In collaborative inference (CI), transmitting intermediate representations $Z$ from edge devices enables model inversion attacks (MIA) that reconstruct the original inputs $X$, while existing defenses mainly perturb shallow-layer $Z$ at the cost of utility. We instead ask where an edge-cloud model should be partitioned to obtain intrinsic resistance to MIA. We challenge the intuition that depth is the driver of MIA resistance, and show that depth is sufficient only insofar as it enables a representational transition; this transition is necessary for intrinsic resistance and is marked by an abrupt rise in the lower bound of $H(X|Z)$. Correspondingly, the decisive variance term in the entropy bound shifts from a global variance to the intra-class mean-squared radius $R_c^2$ rather than dimensionality alone, yielding an $R_c^2$-based criterion to locate the transition zone, or identify it post hoc from MIA outcomes, which we term the Golden Partition Zone (GPZ). We further explain how $R_c^2$ evolves during training and show that it can be controlled through the label distribution; we refer to this controllable dynamic behavior as the Neural Vortex, an analysis-backed explanatory concept. Across four representative deep vision models, partitioning at the GPZ yields more than 4x higher reconstruction MSE compared to shallow splits; under entropy and inversion-model enhancements, decision-level representations provide 66 percent stronger resistance than feature-level ones, and we further observe that data type affects both the transition boundary and reconstruction.

翻译：在协同推理（CI）中，从边缘设备传输中间表示$Z$使得模型反演攻击（MIA）能够重建原始输入$X$，而现有防御手段主要扰动浅层$Z$，但以牺牲效用为代价。我们转而探究应如何划分边缘-云端模型以获得对MIA的内在抵抗性。我们挑战了“深度是驱动MIA抵抗性的关键”这一直觉，表明深度仅在实现表示转换时才足够；该转换是内在抵抗性的必要条件，并以$H(X|Z)$下界的突然上升为标志。相应地，熵界中的决定性方差项从全局方差转变为基于类内均方半径$R_c^2$（而非仅维度），从而得出以$R_c^2$为判据来定位转换区间的准则，或事后从MIA结果中识别该区间，我们称之为黄金划分区间（GPZ）。我们进一步解释了$R_c^2$在训练过程中的演化规律，并表明可通过标签分布来调控它；我们将这一可控的动态行为称为神经涡旋，这是一个基于分析的说明性概念。在四个代表性深度视觉模型中，在GPZ处划分相比浅层划分可产生超过4倍的重建均方误差；在熵和反演模型增强条件下，决策级表示相比特征级表示提供66%更强的抵抗性，且我们进一步观察到数据类型同时影响转换边界和重建效果。