Privacy-Aware Multi-Device Cooperative Edge Inference with Distributed Resource Bidding

Wenhao Zhuang; Yuyi Mao

REVIEW 4 major objections 5 minor 19 references

Privacy-Aware Multi-Device Cooperative Edge Inference with Distributed Resource Bidding

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that multiple mobile devices can share one edge server's classification service while keeping their images private, by learning, with only local observations, how much to bid for the server's help and how hard to compress…

desk verdict A sensible MARL formulation for a real privacy-aware edge inference problem, undermined by a sloppy reward equation and thin experimental evidence; fixable, worth refereeing. read the letter →

arxiv 2412.21069 v1 pith:MF64DMSS submitted 2024-12-30 eess.SY cs.LGcs.NIcs.SY

Wenhao Zhuang , Yuyi Mao This is my paper · ORCID

classification eess.SYcs.LGcs.NIcs.SY

keywords edgeartificialintelligenceinferenceprivacyawarenessdistributedbiddingmulti-agentdeepreinforcementlearningmodelinversionattackintermediatefeaturecompressionDEC-POMDP

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that several mobile devices can use one edge server for AI classification without surrendering their data to a curious server, and without needing any central scheduler. The lever is intermediate feature compression: each device squeezes the features it transmits, so a model-inversion attack at the server reconstructs only a degraded image. Each device independently decides how much to bid for the server's resources and how hard to compress, observing only its own channel rate, remaining bidding budget, and a one-number difficulty score for its data. In simulations the learned distributed policies land within 1.32% and 0.27% of a centralized upper bound's classification accuracy at a privacy level of SSIM 0.26, beat a channel-blind baseline by 0.31-0.95%, and gain a further 1.54-1.67% from including the difficulty score. If correct, this means privacy and competition for edge resources can be handled decentrally with only a small accuracy loss.

What carries the argument

The machinery is a DEC-POMDP formulation solved by MADDPG: a multi-agent deep deterministic policy gradient algorithm, where each agent has an actor network that outputs a continuous bidding value and logits over discrete compression ratios, plus a critic network estimating the joint state-action value, applied to a decentralized partially observable Markov decision process (the multi-agent extension of a POMDP in which each device sees only part of the global state). Each device's observation is [n, ck[n], Mk[n], t(pd_k[n])] — the time slot, its own uplink rate, its remaining bidding budget, and the logit entropy, a scalar measure of how hard the current image is to classify. The reward in Eq. (9) combines the cross-entropy classification loss with the SSIM between the server's reconstruction from the compressed feature and the original image, making the compression ratio the control knob for privacy. The Gumbel-Softmax trick makes the discrete compression-ratio selection differentiable for back-propagation, and a hierarchical replay buffer stores entire episodes of N time slots so policies optimize cumulative rather than per-slot reward.

What would settle it

Train the MADDPG agents with the privacy reward computed by a surrogate inversion network, then deploy the learned policies in a testbed where the server's actual inversion network differs (for example, a stronger one); if the measured SSIM at the server exceeds 0.26, or the accuracy deviates from the paper's reported curve, the claimed privacy-accuracy operating point fails in deployment.

Watch

Extended reading notes

Core claim

The paper's central claim is that the joint problem of bidding for the MEC server's computational resources and choosing intermediate-feature compression ratios can be solved in a fully decentralized way by multi-agent deep reinforcement learning, with each mobile device acting on a local observation that contains only the time slot, its own uplink achievable rate, its remaining bidding budget, and the entropy of its local classifier's logits. The authors model the system as a decentralized partially observable Markov decision process and train the bidding and compression policies with a multi-agent deep deterministic policy gradient algorithm in which each device's reward balances classification cross-entropy against the structural similarity between the server's model-inversion reconstruction and the original image. On two image-classification tasks (STL-10 and CIFAR-10), the learned policies nearly match a centralized deep Q-network that observes the global state: at an SSIM of 0.26, classification accuracy is only 1.32% and 0.27% lower for the two devices, and the method outperforms a channel-agnostic statistical baseline by 0.31-0.95%, with the data-difficulty feature contributing an extra 1.54-1.67%.

