# Minimax Filter: Learning to Preserve Privacy from Inference Attacks

arXiv: https://arxiv.org/abs/1610.03577 · HTML: https://mlsanity.com/paper/1610.03577/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Oct 2016.

## Built on by (most cited first, 16 of 16)

- [A Study of Face Obfuscation in ImageNet](https://mlsanity.com/paper/2103.06191/) (2021)
- [Balancing Biases and Preserving Privacy on Balanced Faces in the Wild](https://mlsanity.com/paper/2103.09118/) (2021)
- [On Characterizing the Trade-off in Invariant Representation Learning](https://mlsanity.com/paper/2109.03386/) (2021)
- [Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective](https://mlsanity.com/paper/2101.03042/) (2021)
- [Image-Perfect Imperfections: Safety, Bias, and Authenticity in the Shadow of Text-To-Image Model Evolution](https://mlsanity.com/paper/2408.17285/) (2024)
- [Modeling the Trade-off of Privacy Preservation and Activity Recognition on Low-Resolution Images](https://mlsanity.com/paper/2303.10435/) (2023)
- [Unsupervised Information Obfuscation for Split Inference of Neural Networks](https://mlsanity.com/paper/2104.11413/) (2021)
- [Dikaios: Privacy Auditing of Algorithmic Fairness via Attribute Inference Attacks](https://mlsanity.com/paper/2202.02242/) (2022)
- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [Learning Robust and Privacy-Preserving Representations via Information Theory](https://mlsanity.com/paper/2412.11066/) (2024)
- [Privacy-Aware Adversarial Network in Human Mobility Prediction](https://mlsanity.com/paper/2208.05009/) (2022)
- [Blinder: End-to-end Privacy Protection in Sensing Systems via Personalized Federated Learning](https://mlsanity.com/paper/2209.12046/) (2022)
- [Attaining Class-level Forgetting in Pretrained Model using Few Samples](https://mlsanity.com/paper/2210.10670/) (2022)
- [Learning to Censor by Noisy Sampling](https://mlsanity.com/paper/2203.12192/) (2022)
- [Defending Against Gradient Inversion Attacks for Biomedical Images via Learnable Data Perturbation](https://mlsanity.com/paper/2503.16542/) (2025)
- [Learning Private Representations through Entropy-based Adversarial Training](https://mlsanity.com/paper/2507.10194/) (2025)

## Abstract (arXiv)

Preserving privacy of continuous and/or high-dimensional data such as images, videos and audios, can be challenging with syntactic anonymization methods which are designed for discrete attributes. Differential privacy, which provides a more formal definition of privacy, has shown more success in sanitizing continuous data. However, both syntactic and differential privacy are susceptible to inference attacks, i.e., an adversary can accurately infer sensitive attributes from sanitized data. The paper proposes a novel filter-based mechanism which preserves privacy of continuous and high-dimensional attributes against inference attacks. Finding the optimal utility-privacy tradeoff is formulated as a min-diff-max optimization problem. The paper provides an ERM-like analysis of the generalization error and also a practical algorithm to perform the optimization. In addition, the paper proposes an extension that combines minimax filter and differentially-private noisy mechanism. Advantages of the method over purely noisy mechanisms is explained and demonstrated with examples. Experiments with several real-world tasks including facial expression classification, speech emotion classification, and activity classification from motion, show that the minimax filter can simultaneously achieve similar or better target task accuracy and lower inference accuracy, often significantly lower than previous methods.