InfoDecom: Decomposing Information for Defending against Privacy Leakage in Split Inference
This addresses privacy risks for users of split inference services in computer vision, offering an incremental improvement over prior defenses by reducing utility degradation.
The paper tackles the problem of privacy leakage in split inference due to data reconstruction attacks, proposing InfoDecom to decompose and remove redundant information before injecting noise, which achieves a superior utility-privacy trade-off compared to existing baselines.
Split inference (SI) enables users to access deep learning (DL) services without directly transmitting raw data. However, recent studies reveal that data reconstruction attacks (DRAs) can recover the original inputs from the smashed data sent from the client to the server, leading to significant privacy leakage. While various defenses have been proposed, they often result in substantial utility degradation, particularly when the client-side model is shallow. We identify a key cause of this trade-off: existing defenses apply excessive perturbation to redundant information in the smashed data. To address this issue in computer vision tasks, we propose InfoDecom, a defense framework that first decomposes and removes redundant information and then injects noise calibrated to provide theoretically guaranteed privacy. Experiments demonstrate that InfoDecom achieves a superior utility-privacy trade-off compared to existing baselines. The code and the appendix are available at https://github.com/SASA-cloud/InfoDecom.