Guarantees of confidentiality via Hammersley-Chapman-Robbins bounds
Authors: Kamalika Chaudhuri
Chuan Guo
Laurens van der Maaten
Saeed Mahloujifar
Mark Tygert
Venue: Accepted by TMLR ()

Abstract: Protecting privacy during inference with deep neural networks is possible by adding Gaussian noise to the activations in the last layers prior to the final classifiers or other task-specific layers. The activations in such layers are known as "features" (or, less commonly, as "embeddings" or "feature embeddings"). The added noise helps prevent reconstruction of the inputs from the noisy features. Lower bounding the variance of every possible unbiased estimator of the inputs quantifies the confidentiality arising from such added noise. Convenient, computationally tractable bounds are available from classic inequalities of Hammersley and of Chapman and Robbins -- the HCR bounds. Numerical experiments indicate that the HCR bounds are on the precipice of being effectual for small neural nets with the data sets, "MNIST" and "CIFAR-10," which contain 10 classes each for image classification. The HCR bounds appear to be insufficient on their own to guarantee confidentiality of the inputs to inference with standard deep neural nets, "ResNet-18" and "Swin-T," pre-trained on the data set, "ImageNet-1000," which contains 1000 classes. Supplementing the addition of Gaussian noise to features with other methods for providing confidentiality may be warranted in the case of ImageNet. In all cases, the results reported here limit consideration to amounts of added noise that incur little degradation in the accuracy of classification from the noisy features. Thus, the added noise enhances confidentiality without much reduction in the accuracy on the task of image classification.

Published in Transactions on Machine Learning Research (08/2024)
Guarantees of confidentiality via Hammeerley-Chapmaa--obbbiii bounds
Kamalika Chaudhuri
kamalika com
Pundamental Artificial Intelligence Research Meta Platforms, Inc.
Chuan Guo
chuanggu@@meta.comm com
Pundamental Artificial Intelligence Research Meta Platforms, Inc.
Laurens der Maaten
Vodmaaten@metaa.com
Pundamental Artificial Intelligence Research Meta Platforms, Inc.
Saeed Mahloujifar
Sacedm@mette com
Fundamental Artificial Intelligence Research Mela Plalforms, Inc.
Mark Tygert Pundamental Artificial Intelligence Research Meta Platforms, Inc.
mark www.kkttgget..om com
Reviewed OpenReview: https://openreeeee net/ for/fo id= DOWSP7y2n
Abstract
Protecting privacy during inference with deep neural networks is possible by adding Gaus- sian noise to the activations in the last layers prior to the final classifiers or other task-specific layers. The activations in such layers are known as "fcaturcs" (or, less commonly, as "em- beddings" or "feature embeddings"). The added noise helps prevent reconstruction of the inputs from the noisy features. Lower bounding the variance of every possible unbiased esti- mator of the inputs quantifies the confidentiality arising from such added noise. Convenient, computationally tractable bounds are available from classic incqualities of Hammersley and of Chapman and Robbins - the HCR bounds. Numerical experiments indicate that the HCR bounds are on the precipice of being effectual for small neural nets with the data sets, "MNIST" and "CIFAR-10," which contain 10 classes each for image classification. The HCR bounds appear be insufficient. on their own guarantee confidentiality of the puts to inference with standard deep neural nets, "ResNet-18" and "Swin-T," pre-trained on the data set, "ImageNet-1000," which contains 1000 classes. Supplementing the addition of Gaussian noise to features with other methods for providing confidentiality may be war- ranted in the case of ImageNet. In all cases, the results reported here limit consideration to amounts of added noise that incur little degradation in the accuracy of classification from the noisy features. Thus, the added noise enhances confidentiality without much reduction in the accuracy on the task of image classification.
1 Introduction
The Haaanersley-Chaapan---oee (HCR) bounds of Hammersley (1500) and Chapman Robbins 1951 provide easily interpretable, tight data-driven guarantees on confidentiality. The interpretation especially simple and direct, lower bounding the variance of any estimator for reconstructing inputs to inference with

---

Published in Transactions on Machine Learning Research (08/2024)
neural networks. Moreover, computing the bounds is efficient and straightforward. Confidentiality stems from suitable addition of noise; the HCR bounds quantify the effect of the added noise on the minimum possible variance of any estimator.
This paper studies the privacy preservation arising from adding independent and identically distributed Gaussian noise to the activations in the final layers of deep neural networks, that is, to the layers im- mediately preceding the classifiers used during supervised training of the nets and used for classification during inference. The most common terminology for these activations is "features" (or vectors of features). Less common synonyms are "feature embeddings" simply "embeddings." Adding noise is also known "dithering." Dithering fcatures is canonical method for limiting the quality of possible reconstructions of the inputs that generated the noiseless features.
The present paper omits consideration of adding noise directly to the data or for proxies to that process; such as DP-SGD of Abadi et al. (2016), since quantifying their privacy preservation in terms of the variance minimized over all possible estimators is trivial, given directly by the amount of noise added.
A method for quantifying privacy that is closely related to the HCR bounds is to use Fisher information and the Cramér-Rao bound, as advanced by Hannun et al. (2021) and others. The Cramér-Rao bound is most useful when quadratic form specified by the Fisher information matrix is good approximation to the expected loss (the risk function) near the parameters at which the Fisher information is evaluated. Tn contrast, the HCR bounds used below are typically tight whether or not a quadratic form specified by Fisher information evaluated at a single setting of parameters is a good approximation. Furthermore, evaluating the Fisher information for complicated models in machine learning such as deep neural networks can be difficult costly at scale. The approach proposed below avoids most of the difficulties and is computationally tractable. In fact, the HCR bounds always exist, whereas the Cramér-Rao bounds exist only when the loss is sufficiently smooth.
The present paper could be viewed as providing an alternative to the Cramér-Rao bounds that is more practical. Indeed, the Cramér-Rao bound a certain limit of an HCR bound. Subsection 2.5 below details the connection, a connection first made in the original works of Hammersley (1950) and of Chapman & Robbins (1951).
Unfortunately, the experimental results reported below indicate that the HCR bounds are weak for one of the data sets tested, at least with some standard neural nets for image classification (image classification is also known as "image recognition"). Section 4 below concludes that dithering features and leveraging the associated HCR bounds would be most useful in conjunction with cruder, brute-force methods for enhancing confidentiality of the inputs to inference (such as limiting the sizes of the vectors of features being revealed). From the point of view of actual practice, the idea proposed in the conclusion, Section 4 is to restrict the dimensions of the vectors of features accessible to an adversary, which directly limits the information available to the adversary. The HCR bounds are obviously more effective for practical applications in which the amount of information available to an adversary is limited. The numerical results reported in Scction 3 below illustrate how the HCR bounds are more effective with smaller sizes of the vectors of features.
Earlier work, notably the thesis of Alisic (2021), also applies HCR bounds to quantify privacy, comparing favorably with the differential privacy of Dwork & Roth (2014). The focus of Alisic (2021) and the subsct of the thesis reported by Alisic et al. (2020) is on confidentiality in the measurement of dynamical systems - quite different from the setting considered in the present, paper yet the results are complementary and consonant with those of the present paper.
The differential privacy of Dwork & Roth (014)) focuses on anonymization and preventing re-identification, rather than on the full confidentiality that directly prevents accurate reconstructions of input data (which is the focus of the present paper). Differential privacy provides guarantees in the form of parameters often denoted "g" and "8," whereas the HCR bounds directly guarantee a minimum level of noise on the best- possible reconstructions obtainable from the dithered features. Appreciating the meanings of parameters such and 5 from the usual formulations of differential privacy may require familiarity with mathematics that ordinary users are unlikely to have mastered, such as the exponential function or the concepts of relative sizes of probabilities or of the probabilities arising from classification via randomized algorithms. The HCR
2

