Title: Deep Learning with Plausible Deniability
Venue: NeurIPS 2025
Accepted: yes
Keywords: Privacy

Plausible Deniability

Privacy-Preserving Machine Learning
Abstract: Deep learning models are vulnerable to privacy attacks due to their tendency to memorize individual training examples. Theoretically-sound defenses such as differential privacy can defend against this threat, but model performance often suffers. Empirical defenses may thwart existing attacks while maintaining model performance but do not offer any robust theoretical guarantees.

In this paper, we explore a new strategy based on the concept of plausible deniability. We introduce a training algorithm called **P**lausibly **D**eniable **S**tochastic **G**radient **D**escent (PD-SGD). 
The core of this approach is a rejection sampling technique, which probabilistically prevents updating model parameters whenever a mini-batch cannot be plausibly denied. We provide theoretical results showing that PD-SGD effectively mitigates privacy leakage from individual data points. Experiments demonstrate the scalability of PD-SGD and the favorable privacy-utility trade-off it offers compared to existing defense methods.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Plausibly Deniable Stochastic Gradient Descent (PD-SGD), a training procedure that attaches a mini-batch–level “plausible deniability” test to every stochastic-gradient update. Concretely, the seed batch’s gradient is first perturbed with isotropic Gaussian noise; the update is accepted only if at least T other batch gradients fall within a log-density band of width γ around the noisy seed gradient, otherwise the step is rejected altogether. This rejection-sampling view allows the authors to derive an differential-privacy guarantee under mild conditions while avoiding per-example clipping and thus supporting non-decomposable losses. Three hyper-parameters—noise scale, band width, neighbour count—govern the privacy–utility trade-off and can be tuned heuristically by monitoring the rejection rate.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. PD-SGD sounds to be conceptually novel: by enforcing a batch must be indistinguishable from several others before its gradient is used, it turns plausible deniability into a practical optimisation rule.\n2. Experiments on CIFAR-10/100 (Vision Transformers and Wide-ResNets) and Purchase-100 (linear model) show that PD-SGD matches or exceeds the test accuracy of empirical defenses (AdvReg, SELENA) while lowering four standard membership-inference attack scores and vastly outperforming DP-SGD at comparable privacy budgets.\n3. The logic of this paper is clear, the explanatory figures can help readers understand, and the literature review is comprehensive.The experimental section of this paper provides a wealth of details and ablation studies, which enhances its credibility. \n\nWeaknesses:\nThe paper lacks persuasiveness in some places.\n1. Theoretical contributions. The author claims that “to the best of our knowledge, no existing defense mechanism simultaneously offers a theoretically justified guarantee and maintains good model utility.”, which seems to show the significance of this work. However, I suspect that the author has overstated the theoretical contributions of the paper. Although the author elaborates on the theoretical significance in Section 4.1, I would like to know further whether the theory of this paper employs any inspiring mathematical tools or techniques that can distinguish its theoretical contributions from other papers? Otherwise, I will question the novelty of the theory of this paper. Also, the theoretical derivations in the appendix seems to be relatively straightforward, making it difficult to justify the theoretical novelty. \n2. Experiment. The author seems not to have provided comparisons of the method in terms of computational resources and memory. Each iteration still requires computing gradients for all mini-batches to perform the plausibility test, which the authors acknowledge and evaluate in Appendix F.4, implying non-trivial time and energy overhead on large or distributed workloads.\n3. Scalability. Empirical evaluation focuses on black-box membership-inference attacks against medium-scale vision and tabular models; robustness to stronger white-box or property-inference attacks, and scalability to very large language or generative models, remain untested\n\nQUESTIONS:\nSee the weakness.\n\nLIMITATIONS:\nSee weakness", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel empirically-effective privacy framework called PD - plausible deniability, and a privacy preserving training algorithm under this framework, PD-SGD. On an intuitive level, models trained under PD have the property that training data points within any mini-batch is not significantly \"different\" under gradient based white-box (i.e. has model weight access, I'm a bit confused by the author's definition of blackbox vs whitebox, but that of tangential interest here) membership inference attacks. Mathematically, this notion can be expressed by the existence of at least T alternative minibatches that falls within a certain Euclidean distance within the target batch, such that their log-density under a normal perturbation model has bounded change. Methodologically, this is implemented by a DP-SGD-like Graussian perturbation followed by rejection sampling of batches with outlier gradients. Empirically, models trained by PD-SGD obtain favorable privacy-utility trade-offs compared to other empirically and theoretically guaranteed defense mechanisms against MI attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper explains various properties of the proposed PD framework in reasonable detail.\n2. Compared to other empirically motivated defense mechanisms, PD-SGD shows competitive performance while being more up-right under theoretical examination. Compared to DP-based methods, PD-SGD provides clear performance benefits in privacy-utility trade-off. \n3. Experimental evaluations of PD-SGD is fairly thorough on common architectures and datasets, with multiple MI attack methods as benchmark.