{"id":"907b37e7-20ab-4d15-96a2-54a897987c0d","arxiv_id":"2411.18746","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"low","formal_verification":"none","parameter_count":1,"one_line_summary":"Inference Privacy requires that a model's output distributions for any two inputs within a chosen radius alpha are almost identical, and it is implemented by calibrating input or output noise with standard differential privacy machinery.","lead":"This paper defines Inference Privacy, a guarantee that the outputs of a machine learning model look nearly the same for any two user inputs that are close to each other, and gives simple noise-adding mechanisms to achieve it. The practical appeal is a user-controlled knob that trades how much input similarity is protected against how accurate the model stays.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Output-perturbation mechanisms depend on a certified global Lipschitz bound that the paper neither derives nor validates; without it, the (epsilon, delta) IP guarantee in Theorem 2 does not follow.","rationale":"The reader's weakest_assumption points to the Lipschitz bound; I agree this is the load-bearing issue. The output-perturbation theorems are conditional on a certified mu_C, and the paper's move from 'supremum' to 'upper bound' in Section IV is exactly where a privacy proof can silently break: any underestimate of mu_C invalidates the sensitivity bound used in Theorem 2. Because the experiments use Gauss-Output only on SLL models and do not list certified mu_C values, the practical half of the central claim is not fully supported. I did not find an internal inconsistency in the main mechanisms: input perturbation is a valid post-processing of a Gaussian mechanism with sensitivity alpha, and the composition/chaining statements are standard (though the appendix proofs contain typographical errors and some hand-waving in product-set composition). Those are fixable and do not change the verdict. Hence no adjustment beyond the reader's conditional acceptance.","tokens_in":16952,"tokens_out":17460,"duration_ms":165695,"concrete_test":"For one SLL model used in Fig. 3, compute a certified Lipschitz upper bound mu_cert (e.g., via the direct parameterization of [26] or the SDP of [21]). Re-run Gauss-Output with sigma_cert = sqrt(2 ln(1.25/delta)) * (alpha * mu_cert) / epsilon and with sigma_under = 0.5 * sigma_cert. For 100,000 random pairs with ||xa - xb||_2 <= alpha, estimate P[|ln(f_{M(xa)}(y) / f_{M(xb)}(y))| > epsilon] from model outputs; if the underestimated run exceeds delta while the certified run does not, the guarantee is confirmed to depend on a certified bound. Also report mu_cert next to the experimental accuracy so the noise scales in Table 6 can be checked.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 3/Theorem 1 and Definition 4/Theorem 2 instantiate IP by adding noise calibrated to mu_C, the model's global Lipschitz constant. The paper defines mu_C in Eq. (8) as a supremum, then immediately substitutes an unstated 'upper bound' without a certification procedure. The proof of Theorem 2 uses alpha * mu_C >= ||C(xa) - C(xb)||_2 for every pair with d(xa, xb) <= alpha (Eq. 52); this holds only if mu_C is a true upper bound. For ReLU networks, exact Lipschitz constants are NP-hard, and the authors themselves report in Section V that Gauss-Output was not applied to ResNet-18 because the model's mu_C is too large. If an underestimated or non-certified mu_C is used, the noise scale sigma is too small, the privacy-loss tail bound in Eqs. (53)-(54) is invalid, and the claimed {(epsilon, delta), alpha} IP guarantee does not hold. The experiments on SLL models do not report certified mu_C values, so the empirical support for output perturbation is incomplete. This is the weakest load-bearing link in the paper's central claim of providing output-perturbation mechanisms with rigorous IP.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Inference Privacy (IP), a definition that requires a randomized mechanism's output distributions to be close for any two inputs within a metric ball of radius α, yielding {(ε,δ),α}-IP as a generalization of local differential privacy. It proves basic properties (post-processing, sequential and parallel composition, chaining), and proposes three mechanisms: Laplace output perturbation, Gaussian output perturbation, and Gaussian input perturbation, with noise calibrated to the model's global Lipschitz constant (for output perturbation) or to α alone (for input perturbation). Experiments on CIFAR-10 and CIFAR-100 compare utility trade-offs for ResNet-18 