---

Published in Transactions on Machine Learning Research (08/2024)
bounds characterize via variance the minimum level of noise that an adversarial reconstruction could possibly attain; variance (or standard deviation) is statistic measuring noise level, variability, spread, or dispersion that is meaningful to virtually anyone.
And for those who cannot understand the notion of "variance" or who prefer to see the quality of possible reconstructions displayed visually, Figures 2 and I below illustrate the best-possible adversarial reconstruc- tions. Users are welcome to look at the pictures in Figures 2 and 4 the noisy versions are the best any adversary who lacks prior information about the imput can reconstruct the noiscless inputs. (Lacking prior information refers to the restriction that the adversary course, if the adversary knew all the pixels of the input image ahoad of time via external sources of informa- tion, then a biased estimator that simply ignores all data and uses the prior information would completely compromise confidentiality. The general mathematical analysis developed in Section 2 below in principle allows for adjusting the bounds to account for prior information, though working out the full theory well beyond the scope of the present paper.) Figures 2 and effectively depict error bars on the best-possible reconstructions that any adversary could ever make.
estimator which is statistically unbiased; of
Copious advantages of Cramér-Rao bounds over the canonical formulations of differential privacy have been detailed by Hannun et al. (2021) and others. Many of these advantages pertain to the HCR bounds, too. For instance, the HCR bounds adapt to the given data, whereas the standard formulation of differential privacy provides only worst-case guarantees, valid uniformly over all possible data sets (not only for the actual data of interest). The HCR bounds thus can be tighter and more powerful than the guarantees from typical differential privacy, at least with regard to preventing reconstruction of the data. Moreover, the HCR bounds can address individual pixels of images, individual modes in Fourier representations, or other parts of input data, whereas differential privacy typically operates at coarser granularity ("membership inference").
The remainder of the present paper has the following structure: Section P develops theory and algorithms based on HCR bounds. Section repport numerical experiments with the popular data sets MNIST, CIFAR- 10, and TmageNVet-1000 for image classification, when processed with standard architectures such as ResNets and Swin Transformers as well as with some especially simple, illustrative neural nets M Section 4 draws several conclusions and suggests coupling the methods presented in the present paper with cruder, brute- force techniques for enhancing confidentiality.
2 Methods
This section details the methodology of the present paper. Subsection 2.1 briefly reviews the general for- mulation of dithering vectors of features specifically and develops algorithms for computing the bounds. Subsection 2.3 specializes the HCR bounds to the addition (to the features) of independent and identically distributed noise. Subsection 2.4 performs the calculations for the case that. the distribution of the noise a centered Gaussian. Subsection 2.5 considers a limit in which the HCR bounds become the classical Cramér-Rao bounds (under suitable assumptions of regularity in the parametric model, so that the relevant derivatives exist). The following section, Section 3 tests the bounds with several standard data sets and machine-learned models, when adding independent and identically distributed Gaussian noise to the features.
(HCR) bounds. Subsection 2.2 specifies the HCR bounds for
2.1 Hamnmerstey-Chaapa--Robbbo bounds
This subsection reviews a classic bound introduced independently by Hammersley (9500) and Chapman & Robbins (1951). Specifically, we use the multivariate generalization detailed, for example, by Wikipedia contributors (2024).
We consider a family of probability density functions (pdis) So (xx) of a vector x, parameterized by vector 0, with coming from an n-dimensional real vector space R² and 0 coming from a p-dimensional real vector
1 Perrissiivlyy licensed open-source codes that can automatically reproduce all results the present paper are available at http:://gtttub..c//aaaacbbbbo http:://hhhtbcccccccccooorrrrret
3

---

Published in Transactions on Machine Learning Research (08/2024)
space RP. We consider any estimator ((X) of 0: the estimator is function of the vector X of observations. We define g(0) to be the expected value of 0 with respect to the pdf fe, that is,
( = [o(0] = / ((x) fo(x) dx.
(1)
The
(HCR) bound is
(gx + + 9u (0))2
(ar)(Ox) 2
(2)
[x++(() (v/(x) [o(X) - )
Ep
for 1, ...,, p and for any vector E in the same p-dimensional real vector space R2 to which belongs.
In 2 0g is the kth entry of the vector-valued 0, similarly Ise is the kth entry of the vector-valued g, and
Varo (0&c IE [00 9a [00)))]] = =/f (D.co) - .fc On(v) fo(u) fo(u)dy du) fo(x) de
(3)
and
[ fo(X)
-1) -f( (ooc(t) -1) [o(x) dr.
Eg
(4)
fo(x)
If θ is an unbiased estimator 0, then g(0) and (2 simplifics to
(Ex)²
Varo(Ox)
(5)
(X) - ] fo(X)
Bo
for & ==1 1, ..... P and for any vector in the same p-dimensional real vector space R to which O belongs. Requiring the estimator to be unbiased is lantamount to forbidding the use of extra, outside information such as a Bayesian prior. Unbiasedness is a reasonable yet significant restriction. Tf, for example, the actual values of the data are known from sources other than the observations X, then clearly the estimator can better than unbiasod the estimator could simply ignore the observations X and report the correct values known a-priori from another source.
A bound on the mean-square error of any unbiased estimator Ô of 0 follows immediately from
p
(Ex)
Σ
0x)
2
(6)
p 1=1
Eg
[ate(() Jo(X)
1)
2
for any vector 6 the same p-dimensional real vector space RP to which 0 belongs.
2.2 Dithering the features of machine-learned model
This subsection discusses how to enhance privacy (specifically, confidentiality) of the input data used during inference with an already trained machine-learned model, by adding noise to the features that the inference caleulates. The formal term for adding noise is "dithering," The present subsection specializes the HCR bounds of (2 and (5) to this setting and details algorithms for computing the bounds.
To set notation, we let the vector O of parameters denote the input data and the vector X of observations denote the resulting features, with noise added to the features. We let the vector of activations denote the features without noise added. Note that the input data need not be the entire test set, but could be only one or more of the individual examples input during inference.
Obtaining a tight HCR bound hinges on selecting suitable vector of perturbations, perhaps taking the maximum bound realized over several choices of e. The ideal maximizes the ratio in the HCR bound
4

