Title: ObCLIP: Oblivious CLoud-Device Hybrid Image Generation with Privacy Preservation
Venue: NeurIPS 2025
Accepted: yes
Keywords: Text-to-image

diffusion model

prompt privacy
Abstract: Diffusion Models have gained significant popularity due to their remarkable capabilities in image generation, albeit at the cost of intensive computation requirement. Meanwhile, despite their widespread deployment in inference services such as Midjourney, concerns about the potential leakage of sensitive information in uploaded user prompts have arisen. Existing solutions either fail to strike an effective balance between utility and efficiency, or lack rigorous privacy guarantees. 

To bridge this gap, we propose ObCLIP, a plug-and-play safeguard that enables oblivious cloud-device hybrid generation scheme.
By oblivious, each input prompt is transformed into a set of semantically similar candidate prompts that differ only in sensitive attributes (e.g., gender, ethnicity). The cloud server processes all candidate prompts without knowing which one is the real one, thus preventing any prompt leakage. To mitigate server cost, only a small portion of denoising steps is performed upon the large cloud model. The resulting intermediate latents are then transmitted back to the device, which selects the targeted latent and completes the remaining denoising using a small local model to obtain the final image. Additionally, we analyze and incorporate several cache-based accelerations that leverage temporal and batch redundancy, effectively reducing computation cost with minimal utility degradation. Extensive experiments across multiple datasets demonstrate that ObCLIP provides rigorous privacy and comparable utility to large cloud models with slightly increased server computation.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper tackles text-to-image generation via diffusion models with a focus on improving privacy and maintaining efficiency in a hybrid cloud-client generation pipeline.\nTo preserve privacy, the paper proposes to obfuscate sensitive attributes in the text prompts (e.g., concerning gender, age, ethnicity, etc.) by generating a set of augmented prompts where the sensitive attributes are randomly replaced\nTo offset the heavy increase in compute cost such a simple approach would cause, the paper uses a combination of hybrid generation (where some steps are performed in the cloud and some on a device on a smaller model) and techniques to leverage redundancy in the diffusion process on the server side (i.e., due to similar semantics among the set of augmented prompts and redundancy among different diffusion steps). \nExperiments are performed on various combinations of server/client models on MS-COCO and MJHQ, and the proposed approach is compared primarily to baselines consisting of full server/client-side generation and existing hybrid approaches.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper is well presented and easy to follow. \n- The approach to increase privacy through prompt augmentation is sensible and straightforward. Techniques to leverage redundancy in the resulting set of prompts (some of which appear to be novel) also make sense and appear effective in accelerating server-side computation and reducing the negative impact on overall compute. \n\n\nWeaknesses:\n- A bit unclear what the novel technical contributions are. Many of the techniques used for improving the efficiency of the system appear to be from existing works (i.e., the hybrid processing and leveraging temporal redundancy in the diffusion process). The paper appears to be more a combination of existing techniques to a large extent (which is ok, but limits technical contributions). \n- Comparison to HE-Diffusion and other methods listed in Table 1 is lacking. It is unclear why only latency is considered for HE-Diffusion in Table 2. It also appears from Table 1 that the MPC methods would be preferable (though I might misunderstand the meaning of some of the columns). \n- The qualitative examples shown are not very convincing in my opinion. For example, it is not obvious that one of the examples in Fig. 3b is clearly better than the other (both show obvious defects). \n- Though the approach is sensible (i.e., obfuscation by augmentation + improve efficiency via hybrid processing), it is also rather straightforward, and the paper therefore does not provide a lot of novel insights. \n- Given that the obfuscation mechanism appears to be a key contribution, I found that there is limited detail and evaluation of the approach. It appears to be rule-based and relies on some prior model to find sensitive attributes. This seems potentially rather limiting, and I have some doubts about the generality of it. For example, while Fig. 8 highlights \"young\" as a sensitive attribute (age), the information that the person should be 18 years old is not highlighted (though it is likewise referring to age).\n\nQUESTIONS:\nIt would be great if the authors could address some of my concerns listed in the weaknesses above. In particular, I would like to know better about:\n- How the method compares to prior work like HE-Diffusion?\n- What are the novel technical contributions?\n- What are the limitations of the obfuscation approach to identify and replace sensitive attributes?