Autoencoder-Based Defense

The defense operates by forcing data through a low-dimensional latent bottleneck. The encoder compresses the input, and the decoder reconstructs a sanitized version. This process naturally discards high-frequency, instance-specific details that inversion attacks exploit, while preserving the semantic features necessary for the primary classification task. The bottleneck size is a critical hyperparameter controlling the privacy-utility trade-off.

A DAE is trained to reconstruct clean inputs from intentionally corrupted versions. As a defense, it is trained to remove a specific noise profile associated with sensitive attributes or identifiable features. At inference time, the DAE pre-processes inputs, stripping away fine-grained signals before they reach the classifier. This directly obstructs gradient inversion and feature reconstruction attacks by ensuring the classifier never sees the raw, invertible data.

A VAE defense replaces deterministic latent vectors with probabilistic latent distributions (typically Gaussian). The encoder outputs a mean and variance, and a latent vector is sampled from this distribution. This inherent stochasticity acts as a natural differential privacy mechanism, making it mathematically difficult for an attacker to map a specific output back to a single, deterministic input. The KL divergence loss term further regularizes the latent space.

The autoencoder is not trained solely for reconstruction; it is co-trained adversarially with a simulated attacker. The training loop includes a reconstruction adversary that attempts to invert the autoencoder's output. The autoencoder's loss function is augmented with a penalty for the adversary's success, explicitly optimizing the bottleneck to maximize reconstruction error for an attacker while minimizing classification loss for the downstream model.

The defense can be deployed in two primary configurations:

• Inline Filter: The autoencoder sits directly between the data source and the classifier, sanitizing all inputs in real-time.
• Distillation Teacher: A sanitizing autoencoder is used to generate a cleansed dataset. A new classifier is then trained from scratch on this sanitized data, ensuring it never learns from raw, invertible features. This is a form of defensive distillation.

This defense is effective against multiple threat vectors:

• Model Inversion: Reconstructed images from the classifier's gradients or confidence scores are blurry and lack identifiable details.
• Gradient Leakage (DLG): Gradients computed on sanitized inputs carry less high-frequency information, causing DLG optimization to converge to generic, non-sensitive patterns.
• Membership Inference: The stochastic and lossy nature of the autoencoder normalizes the output distribution for both member and non-member inputs, reducing the signal exploited by MIAs.