Can Differential Privacy Practically Protect Collaborative Deep Learning Inference for the Internet of Things?
This addresses privacy concerns for IoT applications using collaborative inference, but it is incremental as it systematically evaluates existing differential privacy techniques against known attacks.
The paper tackles the problem of privacy risks in collaborative deep learning inference for IoT, where reconstruction attacks can recover inputs from intermediate outputs, and finds that differential privacy can practically protect against these attacks with small accuracy losses, such as 0.476% on SVHN and up to 12.454% on CIFAR-10, when datasets have low intra-class variation.
Collaborative inference has recently emerged as an attractive framework for applying deep learning to Internet of Things (IoT) applications by splitting a DNN model into several subpart models among resource-constrained IoT devices and the cloud. However, the reconstruction attack was proposed recently to recover the original input image from intermediate outputs that can be collected from local models in collaborative inference. For addressing such privacy issues, a promising technique is to adopt differential privacy so that the intermediate outputs are protected with a small accuracy loss. In this paper, we provide the first systematic study to reveal insights regarding the effectiveness of differential privacy for collaborative inference against the reconstruction attack. We specifically explore the privacy-accuracy trade-offs for three collaborative inference models with four datasets (SVHN, GTSRB, STL-10, and CIFAR-10). Our experimental analysis demonstrates that differential privacy can practically be applied to collaborative inference when a dataset has small intra-class variations in appearance. With the (empirically) optimized privacy budget parameter in our study, the differential privacy technique incurs accuracy loss of 0.476%, 2.066%, 5.021%, and 12.454% on SVHN, GTSRB, STL-10, and CIFAR-10 datasets, respectively, while thwarting the reconstruction attack.