RECORD
Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble
Cryptography and Security · Submitted 19 Jan 2024
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Our experiments demonstrate that Ensembler can effectively shield input images from reconstruction attacks, even when the client only retains one layer of the network locally.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
For collaborative inference through a cloud computing platform, it is sometimes essential for the client to shield its sensitive information from the cloud provider. In this paper, we introduce Ensembler, an extensible framework designed to substantially increase the difficulty of conducting model inversion attacks by adversarial parties. Ensembler leverages selective model ensemble on the adversarial server to obfuscate the reconstruction of the client's private information. Our experiments demonstrate that Ensembler can effectively shield input images from reconstruction attacks, even when the client only retains one layer of the network locally. Ensembler significantly outperforms baseline methods by up to 43.5% in structural similarity while only incurring 4.8% time overhead during inference.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | For collaborative inference through a cloud computing platform, it is sometimes essential for the client to shield its sensitive information from the cloud provider. | background 1.00 | 0.04 | 0.02 | hedged possibility 0.73 |
| s1 | In this paper, we introduce Ensembler, an extensible framework designed to substantially increase the difficulty of conducting model inversion attacks by adversarial parties. | contribution 1.00 | 0.85 | 0.23 | asserted 0.97 |
| s2 | Ensembler leverages selective model ensemble on the adversarial server to obfuscate the reconstruction of the client's private information. | method 0.98 | 0.59 | 0.09 | asserted 1.00 |
| s3 | Our experiments demonstrate that Ensembler can effectively shield input images from reconstruction attacks, even when the client only retains one layer of the network locally. | result 1.00 | 0.96 | 0.45 | asserted 1.00 |
| s4 | Ensembler significantly outperforms baseline methods by up to 43.5% in structural similarity while only incurring 4.8% time overhead during inference. | result 1.00 | 0.95 | 0.31 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v2
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
For collaborative inference through a cloud computing platform, it is sometimes essential for the client to shield its sensitive information from the cloud provider. In this paper, we introduce Ensembler, an extensible framework designed to substantially increase the difficulty of conducting model inversion attacks by adversarial parties. Ensembler leverages selective model ensemble on the adversarial server to obfuscate the reconstruction of the client's private information. Our experiments demonstrate that Ensembler can effectively shield input images from reconstruction attacks, even when the client only retains one layer of the network locally. Ensembler significantly outperforms baseline methods by up to 43.5% in structural similarity while only incurring 4.8% time overhead during inference.
Human review
How the literature uses it
1 arXiv paper cite this in 1 sentence
What it cites · 1 sentence without a confident label
Compares with 1 paper
-
In addition, we report the real-world time delay of the proposed method compared with its single counterpart and a recent encryption-based method [ref] .
Efficient Privacy-Preserving Machine Learning with Lightweight Trusted Hardware · Experiment Setup · 0.98
Cites as background 4 papers
-
For simplicity and without loss of generalization, we will group existing approaches into two categories in this paper: encryption-based algorithms that guarantee privacy at the cost of thousands of times of time efficiency [ref] , and perturbation-based algorithms that operate on the intermediate layers of a DL architecture, introducing noise to thwart the adversary's ability to recover client input [ref] .
xMLP: Revolutionizing Private Inference with Exclusive Square Activation · Collaborative Machine Learning · 0.81
-
[ref] provides an extensive discussion on different algorithmic and architectural choices and their impacts on privacy protection.
Privacy-Preserving Machine Learning: Methods, Challenges and Directions · Collaborative Machine Learning · 0.94
-
Related areas include federated learning, where multiple edge devices jointly train a DL model [ref] ; split learning, where a DL model is split into two or more parts, and the client and server jointly train it [ref] ; and collaborative inference, where a DL model is split, with only a portion deployed on the server to provide services [ref] .
Split Learning for collaborative deep learning in healthcare · Collaborative Machine Learning · 0.99
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.