1 Introduction↩︎

A machine learning (ML) model, trained on a dataset, is a representation of the data that can be used to make predictions and offer insights on other data that is of a similar distribution to the original training set. As a result, even in cases where the training data itself cannot be shared due to privacy restrictions, there is still a strong incentive to share access to the ML model. Moreover, techniques such as PATE [1] and federated learning [2] have been proposed to enable training such models while limiting the privacy impact on the training set. The privacy protection such techniques confer is maximized when offering only black-box access (i.e., keeping the weights private) to such models, so that the intermediate activations computed during inference remain hidden [3].

Sensitive data is sometimes shared for socially beneficial reasons, particularly in regulated sectors where organizations must disclose privacy-sensitive information to protect public welfare. For example, hospitals may be required to share patient information during disease outbreaks, and financial institutions may need to report accounts suspected of money laundering. ML could enable similar benefits while reducing the need to share sensitive datasets directly: organizations with large proprietary datasets could train predictive models using privacy-protective techniques [1], [2] and provide controlled access to entities without comparable data. For instance, a healthcare network could offer smaller clinics access to a model that predicts disease risk, while a large financial institution could provide local banks with a model for detecting money laundering.

However, while black-box models trained using privacy-preserving methods protect the training set, inference in the black-box setting still requires the model user to transmit potentially sensitive inputs. While various methods for protecting privacy during inference have been proposed, none satisfy the requirements of efficiency and ease of adoption. For instance, homomorphic encryption [4] can impose severe overheads and typically targets an honest-but-curious adversary model, while hardware-enforced trusted execution environments [5] require specialized hardware that is currently not broadly available.

The strongest privacy guarantee available to a model user is to obtain the trained model weights and perform inference locally, so that the user’s data never leaves their control. However, this would open up the original model to white-box attacks. To address this, we propose a privacy-preserving distillation of black-box models while bounding the privacy leakage of query inputs, which we call LDPKiT (Local Differentially-Private and Utility-Preserving Inference via Knowledge Transfer). Effective distillation requires users’ queries to be representative of the model’s training data distribution, so ideally, they should use real data. However, in regulated privacy-sensitive domains, users typically possess only small amounts of such data, e.g., smaller clinics may have far fewer patients. LDPKiT addresses the privacy and data-shortage challenges by applying local differential privacy (LDP) to bound the privacy leakage of each query while introducing a data augmentation technique that superimposes pairs of noised inputs to generate additional in-distribution queries. This combination enables users to distill useful knowledge from remote models while ensuring protection of sensitive query data.

Our analysis is guided by the following research questions:

RQ1. Does LDPKiT recover the utility impacted by LDP noise? (Section 4.1)

RQ2. Why does superimposition work in LDPKiT? (Section 4.2)

RQ3. How do the size of the private dataset and the number of queries impact LDPKiT? (Section 4.3)

Contributions. LDPKiT enables privacy-preserving distillation from remote black-box models by generating augmented inference datasets from users’ \(\epsilon\)-LDP-protected private samples. Across three image-classification datasets and two models, LDPKiT recovers much of the utility lost to LDP noise. We further study the impact of private-dataset size and number of queries, and conduct latent-space analysis to uncover factors contributing to LDPKiT’s effectiveness.

2 Overview↩︎

2.0.0.1 Motivation.

Our scenario considers privacy-sensitive ML services used to label privacy-sensitive data. Effective distillation for privacy requires realistic in-distribution data, which may itself be sensitive and unavailable publicly. Using out-of-distribution data is ineffective. For instance, distilling a ResNet-18 trained on Fashion-MNIST with SVHN samples, or vice versa, yields approximately random-guessing accuracy (i.e., 10%) for these 10-class datasets. By contrast, noisy in-distribution samples perform better: models distilled using \(\epsilon\)-LDP data with \(\epsilon=2.0\) achieve roughly 21% accuracy on SVHN and 28% on Fashion-MNIST.

2.0.0.2 Preliminaries and General Setup.

Our scenario involves two parties: a model provider hosting a remote model, \({\mathcal{M}_{\rm R}}\), and a user with a small, unlabelled, sensitive dataset, \({\mathcal{D}_{\rm priv}}\), who distills a local model, \({\mathcal{M}_{\rm L}}\). The user may be an organization or individual with black-box access to \({\mathcal{M}_{\rm R}}\). To protect \({\mathcal{D}_{\rm priv}}\), the user applies \(\epsilon\)-LDP noise to each sample, producing \({\mathcal{D}_{\rm protected}}\), where \(|{\mathcal{D}_{\rm priv}}| = |{\mathcal{D}_{\rm protected}}|\). Since \(|{\mathcal{D}_{\rm priv}}|\) is typically small, we augment \({\mathcal{D}_{\rm protected}}\) to form an expanded inference dataset, \({\mathcal{D}_{\rm infer}}\). Its size, \(|{\mathcal{D}_{\rm infer}}|\), is determined by the user’s query budget for \({\mathcal{M}_{\rm R}}\), allowing the user to select some or all augmented samples. These samples are labelled by \({\mathcal{M}_{\rm R}}\) and used to train \({\mathcal{M}_{\rm L}}\). We compare against SIDP, a baseline in which the user directly queries \({\mathcal{M}_{\rm R}}\) with \({\mathcal{D}_{\rm protected}}\) and accepts the returned predictions, despite errors caused by LDP noise. To improve accuracy on \({\mathcal{D}_{\rm priv}}\), LDPKiT distills \({\mathcal{M}_{\rm L}}\) using samples from \({\mathcal{D}_{\rm infer}}\) generated by two augmentation methods, LDPKiT-Rand and LDPKiT-Sup.