\n\nLIMITATIONS:\nI mentioned some potential technical limitations above. I don't see any negative societal impacts from the work.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes ObCLIP to achieve privacy protection in image generation scenarios under the cloud - device hybrid architecture. The method leverages the collaboration between the obfuscation of multiple prompts and the Oblivious computing mechanism to construct a cloud-device collaborative privacy-enhancing framework, which obfuscates and hides user generation intent (prompt) and computing processes to resist privacy leakage risks. ObCLIP consists of components such as the local processing module on the device side and the cloud-side collaborative generation module. Experiments show that ObCLIP can effectively reduce the privacy leakage risks of user prompts and generation processes while maintaining the quality of image generation.\n\nSTRENGTHS AND WEAKNESSES:\nPros：\n - The paper is clearly written.\n - Uses a cloud–device hybrid pipeline where the server only handles partial denoising and the client completes the rest, cutting server load without compromising generation quality.\n - Integrates cache-based accelerations exploiting temporal and batch redundancies to drastically reduce server-side computation with minimal impact on utility.\nCons:\n  - Insufficient innovation in core privacy mechanism. The paper relies on generating multiple prompts to obfuscate the real prompt as the core privacy method. Relying solely on prompt-level obfuscation, this single-dimensional strategy shows limited innovation in resisting attacks that exploit prompt correlations or sequences.\n - The paper uses single-dimensional attributes (e.g., age, gender) for illustration. Real-world privacy risks involve multi-attribute correlations and temporal prompt patterns. Limiting experiments to simple cases fails to validate defense against complex threats, weakening applicability in vertical domains.\n - Limited generative model generalization: The paper conducts experiments mainly on specific Stable Diffusion models, while not extending to other mainstream generative architectures (such as Transformer-based DALL-E-like models or hybrid-structured generative framewo\n\nQUESTIONS:\n- The experiments mainly use single - dimensional attributes like age and gender for illustration. But real - world privacy risks often involve multi - attribute correlations and temporal prompt patterns.\n- Could you extend your experiments to more complex scenarios involving multi - attribute correlations? For instance, in a healthcare domain where patient information includes age, gender, medical history, and treatment records, how would your method perform in protecting privacy against potential threats that exploit correlations among these attributes? Including such experiments would strengthen the applicability of your work in vertical domains.\n\n- The experiments are mainly conducted on specific Stable Diffusion models, without extending to other mainstream generative architectures such as Transformer - based DALL - E - like models or hybrid - structured generative frameworks.\n- What are the key differences between Stable Diffusion models and other mainstream generative architectures like DALL - E - like models that might affect the performance of your privacy protection method? A detailed comparison and analysis would be beneficial.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel cloud-device collaborative framework for image generation. By splitting the diffusion process between the device and the cloud, the framework enhances prompt privacy while reducing server-side costs. To further protect private prompts, the paper proposes an oblivious prompt transformation and a local feature extraction strategy. Additionally, two acceleration techniques are developed to reduce computational overhead.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nS1: The paper presents a novel and well-motivated cloud-device collaborative framework for image generation, which effectively protects prompt privacy and reduces computational costs.\n\nS2: The paper is well organized and clearly written, making it easy to follow.\n\nS3: Experimental results demonstrate both the effectiveness and efficiency of the proposed method.\n\nWeaknesses:\n\nW1: The privacy guarantee heavily depends on the completeness of candidate prompt enumeration. In scenarios involving high-dimensional sensitive attributes, the exponential growth of the candidate set may either weaken privacy protection or lead to significant computational overhead, resulting in a fundamental trade-off that is difficult to resolve.\n\nW2: Some important implementation details are missing. For instance, it remains unclear how the oblivious prompt transformation can be applied in general scenarios. The paper only provides dataset-specific implementations in the experimental section, without offering broader methodological guidance.\n\nQUESTIONS:\nPlease address the identified weaknesses. Additionally, I have the following questions:\n\n1. How is the diffusion process divided between the device and the cloud in general scenarios? A more detailed explanation should be supplemented.\n2. How many devices were used in the experiments? Does the distribution of client data have a significant impact on performance?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-18"}