Question-guided token pruning reduces privacy risks in vision language models
Don't Send What You Don't Need: Question-Guided Token Pruning as a Privacy Defense for Vision-Language Models
Computer Vision and Pattern RecognitionArtificial IntelligenceCryptography and Security
Summary
When AI systems answer questions about images, sometimes sending all image details risks exposing private information. The authors created a way to smartly pick only the important parts of an image related to the question, while hiding sensitive parts. Their method uses a tiny helper that decides which image pieces to keep or drop based on how private or useful they are. This reduces how much data is shared and lowers chances of privacy attacks, all without hurting the AI’s ability to answer questions well.
What this means in practice
- •For mobile app developers: Reduce data transmission and privacy leaks when apps answer questions about user photos by sending fewer but relevant image details.
- •For healthcare ai engineers: Protect sensitive medical image features during distributed model training that answers diagnostic questions without exposing private patient data.
Authors
Md Khalid Syfullah, Alvi Ataur Khalil
Abstract
Visual Question Answering (VQA) with Vision-Language Models (VLMs) is increasingly used in privacy-sensitive and bandwidth-constrained settings. Federated Learning (FL), Split Learning (SL), and U-Shaped Split Learning (USL) keep raw data local, but transmitting all visual tokens across a model partition remains costly and can expose private information. We propose QPriv-VL, a question-guided, privacy-aware token-pruning framework for FL, SL, and USL that prunes visual tokens before transmission based on task utility and privacy sensitivity. Its core component is a lightweight Dynamic Threshold Predictor (DTP) that jointly estimates a sample-specific pruning ratio and a token-level retention mask in one forward pass. DTP combines question relevance, computed from cross-modal similarity between visual patches and the pooled question embedding, with a sensitivity signal derived from frozen DINOv2 features. This allows the model to suppress potentially sensitive regions while preserving patches useful for answering the question, without requiring sensitivity labels. We evaluate QPriv-VL on GQA, OK-VQA, VQAv2, SLAKE, VQA-RAD, and PathVQA against four privacy attack families: FSHA, FORA, iDLG, and attribute-inference membership inference attacks. DTP matches or outperforms fixed-ratio pruning while using substantially fewer transmitted tokens. On VQA-RAD, it reduces membership-inference attack success from 0.99 to 0.76-0.79, lowers FSHA and FORA reconstruction PSNR relative to fixed-ratio pruning, and preserves competitive VQA accuracy using about 40% of the original visual-token budget. A sensitivity exclusion ratio of 1.20 +/- 0.18 indicates preferential removal of privacy-sensitive patches, while explainability analysis shows that retention adapts to question semantics rather than generic visual saliency.