2.0.0.3 Threat Model.

The user’s goal is to label samples in \({\mathcal{D}_{\rm priv}}\) with reasonable accuracy when interacting with an ML service in a privacy-preserving way. We only assume that \({\mathcal{M}_{\rm R}}\) provides faithful responses so that the user can obtain faithful predictions on inputs. Furthermore, the service provider has complete control of the model implementation and, as a result, has full access to the inference inputs. We note that the assumption of faithful responses is not required for LDPKiT’s privacy guarantees, only for the utility of the \({\mathcal{M}_{\rm L}}\). To mitigate the threat of exposing sensitive data, the user applies \(\epsilon\)-LDP to their data before querying \({\mathcal{M}_{\rm R}}\), limiting the amount of information that can be inferred from individual samples. Our privacy goal is to protect the user’s inference inputs from the remote model provider; LDPKiT does not aim to protect the provider’s proprietary model beyond the provider’s existing black-box access policy.

2.0.0.4 Privacy Guarantee.

LDPKiT ensures the privacy of \({\mathcal{D}_{\rm priv}}\) during inference by applying LDP noise to each data sample. Intuitively, \(\epsilon\)-LDP ensures that after observing a protected query, the provider cannot confidently distinguish which raw private input produced it; a smaller \(\epsilon\) makes inputs harder to distinguish.

A lower \(\epsilon\) indicates a tighter bound in the inequality and a stronger privacy guarantee. We choose \(\epsilon\) values primarily based on common industry standards [7], [8] and empirically verify that protected data is resilient to data reconstruction attacks [9]. We apply Laplace noise to satisfy the \(\epsilon\)-LDP privacy guarantee.

For constructing the inference dataset \({\mathcal{D}_{\rm infer}}\), we use LDP’s post-processing property: any processing of an \(\epsilon\)-LDP output remains \(\epsilon\)-LDP [10]. This allows LDPKiT to improve utility through augmentation without weakening privacy [11].

3 Design↩︎

Figure 1 summarizes SIDP and LDPKiT. Since \(|{\mathcal{D}_{\rm protected}}| < |{\mathcal{D}_{\rm infer}}|\), SIDP has a lower query cost than LDPKiT, but at the cost of utility. SIDP directly queries \({\mathcal{M}_{\rm R}}\) with \({\mathcal{D}_{\rm protected}}\) and accepts the returned labels, while LDPKiT post-processes \({\mathcal{D}_{\rm protected}}\) into a larger \({\mathcal{D}_{\rm infer}}\), queries \({\mathcal{M}_{\rm R}}\) for labels, and trains \({\mathcal{M}_{\rm L}}\) for local inference on \({\mathcal{D}_{\rm priv}}\). Thus, SIDP has lower query cost, whereas LDPKiT uses additional post-processed queries to recover utility.

3.0.0.1 Preliminary Experiments.

Distillation with OOD public data is ineffective (Section 2); hence, users must query \({\mathcal{M}_{\rm R}}\) with in-distribution samples from \({\mathcal{D}_{\rm priv}}\). To protect these samples, LDPKiT applies an \(\epsilon\)-LDP mechanism to obtain \({\mathcal{D}_{\rm protected}}\). However, \({\mathcal{D}_{\rm priv}}\) is often small, and LDP noise degrades utility. LDPKiT therefore augments \({\mathcal{D}_{\rm protected}}\) into a larger inference dataset, \({\mathcal{D}_{\rm infer}}\), while preserving privacy through LDP’s post-processing property. \({\mathcal{D}_{\rm protected}}\) retains sufficient distributional information for distillation, yielding 2–3\(\times\) higher utility than OOD data (Section 2). A natural augmentation strategy is to generate \(n\) perturbed variants of each protected sample, producing \(|{\mathcal{D}_{\rm infer}}| = n \times |{\mathcal{D}_{\rm protected}}|\). Since augmentation operates only on \({\mathcal{D}_{\rm protected}}\), the \(\epsilon\)-LDP guarantee is preserved.

We validate this idea on SVHN using 500 randomly selected private samples, ResNet-152 as \({\mathcal{M}_{\rm R}}\), and ResNet-18 as \({\mathcal{M}_{\rm L}}\). Results are averaged over three runs and three dataset splits. With \(\epsilon=1.5\), SIDP achieves only 14.16% inference accuracy, indicating that \({\mathcal{M}_{\rm R}}\) provides limited but nontrivial information under privacy protection. We then add a layer of random noise 499 times to each protected sample, yielding \(|{\mathcal{D}_{\rm infer}}|=249{,}500\) augmented queries. Distillation on \({\mathcal{D}_{\rm infer}}\) improves \({\mathcal{M}_{\rm L}}\) accuracy to 34.07%, whereas distillation using only the 500 samples in \({\mathcal{D}_{\rm protected}}\) yields near-random accuracy (i.e., 10%). Compared with SIDP, this gives a 20% absolute accuracy improvement without additional privacy loss; a dependent two-sample t-test confirms statistical significance (\(p<0.05\)).