Load-bearing premise

The scheme only learns because each device can compute the privacy reward, which is the similarity between the original image and what the server's secret reconstruction network would output; that requires the device to possess and simulate the server's reconstruction model, which a truly curious server would never provide.

Editorial extensions

If this is right

A privacy guarantee can be maintained while each device decides purely from local information, so no central authority needs to know other devices' data, channels, or budgets.
Compression ratio works as a continuous privacy-accuracy dial, and the learned policies automatically compress harder when the channel is weak or the data is easy.
Adding a scalar data-difficulty feature (logit entropy) is worth 1.54-1.67% accuracy because scarce bids get spent on genuinely hard images.
The accuracy gap to a fully centralized scheduler is at most 1.32% at SSIM 0.26, indicating that decentralization itself is not the dominant cost.
When privacy is not a concern (high SSIM targets), the learned policy approaches the no-compression accuracy, so the scheme degrades gracefully instead of collapsing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The training reward requires each device to compute the SSIM between the original image and the server's reconstruction, which means the device must know and simulate the server's inversion network; a truly curious server would keep that network secret, so a practical deployment would need a surrogate or certified reconstruction bound — a step this paper leaves implicit.
The bidding mechanism is effectively an auction, and the results suggest that auction-theoretic questions (efficiency, truthfulness, revenue-neutral budgets) could be asked directly of this scheme; one testable extension is whether a simple bidding rule based on per-device marginal accuracy gain reproduces the learned policies.
Logit entropy as a cheap difficulty signal could transfer to other multi-device resource allocation problems with local observations, such as spectrum sharing, caching, or model split-point selection.
A direct robustness test would be to deploy the trained policies against a server with a stronger or differently trained inversion network than used during training, and check whether the claimed SSIM 0.26 privacy boundary still holds.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Punchline: the paper is a reasonable first cut at a genuinely multi-device version of privacy-aware cooperative edge inference, and the MADDPG formulation is not a trivial rehash. But Eq. (9) as printed cannot train anything, and the experimental support for the headline numbers is thinner than the text suggests.

What is new: most prior privacy-aware split inference is single-device. This paper adds distributed bidding for server resources and a DEC-POMDP where each device sees only its own rate, budget, and local logit entropy. That is a fair problem statement. The algorithmic pieces—MADDPG, Gumbel-Softmax, hierarchical replay—are assembled sensibly, and the simulation setup is concrete. The result that a channel-aware distributed policy beats a channel-agnostic one by 0.3–0.95%, and that adding data-difficulty helps by another 1.5–1.7%, is believable as a qualitative finding.

Where it falls down. The stress-test note is half right. The cross-entropy term in Eq. (9) is indeed backwards; that is a typo, not a conceptual failure, but it has to be fixed. The bigger gap is that Rk includes SSIM between the server's reconstruction and the original image, which requires the server's reconstruction network. In MADDPG-style centralized training a simulator can compute that reward and hand it to the agents, but the paper never says so. As written, the training loop is not executable. This is fixable with one sentence and a small algorithm edit, but it is exactly the kind of thing a referee should ding.

The quantitative claims also rest on thin ice: no error bars or seeds, two devices only, and the SSIM 0.26 target is chosen from the paper's own Fig. 2. The accuracy differences are under 2%, so without variance estimates they may not be significant. The DQN baseline is fine as a strawman upper bound, but calling it an upper bound is generous. No code release makes it harder to verify. The citation pattern looks fine, with no obvious missing prior work in my area.

Bottom line: the system model and problem formulation are worth building on, and the results are plausible enough to warrant a serious referee. But it needs a corrected reward equation, an explicit statement of who computes the reward, multi-seed statistics, and ideally code before publication. I would not cite it in its current form.

Referee Report

4 major / 5 minor

Summary. The paper considers a mobile edge computing system in which multiple devices perform image classification with the help of a single MEC server, while treating the server as a curious adversary. Each device can either classify locally or bid for the server's cooperative inference service, and intermediate features can be compressed before transmission to reduce privacy leakage measured by SSIM. The authors formulate the joint bidding and compression problem as a DEC-POMDP with partially observable local state, propose an MADDPG-based algorithm with actor-critic networks and a hierarchical replay buffer, and evaluate it on two devices using STL-10 and CIFAR-10. The reported results claim that the proposed distributed policies approach a centralized DQN baseline at a target SSIM of 0.26, outperform a channel-agnostic baseline by 0.31-0.95%, and gain an additional 1.54-1.67% when data-difficulty features are included in the observation.

