RobPI: Robust Private Inference against Malicious Client

Jiaqi Xue; Mengxin Zheng; Qian Lou

cs.CRFeb 23, 2026

RobPI: Robust Private Inference against Malicious Client

Authors: Jiaqi Xue, Mengxin Zheng, Qian Lou

Organizations: University of Central Florida

Abstract

The increased deployment of machine learning inference in various applications has sparked privacy concerns. In response, private inference (PI) protocols have been created to allow parties to perform inference without revealing their sensitive data. Despite recent advances in the efficiency of PI, most current methods assume a semi-honest threat model where the data owner is honest and adheres to the protocol. However, in reality, data owners can have different motivations and act in unpredictable ways, making this assumption unrealistic. To demonstrate how a malicious client can compromise the semi-honest model, we first designed an inference manipulation attack against a range of state-of-the-art private inference protocols. This attack allows a malicious client to modify the model output with 3x to 8x fewer queries than current black-box attacks. Motivated by the attacks, we proposed and implemented RobPI, a robust and resilient private inference protocol that withstands malicious clients. RobPI integrates a distinctive cryptographic protocol that bolsters security by weaving encryption-compatible noise into the logits and features of private inference, thereby efficiently warding off malicious-client attacks. Our extensive experiments on various neural networks and datasets show that RobPI achieves ~91.9% attack success rate reduction and increases more than 10x the number of queries required by malicious-client attacks.

Figures & tables

Fig. 1: Client may be malicious in private inference.

	vulnerable to adversarial examples	requires network modification
LoLa	●	●
CryptoNets	●	●
CryptoDL	●	●
CHET	●	●
HEMET	●	●
TenSEAL	●	●

TABLE I: Prior private inferences are vulnerable to malicious-client adversarial examples and need network modification for higher robustness.

Fig. 2: (a) PI-Attack use case on the privacy-preserving face recognition system. (b) Our RobPI enables a fast, accurate, and robust PI.

Fig. 4: (a) Disturbance success probability S(x, t) for one query. (b) incorrect prediction rate

P(i\neq j)

, which means the probability of misclassification after adding noise on the confidence scores. (c) distribution of the difference between the highest predicted score

M_{p}^{i}

and the second highest predicted score

M_{p}^{j}

Schemes	CIFAR-10						Diabetic Retinopathy
	Average Queries		Average $\ell_{2}$		Success Rate		Average Queries		Average $\ell_{2}$		Success Rate
	Untar.	Target	Untar.	Target	Untar.	Target	Untar.	Target	Untar.	Target	Untar.	Target
Square	$100.1$	$301.6$	$4.21$	$5.44$	$85.64\%$	$71.56\%$	$50.0$	$99.1$	$1.47$	$1.18$	$64.32\%$	$64.14\%$
SimBA-DCT	$101.6$	$302.4$	$2.86$	$4.81$	$78.28\%$	$73.98\%$	$51.8$	$101.0$	$0.82$	$0.92$	$73.28\%$	$51.49\%$
PI-Attack	$103.4$	$299.4$	$2.79$	$4.09$	$81.33\%$	$81.48\%$	$50.5$	$102.5$	$0.84$	$0.87$	$84.36\%$	$63.28\%$
+Schedule	$99.8$	$201.5$	$3.61$	$4.87$	$\mathbf{94.38}\%$	$\mathbf{94.22}\%$	$50.4$	$98.5$	$1.15$	$1.31$	$\mathbf{89.92}\%$	$\mathbf{76.48}\%$

TABLE II: The attack comparisons of PI-Attack and prior works, e.g, SimBA-DCT [ 25 ] and Square attack [ 26 ] on CIFAR-10 and medical dataset. Untar., Target means untarget and target attacks, respectively.

Schemes

CIFAR-10

Diabetic Retinopathy

Clean Accuracy

Average queries

Success Rate

Clean Accuracy

Average queries

Success Rate

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

RND

72.86\%

199.8

301.1

2.03\%

39.22\%

66.81\%

48.5

53.1

15.00\%

46.40\%

RND-GF

73.71\%

204.2

300.4

10.39\%

56.33\%

67.73\%

50.2

49.3

10.08\%

59.60\%

67.88\%

199.5

302.5

49.08\%

86.20\%

61.37\%

50.0

51.3

37.36\%

79.05\%

RobPI

74.10\%

198.2

299.1

56.17\%

88.04\%

67.91\%

51.7

50.1

49.77\%

74.14\%

TABLE III: The defense comparisons of RobPI and prior works, e.g, RND [ 40 ] , RND-GF [ 40 ] and Adversarial Training(AT) [ 48 ] , on CIFAR-10 and medical dataset. ’+Input noise’, and ’+DNT’ represent adding Gaussian noise into the input layer and using an additional DNT method, respectively, on RobPI.

