PaperlayerView exact revision on arXiv

Source-linked AI summary

Label-Budgeted Attribute Inference from Protected Features in Edge-Cloud Split Multimodal LLMs

Junguang Yao, Peichun Hua, Hanxiu Zhang, Yue Zheng

arXiv:2610.32079v1cs.CR

TL;DR

Split inference sends intermediate MLLM features to a server, where sensitive attributes may be inferred despite keeping raw images local. This paper measures leakage across budgets of labeled protected features and tests for feature–attribute dependence. Its evaluation finds persistent leakage across split depths and shows that protected features can remain recoverable with limited labels.

  • Problem

    Split inference exposes intermediate features to a server, and the extent to which those features reveal sensitive attributes under adaptive, label-budgeted attacks is not captured by native protection evaluations.

    Source: §I · p. 1

  • Method

    The framework measures the share of unprotected leakage recovered as labeled protected samples increase from zero to a full set, and complements this curve with a classifier-free dependence test.

    Source: §I · pp. 1–2, §III · p. 2

  • Results

    Across tested split depths, all three attributes remain recoverable; with Safe-LLaVA, 20 labeled samples per class recover 75–85% of the unprotected leakage.

    Source: §I · p. 2, §V · p. 3

  • Takeaways & Limitations

    The results show that privacy at the split boundary depends on where protection intervenes, and support evaluating mechanisms with label budgets and classifier-free dependence tests.

    Source: §VI · p. 4

    The framework’s evaluation is limited to faces; extending it beyond faces and to compressed features remains future work.

    Source: §VI · p. 4

Abstract

from arXiv · show

Edge-cloud split inference runs the early layers of a multimodal large language model (MLLM) on a device and sends intermediate features to a server to complete the task. While keeping raw images local is often perceived as a privacy benefit, an honest-but-curious server can still infer sensitive attributes, such as age, gender, and race, from the received features. Existing protections intervene at the input, transmitted representation, or model's responses, but their native evaluations rely on final-response refusals or fixed-classifier failures, which underestimate an adaptive server's capabilities. To address this, we propose a label-budgeted attribute-inference framework that measures representation-level privacy through a recovery curve: the share of the unprotected leakage the server recovers as a function of its labeled-sample budget, from zero (a classifier trained on unprotected features) to a full labeled set. Our evaluation across two popular MLLMs reveals two critical findings. First, in unprotected pipelines, intermediate features leak all three attributes regardless of the split depth. Second, even when protection mechanisms are deployed across different stages, sensitive information remains recoverable under limited label budgets. For example, Safe-LLaVA removes biometric content from the model's responses, but from the features it transmits in split inference, 20 labeled samples per class recover 75-85% of the unprotected leakage. This work provides a label-budgeted measure of feature-level privacy for split MLLM inference and motivates defenses that act on the transmitted representation.

I. INTRODUCTION

Split inference keeps raw images on the device but sends intermediate representations that may reveal sensitive attributes to the server. This paper studies how much labeled protected data an honest-but-curious server needs to recover those attributes and evaluates a label-budgeted framework across generation and face-recognition settings.

I. INTRODUCTION

  • The transmitted representation can reveal sensitive attributes such as age, gender, and race even when the raw image stays local.The server follows the inference protocol while also attempting to infer attributes from features it legitimately receives.Source: §I · p. 1
  • Existing defenses target different pipeline stages, but their native evaluations—such as response refusal or fixed-classifier accuracy—do not measure privacy at the split boundary across label budgets.The evaluated mechanisms include image-level ImageProtector, representation-level PASS, and model-level Safe-LLaVA.Source: §I · p. 1, Figure 1 · p. 2
  • The framework measures the share of unprotected leakage recovered as the server’s labeled protected-sample budget grows, from zero to a full auxiliary set.At zero, the attacker transfers a probe trained on unprotected features; with at most 20 labels per class it fine-tunes that probe.Source: §I · pp. 1–2
  • Across generation and face-recognition settings, the study evaluates recovery of age, gender, and race from features produced by two MLLMs.The reported findings include persistent leakage across split depths and recoverability under limited label budgets, including for protected features.Source: §I · pp. 1–2

II. SYSTEM AND THREAT MODEL

A provider-owned service partitions an MLLM between a trusted device and the provider’s server. The server completes the requested task while also attempting to infer a sensitive attribute from the features it receives.

II. SYSTEM AND THREAT MODEL

  • The provider deploys the device-side partition, which processes an image and prompt through the vision encoder, projector, and decoder layers up to split layer ℓ.The device applies any prescribed protection mechanism before transmitting features.Source: §II · p. 2
  • The server runs the remaining decoder layers to generate a response or uses a compact embedding for face verification.Source: §II · p. 2
  • For generation, the device transmits token-level hidden states; for face verification, it pools those states and projects them to an embedding.The token count and feature width do not depend on the split layer.Source: §II · p. 2
  • The honest-but-curious server knows the architecture, split layer, and protection mechanism, and can use labeled auxiliary face data to train attribute probes.Its budget counts protected labeled samples per class; from sequences it mean-pools features, while it uses embeddings directly.Source: §II · p. 2

III. ATTRIBUTE-INFERENCE FRAMEWORK

The framework varies an attacker’s budget of labeled protected features and measures the leakage recovered at each budget. It also tests for statistical dependence between protected features and the sensitive attribute without training a classifier.