Significance. If the central claims are reproducible, the paper makes a useful incremental contribution: it extends privacy-aware cooperative edge inference from single-device settings to a multi-device setting with competitive resource bidding, and it demonstrates that a multi-agent reinforcement learning approach can yield distributed policies based only on local observations. The paper is reasonably clear in its system model, provides a pseudocode algorithm, and includes several ablation variants (MADDPG-DD, MADDPG-DT, MADDPG-MC) that help isolate the effect of individual design choices. The main weaknesses are that the reward function as printed is not executable or mathematically valid, the headline comparisons rely on an informally chosen SSIM threshold, and the reported accuracy differences are small without statistical uncertainty quantification. These issues are fixable and do not invalidate the overall research direction, but they must be addressed before the quantitative conclusions can be accepted.

major comments (4)

[§III-B, Eq. (9)] The reward function cannot be evaluated from the information available to the agents as specified. The privacy term Lp(hat x_k[n], x_k[n]) is the SSIM between the server's model-inversion reconstruction and the original image. This quantity depends on the server's reconstruction network I_theta_k and is not included in the observation O_k[n] in Eq. (8); the paper never states that the device can simulate I_theta_k, nor that a trusted training-time oracle computes R_k and feeds it to the replay buffer. Since Eq. (9) is the only reward used in the critic update (12), Algorithm 1 is not executable as written. Please specify who computes R_k and, if a central oracle is used, explain its relation to the curious-server assumption.
[§III-B, Eq. (9)] The printed cross-entropy term is invalid. The line following Eq. (9) defines Lc(p_k[n], y_k,n) = -Σ_c p_k,c[n] log(y_k,n). For a scalar label y_k,n, log(y_k,n) is zero/negative or undefined; for a one-hot label, the sum is over the wrong argument. The standard form is -Σ_c y_k,n,c log p_k,c[n]. Also, the equation uses La while the definition uses Lc. As printed, the accuracy component of the reward would not be a meaningful training signal.
[§III-C and §V, Fig. 4] The headline operating point is an SSIM index of 0.26, justified by the statement in §III-C that reconstructed images become "indistinguishable" below 0.26. This threshold is a subjective/self-selected point from Fig. 2, with no perceptual study or statistical test. The quantitative claims (e.g., 1.32% and 0.27% accuracy differences versus DQN, and the 0.31-0.95% and 1.54-1.67% improvements) are evaluated at or around this threshold. Please either justify the threshold with a reproducible procedure or present the comparisons over the full SSIM range rather than anchoring on a single value.
[§V, Fig. 4 and Abstract] The reported accuracy differences are small (0.31-0.95% and 1.54-1.67%) and no error bars, confidence intervals, or multiple-seed results are reported. It is therefore unclear whether the observed differences between MADDPG and the baselines are statistically significant. Please report the mean and variance over at least several random seeds and, if possible, a significance test.

minor comments (5)

[§II-A] The local classifier is said to compute logits, but the displayed quantity is Softmax(...); moreover, the expression uses hat z_k[n] before hat z_k[n] is defined. Please use z_k[n] and call the output a probability vector.
[§V, Fig. 3(b)] The caption should state that the horizontal axis m denotes the bidding budget M1=m and M2=10-m, since the main text only defines this in the paragraph discussing the figure.
[§IV-A] The centralized critic is defined on joint observations and actions Q({O_{k'}[n], A_{k'}[n]}_{k'}; Phi_k), whereas the MDP state in §III-A includes data, channels, budgets, and time. The paper should justify why joint observations are sufficient for the critic or define Q on the true state.
[Algorithm 1] The experience-collection loop samples channels and data but does not explicitly compute R_k. Once the reward oracle is clarified, add the corresponding step to the pseudocode so that the training loop is complete.
[References] References [4] and [5] share the page range 197-211 in different journals; please verify the page numbers, and reference [6] appears to have a typo in the journal abbreviation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's results are empirical RL evaluations with a standard reward objective; no derivation reduces to its own inputs.

