TADP-RME: A Trust-Adaptive Differential Privacy Framework for Enhancing Reliability of Data-Driven Systems

Labani Halder; Payel Sadhukhan; Sarbani Palit

cs.CRApr 9, 2026

TADP-RME: A Trust-Adaptive Differential Privacy Framework for Enhancing Reliability of Data-Driven Systems

Authors: Labani Halder, Payel Sadhukhan, Sarbani Palit

Organizations: Indian Statistical Institute Kolkata 203 B.T. Road, Kolkata-700108, India · Army Institute of Management Plot No III/B-11, Action Area III, New Town, Kolkata-700160, India

Abstract

Ensuring reliability in adversarial settings necessitates treating privacy as a foundational component of data-driven systems. While differential privacy and cryptographic protocols offer strong guarantees, existing schemes rely on a fixed privacy budget, leading to a rigid utility-privacy trade-off that fails under heterogeneous user trust. Moreover, noise-only differential privacy preserves geometric structure, which inference attacks exploit, causing privacy leakage. We propose TADP-RME (Trust-Adaptive Differential Privacy with Reverse Manifold Embedding), a framework that enhances reliability under varying levels of user trust. It introduces an inverse trust score in the range [0,1] to adaptively modulate the privacy budget, enabling smooth transitions between utility and privacy. Additionally, Reverse Manifold Embedding applies a nonlinear transformation to disrupt local geometric relationships while preserving formal differential privacy guarantees through post-processing. Theoretical and empirical results demonstrate improved privacy-utility trade-offs, reducing attack success rates by up to 3.1 percent without significant utility degradation. The framework consistently outperforms existing methods against inference attacks, providing a unified approach for reliable learning in adversarial environments.

Figures & tables

Figure 1: Motivation for Reverse Manifold Embedding (RME). (Left) Original data exhibits tightly clustered points with strong proximity relationships. (Right) After nonlinear twisting into a Swiss-roll–like manifold, nearby samples are separated and redistributed, distorting local structure and introducing ambiguity in neighborhood relationships.

Figure 2: Behavior of $r^{2}-2\ln(r)$ for $r<1$ . The function remains strictly positive across this range, confirming inequality ( 5 ) and guaranteeing a positive KL divergence between the corresponding distributions.

Figure 3: Recovery probability under partial pairing knowledge. While reconstruction remains feasible in low dimensions ( $d=2,3$ ), success probability drops sharply as dimensionality increases, even with high levels of known pairings.

		MNIST			Fashion-MNIST			CIFAR-10
$\tau$	$\varepsilon$	Acc.	Priv.	Recon.	Acc.	Priv.	Recon.	Acc.	Priv.	Recon.
0.0	80.0	$90.0\pm 0.7$	$0.399\pm 0.006$	$0.114\pm 0.000$	$81.7\pm 0.6$	$0.429\pm 0.001$	$0.104\pm 0.001$	$38.4\pm 1.4$	$0.694\pm 0.004$	$0.296\pm 0.004$
0.1	73.5	$72.7\pm 0.4$	$0.561\pm 0.002$	$0.517\pm 0.001$	$63.1\pm 0.9$	$0.585\pm 0.003$	$0.457\pm 0.002$	$15.8\pm 2.3$	$0.804\pm 0.003$	$0.479\pm 0.001$
0.25	63.8	$68.7\pm 0.7$	$0.586\pm 0.005$	$0.551\pm 0.001$	$59.6\pm 0.7$	$0.600\pm 0.006$	$0.475\pm 0.002$	$14.8\pm 1.4$	$0.813\pm 0.002$	$0.499\pm 0.003$
0.5	47.5	$57.8\pm 1.0$	$0.631\pm 0.004$	$0.616\pm 0.002$	$51.6\pm 1.1$	$0.640\pm 0.005$	$0.515\pm 0.002$	$12.4\pm 1.4$	$0.831\pm 0.003$	$0.539\pm 0.002$
0.75	31.3	$40.6\pm 1.5$	$0.705\pm 0.003$	$0.700\pm 0.002$	$38.7\pm 0.8$	$0.704\pm 0.004$	$0.570\pm 0.003$	$11.2\pm 1.0$	$0.858\pm 0.006$	$0.600\pm 0.001$

