A Privacy Study of Sparse Collaborative Inference
2026-08-17 • Machine Learning
Machine Learning
AI summaryⓘ
The authors studied a technique called collaborative inference, where part of a model runs on a local device and part on a server, sharing some intermediate data. They looked at how making this data sparse (only keeping some values) affects privacy and communication cost. Their experiments show that sparsifying reduces data sent but does not reduce privacy risks as much as expected, because the positions of the kept values leak a lot of private information. This means that just focusing on the values is not enough; the positions themselves should be protected to keep data private. The authors suggest carefully checking these position data in collaborative inference setups.
collaborative inferencesparse activationprivacy leakagecommunication costentropy codingactivation sparsificationintermediate activationmodel splittingprivacy riskre-identification
Authors
Maximilian Andreas Hoefler, Karsten Mueller, Wojciech Samek
Abstract
Collaborative inference (CI) splits a model between an edge device and a server, whereby the client computes an intermediate activation, transmits it, and the server completes the computation. This raises two concerns, the communication cost of the transmission and the risk that it reveals private information about the input. Recent work reduces this cost by sparsifying activations and entropy-coding the result. Sparsity has also been argued to improve privacy, on the intuition that transmitting fewer values reveals less about the input. We test this claim by decomposing the sparse activation into the retained values and the set of positions they occupy, and by reconstructing inputs from each component in isolation. We find that sparsification reduces the leakage far less than it reduces the transmission cost, and that the remaining risk shifts to the positions, which prior analyses treat as side information for decoding. Across natural-image and face datasets, the positions alone constitute a serious privacy risk, enabling high-fidelity reconstructions and re-identification of individuals. The leakage from the positions persists even when both the transmission cost and the task utility are low. We conclude that the positions of sparse activations should be treated as sensitive transmitted data and audited carefully in the context of collaborative inference. Code is available at https://github.com/an7123/Privacy-Study-Sparse-CI.