---

Published in Transactions on Machine Learning Research (08/2024)
Algorithm 1: Calculation of perturbation E to the vector of parameters 0
Input: Positive integers 2, n, and p. a vector whose n entries are real numbers, vector 0 whose p entries are real numbers, and functions and u that apply the transpose of the Jacobian (0aa/00) and the Jacobian itsclf (without transposition) to arbitrary vectors, respectively, where ag is the vector of fealures introduced in Subsection 2.2 here, i is the number of repetitions of the LSQR algorithm of Paige & Saunders (1982) that the present Algorithm !
will execute, 2 is the starting voctor for the itcrations of LSQR (so t(z) is the starting vector with regard to the normal equations), and f is the unperturbed input data.
Output: vector & whose p entries are real-valued and a vector 2e whose n entries are real-valued;
e is the perturbation to 0 such that 2e ag+s - ag.
Set 20) 2.
Calculate the vector of features 0g corresponding to the input 0.
3 for j = 1, 2, ..., i do
Set =(6-1) = ||||| /1= so that the Euclidean norms of and =(1-1) are equal.
5 Solve the least-squares problem of minimizing the Euclidean norm ((0as/00) e(ب) - -00-1)|| obtaining the minimizing e(i using LSQR of Paige & Saunders 1982). LSQR should invoke the functions t and u to perform the matrix-vector multiplications that LSQR requires. This step 5 amounts to applying the pseudoinverse of the Jacobian (dag/00) to g(i-1), yielding e0),
Calculate the vector of features ag+c()) corresponding to the perturbed input (0 + e(i)).
6
Set 200 00+e(1) ag.
7
end
return E e(0 and 2g = 2(0.
9
of (5). When the noise added to the features is Gaussian, with the entries of the noise being independent and identically distributed centered normal variates, the denominator in ( becomes the expression in 112
given below. Maximizing 5 thus amounts to making the perturbation & to the input O as large as possible while making the corresponding perturbation &e to the features ag as small as possible, for ze of 110g below; that is, the goal is to maximize the ratio of Euclidean norms ||e||/[| ll, or, equivalently, to minimize the ratio 2| //]l If the perturbation E is small, then linearization yields that 2, (0ag/00) E, which is the product of the Jacobian (da)/00) and the perturbation e to O. Under this linear approximation, the minimum of
the ratio |==||/||e|| is therefore equal to reciprocal of the spectral norm of the pscudoinverse of the Jacobian (Daa/80) after all, the spectral norm of the pseudoinverse is simply the reciprocal of the least. singular-value of the Jacobian itself, and the least singular-value of the Jacobian (dag/ is by definition the minimum of the ratio (((aaa/00) ell el|/||||| = || ||e|l
Some simple iterations can approximate the spectral norm of the pseudoinverse of the Jacobian (Qag/00) while simultaneously calculating a perturbation for which the ratio [(0as/000 e0)//00)))///le e||/||||| ze || is nearly minimal. Indoed, iterations of LSQR of Paige & Saunders (1982) with the Jacobian (Da,/00) applied to vectors generated during the iterations of LSQR and with the transpose (dag/08) /0) of the Jacobian applied to other vectors generated during the iterations can approximate the action of the pseudoinverse of the Jacobian (0az/00). Such iterations of LSQR produce a perturbation e, from which the corresponding perturbation to the features is straightforward to calculate. Then the newly calculated 2 can serve as the starting point (0ag/a0) z. in the normal equations for further iterations of L.QQ. The further iterations of LSQR yield an updated perturbation E, from which the corresponding perturbation 2e to the fcatures is straightforward to compute. Repeating this process several (say, i = 10) times, iteratively updating e and 2e every time, will approximately minimize the ratio |2g l//|=/// Algorithm I provides pseudocode summarizing the procedure.
Note that automatic differentiation can apply to arbitrary vectors both the Jacobian and its transposc, efficiently and matrix-free (never actually having to form the full Jacobian). Furthermore, there is no need to compute e especially precisely, as any approximation whatsoever to the ideal for e yields a perfectly rigorous guarantee via the HCR bounds. Indcod, given the perturbation e to the input 8 calculating the corresponding perturbation 2e to the features exactly (without any approximations) requires just one forward run of inference with the machine-learned model.
5

---

Published in Transactions on Machine Learning Research (08/2024)
2.3 Additive noise
This subsection specializes the HCR bounds of the previous subsections to the case in which the dithered features are simply the features plus independent and identically distributed noise. In particular, this subsection derives an explicit expression for the right-hand side (5). In accordance with the notation of the preceding subsection, Subsection 2.2 we denote by ag the features generated by inference with the already trained model using the original data. f (or just a single test example) as inputs, and we denote by a94s the features generated by inference using the perturbed data (0 + +) as inputs.
Dithering yields the observed noisy vector of features
x= ag Z,
where Z is the noise added. Denoting by the probability density function of the noise, see that
fo(X) fo(as + Z) = f(2)
(8)
and
f0+c(X) fo(X- (ao+e - 0o)) = [as + 2 (ag-s aQ)) f(Z (ao+= aQ)) f(Z - ze),
(9)
where
Ze =
00+= 00;
(10)
that is, 2e is the perturbation added to the features during determination of (with 2 updated to correspond exactly to the actually used, discussed at the end of Subsection 2.2 Combining ( and 9
yields that
the denominator in (5 is
Eg ( ( - =R 1))-
27
(5((x) fo(x)
(11)
f(2)
where 2e from 10 viewed as a fixed constant during evaluation of the expectation.
For some distributions Z including the multivariate normal distribution NN0,02 I,,) corresponding to standard deviation
evaluate (11) via analytic integration, aligning one of the axes of integration in the integral corresponding to the right-hand side of (II) with the fixed direction given by ze- The following subsection, Subsection 2.4 performss the caleulation for this normal case, yielding that the denominator in 5 is
| 02
Es
fo(X)
= exp
(12)
where || is the Euclidean norm of from 10 For more complicated distributions, we can estimate the right-hand side of [11] via Monte-Carlo methods. For isotropic (that is, rotation-invariant) distributions of the added noise Z, such as the multivariate normal distribution N/ 00 In). the value (11) depends only on the Fuclidean norm of 2 and not on the entries of ze individually. In all cases, the value of 11 is independent of the machine-learned model used.
2.4 Normally distributed noise
the case of the multivariate normal distribution which all n entrics of vector Z independent and identically distributed (N(0, so that the probability density function (pdf) of Z is
This subscction derives 12
|
f(z) (2/o22)a/2 exp
(13)
202
where ||=|| is the Fuclidean norm z. With this pdf, the right-hand side of
f(z (1(2-22) f(2)
2c) -1) 1) - -/-
[(2 (((=-w) v)
-1) f(z) dz,
(14)
Rm ({z)

---

Published in Transactions on Machine Learning Research (08/2024)
where v's first entry U1 - is the Euclidean norm of 4e and v's other entries es 0 for l: 1; the
invariance of 13 to rotations of the coordinate system yields (14) the right-hand side of (14) aligns the
first coordinate axis with the direction of žz. The remainder of this subsection simplifies [14 further.
Substituting
13 into the right-hand hand side of 14 yields
(1(=-u) f(2)
-1)
f(z) dz
12
000
rc
(z1)² - (3) - v1
-1) 2
(21) (21) +... (.nn))))))n)) dzi dz2 ...
(2ma2)n/22
...
exp
20
exp
20²
dan
-00
0
( (2) c)2
2
+... +...t
+.,...((3))) (3n)2
(2 -00
exp
2
-1
exp
2
d21 d22 ... dan. (15)
-00
where
81
(16)
a
Expanding the square yields three terms
(z1 - (21 -0)=
c)2
-1) :) exp ((2))=- (21- - -c)2) - 2exp
(21) - (21 c)2
exp
2 +1. (17)
The last term
17 corresponds in 15 to
(21) )2 (2n)
exp
dæi d22 ... dzn
(18)
(2x)
2
The penultimate term in 17 corresponds in 15
2
(2) - c)² - (22) +... +...... +2x))
n2
exp
2
dzi dag dan
0
0
(- (z1)² 2 (22)
+... (zn)2) day d22. d2n = 2. (19)
exp
(2m)
2
The first term in the right-hand side of 17 corresponds in 15
2(21 c)² - (21) 2 + (zz)² +... (zn)²
1/2
exp
2
dzl dē2 .dn
1
2(21 c)2 (21)²)
1
(21) - 4c21 + 20
exp
dzp
exp
dzy. (20)
2
2
v
2m
--0
2
Further simplification yields
(=(1))² 4021
2c²
exp(c?)
1
000
20)²
cxp
cxp
d2i = exp(c?).
(21)
2m -00
2
2
2
Combining all formulas in this subsection yields that the right- side of
11
is
(2)) (11 -1) f(z)
[(Z [1(2-2e)
2z)
-1)
[1
E
exp
1.
(22)
2.5 Cramér-Ran bounds
This subsection connects the earlier subsections with the famous approach of Cramér and Rao connection that the original works of Hammersley (1950) and of Chapman Robbins (1951) note motivation for