and SLL networks. The central definitions and main privacy statements are plausible and follow standard differential-privacy sensitivity arguments, but several proof details and the treatment of the Lipschitz bound need correction.","tokens_in":17181,"tokens_out":3843,"duration_ms":36421,"significance":"If the stated guarantees hold in the intended form, the paper offers a clean and broadly applicable framework for inference-time privacy with a tunable radius α, and it explicitly connects to Lipschitz-bounded networks. The main theorems are derived from first-principles sensitivity bounds rather than fitted parameters, which is a strength. The paper also honestly admits limitations (Remark 9, and the difficulty of applying Gauss-Output to ResNet-18 in Section V). However, the practical validity of the output-perturbation guarantees depends on certified Lipschitz bounds, and the write-up contains several proof errors that currently prevent the rigor claimed in the paper. The utility curves are direct consequences of the noise formulas, so the empirical section is illustrative rather than a validation of the privacy guarantee itself.","major_comments":[{"comment":"The output-perturbation guarantees require μ_C to be a certified upper bound on the true global Lipschitz constant, because Eq. (52) uses α μ_C ≥ ||C(xa) – C(xb)||_2. The paper defines μ_C in Eq. (8) as a supremum, then says that 'upper bounds' will be used and that the upper bound will also be denoted μ_C, but it never states how such a bound is certified for the SLL models in Section V. If μ_C is underestimated or is not certified, Theorem 2 and Definition 4 do not provide the claimed {(ε,δ),α}-IP. Please make the certification requirement explicit in the mechanism definitions and report the certified μ_C values used in the experiments; the SLL networks from [21,26] presumably have certified 1-Lipschitz properties, but this is not stated.","section":"Section IV, Eq. (8), Definitions 3–4, Theorem 2"},{"comment":"The Gaussian tail bound is misstated. The text claims δ/2 > (σ/(√(2π) z)) e^{-z²/(2σ²)} ≥ Pr[Z > z] with Z a standard normal variate. The correct standard tail bound is Pr[Z > z] ≤ (1/(√(2π) z)) e^{-z²/2} for z > 0; σ does not appear in the exponent once Z is standardized. The same error is copied into Appendix G. The mechanism calibration σ ≥ sqrt(2 ln(1.25/δ)) α μ_C / ε may still be correct, but the proof must be rewritten with the proper tail inequality and the relevant substitutions.","section":"Appendix F, Eq. (54), and Appendix G, Eq. (71)"},{"comment":"The proof of parallel composition treats each chunk distance ||xa_i – xb_i||_p as though it were equal to the privacy radius α_i, writing d(xa,xb) = (Σ α_i^p)^{1/p} ≥ α_i and then using this to assert B(xi,min α_i) ⊆ B(xi,α_i). This is not justified: α_i is a mechanism parameter, not the actual distance between the two inputs in that chunk. The proposition is still true via the simpler observation that ||xa_i – xb_i||_p ≤ ||xa – xb||_p ≤ min_j α_j ≤ α_i, but the argument as written is erroneous and should be replaced.","section":"Appendix C, Eqs. (21)–(24)"},{"comment":"The Laplace mechanism proof is written for point masses, using expressions such as Pr[MLo(xa) = y] and Pr[Z1 = z] and then evaluating densities. The mechanism is continuous, so the proof should be phrased in terms of densities and integrals over measurable sets. The underlying sensitivity bound is standard and can be made correct, but the current presentation is not a valid proof as written.","section":"Appendix E, Eqs. (35)–(38)"}],"minor_comments":[{"comment":"There is a typo: 'Poof of this result is presented in Appendix E' should read 'Proof of this result is presented in Appendix E.'","section":"Before Theorem 1"},{"comment":"The word 'spited' should be 'split,' and the notation in the proposition statements '{(Pm i=1 ϵi, Pm i=1 δi, min αi} IP' is missing matching braces for the privacy tuple.","section":"Proposition 3 statement"},{"comment":"The text says 'As presented in Table 6,' but the referenced object is a figure; this should be 'As presented in Figure 6.'","section":"Section V, discussion of Figure 6"},{"comment":"The noise variable Z2 is reused for both output perturbation in Definition 4 and input perturbation in Definition 5, while Appendix G switches notation to Z3; this is confusing and should be made consistent.","section":"Definitions 4 and 5"},{"comment":"Equation (54) is missing a closing parenthesis in the exponent and the displayed inequality is dimensionally inconsistent; the equation should be corrected along with the tail-bound rewrite described in the major comment.","section":"Appendix F, Eq. (54)"}],"recommendation":"major_revision","confidential_remarks":"The paper is a reasonable fit for a privacy venue, and the IP definition is a useful variation on metric differential privacy. The main risk is that the practical mechanisms are only as strong as the certified Lipschitz bound, and the current manuscript does not make the certification step explicit. The proof errors in Appendices C, E, and F are fixable, but they are currently strong enough to block acceptance in the present form. I would be willing to review a revised version."