# Hybrid Uncertainty Metrics-Based Privacy-Preserving Alternating Multimodal Representation Learning
## 4 Results and Discussion
### Comparison Between PAMRL and MLA Models Against Membership Inference Attacks  
To evaluate the privacy protection capability of the model, we employ the membership inference attack (MIA) [26] as the benchmark attack method. Following the shadow model paradigm, the attacker observes the loss function values and confidence distributions of the target model for input data, utilizing a threshold-based classifier to distinguish between member and non-member samples. This method aims to infer whether a specific data sample belongs to the model's training set, thereby exposing sensitive information such as personal identities or medical records through statistical divergences in model outputs. The ideal attack accuracy of 50% corresponds to random guessing, indicating no discernible privacy leakage, while higher values signify vulnerabilities requiring mitigation via differential privacy mechanisms or gradient obfuscation techniques.  
**AUC for Member Inference Attack (\(MIA_{AUC}\))**: An attacker analyzes a model's output (e.g., predictive confidence) to infer whether a particular sample belongs to the model's training set \(MIA_{AUC}\) measures the model's ability to discriminate between the confidence of samples in the training set (members) and samples in the test set (non-members) by calculating the Area Under the Curve (AUC) of the ROC curve, calculated as  
Figure 4: Training evaluation with \(\epsilon=1\) and \(\sigma=2.40\) On MVSA: (**a**) accuracy; (**b**) precision; (**c**) F1; (**d**) Low-Confidence Accuracy; (**e**) recall; (**f**) ECE.  
Figure 5: Training evaluation with \(\epsilon=2\) On MVSA: (**a**) accuracy; (**b**) ECE; (**c**) F1; (**d**) precision; (**e**) recall; (**f**) Low-Confidence Accuracy.  
\[\text{MIA}_{\text{AUC}}=\int_{0}^{1}\text{TPR}(\text{FPR})d\text{FPR}\]  
where \(\text{TPR}=\frac{\text{TP}}{\text{TP}+\text{FN}}\) is the true positive rate, and \(\text{FPR}=\frac{\text{FP}}{\text{FP}+\text{TN}}\) is the false positive rate.  
The experimental results show that on both CREMA-D and MVSA datasets, No-DP models (MLA) exhibit a high MLA AUC (0.73 for CREMA-D, 0.75 for MVSA), increasing steadily from 0.50 to 0.51 and stabilizing, while DP models (PAMRL) consistently suppress MIA AUC with lower values throughout training, as illustrated in Figure 6. This indicates that No-DP models overfit to training data, increasing vulnerability to membership inference attacks, whereas DP models effectively mitigate these privacy risks, with stronger privacy settings (e.g., higher noise levels) further reducing AUC. This reflects PAMRL's robust privacy protection, as its DP mechanism obscures training data patterns, enhancing security for sensitive multimodal data like audio-visual (CREMA-D) and text-image (MVSA) datasets. Such performance supports the PAMRL framework by validating its design goal of safeguarding sensitive data through differential privacy), ensuring its applicability in privacy-sensitive multimodal applications such as emotion recognition and sentiment analysis, where mitigating privacy risks is critical.