] due to lack of source code.\nMPC-based approaches do offer strong privacy and somewhat comparable utility with delicate approximation methods. However, their efficiency is typically orders of magnitude slower (due to heavy cryptographic computations). For example, as shown in the Table below, HE-Diffusion is over $100\\times$ slower and [1] is even over $1000\\times$ slower than ObCLIP. Such drawback greatly hinders the practicality of MPC-based approaches. In contrast, ObCLIP achieves significantly better efficiency with comparable utility.\n\n|                 | Generation Method  | FID $\\downarrow$ | Latency (s) |\n|:---------------:|--------------------|:----------------:|:-----------:|\n| **Non-private** | SD-v1.4            |       13.86      |     1.12    |\n|                 | BK-SDM-small       |       18.30      |     0.78    |\n|                 | Hybrid SD ($k=10$) |       14.29      |     0.55    |\n|                 | Hybrid SD ($k=5$)  |       15.48      |     0.28    |\n|   **Private**   | HE-Diffusion       |   $\\sim 21.85$   |     106     |\n|                 | [1]                |   $\\sim 13.00$   |     660     |\n|                 | ObCLIP $(k=10)$    |       15.73      |     0.57    |\n|                 | ObCLIP $(k=5)$     |       16.45      |     0.33    |\n\n\nRegarding the qualitative comparison in Table 1, to better highlight the trade-offs, we update the table with four levels of performance: High, Medium, Low, and Very Low. Specifically, MPCViT focused on secure inference of vision transformer, which is different from our approach (U-Net based diffusion). Therefore, we do not include quantitative comparison to this work. Note that, due to LaTeX syntax incompatibility, we here use textual indicators instead of circular symbols. \nWe hope this resolves your concern and promise to update the table in the final version.\n\n|                 |            | Method       |     Domain    | Privacy | Server Cost | Utility |\n|:---------------:|:----------:|--------------|:-------------:|:-------:|:-----------:|:-------:|\n| **Non-private** | Standalone | Server-Only   | Text-to-Image |   Low   |     Low     |   High  |\n|                 |            | Client-Only  | Text-to-Image |   High  |     High    |   Low   |\n|                 |   Hybrid   | Hybrid SD    | Text-to-Image |   Low   |    Medium   |  Medium |\n|   **Private**   |     MPC    | MPCViT       | Text-to-Image |   High  |   Very Low  |  Medium |\n|                 |            | HE-Diffusion | Text-to-Image |   High  |   Very Low  |  Medium |\n|                 |            | [1]          | Text-to-Image |   High  |   Very Low  |  ~High  |\n|                 |   Hybrid   | ObCLIP       | Text-to-Image |   High  |    Medium   |  Medium |\n\n\n\n[1]: Secure Diffusion Model Unlocked: Efficient Inference via Score Distillation\n\n> Q2: Clarification on the novel contributions.\n\nWe argue that in caching-based acceleration, the core challenge lies in devising a caching strategy that effectively balances efficiency and utility. Specifically in this paper, we incorporate both temporal- and batch- redundancy-based accelerations designed for the client-server hybrid generation paradigm.\nFor temporal redundancy, we first analyze server-side redundancy across self-attention, cross-attention, and block outputs, as shown in Figure 6. Guided by these insights, we develop a multi-granularity acceleration strategy that further reduces overhead compared to prior work. For example, different from T-Gate[1], we cache both the self-attention and cross-attention in the server-side early denoising (T-Gate only caches self-attention).\nIn addition, we propose a novel batch-redundancy-based acceleration technique that reduces the total attention computation by a factor of $1/N$. \nBy jointly leveraging both temporal and batch redundancy, our approach achieves a better efficiency–utility trade-off, which is thus non-trivial.\nWe hope this approach offers useful insights for future work, particularly in real-world high-concurrency inference services, where similar forms of redundancy across different user requests could be exploited.\n\nWe also appreciate the reviewer’s positive feedback that \"the approach is sensible.\" We believe that, despite its simplicity, our method offers an effective and practical solution for private image generation while maintaining good utility.\n\n\n[1]: Faster Diffusion via Temporal Attention Decomposition. 2025\n\n> Q3: Clarification on the obfuscation approach.\n\nThanks for your careful reading. We provide the detailed design of obfuscation mechanism in Algorithm 1 in the Appendix B.\nWe clarify that it mainly involves two steps: (i) detecting sensitive tokens, and (ii) constructing the corresponding candidate set. The first step, also known as named entity recognition, are used as an existing technique[1] in this work. One limitation is that we depend on the underlying model to detect sensitive tokens. We argue that this could be of independent interest. For example, there are recent works that use LLM for NER detection[2], which yields much better performance.\n\n\nRegarding Fig. 8, we apologize for the insufficient elaboration due to page limit. In this figure, the parentheses indicate an example age (e.g., \"18-year-old\") to represent the \"young\" category. For general tasks that require age as input, we discretize age into three categories: young (18–35), middle-aged (36–59), and old (60+). \nWe hope this resolves your concern and will include a more detailed explanation in the final version.\n\n\n[1] Isotonic. Distilbert fine-tuned for ai4privacy task, 2025.\n\n[2] UniversalNER: Targeted Distillation from Large Language Models for Open Named Entity Recognition. 2023\n\n\n> Q4: Examples in Fig. 3b\n\nWe acknowledge that as shown in the figure, even server-only generation yields obvious defects. \nHowever, server-first hybrid generation is clearly more influenced by server-side guidance. This supports our design choice to offload the early denoising stages to the server, enabling stronger semantic alignment and improved generation quality."}]

Author rebuttal:

Meta-review: The paper proposes a cloud-device collaborative framework to achieve privacy protection in image generation. It integrates the obfuscation of prompts and the oblivious computing mechanism to mitigate privacy risks. The effectiveness of the proposed method is demonstrated by extensive experiments. The paper is well-written and its cloud-device design has practical values.  However, the technical novelty of the proposed method is a concern, and its effectiveness to a broader range of real-world attacks are still yet to be verified. as also pointed out by the reviewers.

During the rebuttal, the authors addressed most of the reviewers' questions, leading to consensus positive scores. Based on the reviewers' final scores and justifications, I would like to recommend the acceptance of the paper.
Decision: Accept (poster)