PaperlayerView exact revision on arXiv

Source-linked AI summary

Don't Send What You Don't Need: Question-Guided Token Pruning as a Privacy Defense for Vision-Language Models

Md Khalid Syfullah, Alvi Ataur Khalil

arXiv:2609.15671v1cs.CVcs.AIcs.CR

TL;DR

Distributed VQA needs to limit the cost and privacy exposure of transmitting full visual-token prefixes, while existing pruning approaches do not jointly address question relevance and sensitivity. QPriv-VL prunes tokens before transmission using a dynamic predictor that combines those signals. Across four learning settings, it compresses the visual prefix to nearly 40% while reducing evaluated attacks and keeping VQA performance close to the unpruned baseline.

  • Problem

    Distributed VQA must contend with costly full visual-token transmission, and prior pruning methods were not explored as privacy defenses or jointly trained with content-sensitivity signals.

    Source: §I · p. 1

  • Method

    QPriv-VL uses a client-side dynamic threshold predictor to jointly select a per-sample pruning ratio and token keep-mask based on question relevance and content sensitivity.

    Source: §I · pp. 1–2

  • Results

    Across CL, FL, SL, and USL, DTP compresses the visual prefix to nearly 40% of its original size, reduces evaluated attack effectiveness, and keeps VQA performance close to the unpruned baseline.

    Source: K. Discussion and Limitations · p. 11

  • Takeaways & Limitations

    DTP achieves a strong privacy-utility trade-off across general-domain and medical VQA benchmarks and four learning settings.

    Source: §VII · p. 11

    The experiments use LLaVA-1.5-7B with fixed cut-layer configurations, and DTP may generalize poorly against adaptive attackers that exploit its token-retention behavior.

    Source: K. Discussion and Limitations · p. 11

Abstract

from arXiv · show

Visual Question Answering (VQA) with Vision-Language Models (VLMs) is increasingly used in privacy-sensitive and bandwidth-constrained settings. Federated Learning (FL), Split Learning (SL), and U-Shaped Split Learning (USL) keep raw data local, but transmitting all visual tokens across a model partition remains costly and can expose private information. We propose QPriv-VL, a question-guided, privacy-aware token-pruning framework for FL, SL, and USL that prunes visual tokens before transmission based on task utility and privacy sensitivity. Its core component is a lightweight Dynamic Threshold Predictor (DTP) that jointly estimates a sample-specific pruning ratio and a token-level retention mask in one forward pass. DTP combines question relevance, computed from cross-modal similarity between visual patches and the pooled question embedding, with a sensitivity signal derived from frozen DINOv2 features. This allows the model to suppress potentially sensitive regions while preserving patches useful for answering the question, without requiring sensitivity labels. We evaluate QPriv-VL on GQA, OK-VQA, VQAv2, SLAKE, VQA-RAD, and PathVQA against four privacy attack families: FSHA, FORA, iDLG, and attribute-inference membership inference attacks. DTP matches or outperforms fixed-ratio pruning while using substantially fewer transmitted tokens. On VQA-RAD, it reduces membership-inference attack success from 0.99 to 0.76-0.79, lowers FSHA and FORA reconstruction PSNR relative to fixed-ratio pruning, and preserves competitive VQA accuracy using about 40% of the original visual-token budget. A sensitivity exclusion ratio of 1.20 +/- 0.18 indicates preferential removal of privacy-sensitive patches, while explainability analysis shows that retention adapts to question semantics rather than generic visual saliency.

I. Introduction

Distributed VQA faces communication and privacy risks because full visual-token prefixes cross model partitions, while prior pruning work was not designed as a privacy defense. QPriv-VL uses question relevance and content sensitivity to select tokens before transmission across centralized and distributed settings.

