{"id":"a3afe860-23ea-4fb6-92af-582e47929f11","arxiv_id":"2501.00824","paper_version":7,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A mutual-information-based criterion, Dmia, predicts model inversion attack difficulty in collaborative inference, and the SiftFunnel defense suppresses the criterion's factors to raise reconstruction error with only about a 3% accuracy drop.","lead":"This paper proposes a criterion for when attackers can reconstruct private images from the features an edge device sends to the cloud during collaborative inference, plus a defense called SiftFunnel that makes those features harder to invert. It reports about 30% higher reconstruction error and a roughly 20x smaller edge model while keeping accuracy loss near 3%.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Fano-to-perceptual bridge in Eq. (7) is asserted, not derived: continuous image alphabets make log|X| and H(z|x)=0 ill-defined, so the criterion lacks its claimed formal foundation.","rationale":"The reader identified the same load-bearing weak point: the extension of Fano's inequality to perceptual or semantic reconstruction error is asserted without proof in Section 4.2. My stress-test sharpens this concern beyond the finite-alphabet issue by noting that the paper's continuous image setting makes the very terms in the inequality ill-defined: log|X| is infinite, differential conditional entropies can be negative, and H(z|x)=0 in Eq. (4) is not correct for deterministic maps under differential entropy. These are not merely matters of convention; they mean that the derivation of Eq. (7) does not go through as a formal argument. The paper does have independent support: systematic experiments across CIFAR-10, FaceScrub, CelebA, and ChestX-ray, a reproducible-code link, MINE-based validation, and a detailed ablation study showing that the proposed losses and architecture contribute to defense performance. Those results justify interest in SiftFunnel as an empirical defense. However, they do not establish the theoretical criterion, because the validation partially uses quantities the defense directly optimizes (MI and delta(z)) and the MINE estimates do not test the Fano inequality itself. The appropriate verdict remains CONDITIONAL: the empirical defense could be accepted with clearer uncertainty quantification and softened claims about a theoretical criterion, but the central formal claim needs correction or removal. Since the reader already reached CONDITIONAL, no verdict adjustment is needed; the stress-test confirms and strengthens the reader's reasoning.","tokens_in":22489,"tokens_out":2860,"duration_ms":33131,"concrete_test":"Construct a finite discrete surrogate for the continuous image setting: quantize input images to a codebook of size K, measure the empirical conditional entropy H(X|Z) over this quantized space for SiftFunnel and baseline defenses, and compute the exact Fano lower bound Pe >= (H(X|Z) - 1) / log K. Then compare this bound with the observed MIA success rate, e.g., the fraction of reconstructions exceeding an SSIM or perceptual threshold. If the bound does not track observed attack difficulty across defenses, the Fano foundation of Eq. (7) is falsified. As a separate check, evaluate Eq. (4) on a simple deterministic encoder with continuous inputs: compute or estimate h(z|x), h(x|z), and I(x;z). If h(z|x) evaluates to -infinity or I(x;z) to infinity under the paper's own continuous model, then Eq. (4) is not a valid identity in the setting used to justify Dmia.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central theoretical claim is Eq. (7), Dmia proportional to H(x|z) / (H(z)^{k1} delta(z)^{k2}), with I(x;z)=H(z) from Eq. (4). The derivation rests on Fano's inequality in Eqs. (5)-(6), applied after redefining Pe as semantic or perceptual failure in Section 4.2. This bridge is not proved and is likely invalid. Fano's inequality in the form Pe log|X| >= H(X|Z) - H(Pe) requires X to be a discrete random variable over a finite alphabet with known cardinality |X|. For 64x64 or 128x128 continuous images, |X| is uncountably infinite, so log|X| is undefined and the later step treating |X| as a fixed dataset constant has no meaning. Redefining Pe as 'semantic equivalence' or 'perceptual similarity' requires constructing a finite partition of image space into success/failure classes with a bounded error event; the paper merely asserts that a binary distinction suffices, without establishing such a partition or its cardinality. A second, independent problem is Eq. (4): the paper writes H(z|x)=0 because the feature map is deterministic. That is false for differential entropy: conditioning on a