LDP-Slicing: Local Differential Privacy for Images via Randomized Bit-Plane Slicing

Yuanming Cao; Chengqi Li; Wenbo He

cs.CVMar 4, 2026

LDP-Slicing: Local Differential Privacy for Images via Randomized Bit-Plane Slicing

Authors: Yuanming Cao, Chengqi Li, Wenbo He

Organizations: McMaster University, Hamilton, Ontario, Canada

Abstract

Local Differential Privacy (LDP) is the gold standard trust model for privacy-preserving machine learning by guaranteeing privacy at the data source. However, its application to image data has long been considered impractical due to the high dimensionality of pixel space. Canonical LDP mechanisms are designed for low-dimensional data, resulting in severe utility degradation when applied to high-dimensional pixel spaces. This paper demonstrates that this utility loss is not inherent to LDP, but from its application to an inappropriate data representation. We introduce LDP-Slicing, a lightweight, training-free framework that resolves this domain mismatch. Our key insight is to decompose pixel values into a sequence of binary bit-planes. This transformation allows us to apply the LDP mechanism directly to the bit-level representation. To further strengthen privacy and preserve utility, we integrate a perceptual obfuscation module that mitigates human-perceivable leakage and an optimization-based privacy budget allocation strategy. This pipeline satisfies rigorous pixel-level $\varepsilon$ -LDP while producing images that retain high utility for downstream tasks. Extensive experiments on face recognition and image classification demonstrate that LDP-Slicing outperforms existing DP/LDP baselines under comparable privacy budgets, with negligible computational overhead.

Figures & tables

Figure 1: The LDP-Slicing framework. Our method consists of two primary stages: (1) Perceptual obfuscation: the input image is transformed into the frequency domain via DWT, where the low-frequency (LL) band is pruned to remove human-perceptible information. (2) Bit-plane randomization: The obfuscated image is decomposed into binary bit-planes. A utility-aware randomized response mechanism is applied to each bit and enforces a strict $\varepsilon$ -Local Differential Privacy guarantee before the final image is reconstructed.

Figure 2: Bit-plane slicing reveals the non-uniform distribution of structural information. An 8-bit image (left) is decomposed into its planes ( right ), from LSB (top-left) to MSB (bottom-right). This visualization shows that coarse structural information is concentrated in the high-order MSB planes, while low-order LSB planes consist primarily of noise-like texture. This motivates our non-uniform, utility-aware budget optimization strategy.

Figure 3: Visual justification for channel-aware allocation and perceptual obfuscation. This figure shows an original image (a) and its YCbCr components before and after LL-pruning. It validates two key decisions: (1) Channel Importance: The luma (Y) channel (b) contains the most structural information compared to the chroma channels (c,d). (2) Post-Pruning Signal: After LL-pruning (e), the resulting image (e) is perceptually obfuscated for human viewers. The Y-channel’s MSB (f) still retains significant high-frequency detail for machine learning, unlike the less informative chroma MSBs (g,h).

Method	DP/LDP Guarantee	AgeDB-30	LFW	CPLFW	CALFW
ArcFace	None	97.88	99.77	92.77	96.05
InstaHide	None	79.58	96.53	81.03	86.24
Cloak	None	92.60	98.91	83.43	92.18
PPFR-FD	None	97.23	99.69	90.19	95.60
DuetFace	None	97.93	99.82	92.77	96.10
PartialFace	None	97.79	99.80	92.03	96.07

Table 1: Benchmarks on face recognition accuracy (%). LDP-Slicing is compared with a non-private baseline, heuristic methods, and methods with formal privacy guarantees. Bold indicates the best result among DP/LDP methods.

Figure 4: Visual comparison between LL pruning (Bottom) versus without pruning (Top). (a) $\varepsilon_{\text{total}}=1$ . (b) $\varepsilon_{\text{total}}=2.4$ . (c) $\varepsilon_{\text{total}}=5.2$ . (d) $\varepsilon_{\text{total}}=12$ . (e) $\varepsilon_{\text{total}}=20$ . (f) $\varepsilon_{\text{total}}=32$ . (g) $\varepsilon_{\text{total}}=58$ .