Nevertheless, this naïve random-noise augmentation is limited by the small size of \({\mathcal{D}_{\rm priv}}\) and the undirected nature of the perturbations. We hypothesize that more informative queries lie near decision boundaries in the latent data distribution. Motivated by this, we explore a superimposition-based augmentation strategy that refines post-processed LDP samples and better captures decision boundaries. Under the same setup, this approach improves ResNet-18 accuracy to 45.69%, a further 10% gain over random-noise augmentation.

3.1 LDPKiT’s Data Augmentation Mechanism↩︎

LDPKiT first applies the \(\epsilon\)-LDP mechanism [6] to each private sample in \({\mathcal{D}_{\rm priv}}\) once, producing \({\mathcal{D}_{\rm protected}}\). All subsequent augmentation operates only on \({\mathcal{D}_{\rm protected}}\) and data-independent randomness. We consider two post-processing strategies: LDPKiT-Rand, which adds additional random perturbations to protected samples, and LDPKiT-Sup, which averages pairs of protected samples.

3.1.0.1 Mechanism-level Privacy Guarantee.

Let \(\mathcal{M}({\mathcal{D}_{\rm priv}})\) denote the complete user-side procedure. Each private sample \(d_{\text{priv}_i} \in {\mathcal{D}_{\rm priv}}\) is randomized once by an \(\epsilon\)-LDP mechanism \(\mathcal{A}_{\epsilon}\) to produce \(d_{\text{protected}_i} = \mathcal{A}_{\epsilon}(d_{\text{priv}_i})\), using the Laplace mechanism in Definition 2. The augmented query set \({\mathcal{D}_{\rm infer}}\) is then constructed only from \(\{d_{\text{protected}_i}\}\) using data-independent post-processing, including additional random perturbation (LDPKiT-Rand) or pairwise averaging (LDPKiT-Sup).

For any two private datasets \(D\) and \(D'\) that differ in one record, all protected records except the changed one have the same distribution, while the changed record is protected by \(\mathcal{A}_{\epsilon}\). Since the construction of \({\mathcal{D}_{\rm infer}}\) and the selection of any query set are post-processing of protected records, for any event \(T\) over query sets, \(\Pr[\mathcal{M}(D) \in T] \leq e^{\epsilon} \Pr[\mathcal{M}(D') \in T]\). Thus, the query set \({\mathcal{D}_{\rm infer}}\) preserves record-level \(\epsilon\)-LDP, assuming each private record is randomized once and later augmentations access only protected records and data-independent randomness.

LDPKiT-Rand. We formally describe the augmentation technique: for each \(d_{\text{priv}_i} \in {\mathcal{D}_{\rm priv}}\), we construct an augmented dataset of the form: \(d_{\text{infer}_i} \in {\mathcal{D}_{\rm infer}}= d_{\text{priv}_i} + \mathcal{L}_{i} + \mathcal{L}_{j}\), where \(\mathcal{L}_{i}\) and \(\mathcal{L}_{j}\) are Laplace noise samples drawn independently with the same scale. The first noise layer, \(\mathcal{L}_{i}\), is used to generate the initial privacy-protected dataset: \(d_{\text{protected}_i} = d_{\text{priv}_i} + \mathcal{L}_{i}\), where \(i = 1, 2, \dots, |{\mathcal{D}_{\rm protected}}|\). We then apply the second noise layer, \(\mathcal{L}_{j}\), where \(j = 1, 2, \dots, |{\mathcal{D}_{\rm protected}}| - 1\), as post-processing to create an expanded augmented dataset for querying. While it is theoretically possible to generate an infinite number of such noisy variants per data point, we cap the size of the maximum possible augmented dataset \({\mathcal{D}_{\rm infer}}\) to \(|{\mathcal{D}_{\rm protected}}|\cdot(|{\mathcal{D}_{\rm protected}}| - 1)\) to make it comparable to LDPKiT-Sup below.

LDPKiT-Sup. LDPKiT-Rand introduces unrelated noise that may cause the resulting data to deviate further from the distribution of \({\mathcal{D}_{\rm priv}}\). LDPKiT-Sup is thus proposed as an alternative to better preserve the characteristics of \({\mathcal{D}_{\rm priv}}\). After applying the first layer of \(\epsilon\)-LDP random noise to each data point in \({\mathcal{D}_{\rm priv}}\) to produce \({\mathcal{D}_{\rm protected}}\), we combine pairwise samples of \({\mathcal{D}_{\rm protected}}\) for all pairs by averaging corresponding pixel values. Each augmented inference data point \(d_{\text{infer}_i} \in {\mathcal{D}_{\rm infer}}\) is computed as \(d_{\text{infer}_i} = avg(d_{\text{protected}_i}, d_{\text{protected}_j}) \text{ where } i,j = 1, 2, \dots, |{\mathcal{D}_{\rm protected}}|, i \neq j\). This process results in at most \(|{\mathcal{D}_{\rm protected}}|\cdot(|{\mathcal{D}_{\rm protected}}| - 1)\) permutations in \({\mathcal{D}_{\rm infer}}\). Since averaging is symmetric, pairs \((i,j)\) and \((j,i)\) are identical; in our implementation, we retain these ordered samples to match the experimental query budget of LDPKiT-Rand, but deduplication could reduce the query count without changing the set of unique superimposed images.

