A Privacy Study of Sparse Collaborative Inference

2026-08-17

AI Summary

This study addresses the underestimated privacy risks associated with sparse activation in collaborative inference by challenging the prevailing assumption that sparsity inherently guarantees security. Treating activation positions as independent sensitive sources, this work decomposes sparse activations into values and locations to design input reconstruction and re-identification attacks. We demonstrate for the first time that high-fidelity image reconstruction and individual re-identification are achievable using positional information alone. The findings reveal that position leakage constitutes a severe privacy threat even under conditions of low communication overhead and high task utility, exposing critical blind spots in existing defenses. Consequently, this research establishes a new paradigm for privacy auditing in collaborative inference systems, highlighting the necessity of protecting spatial metadata alongside activation values.

Abstract

Collaborative inference (CI) splits a model between an edge device and a server, whereby the client computes an intermediate activation, transmits it, and the server completes the computation. This raises two concerns, the communication cost of the transmission and the risk that it reveals private information about the input. Recent work reduces this cost by sparsifying activations and entropy-coding the result. Sparsity has also been argued to improve privacy, on the intuition that transmitting fewer values reveals less about the input. We test this claim by decomposing the sparse activation into the retained values and the set of positions they occupy, and by reconstructing inputs from each component in isolation. We find that sparsification reduces the leakage far less than it reduces the transmission cost, and that the remaining risk shifts to the positions, which prior analyses treat as side information for decoding. Across natural-image and face datasets, the positions alone constitute a serious privacy risk, enabling high-fidelity reconstructions and re-identification of individuals. The leakage from the positions persists even when both the transmission cost and the task utility are low. We conclude that the positions of sparse activations should be treated as sensitive transmitted data and audited carefully in the context of collaborative inference. Code is available at https://github.com/an7123/Privacy-Study-Sparse-CI.

Problem

• Collaborative Inference
• Sparse Activation
• Privacy Leakage
• Position Indices
• Input Reconstruction

Innovation

• Sparse Collaborative Inference
• Position Leakage
• Privacy Audit
• Activation Sparsification
• Input Reconstruction