## 4 Methods
### Overview
#### 4.1.3 Additional Modules  
To engineer a robust solution resistant to reconstruction attacks, we make use of a _selector module_ and a _noise module_, as shown in Figure 2. The noise module incorporates additive noise sampled from a Gaussian distribution into the feature maps while the selector module annuls a subset of feature maps based on predefined policies. Recovering sensitive information from only a subset of the feature maps is significantly harder than reconstructing the images using all the feature maps.  
In the noise module, there are two hyperparameters to control the noise injected: (i) Variance of the Gaussian noise (\(\sigma^{2}\)), and (ii) mean of the Gaussian noise (\(\mu\)). For a set of feature maps \(\mathbf{x}\in\mathbb{R}^{\mathbb{R}\times\mathbb{C}\times H\times W}\), the set of perturbed feature maps \(\mathbf{x}^{\prime}\) is given by the following:  
\[\mathbf{x}^{\prime}=\text{clip}(\mathbf{x}+\delta,0,1),\;\delta\sim\mathcal{N }(\mu,\sigma^{2})\]  
Here, \(B\) is the batch size, \(\mathbb{C}\) is the number of feature maps, \(H\) is the height of the feature maps, \(W\) is the width of the feature maps, and \(\delta\in\mathbb{R}^{\mathbb{R}\times\mathbb{C}\times H\times W}\) is the additive noise. Since \(\mathbf{x}^{\prime}\) substitutes \(\mathbf{x}\) as an intermediate representation, we clip the values to [0,1] to prevent gradient vanishing or explosion when the model is trained.  
In the selector module, the fraction of feature maps to be annulled is given by the hyperparameter \(\lambda\). A naive annulment can be implemented by simply sending a subset of the feature maps to the cloudlet, however, for each distinct value of \(\lambda\), the model architecture on the cloudlet will need to be changed. Consider a subset of feature maps \(\mathbf{x}_{\text{s}}\subset\mathbf{x}\) such that \(\frac{|\mathbf{x}_{\text{s}}|}{|\mathbf{x}|}=\lambda\), and assume that the feature maps \(\mathbf{x}_{\text{s}}\) need to be annulled. Then, the three annulment strategies are as follows:  
1. [label=()]
2. Setting the feature maps to 0 (\(k=0\)): We set \(\mathbf{x}_{\text{s}}=\mathbf{0}\) i.e., the feature maps to be annulled have all their values set to 0. For example, if one \(20\times 20\) feature map is to be annulled, all 400 values of the feature map are set to 0.
3. Setting the feature maps to 1 (\(k=1\)): We set \(\mathbf{x}_{\text{s}}=\mathbf{1}\) i.e., the feature maps to be annulled have all their values set to 1.  
* Setting the feature maps to be noise (\(k\sim\mathcal{N}(0,1)\)): In this case, each value of the feature map is sampled from a unit normal distribution.  
By using the aforementioned strategies, the cloudlet model architecture can remain unchanged allowing for greater flexibility.  
Intuitively, one could question the use of noise injection to feature maps instead of the raw image. Adding noise to the original image does not provide sufficient privacy protection. Instead, Gaussian noise can make it easier for adversaries to reconstruct images because it is a powerful data augmentation technique for image reconstruction [14]. The amount of noise that needs to be added to the raw image to preserve privacy would severely degrade model performance. Thus, we add noise to the feature maps to strike a balance between performance and privacy protection.