# DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks

arXiv: https://arxiv.org/abs/2012.11025 · HTML: https://mlsanity.com/paper/2012.11025/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Dec 2020.

## Built on by (most cited first, 23 of 23)

- [Split HE: Fast Secure Inference Combining Split Learning and Homomorphic Encryption](https://mlsanity.com/paper/2202.13351/) (2022)
- [AdaSplit: Adaptive Trade-offs for Resource-constrained Distributed Deep Learning](https://mlsanity.com/paper/2112.01637/) (2021)
- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [PriMask: Cascadable and Collusion-Resilient Data Masking for Mobile Cloud Inference](https://mlsanity.com/paper/2211.06716/) (2022)
- [DRAG: Data Reconstruction Attack using Guided Diffusion](https://mlsanity.com/paper/2509.11724/) (2025)
- [Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models](https://mlsanity.com/paper/2401.07205/) (2024)
- [A Taxonomy of Attacks and Defenses in Split Learning](https://mlsanity.com/paper/2505.05872/) (2025)
- [What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs](https://mlsanity.com/paper/2511.15316/) (2025)
- [Privacy Safe Representation Learning via Frequency Filtering Encoder](https://mlsanity.com/paper/2208.02482/) (2022)
- [Privacy Protectability: An Information-theoretical Approach](https://mlsanity.com/paper/2305.15697/) (2023)
- [Oops!... They Stole it Again: Attacks on Split Learning](https://mlsanity.com/paper/2508.10598/) (2025)
- [Improving the Behaviour of Vision Transformers with Token-consistent Stochastic Layers](https://mlsanity.com/paper/2112.15111/) (2021)
- [Learning to Censor by Noisy Sampling](https://mlsanity.com/paper/2203.12192/) (2022)
- [Amalgam: A Framework for Obfuscated Neural Network Training on the Cloud](https://mlsanity.com/paper/2406.03405/) (2024)
- [Enhancing Privacy in ControlNet and Stable Diffusion via Split Learning](https://mlsanity.com/paper/2409.08503/) (2024)
- [Anatomical 3D Style Transfer Enabling Efficient Federated Learning with Extremely Low Communication Costs](https://mlsanity.com/paper/2410.20102/) (2024)
- [Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization](https://mlsanity.com/paper/2508.20613/) (2025)
- [Privacy-Aware Split Inference with Speculative Decoding for Large Language Models over Wide-Area Networks](https://mlsanity.com/paper/2602.16760/) (2026)
- [LightSplit: Practical Privacy-Preserving Split Learning via Orthogonal Projections](https://mlsanity.com/paper/2605.13265/) (2026)
- [Keyed Nonlinear Transform: Lightweight Privacy-Enhancing Feature Sharing for Medical Image Analysis](https://mlsanity.com/paper/2605.14123/) (2026)
- [CausShield: Sample Reconstruction-Resilient Vertical FL via Causal Representation Learning](https://mlsanity.com/paper/2606.08027/) (2026)
- [Cloak of Invisibility: Real-Time Privacy-Preserving Volumetric Video Streaming](https://mlsanity.com/paper/2608.11645/) (2026)
- [Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding](https://mlsanity.com/paper/2608.23382/) (2026)

## Abstract (arXiv)

Recent deep learning models have shown remarkable performance in image classification. While these deep learning systems are getting closer to practical deployment, the common assumption made about data is that it does not carry any sensitive information. This assumption may not hold for many practical cases, especially in the domain where an individual's personal information is involved, like healthcare and facial recognition systems. We posit that selectively removing features in this latent space can protect the sensitive information and provide a better privacy-utility trade-off. Consequently, we propose DISCO which learns a dynamic and data driven pruning filter to selectively obfuscate sensitive information in the feature space. We propose diverse attack schemes for sensitive inputs & attributes and demonstrate the effectiveness of DISCO against state-of-the-art methods through quantitative and qualitative evaluation. Finally, we also release an evaluation benchmark dataset of 1 million sensitive representations to encourage rigorous exploration of novel attack schemes.