Jul 2026· International Conference on Computer, Information and Telecommunication Systems· pp. 1-8· 0 citations· 45 references
Abstract
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
This paper presents a systematic framework for membership inference attacks, in which an adversary with only black-box query access to a deployed classifier determines whether a specific individual's record was part of its training set.
Pramod Prakash· International Journal of Int...· 0 citations
Metric Differential Privacy (mDP) extends classical differential privacy (DP) by replacing Hamming adjacency with application-aware distance metrics, which offers utility-preserving protection for structured and continuous data including locations, trajectories, images, and text embeddings. This Systematization of Knowledge (SoK) paper synthesizes a decade of progress (2013-2025), clarifying mDP's foundations and its connections to central and local DP, and surveying three principal mDP mechanism families: homogeneous distance mechanisms, non-homogeneous distance mechanisms, and optimized perturbation mechanisms. We organize applications across geo-location privacy, text and embeddings, image and voice protection, graphs and network telemetry, and federated/edge settings. We also surface open challenges, including robust composition and adversarial modeling, context-adaptive privacy, high-dimensional scalability, and principled geometry-aware trade-off bounds, and distill practical guidance for selecting metrics, mechanisms, and metrics of utility. The goal is a unified reference and roadmap for deploying scalable, utility-preserving metric privacy in real-world systems.
Xinpeng Xie, Chenyang Yu, Yan Huang et al.· Proceedings on Privacy Enhan...· 0 citations
High-quality data are essential for machine learning and data-driven research, yet data scarcity and privacy concerns remain major obstacles in many domains. Generative models have recently emerged as a promising approach to synthesize data that follow the same statistical distribution as real datasets. However, generative models are vulnerable to membership inference attacks, which threaten data confidentiality by exploiting model outputs to infer whether specific samples were used in training. Existing defense strategies struggle to simultaneously preserve data utility and provide robust privacy protection. To address this challenge, we propose our PPGM-GAN, a Privacy-Preserving GAN for synthetic data against membership inference attack to balance both data utility and data privacy. PPGM-GAN balances privacy and utility through a privacy-utility tradeoff function that quantifies and optimizes both aspects under different adversarial knowledge. To enhance data utility, we incorporate conditional generation and key-attribute screening to ensure sufficient representation of infrequent attribute values. Additionally, differential privacy is employed during training to prevent overfitting and reduce privacy leakage. Experimental results demonstrate that PPGM-GAN outperforms state-of-the-art privacy-preserving generative models, producing high-utility synthetic data under the same privacy constraints.
Guizhang Cui, Guowei Wu, Lin Yao et al.· ACM Transactions on Privacy...· 0 citations
ProxyDrift is presented, a framework that identifies and measures drift between production traffic and offline evaluation sets, and constructs and refreshes those evaluation sets accordingly; all without access to raw user data.
Michael Levit, Josh Ledgard, Haoyu Dong et al.· 0 citations
As medical records are shared for research and treatment, the same anonymization techniques are used for all, but the risks are exacerbated by the fact that the records are being shared with others. This paper proposes a user-aware deep learning anonymization framework to adjust privacy strength according to the recipient attributes (such as the role, purpose, trust level). It combines conditional generative adversarial networks with differential privacy, with the privacy budget allocated to a user, ε, being tighter for low-trust requesters, and looser for clinicians, where ε ∈ {0.1, 1.0, 5.0}. The proposed approach performs well downstream in terms of the F1 score (0.89) of high-trust users, and exhibits membership inference AUC of 0.52 just above random guessing on the MIMIC-IV data. The accuracy of attribute inference for low-trust users is also low (still less than 0.55) for sensitive diagnoses, leading to improved performance over fixed-DP GAN, AnomiGAN, and PRIMIS. A user encoder is able to decrease mutual information between embeddings and raw patient data from 0.42 to 0.07 during training. In conclusion, the results show that user-adaptive anonymization maintains clinically meaningful utility for legitimate use while ensuring strong protection against re-identification attempts, thereby filling a crucial gap in the field of privacy-preserving medical data sharing.
Lingam Suman, S. Venkata Lakshmi· 2026 6th International Confe...· 0 citations
Ball-DP is proposed: enforcing epsilon-delta indistinguishability over single-record substitutions restricted to a ball of radius r under a distance metric d in the embedding space so that a deployment facing only local reconstruction threats can choose a small r, thereby reducing noise and recovering accuracy.
