Jul 2026· International Conference on Computer, Information and Telecommunication Systems· pp. 1-8· 0 citations· 45 references
Abstract
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
Machine-learning-as-a-service (MLaaS) platforms let organizations deploy predictive models without revealing their internal architecture, but this opacity does not guarantee the privacy of the data used to train them. This paper presents a systematic framework for membership inference attacks, in which an adversary with only black-box query access to a deployed classifier determines whether a specific individual's record was part of its training set. We introduce a shadow-model methodology that trains auxiliary classifiers on synthetically generated data produced via model-based synthesis, known population statistics, or noisy real data to learn the behavioral differences a target model exhibits on seen versus unseen inputs. Evaluated against commercial platforms including Google Prediction API and Amazon ML across seven datasets spanning healthcare, retail, location, and image domains, our attacks achieve median precision of 0.657 and 0.678 on the two platforms, respectively, with healthcare records showing vulnerability of approximately 65.7% precision. We identify overfitting, output granularity, and class imbalance as primary drivers of leakage, and evaluate mitigations such as output truncation, temperature scaling, and regularization, finding that each offers only partial protection at the cost of utility. These findings expose significant gaps in current regulatory frameworks such as GDPR and HIPAA regarding inference-based privacy violations.
Pramod Prakash· International Journal of Int...· 0 citations
Metric Differential Privacy (mDP) extends classical differential privacy (DP) by replacing Hamming adjacency with application-aware distance metrics, which offers utility-preserving protection for structured and continuous data including locations, trajectories, images, and text embeddings. This Systematization of Knowledge (SoK) paper synthesizes a decade of progress (2013-2025), clarifying mDP's foundations and its connections to central and local DP, and surveying three principal mDP mechanism families: homogeneous distance mechanisms, non-homogeneous distance mechanisms, and optimized perturbation mechanisms. We organize applications across geo-location privacy, text and embeddings, image and voice protection, graphs and network telemetry, and federated/edge settings. We also surface open challenges, including robust composition and adversarial modeling, context-adaptive privacy, high-dimensional scalability, and principled geometry-aware trade-off bounds, and distill practical guidance for selecting metrics, mechanisms, and metrics of utility. The goal is a unified reference and roadmap for deploying scalable, utility-preserving metric privacy in real-world systems.
Xinpeng Xie, Chenyang Yu, Yan Huang et al.· Proceedings on Privacy Enhan...· 0 citations
High-quality data are essential for machine learning and data-driven research, yet data scarcity and privacy concerns remain major obstacles in many domains. Generative models have recently emerged as a promising approach to synthesize data that follow the same statistical distribution as real datasets. However, generative models are vulnerable to membership inference attacks, which threaten data confidentiality by exploiting model outputs to infer whether specific samples were used in training. Existing defense strategies struggle to simultaneously preserve data utility and provide robust privacy protection. To address this challenge, we propose our PPGM-GAN, a Privacy-Preserving GAN for synthetic data against membership inference attack to balance both data utility and data privacy. PPGM-GAN balances privacy and utility through a privacy-utility tradeoff function that quantifies and optimizes both aspects under different adversarial knowledge. To enhance data utility, we incorporate conditional generation and key-attribute screening to ensure sufficient representation of infrequent attribute values. Additionally, differential privacy is employed during training to prevent overfitting and reduce privacy leakage. Experimental results demonstrate that PPGM-GAN outperforms state-of-the-art privacy-preserving generative models, producing high-utility synthetic data under the same privacy constraints.
Guizhang Cui, Guowei Wu, Lin Yao et al.· ACM Transactions on Privacy...· 0 citations
LLM applications deployed at scale face a fundamental challenge: privacy constraints prevent direct inspection of user interactions, making it difficult to obtain any representative evaluation dataset or to track the ongoing evolution of production traffic. We present ProxyDrift, a framework that (i) identifies and measures drift between production traffic and offline evaluation sets, and (ii) constructs and refreshes those evaluation sets accordingly; all without access to raw user data. Our approach operates entirely on non-PII proxy representations: structured, multi-dimensional descriptors derived from LLM-based classification of user interactions. We introduce (1) a chance-calibrated, redundancy-aware (RA) alignment score that aggregates per-dimension drift measurements via mutual information; (2) a conditional sampler that generates synthetic proxies respecting inter-dimensional dependencies; (3) a roundtrip consistency analysis that exposes generator/classifier disagreements and guides proxy taxonomy refinement; and (4) a feedback-linkage analysis that ties per-dimension and per-value proxy distributions to user satisfaction, surfacing actionable failure and success modes. Serving hundreds of millions of users, ProxyDrift enables continuous drift monitoring and targeted synthetic data generation without exposing sensitive user data. Experiments confirm strong roundtrip consistency, discriminator-level indistinguishability of synthetic queries from human queries, and tight end-to-end alignment (RA~0.9) with production.
Michael Levit, Josh Ledgard, Haoyu Dong et al.· 0 citations
As medical records are shared for research and treatment, the same anonymization techniques are used for all, but the risks are exacerbated by the fact that the records are being shared with others. This paper proposes a user-aware deep learning anonymization framework to adjust privacy strength according to the recipient attributes (such as the role, purpose, trust level). It combines conditional generative adversarial networks with differential privacy, with the privacy budget allocated to a user, ε, being tighter for low-trust requesters, and looser for clinicians, where ε ∈ {0.1, 1.0, 5.0}. The proposed approach performs well downstream in terms of the F1 score (0.89) of high-trust users, and exhibits membership inference AUC of 0.52 just above random guessing on the MIMIC-IV data. The accuracy of attribute inference for low-trust users is also low (still less than 0.55) for sensitive diagnoses, leading to improved performance over fixed-DP GAN, AnomiGAN, and PRIMIS. A user encoder is able to decrease mutual information between embeddings and raw patient data from 0.42 to 0.07 during training. In conclusion, the results show that user-adaptive anonymization maintains clinically meaningful utility for legitimate use while ensuring strong protection against re-identification attempts, thereby filling a crucial gap in the field of privacy-preserving medical data sharing.
Lingam Suman, S. Venkata Lakshmi· 2026 6th International Confe...· 0 citations
Vector embeddings of raw records, while not human-readable, do not preserve record privacy: an adversary can reconstruct training records from a released model even when that model is a simple convex classifier. Differential privacy (DP) is the principled defense, but its noise is calibrated to worst-case indistinguishability, hiding arbitrary single-record substitutions, including those far outside the set of plausible alternatives relevant to a reconstruction adversary. The result is noise far larger than what reconstruction robustness requires, degrading accuracy without a corresponding security benefit. We propose Ball-DP: enforcing epsilon-delta indistinguishability over single-record substitutions restricted to a ball of radius r under a distance metric d in the embedding space. A deployment facing only local reconstruction threats can choose a small r, thereby reducing noise and recovering accuracy. The radius makes the scope of the privacy claim explicit against reconstruction attacks; standard DP is recovered when r covers the entire admissible record domain. We provide noise calibrations for regularized convex learning problems under Ball-DP, and derive corresponding reconstruction-robustness certificates, called Ball-ReRo, that upper-bound an attacker's reconstruction success. By deriving the optimal finite-prior MAP reconstruction attack, we empirically audit Ball-ReRo certificates on seven benchmark learning tasks. Our experiments show that calibrating noise to Ball-DP improves utility, considerably exceeding the dilution of reconstruction robustness in high-privacy regimes, i.e., when epsilon is small.