The mechanism-level guarantee above also covers structure-aware providers that know the LDPKiT-Sup construction. In particular, when sufficiently many pairwise averages are observed, a provider may recover protected records algebraically: \(d_{\text{protected}_i}=\mathrm{avg}(d_{\text{protected}_i},d_{\text{protected}_j})+\mathrm{avg}(d_{\text{protected}_i},d_{\text{protected}_k})-\mathrm{avg}(d_{\text{protected}_j},d_{\text{protected}_k})\). Such recovery does not violate the formal guarantee: the recovered \(d_{\text{protected}_i} \in {\mathcal{D}_{\rm protected}}\) is already the output of \(\mathcal{A}_{\epsilon}\), and the attack does not recover the private sample \(d_{\text{priv}_i}\) or break the \(\epsilon\)-LDP privacy guarantee.

4 Evaluation↩︎

In this section, we present the evaluation results and address our research questions in Section 1 with empirical analysis.

4.0.0.1 Experimental setup.

We run our experiments on two machines. One has two GPUs, NVIDIA GeForce RTX 3090 and 4090, with 24GB of dedicated memory, and an Intel 12th Gen i7-12700 CPU with 12 cores and 64GB of RAM. The other has two NVIDIA GeForce RTX 4090 GPUs and an AMD Ryzen Threadripper PRO 5955WX CPU with 16 cores and 64GB of RAM. The underlying operating systems are 64-bit Ubuntu 22.04.3 LTS and Ubuntu 24.04 LTS, respectively. We use Python 3.9.7 and PyTorch v2.1.2 with CUDA 12.1.

We evaluate LDPKiT on three diverse datasets: SVHN [12], Fashion-MNIST [13], and PathMNIST from MedMNIST2D [14] for medical imaging in pathology. For ML models, we use ResNet-152 as \({{\mathcal{M}_{\rm R}}}\), and ResNet-18 and MobileNetV2 as \({{\mathcal{M}_{\rm L}}}\). The \({\mathcal{M}_{\rm L}}\) models are initialized with random weights.

To construct \({\mathcal{D}_{\rm priv}}\), we train each \({\mathcal{M}_{\rm R}}\) on a subset of the original data rather than the default training split: 35k samples for Fashion-MNIST, 48,257 for SVHN, and 89,996 for PathMNIST. The remaining data is divided into a candidate pool for \({\mathcal{D}_{\rm priv}}\) and a holdout set, \({\mathcal{D}_{\rm val}}\), used to evaluate \({\mathcal{M}_{\rm L}}\)’s generalizability. The candidate pools contain 25k, 25k, and 10,004 samples for Fashion-MNIST, SVHN, and PathMNIST, respectively, while \({\mathcal{D}_{\rm val}}\) contains 10k, 26,032, and 7,180 samples. To model users with limited private data, we set \(|{\mathcal{D}_{\rm priv}}|=1{,}500\) in Section 4.1, sampled uniformly across classes from the candidate pool. We study the effect of varying \(|{\mathcal{D}_{\rm infer}}|\) and \(|{\mathcal{D}_{\rm priv}}|\) in Section 4.3. All experiments are repeated over three random seeds and subset splits; dependent two-sample t-tests confirm that all reported improvements are statistically significant (\(p<0.05\)).

We report SIDP accuracy using \({\mathcal{M}_{\rm R}}\)’s labels on \({\mathcal{D}_{\rm protected}}\), while LDPKiT accuracy is measured on \({\mathcal{D}_{\rm priv}}\) using \({\mathcal{M}_{\rm L}}\) trained with \({\mathcal{M}_{\rm R}}\)’s labels on \({\mathcal{D}_{\rm infer}}\). Following industry practice [7], [8], we choose \(\epsilon\) values so that SIDP achieves 1.5–3\(\times\) random-guessing accuracy, giving \({\mathcal{M}_{\rm R}}\) minimal but useful signal while maintaining robustness to reconstruction attacks (Section 4.4). We use \(\epsilon \in {2.0,1.5,1.25}\) for SVHN, \({2.0,1.5}\) for Fashion-MNIST, and \({10.0,7.0}\) for PathMNIST, consistently across SIDP, LDPKiT-Rand, and LDPKiT-Sup. Figure 2 shows Fashion-MNIST samples in \({\mathcal{D}_{\rm infer}}\) generated by LDPKiT-Rand and LDPKiT-Sup.