\n\nWeaknesses:\n1. PD falls short of a \"attack-agnostic\" privacy framework due to it's definition being reliant on a source pool of mini-batches, which seems quite specific to a particular configuration of the MI setting. If the imaginary attacker do not have the same pool of mini-batches as the model provider, (or even better/worse, the attacker has only one target data batch and wants to know if it has been used in the training of the model), then there is no such notion of \"d\" in equation 4, hence no clear way quantify the privacy afforded by PD. This is in contrast to DP, which is agnostic to attacker knowledge.\n2. The baselines in the experiments are quite dated. Various improved alternatives to SELENA and ADVReg have been proposed in the literature since 2023 that also out-perform these two baselines in privacy-utility trade-offs.\n3. The proposed method PD-SGD has an unfavorable privacy-compute trade-off, in that narrowing the threshold $\\gamma$ results in more gradient comparisons needed before a minibatch is rejected. In the extreme case where $\\gamma$ is too low, the algorithm would traverse through the entire dataset for each gradient step. Storing gradients is also not feasible for modern models in the Billions parameter range. Some form of caching, embedding and efficient search strategies should be discussed to make the proposed method more practical.\n\nQUESTIONS:\n1. Comparisons against some more recent defense mechanisms would make the experimental contributions more convincing.\n2. Some details on the attack mechanisms are owed, even if in the appendix.\n3. Some training cost comparisons would be good to have.\n4. Table 1 and table 3's font is too smal.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a novel framework that focuses on providing 'plausible deniability' of using the gradient update from a batch by only using that update if there are many other similar batches present in the training dataset. It provides both a theoretical analysis of this framework as well as an empirical investigation. Their technique, PD-SGD, achieves better utility-privacy tradeoffs than existing methods, while the paper also claims to provide theoretical justifications for their technique (arguing some level of protection against even future yet-to-be-discovered attacks).\n\nSTRENGTHS AND WEAKNESSES:\nQuality: The plausible deniability framework does not have the appropriate theoretical justifications that the paper claims, while the empirical results also do not provide an in-depth exploration to support several claims made in the main paper (see 'Questions' section for details). I am optimistic that at least for the theoretical claims, the paper can be improved during the rebuttal phase, to be more precise about these claims.\n\nClarity: The submission is clearly written and well organized for the most part. My comments here are at the intersection of Quality and Clarity, repeating that the theoretical justifications and the threat model are not clear.\n\nSignificance: The empirical results have the potential to be highly impactful, as the paper provides a more computationally efficient technique to achieve privacy that is also shown to be able to improve the privacy-utility tradeoff against some baseline techniques. While the theoretical threat model might be different, it is clear that their technique is more efficient and provides better tradeoffs. A deeper analysis with more experiments and other techniques would definitely improve this aspect of the work. \n\nThe theoretical discussion and the plausible deniability framework, too, are quite valuable, and I believe stand well on their own. As discussed in detail in the 'Questions' below, I feel the value of this framework becomes murky because of the authors' attempts to place it within the existing MIA framework of privacy, but without enough appropriate justifications for the same. As I mentioned above, I am optimistic that the rebuttal phase will either help the authors clarify these connections or acknowledge the distinction between the two and appropriately argue why their framework, too, has value, without forcing it within existing discussions of MIA. \n\nOriginality: The perspective of plausible deniability, to my knowledge, is quite novel and interesting. The paper takes a bold step away from existing privacy frameworks and proposes something new that could have useful implications for privacy protection.\n\nQUESTIONS:\nThe 'theoretical justification' claim of the paper needs to be clarified.\n\nConsider the following threat model: An adversary, with access to model outputs, is able to determine whether an individual was part of the training dataset or not, i.e., membership inference. Differential privacy provides guarantees that it is not possible to confidently distinguish between two outputs if the underlying dataset differed by exactly one point, i.e., it protects against the membership inference threat model. For a good 'theoretical justification' for privacy, one needs to choose a reasonable threat model and a technique that directly protects against the threat model.\n\nLet's talk about plausible deniability. What exactly is the threat model here?\n\nIs the threat model still membership inference? If so, the guarantees of rejecting highly anomalous batches are not enough, and any theoretical justification needs to be directly connected to differential privacy.\n\nOr is the threat model an adversary not able to tell which exact batch out of T different batches was used for the gradient update at a particular training step? The theoretical guarantees are more in line here, but the threat model itself isn't strong. Since batches are created randomly at every training step, the idea of a 'batch' does not hold meaning across the complete training run. So it is unclear how the threat model of plausible deniability at a single training step translates to the overall training.\n\nI found the empirical aspect of the work more promising. However, since that is not the focus of the paper, there aren't enough experiments or details here to support the claims. For instance, the authors argue that avoiding calculating individual-level gradients, which is a requirement for DP-SGD but not for their technique, PD-SGD, can be computationally beneficial. However, there is no empirical evidence to show how beneficial this difference is, and how much does constant rejection of batches after gradient calculation might affect this.