Table 1: Trust-adaptive privacy-utility trade-off across MNIST, Fashion-MNIST, and CIFAR-10. The inverse trust score

\tau\in[0,1]

controls the privacy budget as

\varepsilon_{\tau}=80-\tau\cdot 65

, where

\tau=0

corresponds to fully trusted (maximum utility,

\varepsilon=80

) and

\tau=1

corresponds to fully untrusted (maximum privacy,

\varepsilon=15

). Results show mean

\pm

standard deviation across 5 independent seeds.

Figure 4: Privacy-utility trade-off across datasets. Accuracy decreases as

\tau

increases, with CIFAR-10 exhibiting rapid degradation at low privacy levels.

Figure 5: Utility retention across privacy levels

\tau

. Higher

\tau

leads to reduced utility, with a critical transition around

\tau\approx 0.5

Figure 6: Utility comparison across privacy regimes (

\tau=0

0.5

, and

1

). Moderate privacy provides a balance between accuracy and protection, while strong privacy leads to significant degradation.

$\varepsilon=15$ (Strong Privacy)
Method	MNIST		Fashion-MNIST		CIFAR-10
Method	Accuracy	Privacy	Accuracy	Privacy	Accuracy	Privacy
Gaussian DP	$26.8\pm 1.2$	$0.784\pm 0.007$	$27.1\pm 1.5$	$0.757\pm 0.013$	$11.0\pm 0.9$	$0.848\pm 0.004$
Laplace DP	$58.9\pm 1.4$	$0.585\pm 0.010$	$55.1\pm 0.7$	$0.625\pm 0.007$	$13.2\pm 0.8$	$0.804\pm 0.003$
Personalized DP	$12.1\pm 0.7$	$0.839\pm 0.003$	$12.9\pm 0.8$	$0.815\pm 0.005$	$10.3\pm 0.6$	$0.861\pm 0.003$
TADP-RME ( $\tau=1$ )	$\mathbf{26.6\pm 1.2}$	$\mathbf{0.782\pm 0.003}$	$\mathbf{26.8\pm 1.1}$	$\mathbf{0.756\pm 0.006}$	$\mathbf{10.1\pm 0.8}$	$\mathbf{0.851\pm 0.004}$

Table 2: Comparison with baseline methods at matched privacy budgets. For DP baselines, we evaluate at

\varepsilon=15

(strong privacy),

\varepsilon=47.5

(moderate privacy), and

\varepsilon=80

(weak privacy). TADP-RME is evaluated at

\tau=1

\tau=0.5

, and

\tau=0

, corresponding to

\varepsilon=15

47.5

, and

80

, respectively. Non-DP baselines are evaluated with their default configurations. Results show mean accuracy and privacy score across 5 independent seeds, where privacy score is the average of membership inference, reconstruction, and attribute inference privacy scores (higher values indicate stronger empirical privacy).

Dataset	$\tau=0.0$			$\tau=1$
Dataset	MIA	Recon	AIA	MIA	Recon	AIA
MNIST	$0.541\pm 0.006$	$0.114\pm 0.000$	$0.543\pm 0.006$	$0.988\pm 0.004$	$0.532\pm 0.000$	$0.827\pm 0.006$
Fashion-MNIST	$0.592\pm 0.005$	$0.104\pm 0.001$	$0.591\pm 0.005$	$0.984\pm 0.011$	$0.461\pm 0.001$	$0.822\pm 0.008$
CIFAR-10	$0.895\pm 0.004$	$0.296\pm 0.004$	$0.891\pm 0.004$	$0.987\pm 0.009$	$0.576\pm 0.003$	$0.981\pm 0.006$

Table 3: Attack resilience at

\tau=0.0

(weak privacy,

\varepsilon=80

) and

\tau=1

(maximum privacy,

\varepsilon=15

). MIA (membership inference attack) privacy score measures protection against training set membership leakage, where

1

indicates random guessing. Reconstruction privacy score quantifies resistance to feature inversion, with higher values indicating greater reconstruction difficulty. AIA (attribute inference attack) privacy score measures protection against label inference, normalized against random guessing baseline (

1/C

for

C

classes). All scores are normalized to

[0,1]

, where

1

represents maximum resistance to adversarial inference. Results show mean

\pm

standard deviation across 5 seeds.