---

Published in Transactions on Machine Learning Research (08/2024)
developing their own bounds. (The remainder of this subsection will be assuming tacitly, without further elaboration, that all derivatives required for this subsection's 's derivations actually exist and are continuous. Unlike the HCR bounds, the Cramér-Ras bounds pertain only to scenarios in which the derivatives do exist.)
If the perturbation e is very small, then 2e = apte ag will also be very small, with 20 = 0, so
p H(ze)s
(ze),
Σ
EK + o(ll=|))
(23)
DEk
for j = 1, ..., n, while the right-hamd hand side 12 becomes
exp
12g 1
2
+
(I|=
σ² Σ ((t)))) + +
(24)
where (ze), denotes the jth entry of the vector 2e. Combining
23 and 24
yields
exp
| 02
-
-11
a(ze) Ek + +[|==|13).
(25)
σ² j=1
Evaluating 25 for perturbation in which all entries but one say the kth are zero yields
| x2 -
(Ex)
O(ze)i
exp
Σ
DEk + o((l=|1?),
(26)
j=1
where & is one of the positive integers 1, 2, ..... p. Naturally,
0(=z);
1
(27)
0Ek dex/O(ze);
for 2,
2, ..., Combining 5
12
and 26 and taking the limit - then yields
0²
Var (0x)
(28)
( 2e) /
(Zz),)²
for h: 1, 2, .... P. where the latter equality in 28 follows from 27 Please note that 28 is exact, not approximate the higher-order terms vanish in the limit + O. Evaluating the bound 28 for all values of requires the computation of cither or n gradients, where p is the dimension of the space of paramoters and n is the dimension of the space of observations. (Taking the Jacobian of me with respect to 8 requires n gradients; taking the Jacobian of with respect to ze requires gradients.) The inequality in (28 is known the "Cramér-Rao bound," as elucidated by Hannun et al. (001)) for example.
3 Results
This section applics the methods of the previous section, Scction 2 to several standard data sets and neural architectures for classifying the input images All experiments of the present section pertain to the addition of independent and identically distributed Gaussian noise to features. All bounds reported in the present section are for the standard deviations corresponding to (5: of course, the standard deviation is the square root of the variance from 5 Subsection 3.1 considers MNIST, classic data set of 28 x 28 pixel grayscale scans of handwritten digits, first training a simple neural net on the standard training set and then conducting inference and computing the associated HCR bounds on the test set. Subsection 3.2 does similarly for CIFAR-10, classic data set of 32 pixel color images of 10 classes, namely airplanes, birds,
?Permissively licensed open-source software that automatically reproduce all the results reported here is available htt.://hw....cceeccoooooeeeeeaaa
8

---

Published in Transactions on Machine Learning Research (08/2024)
boats, cars, cats, deer, dogs, frogs, horses, and trucks. Subsection 3.3 considers ImageNet, standard data set with 1000 classes, processing images from the validation set via the conventional pre-trained neural nets, "ResNet-18" and "Swin-',," from TorchVision Vssion of "TorchVision Vision maintainers & contributors (2024). Further experiments applying RcsNet-18 and Swin-T to MNIST and CIFAR-10 yield results similar to those applying these same pre-trained models to ImageNet-11000 1000 and are therefore omitted - the HCR bounds turn out to be rather ineffective and uninteresting for the larger deep nets, ResNet-18 and Swin-T.
In the coming subsections, "Affinemxn xn" refers to layer which multiplies the imput row vector from the right by an X n matrix whose entries are learned and adds vector which is independent of the imput (that is, "bias") that is also learned; the dimension of the input is m and the dimension of the output is n. "ReLU" refers to a layer which preserves unchanged every non-negative entry of the input and zeros every negative entry; the dimensions of the imput and of the output are the same. "Flatten" " refers to a layer which reshapes the input into a single, longer vector. "Convolution2DD (wnchaannddd ((kenel))) " refers to a layer which convolves each of the m channels of the input with n convolutional kernels, each of size k x pixels whose values are learned, and adds to the result an image which is independent of the input. (that is, "bias") that is also learned. " "MaximummPoolinge"" (xseiingggnxx((itiiiaaa mxx(stridd)) (kornel) refers to layer which partitions xdderree)
the input into m x n blocks of pixels and replaces cach block with the maximum value in the block (in this paper, the stride and size of the kernel are always the same, that is, m = k and = E); the first dimension of the output is 1/m times the first dimension of the input, while the second dimension of the output is 1 //n times the second dimension of the input. "Softmax" refers to a layer which calculates the softmax of the input vector (the softmax is also known as the "Gibbs distribution"); the dimensions of the input and of the output are the same.
The weights and biases in the neural networks are the learned values; the values of the inputs, features, and class-confidences are activations (that is, values at nodes) in the neural nets. All results reported are HCR bounds maximized over 25 independent and identically distributed pseudorandom realizations of ze in (22 obtained by running the algorithm (Algorithm 1 of Subsection 2.2 with the n entries of the starting vector 2 being proportional to the normally distributed noise added to the features. The constant of proportionality is 1/vn times the size s of perturbation specified in the captions to the subfigures (these sizes are 1/200, 1/500, and 1/1000 for the different subfigures, as indicated in the captions). This constant of proportionality results in the right-hand side of 12 being roughly exp(s?)- - = s², where is the size of the perturbation (s -==11 1/200, 1/500, or 1 10000 specified in the subfigures' captions).
3.1 MNIST
This subsection reports the results of numerical experiments with the standard data set, "MNIST," " a data set presented by LeCun et al. 1998). MNIST contains images of handwritten digits (0, 1, 2, ..., 9).
To calculate features for a given input, we use the activations in the last layer of the following neural network: inputs - Flatten - Affinersix781 + ReLU + Affine784x788 + ReLU + features
There are 784 entries both in the input vector for each image and in the corresponding features. The input images are 28 x 28 pixels, with only single color channel (the inputs are grayscale).
Given the features, the classifier takes the argmax of the activations (values at the nodes) in the last layer of the following neural network, passing the given features as inputs to the network: features + Affine7sxx10 -> Softmax - class-confidences
In all processing, we first normalize the pixels' potential values to range from 0 to 1, then subtract the overall mean 0.1037, and finally divide by the standard deviation 0.3081. When displaying images, we reverse all these normalizations.
For training, we use random minibatches of 32 examples each, over 6 epochs of optimization (thus sweeping 6 times through all 60,000 examples from the training set of MNIST). We minimize the empirical average cross-entropy loss using AdamW of Loshchilov & Hutter (2019), with a learning rate of 0.001.
On the test set of MNIST, the average accuracy for classification without dithering 97.9% and with dithering is 9%.
9