Figure 5: Resilience to a white-box reconstruction attack. The adversary has full knowledge of our pipeline and trains a specialized two-stage inversion model. From top to bottom $\varepsilon_{total}=5.2$ , $\varepsilon_{total}=20$ , $\varepsilon_{total}=58$ (a) The original images. (b) original images after LL removed. (c) LDP-Slicing privatized images. (d) LL recovered images. (e) Final recovered images.

Figure 6: Resilience to black-box reconstruction attack. (a) The original images. Recovered LDP-Slicing image from (b) $\varepsilon_{total}=5.2$ , (c) $\varepsilon_{total}=20$ , and (d) $\varepsilon_{total}=58$ . (e) Recovered DCTDP image ( $\varepsilon_{mean}=0.5$ ).

Panel of Figure 7 — Figure 7: Privacy-utility trade-off on privacy-preserving image classification. LDP-Slicing is compared against the strong centralized DP-SGD model [ 1 ] . On both CIFAR-10 (a) and CIFAR-100 (b) , our local model demonstrates a clear and growing advantage as the budget moves into a more practical range, comparing with the centralized trusted-curator model.

Figure 8: Visual comparison on $\text{Map}^{2}$ V [ 51 ] reconstruction attack on PPFR SOTAs. Red squares highlight reconstructions that leak facial features. (a) Target images. (b) Reconstruction from DCTDP [ 23 ] . (c) Reconstruction from DuetFace [ 32 ] . (d) Reconstruction from PartialFace [ 33 ] . (e) Reconstruction from LDP-Slicing (ours).

Method	CIFAR10	CIFAR100	AgeDB-30	LFW	CALFW	CPLFW
PartialFace [ 33 ]	3.55	4.34	0.43	16.28	9.0	6.18
DuetFace [ 32 ]	5.07	7.14	6.97	19.75	12.98	8.89
DCTDP [ 23 ]	4.97	5.98	5.65	12.58	10.92	10.36
LDP-Slicing (Ours)	0.25	0.1	0.42	4.5	3.87	1.62

Table 2: Identity distinguishing attack advantage (%). The table shows the adversary’s advantage rate in Definition 1 . A lower advantage indicates a stronger protection.

Configuration	AgeDB-30	LFW	CPLFW	CALFW
ArcFace (baseline)	97.88	99.77	92.77	96.05
(A) w/o LL Pruning	96.90	99.77	91.67	96.05
(B) LL Pruning + Uniform Budget	89.82	99.35	86.73	94.13
(C) DC Pruning + Utility-aware optimization	95.58	99.53	89.53	95.77
(D) LL Pruning + Utility-aware optimization (LDP-Slicing)	96.68	99.75	91.08	96.02

Table 3: Ablation study of key components of LDP-Slicing . Results show face recognition accuracy (%) on four benchmarks, with a fixed privacy budget of

\varepsilon_{\text{total}}=20

. Each ablative variant modifies a single component of our full method (D): (A) without LL pruning, (B) with uniform privacy budget, and (C) DCT-based DC pruning with full utility-aware optimization.

Privacy Budget	AgeDB-30	LFW	CPLFW	CALFW	$\boldsymbol{\mathrm{PSNR}_{\text{avg}}}$
$\varepsilon_{\text{total}}=1$	50.95	52.88	51.45	52.31	6.90 dB
$\varepsilon_{\text{total}}=2.4$	54.12	53.62	51.85	53.83	6.91 dB
$\varepsilon_{\text{total}}=5.2$	68.89	89.31	71.30	79.15	6.94 dB
$\varepsilon_{\text{total}}=12$	93.70	99.30	88.70	95.33	7.30 dB
$\varepsilon_{\text{total}}=20$	96.68	99.75	91.08	96.02	7.62 dB
$\varepsilon_{\text{total}}=32$	96.46	99.77	91.93	96.04	8.51 dB

Table 4: Privacy-utility trade-off on face recognition accuracy (%) . As the privacy budget

\varepsilon_{\text{total}}

decreases, utility across all benchmarks declines smoothly, aligning with theoretical expectations. PSNR values also correlate with the applied privacy budget.