deterministic function gives h(Z|X) = -infinity, not zero, and the corresponding mutual information is infinite unless a finite-precision or discretized model is explicitly assumed. Similarly, differential entropies can be negative, so the ratio in Eq. (7) has no well-defined units or positivity. Thus the formal derivation of Dmia collapses to a heuristic proposal: the delta(z) term is already acknowledged as heuristic, and the constants k1, k2 are unspecified. The empirical defense results and ablations remain meaningful as engineering evidence, but the paper's headline claim of a 'first theoretical criterion' is not supported by the proof as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies model inversion attacks (MIAs) in collaborative inference (CI), where an edge device sends intermediate features to a cloud model, and makes two related contributions. First, it proposes Dmia, a 'difficulty criterion' (Eq. (7)) asserting that MIA difficulty grows with the conditional entropy H(x|z) and falls with the feature entropy H(z) and the mean number of nonzero features δ(z), with the identification I(x;z)=H(z) argued from the determinism of the feature mapping (Eq. (4)) and justified through Fano's inequality applied to the reconstruction error (Eqs. (5)-(6)). Second, it proposes SiftFunnel, a defense whose funnel-shaped edge model, attention modules, and loss terms (distance correlation, Pearson correlation, l1 sparsity, label smoothing with KL divergence) are designed to increase H(x|z) and reduce H(z) and δ(z). Experiments on CIFAR-10, FaceScrub, CelebA, and ChestX-ray, using CNN, ResNet-18, and VGG16 edge models and both MLE-based and Gen-based attacks, report that SiftFunnel approximately doubles the reconstruction MSE of the strongest IB baseline under Gen-based MIA on the CNN (0.0639 versus 0.035, Table 2) at roughly 2-3% accuracy loss, with a nearly 20x reduction in edge parameters; the ablation study in Table 5 attributes these gains to all major loss and architectural components.","tokens_in":22830,"tokens_out":19430,"duration_ms":177236,"significance":"If the analysis were fully rigorous, the paper would provide the first principled design criterion for MIA-resistant collaborative inference, and its empirical surface is genuinely valuable: four datasets, three edge architectures, two attack families, nine baselines, a gray-box attack setting, extensive ablations, latency measurements, and a public code release. The ablation study (Table 5) gives direct, falsifiable evidence that each component of SiftFunnel (funnel, attention, distance correlation, Pearson, l1, KL+LS) contributes to reconstruction error, and the consistent ~2-3% accuracy cost across datasets makes the usability-privacy-deployability trade-off credible. The paper also includes honest caveats, such as Section 4.3's acknowledgment of the gap in MLE-based MIA evaluation methods and Section 5.2's statement that the non-independence assumption is idealized. The theoretical contribution, however, is currently a heuristic: Eq.","major_comments":[{"comment":"The identity I(x;z)=H(z) relies on the assertion H(z|x)=0, which is valid only for discrete random variables under a deterministic mapping. For the continuous-valued images and intermediate features used throughout the experiments, the conditional differential entropy h(Z|X) diverges rather than equaling zero, and the associated mutual information is infinite unless a finite-precision model is assumed. The paper never states such a discretization, yet Section 6 reports finite MI values on a [0,1] scale (Tables 2-5) without specifying how the MINE estimates are normalized. This is load-bearing because Eq. (7) is the paper's central theoretical claim. Please either state explicitly that all information quantities in Section 4 are defined with respect to a fixed quantization of inputs and features, or rework the derivation in terms of differential entropies and explain how the finite estimates produced by MINE relate to the theoretical quantities.","section":"§4.2, Eq. (4)"},{"comment":"The lower-bound derivation assumes Fano's inequality in its exact-recovery form, Pe log|X| ≥ H(X|Z) − H(Pe), and then extends it to perceptual similarity with a single sentence: 'the inequality merely requires a binary distinction between success and failure.' A binary success/failure event is not sufficient, because the bound contains |X|, whose value changes if X is replaced by a partition of the reconstruction space induced by a perceptual threshold; the paper provides no construction of such a partition, no bound on its cardinality, and no argument relating Pe to MSE/PSNR/SSIM. A charitable reading