---

Published in Transactions on Machine Learning Research (08/2024)
In Figures and 2 the size of the perturbation (either 1/200 or 1/1000) pertains to the Euclidean norm of ze in 12] In the limit that the size is O, the HCR bounds would become Cramér-Rao bounds (if the parameterizations of the neural networks were differentiable), as in 28 The results for the different sizes turn out to be reasonably similar.
Figure 1 histograms (over all examples the test set) the magnitudes of the HCR lower bounds on the standard deviations of unbiased estimators for the original images' values. The estimates are for the Fourier modes in discrete cosine transform (DCT) of type II, with the DCT normalized to be orthogonal linear transformation (meaning real and unitary or isometric). The modes of the DCT form an orthonormal basis suitable as a system of coordinates; note that these modes are for the normalized input images, standardized such that the standard deviation of the normalized pixel values is 1 and the mean is O. The histograms in the rightmost column of Figure [ consider only the 8 x lowest- freeus-fyy modes, whereas the histograms in the leftmost column consider all x 28.
Figure D shows that the bounds would have been reasonably effective had the pixels of the original images not been mostly almost pure black pure white (so that rounding away the obtained bounds denoises the estimates very effectively).
Figure 2 visualizes the HCR bounds on three examples from the test set. The visualization involves (1) adding to the modes of the DCT for the normalized original image the product of independent and identically distributed Rademacher variates (which are -1 with probability 1/2 and +1 with probability 1/2) times the corresponding HCR bounds, (2) inverting the DCT, and (3) reversing the per-pixel normalization back into the conventional perceptual space in which the values of pixels can range from 0 to 1 (while clipping negative values to 0 and clipping values excceding to 1). Figure illustrates that the obtained bounds are significant yet inelfective (mostly since thresholding the grayscale images to purely black-and-whiee would denoise away much of the displayed perturbations). In Figure 2 the noisy images (a), (b), (d), (e), (g), and (h) depict the best any adversary can reconstruct the noiseless inputs (c), (f), and (i) via an unbiased estimator.
3.2 CIFAR-10
This subsection presents the results of numerical experiments with the standard benchmark data set, "CIFAR-10," of Krizhessky (009)) CIFAR-10 contains images representing ten labeled classes airplanes, birds, boats, cars, cats, deer, dogs, frogs, horses, and trucks.
To calculate features for a given input, we use the activations in the last layer of the following neural network, adapted from the net of Shahrestani (2021): inputs + seroouuiionn2Dssscccamnndd..ssd + Convolution22ga> (0244chammee))55x((((m)e)e - ReLU + >> ReLU - Flatten
+
ReLU + (attmmmmmPPolnngnddxxxxrrriaeepo
MaximumPPolling2D, (xallingg)D)xxxtnddddea:...... 3 >> Convolution (02xxa07r(ccaauus)3333
+ Affine3072x3072 + ReLU - features ("Flatten" simply removes dimensions that are 1 in the shape of the tensor, in this particular casc.)
There are 3,072 entries both in the input vector for each image and in the corresponding features. The input images are 32 x 32 pixels, with three color channels (red, green, and blue).
Given the features, the classifier takes the argmax of the activations (values at the nodes) in the last layer of the following neural network, passing the given features as inputs to the network: features - Affinego12x10 + Softmax + class-confidences
In all processing, we normalize the pixels' potential values to range from 0 to 2 and then subtract 1, so that the resulting pixel values can range from -1 to 1. When displaying images, reverse all these normalizations,
For training, we use random minibatches of 32 examples each, over 7 epochs of optimization (thus sweeping 7 times through all 50,000 examples from the training set of CIFAR-10). We use the AdamW optimizer of Loshchilov Hutter (2019) with a learning rate of 0.001, minimizing the empirical average cross-entropy.
On 2,500 examples drawn random without replacement from the test set of CIFAR-10, the average accuracy for classification without dithering is 70% and with dithering is 50%.
10

---

Published in Transactions on Machine Learning Research (08/2024)
In Figures
3 and 1 the size of the perturbation (either 1/500 1/1000) pertains to the Euclidean norm of 2e in 12 The size 1/1000 is close to the limit in which HCR bounds would become Cramér-Rao bounds (if the parameterizations of the neural networks were differentiable), as in (28) The results for the different sizes are quite similar.
Figure histograms (over 2,500 examples from the test set) the magnitudes of the HCR lower bounds on the standard deviations of unbiased estimators for the original images' values. The estimates are for the Fourier modes in a discrete cosine transform (DCT) of type II, with the DCT normalized to be orthogonal (meaning real and umitary isometric). The modes of the DCT form orthonormal system of coordinates; note that these modes are for the normalized input images, standardized such that the normalized pixel values range from -1 to 1. The histograms in the rightmost column of Figure 3 consider only the 8 x 8 lowest-frequency modes, while the histograms in the leftmost column consider all 32 x 32.
Figure visualizes the HCR bounds on three examples from the test sct. As with Figure 2 the visualization involves (1) adding to the values of the modes in the DCT for the normalized original image the product of independent and identically distributed Rademacher variates with the corresponding HCR bounds on the standard deviations, (2) inverting the DCT, and (3) reversing the per-pixel normalization back to where the values of pixels in each color channel can range from 0 to 1 (clipping negative values to 0 and clipping values that are greater than 1 to 1). In Figure $ the noisy images (a), (b), (d), (e), (g), and (h) illustrate the best any adversary could reconstruct the noiseless inputs (c), (f), and (i) via an unbiased estimator.
Both Figure 3 and Figure show that the bounds are on the precipice of guarantecing that decent recon- structions of the original images are impossible from the dithered features.
3.3 ImageNet-1000 1000
This subsection presents the results of numerical experiments with the popular data set, "ImageNet-1000 of RRussakovsky et al. 2015). ImageNet-1000 contains a thousand labeled classes, each consisting of images representing a particular noun (such as a species or a dog breed).
All examples of the present subsection consider 128 examples from the validation set of ImageNet- 1000, drawing the examples uniformly at random without replacement. These 128 examples are more than sufficient to find that the HCR bounds for ImageNet are inelfective, allowing the dithered features to lead to full reconstructions that are imperceptibly different from the imput images. All models of the present subsection are trained on the training set of ImageNet; we downloaded the pre-trained networks from PyTTor'''s "model zoo" of TorchVision maintainers & contributors (2024). The input images get resized to be 91 x 91 pixels (with three color channels red, green, and blue) and then upsampled to be 224 x 224 pixels (with the same RGB color channels) for input to the pre-trained neural nets. There are slightly fewer degrees of freedom in image that has 91 x 91 pixels for each of three color channels than in the features of either of the pre-trained networks ("ResNet-18" 18" and "Swin-T") considered here. For pre-processing, we applied to the input images the usual normalizations from the model zoo of TorchVision maintainers & contributors (2024)
In Figures and 6 the size (either 1/500 or 1/1000) of the urbtuonation pertains to the Euclidean norm of =e in 12 The size 1/1000 is close to 0 close to the limit in which HCR bounds would become Cramér-Rao bounds (if the parametcrizations of the neural networks were differentiable), as in 28 The results of the different sizes are similar.
The following two subsubsections refrain from displaying analogues of Figures 2 and since visualizations of which reconstructions are possible (analogous to those of Figures 2 and turn out to be perceptually indistinguishable from the original images.
3.3.1 ResNet-16 18
This subsubsection uses the ResNet-18 of He et al. 20166) There are 24,843 entries in the input vector for each image and 25,088 entries in the corresponding features. The average (top-1) accuracy of classification without dithering is 57% and with dithering is 54%.
11

