Adversary-Aware Private Inference over Wireless Channels

Technical Summary: Adversary-Aware Private Inference over Wireless Channels

Problem Statement
The paper addresses the privacy risks inherent in AI-based sensing at wireless edge devices, specifically within collaborative inference frameworks. In these systems, edge devices extract features from raw sensing data (e.g., images) and transmit them to a remote server for prediction. While this reduces on-device computational load, it exposes sensitive intermediate feature representations to eavesdropping. Existing privacy mechanisms, such as Differential Privacy (DP), typically focus on protecting finite datasets or guaranteeing the indistinguishability of a dataset's output. However, the paper notes that protection for individual features transmitted over wireless channels, particularly against reconstruction attacks by an adversary observing the transmission, has not been rigorously addressed. The core challenge is to design a transmission pipeline that minimizes communication overhead while guaranteeing a high reconstruction error for an adversary, without significantly degrading the server's inference accuracy.

Methodology
The authors propose an end-to-end transmission pipeline for collaborative inference that integrates privacy preservation directly into the physical and signal processing layers. The framework operates through the following stages:

1. Feature Extraction and Dimensionality Reduction: An edge device extracts a feature vector $F(x)$ from raw input $x$. This vector is clipped to ensure bounded sensitivity and then projected into a lower-dimensional space ($r \leq d$) using a linear encoder matrix $W$.
2. Local Privacy Injection: To ensure local privacy, the device applies the Gaussian mechanism by adding Gaussian noise to the encoded vector. This step is governed by $(\epsilon, \delta)$-feature Differential Privacy (DP) constraints.
3. Wireless Transmission: The perturbed vector is scaled by a transmit power coefficient and transmitted over a block-fading wireless channel. The model accounts for channel impairments and additive Gaussian noise.
4. Server-Side Processing: The server receives the noisy signal, rescales it, and applies a linear decoder to reconstruct the feature representation for classification.
5. Adversarial Model: An adversary is modeled as an eavesdropper observing the transmission over a separate wireless channel with its own channel coefficient and noise. The adversary attempts to reconstruct the original features using a linear estimator.

The paper analyzes the trade-offs between the dimensionality of the projected features, the magnitude of privacy noise, and the wireless channel conditions. It derives theoretical bounds on the server's classification accuracy and the adversary's Mean Squared Error (MSE) in reconstructing the features.

Key Contributions
The paper introduces a novel privacy framework termed feature differential privacy, specifically designed to protect intermediate feature representations during wireless transmission. The main contributions include:

• Theoretical Guarantees on Adversarial Reconstruction: The authors derive a rigorous lower bound on the adversary's MSE as a function of model parameters, channel conditions, transmit power, and noise. This bound quantifies the difficulty an adversary faces in recovering sensitive information.
• Optimal Projection Dimension: The paper establishes the optimal projection dimension $r^*$ required to satisfy a target adversarial MSE threshold while minimizing latency. It identifies two regimes: a "privacy-limited" regime where dimensionality scales with privacy parameters ($r^* \propto \epsilon^2/d$) and a "noise-limited" regime where dimensionality saturates to a constant determined by channel noise.
• Classification Accuracy Bounds: A lower bound on classification accuracy is derived under differential privacy constraints, explicitly capturing the trade-offs between feature dimensions, privacy noise, and wireless channel impairments.
• Massive MIMO Extension: The framework is extended to a Massive MIMO setting, demonstrating that channel hardening and favorable propagation can inherently suppress information leakage to eavesdroppers, causing the adversary's reconstruction error to asymptotically approach the dimension of the feature space (effectively gaining no information) as the number of antennas increases.

Results
Theoretical analysis and visualizations (e.g., Fig. 2 and Fig. 3) demonstrate the following:

• Privacy-Utility Trade-off: As the privacy parameter $\epsilon$ decreases (stricter privacy), the adversarial MSE increases, indicating stronger protection. However, increasing the feature dimension $d$ without adjusting privacy noise can degrade server-side classification accuracy due to the amplification of perturbation noise.
• Dimensionality Impact: In high privacy regimes, increasing dimensionality amplifies noise, reducing accuracy. Conversely, in low privacy regimes, higher dimensionality can aid classification until a critical turning point is reached.
• Adversarial Resilience: The derived lower bounds confirm that the proposed mechanism effectively limits the adversary's ability to reconstruct features. The use of a random compression matrix (with entries from a Laplacian distribution) combined with Gaussian noise ensures that the mechanism satisfies $(\epsilon, \delta)$-feature DP.
• Massive MIMO Benefits: In the Massive MIMO limit, the adversary's ability to recover the transmitted features vanishes asymptotically, highlighting the inherent privacy benefits of physical layer characteristics.

Significance
The paper claims to provide a comprehensive and efficient transmission framework for wireless AI-based sensing that aligns with standard privacy criteria while explicitly accounting for the wireless channel. By integrating privacy into the transmission process through calibrated randomness and dimensionality reduction, the framework offers rigorous theoretical insights into how channel-aware encoding and privacy-preserving perturbation interact to safeguard sensitive information. The work bridges the gap between theoretical privacy guarantees and the practical constraints of wireless communication, offering a foundation for designing privacy-aware edge inference systems. The authors note that future work will explore structured data acquisition models and non-linear dimensionality reduction mechanisms to further bridge theory with practical sensing constraints.