Title: Reimagining Mutual Information for Enhanced Defense against Data Leakage in Collaborative Inference
Venue: NeurIPS 2024
Accepted: yes
Keywords: Collaborative inference
Abstract: Edge-cloud collaborative inference empowers resource-limited IoT devices to support deep learning applications without disclosing their raw data to the cloud server, thus protecting user's data. Nevertheless, prior research has shown that collaborative inference still results in the exposure of input and predictions from edge devices. To defend against such data leakage in collaborative inference, we introduce InfoScissors, a defense strategy designed to reduce the mutual information between a model's intermediate outcomes and the device's input and predictions. We evaluate our defense on several datasets in the context of diverse attacks. Besides the empirical comparison, we provide a theoretical analysis of the inadequacies of recent defense strategies that also utilize mutual information, particularly focusing on those based on the Variational Information Bottleneck (VIB) approach. We illustrate the superiority of our method and offer a theoretical analysis of it.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe collaborative inference enables resource-constrained IoT devices to support deep learning applications without sharing raw data with the cloud server, but previous research has revealed that this approach still leaks input and prediction information from edge devices. To address this vulnerability, the authors propose InfoScissors, a defense strategy designed to minimize the mutual information between a model's inner states and the device's input and outputs. The effectiveness of InfoScissors is evaluated on common datasets like CIFAR10/100 against various attacks, demonstrating its superiority over existing defense strategies that utilize mutual information. The paper also provides theoretical analysis to support the proposed method.\n\nSTRENGTHS:\n+ Study of an important privacy issue in collaborative inference.\n\nWEAKNESSES:\n- The novelty of proposed method is somehow limited. The proposed defense InfoScissors relies on the Mutual Information (MI) regularization that has been explored in previous study like MID. The paper directly adopts a new formulation [38] for the upper bound of MI terms. As a result, the novelty and contribution of this paper appear to be limited. Compared to previous VIB-based approaches, even though the authors manage to find out several advantages  and provide a theoretical explanation, the challenges are not clear.\n\n\n- Limited evaluation of adaptive attack, making the robustness of proposed defense InfoScissors doubtful. The only mention of adaptive attack is the AMC attack, but there is not many details about the adaptive attack. A strong adversary can follow the proposed method to train surrogates classifier and generator to mimic the victim's data. I suggest the authors to clarify the adversary capacity and thoroughly evaluate the potential privacy breach after the method is known by the adversary.\n\n- Limited evaluation of benchmarks. The paper only evaluates on the simple benchmark like CIFAR10/100 but not more large-scale dataset like ImageNet. The model architecture evaluation is also important to demonstrate the scalability of proposed defense. Also, it seems that the method is only evaluated on the vision classification models, is it applicable to generative model or other tasks? If so, what is the cost of efficiency and accuracy?\n\nQUESTIONS:\nSee comments above\n\nLIMITATIONS:\nNone", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers a setting where two parties (Cloud Server and Edge Device) are collaboratively training a deep model. The threat model considers both inputs and outputs to be private data of the Edge Device that should be protected from the Cloud Server. The authors propose a learning algorithm that is theoretically motivated by a recent method called CLUB [38], and performs better than other baselines on two datasets CIFAR10 and CIFAR100.  The main contribution of this paper is that the authors show CLUB offers better optimization results compared to Variational Information Bottleneck (VIB).\n\nSTRENGTHS:\nThe paper is well written, easy to follow, and relevant to the ML community. The baselines are studied and elaborated properly. The algorithm is supported both empirically and theoretically and the results suggest state-of-the-art performance. Overall, I am happy about this work and I appreciate the author's hard work and novelty.\n\nWEAKNESSES:\nThe main weaknesses are motivation of the problem and the evaluations of the algorithm. The paper needs some improvements in this regard. Please see below.\n\nQUESTIONS:\n(1) One important, but totally ignored, aspect of the proposed framework (Figure 1) is that the Cloud Server can run the classifier part (that is \\theta^c) and easily discover y without needing any sophisticated attack. Unless, the authors argue that the classifier part is not available to Cloud Server! Which is a strong and unrealistic assumption because usually the server is the entity that trains the model and then splits it among the Edge devices.  I am struggling to find a real-world application in which the Edge Device has access to the classifier part but the Cloud Server does not have that access. Authors need to clarify and motivate this.\n\n(2) When reading the paper, it is not clear to distinguish between training vs. inference stage. The title mentions “Collaborative Inference”, but the paper is actually more related to “Collaborative Training”. The fact that two parties (Cloud Server and Edge Device) are collaborating in training a model or they are collaborating in making a prediction (via a trained model in inference mode) makes a huge difference in terms of threat model and evaluation. The authors need to revise the text and make this as clear as possible from the beginning of the paper. It is also suggested to discuss relevance to a work published last year https://arxiv.org/abs/2310.13384 (Salted Inference: Enhancing Privacy while Maintaining Efficiency of Split Inference in Mobile Computing)\n\n(3) The authors should compare and clarify the contribution of this paper compared to Club [38]. They should explain to what extent the theoretical analysis of this paper is novel compared to what has been already presented in [38].\n\n(4) The paper should show the performance of the work on more complex data types. The two chosen datasets are of similar complexity. Similarly, beside ResNet 18, other model architectures should be examined. It is not clear if this method only works for ConvNets or whether it supports other types of layers.\n\n(5) In Figure 3, it is not clear what is the difference between different rows. For each method there are three pairs of images and results, but how different are these and in what sense?\n\nLIMITATIONS:\nThe main limitation is that the generalization of the method to other complex datasets and model architectures is not explored or discussed.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

comments: SUMMARY:
This paper provides InfoScissors, a learning algorithm that regularizes the model during the training phase. This paper also compares their method with VIB-based methods and evaluates it with multiple attacks.

STRENGTHS:
The paper provides the theoretical analysis for the defense method and also compares it with VIB-based methods.

WEAKNESSES:
The author claims that LLMs cannot be handled on edge devices; however, in the evaluation part, they only use CIFAR10 and CIFAR100, both of which can be handled by edge devices. The paper does not measure the method with real large-size datasets.

QUESTIONS:
No

LIMITATIONS:
The paper does not measure the method with real large-size datasets.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-13