# Privacy Partitioning: Protecting User Data During the Deep Learning Inference Phase

arXiv: https://arxiv.org/abs/1812.02863 · HTML: https://mlsanity.com/paper/1812.02863/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Dec 2018.

## Built on by (most cited first, 9 of 9)

- [A Vertical Federated Learning Framework for Graph Convolutional Network](https://mlsanity.com/paper/2106.11593/) (2021)
- [Edge-Based Video Analytics: A Survey](https://mlsanity.com/paper/2303.14329/) (2023)
- [Unsupervised Information Obfuscation for Split Inference of Neural Networks](https://mlsanity.com/paper/2104.11413/) (2021)
- [PriMask: Cascadable and Collusion-Resilient Data Masking for Mobile Cloud Inference](https://mlsanity.com/paper/2211.06716/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [A General Pseudonymization Framework for Cloud-Based LLMs: Replacing Privacy Information in Controlled Text Generation](https://mlsanity.com/paper/2502.15233/) (2025)
- [The Fundamental Limits of Least-Privilege Learning](https://mlsanity.com/paper/2402.12235/) (2024)
- [A Secure Fingerprinting Framework for Distributed Image Classification](https://mlsanity.com/paper/2207.04668/) (2022)
- [Privacy from Symmetry: Orthogonally Equivariant Transformers for LLM Inference](https://mlsanity.com/paper/2606.16461/) (2026)

## Abstract (arXiv)

We present a practical method for protecting data during the inference phase of deep learning based on bipartite topology threat modeling and an interactive adversarial deep network construction. We term this approach Privacy Partitioning. In the proposed framework, we split the machine learning models and deploy a few layers into users' local devices, and the rest of the layers into a remote server. We propose an approach to protect user's data during the inference phase, while still achieve good classification accuracy. We conduct an experimental evaluation of this approach on benchmark datasets of three computer vision tasks. The experimental results indicate that this approach can be used to significantly attenuate the capacity for an adversary with access to the state-of-the-art deep network's intermediate states to learn privacy-sensitive inputs to the network. For example, we demonstrate that our approach can prevent attackers from inferring the private attributes such as gender from the Face image dataset without sacrificing the classification accuracy of the original machine learning task such as Face Identification.