I. Introduction

  • Full visual prefixes make split learning costly and expose activations to inversion and membership attacks, although only a small subset contributes to VQA.A CLIP-ViT-L/14 encoder at 336×336 produces 576 visual tokens with 1024-dimensional embeddings.Source: §I · p. 1
  • Prior question-guided pruning targets centralized inference, while distributed defenses largely ignore question features and content sensitivity.Existing split-learning compression is largely task-agnostic.Source: §I · p. 1
  • QPriv-VL applies one client-side pruning framework across centralized training, FL, SL, and USL, shortening the visual prefix before transmission.A single DTP forward pass produces a per-sample pruning ratio and a per-token keep-mask.Source: §I · p. 2
  • Its DTP weighs question relevance against learned content sensitivity and generalizes across general and medical domains without per-domain retraining.The same module can serve as a communication-efficiency layer and privacy defense in distributed settings.Source: §I · p. 2
  • The paper evaluates QPriv-VL against FSHA, FORA, iDLG, and membership-inference attacks on general-domain and medical VQA benchmarks.The introduction frames questions about accuracy, communication, privacy, pruning trade-offs, token sensitivity, and explainability.Source: §I · p. 2

II. Background

  • The background section introduces distributed learning and attacks, and Fig. 1 overviews the four attacks considered..Source: §II · p. 2, Figure 1 · p. 2

A. VQA and VLMs

The paper uses LLaVA-1.5-7B as its reference VLM and builds on frozen visual representations and distributed training paradigms. It considers reconstruction, membership-inference, and gradient-leakage threats across those settings.

A. VQA and VLMs

  • LLaVA-1.5-7B pairs a CLIP-ViT-L/14 visual encoder with a Vicuna language model through an MLP projector.VQA maps an image and natural-language question to a textual answer.Source: A. VQA and VLMs · p. 2

B. Self-Supervised Visual Representations

  • Frozen DINOv2 patch features provide label-free, object-aware representations that transfer across natural and medical imagery without retraining.The paper uses DINOv2 as the sensitivity-branch backbone for its patch features and low computational cost.Source: B. Self-Supervised Visual… · p. 2

C. Training Paradigms

  • FL sends parameter updates, SL exchanges cut-layer activations and gradients, and USL adds a second cut while keeping labels and the language-model head client-side.FL preserves data locality; USL incurs an extra communication round per step.Source: C. Training Paradigms · pp. 2–3

D. Attacks on VLMs

  • The threat set spans active FSHA and passive FORA reconstruction, confidence-based membership inference, and iDLG recovery of inputs and labels from gradients.FSHA aligns smashed representations with public proxy-image embeddings, whereas FORA trains an inverter using same-domain public auxiliary data.Source: D. Attacks on VLMs · p. 3

III. Literature Review

Prior work treats question-guided pruning, distributed-learning privacy defenses, and sensitivity modeling largely separately. QPriv-VL combines these ideas in a unified token-pruning framework that uses frozen encoders, question relevance, and a learned sensitivity signal.

III. Literature Review

  • Prior VLM pruning reduces redundant visual prefixes but is used for centralized inference, while distributed defenses generally lack question-conditioned semantic token control.Existing defenses target activations or gradients, and multimodal methods may still transmit the full visual prefix.Source: §III · p. 3
  • QPriv-VL combines question-guided pruning, learned sample-specific ratios and token keep-masks, and DINOv2-based patch sensitivity across CL, FL, SL, and USL.Its evaluation analyzes robustness against four attacks.Source: §III · p. 3

IV. Proposed Framework

  • The framework places question-guided token pruning between frozen vision-language encoders and the multimodal projector, selecting which patches and how many to pass forward.It is used unchanged across CL, FL, SL, and USL.Source: §IV · p. 4

A. Frozen Encoders

  • Frozen CLIP vision and text encoders provide patch tokens and pooled image and question vectors, while frozen DINOv2 provides object-structured patch features for sensitivity.These are fixed feature representations.Source: A. Frozen Encoders · p. 4

B. Utility Branch

  • The utility branch scores each CLIP patch through scaled dot-product attention between projected patch tokens and the pooled question embedding.A sigmoid converts the cross-modal similarity into a per-patch relevance score.Source: B. Utility Branch · p. 4

C. DTP Module

  • DTP aligns DINOv2 sensitivity scores with CLIP patches, learns a soft keep-mask from weighted utility and sensitivity, and predicts each sample’s prune ratio from image, question, and sensitivity summaries.Training uses the soft mask as a differentiable distillation target; inference uses discrete top-k selection, and the ratio is the only quantity varying per sample at inference.Source: C. DTP Module · p. 4

D. Pruning Decision Branch

QPriv-VL prepares a dynamic pruning predictor through oracle ratio search and teacher-student distillation, then selects a pruning policy and sends the retained visual prefix to the language model.

