Reimagining Mutual Information for Enhanced Defense against Data Leakage in Collaborative Inference

Thanks for your review and constructive suggestions. We are delighted to answer the questions and address the concerns.

W1.

The novelty of our theoretical analysis is that we analyze why we should choose CLUB rather than other approximations to approximate the upper bound of mutual information between the data and the representations. We do not modify the detailed approximation method (i.e., CLUB), and that is not our focus. Our novelty is that we theoretically analyzed the superiority of applying CLUB over the other mutual information approximations in collaborative inference defense. The multi-stage training procedure derived from the multiple training objectives is also a novelty of our paper. I appreciate that you recognize that we provide a theoretical explanation of the superiority of applying CLUB. When you understand our theoretical explanation, there will be no challenge to choose CLUB for approximation. However, without our analysis, it will be challenging to achieve optimal performance-defense trade-off because there is no clue to select the optimal approximation for MI in privacy preservation. Previous works select VIB because VIB is the most widely applied approximation method, but it is not optimal under the collaborative inference privacy-preservation setting.

W2.

Thanks for the constructive suggestion, we will add more details about the adaptive attack, AMC attack, and the adversary's capability in the revised draft section 3.2 and section 5.1. In our threat model, the adversary (i.e., malicious server) is capable of training a surrogate classifier and generator to mimic the victim's data. The primary goal of our defense is to make the collaborative model depend less on the encoder on the server for specific tasks. Such that the data and prediction information can be filtered during inference. Under the adaptive attack setting, we enable the adversary to modify the training profiling such that it can trick the collaborative model into relying more on its encoder, thereby extracting more private data information from the encoder's features. In this setting, the adversary is directly confronting the fundamental principles of our defense method, constituting a highly potent form of adaptive attack. The results show that our defense is capable of defending such a strong adaptive attack.

W3.

Thanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels.

The results for comparison with other baselines can be found in the global response PDF file. It is shown that our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures. Our defense against the model inversion attacks shows the high potential of our method in generative tasks. We also evaluate our method under the credit fraud detection task on the UCI_Default_Credit with MLPs, the results are shown below.

It is shown that our method can also achieve a good performance-privacy trade-off on different tasks.

We appreciate your review and constructive suggestions. Please let us know if you have any new questions or concerns.

I hope our rebuttal addressed your concerns effectively. As we approach the end of the discussion period, we wanted to check if you have any remaining questions or points you'd like to clarify. Your insights are very important to us, and we would appreciate any further feedback you can provide before the discussion period ends.

Thanks for your review and constructive suggestions. We are delighted to answer the questions and address the concerns.

W1.

In real life, there are some applications and settings where the classifier or other head models are deployed on the edge. For example, in some medical applications, the encoder on the cloud server will extract the features while the diagnosis results (prediction) are calculated on the wearable devices since the diagnosis results might contain private information of the user. The other practical setting is that the user might need to finetune the classifier or other head models on the device using their private data, which cannot be shared with the server. In such a case, the classifier has to be deployed on the edge device, and the prediction needs to be protected.

W2.

Thanks for your constructive suggestion. We are delighted to explain the settings of our paper. The goal of our method is to preserve user privacy in collaborative inference, and privacy preservation is achieved by manipulating the training phase (i.e., collaborative training). By applying our defense, the model is normalized to filter the private information when extracting features and representations, such that privacy is preserved during the inference phase. We will revise our draft to clarify this point more clearly in the introduction section.

Thanks for your reference. The setting of this paper is similar to our paper, which also realizes inference privacy by normalizing the training procedure. But they only focus on prediction protection. Technically, they add noise to the training label by randomly sampling a class label, which is intuitively correct. Our training method is theoretically derived from the perspective of mutual information, and we provide a theoretical analysis of our defense performance. Even though we are distinguished from the methodology, we still appreciate your suggestion and will include it in the related work.

W3.

CLUB is a paper focusing on approximating the mutual information upper bound, while our paper utilizes the mutual information to defend against privacy leakage. Thus, our contribution is more about privacy preservation, which is different from the goal of CLUB. The novelty of our theoretical analysis is that we analyze why we should choose CLUB rather than other approximations to approximate the upper bound of mutual information between the data and the representations. When you want to minimize the mutual information, there are many choices of approximation. Most of the existing related works apply Variational Information Bottleneck (VIB)[22] since it is the most widely applied approximation of mutual information upper bound. However, we analyze that when defending data privacy, VIB is sub-optimal and could sacrifice too much performance. Following our analysis, we find that CLUB is a better approximation to apply. In other words, we do not modify the detailed approximation method (i.e., CLUB), and that is not our focus and novelty. Our novelty is that we theoretically analyzed the superiority of applying CLUB over the other mutual information approximations in collaborative inference defense. The multi-stage training procedure derived from the multiple training objectives is also a novelty of our paper.

W4.

Thanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels.

The results for comparison with other baselines can be found in the global response PDF file. It is shown that our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures.

W5.

We apologize for the confusion. Different rows present different defense levels. The bottom row applies the highest defense strength; thus, the reconstructed image is low-quality while the accuracy is sacrificed. We will revise the caption to clarify this.

Thanks for the constructive advice. To evaluate performance on large-scale datasets with higher dimensions, we conducted more experiments on the mini-ImageNet dataset, which is a subset of ImageNet. We also conducted experiments on the Vision Transformer (ViT-B/16). Due to the time limit, we only got the results on the model completion attack. Here are the results of our defense under different defense levels.

The results for comparison with other baselines can be found in the global response PDF file. Our method achieves the best defense-performance trade-off under the large-scale dataset and is generalized to the other model architectures.

May I kindly inquire if you have any further concerns or questions after reviewing our rebuttal? As the discussion period is nearing its conclusion, your feedback is incredibly valuable to us. I would greatly appreciate it if you could let us know if there are any additional points you'd like to discuss or if our rebuttal satisfactorily addresses your concerns.