# Is Private Learning Possible with Instance Encoding?

arXiv: https://arxiv.org/abs/2011.05315 · HTML: https://mlsanity.com/paper/2011.05315/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Nov 2020.

## Built on by (most cited first, 22 of 22)

- [Evaluating Gradient Inversion Attacks and Defenses in Federated Learning](https://mlsanity.com/paper/2112.00059/) (2021)
- [Deep Unlearning via Randomized Conditionally Independent Hessians](https://mlsanity.com/paper/2204.07655/) (2022)
- [Differential Privacy for Text Analytics via Natural Text Sanitization](https://mlsanity.com/paper/2106.01221/) (2021)
- [DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations](https://mlsanity.com/paper/2103.02079/) (2021)
- [DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation](https://mlsanity.com/paper/2103.11109/) (2021)
- [Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domain](https://mlsanity.com/paper/2207.07316/) (2022)
- [DarKnight: An Accelerated Framework for Privacy and Integrity Preserving Deep Learning Using Trusted Hardware](https://mlsanity.com/paper/2207.00083/) (2022)
- [Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information](https://mlsanity.com/paper/2305.04146/) (2023)
- [Private Alternating Least Squares: Practical Private Matrix Completion with Tighter Rates](https://mlsanity.com/paper/2107.09802/) (2021)
- [Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods](https://mlsanity.com/paper/2103.03078/) (2021)
- [Disrupting Model Training with Adversarial Shortcuts](https://mlsanity.com/paper/2106.06654/) (2021)
- [Practical and Secure Federated Recommendation with Personalized Masks](https://mlsanity.com/paper/2109.02464/) (2021)
- [Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategies](https://mlsanity.com/paper/2204.12495/) (2022)
- [A Fusion-Denoising Attack on InstaHide with Data Augmentation](https://mlsanity.com/paper/2105.07754/) (2021)
- [Symmetric Sparse Boolean Matrix Factorization and Applications](https://mlsanity.com/paper/2102.01570/) (2021)
- [Setting varepsilon is not the Issue in Differential Privacy](https://mlsanity.com/paper/2511.06305/) (2025)
- [Defense Against Gradient Leakage Attacks via Learning to Obscure Data](https://mlsanity.com/paper/2206.00769/) (2022)
- [Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inference](https://mlsanity.com/paper/2309.04875/) (2023)
- [CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation](https://mlsanity.com/paper/2511.19711/) (2025)
- [Privacy and Integrity Preserving Training Using Trusted Hardware](https://mlsanity.com/paper/2105.00334/) (2021)
- [PEOPL: Characterizing Privately Encoded Open Datasets with Public Labels](https://mlsanity.com/paper/2304.00047/) (2023)
- [Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attack](https://mlsanity.com/paper/2403.10558/) (2024)

## Abstract (arXiv)

A private machine learning algorithm hides as much as possible about its training data while still preserving accuracy. In this work, we study whether a non-private learning algorithm can be made private by relying on an instance-encoding mechanism that modifies the training inputs before feeding them to a normal learner. We formalize both the notion of instance encoding and its privacy by providing two attack models. We first prove impossibility results for achieving a (stronger) model. Next, we demonstrate practical attacks in the second (weaker) attack model on InstaHide, a recent proposal by Huang, Song, Li and Arora [ICML'20] that aims to use instance encoding for privacy.