TADP-RME: A Trust-Adaptive Differential Privacy Framework for Enhancing Reliability of Data-Driven Systems

Labani Halder; Payel Sadhukhan; Sarbani Palit

cs.CRApr 9, 2026

TADP-RME: A Trust-Adaptive Differential Privacy Framework for Enhancing Reliability of Data-Driven Systems

Authors: Labani Halder, Payel Sadhukhan, Sarbani Palit

Organizations: Indian Statistical Institute Kolkata 203 B.T. Road, Kolkata-700108, India · Army Institute of Management Plot No III/B-11, Action Area III, New Town, Kolkata-700160, India

Abstract

Ensuring reliability in adversarial settings necessitates treating privacy as a foundational component of data-driven systems. While differential privacy and cryptographic protocols offer strong guarantees, existing schemes rely on a fixed privacy budget, leading to a rigid utility-privacy trade-off that fails under heterogeneous user trust. Moreover, noise-only differential privacy preserves geometric structure, which inference attacks exploit, causing privacy leakage. We propose TADP-RME (Trust-Adaptive Differential Privacy with Reverse Manifold Embedding), a framework that enhances reliability under varying levels of user trust. It introduces an inverse trust score in the range [0,1] to adaptively modulate the privacy budget, enabling smooth transitions between utility and privacy. Additionally, Reverse Manifold Embedding applies a nonlinear transformation to disrupt local geometric relationships while preserving formal differential privacy guarantees through post-processing. Theoretical and empirical results demonstrate improved privacy-utility trade-offs, reducing attack success rates by up to 3.1 percent without significant utility degradation. The framework consistently outperforms existing methods against inference attacks, providing a unified approach for reliable learning in adversarial environments.

Figures & tables

Figure 1: Motivation for Reverse Manifold Embedding (RME). (Left) Original data exhibits tightly clustered points with strong proximity relationships. (Right) After nonlinear twisting into a Swiss-roll–like manifold, nearby samples are separated and redistributed, distorting local structure and introducing ambiguity in neighborhood relationships.

Figure 2: Behavior of $r^{2}-2\ln(r)$ for $r<1$ . The function remains strictly positive across this range, confirming inequality ( 5 ) and guaranteeing a positive KL divergence between the corresponding distributions.

Figure 3: Recovery probability under partial pairing knowledge. While reconstruction remains feasible in low dimensions ( $d=2,3$ ), success probability drops sharply as dimensionality increases, even with high levels of known pairings.

		MNIST			Fashion-MNIST			CIFAR-10
$\tau$	$\varepsilon$	Acc.	Priv.	Recon.	Acc.	Priv.	Recon.	Acc.	Priv.	Recon.
0.0	80.0	$90.0\pm 0.7$	$0.399\pm 0.006$	$0.114\pm 0.000$	$81.7\pm 0.6$	$0.429\pm 0.001$	$0.104\pm 0.001$	$38.4\pm 1.4$	$0.694\pm 0.004$	$0.296\pm 0.004$
0.1	73.5	$72.7\pm 0.4$	$0.561\pm 0.002$	$0.517\pm 0.001$	$63.1\pm 0.9$	$0.585\pm 0.003$	$0.457\pm 0.002$	$15.8\pm 2.3$	$0.804\pm 0.003$	$0.479\pm 0.001$
0.25	63.8	$68.7\pm 0.7$	$0.586\pm 0.005$	$0.551\pm 0.001$	$59.6\pm 0.7$	$0.600\pm 0.006$	$0.475\pm 0.002$	$14.8\pm 1.4$	$0.813\pm 0.002$	$0.499\pm 0.003$
0.5	47.5	$57.8\pm 1.0$	$0.631\pm 0.004$	$0.616\pm 0.002$	$51.6\pm 1.1$	$0.640\pm 0.005$	$0.515\pm 0.002$	$12.4\pm 1.4$	$0.831\pm 0.003$	$0.539\pm 0.002$
0.75	31.3	$40.6\pm 1.5$	$0.705\pm 0.003$	$0.700\pm 0.002$	$38.7\pm 0.8$	$0.704\pm 0.004$	$0.570\pm 0.003$	$11.2\pm 1.0$	$0.858\pm 0.006$	$0.600\pm 0.001$

Table 1: Trust-adaptive privacy-utility trade-off across MNIST, Fashion-MNIST, and CIFAR-10. The inverse trust score

\tau\in[0,1]

controls the privacy budget as

\varepsilon_{\tau}=80-\tau\cdot 65

, where

\tau=0

corresponds to fully trusted (maximum utility,

\varepsilon=80

) and

\tau=1

corresponds to fully untrusted (maximum privacy,

\varepsilon=15

). Results show mean

\pm

standard deviation across 5 independent seeds.

Figure 4: Privacy-utility trade-off across datasets. Accuracy decreases as

\tau

increases, with CIFAR-10 exhibiting rapid degradation at low privacy levels.