full rationale

The paper's central claims are simulation results for an MADDPG-based distributed bidding and compression policy. The reward in Eq. (9) includes the SSIM privacy term, so reporting SSIM values as privacy outcomes reflects the optimized objective rather than an independent prediction; however, the headline accuracy comparisons are not forced by construction. The policies are learned and then evaluated against centralized DQN and channel-agnostic baselines on testing data, and the reported accuracy gap at an SSIM operating point depends on the learned bidding/compression behavior. The SSIM 0.26 threshold is an operating point selected from the paper's own Fig. 2, which is mildly self-referential but not a derivational circularity. Self-citations ([2], [5], [19]) are used for background, the IB principle, and a replay-buffer component; they are not the load-bearing justification for the main empirical claims. Separately, Eq. (9)'s printed cross-entropy expression appears reversed or undefined for scalar labels, and the paper does not specify how a device computes the SSIM reward term; these are correctness/implementation concerns, not circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper's central claim rests on standard RL assumptions, a specific and partly ad hoc threat model, and the availability of an exact privacy-leakage reward that a real device could not easily obtain. The SSIM threshold and reward weights are chosen by the authors to produce the accuracy-privacy operating points reported.

free parameters (3)

Reward weights t1,k and t2 = e.g., t1,1=t1,2=0.2, t2=0.8 (Fig 3a); t1,1=t1,2=0.9, t2=0.1 (Fig 3b); swept for Fig 4
Hand-chosen weights trade classification accuracy against SSIM privacy; the operating point (e.g., SSIM 0.26) at which headline improvements are reported is determined by these weights.
Gumbel-Softmax temperature tau_omega = not reported
Controls exploration over compression ratios; its value affects the learned policy and is not specified.
Privacy target SSIM threshold = 0.26
The abstract's claim of 0.31-0.95% accuracy improvement is reported at SSIM=0.26, a threshold derived from the paper's own Fig 2 to define 'sufficient' privacy.

assumptions (3)

domain assumption Inference data {x_k[n]} and labels {y_k[n]} are sampled from a joint distribution P(X_k, Y_k) independently over time.
Justifies the MDP/DEC-POMDP formulation in Sec III-A; if data is non-stationary or correlated across slots, the transition model is invalid.
domain assumption The MEC server is honest-but-curious: it follows the bidding protocol and only passively reconstructs data with a fixed attack model.
Bounds the threat model; the server does not adapt its attack to the compression policy, and no active adversary is considered. Introduced in Sec II-C.
ad hoc to paper SSIM is a valid proxy for privacy leakage, with 0.26 as the indistinguishability threshold.
The threshold is asserted from visual inspection of Fig 2 without a quantitative user study or external benchmark; the reward in Eq. (9) relies on this proxy.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Privacy-Aware Multi-Device Cooperative Edge Inference with Distributed Resource Bidding." pith.science (2026). https://pith.science/paper/MF64DMSS

@misc{pith2026241221069,
  author       = {Pith},
  title        = {Pith review of: Privacy-Aware Multi-Device Cooperative Edge Inference with Distributed Resource Bidding},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MF64DMSS}},
  note         = {Machine review of arXiv:2412.21069}
}

read the original abstract

Mobile edge computing (MEC) has empowered mobile devices (MDs) in supporting artificial intelligence (AI) applications through collaborative efforts with proximal MEC servers. Unfortunately, despite the great promise of device-edge cooperative AI inference, data privacy becomes an increasing concern. In this paper, we develop a privacy-aware multi-device cooperative edge inference system for classification tasks, which integrates a distributed bidding mechanism for the MEC server's computational resources. Intermediate feature compression is adopted as a principled approach to minimize data privacy leakage. To determine the bidding values and feature compression ratios in a distributed fashion, we formulate a decentralized partially observable Markov decision process (DEC-POMDP) model, for which, a multi-agent deep deterministic policy gradient (MADDPG)-based algorithm is developed. Simulation results demonstrate the effectiveness of the proposed algorithm in privacy-preserving cooperative edge inference. Specifically, given a sufficient level of data privacy protection, the proposed algorithm achieves 0.31-0.95% improvements in classification accuracy compared to the approach being agnostic to the wireless channel conditions. The performance is further enhanced by 1.54-1.67% by considering the difficulties of inference data.

