# Unsupervised Information Obfuscation for Split Inference of Neural Networks

arXiv: https://arxiv.org/abs/2104.11413 · HTML: https://mlsanity.com/paper/2104.11413/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 40 references that are in the map.
- First posted on arXiv 23 Apr 2021.

## Builds on (most cited first, 21 of 21)

- [Auto-Encoding Variational Bayes](https://mlsanity.com/paper/1312.6114/) (2013)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Pruning Filters for Efficient ConvNets](https://mlsanity.com/paper/1608.08710/) (2016)
- [Age Progression/Regression by Conditional Adversarial Autoencoder](https://mlsanity.com/paper/1702.08423/) (2017)
- [Understanding Deep Image Representations by Inverting Them](https://mlsanity.com/paper/1412.0035/) (2014)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Censoring Representations with an Adversary](https://mlsanity.com/paper/1511.05897/) (2015)
- [Controllable Invariance through Adversarial Feature Learning](https://mlsanity.com/paper/1705.11122/) (2017)
- [Invariant Representations without Adversarial Training](https://mlsanity.com/paper/1805.09458/) (2018)
- [Reducing Overfitting in Deep Networks by Decorrelating Representations](https://mlsanity.com/paper/1511.06068/) (2015)
- [CrypTFlow2: Practical 2-Party Secure Inference](https://mlsanity.com/paper/2010.06457/) (2020)
- [Overlearning Reveals Sensitive Attributes](https://mlsanity.com/paper/1905.11742/) (2019)
- [Towards Robust and Privacy-preserving Text Representations](https://mlsanity.com/paper/1805.06093/) (2018)
- [Deep Private-Feature Extraction](https://mlsanity.com/paper/1802.03151/) (2018)
- [Context-Aware Generative Adversarial Privacy](https://mlsanity.com/paper/1710.09549/) (2017)
- [Minimax Filter: Learning to Preserve Privacy from Inference Attacks](https://mlsanity.com/paper/1610.03577/) (2016)
- [Privacy Partitioning: Protecting User Data During the Deep Learning Inference Phase](https://mlsanity.com/paper/1812.02863/) (2018)
- [Learning Anonymized Representations with Adversarial Neural Networks](https://mlsanity.com/paper/1802.09386/) (2018)
- [Tight Lower Bounds for Locally Differentially Private Selection](https://mlsanity.com/paper/1802.02638/) (2018)
- [Better accuracy with quantified privacy: representations learned via reconstructive adversarial network](https://mlsanity.com/paper/1901.08730/) (2019)

## Built on by (most cited first, 5 of 5)

- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [Measuring and Controlling Split Layer Privacy Leakage Using Fisher Information](https://mlsanity.com/paper/2209.10119/) (2022)
- [Salted Inference: Enhancing Privacy while Maintaining Efficiency of Split Inference in Mobile Computing](https://mlsanity.com/paper/2310.13384/) (2023)
- [Roulette: A Semantic Privacy-Preserving Device-Edge Collaborative Inference Framework for Deep Learning Classification Tasks](https://mlsanity.com/paper/2309.02820/) (2023)
- [Oops!... They Stole it Again: Attacks on Split Learning](https://mlsanity.com/paper/2508.10598/) (2025)

## Abstract (arXiv)

Splitting network computations between the edge device and a server enables low edge-compute inference of neural networks but might expose sensitive information about the test query to the server. To address this problem, existing techniques train the model to minimize information leakage for a given set of sensitive attributes. In practice, however, the test queries might contain attributes that are not foreseen during training. We propose instead an unsupervised obfuscation method to discard the information irrelevant to the main task. We formulate the problem via an information theoretical framework and derive an analytical solution for a given distortion to the model output. In our method, the edge device runs the model up to a split layer determined based on its computational capacity. It then obfuscates the obtained feature vector based on the first layer of the server model by removing the components in the null space as well as the low-energy components of the remaining signal. Our experimental results show that our method outperforms existing techniques in removing the information of the irrelevant attributes and maintaining the accuracy on the target label. We also show that our method reduces the communication cost and incurs only a small computational overhead.