is that X is the finite set of 8-bit images, but then |X| is astronomically large, making the bound in Eq. (6) vacuous for any realistic H(x|z), so the inequality cannot order attack difficulties quantitatively in the image setting. A fixable route is to quantize the reconstruction space explicitly and derive a Fano bound for the quantized variable, or to present Eq. (7) explicitly as a heuristic criterion motivated by, rather than derived from, Fano's inequality.","section":"§4.2, Eqs. (5)-(6)"},{"comment":"The δ(z) factor and the exponents k1 and k2 are introduced by assertion ('the difficulty of implementing both types of MIA is inversely proportional to...'), with no derivation from the Fano chain in Eqs. (5)-(6), and with k1 and k2 left unspecified; they are called proportionality constants but are never fitted or assigned values. Moreover, under Eq. (4) the 'four critical factors' are not independent: I(x;z)=H(z) and H(x|z)=H(x)−H(z), so the numerator and denominator of Eq. (7) are functions of the same quantity. The resulting formula Dmia ∝ (H(x)−H(z))/(H(z)^{k1} δ(z)^{k2}) makes no quantitative prediction until the exponents are fixed or fitted. Please either derive a bound that involves δ(z), or fit and test Eq. (7) quantitatively across the configurations in Section 6, or explicitly label Eq. (7) as a qualitative ranking heuristic. As written, the abstract's claim that Eq. (7) is a criterion with 'demonstrated validity' is stronger than the derivation supports.","section":"§4.2, Eq. (7)"},{"comment":"The empirical validation does not yet establish the quantitative claims. First, every metric is reported for a single run; the paper itself notes in Section 4.3 that MINE-based MI estimates are sensitive to batch size and sampling, so headline numbers such as 'increases reconstruction error by ~30%' and 'lowers mutual and effective information metrics by ≥50%' need multiple seeds and error bars. Second, the validation never estimates H(x|z) or H(z) separately from data, nor does it compare the predictions of Eq. (7) against measured attack difficulty across a varied set of defenses; instead, SiftFunnel's loss directly minimizes distance correlation, Pearson correlation, and the l1 norm, which are the very quantities the criterion names, so the observed agreement with Dmia is at least partly built into the construction. The ablation study (Table 5) argues that each loss term matters, which is good evidence, but it does not test the predicted functional form of Eq. (7); a sharper falsification would show that configurations raising H(z) or δ(z) while holding other factors fixed make attacks easier. Third, the reported MI values are stated to range over [0,1] (e.g., 0.9719 in Table 3), which is not what the DV-representation estimator in Eqs. (9)-(10) returns; the normalization must be specified for the relative reductions to be interpretable.","section":"§6.3, Tables 2-5"}],"minor_comments":[{"comment":"Fano's inequality is cited to [42] and [43], but [43] is Arrow's 1969 economics paper and is not a source for Fano's inequality; please cite Fano (1961) or a standard textbook such as Cover and Thomas.","section":"§4.2 (citation)"},{"comment":"The loss function is numbered (14), but Section 6.1 refers to 'parameters ... in Equation (15)', and Section 4.3 says 'used Equation (11) to train MINE' while the MINE estimator is Eq. (10); please correct the equation cross-references.","section":"§5.3 / §6.1 (cross-references)"},{"comment":"Several typos and mechanical errors need cleanup: 'impiles' after Eq. (5); 'UA Vs' and 'Estimati-on-based' in Section 1; a duplicated sentence 'The final formulation of this optimization is as follows, with specific parameter settings.' in Section 5.3; and an incomplete phrase 'with negative values might drive correlations toward complete negative correlation' in Section 5.3.","section":"Throughout (typos and style)"},{"comment":"In Tables 2 and 3, the AE-based rows contain two extra numbers ('0.0542 17.4852 0.8151' and '0.0143 23.2332 0.9488') that appear to be gray-box Gen-based MIA results but are not aligned with the column headers; please make the row/column mapping explicit and clarify in the captions which entries are gray-box versus black-box results.","section":"Tables 2 and 3 (formatting)"},{"comment":"Figure 2 is discussed in detail in Section 4.3 (parts (a)-(d)) but does not appear in the manuscript version provided for review; please ensure the figure is present in the submission, as it is the primary visual evidence for the depth and skip-connection claims.","section":"Figure 2"},{"comment":"The abstract's 'increases reconstruction error by ~30%' claim needs an