III. ATTRIBUTE-INFERENCE FRAMEWORK

  • The attacker may transfer a probe trained on unprotected auxiliary features, fine-tune it on 1, 2, 5, 10, or 20 protected samples per class, or retrain it on the full protected auxiliary set.A transductive few-label variant additionally self-trains on unlabeled protected target features.Source: §III · p. 2
  • The recovery curve normalizes the attacker’s score at budget b against the task baseline and the score from a probe trained and tested on unprotected features.Categorical tasks use balanced accuracy and age regression uses negative mean absolute error; values above 100% exceed unprotected leakage.Source: §III · p. 2
  • A classifier-free dependence test uses normalized Hilbert–Schmidt independence criterion to test whether protected target features remain statistically dependent on the attribute.The test uses feature and label kernels and estimates its p-value from 1,000 label permutations.Source: §III · pp. 2–3

IV. EXPERIMENTAL SETUP

The experiments evaluate two MLLMs on face-image generation and recognition tasks, using categorical attributes and age regression. They compare split depths and protection mechanisms while measuring privacy, utility, and computational cost.

IV. EXPERIMENTAL SETUP

  • The study evaluates LLaVA-1.5-7B and Qwen2.5-VL-3B on FairFace and UTKFace for age, gender, and race prediction.FairFace supplies categorical age groups, gender, and race; UTKFace includes age in years as well as categorical gender and race.Source: §IV · p. 3
  • Models are split after layers 5, 15, 25, or L, using an RTX 2080 Ti device and a V100 server.The setup measures device latency, peak GPU memory, energy above idle, and server latency.Source: §IV · p. 3
  • The evaluation checks ImageProtector by attribute-query refusal, Safe-LLaVA by refusal on PRISM, and PASS by attribute balanced accuracy on FairFace.Utility is measured using CLIP similarity for Safe-LLaVA and ImageProtector, and face-verification accuracy for PASS.Source: §IV · p. 3
  • Final-layer probes use stratified 80/20 dataset splits, while other evaluations use 1,050 auxiliary and 2,100 target images with five-seed means and standard deviations.The protection evaluation uses standardized layer-15 features projected to 512 dimensions, except PASS, which uses its own embedding.Source: §IV · p. 3

V. RESULTS

Final-layer probes recover every evaluated attribute above baseline, and measured leakage changes little with split depth. Deeper LLaVA splits raise device costs, while each evaluated defense meets its own stated security objective.

V. RESULTS

  • From layer 5 to the last layer, no BA changes by more than 0.03 and age MAE by at most 0.5 years, despite significant final-layer leakage across attributes.Table I reports unprotected BA, or UTK age MAE, at each split layer.Source: §V · p. 3, Table I · p. 3
  • Moving LLaVA’s split from layer 5 to layer 15 doubles device latency and energy, while layer 25 exceeds the device’s 11-GiB capacity.The split-cost table reports latency and marks out-of-memory settings.Source: §V · p. 3, Table II · p. 3
  • Safe-LLaVA, ImageProtector, and PASS each meet their native security objective, with ImageProtector requiring 17.6 GiB and 295 seconds per image.ImageProtector’s per-image memory requirement exceeds the device’s 11-GiB capacity.Source: §V · p. 3

A. Recovery at Zero and Full Budget

At full budget, the defenses differ in how much attribute leakage remains recoverable: Safe-LLaVA retains near-unprotected leakage, ImageProtector varies across models, and PASS limits probe recovery. The table reports leakage at zero and full budget, with recovery shading and relative nHSIC.

A. Recovery at Zero and Full Budget

B. Recovery Curves

Recovery curves show how quickly protected features yield sensitive attributes as the server receives labeled samples. Recovery varies substantially across protections, while Safe-LLaVA’s UTK age results also improve with residual-ridge calibration.

B. Recovery Curves

  • Twenty samples per class under Safe-LLaVA recover 75–85% of unprotected leakage and close 69–84% of the gap.One protected sample per class already recovers 35–53%; half of the unprotected leakage takes 1 to 5 labels per class.Source: B. Recovery Curves · p. 4
  • On FF, recovering half the unprotected leakage remains out of reach under ImageProtector and PASS, even with the full set.At 20 labels per class, recovery is at most about 27% under ImageProtector and 10% under PASS.Source: B. Recovery Curves · p. 4
  • For UTK age under Safe-LLaVA, residual-ridge calibration lowers transfer-attacker MAE from 35.3 years to 13.3 with 10 samples and 9.2 with 200.The full-budget MAE is 6.8 years.Source: B. Recovery Curves · p. 4

VI. CONCLUSION

Attribute privacy depends on where protection intervenes: Safe-LLaVA leaves attributes recoverable, while ImageProtector and PASS offer differing levels of protection. Deeper splits raise device overhead without mitigating leakage.

VI. CONCLUSION

  • Safe-LLaVA leaves sensitive attributes recoverable from intermediate features, with 1 to 5 labels per class sufficient to recover half the unprotected leakage.ImageProtector provides limited cross-model protection, while PASS suppresses inference attacks but retains measurable dependence.Source: §VI · p. 4
  • Moving the split layer deeper increases device overhead without mitigating leakage.The conclusion recommends label budgets and classifier-free dependence tests for evaluating split-inference privacy mechanisms.Source: §VI · p. 4
  • The framework’s stated future scope is evaluation beyond faces and on compressed features.Source: §VI · p. 4
Loading 2610.32079v1…