Local Differential Privacy (LDP) is the gold standard trust model for privacy-preserving machine learning by guaranteeing privacy at the data source. However, its application to image data has long been considered impractical due to the high dimensionality of pixel space. Canonical LDP mechanisms are designed for low-dimensional data, resulting in severe utility degradation when applied to high-dimensional pixel spaces. This paper demonstrates that this utility loss is not inherent to LDP, but from its application to an inappropriate data representation. We introduce LDP-Slicing, a lightweight, training-free framework that resolves this domain mismatch. Our key insight is to decompose pixel values into a sequence of binary bit-planes. This transformation allows us to apply the LDP mechanism directly to the bit-level representation. To further strengthen privacy and preserve utility, we integrate a perceptual obfuscation module that mitigates human-perceivable leakage and an optimization-based privacy budget allocation strategy. This pipeline satisfies rigorous pixel-level ε-LDP while producing images that retain high utility for downstream tasks. Extensive experiments on face recognition and image classification demonstrate that LDP-Slicing outperforms existing DP/LDP baselines under comparable privacy budgets, with negligible computational overhead.
Figures & tables
Figure 1: The LDP-Slicing framework. Our method consists of two primary stages: (1) Perceptual obfuscation: the input image is transformed into the frequency domain via DWT, where the low-frequency (LL) band is pruned to remove human-perceptible information. (2) Bit-plane randomization: The obfuscated image is decomposed into binary bit-planes. A utility-aware randomized response mechanism is applied to each bit and enforces a strict ε -Local Differential Privacy guarantee before the final image is reconstructed.
Figure 2: Bit-plane slicing reveals the non-uniform distribution of structural information. An 8-bit image (left) is decomposed into its planes ( right ), from LSB (top-left) to MSB (bottom-right). This visualization shows that coarse structural information is concentrated in the high-order MSB planes, while low-order LSB planes consist primarily of noise-like texture. This motivates our non-uniform, utility-aware budget optimization strategy.
Figure 3: Visual justification for channel-aware allocation and perceptual obfuscation. This figure shows an original image (a) and its YCbCr components before and after LL-pruning. It validates two key decisions: (1) Channel Importance: The luma (Y) channel (b) contains the most structural information compared to the chroma channels (c,d). (2) Post-Pruning Signal: After LL-pruning (e), the resulting image (e) is perceptually obfuscated for human viewers. The Y-channel’s MSB (f) still retains significant high-frequency detail for machine learning, unlike the less informative chroma MSBs (g,h).
Method
DP/LDP Guarantee
AgeDB-30
LFW
CPLFW
CALFW
ArcFace
None
97.88
99.77
92.77
96.05
InstaHide
None
79.58
96.53
81.03
86.24
Cloak
None
92.60
98.91
83.43
92.18
PPFR-FD
None
97.23
99.69
90.19
95.60
DuetFace
None
97.93
99.82
92.77
96.10
PartialFace
None
97.79
99.80
92.03
96.07
Table 1: Benchmarks on face recognition accuracy (%). LDP-Slicing is compared with a non-private baseline, heuristic methods, and methods with formal privacy guarantees. Bold indicates the best result among DP/LDP methods.
Figure 5: Resilience to a white-box reconstruction attack. The adversary has full knowledge of our pipeline and trains a specialized two-stage inversion model. From top to bottom εtotal=5.2 , εtotal=20 , εtotal=58 (a) The original images. (b) original images after LL removed. (c) LDP-Slicing privatized images. (d) LL recovered images. (e) Final recovered images.
Figure 6: Resilience to black-box reconstruction attack. (a) The original images. Recovered LDP-Slicing image from (b) εtotal=5.2 , (c) εtotal=20 , and (d) εtotal=58 . (e) Recovered DCTDP image ( εmean=0.5 ).
Figure 7: Privacy-utility trade-off on privacy-preserving image classification. LDP-Slicing is compared against the strong centralized DP-SGD model [ 1 ] . On both CIFAR-10 (a) and CIFAR-100 (b) , our local model demonstrates a clear and growing advantage as the budget moves into a more practical range, comparing with the centralized trusted-curator model.
Figure 8: Visual comparison on Map2 V [ 51 ] reconstruction attack on PPFR SOTAs. Red squares highlight reconstructions that leak facial features. (a) Target images. (b) Reconstruction from DCTDP [ 23 ] . (c) Reconstruction from DuetFace [ 32 ] . (d) Reconstruction from PartialFace [ 33 ] . (e) Reconstruction from LDP-Slicing (ours).
Method
CIFAR10
CIFAR100
AgeDB-30
LFW
CALFW
CPLFW
PartialFace [ 33 ]
3.55
4.34
0.43
16.28
9.0
6.18
DuetFace [ 32 ]
5.07
7.14
6.97
19.75
12.98
8.89
DCTDP [ 23 ]
4.97
5.98
5.65
12.58
10.92
10.36
LDP-Slicing (Ours)
0.25
0.1
0.42
4.5
3.87
1.62
Table 2: Identity distinguishing attack advantage (%). The table shows the adversary’s advantage rate in Definition 1 . A lower advantage indicates a stronger protection.
Table 3: Ablation study of key components of LDP-Slicing . Results show face recognition accuracy (%) on four benchmarks, with a fixed privacy budget of εtotal=20 . Each ablative variant modifies a single component of our full method (D): (A) without LL pruning, (B) with uniform privacy budget, and (C) DCT-based DC pruning with full utility-aware optimization.