4.1 RQ1: LDPKiT’s Utility Recovery on \({\mathcal{D}_{\rm priv}}\)↩︎

In this section, we evaluate whether LDPKiT improves prediction accuracy on \({\mathcal{D}_{\rm priv}}\) compared to directly using \({\mathcal{M}_{\rm R}}\)’s returned labels on \({\mathcal{D}_{\rm protected}}\) (i.e., SIDP). To simulate a realistic scenario, we set \(|{\mathcal{D}_{\rm priv}}|\) to 1,500, representing a practical amount of private data available to a user. For variable control, we use the full \({\mathcal{D}_{\rm infer}}\), of size \(|{\mathcal{D}_{\rm protected}}|\cdot(|{\mathcal{D}_{\rm protected}}| - 1)\) for querying \({\mathcal{M}_{\rm R}}\) and training \({\mathcal{M}_{\rm L}}\) to minimize variations from random subset splits.

Without privacy protection, \({\mathcal{M}_{\rm R}}\)’s average accuracies on noise-free \({\mathcal{D}_{\rm priv}}\) of Fashion-MNIST, SVHN, and PathMNIST are 93.33%, 94.73%, and 86.2%, respectively. The accuracies on \({\mathcal{D}_{\rm val}}\) are 93.22%, 96.30% and 81.24%, respectively.

To answer RQ1, we compare the last-epoch accuracies of \({\mathcal{M}_{\rm L}}\) on \({\mathcal{D}_{\rm priv}}\) with \({\mathcal{M}_{\rm R}}\)’s SIDP accuracies on \({\mathcal{D}_{\rm protected}}\) in Figure 3 and Figure 6 (a). Overall, LDPKiT consistently improves accuracy over SIDP. For example, when \(\epsilon=2.0\) on SVHN, ResNet-152’s SIDP accuracy is only 21.07%, while both LDPKiT-Rand and LDPKiT-Sup recover ResNet-18 accuracy to about 85%. However, LDPKiT-Rand provides limited gains in some cases. On Fashion-MNIST, ResNet-18 reaches only 68.52% and 58.07% accuracy at \(\epsilon=2.0\) and \(\epsilon=1.5\), respectively, while MobileNetV2 remains below 60%. On PathMNIST, ResNet-18 also performs poorly, and MobileNetV2 with LDPKiT-Rand can even underperform SIDP. These results suggest that adding arbitrary random noise does not generate sufficiently representative training data. By contrast, LDPKiT-Sup consistently outperforms LDPKiT-Rand. Superimposing noised \({\mathcal{D}_{\rm priv}}\) samples produces more useful \({\mathcal{D}_{\rm infer}}\) than applying random noise. For instance, on Fashion-MNIST with \(\epsilon=2.0\), LDPKiT-Sup raises ResNet-18 accuracy to 81.78%, compared with 28.69% for SIDP and 68.52% for LDPKiT-Rand. On PathMNIST with \(\epsilon=10.0\), LDPKiT-Sup reaches 82.11%, far above SIDP at 28.74% and LDPKiT-Rand at 43.90%. On SVHN, despite SIDP accuracies of only 11.87%–21.07%, LDPKiT-Sup consistently achieves over 80% accuracy with both ResNet-18 and MobileNetV2. These results show that LDPKiT, especially LDPKiT-Sup, effectively recovers much of the utility lost to \(\epsilon\)-LDP noise while maintaining the same per-sample \(\epsilon\)-LDP protection.

4.2 RQ2: Latent Space Analysis↩︎

Section 4.1 shows that LDPKiT improves accuracy on \({\mathcal{D}_{\rm priv}}\) over SIDP, with LDPKiT-Sup consistently outperforming LDPKiT-Rand. We hypothesize that LDPKiT-Sup is more effective because superimposition produces augmented samples that better preserve the target-class structure, yielding more informative data for knowledge transfer. To examine this, we analyze the latent space of \({\mathcal{D}_{\rm infer}}\) by training a VAE on \(\epsilon\)-LDP-noised samples from three randomly selected classes, using \(\epsilon=2.0\) for Fashion-MNIST and SVHN and \(\epsilon=7.0\) for PathMNIST. To obtain separable class clusters, we replace the conventional reconstruction loss with the triplet margin loss. With the trained VAE, we visualize two additional noisy clusters: one generated by LDPKiT-Sup from two target classes and one generated by LDPKiT-Rand from a single class. We then compute the Euclidean distances between these noisy clusters and the original clusters to assess whether LDPKiT-Sup provides a latent-space learning advantage over LDPKiT-Rand.

Figure 4 visualizes the Fashion-MNIST latent space for Classes 0, 2, and 9. The LDPKiT-Sup clusters are generated by superimposing noisy samples from target-class pairs, whereas the LDPKiT-Rand clusters are generated by applying additional random noise to samples from a single class. The plots show that LDPKiT-Sup generally produces samples closer to the target-class regions than LDPKiT-Rand. For example, in Figures 4 (a) and 4 (c), the LDPKiT-Sup clusters lie closer to their corresponding target-class clusters than the LDPKiT-Rand clusters. Similarly, in Figure 4 (b), the LDPKiT-Sup cluster overlaps more with Classes 2 and 9, while the LDPKiT-Rand cluster is less representative, positioned between the clusters of Classes 0, 2, and 9.