Fig. 5: Attack success rate (ASR) of different methods.

Fig. 6: Defense success rate (DSR) of different methods.

Fig. 7: RobPI achieves a higher probability of disturbance success probability (DSP) than prior work RND.

Fig. 8: RobPI achieves a better balance between defense effect and clean accuracy than RND-GF.

N_{q}

CIFAR-10

Diabetic Retinopathy

Clean Accuracy

Average Queries

Defense Success Rate

Clean Accuracy

Average Queries

Defense Success Rate

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

1

74.55\%

199.4

299.7

63.36\%

91.88\%

68.09\%

48.9

52.0

66.41\%

88.67\%

2

74.55\%

200

302

62.19\%

86.99\%

68.09\%

49.5

51.5

\mathbf{58.53\%}

\mathbf{71.85\%}

3

74.55\%

199.6

299.3

59.08\%

\mathbf{83.52\%}

68.09\%

48.3

49.3

60.88\%

79.01\%

4

74.55\%

200

300

\mathbf{54.76\%}

87.31\%

68.09\%

50.5

49

69.09\%

85.96\%

TABLE IV: The attack performance under different query numbers of Average PI-Attack.

Schemes

CIFAR-10

Diabetic Retinopathy

Clean Accuracy

Average Queries

Defense Success Rate

Clean Accuracy

Average Queries

Defense Success Rate

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

Untar.

Target

RobPI

74.55\%

200

299.3

54.76\%

83.52\%

68.09\%

49.5

51.5

58.53\%

71.85\%

\mu=3

74.53\%

200

300

64.19\%

90.74\%

68.16\%

50.5

50.5

64.96\%

86.75\%

Penultimate layer

70.83\%

201

300.6

59.92\%

85.77\%

66.89\%

50.5

49

61.56\%

77.30\%

TABLE V: The defense performance against Average PI-Attack using two proposed methods.

Fig. 9: The 64 Basis Functions of an 8-by-8 Image.

Fig. 10: defense results on MNIST.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Code-Poisoning Property Inference Attacks
Jul 17, 2026Xukun Luan, Yuhui Gong, Gang Zhang +4Adversarial Attacks
School of Computer Science and Technology, Beijing Institute of Technology · School of Computer Science and Engineering, Northeastern University
ReproMIA: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attacks
Mar 30, 2026Chihan Huang, Huaijin Wang, Shuai WangMembership Inference Attacks Privacy Leakage in Language Models
HKUST, Hong Kong, China
Your Inference Request Will Become a Black Box: Confidential Inference for Cloud-based Large Language Models
Feb 27, 2026Chung-ju Huang, Huiqiang Zhao, Yuanpeng He +5Privacy-Preserving Language Models Privacy Leakage in Language Models
Key Lab of High Confidence Software Technologies (Peking University), Ministry of Education, China · School of Computer Science, Peking University, Beijing, China · Tencent, Shenzhen, China +1

Jul 17, 2026J/K move · Enter open · S save

Code-Poisoning Property Inference Attacks

Xukun Luan, Yuhui Gong, Gang Zhang, Zixuan Huang+3

School of Computer Science and Technology, Beijing Institute of Technology · School of Computer Science and Engineering, Northeastern University

Adversarial Attacks

Open paper AskPDF arXiv

The flourishing code hosting platforms and coding agents enable even beginners with private data to build tailored Machine Learning (ML) models using available code quickly. The training data for ML models, often regarded as private property (e.g., clinical records, transaction information), is at significant risk of information leakage. Property Inference Attacks (PIAs), as a significant type of privacy attack, aim to expose global property information of the training set. In this paper, we present Code-Poisoning Property Inference Attack (CPPIA), the first code-level PIA, which overcomes four limitations of existing works: insufficient attack performance, severe degradation of model accuracy, high computational overhead, and failure under defenses. We consider malicious code providers from code hosting platforms (GitHub) and coding agents (Codex). Upon downloading the poisoned code, data holders train models with their private data without professional auditing, subsequently releasing label-only APIs to the public. The adversary embeds the properties into secret samples during training and queries the trained model on these samples later to leak privacy. CPPIA offers 100% attack accuracy without degrading model accuracy. It is also computationally lightweight and requires no shadow models. We evaluate the attack performance across four datasets, eight model architectures, eighteen properties, and under three defense mechanisms, demonstrating the universality and effectiveness of CPPIA.

Abstract

Privacy-Preserving ML

Explore similar work

Code-Poisoning Property Inference Attacks

ReproMIA: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attacks

Your Inference Request Will Become a Black Box: Confidential Inference for Cloud-based Large Language Models