Figure 5: Utility retention across privacy levels

\tau

. Higher

\tau

leads to reduced utility, with a critical transition around

\tau\approx 0.5

Figure 6: Utility comparison across privacy regimes (

\tau=0

0.5

, and

1

). Moderate privacy provides a balance between accuracy and protection, while strong privacy leads to significant degradation.

$\varepsilon=15$ (Strong Privacy)
Method	MNIST		Fashion-MNIST		CIFAR-10
Method	Accuracy	Privacy	Accuracy	Privacy	Accuracy	Privacy
Gaussian DP	$26.8\pm 1.2$	$0.784\pm 0.007$	$27.1\pm 1.5$	$0.757\pm 0.013$	$11.0\pm 0.9$	$0.848\pm 0.004$
Laplace DP	$58.9\pm 1.4$	$0.585\pm 0.010$	$55.1\pm 0.7$	$0.625\pm 0.007$	$13.2\pm 0.8$	$0.804\pm 0.003$
Personalized DP	$12.1\pm 0.7$	$0.839\pm 0.003$	$12.9\pm 0.8$	$0.815\pm 0.005$	$10.3\pm 0.6$	$0.861\pm 0.003$
TADP-RME ( $\tau=1$ )	$\mathbf{26.6\pm 1.2}$	$\mathbf{0.782\pm 0.003}$	$\mathbf{26.8\pm 1.1}$	$\mathbf{0.756\pm 0.006}$	$\mathbf{10.1\pm 0.8}$	$\mathbf{0.851\pm 0.004}$

Table 2: Comparison with baseline methods at matched privacy budgets. For DP baselines, we evaluate at

\varepsilon=15

(strong privacy),

\varepsilon=47.5

(moderate privacy), and

\varepsilon=80

(weak privacy). TADP-RME is evaluated at

\tau=1

\tau=0.5

, and

\tau=0

, corresponding to

\varepsilon=15

47.5

, and

80

, respectively. Non-DP baselines are evaluated with their default configurations. Results show mean accuracy and privacy score across 5 independent seeds, where privacy score is the average of membership inference, reconstruction, and attribute inference privacy scores (higher values indicate stronger empirical privacy).

Dataset	$\tau=0.0$			$\tau=1$
Dataset	MIA	Recon	AIA	MIA	Recon	AIA
MNIST	$0.541\pm 0.006$	$0.114\pm 0.000$	$0.543\pm 0.006$	$0.988\pm 0.004$	$0.532\pm 0.000$	$0.827\pm 0.006$
Fashion-MNIST	$0.592\pm 0.005$	$0.104\pm 0.001$	$0.591\pm 0.005$	$0.984\pm 0.011$	$0.461\pm 0.001$	$0.822\pm 0.008$
CIFAR-10	$0.895\pm 0.004$	$0.296\pm 0.004$	$0.891\pm 0.004$	$0.987\pm 0.009$	$0.576\pm 0.003$	$0.981\pm 0.006$

Table 3: Attack resilience at

\tau=0.0

(weak privacy,

\varepsilon=80

) and

\tau=1

(maximum privacy,

\varepsilon=15

). MIA (membership inference attack) privacy score measures protection against training set membership leakage, where

1

indicates random guessing. Reconstruction privacy score quantifies resistance to feature inversion, with higher values indicating greater reconstruction difficulty. AIA (attribute inference attack) privacy score measures protection against label inference, normalized against random guessing baseline (

1/C

for

C

classes). All scores are normalized to

[0,1]

, where

1

represents maximum resistance to adversarial inference. Results show mean

\pm

standard deviation across 5 seeds.

Figure 7: Structure preservation versus utility under varying privacy levels

\tau

, measured using k-NN overlap for

k=5

and

k=10

. Higher overlap indicates better preservation of local geometry. Results are shown for MNIST (blue), Fashion-MNIST (purple), and CIFAR-10 (orange). As

\tau

increases, both structure preservation and accuracy decrease. The trends are consistent across both neighborhood sizes, with

k=10

exhibiting slightly smoother degradation compared to the more locally sensitive

k=5

, indicating that the observed behavior is consistent across different neighborhood scales.