explicit baseline and configuration: versus the AE-based baseline it ranges from about 35% on FaceScrub (Table 4) to several-fold on ResNet-18 (Table 3), so the 30% figure is not directly traceable from the tables.","section":"Abstract and §6.3 (headline claim)"},{"comment":"The label-smoothing parameter α plays an important role in Eqs. (13)-(14), and the paper notes that LS can in some settings increase feature entropy; please state how α interacts with the KL divergence and whether α=0.35 was tuned per dataset or fixed, since Table 4 adjusts λ1-λ3 across datasets.","section":"§5.3 (label smoothing)"}],"recommendation":"major_revision","confidential_remarks":"To the editor: the paper's headline novelty ('first theoretical criterion, with demonstrated validity') is the part I would scrutinize most. Sections 4.2 and 6.3 claim more than the derivation and experiments establish; the revision should require the authors either to supply the missing discrete-variable and perceptual-partition arguments, or to reframe Eq. (7) as a heuristic and present the criterion as a motivational framework for the defense. The empirical defense contribution is solid enough to be publishable once multi-seed statistics and a normalization of the reported MI values are added. Note also the citation of Arrow (1969) for Fano's inequality, which appears to be an error. Scope fit with a security venue is fine; with an information-theory venue it would be weaker without a repaired derivation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the defense work is genuinely useful, the theory is not. The paper deserves peer review, but the authors need to either fix or soften the Dmia derivation.\n\nWhat's new: SiftFunnel combines a funnel-shaped edge head, SE/CBAM/triplet attention, and a loss mixing distance correlation, Pearson correlation, l1, and label smoothing. That combination is new, and the experimental coverage is unusually broad: four datasets, MLE and Gen-based attacks, gray-box evaluation, ablations, latency and memory numbers. Reconstruction error roughly triples over the best baseline in some conditions while accuracy drops about 2–3%. Code is linked. That is a real engineering contribution worth citing.\n\nSoft spots: the criterion in Eq. (7) is the advertised headline, and it does not hold together as a theorem. Fano's inequality is applied to a redefined 'perceptual' error with no derivation of the appropriate partition of the input space; the bound on H(X|Z) does not follow from a success/failure distinction on a semantic label. The step H(z|x)=0 is fine for discrete finite-precision features, but the paper never states that, and for continuous features the differential conditional entropy is not zero. The delta(z) factor is admitted to be heuristic, and k1, k2 are unspecified, so Eq. (7) is a plausible heuristic, not a 'first theoretical criterion.' The empirical validation also has no error bars and partly validates Dmia by optimizing the very quantities it measures.\n\nThat said, these flaws do not sink the defense. The ablations show each loss term matters, the gray-box evaluation is honest, and the comparison set is fair. The paper's value is the practical defense, not the theory. I would like to see the theoretical claims cut down to 'heuristic guidance' and the Fano bridge either proved for a suitable finite alphabet or dropped. Also note the Fano citation is off: [42] and [43] are not Fano's original inequality.\n\nFor a venue: yes, send to serious referees. The defense is strong enough to warrant revision; the theory needs correcting but is fixable by reframing.","headline":"Solid defense, shaky theory: SiftFunnel's empirical gains are real, but the 'first theoretical criterion' overclaims.","tokens_in":23445,"tokens_out":3120,"would_cite":true,"duration_ms":31201,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes a criterion, Dmia, claiming model-inversion attacks get harder as conditional entropy H(x|z) grows and easier as feature entropy H(z) and the average number of non-zero features δ(z) grow, then builds a defense…","keywords":["model inversion attack","collaborative inference","privacy-preserving machine learning","mutual information","Fano's inequality","feature entropy","SiftFunnel","information bottleneck"],"falsifier":"Train two edge models with equal I(x;z) but different δ(z), for example by pruning feature channels, and measure whether a generative model-inversion attack's reconstruction error rises as δ(z) falls; if reconstruction error stays flat while δ(z) halves, the criterion's predicted dependence on δ(z) is refuted.","tokens_in":22252,"feed_emoji":"🛡️","tokens_out":6459,"duration_ms":57760,"temperature":0.7,"pith_summary":"This