Table ¿tbl:tab:fmnist95latent9502995euclidean? reports Euclidean distances between cluster centroids and supports the visual trends. We note, however, that the Euclidean distance between centroids is not always an ideal measure of similarity between clusters. For example, in Figure 4 (b), LDPKiT-Sup visually overlaps more with Class 9, but because it combines samples from both Classes 2 and 9, its distribution is more dispersed; consequently, the LDPKiT-Rand centroid can appear slightly closer to the Class 9 centroid despite being less representative overall.

To better understand the latent-space representations, we compute Kullback-Leibler (KL) divergence [15]. Let \(C_T\) denote the target triplet cluster, \(C_S\) the LDPKiT-Sup cluster generated from superimposed target-class pairs, and \(C_R\) the LDPKiT-Rand cluster generated from noisy samples of the same triplet classes, with \(C_S\) and \(C_R\) matched in size. We define the Divergence Ratio (DR) as \[\text{DR}(\bar{C}_R, \bar{C}_S) = \frac{D_{\text{KL}}(\bar{C}_T \,\|\, \bar{C}_R)}{D_{\text{KL}}(\bar{C}_T \,\|\, \bar{C}_S)},\] where \(\bar{C}_T\), \(\bar{C}_S\), and \(\bar{C}_R\) are normalized distributions. \(\text{DR}>1\) indicates that LDPKiT-Sup is closer to the target triplet distribution than LDPKiT-Rand.

Across 130 triplets from SVHN, Fashion-MNIST, and PathMNIST, LDPKiT-Sup achieves lower KL divergence than LDPKiT-Rand in 68.56% of cases. This supports our hypothesis that LDPKiT-Sup more often preserves the target latent distribution, consistent with its stronger accuracy in Section 4.1. However, KL divergence does not fully explain accuracy gains, and a more complete statistical characterization remains future work.

4.3 RQ3: Impact of \(|{\mathcal{D}_{\rm infer}}|\) and \(|{\mathcal{D}_{\rm priv}}|\)↩︎

We analyze the trade-off among privacy exposure (\(|{\mathcal{D}_{\rm priv}}|\)), query cost (\(|{\mathcal{D}_{\rm infer}}|\)), and accuracy by varying the number of private samples used for augmentation and the number of generated queries used to train \({\mathcal{M}_{\rm L}}\). As shown in Table ¿tbl:tab:sensitivity?, we construct multiple \({\mathcal{D}_{\rm infer}}\) datasets from \({\mathcal{D}_{\rm priv}}\) at different scales. For example, when \(|{\mathcal{D}_{\rm priv}}|=125\), the maximum \(|{\mathcal{D}_{\rm infer}}|\) is 15,500, computed as \(|{\mathcal{D}_{\rm protected}}|\cdot(|{\mathcal{D}_{\rm protected}}|-1)\). When \(|{\mathcal{D}_{\rm priv}}|=250\), \(|{\mathcal{D}_{\rm infer}}|\) can either remain 15,500 through random selection or increase to a maximum of 62,250. To isolate the effect of \(|{\mathcal{D}_{\rm priv}}|\), we fix \(|{\mathcal{D}_{\rm infer}}|\) and compare different \(|{\mathcal{D}_{\rm priv}}|\) values; to isolate the effect of \(|{\mathcal{D}_{\rm infer}}|\), we fix \(|{\mathcal{D}_{\rm priv}}|\) and vary \(|{\mathcal{D}_{\rm infer}}|\). We exhaustively evaluate these settings for \(|{\mathcal{D}_{\rm priv}}|\) from 125 to 1.5k and report ResNet-18 (\({\mathcal{M}_{\rm L}}\)) accuracies.

The results show that LDPKiT is relatively insensitive to \(|{\mathcal{D}_{\rm priv}}|\), indicating that users can achieve similar utility with fewer private samples and therefore lower privacy exposure. For example, on Fashion-MNIST with \(\epsilon=2.0\), when \(|{\mathcal{D}_{\rm infer}}|=15{,}500\), the maximum accuracy gap across different \(|{\mathcal{D}_{\rm priv}}|\) settings is below 5%; when \(|{\mathcal{D}_{\rm infer}}|=500k\), the gap is only about 0.69%. Thus, with a reasonable \(|{\mathcal{D}_{\rm infer}}|\), users can generate effective queries from a smaller \({\mathcal{D}_{\rm priv}}\). One exception occurs when \(|{\mathcal{D}_{\rm infer}}|=250k\), where increasing \(|{\mathcal{D}_{\rm priv}}|\) improves accuracy, likely because more private samples increase the chance of generating representative and diverse training data.