Figures

Figures reproduced from arXiv: 2412.21069 by the authors.

**Figure 3.** (a) Averaged cumulative reward achieved by the proposed [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

**Figure 4.** Classification accuracy versus SSIM index value with testing [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

19 extracted references · 12 canonical work pages

[1]

Edge artificial intelligence for 6G: Vision, enabling technologies, and applications,

K. B. Letaief, Y . Shi, J. Lu, and J. Lu, “Edge artificial intelligence for 6G: Vision, enabling technologies, and applications,” IEEE J. Sel. Areas Commun., vol. 40, no. 1, pp. 5–36, Jan. 2022

2022
[2]

Green edge AI : A contemporary survey,

Y . Mao, X. Yu, K. Huang, Y .-J. A. Zhang, and J. Zhang, “Green edge AI : A contemporary survey,” Proc. IEEE, vol. 112, no. 7, pp. 880–911, Jul. 2024

work page 2024
[3]

Edge AI: On-demand acceler- ating deep neural network inference via edge computing,

E. Li, L. Zeng, Z. Zhou, and X. Chen, “Edge AI: On-demand acceler- ating deep neural network inference via edge computing,” IEEE Trans. Wireless Commun., vol. 19, no. 1, pp. 447–457, Jan. 2020

2020
[4]

Communication-computation trade-off in resource-constrained edge inference,

J. Shao and J. Zhang, “Communication-computation trade-off in resource-constrained edge inference,” IEEE Commun. Mag. , vol. 58, no. 12, pp. 197–211, Dec. 2020

work page 2020
[5]

Learning task-oriented communication for edge inference: An information bottleneck approach,

J. Shao, Y . Mao, and J. Zhang, “Learning task-oriented communication for edge inference: An information bottleneck approach,” IEEE J. Sel. Areas Commun., vol. 40, no. 1, pp. 197–211, Jan. 2022

2022
[6]

Joint source-channel coding for channel-adaptive digital semantic communications,

J. Park, Y . Oh, S. Kim, and Y .-S. Jeon, “Joint source-channel coding for channel-adaptive digital semantic communications,” IEEE Trans. Cong. Commun. Netw., to appear

work page
[7]

Exploring image reconstruction attack in deep learning computation offloading,

H. Oh and Y . Lee, “Exploring image reconstruction attack in deep learning computation offloading,” in The 3rd Int. Workshop Deep Learn. Mobile Syst. Appl. , ser. EMDL ’19, New York, NY , USA, 2019, p. 19–24

work page 2019
[8]

Attacking and protecting data privacy in edge-cloud collaborative inference systems,

Z. He, T. Zhang, and R. B. Lee, “Attacking and protecting data privacy in edge-cloud collaborative inference systems,” IEEE Internet Things J. , vol. 8, no. 12, pp. 9706–9716, 2021

work page 2021

Show all 19 references

[9]

Can differential privacy practically protect collaborative deep learning inference for IoT?

J. Ryu et al. , “Can differential privacy practically protect collaborative deep learning inference for IoT?” Wireless Netw., vol. 30, pp. 4713– –4733, Aug. 2024

2024
[10]

Joint model, task partitioning and privacy preserving adaptation for edge DNN inference,

J. Jiang, H. Li, and L. Wang, “Joint model, task partitioning and privacy preserving adaptation for edge DNN inference,” in Proc. IEEE Wireless Commun. Netw. Conf. (WCNC) , Austin, TX, USA, Apr. 2022

2022
[11]

Privacy-preserving task-oriented semantic communications against model inversion attacks,

Y . Wang, S. Guo, Y . Deng, H. Zhang, and Y . Fang, “Privacy-preserving task-oriented semantic communications against model inversion attacks,” IEEE Trans. Wireless Commun. , vol. 23, no. 8, pp. 10 150–10 165, Aug. 2024

2024
[12]

Multi-agent actor-critic for mixed cooperative- competitive environments,

R. Lowe et al. , “Multi-agent actor-critic for mixed cooperative- competitive environments,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), NY , USA, Dec. 2017

2017
[13]

