From Pixels to Privacy-Sensitive Features: An Information-Theoretic Framework for Reconstruction Bounds
The paper gives a pre-training way to lower-bound how much reconstruction error any DP-SGD attack must face.
Bourne and Allison frame reconstruction risk through conditional mutual information and source entropy, then use rate-distortion theory to bound expected attack error. The bound can target chosen representations, including pixel space and LPIPS feature space. It is designed for a strong adversary that can see the training trajectory and knows all other records plus the population distribution. On image datasets, the authors report non-trivial unavoidable reconstruction error across recommended privacy-budget ranges and beyond. ArXiv · AI/CL/LG's note
Bourne and Allison frame reconstruction risk through conditional mutual information and source entropy, then use rate-distortion theory to bound expected attack error. The bound can target chosen representations, including pixel space and LPIPS feature space. It is designed for a strong adversary that can see the training trajectory and knows all other records plus the population distribution. On image datasets, the authors report non-trivial unavoidable reconstruction error across recommended privacy-budget ranges and beyond. ArXiv · AI/CL/LG's note
score 5