---

Published in Transactions on Machine Learning Research (08/2024)
Figure 3 histograms (over 128 examples from the validation set) the magnitudes of the HCR lower bounds on the standard deviations of unbiased estimators for the original images' values. The estimates are for the Fourier modes in an orthogonal discrete cosine transform (DCT) of type 11. The modes of the DCT form an orthonormal system of coordinates; note that these modes are for the normalized input images, standardized such that the standard deviation of the normalized pixel values is about 1 and the mean roughly The rightmost histograms in Figure consider only the 32 x 32 lowest-frqqeency DCT modes.
The bounds reported in Figure are useless for all practical purposes, providing next to no guaranteee of any protection against reconstruction attacks.
3.3.2 Swin-T T
This subsubsoction uses the Swin-T of Liu al. (2021). ). There are 24,843 entrics in the input vector for each image and 37,632 entries in the corresponding features. The average (lop-1) accuracy of classification without dithering is 64% and with dithering is 54%.
Figure 0 histograms (over 128 examples) the magnitudes of the HCR lower bounds on the standard devia- tions of unbiased estimators for the original images' values. The estimates are for the modes in an orthogonal discrete cosine transform (DCT) of type II. The modes of the DCT constitute an orthonormal basis appro- priate for a system of coordinates; note that these modes are for the normalized input images, standardized such that the standard deviation of the normalized pixel values is around and the mean is approximately 0. The rightmost histograms in Figure f filter down to the 32 x 32 lowest-frequency modes.
As with Figure 5 the bounds reported in Figure 6 provide effectively no guarantee of protection against reconstructing the input images.
4 Conclusion
The guarantees provided by the Ganmeesley-Chappan--obolll (HCR) bounds in the results presented above are sometimes on the precipice of being very useful, but are far from ideal. Theoretical understanding of why could be an interesting direction for future research. The results above consider only examples in which the neural networks are at least somewhat deep. The HCR bounds might be more useful a-priori for shallow neural-networks such as those corresponding to popular generalizod lincar models. However, for such models Cramér- Rao bounds are easy to calculate and simpler than the HCR analogues; none of the computational sophistication developed in the present paper is necessary to compute ideal Cramér-Rao bounds in such cases. Hannun et al. (2021) took this approach.
Thus, the HCR. approach appears to be ineffectual on its own. Perhaps the best use of the HCR bounds would be to supplement other, cruder techniques for enhancing privacy. An obvious such cruder technique would be to limit the sizes of the vectors of features. In the examples considered above, the sizes of the vectors of features are never less than the corresponding numbers of pixels in the images times the numbers of color channels. Tn the complete absence of noise, reconstructing the whole original images from the calculated features be possible only when the number of features is less than the number of pixel values being reconstructed (though, even then, computational cost might limit the feasibility of fulll reconstruction in practice). In the presence of noise, the HCR bounds rigorously limit the quality of the reconstruction. Yet the above results indicate that the bounds are fairly ineffectual for large models. A more effective strategy than relying exclusively on the HCR bounds could be to limit the sizes of the vectors of features. After all, the numbers of degrees of freedom in the original images that any scheme whatsoever can reconstruct from the corresponding features obviously cannot ever be greater than the sizes of the vectors of features. Dithering and the HCR bounds can nicely complement the limiting of the sizes of the vectors of features.
12

---

Published in Transactions on Machine Learning Research (08/2024)
MNIST filtered
MNIST unfiltered
250000
12000
number of modes
200000
number of modes
10000
8000
150000
6000
100000
4000
50000
0
0.0
0.2
1.0
1.5
bound on the standard deviation
bound on the standard deviation
iterations a perturbation 1/200
(b)
iterations with perturbation 1/200
MNIST filtered
MNIST unfiltered
250000
14000
number of modes
200000
number of modes
12000
10000
150000
8000
6000
100000
4000
50000
2000
0
0.0
0.2
0.4
0.6
0.8
1.0
bound the standard deviation
bound on the standard deviation
(c) 10 Iterations with a perturbation of 1/1000
(d) iterations with a perturbation 1/1000
Figure 1: Histograms of the HCR bounds over the 10,000 examples of MNIST's test set, both unfiltered and filtered to the x lowest-frequency modes of the type-2 discrete cosine transform; the numbers of iterations are the numbers of repetitions of LSQR in Subsection 2.2 which is the input in Algorithm
13

---

Published in Transactions on Machine Learning Research (08/2024)
(a) one, perturbed by 1/1000
(b) one, perturbed by 1/200
(c) one, unperturbed
4
(d) four, perturbed by 1/1000
(c) four, perturbed by 1/200
(f) four, unperturbed
1991
(g) nine, perturbed by 1/1000
(h) nine, perturbed by 1/200
(i) nine, unperturbed
Figure 2: Reconstructions of examples from MNIST's s test set
14

---

Published in Transactions on Machine Learning Research (08/2024)
CIFAR10 filtered
CIFAR10 unfiltered
8000
150000
number of modes
number modes
125000
6000
100000
4000
75000
50000
2000
25000
0
0.00
0.05
0.10
0.15
0.20
0.25
0.0
0.1
0.2
0.3
bound on the standard deviation
bound on the standard deviation
(a) iterations with a perturbation of 1/500
(b) iterations a perturbation 1/500
CIFAR10 filtered
8000
CIFAR10 unfiltered
140000
number of modes
6000
120000
number of modes
100000
4000
80000
60000
2000
40000
20000
0
0.00 0.05
0.10
0.15
0.20
0.25
0.0
0.1
0.2
0.3
bound on the standard deviation
bound on the standard deviation
(c) itcrations with perturbation of 1/1000
(d) itcrations with perturbation of 1/1000
Figure 3: Histograms of the HCR bounds over 2,500 examples from CIFAR-10's test set, both unfiltered and filtered to the x lowest-frequenc, modes of the type-2 discrete cosine transform; the numbers of iterations are the numbers of repetitions of LSQR in Subsection 2.2 which is the input i in Algorithm
15

---

Published in Transactions on Machine Learning Research (08/2024)
(a) airplane, perturbed by 1/1000 (b) airplane, perturbed by 1/500
(c) airplane, unperturbed
(d) bird, perturbed by 1/1000
(e) bird, perturbed by 1/300
(f) bird, unperturbed
(g) boat, perturbed by 1/1000
(h) boat, perturbed by 1/500
ii) boat, unperturbed
Figure 4: Reconstructions of examples from CIFAR-10's test sct
16