Mibench: A comprehensive benchmark for model inversion attack and defense,

Y . Qiu et al. , “Mibench: A comprehensive benchmark for model inversion attack and defense,” 2024. [Online]. Available: https: //arxiv.org/abs/2410.05159

2024 arXiv
[14]

Image quality assessment: from error visibility to structural similarity,

Z. Wang, A. Bovik, H. Sheikh, and E. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” IEEE Trans. Image Process., vol. 13, no. 4, pp. 600–612, Apr. 2004

2004
[15]

R. S. Sutton and A. G. Barto, Reinforcement learning: An introduction . MIT press, 2018

2018
[16]

F. A. Oliehoek and C. Amato, A Concise Introduction to Decentralized POMDPs, 1st ed. Springer, 2016

2016
[17]

Entropy-based active learning for object detection with progressive diversity constraint,

J. Wu, J. Chen, and D. Huang, “Entropy-based active learning for object detection with progressive diversity constraint,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn. (CVPR) , New Orleans, LA, USA, Jun. 2022

2022
[18]

Categorical reparameterization with gumbel-softmax,

E. Jang, S. Gu, and B. Poole, “Categorical reparameterization with gumbel-softmax,” in Proc. Int. Conf. Learn. Represent. (ICLR) , Toulon, France, Apr. 2017

2017
[19]

Integrated sensing and communications for low-altitude economy: A deep reinforcement learning approach

X. Ye, Y . Mao, X. Yu, S. Sun, L. Fu, and J. Xu, “Integrated sensing and communications for low-altitude economy: A deep reinforcement learning approach.” [Online]. Available: https://arxiv.org/abs/2412.04074

arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Edge artificial intelligence for 6G: Vision, enabling technologies, and applications,

K. B. Letaief, Y . Shi, J. Lu, and J. Lu, “Edge artificial intelligence for 6G: Vision, enabling technologies, and applications,” IEEE J. Sel. Areas Commun., vol. 40, no. 1, pp. 5–36, Jan. 2022

2022

[2] [2]

Green edge AI : A contemporary survey,

Y . Mao, X. Yu, K. Huang, Y .-J. A. Zhang, and J. Zhang, “Green edge AI : A contemporary survey,” Proc. IEEE, vol. 112, no. 7, pp. 880–911, Jul. 2024

work page 2024

[3] [3]

Edge AI: On-demand acceler- ating deep neural network inference via edge computing,

E. Li, L. Zeng, Z. Zhou, and X. Chen, “Edge AI: On-demand acceler- ating deep neural network inference via edge computing,” IEEE Trans. Wireless Commun., vol. 19, no. 1, pp. 447–457, Jan. 2020

2020

[4] [4]

Communication-computation trade-off in resource-constrained edge inference,

J. Shao and J. Zhang, “Communication-computation trade-off in resource-constrained edge inference,” IEEE Commun. Mag. , vol. 58, no. 12, pp. 197–211, Dec. 2020

work page 2020

[5] [5]

Learning task-oriented communication for edge inference: An information bottleneck approach,

J. Shao, Y . Mao, and J. Zhang, “Learning task-oriented communication for edge inference: An information bottleneck approach,” IEEE J. Sel. Areas Commun., vol. 40, no. 1, pp. 197–211, Jan. 2022

2022

[6] [6]

Joint source-channel coding for channel-adaptive digital semantic communications,

J. Park, Y . Oh, S. Kim, and Y .-S. Jeon, “Joint source-channel coding for channel-adaptive digital semantic communications,” IEEE Trans. Cong. Commun. Netw., to appear

work page

[7] [7]

Exploring image reconstruction attack in deep learning computation offloading,

H. Oh and Y . Lee, “Exploring image reconstruction attack in deep learning computation offloading,” in The 3rd Int. Workshop Deep Learn. Mobile Syst. Appl. , ser. EMDL ’19, New York, NY , USA, 2019, p. 19–24

work page 2019

[8] [8]

Attacking and protecting data privacy in edge-cloud collaborative inference systems,

Z. He, T. Zhang, and R. B. Lee, “Attacking and protecting data privacy in edge-cloud collaborative inference systems,” IEEE Internet Things J. , vol. 8, no. 12, pp. 9706–9716, 2021

work page 2021