Deep learning models have exhibited remarkable performance across various domains. Nevertheless, the burgeoning model sizes compel edge devices to offload a significant portion of the inference process to the cloud. While this practice offers numerous advantages, it also raises critical concerns regarding user data privacy. In scenarios where the cloud server's trustworthiness is in question, the need for a practical and adaptable method to safeguard data privacy becomes imperative. In this paper, we introduce Ensembler, an extensible framework designed to substantially increase the difficulty of conducting model inversion attacks for adversarial parties. Ensembler leverages model ensembling on the adversarial server, running in parallel with existing approaches that introduce perturbations to sensitive data during colloborative inference. Our experiments demonstrate that when combined with even basic Gaussian noise, Ensembler can effectively shield images from reconstruction attacks, achieving recognition levels that fall below human performance in some strict settings, significantly outperforming baseline methods lacking the Ensembler framework.

翻译：深度学习模型已在各个领域展现出卓越性能。然而，日益增长的模型规模迫使边缘设备将大部分推理过程卸载至云端。这种做法虽带来诸多优势，却也引发了用户数据隐私的关键性担忧。在云服务器可信度存疑的场景下，亟需一种实用且可扩展的方法来保护数据隐私。本文提出Ensembler框架，这是一个通过对抗服务器上模型集成技术显著提升攻击方实施模型逆向攻击难度的可扩展框架。该框架可与现有协作推理中向敏感数据添加扰动的方案并行运行。实验表明，即使结合基础高斯噪声，Ensembler也能有效抵御图像重构攻击，在部分严格设定下其识别率甚至低于人类水平，显著优于未采用Ensembler框架的基准方法。