---

Published in Transactions on Machine Learning Research (08/2024)
ResNet18 filtered
ResNet18 unfiltered
70000
6000
60000
number of modes
50000
number of modes
5000
40000
4000
30000
3000
20000
2000
10000
1000
0
0.000
0.005
0.010
0.015
0.020
0.000
0.005
0.010
0.015
0.020
bound on the standard deviation
bound on the standard deviation
(a) iterations a perturbation 1/500
(b)
iterations with perturbation 1/500
ResNet18 filtered
ResNet18 unfiltered
80000
7000
number of modes
60000
number of modes
6000
5000
4000
40000
3000
20000
2000
1000
0
0.000 0.005
0.010
0.015 0.020
0,000
0.005
0.010
0.015 0.020
bound the standard deviation
bound the standard deviation
(c) 10 iterations with a perturbation of 1/1000
(d) 10 iterations with a perturbation of 1/1000
Figure 5: Histograms of the HCR bounds over 128 examples from ImageNet's 's validation set, using a ResNet- 18, both unfiltered and filtered to the 32 x 32 lowest-frequcne modes of the type-2 discrete cosine transform: the numbers of iterations are the numbers of repetitions of LSQR in Subsection 2.2 which is the input in Algorithm !
17

---

Published in Transactions on Machine Learning Research (08/2024)
Swin T filtered
Swin_ T unfiltered
60000
6000
number of modes
50000
number of modes
5000
40000
4000
30000
3000
20000
2000
10000
1000
0
0.000 0.002 0.004 0.006 0.008 0.010
0.000 0.002 0.004 0.006 0.008 0.010 bound on the standard deviation
bound on the standard deviation
(a) iterations a perturbation 1/500
(b)
iterations with perturbation 1/500
Swin_T filtered
Swin T unfiltered
70000
6000
60000
number of modes
number of modes
5000
50000
4000
40000
3000
30000
2000
20000
10000
1000
0
0.000 0.002 0.004 0.006 0.008 0.010 bound the standard deviation
0,000 0.002 0.004 0.006 0.008 0.010 bound the standard deviation
(c) 10 iterations with a perturbation of 1/1000
(d) 10 iterations with a perturbation of 1/1000
Figure 6: Histograms of the HCR bounds over 128 examples from ImageNet's 's validation set, using Swin-T, both unfiltered and filtered to the 32 32 lowest-frqquency modes of the type-2 discrete cosine transform: the numbers of iterations are the numbers of repetitions of LSQR in Subsection 2.2 which is the input in Algorithm !
18

---

Published in Transactions on Machine Learning Research (08/2024)
Broader impact concerns
Probably the greatest risk in promoting the approach of the present paper is for overstated claims of the exlent to which adding noise to features protects the confidentiality of inputs to inference with machine- learned models. For example, in the absence of any accompanying visual presentation to illuminate the raw numbers, unwary users might get deccived by the numerical bounds obtained for the ResNet-18 Swin-T when trained and run on ImageNet-1000 as in Subsection 3.3 above. Indeed, the users might not realize that the obtained bounds are largely vacuous, especially if they fail to think about what the numbers actually mean (that is, just because the bounds give trustworthy, correct, hard numbers does not mean that the numbers are useful). As shown in Subsection 3.3 the bounds do not rule out making reconstructions of the inputs to inference that are imperceptibly different. from the original inputs, even when adding the greatest possible amount of noise to the features which still has negligible impact on the resulting accuracy of classification.
A technique for enhancing confidentiality (such as adding noise) should not be claimed to be fully "privacy- preserving" when in fact the resulting protection of privacy is weak or is strong only with respect to certain narrow concerns such as re-identification Unfortunately, misleading, deceplive overselling is common in "privacy washing," as defined and discussed, for example, by Mozilla Foundation (2023). All that said, this risk from Saaeenerlll---haaa----- Robbins bounds is likely minimal, since the bounds are so easy interpret, directly bounding the variance of any unbiased estimator whatsoever... ... and anyone can understand variance.
Still, the most popular means of preserving confidentiality may be the old standby, encryption. Any claims of protecting privacy via adding noise to features without harming the accuracy of classification should make clear that the level of protection attained is unlikely to match what cryptography could provide. Dithering features does not yield the same level of confidentiality as the familiar cryptosystems and should not. be misrepresented as providing as much privacy as the ubiquitous gold-standard, encryption.
Acknowledgements
We would like to thank Awni Hannun, Edward Suh, the editors, and the reviewers.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, 1lya Miranov, Kunal Talwar, and Li Zhang, Deep learning with differential privacy. In Edgar Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew Myers, and Shai Halevi (eds.), Proceedings of the 2016 ACM SIGSAC Conference on Compuler and Communications Security (CCS), pp. 308-318, 318. Association for Computing Machinery, 2016.
Rijad Alisic. Privacy of Sudden Events in Technology, 2021. This is actually a "licentiate thesis" part of Ph.D.
Systems. PhD thesis, KTH Royal Institute of
Rijad Alisic, Marco Molinari, Philip F. Paré, and Henrik Sandberg. Maximizing privacy in MTMO cyber- physical systems using the Chapman- Robbins bound. In Richard D. Braatz, Chung Choo Chung, Jay H. Lee, and Luca Zaccarian (cds.), Proceedings of the 2020 59th IEEE Conference on Decision and Control (CDC), pp. 6272 6277. IEEE, 2020.
Douglas G. Chapman and Herbert Robbins. Minimum variance estimation without regularity assumptions. Ann. Math. Stat., 22(4):581158) 1951.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sei. 0(3-4):211-407 2014.
John M. Hammersley. On estimating restricted parameters. J. R. Stat. Soc. Ser. B, 12(2):192 240, 1950.
Awni Hanmun, Chuan Guo, and Laurens van der Maaten. Measuring data leakage in machine-learning models with Fisher information. In Cassio de Campos and Marloes H. Maathuis (ods.), Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence, volume 161 of Proceedings of Machine Learning Research, pp. 760-770 -700. Microtome Press, 2021.
19

---

Published in Transactions on Machine Learning Research (08/2024)
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the 29th IEFF Conference on Computer Vision and Pottern Recognilion (CVPR), pp- 770 778. IEEE Computer Society, 2016.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical Report Master's Thesis, University of Toronto Department of Computer Science, 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- learning applied to docu- ment recognition. Proc. IEEE, 86(11):22782388 1998.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin Transformer: hierarchical vision Transformer using shifted windows. In Proceedings of the 2021 IEEE/CVP International Conference on Computer Vision (ICCV), pp. 100022 IEEE Computer Society, 2021.
Nya Loshchilov and Frank Hutter. Decoupled weight decay regularization. Technical Report 1711.05101, arXiv, 2019. Also published as a poster and paper at the 2019 International Conference on Learned
Representations (ICLR).
Mozilla Foundation. Privacy nightmare wheels: every brand reviewed by Mozilla including Ford, Volkswagen, and Toyota flunks privacy test. Blog post (see the section on privacy washing), Septem- ber 2023. wttp://wwww.....o..ooeoo.oooooio rraaddreviewwdd-yie
oher:/aaarrrrooteeeeeeeeeeeerrrr and-aaa-gee-----oooota-aaa-a toyota foyota-flunks flunks- prinnks-rrivacy-tesee
Christopher C. Paige and Michael A. Saunders. LSQR: algorithm for sparse linear equations and sparse least squares. ACM Trans. Math. Softw., 8(1):33 71, 1982.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet large scale visual recognition challenge. Ird. J. Comput. Vis., 115(3):211 (111)2211222222 252, 2015.
Afshin Shahrestani. Classifying CIFAR-10 using a simple CNN. Blog post on the web-only pub- lisher Medium's series, Analyties Vidhyaa August 2021. https: https://medi: htpps://mmdiumm www/comm//c///c hhmm/aaalytic-idhyaa
TorchVision maintainers and contributors. TorchVision: PyTorch's computer vision library. Repository on GitHub, 2024. httpe://ggtaab..co//yyrroo/////p
Wikipedia contributors. Chapman-Robbins bound. Accessed online via the world wide web in August 2024 al / http:///waaaaaaaaoaaao/////////p bound, 2024.
20