Figure 7: Structure preservation versus utility under varying privacy levels

\tau

, measured using k-NN overlap for

k=5

and

k=10

. Higher overlap indicates better preservation of local geometry. Results are shown for MNIST (blue), Fashion-MNIST (purple), and CIFAR-10 (orange). As

\tau

increases, both structure preservation and accuracy decrease. The trends are consistent across both neighborhood sizes, with

k=10

exhibiting slightly smoother degradation compared to the more locally sensitive

k=5

, indicating that the observed behavior is consistent across different neighborhood scales.

Privacy Improvement over Noise Only
Component	MNIST		Fashion-MNIST		CIFAR-10
Component	Acc (%)	Priv	Acc (%)	Priv	Acc (%)	Priv
Noise Only	$58.2\pm 0.6$	$0.605\pm 0.002$	$54.7\pm 0.6$	$0.609\pm 0.003$	$14.7\pm 0.6$	$0.807\pm 0.003$
Embedding Only	$90.0\pm 0.4$	$0.400\pm 0.004$	$81.7\pm 0.6$	$0.429\pm 0.001$	$38.4\pm 1.4$	$0.694\pm 0.004$
Fixed- $\tau$ (Non-adaptive)	$58.0\pm 1.0$	$0.633\pm 0.003$	$51.9\pm 0.9$	$0.643\pm 0.003$	$12.6\pm 0.5$	$0.822\pm 0.004$
Full Pipeline (Adaptive)	$\mathbf{57.8\pm 1.0}$	$\mathbf{0.631\pm 0.004}$	$\mathbf{51.6\pm 1.1}$	$\mathbf{0.640\pm 0.005}$	$\mathbf{12.4\pm 1.4}$	$\mathbf{0.818\pm 0.003}$

Table 4: Ablation study at

\tau=0.5

(moderate privacy,

\varepsilon=47.5

). Noise-only applies the Gaussian mechanism without geometric transformation; embedding-only applies polar transformation without stochastic noise; fixed-

\tau

(non-adaptive) uses the full pipeline with a constant trust level; full pipeline corresponds to the adaptive TADP-RME framework. Results are reported as mean

\pm

standard deviation across 5 runs.

Parameter	Value	Accuracy (%)	Privacy Score	Reconstruction Error
$\varepsilon_{\min}$	10	$55.0\pm 1.1$	$0.637\pm 0.005$	$0.628\pm 0.002$
	15	$57.8\pm 1.0$	$0.631\pm 0.004$	$0.616\pm 0.002$
	20	$59.8\pm 0.7$	$0.627\pm 0.003$	$0.607\pm 0.002$
	30	$63.9\pm 0.6$	$0.606\pm 0.004$	$0.586\pm 0.002$
$\varepsilon_{\max}$	40	$45.8\pm 1.0$	$0.672\pm 0.004$	$0.666\pm 0.003$
	60	$54.2\pm 0.9$	$0.653\pm 0.006$	$0.614\pm 0.002$

Table 5: Parameter sensitivity analysis on MNIST at

\tau=0.5

(

\varepsilon=47.5

). Results are reported as mean

\pm

standard deviation across 5 runs, where higher privacy scores indicate stronger resistance to adversarial inference.

Figure 8: Global distance preservation measured using Spearman’s rank correlation

\rho

. Increasing

\tau

leads to rapid degradation of global geometry, with correlations approaching zero under strong privacy.

Figure 9: Computational overhead across privacy levels. Runtime decreases significantly as

\tau

increases, indicating improved efficiency under stronger privacy settings.

