Search papers, labs, and topics across Lattice.
This paper introduces a variational feature compression framework to mitigate input repurposing in shared deep learning inference settings. The method encodes inputs into a compact latent space using a variational autoencoder trained with cross-entropy and KL regularization, and then applies a dynamic binary mask based on KL divergence and gradient-based saliency to suppress task-irrelevant latent dimensions. Experiments on CIFAR-100 demonstrate that the processed representations maintain high utility for the target classifier while significantly reducing the accuracy of unintended classifiers.
Achieve >45x suppression of unintended classifier accuracy by strategically zeroing out latent dimensions that are uninformative for the intended task, effectively preventing model repurposing.
As deep learning inference is increasingly deployed in shared and cloud-based settings, a growing concern is input repurposing, in which data submitted for one task is reused by unauthorized models for another. Existing privacy defenses largely focus on restricting data access, but provide limited control over what downstream uses a released representation can still support. We propose a feature extraction framework that suppresses cross-model transfer while preserving accuracy for a designated classifier. The framework employs a variational latent bottleneck, trained with a task-driven cross-entropy objective and KL regularization, but without any pixel-level reconstruction loss, to encode inputs into a compact latent space. A dynamic binary mask, computed from per-dimension KL divergence and gradient-based saliency with respect to the frozen target model, suppresses latent dimensions that are uninformative for the intended task. Because saliency computation requires gradient access, the encoder is trained in a white-box setting, whereas inference requires only a forward pass through the frozen target model. On CIFAR-100, the processed representations retain strong utility for the designated classifier while reducing the accuracy of all unintended classifiers to below 2%, yielding a suppression ratio exceeding 45 times relative to unintended models. Preliminary experiments on CIFAR-10, Tiny ImageNet, and Pascal VOC provide exploratory evidence that the approach extends across task settings, although further evaluation is needed to assess robustness against adaptive adversaries.
Stanford HAI