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper defines a radius-bounded variant of metric differential privacy and calls it Inference Privacy. That is a modest but real contribution, and the mechanisms are correct given a certified Lipschitz bound. The paper overstates the novelty, and the appendices have proof typos, but the main theorems hold. It deserves a referee.\n\nThe good part: the definition is clean and practically motivated. For any two inputs within distance alpha, the outputs are (eps, delta)-indistinguishable. That is a useful language for inference-stage privacy, and the user-tunable radius is a nice feature. The post-processing, composition, and chaining properties are standard but correctly transferred to this setting. The three mechanisms—Lap-Output, Gauss-Output, Gauss-Input—are the obvious applications of Laplace and Gaussian noise calibrated to the global Lipschitz constant, and the calibrations are right. The experiments on 1-Lipschitz SLL models show the expected utility-privacy trade-offs, and the decision to use Gauss-Input on ResNet-18 because its Lipschitz bound is too large is honest.\n\nThe soft spots: First, the paper claims IP is a generalization of metric DP. It is the opposite: IP is metric DP restricted to pairs within distance alpha, and alpha=infinity recovers LDP. That framing should be corrected; it does not break the theorems, but it weakens the contribution. Second, the proofs in Appendices C and F have errors: Appendix C equates chunk radii with chunk distances, and Appendix F misstates the Gaussian tail bound. The results are still correct, but a referee should ask for clean proofs. Third, the output mechanisms require a certified global Lipschitz constant. For the SLL models, mu_C=1 is guaranteed by construction, but for general networks the paper offers no certification procedure; it just says 'use upper bounds.' That is a real practical gap. The theorems are conditional on mu_C being a true upper bound, and that should be stated loudly. Finally, the experiments report averages without error bars, so the comparisons across mechanisms are anecdotal.\n\nBottom line: this is a reasonable systemization of inference-stage privacy with standard mechanisms. It is not a new primitive. I would accept it for peer review, but only after the authors correct the overclaim about metric DP and tighten the appendices.","headline":"A radius-bounded inference-privacy framework that is essentially metric DP with a tunable ball; the mechanisms are correct given a certified Lipschitz bound, but the novelty is modest and the proofs need cleanup.","tokens_in":17696,"tokens_out":3622,"would_cite":false,"duration_ms":31815,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Inference Privacy gives users a tunable privacy radius when querying public models.","keywords":["inference privacy","local differential privacy","metric differential privacy","Lipschitz constant","output perturbation","input perturbation","privacy utility tradeoff","post-processing composition"],"falsifier":"Choose a model and its claimed Lipschitz bound $\\mu_C$; by optimization or random search, look for two inputs $x_a,x_b$ with $\\|x_a-x_b\\|_p\\le\\alpha$ such that $\\|C(x_a)-C(x_b)\\|_p>\\mu_C\\alpha$. If such a pair exists, the density ratio of the corresponding Lap-Output or Gauss-Output mechanism at the stated noise scale exceeds $e^\\epsilon$ for some output region, so one can exhibit a measurable set $S$ where the IP inequality $\\Pr[M(x_a)\\in S]\\le e^\\epsilon\\Pr[M(x_b)\\in S]+\\delta$ is violated. Finding one such pair would refute the mechanism's claimed privacy calibration for that model.","tokens_in":16745,"feed_emoji":"🔒","tokens_out":8705,"duration_ms":75028,"temperature":0.7,"pith_summary":"The paper aims to move privacy protection from the training phase to the inference phase: a user querying a public model should be able to control how easily the model's output can be traced back to their