In contrast, \(|{\mathcal{D}_{\rm infer}}|\) has a stronger impact on accuracy because it directly determines the amount of training data and query cost. Although \(|{\mathcal{D}_{\rm priv}}|\) constrains the maximum feasible \(|{\mathcal{D}_{\rm infer}}|\), sufficient \({\mathcal{D}_{\rm infer}}\) is crucial for effective training. For example, on PathMNIST with \(\epsilon=10.0\) and \(|{\mathcal{D}_{\rm priv}}|=1.5k\), LDPKiT-Rand improves from 23.56% accuracy at \(|{\mathcal{D}_{\rm infer}}|=15{,}500\) to 54.39% at \(|{\mathcal{D}_{\rm infer}}|=500k\), while LDPKiT-Sup improves from 42.99% to 76.79%. Conversely, on SVHN, \({\mathcal{M}_{\rm L}}\) remains near 10% accuracy when \(|{\mathcal{D}_{\rm infer}}|=15{,}500\), regardless of \(|{\mathcal{D}_{\rm priv}}|\).

Figure 5 and Figure 6 (b) further illustrate the effect of \(|{\mathcal{D}_{\rm infer}}|\) under a fixed \(|{\mathcal{D}_{\rm priv}}|=1.5k\). LDPKiT-Sup requires a sufficiently large \({\mathcal{D}_{\rm infer}}\) to achieve adequate accuracy, such as 250k for PathMNIST and 500k for Fashion-MNIST and SVHN. Increasing \(|{\mathcal{D}_{\rm infer}}|\) improves accuracy, but the gains diminish beyond 500k. For instance, on Fashion-MNIST with \(\epsilon=2.0\), ResNet-18 achieves 74.35%, 78.88%, and 81.78% accuracy when \(|{\mathcal{D}_{\rm infer}}|\) is 500k, 1M, and 2.2M, respectively. Thus, querying all possible \({\mathcal{D}_{\rm infer}}\) points is unnecessary; LDPKiT-Sup can achieve satisfactory accuracy using only about 20% of \({\mathcal{D}_{\rm infer}}\).

To estimate the API query cost, we use OpenAI’s listed GPT-5 nano pricing as of May 2026 ($0.05 per 1M input tokens and $0.40 per 1M output tokens) [16] and OpenAI’s image-token accounting rules for patch-based image inputs (\(2.46\) input tokens per image) [17]. Assuming a one-token class-label output, each query costs about \(5.23 \times 10^{-7}\) USD, so \(2.2\)M queries cost about $1.15 under a lower-bound estimate, or $3.35 with a minimal 20-token text prompt. Rate limits, latency, batching, and API policies remain practical constraints.

Finally, the \({\mathcal{D}_{\rm infer}}\) subsets used in these experiments are randomly selected, and there is currently no universal lower bound on \(|{\mathcal{D}_{\rm priv}}|\) that guarantees reliable performance because the required size depends on the task, \({\mathcal{M}_{\rm R}}\) complexity, LDP noise level, and the diversity of \({\mathcal{D}_{\rm priv}}\). In practice, users can perform small-scale pilot runs by gradually increasing \(|{\mathcal{D}_{\rm infer}}|\) and monitoring accuracy trends, while systematic estimation of practical \(|{\mathcal{D}_{\rm priv}}|\) thresholds remains future work.

4.4 Evaluation of Data Reconstruction Risks↩︎

To rigorously evaluate whether the amount of LDP noise added to each private image is sufficient, we audit the privacy guarantees of LDPKiT following the methodology of [9]. Specifically, we conduct data reconstruction attacks using a DDPM trained to model the image prior (i.e., trained on the original images). Our experiment spans three datasets: SVHN, Fashion-MNIST, and PathMNIST. For each dataset, we randomly select a subset of 1,000 images (900 for PathMNIST) processed with LDPKiT-Sup, and quantitatively measure reconstruction success with standard image-similarity metrics: MSE, VGG-based LPIPS, and SSIM. We report results in Table ¿tbl:tab:full95denoising95metrics?. Our measurements show that the reconstructed images are generally more dissimilar from the original images after reconstruction (i.e., lower SSIM and higher MSE). We did not observe successful reconstructions under our evaluated attack setting. We also show that a fully trained classifier (ResNet-152) shows near-random accuracy on the reconstructed images.

5 Related work↩︎

5.0.0.1 Knowledge transfer techniques.

Knowledge distillation is a knowledge transfer technique that distills a large teacher model into a smaller student model while preserving model performance [18], [19]. The conventional use case is model compression, enabling deployment in a resource-restricted environment. Knowledge can be transferred in different forms [19], and such techniques can also be used adversarially. Model extraction is an adversarial setting in which the attacker reproduces a model stealthily by stealing its parameters, decision boundaries, or functionalities. It demonstrates that an iterative query-based knowledge transfer process from a high-performance model can be performed via a prediction query interface [20]–[22]. Model extraction can be challenging without knowledge of the victim model’s training data distribution [23]. Successful model extractions with partial or zero knowledge of the victim model and training data [23], [24] may require more information than hard labels. Related defenses [25]–[27] are in active research. Rather than model compression or adversarial extraction for the purpose of theft, we adopt query-based knowledge transfer techniques in a non-adversarial setting to recover the utility loss introduced by LDP noise while protecting users’ private data.

