FlagThis

Abstract

An adversary observing a models released prediction can infer sensitive attributes of the queried input, or even reconstruct representatives of the models training data. The inference interface thus acts as a side channel for privacy leakage. We introduce Robust Privacy (RP), an inferencestage privacy notion inspired by certified robustness: if a models prediction is provably invariant within a radius- R neighborhood around an input x with confidence at least 1 , then x enjoys ( R, ) -Robust Privacy, under which we prove that any adversary observing the released prediction has at most / 2 advantage in distinguishing x from any input within distance R of x . Building on RP, we formalize Robust Attribute Privacy (RAP), an attribute-level privacy notion that characterizes the set of sensitive-attribute values that remain compatible with a released prediction when the adversarys side information is fixed. On a classification task with a sensitive attribute, RP increases the median length of the RAP-compatible inference interval from 23 . 50 to 29 . 96 , reducing attribute-inference precision. Model inversion attacks, often treated as a training-stage threat, in fact rely on finegrained inputoutput dependence signals leaked through the inference interface; RP masks these signals at the inference stage, reducing attack success rate (ASR) from 73% to 4% on a black-box inversion attack. This direct targeting of the leakage channel enables RP to dominate DP-SGD and randomized response in the privacyutility tradeoff space: RP retains 98 . 4% accuracy at 21% ASR, whereas DP-SGD must drop accuracy to 61 . 7% to reach a comparable ASR. Across both experiments, increasing the smoothing sample size N at fixed noise scale strengthens privacy and improves utility together, at higher per-query inference cost. Finally, we examine model distillation as a scope boundary and show that RP mitigates attributelevel and instance-level inference-stage privacy leakage, but not function-level extraction through model distillation.