Figure 10: Privacy-utility Pareto frontier showing the trade-off between classification accuracy and empirical privacy, which can be interpreted as system reliability under adversarial conditions. Each point corresponds to a different trust level

\tau

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

May 20, 2026

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

Randomized smoothing is a powerful tool for certifying robustness to adversarial perturbations, including poisoning attacks via randomized training and evasion attacks via randomized inference. Extending these guarantees to backdoor attacks, where training and test data are jointly perturbed, remains challenging because training- and test-time randomized mechanisms must be analyzed within a single robustness certificate. We address this by connecting randomized smoothing to the dual view of differential privacy through privacy profiles, which provide a numerical procedure for composing heterogeneous mechanisms. The resulting framework enables tight, modular, end-to-end certification of complex, composed mechanisms while leveraging existing analyses of differentially private mechanisms. We instantiate the framework for DP-SGD and Deep Partition Aggregation with inference-time smoothing, deriving joint robustness guarantees against both training-time and inference-time attacks. Experiments on MNIST and CIFAR-10 demonstrate the effectiveness of our framework. Overall, we provide a principled and general framework for using composite mechanisms to certify robustness under complex threat models that better capture the capabilities of real-world adversaries.

Aman Saxena, Jan Schuchardt, Yan Scholten +1

Department of Computer Science, Technical University of Munich · Munich Data Science Institute · MCML +1

Randomized Smoothing Adversarial Robustness Backdoor Defense Certified Robustness

Ask PDF

May 31, 2026

PRISM: Gauge-Invariant Tangent-Space Differentially Private LoRA

Applying differential privacy (DP) via DP-SGD to Low-Rank Adaptation (LoRA) is a natural approach for privacy-preserving fine-tuning. However, LoRA's low-rank parameterization poses a fundamental challenge. In LoRA, each trainable update is represented as a low-rank matrix

Z = AB^\top

, but this factorization is inherently non-identifiable: many factor pairs

(A,B)

represent the same update

Z

. As a result, applying DP-SGD directly to the factors induces gauge-dependent perturbations on

Z

, and we show that this naive DP-LoRA can lead to unbounded noise amplification. We propose PRISM, an intrinsic DP mechanism for LoRA that is gauge invariant by construction, avoids bilinear noise amplification, and admits an efficient low-dimensional noise sampler. Moreover, PRISM yields a closed-form characterization of the effective intrinsic noise induced on

Z

, enabling stable privacy-utility trade-offs through bounded, gauge-invariant perturbations. We establish standard

(ε,δ)

-DP guarantees for PRISM and introduce a DP-aware, gauge-invariant adaptive update rule that prevents adaptive optimization from amplifying injected privacy noise, improving numerical stability in practice.

Shihao Wang, Xueru Zhang

Department of Computer Science and Engineering, The Ohio State University, Columbus, OH, USA.

Differentially Private Stochastic Gradient Descent Low-Rank Adaptation Privacy-Preserving ML Differential Privacy

Ask PDF

Jun 1, 2026

Private and Stable Test-Time Adaptation with Differential Privacy

Test-time adaptation (TTA) can reduce error on new and different data by updating the model on these inputs during inference. However, these updates raise the issue of privacy w.r.t. the testing data, because the model parameters now depend on all past inputs. To control this privacy risk, we cast multiple popular TTA methods (Tent, EATA, SAR, DeYO, and COME) into differential privacy (DP) forms that apply per-sample gradient clipping and Gaussian noise for all updates. On ImageNet-C, our DP-TTA methods provide adequate privacy at small cost to accuracy, and in the low-privacy regime the clipping mechanism of DP can even improve the accuracy and stability of adaptation in the continual setting. These improvements to privacy and accuracy come at only modest computational overhead. These first results on private TTA raise awareness of the issue, inform the development of more private test-time updates, and identify per-sample clipping as an effective technique for improving the accuracy and stability of adaptation.

Zefeng Li, Qiaoyue Tang, Mathias Lecuyer +1

University of British Columbia · Vector Institute

Continual Test-Time Adaptation Privacy-Preserving ML Differential Privacy

Ask PDF

Abstract

Privacy-Preserving ML

Explore similar work

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

PRISM: Gauge-Invariant Tangent-Space Differentially Private LoRA

Private and Stable Test-Time Adaptation with Differential Privacy