Privacy Budget
AgeDB-30
LFW
CPLFW
CALFW
PSNRavg
εtotal=1
50.95
52.88
51.45
52.31
6.90 dB
εtotal=2.4
54.12
53.62
51.85
53.83
6.91 dB
εtotal=5.2
68.89
89.31
71.30
79.15
6.94 dB
εtotal=12
93.70
99.30
88.70
95.33
7.30 dB
εtotal=20
96.68
99.75
91.08
96.02
7.62 dB
εtotal=32
96.46
99.77
91.93
96.04
8.51 dB
Table 4: Privacy-utility trade-off on face recognition accuracy (%) . As the privacy budget εtotal decreases, utility across all benchmarks declines smoothly, aligning with theoretical expectations. PSNR values also correlate with the applied privacy budget.
Method
Ours
[ 34 ]
[ 47 ]
[ 33 ]
[ 46 ]
[ 32 ]
[ 23 ]
Storage ↓
×1
×1
×5.3
×9
×36
×54
×63
Table 5: Storage and transmission overhead analysis. Overhead is reported as a multiple of the size of a standard image (our method, ×1 ). Lower is better. LDP-Slicing introduces zero overhead.
Figure 9: Qualitative comparison against other SOTAs. We compare LDP-Slicing (i) against (b) PPFR-FD [ 46 ] , (c) DuetFace [ 32 ] , (d) PartialFace [ 33 ] , (e) ProFace [ 50 ] , (f) AdvFace [ 47 ] , (g) MinusFace [ 34 ] , and DCTDP [ 23 ] . DCTDP and LDP-Slicing achieve a higher level of perceptual obfuscation.
Dataset
ε =1
ε =2.4
ε =5.2
ε =12
ε =20
ε =32
ε =58
Chest X-Ray [ 25 ]
76.60
88.94
90.54
91.99
92.15
92.95
93.43
VGGFace2 [ 5 ]
48.95
50.31
51.71
66.69
67.15
68.99
70.64
CelebA [ 30 ]
49.88
50.97
50.84
75.90
80.44
82.68
84.89
Table 6: Privacy-utility trade-off (%). We perform additional experiment on another 3 benchmarks
Color W.
CIFAR10
CIFAR100
AgeDB
LFW
CALFW
CPLFW
4:1:1 (Ours)
80.36
53.55
96.68
99.75
96.02
91.08
2:1:1
78.44
50.63
95.85
99.63
95.68
90.87
1:1:1
74.92
45.16
94.68
99.47
94.17
89.85
Table 7: Utility under different color weight (%).
While Local Differential Privacy (LDP) serves as a foundational primitive for distributed data collection, its stringent randomization requirements often lead to severe degradation in data representation utility. This degradation stems from the task-agnostic nature of conventional LDP mechanisms, which perturb all dimensions without accounting for their relative importance to the downstream objective. To address this issue, we propose a novel approach that mitigates noise in task-relevant subspaces of the data representation. Our method identifies task-critical subspaces via the Jacobian of a public downstream model, selectively attenuates noise along these directions, and reshapes the isotropic noise of standard LDP mechanisms into an anisotropic distribution. The resulting mechanism preserves the privacy guarantee of the underlying LDP randomizer while heterogeneously modulating the impact of noise across task directions, thereby substantially enhancing data utility. The approach is applicable to both linear and nonlinear models and can be seamlessly integrated with existing LDP mechanisms. Extensive experiments on CIFAR-10-C under brightness corruption at the highest severity level demonstrate that integrating our approach improves classification accuracy by approximately 8 percentage points for Laplace and 20 percentage points for PrivUnit variants at ε=7.5. The source code is available at https://github.com/ymha/jacobian-anr-ldp.
Youngmok Ha, Viktor Schlegel, Yidan Sun +1
Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore +1
Generative models trained on sensitive image datasets risk memorizing and reproducing individual training examples, making strong privacy guarantees essential. While differential privacy (DP) provides a principled framework for such guarantees, standard DP finetuning (e.g., with DP-SGD) often results in severe degradation of image quality, particularly in high-frequency textures, due to the indiscriminate addition of noise across all model parameters. In this work, we propose a spectral DP framework based on the hypothesis that the most privacy-sensitive portions of an image are often low-frequency components in the wavelet space (e.g., facial features and object shapes) while high-frequency components are largely generic and public. Based on this hypothesis, we propose the following two-stage framework for DP image generation with coarse image intermediaries: (1) DP finetune an autoregressive spectral image tokenizer model on the low-resolution wavelet coefficients of the sensitive images, and (2) perform high-resolution upsampling using a publicly pretrained super-resolution model. By restricting the privacy budget to the global structures of the image in the first stage, and leveraging the post-processing property of DP for detail refinement, we achieve promising trade-offs between privacy and utility. Experiments on the MS-COCO and MM-CelebA-HQ datasets show that our method generates images with improved quality and style capture relative to other leading DP image frameworks.
The ever-increasing collection of personal data has created mounting pressure to develop technologies that protect sensitive aspects of individual identity. Differential privacy (DP) provides a principled framework with strong formal guarantees and has already achieved practical success. However, releasing high-dimensional data, such as images, has remained elusive: releasing uncompressed privatized data requires significant storage. At the same time, no effective data compression scheme exists that can compress high-resolution data with privacy guarantees. We address this challenge with DP-DiPP, a compression pipeline that combines stochastic codes with diffusion models. DP-DiPP is highly flexible: the practitioner has direct control over the compression rate-privacy-utility tradeoff. As the theoretical backbone, we extend the Poisson private representation (PPR) to encode the outputs of privacy mechanisms. We then combine it with DiffC, a diffusion-based lossy data compression method, to obtain a differentially private image compressor. Our experiments on privatized image classification on CIFAR-10 demonstrate that DP-DiPP significantly outperforms the baseline, achieving a 10-30 times better compression while retaining comparable privacy guarantees and utility.