\n\nLIMITATIONS:\nPlease see the comments above.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a variant of DP-SGD/Noisy SGD without clipping and with additional censoring of minibatch gradients that do not pass the so-called \"privacy test\", which ensures that each applied mini-batch gradient is $\\alpha$-indistinguishable from at least $T$ other mini-batch gradients. The paper argues that this definition constitutes a theoretically justifiable notion of privacy, motivated by an observation that the model could plausibly deny an accusation by a party claiming that a specific mini-batch has been used in training (Lemma 4). The paper shows that on CIFAR-10, the proposed variant achieves higher empirical privacy-accuracy trade-off than empirical defenses and DP-SGD.\n\nSTRENGTHS AND WEAKNESSES:\nObtaining meaningful relaxations of the strong threat model of differential privacy in a way that is practical and useful is a great open problem. This paper proposes plausible deniabilty of mini-batches as a potential solution, paired with a practical SGD-based algorithm that empirically achieves better privacy-utility trade-offs than DP-SGD and empirical defenses. The paper provides an extensive evaluation of different aspects of the algorithm: performance in different training regimes, with different batch sizes, distribution of example rejection rates, etc. It looks like PD-SGD can outperform the baseline methods in terms of utility and privacy in at least three tasks consistently—assuming carefully tuned parameters. This is a useful result, which could establish PD-SGD a state-of-the-art empirical defense. \n\nDespite the extensive empirical investigation, a core part of the paper is lacking:\n\n- *It's unclear how mini-batch deniability is a meaningful notion of privacy, regardless of possible theoretical guarantees on it.* The proposed theoretical guarantee is not substantiated as a meaningful and valid notion of privacy. In fact, the detailed interpretation of this notion is buried all the way in Appendix C. And that is: we have an (asymmetric) local DP guarantee on any released gradient value as a function of the sequence of mini-batches. Specifically $\\tilde g \\leftarrow M(x)$ satisfies $\\varepsilon$-LDP over the space of two possible inputs $x_0 = \\\\{B, B_1, \\ldots, B_m\\\\}$ and $x_1 = \\\\{B_1, \\ldots, B_m\\\\}$ for some $\\varepsilon = \\log \\lambda(\\alpha, \\sigma, m, T)$, where $\\alpha$ is the likelihood ratio threshold in the privacy test, $\\sigma$ is the Gaussian noise scale, $m$ is the number of batches, and $T$ the minimal number of indistinguishable batches. The problem here is that it is unclear why such guarantee matters in the first place:\n  - What are some realistic attack settings that are directly prevented by such guarantee? What actual adversarial scenarios can be modeled by \"denying an inclusion of a batch\"?\n  - How does it exactly map to privacy of individuals? The privacy of \"batches\" is certainly not a useful primary notion of privacy.\n\n  A more substantial motivation for the relevance of this setup to privacy of individuals is needed in the paper, and it should be a part of the main body. The claims of _theoretical guarantees of privacy_ are unsubstantiated, as it is not clear why the guarantee described above is directly relevant to privacy, which is, again, not a per-batch property, but a per-individual property. In particular, the conclusion \"Theoretical results [...] show that PD-SGD provides a superior privacy-utility trade-off compared to [...] DP-SGD\" is wrong as of now as the paper does not explain how the proposed theoretical notion is a meaningful notion of privacy.\n- *Unclear parameterization strategies.* Finding the parameters for PD-SGD seems challenging and require substantial grid search, as there are three primary privacy parameters, in addition to batch size. This seems like a fundamental limitation–which is addressed–but the paper should provide derive concrete Algorithms based on Section D, and ideally evaluate them, as otherwise it is quite unclear how to set the parameters.\n\nOverall, the proposed notion is tailored to SGD's structure. As a result, its interpretation is *retrofitted to an existing algorithmic structure rather than to a meaningful notion of data privacy.* However, this should not take away at all from the fact that PD-SGD with carefully tuned parameters seems like a superior empirical privacy defense strategy in SGD!\n\nTo mitigate this issue, the paper should either drop the claims of theoretical privacy guarantees (e.g., in conclusions), treat the method as empirical even if motivated by batch plausible deniability, and treat the parameter selection strategies as part of the core contributions – or explain how the notion of batch plausible deniability *on its own* constitutes a notion of privacy. Note that the latter option is orthogonal to the observation in the Appendix that with some test instantations a single step of PD-SGD satisfies DP. A possible direction would be to derive the guarantee equivalent to Lemma 4 on the deniability of individual participation based on the batch size/number of batches the individual appears in. \n\nThis reviewer would like to make it clear that the direction is worthwhile, and alternatives to standard DP are critically needed to ensure privacy guarantees in many practical settings. The proposed approach in its current form misses the mark as it is hard to see the relationship of mini-batch deniability to relevant notions of privacy of individuals in the training data – the practical setting in which such deniability would be relevant is unclear, and even if it was, a single individual's data could appear in multiple mini-batches.\n\nQUESTIONS:\n- What are some realistic attack settings that are directly prevented by Lemma 4? What actual adversarial scenarios can be modeled by \"denying an inclusion of a batch\"?\n  - How does Lemma 4 map to privacy of individuals?\n\nLIMITATIONS:\nThe limitations are discussed in the appendix.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-04"}