Method	Ours	[ 34 ]	[ 47 ]	[ 33 ]	[ 46 ]	[ 32 ]	[ 23 ]
Storage $\downarrow$	$\times 1$	$\times 1$	$\times 5.3$	$\times 9$	$\times 36$	$\times 54$	$\times 63$

Table 5: Storage and transmission overhead analysis. Overhead is reported as a multiple of the size of a standard image (our method,

\times 1

). Lower is better. LDP-Slicing introduces zero overhead.

Figure 9: Qualitative comparison against other SOTAs. We compare LDP-Slicing (i) against (b) PPFR-FD [ 46 ] , (c) DuetFace [ 32 ] , (d) PartialFace [ 33 ] , (e) ProFace [ 50 ] , (f) AdvFace [ 47 ] , (g) MinusFace [ 34 ] , and DCTDP [ 23 ] . DCTDP and LDP-Slicing achieve a higher level of perceptual obfuscation.

Dataset	$\varepsilon$ =1	$\varepsilon$ =2.4	$\varepsilon$ =5.2	$\varepsilon$ =12	$\varepsilon$ =20	$\varepsilon$ =32	$\varepsilon$ =58
Chest X-Ray [ 25 ]	76.60	88.94	90.54	91.99	92.15	92.95	93.43
VGGFace2 [ 5 ]	48.95	50.31	51.71	66.69	67.15	68.99	70.64
CelebA [ 30 ]	49.88	50.97	50.84	75.90	80.44	82.68	84.89

Table 6: Privacy-utility trade-off (%). We perform additional experiment on another 3 benchmarks

Color W.	CIFAR10	CIFAR100	AgeDB	LFW	CALFW	CPLFW
$4:1:1$ (Ours)	80.36	53.55	96.68	99.75	96.02	91.08
$2:1:1$	78.44	50.63	95.85	99.63	95.68	90.87
$1:1:1$	74.92	45.16	94.68	99.47	94.17	89.85

Table 7: Utility under different color weight (%).

Figure 10: Black-box reconstruction attack (w/o LL pruning)

Explore similar work

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy
May 16, 2026Youngmok Ha, Viktor Schlegel, Yidan Sun +1Privacy-Preserving ML Differential Privacy
Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore +1
Decomposing Private Image Generation via Coarse-to-Fine Wavelet Modeling
Feb 26, 2026Jasmine Bayrooti, Weiwei Kong, Natalia Ponomareva +3Image Generation Differential Privacy
University of Cambridge
Scalable Differentially Private Data Compression via Diffusion and Stochastic Codes
Jul 3, 2026Gergely Flamich, Oykü Sıla Güner, Yanxiao Liu +1Learned Image Compression Differential Privacy
Imperial College London, London, UK

May 16, 2026J/K move · Enter open · S save

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy

Youngmok Ha, Viktor Schlegel, Yidan Sun, Anil Anthony Bharath

Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore+1

Privacy-Preserving ML Differential Privacy

Open paper AskPDF arXiv

While Local Differential Privacy (LDP) serves as a foundational primitive for distributed data collection, its stringent randomization requirements often lead to severe degradation in data representation utility. This degradation stems from the task-agnostic nature of conventional LDP mechanisms, which perturb all dimensions without accounting for their relative importance to the downstream objective. To address this issue, we propose a novel approach that mitigates noise in task-relevant subspaces of the data representation. Our method identifies task-critical subspaces via the Jacobian of a public downstream model, selectively attenuates noise along these directions, and reshapes the isotropic noise of standard LDP mechanisms into an anisotropic distribution. The resulting mechanism preserves the privacy guarantee of the underlying LDP randomizer while heterogeneously modulating the impact of noise across task directions, thereby substantially enhancing data utility. The approach is applicable to both linear and nonlinear models and can be seamlessly integrated with existing LDP mechanisms. Extensive experiments on CIFAR-10-C under brightness corruption at the highest severity level demonstrate that integrating our approach improves classification accuracy by approximately 8 percentage points for Laplace and 20 percentage points for PrivUnit variants at

ε=7.5

. The source code is available at https://github.com/ymha/jacobian-anr-ldp.

Abstract

Explore similar work

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy

Decomposing Private Image Generation via Coarse-to-Fine Wavelet Modeling

Scalable Differentially Private Data Compression via Diffusion and Stochastic Codes