Privacy Improvement over Noise Only
Component	MNIST		Fashion-MNIST		CIFAR-10
Component	Acc (%)	Priv	Acc (%)	Priv	Acc (%)	Priv
Noise Only	$58.2\pm 0.6$	$0.605\pm 0.002$	$54.7\pm 0.6$	$0.609\pm 0.003$	$14.7\pm 0.6$	$0.807\pm 0.003$
Embedding Only	$90.0\pm 0.4$	$0.400\pm 0.004$	$81.7\pm 0.6$	$0.429\pm 0.001$	$38.4\pm 1.4$	$0.694\pm 0.004$
Fixed- $\tau$ (Non-adaptive)	$58.0\pm 1.0$	$0.633\pm 0.003$	$51.9\pm 0.9$	$0.643\pm 0.003$	$12.6\pm 0.5$	$0.822\pm 0.004$
Full Pipeline (Adaptive)	$\mathbf{57.8\pm 1.0}$	$\mathbf{0.631\pm 0.004}$	$\mathbf{51.6\pm 1.1}$	$\mathbf{0.640\pm 0.005}$	$\mathbf{12.4\pm 1.4}$	$\mathbf{0.818\pm 0.003}$

Table 4: Ablation study at

\tau=0.5

(moderate privacy,

\varepsilon=47.5

). Noise-only applies the Gaussian mechanism without geometric transformation; embedding-only applies polar transformation without stochastic noise; fixed-

\tau

(non-adaptive) uses the full pipeline with a constant trust level; full pipeline corresponds to the adaptive TADP-RME framework. Results are reported as mean

\pm

standard deviation across 5 runs.

Parameter	Value	Accuracy (%)	Privacy Score	Reconstruction Error
$\varepsilon_{\min}$	10	$55.0\pm 1.1$	$0.637\pm 0.005$	$0.628\pm 0.002$
	15	$57.8\pm 1.0$	$0.631\pm 0.004$	$0.616\pm 0.002$
	20	$59.8\pm 0.7$	$0.627\pm 0.003$	$0.607\pm 0.002$
	30	$63.9\pm 0.6$	$0.606\pm 0.004$	$0.586\pm 0.002$
$\varepsilon_{\max}$	40	$45.8\pm 1.0$	$0.672\pm 0.004$	$0.666\pm 0.003$
	60	$54.2\pm 0.9$	$0.653\pm 0.006$	$0.614\pm 0.002$

Table 5: Parameter sensitivity analysis on MNIST at

\tau=0.5

(

\varepsilon=47.5

). Results are reported as mean

\pm

standard deviation across 5 runs, where higher privacy scores indicate stronger resistance to adversarial inference.

Figure 8: Global distance preservation measured using Spearman’s rank correlation

\rho

. Increasing

\tau

leads to rapid degradation of global geometry, with correlations approaching zero under strong privacy.

Figure 9: Computational overhead across privacy levels. Runtime decreases significantly as

\tau

increases, indicating improved efficiency under stronger privacy settings.

Figure 10: Privacy-utility Pareto frontier showing the trade-off between classification accuracy and empirical privacy, which can be interpreted as system reliability under adversarial conditions. Each point corresponds to a different trust level

\tau

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy
May 20, 2026Aman Saxena, Jan Schuchardt, Yan Scholten +1Randomized Smoothing Adversarial Robustness
Department of Computer Science, Technical University of Munich · Munich Data Science Institute · MCML +1
PRISM: Gauge-Invariant Tangent-Space Differentially Private LoRA
May 31, 2026Shihao Wang, Xueru ZhangDifferentially Private Stochastic Gradient Descent Low-Rank Adaptation
Department of Computer Science and Engineering, The Ohio State University, Columbus, OH, USA.
Private and Stable Test-Time Adaptation with Differential Privacy
Jun 1, 2026Zefeng Li, Qiaoyue Tang, Mathias Lecuyer +1Continual Test-Time Adaptation Privacy-Preserving ML
University of British Columbia · Vector Institute

May 20, 2026J/K move · Enter open · S save

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

Aman Saxena, Jan Schuchardt, Yan Scholten, Stephan Günnemann

Department of Computer Science, Technical University of Munich · Munich Data Science Institute · MCML+1

Randomized Smoothing Adversarial Robustness Backdoor Defense Certified Robustness

Open paper AskPDF arXiv

Randomized smoothing is a powerful tool for certifying robustness to adversarial perturbations, including poisoning attacks via randomized training and evasion attacks via randomized inference. Extending these guarantees to backdoor attacks, where training and test data are jointly perturbed, remains challenging because training- and test-time randomized mechanisms must be analyzed within a single robustness certificate. We address this by connecting randomized smoothing to the dual view of differential privacy through privacy profiles, which provide a numerical procedure for composing heterogeneous mechanisms. The resulting framework enables tight, modular, end-to-end certification of complex, composed mechanisms while leveraging existing analyses of differentially private mechanisms. We instantiate the framework for DP-SGD and Deep Partition Aggregation with inference-time smoothing, deriving joint robustness guarantees against both training-time and inference-time attacks. Experiments on MNIST and CIFAR-10 demonstrate the effectiveness of our framework. Overall, we provide a principled and general framework for using composite mechanisms to certify robustness under complex threat models that better capture the capabilities of real-world adversaries.

Abstract

Privacy-Preserving ML

Explore similar work

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

PRISM: Gauge-Invariant Tangent-Space Differentially Private LoRA

Private and Stable Test-Time Adaptation with Differential Privacy