input. To that end it defines Inference Privacy (IP), in which a randomized mechanism is $\\{(\\epsilon,\\delta),\\alpha\\}$-private if all inputs within distance $\\alpha$ under a chosen metric have outputs that are $(\\epsilon,\\delta)$-indistinguishable. The radius $\\alpha$ is user-tunable, so users can choose how wide a neighborhood of their data must be protected. The paper shows that IP generalizes local differential privacy, satisfies post-processing and composition properties, and can be realized by adding noise to the model output (calibrated by the model's global Lipschitz constant) or to the input (calibrated by $\\alpha$ alone). Experiments on CIFAR-10 and CIFAR-100 demonstrate the resulting utility-privacy tradeoff.","feed_headline":"Inference Privacy bounds leakage within a user-chosen radius","feed_subtitle":"The new definition generalizes local differential privacy and adds noise mechanisms for any public model.","key_machinery":"The object that carries the argument is the $\\{(\\epsilon,\\delta),\\alpha\\}$-IP condition itself, which makes the privacy radius $\\alpha$ a first-class parameter alongside $(\\epsilon,\\delta)$. In the output-perturbation mechanisms the noise scale is set by $\\alpha\\mu_C$, where $\\mu_C$ is an upper bound on the model's global Lipschitz constant; this converts a bound on input distance into a bound on output movement, so the usual Laplace and Gaussian density-ratio computations apply. In the input-perturbation mechanism the noise scale depends on $\\alpha$ alone, because the identity map has Lipschitz constant 1 and the post-processing property extends the guarantee to any downstream model $C$. The chaining property rests on the geometric fact that Euclidean $p$-space is geodesic: intermediate points $u_1,\\ldots,u_{h-1}$ along the segment from $x_a$ to $x_b$, each at distance $\\alpha$ from its neighbor, let the proof compose $h=\\lceil\\beta/\\alpha\\rceil$ pairwise privacy losses.","core_discovery":"The central claim is that inference-stage privacy can be defined locally around a user's input and enforced by standard noise mechanisms. Within a metric space $(\\mathcal{X},d)$, a mechanism $M$ satisfies $\\{(\\epsilon,\\delta),\\alpha\\}$ Inference Privacy if for every measurable $S$ and every pair $x_a,x_b$ with $d(x_a,x_b)\\le\\alpha$, we have $\\Pr[M(x_a)\\in S]\\le e^\\epsilon\\Pr[M(x_b)\\in S]+\\delta$. Because taking $\\alpha=\\infty$ recovers local differential privacy, IP is a strict generalization and gives users a dial that LDP lacks. The paper proves that IP is closed under data-independent post-processing, that basic and parallel composition add privacy budgets while taking the minimum radius, and that a chaining property extends a guarantee from radius $\\alpha$ to any larger $\\beta$ by inserting intermediate points on a geodesic line segment. Constructively, it gives a Laplace output mechanism with scale $\\mu_C\\alpha/\\epsilon$, a Gaussian output mechanism with variance $2\\ln(1.25/\\delta)(\\alpha\\mu_C)^2/\\epsilon^2$, and a Gaussian input mechanism with variance $2\\ln(1.25/\\delta)\\alpha^2/\\epsilon^2$, where $\\mu_C$ is the model's global Lipschitz constant.","pith_inferences":["Applied at the embedding level of a language model, with a semantic metric in place of $\\ell_p$ distance, IP could become a formal defense against prompt-reconstruction and model-inversion attacks on chatbots; the paper names language models as future work but does not test them.","Swapping global Lipschitz bounds for local Lipschitz bounds, as the authors suggest in their discussion, would likely cut the required noise on standard networks and could make output perturbation practical where it currently is not.","The fact that Gauss-Input accuracy depends only on the ratio $\\alpha/\\epsilon$ suggests a simple service design: advertise equivalent $(\\alpha,\\epsilon)$ pairs and let users trade neighborhood size against indistinguishability at constant utility.","Because the chaining bound mirrors group differential privacy, tighter group-privacy composition results could probably be imported to reduce the exponential $\\delta$ growth in IP's radius extension."],"forward_implications":["A user sending a query to a public classifier or chatbot can obtain a numerical privacy guarantee over a chosen neighborhood of their input, without any change to the model's training procedure.","For models with small certified Lipschitz constants, output perturbation dominates input perturbation in accuracy at the same privacy level, giving architects a concrete reason to build 1-Lipschitz networks.","The