Reviews:
[{"review_id": "gS9Y34sT0n", "reviewer": "Reviewer_Pz2W", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "+ HCR method proposed here is alternative to the use of Fisher information and the Cramér-Rao bound.  CR bound is most useful when a quadratic form specified by the Fisher information matrix is a good approximation to the expected loss (the risk function) near the parameters at which the Fisher information is evaluated. HCR bound are typically tight whether or not a quadratic form specified by Fisher information is a good approximation. HCR bounds will always exist while CR bounds exist only for sufficiently smooth loss. \n\n+ HCR method is also computationally more efficient when compared to evaluating the Fisher information for complex ML models such as deep neural networks. The approach proposed below avoids most of the difficulties and is computationally tractable. \n\n+ For a special case whether the dithering noise is additive and some other technical conditions, an analytical simplified expression is computed and for more general case, Monte Carlo can be used to compute the denominator. \n\n+ A detailed experimental evaluation is conducted. In itself, the effectiveness of the HCR approach is shown to be unclear.  The paper concludes that the best use of the HCR bounds  in enhancing the privacy would be to supplement other, cruder techniques, for example, by limiting the sizes of the vectors of features. The experimental results show that the sizes of the vectors of features are more than the corresponding numbers of pixels in the images times the numbers of color channels. \n\nThe reviewer appreciates the paper's attempt to describe an observation coupled with objective evaluation that would be useful to researches in the field, rather than the usual practice of proposing a method and defending it through experiments.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Ensuring privacy at inference-time with deep neural networks can be achieved by adding noise to the activations in the last layers (features/embeddings) before the final classifiers or other task-specific layers. The features become more secure when noise is introduced and reconstruction becomes difficult. The confidentiality provided by this noise can be quantified by lower bounding the variance of every possible unbiased estimator of the inputs. Convenient and computationally manageable bounds, known as Hammersley and Chapman-Robbins (HCR) bounds, are derived from classic inequalities.  The empirical evaluation show that HCR bounds are nearly effective for small neural networks with datasets like MNIST and CIFAR-10, each containing 10 classes for image classification. The HCR bounds alone appear insufficient to guarantee the confidentiality of inputs for standard deep neural networks like ResNet-18 and Swin-T, pre-trained on the ImageNet-1000 dataset, which includes 1000 classes. In all scenarios, the results discussed here consider only those levels of added noise that minimally impact the accuracy of classification from the noisy features. Thus, the noise enhances confidentiality without significantly reducing the accuracy of image classification tasks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The reviewer suggests bringing Appendix A into the main body of the paper and moving some of the qualitative results in experiments to the appendix.", "broader_impact_concerns": "There are no broader impact concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "RIHiGbff44", "reviewer": "Reviewer_4BWa", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written and easy to understand.\n- It is important to demonstrate both the ineffectiveness and applicable scenarios of HCR bounds.\n\nWeaknesses:\n- There are missing scenarios with HCR bound confidentiality, such as the application to small datasets like MNIST in deep neural networks and large datasets like ImageNet-1000 in shallow networks.\n- It would be beneficial to include more theoretical proof of HCR bounds' ineffectiveness in deep networks, alongside the experimental analysis.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Adding noise to the activations in the last layers of deep neural networks can protect input privacy during inference. This method's confidentiality is quantified using HCR bounds. While HCR bounds are nearly effective for small networks using MNIST and CIFAR-10 datasets, this paper proves they are insufficient for larger models like ResNet-18 and Swin-T on ImageNet-1000.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See above weaknesses.", "broader_impact_concerns": "NA.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "KpiGkwh0Hl", "reviewer": "Reviewer_9A9a", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. Theoretical Rigor: The paper provides a detailed theoretical framework for applying HCR bounds to neural network features, showing a solid understanding of statistical bounds and their implications for privacy.\n\n2. Practical Relevance: The study addresses a crucial aspect of machine learning—privacy during inference—offering insights into practical applications for protecting sensitive data.\n\n3. Comparative Analysis: By comparing HCR bounds with other privacy-preserving techniques like the Cramér-Rao bound, the paper situates its contributions within the broader context of privacy research.\n\n4. Empirical Validation: The authors conduct extensive numerical experiments on well-known datasets, providing empirical evidence to support their theoretical claims.\n\nWeaknesses:\n\n1. Limited Effectiveness for Complex Models: The paper admits that HCR bounds alone are insufficient for guaranteeing confidentiality in more complex models and datasets, such as ResNet-18 and Swin-T on ImageNet-1000.\n\n2. Over-Reliance on Noise Addition: The approach heavily relies on adding noise, which may not be the most efficient or practical method for all applications. The noise levels that maintain accuracy also limit the effectiveness of privacy guarantees.\n\n3. Lack of Generalization: The results are specific to the datasets and models used in the experiments. It is unclear how the approach would perform on other datasets or in different contexts.\n\n4. Vague Practical Recommendations: While the paper suggests supplementing HCR bounds with other techniques, it lacks concrete guidelines or strategies for effectively combining these methods.\n\n5. Inadequate Visual Illustrations: While the paper includes histograms and visualizations, these do not sufficiently convey the practical impact of the bounds on confidentiality.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper \"Guarantees of Confidentiality via Hammersley-Chapman-Robbins Bounds\" explores the application of Hammersley-Chapman-Robbins (HCR) bounds to quantify privacy in neural network inferences. By adding noise to the final layers of neural networks, the authors aim to prevent the reconstruction of inputs from noisy features. They demonstrate the application of HCR bounds to several standard datasets, including MNIST, CIFAR-10, and ImageNet-1000, and provide both theoretical formulations and experimental results. The study concludes that while HCR bounds can offer some privacy guarantees, they are insufficient on their own for more complex models and larger datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Critical Changes:\n\n1. Explore Alternative Noise Addition Techniques: Investigate and compare other noise addition methods that could complement the HCR bounds, particularly for complex models and large datasets.\n\n2. Improve Visual Representations: Provide clearer and more impactful visualizations of the confidentiality guarantees to better illustrate the practical implications of the findings.\n\nStrengthening Changes:\n\n1. Detailed Comparison with Differential Privacy: Include a more in-depth comparison of the HCR bounds with differential privacy techniques to highlight relative strengths and weaknesses.\n\n2. Expanded Discussion on Practical Limitations: Offer a more detailed discussion on the practical limitations of the HCR bounds and potential ways to mitigate these issues.", "broader_impact_concerns": "The Broader Impact Statement section is included in this paper, and it is sufficient.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: I apologize to the authors for the delay in reaching a decision on this paper. While all three reviewers provided their reviews in a timely fashion, one reviewer failed to ever provide an official recommendation, and I finally had to make the decision based on only two reviewers.

The two reviewers who did supply final recommendations appreciate the effort that went into the revision, including a significant reorganization of the paper, and unanimously recommend acceptance.

One reviewer also recommends a reproducibility certification, and I concur.
Decision: Accept (poster)