D. Pruning Decision Branch

  • Each forward pass selects no pruning, a manually chosen fixed ratio, or DTP; the selected ratio determines top-k retention using utility scores.Fixed ratios are chosen from {0.3, 0.5, 0.7, 0.9}.Source: D. Pruning Decision Branch · p. 4

E. Output

  • A minimum of 16 retained tokens supplies image context, and the variable-length visual prefix is projected and combined with question embeddings for language-model processing.During downstream fine-tuning, only LoRA adapters are adapted while the pruning module remains fixed.Source: E. Output · p. 4

V. Methodology

  • The methodology specifies the QPriv-VL framework, DTP preparation, four training configurations, and robustness and privacy probes.Source: §V · p. 4

A. DTP Preparation

  • DTP preparation uses feature pre-computation, oracle prune-ratio search, and teacher-student distillation across six VQA benchmarks capped at 3,000 samples each.The sensitivity head uses a separate auxiliary set with image-level privacy labels; those labels do not enter the VQA loop.Source: A. DTP Preparation · p. 4
  • Oracle search selects the smallest tested pruning ratio that preserves the gold answer, while distillation transfers teacher outputs and hard oracle targets to the student.The search tests ratios in ascending order and is capped at 500 samples per dataset; the teacher signals address discrete oracle targets and unavailable privacy-supervised data.Source: A. DTP Preparation · p. 5

B. QPriv-VL Framework Architecture

QPriv-VL combines question-conditioned utility and DINOv2-derived sensitivity signals to predict a pruning ratio and visual-token mask in one forward pass.

B. QPriv-VL Framework Architecture

  • CLIP-V produces 576 visual features of dimension 1024, CLIP-T produces 768-dimensional question features, and DINOv2 produces 256 features on a 16×16 grid.Source: B. QPriv-VL Framework Architecture · p. 6
  • The sensitivity head maps DINOv2 features to patch sensitivity scores that are bilinearly upsampled to the CLIP grid for fusion with the utility scores.Source: B. QPriv-VL Framework Architecture · p. 6
  • A threshold-prediction MLP uses concatenated global descriptors, and the DTP network jointly predicts a pruning ratio and retention mask in one forward pass.A safety-floored top-k selection enforces kmin=16; the DTP network contains approximately 1.7 million parameters.Source: B. QPriv-VL Framework Architecture · p. 6

C. Training Configurations

The four training configurations share a backbone, LoRA setup, and optimization schedule, while differing in how data and model components are divided between client and server.

C. Training Configurations

  • All four configurations use the same LLaVA-1.5-7B backbone, LoRA configuration, and optimization schedule, differing only in client-server division of model and data.Source: C. Training Configurations · p. 6
  • Centralized training uses one trainer with the entire training set and updates LoRA adapters through mini-batch SGD with gradient accumulation.Source: C. Training Configurations · p. 6
  • Federated learning assigns non-overlapping data shards to clients and aggregates their local LoRA updates with FedAvg each round.The server broadcasts the global LoRA state; optimizer state is not shared.Source: C. Training Configurations · p. 6
  • Split learning places the decoder cut at layer 16, while USL uses cuts at layers 8 and 24 to keep the client head and tail on the client.In USL, the server sees only activations at the two cut points, and per-client AdamW states prevent statistical leakage across clients.Source: C. Training Configurations · p. 6

D. Robustness and Privacy Probes

The evaluation adds probes for off-topic-question behavior and for whether pruning preferentially excludes sensitive image patches.

D. Robustness and Privacy Probes

  • The irrelevant-question probe tests cross-image, nonsensical, and false-premise queries, classifying curated refusal or uncertainty phrases as refusals and other non-empty responses as hallucinations.Source: D. Robustness and Privacy Probes · p. 6
  • Privacy-relevant subsets rank test images by maximum DINOv2-derived patch sensitivity and select the top-N; medical samples generally meet the sensitivity-training threshold.Source: D. Robustness and Privacy Probes · p. 6
  • Sensitivity exclusion ratio values above one indicate preferential removal of highly sensitive regions, while values near one indicate content-agnostic dropping.The same privacy-sensitive subset is also evaluated for closed-question exact-match accuracy and open-question recall.Source: D. Robustness and Privacy Probes · p. 6

VI. Experimental Results

The experiments evaluate QPriv-VL across training paradigms and visualize how DTP combines sensitivity, question-conditioned utility, and a keep-mask. Across examples, the mask responds to both image sensitivity and task-relevant regions.