paper tries to answer a basic question: when is an edge model's transmitted feature vector actually hard to invert? It derives a criterion, Dmia, from Fano's inequality and a deterministic-encoder identity, and claims attack difficulty grows with conditional entropy of the input given the features and falls with feature entropy and the average count of non-zero feature entries, with mutual information equal to feature entropy. The authors validate the criterion with a neural mutual-information estimator and then build SiftFunnel, a training scheme that uses distance correlation, Pearson correlation, an $\\ell^1$ penalty, and label smoothing to suppress redundant features. They report roughly 30% higher reconstruction error than the strongest baseline with about 3% accuracy loss and a nearly 20× smaller edge model. A sympathetic reader would care because this offers a theoretical handle on a vulnerability that has mostly been studied attack-by-attack.","feed_headline":"Privacy criterion ties model-inversion risk to feature entropy","feed_subtitle":"A defense built on that criterion raises reconstruction error ~30% and shrinks edge model size ~20x.","key_machinery":"The load-bearing object is the scalar criterion Dmia ∝ H(x|z) / (H(z)^k1 · δ(z)^k2), with I(x;z) = H(z), where H(x|z) is the conditional entropy of the input given the transmitted feature, H(z) is the feature entropy, and δ(z) is the average number of non-zero elements in z. It is derived by modeling inversion as a Markov chain x → z → x* and applying Fano's inequality to lower-bound reconstruction error, together with the deterministic-encoder identity H(z|x) = 0. The criterion converts a vague intuition about 'too much information in features' into a testable ranking of attacks and defenses, and it directly guides SiftFunnel's loss terms: distance correlation to raise H(x|z), Pearson correlation and $\\ell^1$ to lower H(z) and δ(z), and label smoothing to preserve task accuracy.","core_discovery":"The central claim is that the difficulty of implementing a model inversion attack in collaborative inference is governed by four quantities: the mutual information I(x;z) between input and transmitted feature (which for a deterministic encoder equals H(z)), the conditional entropy H(x|z), the feature entropy H(z), and δ(z), the average number of non-zero elements in z. Concretely, Dmia ∝ H(x|z) / (H(z)^k1 · δ(z)^k2): increasing conditional entropy makes reconstruction harder, while increasing feature entropy or effective information volume makes it easier. The same bound applies to both maximum-likelihood and generative attacks, with δ(z) additionally controlling the separability and training convergence of generative attackers. The paper then claims the defense SiftFunnel instantiates this criterion: a funnel-shaped edge network with attention and channel compression, trained with distance correlation, Pearson correlation, $\\ell^1$ regularization, and label smoothing, raises reconstruction error by about 30% over state-of-the-art defenses while sacrificing roughly 3% accuracy and cutting edge parameters almost 20-fold.","pith_inferences":["As an editorial extension, if Dmia holds beyond the tested image datasets, it gives a deployment-time audit: measure H(z) and δ(z) with estimator-style tools instead of running expensive attacks, and treat rising δ(z) as an alarm.","As an editorial extension, the same loss recipe of distance correlation, Pearson correlation, l1, and label smoothing could transfer to split learning or semantic communication settings the paper does not test, since the criterion does not depend on a specific classifier architecture.","As an editorial extension, a natural stress test not in the paper is to adapt the attacker to also reduce distance correlation on auxiliary data; if that attack defeats SiftFunnel, the defense's advantage may rest partly on a fixed-threat assumption rather than on the information bound alone."],"forward_implications":["Defenses no longer need direct mutual-information estimation: they can achieve the same privacy effect by cheaply pushing down H(z) and δ(z) and pushing up H(x|z), which is what SiftFunnel does.","Shallow edge models without skip connections already reduce I(x;z) with depth; adding skip connections preserves δ(z) and weakens privacy, so network topology is itself a privacy lever.","Compared with state-of-the-art defenses, a Dmia-guided funnel edge model raises reconstruction error by about 30%, cuts mutual information and δ(z) by at least 50%, and reduces edge parameters by almost 20× with comparable accuracy.","The criterion unifies existing