Geometric Data Perturbation (GDP) allows participants to share distance‑preserving transformations of their private data for one‑shot collaborative learning. The paper examines the vulnerability when an analyst colludes with participants, showing that shared‑anchor alignment can restore compatibility but also enables exact data recovery. To mitigate this, the authors propose adding noise to the anchor representations rather than the private data, demonstrating through experiments on MNIST and CelebA that this approach yields better privacy‑utility trade‑offs under collusion.
By Keiyu Nosaka, Yamato Suetake, Yuichi Takano, Yukihiko Okada, Akiko Yoshise
arXiv:2603. 10937v2 Announce Type: replace Abstract: The use of synthetic data has become increasingly popular as a privacy-preserving alternative to sharing real datasets, especially in sensitive domains such as healthcare, finance, and demography.
By Rajdeep Pathak, Amit Basak, Sayantee Jana
arXiv:2503. 10945v3 Announce Type: replace-cross Abstract: Current practices for reporting differential privacy (DP) guarantees for machine learning (ML) algorithms such as DP-SGD provide an incomplete and potentially misleading picture.
By Juan Felipe Gomez, Bogdan Kulynych, Georgios Kaissis, Flavio P. Calmon, Jamie Hayes, Borja Balle, Antti Honkela
The paper compares four audit methods for assessing identity‑level differential privacy in pre‑trained, black‑box face generators. Each method—GaussMech, KDE‑LR, MMD‑TV, and ROC‑HT—has distinct assumptions, hyperparameters, and finite‑sample limitations, and they produce markedly different epsilon estimates when applied to FaceFusion and InstantID. The study finds that all methods reveal significant identity distinguishability, but none can be reliably ranked in this high‑distinguishability regime, suggesting that future work should evaluate them on partially private mechanisms.
By Arman Zareian Jahromi, Vishnu Bondalakunta, Mohammad Akbar Bin Shah, Naimul Haque, Shuangqing Wei, George T. Amariucai
The paper introduces Differential Privacy Representation Geometry for Medical Imaging (DP‑RGMI), a framework that interprets differential privacy as a structured transformation of representation space. DP‑RGMI decomposes performance loss into encoder geometry—measured by representation displacement and spectral effective dimension—and task‑head utilization, quantified by the gap between linear‑probe and end‑to‑end utility. Across 594,000 chest X‑ray images from four datasets, the study finds that differential privacy consistently creates a utilization gap even when linear separability remains, while displacement and spectral dimension vary non‑monotonically with initialization and dataset, indicating that privacy alters representation anisotropy rather than uniformly collapsing features.
By Soroosh Tayebi Arasteh, Marziyeh Mohammadi, Sven Nebelung, Daniel Truhn
arXiv:2607. 08867v1 Announce Type: cross Abstract: Cloud-based deep learning enables large-scale medical image analysis but raises significant privacy concerns when sensitive patient images are outsourced for model development.
By Jason Rojas, Jiajie He, Yash Patel, Yuechun Gu, Zeyun Yu, Keke Chen
The paper addresses the challenge of selecting external datasets for private transfer learning by modeling high‑dimensional regression with heterogeneous sources and a weighted ridge estimator. It relies solely on aggregated statistics and offers privacy guarantees under $
ho$‑zero‑concentrated differential privacy for labels or both features and labels. A deterministic equivalent of test error is derived, enabling optimization of hyperparameters and decision‑making about the utility of private external data without accessing individual records.
By Filip Kova\v{c}evi\'c, Edwige Cyffers, Stefano Sarao Mannelli, Marco Mondelli
The paper investigates whether inexpensive spectral metrics from the heavy‑tailed self‑regularisation framework can predict membership inference attack (MIA) vulnerability, offering a scalable alternative to costly shadow‑model attacks. Experiments on image and tabular classification tasks show that stable rank correlates positively with overall MIA success, while Log alpha‑Norm correlates negatively with MIA risk in low false‑positive regimes, outperforming conventional generalisation gap measures. These findings suggest that neural network spectra contain privacy leakage signals not captured by traditional overfitting metrics, pointing to spectral analysis as a promising direction for privacy auditing.
By Richard J. Preen, Jim Smith
The paper introduces a unified evaluation framework for face de-identification (FDeID), addressing inconsistencies in current protocols. It presents UtilFace, a demographically balanced benchmark assembled from four large-scale datasets, and HiFD, a hierarchical metric that simultaneously measures identity suppression, multi-level utility preservation, and image quality. Using this framework, the authors compare adversarial, GAN-based, and diffusion-based methods, revealing trade-offs and failure modes that were previously hidden, and they release the benchmark and toolkit for reproducible research.
By Hui Wei, Hao Yu, Hui Kuurila-Zhang, Guoying Zhao
arXiv:2606. 31742v1 Announce Type: cross Abstract: Explainable AI (XAI) methods have demonstrated significant success in recent years at identifying relevant features in input data that drive deep learning model decisions, enhancing interpretability for users.
By Maximilian Andreas Hoefler, Karsten Mueller, Wojciech Samek
The paper introduces Jacobian-Guided Anisotropic Noise Reshaping, a method that improves data utility under Local Differential Privacy by selectively reducing noise in task-relevant subspaces of data representations. It uses the Jacobian of a public downstream model to identify critical directions and reshapes isotropic LDP noise into an anisotropic distribution, preserving privacy while enhancing performance. Experiments on CIFAR-10-C show significant accuracy gains, especially for PrivUnit variants at ε=7.5.
By Youngmok Ha, Viktor Schlegel, Yidan Sun, Anil Anthony Bharath
The paper evaluates privacy risks in graph neural networks enhanced by large language models (LLMs). Using a five‑stage framework, the authors test six real‑world text‑attributed graph datasets with 42 model configurations and six privacy attack methods across link, label, and membership inference threats. Results show that LLM‑enhanced GNNs are more vulnerable than shallow baselines, with semantic enrichment amplifying exploitable signals, and that differential privacy can reduce risk but at a significant cost to utility.
By Longzhu He, Zelang Wen, Chaozhuo Li, Sen Su