A. Experimental Setup

  • DTP is evaluated under a shared training configuration across centralized, federated, split, and U-shaped split paradigms.The setup uses LoRA adapters and 20 rounds of 100 micro-batches, with five clients for the distributed paradigms.Source: A. Experimental Setup · p. 7

B. Qualitative Visualisation of DTP Intermediate Signals

  • Medical samples show concentrated sensitivity peaks, with DTP retaining 4–20 diagnostically relevant patches.Low-sensitivity VQAv2 retains 565/576 tokens, while the face-containing OK-VQA example retains 479/576.Source: B. Qualitative Visualisation of DTP… · p. 7
  • Across five dataset examples, the keep-mask follows high-response regions of the combined score αu −βs.Figure 4 shows sensitivity, utility, combined score, and keep-mask for one sample per dataset.Source: B. Qualitative Visualisation of DTP… · p. 7, Figure 4 · p. 7

C. Adaptive vs. Fixed Token Pruning

DTP adapts token retention to sample content and question relevance, then is evaluated for accuracy, communication cost, and privacy robustness. The results report a sample-adaptive budget, competitive accuracy, and lower reconstruction quality under FORA than matched fixed-ratio pruning.

C. Adaptive vs. Fixed Token Pruning

  • DTP retains 305–342 tokens (ρ̂≈0.41–0.47) while preserving semantically relevant regions that fixed-rate pruning may remove uniformly.Examples include abdominal structures, clothing, foreground subjects, and tissue regions.Source: C. Adaptive vs. Fixed Token Pruning · p. 7

D. Accuracy-Token-Budget Trade-off over Training Paradigm

  • On general-domain benchmarks, DTP budgets adapt to content: OK-VQA retains 194 tokens, while GQA retains 318 and VQAv2 retains 296.DTP remains within a few points of matched Fixed rows.Source: D. Accuracy-Token-Budget Trade-off… · p. 8
  • Across six datasets, DTP averages ≈40% retention, with medical budgets of 155–259 tokens and accuracy a few points below unpruned performance.On PathVQA, U-Split DTP retains 155 tokens at 55.9% average accuracy, 5.9 points below Off.Source: D. Accuracy-Token-Budget Trade-off… · p. 8

E. QPriv-VL Robustness Against FSHA

  • FSHA reconstructions remain low fidelity across defenses; DTP reaches ≈14.0 dB PSNR while retaining roughly 221 VQA-RAD tokens.Even without pruning, FSHA fails to recover diagnostically meaningful information from layer-16 representations.Source: E. QPriv-VL Robustness Against FSHA · p. 8

F. QPriv-VL Robustness Against FORA

  • Under FORA, DTP achieves the lowest PSNR in every column and sits 1.4–1.7 dB below the matched-token fixed-ratio trend.On VQA-RAD, DTP matches ρ=0.9 PSNR while retaining roughly four times as many tokens.Source: F. QPriv-VL Robustness Against FORA · p. 9, Table IV · p. 9
  • DTP’s FORA advantage varies by dataset: co-training further weakens the attacker on VQA-RAD, while inference-time pruning dominates on SLAKE.On VQA-RAD, co-training lowers PSNR from 14.39 to 13.85 dB at ρ=0 and from 12.42 to 12.34 dB at the DTP operating point.Source: F. QPriv-VL Robustness Against FORA · p. 9

G. QPriv-VL Robustness Against MIA

The attack evaluations find reduced attribute-inference success on VQA-RAD, while iDLG reconstruction remains poor with or without pruning. Explainability examples show that DTP changes retained regions with question semantics, including reducing retention for an off-topic query.

G. QPriv-VL Robustness Against MIA

  • On VQA-RAD, DTP at ρ=0.61 yields attribute-inference accuracy of 0.76–0.79, down from ≈0.99 undefended while retaining ∼225 tokens.On SLAKE, attack accuracy remains ≥0.95 under every defense, associated with coarse image statistics and a strong question prior.Source: G. QPriv-VL Robustness Against MIA · pp. 9–10, Figure 7 · p. 10

H. QPriv-VL Robustness Against iDLG Attack

I. Explainability Analysis of QPriv-VL

  • For the blouse-color query, DTP retains 265 focused patches and predicts black; for an unrelated arithmetic query, it drops to the safety floor of 16 patches.The fixed pruning examples return white for the blouse query.Source: §I · p. 10

J. Behavioural Probes: Off-Topic Queries and Sensitivity-Aware Pruning

The behavioural probes find that DTP drops patches marked as more sensitive while preserving relevant-question accuracy, though utility falls on the sensitive subset. The discussion reports broad privacy-utility gains but notes that pruning does not provide a formal privacy guarantee.

