Confidence Score Masking

The most common implementation returns only the top-k predicted class labels without their associated confidence scores. For example, a model classifying medical images might return only ['benign', 'malignant'] instead of {'benign': 0.9998, 'malignant': 0.0002}. This eliminates the prediction vector that model inversion attacks use as an optimization target. Typical configurations use k=1 or k=5, balancing utility against the privacy budget.

When confidence scores must be exposed, truncation reduces floating-point precision to a fixed number of decimal places (e.g., 0.9876 → 0.98). Rounding maps scores to discrete buckets. Both techniques introduce quantization noise that degrades the gradient signal exploited by gradient matching and Deep Leakage from Gradients (DLG) attacks. The coarser the rounding, the stronger the defense against membership inference attacks (MIA).

Confidence score masking is often combined with temperature scaling of the softmax layer. A high temperature (T > 1) flattens the probability distribution, making all classes appear more equally likely. When paired with top-k truncation, this dual approach simultaneously reduces the mutual information between the output and the training data, implementing a practical information bottleneck without retraining the model.

Masking complements formal differential privacy (DP) mechanisms. While output perturbation adds calibrated Gaussian or Laplacian noise to satisfy a specific epsilon privacy guarantee, masking provides a deterministic first line of defense. The combination of DP noise and score truncation creates a defense-in-depth strategy where the adversary must overcome both stochastic and structural information barriers to succeed at feature reconstruction.

This defense is deployed at the inference API boundary rather than within the model architecture itself. A lightweight middleware layer intercepts the raw prediction vector before it is serialized and returned to the client. This allows security engineers to enforce query auditing policies—such as rate limiting and sequence anomaly detection—alongside score masking, creating a unified model extraction and model inversion defense gateway.

Aggressive masking (e.g., returning only the single top label) provides strong protection against label-only inversion but may be unacceptable for applications requiring calibrated uncertainty estimates. The trade-off is quantifiable: returning top-5 labels with rounded scores preserves most utility for multi-class decision support while reducing the success rate of membership inference attacks by 40-60% compared to full probability vector disclosure.