Title: How Breakable Is Privacy: Probing and Resisting Model Inversion Attacks in Collaborative Inference Show Chinese title

Title: 隐私有多脆弱：在协作推理中探测和抵抗模型反转攻击

Abstract: Collaborative inference (CI) improves computational efficiency for edge devices by transmitting intermediate features to cloud models. However, this process inevitably exposes feature representations to model inversion attacks (MIAs), enabling unauthorized data reconstruction. Despite extensive research, there is no established criterion for assessing the difficulty of MIA implementation, leaving a fundamental question unanswered: \textit{What factors truly and verifiably determine the attack's success in CI?} Moreover, existing defenses lack the theoretical foundation described above, making it challenging to regulate feature information effectively while ensuring privacy and minimizing computational overhead. These shortcomings introduce three key challenges: theoretical gap, methodological limitation, and practical constraint. To overcome these challenges, we propose the first theoretical criterion to assess MIA difficulty in CI, identifying mutual information, entropy, and effective information volume as key influencing factors. The validity of this criterion is demonstrated by using the mutual information neural estimator. Building on this insight, we propose SiftFunnel, a privacy-preserving framework to resist MIA while maintaining usability. Specifically, we incorporate linear and non-linear correlation constraints alongside label smoothing to suppress redundant information transmission, effectively balancing privacy and usability. To enhance deployability, the edge model adopts a funnel-shaped structure with attention mechanisms, strengthening privacy while reducing computational and storage burdens. Experiments show that, compared to state-of-the-art defense, SiftFunnel increases reconstruction error by $\sim$30\%, lowers mutual and effective information metrics by $\geq$50\%, and reduces edge burdens by almost $20\times$, while maintaining comparable usability. Show Chinese abstract

Abstract: 协作推理（CI）通过将中间特征传输到云模型，提高了边缘设备的计算效率。 然而，这一过程不可避免地使特征表示暴露于模型反转攻击（MIAs），从而允许未经授权的数据重建。 尽管已有大量研究，但尚无评估MIA实施难度的既定标准，留下了一个基本问题：\textit{哪些因素真正且可验证地决定了CI中的攻击成功？}此外，现有的防御措施缺乏上述理论基础，使得在确保隐私的同时有效调控特征信息变得困难。 这些不足带来了三个关键挑战：理论差距、方法限制和实际约束。 为克服这些挑战，我们提出了第一个用于评估CI中MIA难度的理论标准，确定互信息、熵和有效信息量作为关键影响因素。 该标准的有效性通过互信息神经估计器得到验证。 基于这一见解，我们提出了SiftFunnel，一种在保持可用性的前提下抵抗MIA的隐私保护框架。 具体而言，我们结合线性和非线性相关约束以及标签平滑来抑制冗余信息传输，有效地平衡了隐私和可用性。 为了提高可部署性，边缘模型采用带有注意力机制的漏斗结构，增强了隐私性同时减少了计算和存储负担。 实验表明，与最先进的防御方法相比，SiftFunnel使重建误差增加了$\sim$30%，互信息和有效信息指标分别降低了$\geq$50%，并几乎减少了$20\times$的边缘负担，同时保持了相当的可用性。