J. Behavioural Probes: Off-Topic Queries and Sensitivity-Aware Pruning

  • Across 72 dataset-defense combinations, off-topic hallucination rates remain 0.94–0.98 and refusal rates 0.02–0.06, while relevant-question accuracy is 0.50–0.57.Table V aggregates the two probes; Fig. 9 depicts question-conditioned utility maps and retained regions for in-context and out-of-context questions.Source: J. Behavioural Probes: Off-Topic… · pp. 10–11, Table V · p. 11, Figure 9 · p. 11
  • DTP's sensitivity exclusion ratio is 1.20 ± 0.18, versus 0.998 for fixed-rate pruning at ρ=0.5, indicating that dropped patches carry higher sensitivity on average.The same probe reports a moderate utility cost on the sensitive subset: closed accuracy 0.797 →0.736 and open recall 0.468 →0.378.Source: J. Behavioural Probes: Off-Topic… · p. 11

K. Discussion and Limitations

  • DTP reduces the visual prefix to nearly 40% while reducing all evaluated attack families and keeping VQA performance close to unpruned baselines across CL, FL, SL, and USL.The discussion reports a 1.4–1.7 dB reduction in FORA reconstruction quality versus interpolated fixed-ρ pruning and nearly halves VQA-RAD MIA accuracy at operating points unattainable by a single fixed ratio.Source: K. Discussion and Limitations · p. 11
  • Low-entropy attributes such as imaging modality still leak comparatively heavily under aggressive pruning, and the evaluation is limited to LLaVA-1.5-7B with fixed cut-layer configurations.The discussion also cautions that fixed DINOv2 sensitivity guidance may generalize poorly against adaptive attackers.Source: K. Discussion and Limitations · p. 11

VII. Conclusion

  • Token pruning alone is insufficient to guarantee formal privacy protection.The conclusion identifies adaptive-attacker co-training, broader architecture and modality coverage, differential privacy, and secure aggregation as future directions.Source: §VII · p. 12

VIII. LLM Usage Statement

  • LLMs assisted with editorial drafting and code debugging, while authors conceived the methodology and validated the code and reported results.The authors report that figures, tables, and quantitative results were produced without AI assistance.Source: §VIII · p. 12
  • The authors report that no sensitive, private, proprietary, or participant data were shared with AI tools.Source: §VIII · p. 12

Appendix

The comparison places QPriv-VL among centralized token-pruning and split-learning privacy approaches, while reporting utility and attack-resistance results not available for prior pruning methods. The ablation finds the best medical-VQA accuracy at privacy-only token ranking, with token counts nearly constant across the weight sweep.

A. Comparison with Prior Work

  • Prior token-pruning methods focus on centralized inference and do not evaluate feature-reconstruction or membership-inference robustness; no prior work jointly combines question-guided pruning and privacy defense in distributed VLMs.NoPeek and ResSFL target small CNNs, and NoPeek remains vulnerable to FSHA.Source: A. Comparison with Prior Work · p. 13
  • 60.4% accuracy with 318 retained tokens in Direct mode on GQA compares with VisionZip's 59.3% and PyramidDrop's 60.1%, each using 192 tokens.QPriv-VL also reduces FORA reconstruction PSNR by 1.4–1.7 dB on SLAKE and VQA-RAD and lowers VQA-RAD membership-inference accuracy from 0.99 to 0.76.Source: Table VI · p. 13, A. Comparison with Prior Work · p. 13

B. Ablation Study

  • At α = 0, VQA-RAD accuracy is 0.566 and SLAKE accuracy is 0.817, exceeding the α = 1 results of 0.527 and 0.774, respectively.Figure 10 presents the utility-privacy trade-off ablation.Source: Figure 10 · p. 14, B. Ablation Study · p. 14
  • Average retained-token counts vary only from approximately 220–224 on VQA-RAD and 256–262 on SLAKE across the α, β sweep, so the reported trade-off is driven by token ranking criterion rather than token count.Source: B. Ablation Study · p. 14
Loading 2609.15671v1…