5.0.0.2 Noise injection and differential privacy (DP).

DP can be applied either globally [1], [28] or locally [29], both offering provable privacy guarantees. Global DP relies on a trusted curator who accesses raw sensitive data before adding noise to aggregate statistics. To avoid this trust assumption, LDPKiT adopts local DP, where the user perturbs each query before sending it to the ML service. This gives users direct control over privacy protection, but typically reduces utility compared with global DP at the same privacy level [30]. Unlike training-time methods such as DP-SGD [28], LDPKiT protects inputs at inference time. Related split-computation schemes inject noise into intermediate DNN representations [31], but they assume white-box access to a partitioned model.

5.0.0.3 Federated Learning (FL).

FL has emerged as a popular approach to address privacy concerns by enabling collaborative model training without directly sharing users’ raw data with a central server [32], [33]. However, FL primarily protects users’ training data, which is an orthogonal concern to our setting, and it does not mitigate privacy risks during inference. Moreover, FL is vulnerable to gradient inversion attacks that reconstruct local training data from gradient updates, which necessitates extra privacy protection [34]. Finally, FL assumes that users possess labelled local datasets, which is not applicable in our case, where the objective is to annotate unlabelled data. Concerns regarding potential data reconstruction attacks and the integrity of the server imply that relying solely on using shared models from service providers like FL is insufficiently secure and privacy-preserving; therefore, FL is not an ideal solution in our scenario.

5.0.0.4 Others.

Another approach is encrypted inference using homomorphic encryption, but such methods incur high computational overhead [4]. On SVHN, LDPKiT becomes more efficient once the query set reaches roughly 800 samples: full knowledge transfer on 800 samples takes 20.73 seconds, compared with 22.984 seconds for a single Lancelot inference [35] and 484.184 seconds for OpenFHE [36]. Moreover, LDPKiT performs knowledge transfer once, after which inference on data from the same distribution runs locally with negligible overhead. However, encryption-based schemes continue to incur remote per-query costs, leading to higher cumulative overhead for labelling larger datasets. The alternative is hardware-assisted inference using Trusted Execution Environments (TEEs). Slalom protects remote inference by executing computation inside a TEE [5]. However, TEEs still access the original data and remain vulnerable to side-channel attacks [37]. LDPKiT avoids this threat model because it never transmits raw data; any privacy leakage is instead bounded by the LDP mechanism.

6 Limitations↩︎

Our per-record \(\epsilon\)-LDP guarantee is distribution-free and does not rely on an i.i.d. assumption. However, correlations among records may still allow inferences about related records or users and can weaken privacy due to mutual information leakage, so the semantic privacy interpretation is strongest when samples are approximately independent. In practice, many applications use de-duplication to maintain or approximate independence. For example, workflows built on Amazon S3 Inventory, Athena, AWS Lambda, and S3 Batch Operations can identify and remove duplicate objects to reduce storage costs [38]. Similarly, generative AI pipelines commonly de-duplicate LLM training data to improve efficiency and performance while reducing privacy leakage from redundant content [39]–[41].

Currently, LDPKiT only supports the image modality, where superimposition intuitively translates to pixel-level operations. Although textual data does not have a direct counterpart to superimposition, several conceptual approaches can be explored. These include embedding-level averaging, in which two textual embeddings are blended; token-level mixing, which involves interleaving tokens from two samples; and semantic-level merging, such as combining two sentences into a coherent paraphrased summary. Each interpretation may require a distinct adaptation of the LDP scheme. We leave the exploration of these textual superimposition methods as a direction for future research.

We also extended the evaluation of LDPKiT to the ImageNet1K dataset. For reference, the official torchvision ResNet-18 model reports a top-1 accuracy of 69.758% on ImageNet1K [42]. In our evaluation, a randomly selected subset of 15 classes was used. LDPKiT-Sup with ResNet-18 (\({\mathcal{M}_{\rm L}}\)) achieved 63% top-1 accuracy with 15,000 \({\mathcal{D}_{\rm priv}}\) samples at \(\epsilon=5\), whereas the baseline SIDP attained only 19% accuracy under identical conditions. Further enhancing the performance of LDPKiT on larger datasets is left for future work.

7 Conclusion↩︎

LDPKiT introduces a privacy-preserving inference framework for protecting sensitive user data when interacting with remote ML model providers. By injecting LDP noise into inference queries, LDPKiT protects user privacy even when queries are logged, retained, or exposed through later infrastructure compromise. The key contribution of LDPKiT is its integration of LDP with a two-layer augmentation mechanism, LDPKiT-Rand and LDPKiT-Sup, which leverages LDP’s post-processing property to improve utility without weakening privacy. The first layer provides baseline LDP protection, while the second layer generates an augmented dataset for local model distillation. In particular, LDPKiT-Sup uses superimposition-based augmentation to produce samples that better approximate the private data distribution than LDPKiT-Rand’s random-noise strategy. Evaluation results show that LDPKiT-Sup effectively recovers prediction accuracy while preserving privacy, with larger gains under stronger noise levels corresponding to stronger privacy guarantees. Overall, LDPKiT offers a privacy-preserving design aligned with responsible data-use and privacy-by-design principles.

References↩︎