defenses: IB methods lower I(x;z), perturbation methods raise H(x|z), and deeper-network methods reduce both I(x;z) and δ(z)."],"supporting_citations":[{"why":"Defines the MLE-based and generative inversion attacks against collaborative inference that the criterion must explain and the defense must resist.","marker":"[6]"},{"why":"Introduces the generative inversion attack with background-knowledge alignment used as the black-box attack baseline.","marker":"[10]"},{"why":"Provides the mutual-information neural estimator used to validate the dependence of attack difficulty on I(x;z).","marker":"[24]"},{"why":"Supplies Fano's inequality, the formal foundation for the lower bound on reconstruction error in the Dmia derivation.","marker":"[42]"},{"why":"BiDO, the bilateral dependency optimization defense whose kernel-bandwidth sensitivity motivates SiftFunnel's distribution-free correlation constraints.","marker":"[18]"},{"why":"The autoencoder-based NND and IB defense against which SiftFunnel's performance is compared, including its gray-box weakness.","marker":"[15]"},{"why":"Source of the label-smoothing insight that SiftFunnel adapts to preserve usability while suppressing feature separability.","marker":"[33]"},{"why":"Defines distance correlation, used in the loss to raise H(x|z).","marker":"[47]"},{"why":"Defines Pearson correlation, used in the loss to lower H(z) and δ(z).","marker":"[48]"}],"fun_headline_variants":["Feature entropy sets model inversion attack difficulty","SiftFunnel: 30% more privacy, 20x leaner edge model","Privacy bound: entropy and information volume govern MIA resistance","New criterion predicts and resists model inversion attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The criterion's derivation assumes Fano's inequality, stated for exact recovery over a finite alphabet, still holds when reconstruction error is redefined as semantic or perceptual similarity; the paper asserts this bridge but does not prove it.","fun_headline_variants_meta":{"raw":{"variants":["Feature entropy sets model inversion attack difficulty","SiftFunnel: 30% more privacy, 20x leaner edge model","Privacy bound: entropy and information volume govern MIA resistance","New criterion predicts and resists model inversion attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000537,"raw_usage":{"total_tokens":2629,"prompt_tokens":1044,"completion_tokens":1585,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":660,"completion_tokens_details":{"reasoning_tokens":1526}},"tokens_in":660,"tokens_out":1585,"duration_ms":12774,"temperature":1.0,"reasoning_tokens":1526,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:41:47.559199+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train two edge models with equal I(x;z) but different δ(z), for example by pruning feature channels, and measure whether a generative model-inversion attack's reconstruction error rises as δ(z) falls; if reconstruction error stays flat while δ(z) halves, the criterion's predicted dependence on δ(z) is refuted.","supporting_citations":[{"cited_title":"Neural network inversion in adversarial setting via background knowledge alignment,","cited_arxiv_id":null,"evidence_quote":"Introduces the generative inversion attack with background-knowledge alignment used as the black-box attack baseline."},{"cited_title":"Mutual information neural estimation,","cited_arxiv_id":null,"evidence_quote":"Provides the mutual-information neural estimator used to validate the dependence of attack difficulty on I(x;z)."},{"cited_title":"Query-efficient model inversion attacks: An information flow view,","cited_arxiv_id":null,"evidence_quote":"Supplies Fano's inequality, the formal foundation for the lower bound on reconstruction error in the Dmia derivation."},{"cited_title":"Bilateral dependency optimization: Defending against model-inversion attacks,","cited_arxiv_id":null,"evidence_quote":"BiDO, the bilateral dependency optimization defense whose kernel-bandwidth sensitivity motivates SiftFunnel's distribution-free correlation constraints."},{"cited_title":"Privacy-preserving autoencoder for col- laborative object detection,","cited_arxiv_id":null,"evidence_quote":"The autoencoder-based NND and IB defense against which SiftFunnel's performance is compared, including its gray-box weakness."},{"cited_title":"Feature screening via distance corre- lation learning,","cited_arxiv_id":null,"evidence_quote":"Defines distance correlation, used in the loss to raise H(x|z)."},{"cited_title":"Pearson correlation coefficient,","cited_arxiv_id":null,"evidence_quote":"Defines Pearson correlation, used in the loss to lower H(z) and δ(z)."}],"review_version":1}