Towards integration of Privacy Enhancing Technologies in Explainable Artificial Intelligence
Not on the map. Why?
Abstract (arXiv)
Explainable Artificial Intelligence (XAI) is a crucial pathway in mitigating the risk of non-transparency in the decision-making process of black-box Artificial Intelligence (AI) systems. However, despite the benefits, XAI methods are found to leak the privacy of individuals whose data is used in training or querying the models. Researchers have demonstrated privacy attacks that exploit explanations to infer sensitive personal information of individuals. Currently there is a lack of defenses against known privacy attacks targeting explanations when vulnerable XAI are used in production and machine learning as a service system. To address this gap, in this article, we explore Privacy Enhancing Technologies (PETs) as a defense mechanism against attribute inference on explanations provided by feature-based XAI methods. We empirically evaluate 3 types of PETs, namely synthetic training data, differentially private training and noise addition, on two categories of feature-based XAI. Our evaluation determines different responses from the mitigation methods and side-effects of PETs on other system properties such as utility and performance. In the best case, PETs integration in explanations reduced the risk of the attack by 49.47%, while maintaining model utility and explanation quality. Through our evaluation, we identify strategies for using PETs in XAI for maximizing benefits and minimizing the success of this privacy attack on sensitive personal information.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 47 of its 99 references that are in the map. First posted on arXiv 6 Jul 2025.
Builds on
47 of 99 references.
References · 47
- 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
- 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
- 2017Axiomatic Attribution for Deep Networkscited by 3,350
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2019Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AIcited by 1,543
- 2017SmoothGrad: removing noise by adding noisecited by 1,097
- 2019Modeling Tabular data using Conditional GANcited by 695
- 2018Towards Robust Interpretability with Self-Explaining Neural Networkscited by 505
- 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
- 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
35 more
- 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
- 2020Evaluating and Aggregating Feature-based Model Explanationscited by 185
- 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
- 2022Quantus: An Explainable AI Toolkit for Responsible Evaluation of Neural Network Explanations and Beyondcited by 171
- 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
- 2019XRAI: Better Attributions Through Regionscited by 116
- 2020Privacy Preserving Vertical Federated Learning for Tree-based Modelscited by 89
- 2018Model Reconstruction from Model Explanationscited by 84
- 2021Unbox the Black-box for the Medical Explainable AI via Multi-modal and Multi-centre Data Fusion: A Mini-Review, Two Showcases and Beyondcited by 75
- 2018AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learningcited by 58
- 2022Framework for Evaluating Faithfulness of Local Explanationscited by 55
- 2018Algorithms that Remember: Model Inversion Attacks and Data Protection Lawcited by 52
- 2020Improving Robustness to Model Inversion Attacks via Mutual Information Regularizationcited by 49
- 2021Exploiting Explanations for Model Inversion Attackscited by 48
- 2020Model extraction from counterfactual explanationscited by 46
- 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
- 2022On the Privacy Risks of Algorithmic Recoursecited by 32
- 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 31
- 2019Interpretable and Differentially Private Predictionscited by 28
- 2022A Critical Review on the Use (and Misuse) of Differential Privacy in Machine Learningcited by 27
- 2020Model Explanations with Differential Privacycited by 23
- 2023A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Datacited by 23
- 2022The privacy issue of counterfactual explanations: explanation linkage attackscited by 20
- 2022Membership Inference Attack Using Self Influence Functionscited by 19
- 2022Inferring Sensitive Attributes from Model Explanationscited by 15
- 2022Feature-based Learning for Diverse and Privacy-Preserving Counterfactual Explanationscited by 11
- 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Modelscited by 9
- 2024Feature Inference Attack on Shapley Valuescited by 9
- 2023Probabilistic Dataset Reconstruction from Interpretable Modelscited by 7
- 2023Anonymizing medical case-based explanations through disentanglementcited by 5
- 2023Privacy-preserving machine learning for healthcare: open challenges and future perspectivescited by 4
- 2020Reducing Risk of Model Inversion Using Privacy-Guided Trainingcited by 3
- 2021Achieving Transparency Report Privacy in Linear Timecited by 2
- 2022HeartSpot: Privatized and Explainable Data Compression for Cardiomegaly Detectioncited by 2
- 2025Privacy Risks and Preservation Methods in Explainable Artificial Intelligence: A Scoping Reviewcited by 2
Built on by
Citing papers per year: 2025: 1.
1 paper.