chaining property lets one noisy release be analyzed at multiple radii, so a service can publish a single mechanism and let users select the guarantee appropriate to how sensitive their data is.","The composition theorems make IP compositional in multi-step inference pipelines: privacy losses add across steps and the effective neighborhood shrinks to the smallest radius among the steps.","Because Gaussian input noise is calibrated only by $\\alpha/\\epsilon$, any model, regardless of architecture, can be protected with the same input-perturbation mechanism."],"supporting_citations":[{"why":"Supplies the differential privacy definitions and group-privacy reasoning that IP's chaining property extends.","marker":"[2]"},{"why":"Documents the data reconstruction attack at inference time that motivates the IP guarantee.","marker":"[7]"},{"why":"Defines local differential privacy, which IP generalizes by restricting the guarantee to a radius $\\alpha$.","marker":"[8]"},{"why":"Formalizes local privacy in the data-collection setting that IP compares against and extends.","marker":"[9]"},{"why":"Introduces metric differential privacy, the closest prior notion used to position IP.","marker":"[17]"},{"why":"Motivates the use of upper bounds on Lipschitz constants by showing exact estimation is hard for deep networks.","marker":"[19]"},{"why":"Provides the certified Lipschitz network construction used in the output-perturbation experiments.","marker":"[21]"},{"why":"Supplies the CIFAR-10 and CIFAR-100 datasets used to measure utility-privacy tradeoffs.","marker":"[24]"},{"why":"Provides the Lipschitz-bounded parameterization used for the SLL models in the experiments.","marker":"[26]"},{"why":"Supplies the geodesic-space property that the chaining proof uses to insert intermediate points.","marker":"[28]"}],"fun_headline_variants":["Inference Privacy: tune your leakage radius","IP: a privacy radius for model queries","Inference Privacy: LDP generalized with a dial","User-controlled privacy at inference via noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The output-perturbation mechanisms are only as valid as the certified upper bound on the model's global Lipschitz constant: if the true Lipschitz constant is underestimated, the claimed $\\{(\\epsilon,\\delta),\\alpha\\}$ guarantee does not follow, and if it is overestimated, the noise destroys utility.","fun_headline_variants_meta":{"raw":{"variants":["Inference Privacy: tune your leakage radius","IP: a privacy radius for model queries","Inference Privacy: LDP generalized with a dial","User-controlled privacy at inference via noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000302,"raw_usage":{"total_tokens":1755,"prompt_tokens":980,"completion_tokens":775,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":596,"completion_tokens_details":{"reasoning_tokens":719}},"tokens_in":596,"tokens_out":775,"duration_ms":8231,"temperature":1.0,"reasoning_tokens":719,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:56:32.919963+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Choose a model and its claimed Lipschitz bound $\\mu_C$; by optimization or random search, look for two inputs $x_a,x_b$ with $\\|x_a-x_b\\|_p\\le\\alpha$ such that $\\|C(x_a)-C(x_b)\\|_p>\\mu_C\\alpha$. If such a pair exists, the density ratio of the corresponding Lap-Output or Gauss-Output mechanism at the stated noise scale exceeds $e^\\epsilon$ for some output region, so one can exhibit a measurable set $S$ where the IP inequality $\\Pr[M(x_a)\\in S]\\le e^\\epsilon\\Pr[M(x_b)\\in S]+\\delta$ is violated. Finding one such pair would refute the mechanism's claimed privacy calibration for that model.","supporting_citations":[{"cited_title":"Busemann, The geometry of geodesics","cited_arxiv_id":null,"evidence_quote":"Supplies the geodesic-space property that the chaining proof uses to insert intermediate points."},{"cited_title":"Vicious Classifiers: Assessing Inference-time Data Reconstruction Risk in Edge Computing","cited_arxiv_id":"2212.04223","evidence_quote":"Documents the data reconstruction attack at inference time that motivates the IP guarantee."},{"cited_title":"Local differential privacy on metric spaces: optimizing the trade-off with utility,","cited_arxiv_id":null,"evidence_quote":"Introduces metric differential privacy, the closest prior notion used to position IP."},{"cited_title":"Direct parameterization of lipschitz- bounded deep networks,","cited_arxiv_id":null,"evidence_quote":"Provides the Lipschitz-bounded parameterization used for the SLL models in the experiments."}],"review_version":1}