Is Private Learning Possible with Instance Encoding?
Not on the map. Why?
Abstract (arXiv)
A private machine learning algorithm hides as much as possible about its training data while still preserving accuracy. In this work, we study whether a non-private learning algorithm can be made private by relying on an instance-encoding mechanism that modifies the training inputs before feeding them to a normal learner. We formalize both the notion of instance encoding and its privacy by providing two attack models. We first prove impossibility results for achieving a (stronger) model. Next, we demonstrate practical attacks in the second (weaker) attack model on InstaHide, a recent proposal by Huang, Song, Li and Arora [ICML'20] that aims to use instance encoding for privacy.
Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). First posted on arXiv 10 Nov 2020.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 11; 2022: 5; 2023: 3; 2024: 1; 2025: 2.
22 papers.
Sort:
By area:
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
- 2022Deep Unlearning via Randomized Conditionally Independent Hessianscited by 83
- 2021Differential Privacy for Text Analytics via Natural Text Sanitizationcited by 74
- 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
- 2021DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregationcited by 31
- 2022Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domaincited by 28
- 2022DarKnight: An Accelerated Framework for Privacy and Integrity Preserving Deep Learning Using Trusted Hardwarecited by 13
- 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Informationcited by 11
- 2021Private Alternating Least Squares: Practical Private Matrix Completion with Tighter Ratescited by 10
- 2021Defending Medical Image Diagnostics against Privacy Attacks using Generative Methodscited by 8
- 2021Disrupting Model Training with Adversarial Shortcutscited by 7
- 2021Practical and Secure Federated Recommendation with Personalized Maskscited by 7
10 more
- 2022Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategiescited by 5
- 2021A Fusion-Denoising Attack on InstaHide with Data Augmentationcited by 4
- 2021Symmetric Sparse Boolean Matrix Factorization and Applicationscited by 3
- 2025Setting varepsilon is not the Issue in Differential Privacycited by 3
- 2022Defense Against Gradient Leakage Attacks via Learning to Obscure Datacited by 2
- 2023Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inferencecited by 2
- 2025CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computationcited by 1
- 2021Privacy and Integrity Preserving Training Using Trusted Hardwarecited by 0
- 2023PEOPL: Characterizing Privately Encoded Open Datasets with Public Labelscited by 0
- 2024Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attackcited by 0
- 2025CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation24 Nov 2025
- 2025Setting varepsilon is not the Issue in Differential Privacy9 Nov 2025
- 2024Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attack14 Mar 2024
- 2023Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inference9 Sep 2023
- 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information6 May 2023
- 2023PEOPL: Characterizing Privately Encoded Open Datasets with Public Labels31 Mar 2023
- 2022Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domain15 Jul 2022
- 2022DarKnight: An Accelerated Framework for Privacy and Integrity Preserving Deep Learning Using Trusted Hardware30 Jun 2022
- 2022Defense Against Gradient Leakage Attacks via Learning to Obscure Data1 Jun 2022
- 2022Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategies26 Apr 2022
- 2022Deep Unlearning via Randomized Conditionally Independent Hessians15 Apr 2022
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learning30 Nov 2021
10 more
- 2021Practical and Secure Federated Recommendation with Personalized Masks18 Aug 2021
- 2021Private Alternating Least Squares: Practical Private Matrix Completion with Tighter Rates20 Jul 2021
- 2021Disrupting Model Training with Adversarial Shortcuts12 Jun 2021
- 2021Differential Privacy for Text Analytics via Natural Text Sanitization2 Jun 2021
- 2021A Fusion-Denoising Attack on InstaHide with Data Augmentation17 May 2021
- 2021Privacy and Integrity Preserving Training Using Trusted Hardware1 May 2021
- 2021DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation20 Mar 2021
- 2021Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods4 Mar 2021
- 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations2 Mar 2021
- 2021Symmetric Sparse Boolean Matrix Factorization and Applications2 Feb 2021
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
- 2021Differential Privacy for Text Analytics via Natural Text Sanitizationcited by 74
- 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
- 2021DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregationcited by 31
- 2022Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domaincited by 28
- 2022DarKnight: An Accelerated Framework for Privacy and Integrity Preserving Deep Learning Using Trusted Hardwarecited by 13
- 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Informationcited by 11
- 2021Private Alternating Least Squares: Practical Private Matrix Completion with Tighter Ratescited by 10
- 2021Disrupting Model Training with Adversarial Shortcutscited by 7
- 2021Practical and Secure Federated Recommendation with Personalized Maskscited by 7
- 2022Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategiescited by 5
- 2021A Fusion-Denoising Attack on InstaHide with Data Augmentationcited by 4
12 most cited of 20 All 20 (JSON)
- 2025CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation24 Nov 2025
- 2025Setting varepsilon is not the Issue in Differential Privacy9 Nov 2025
- 2024Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attack14 Mar 2024
- 2023Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inference9 Sep 2023
- 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information6 May 2023
- 2023PEOPL: Characterizing Privately Encoded Open Datasets with Public Labels31 Mar 2023
- 2022Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domain15 Jul 2022
- 2022DarKnight: An Accelerated Framework for Privacy and Integrity Preserving Deep Learning Using Trusted Hardware30 Jun 2022
- 2022Defense Against Gradient Leakage Attacks via Learning to Obscure Data1 Jun 2022
- 2022Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategies26 Apr 2022
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learning30 Nov 2021
- 2021Practical and Secure Federated Recommendation with Personalized Masks18 Aug 2021
12 newest of 20 All 20 (JSON)