Gecko: Fast Private Inference via Secure Public Encoder Offloading

• URL: http://arxiv.org/abs/2608.02378v1
• Date: Mon, 03 Aug 2026 15:21:45 GMT
• Title: Gecko: Fast Private Inference via Secure Public Encoder Offloading
• Abstract summary: Private inference protects both user inputs and server models during neural network inference.<n>This motivates recent efforts to run a public encoder, such as a pretrained backbone, outside the protection boundary.<n>We present Gecko, designed to limit this additional risk while retaining a compact predictor.
• Score: 16.22205006647353
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Private inference protects both user inputs and server models during neural network inference, but existing solutions remain too slow for practical deployment. This motivates recent efforts to run a public encoder, such as a pretrained backbone, outside the protection boundary and evaluate only a small private predictor cryptographically. While appealing for efficiency, this design is not inherently secure: naively offloading a public encoder may create a feature-space shortcut: an extraction adversary may learn the remaining private predictor's feature-to-output mapping more easily than the original model's input-to-output behavior. We present Gecko, designed to limit this additional risk while retaining a compact encrypted predictor. We leverage a frozen backbone that contributes hierarchical features, fixed Fastfood projections that compress them, and private feature gating that prepares them for prediction. We formalize ideal independence and information-preservation conditions as design guidance, then separately evaluate component-reuse extraction attacks. Across image and audio tasks, Gecko achieves 0.4-2.2 second inference with at most 10.8 MB communication and accuracy comparable to transfer-learning baselines. Under the evaluated attacks, reusing the offloaded public encoder provides no significant advantage to model-extraction adversaries. Source code and a demo are available at https://github.com/CassiniHuy/gecko-infer.

Related papers

• DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors [40.98521902229488]
  Self-supervised learning (SSL) encoders are vulnerable to backdoor attacks.<n>DEFUSE is a generalizable backdoor detection framework for SSL encoders.
  arXiv  Detail & Related papers  (2026-08-26T14:24:05Z)
• Robust Estimation of Sparse Numerical Vectors under Local Differential Privacy [61.848691894557426]
  Local differential privacy (LDP) protocols are vulnerable to poisoning attacks.<n>In this paper, we address the robust sparse vector mean estimation problem.<n>We propose a correction method based on a careful analysis that gives an exact expression of the bias.
  arXiv  Detail & Related papers  (2026-07-30T07:55:09Z)
• Distributed Deep Variational Approach for Privacy-preserving Data Release [12.868309078964591]
  Federated learning lets distributed nodes train a shared model without exchanging their raw data.<n>In privacy-sensitive medical sensors, IoT devices, wearables the protection offered by keeping data local is incomplete.<n>We propose the emphGaussian Privacy Protector framework for continuous, high-dimensional inputs that learns a sanitized encoder mapping raw data to a low-dimensional representation.
  arXiv  Detail & Related papers  (2026-05-04T18:41:37Z)
• SpecSteer: Synergizing Local Context and Global Reasoning for Efficient Personalized Generation [79.75755802397312]
  SpecSteer is an asymmetric collaborative inference framework that synergizes private on-device context with cloud-scale reasoning.<n>Experiments demonstrate that SpecSteer successfully closes the reasoning gap and achieves superior personalized generation performance.
  arXiv  Detail & Related papers  (2026-03-17T07:51:29Z)
• Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs [61.15237978606501]
  Large language models can infer private user attributes from user-generated text.<n>Existing anonymization-based defenses are coarse-grained, lacking word-level precision in anonymizing privacy-leaking elements.<n>We propose a unified defense framework that combines fine-grained anonymization (TRACE) with inference-preventing optimization (RPS)
  arXiv  Detail & Related papers  (2026-02-12T03:37:50Z)
• Downstream-agnostic Adversarial Examples [66.8606539786026]
  AdvEncoder is first framework for generating downstream-agnostic universal adversarial examples based on pre-trained encoder. Unlike traditional adversarial example works, the pre-trained encoder only outputs feature vectors rather than classification labels. Our results show that an attacker can successfully attack downstream tasks without knowing either the pre-training dataset or the downstream dataset.
  arXiv  Detail & Related papers  (2023-07-23T10:16:47Z)
• When approximate design for fast homomorphic computation provides differential privacy guarantees [0.08399688944263842]
  Differential privacy (DP) and cryptographic primitives are popular countermeasures against privacy attacks. In this paper, we design SHIELD, a probabilistic approximation algorithm for the argmax operator. Even if SHIELD could have other applications, we here focus on one setting and seamlessly integrate it in the SPEED collaborative training framework.
  arXiv  Detail & Related papers  (2023-04-06T09:38:01Z)
• THE-X: Privacy-Preserving Transformer Inference with Homomorphic Encryption [112.02441503951297]
  Privacy-preserving inference of transformer models is on the demand of cloud service users. We introduce $textitTHE-X$, an approximation approach for transformers, which enables privacy-preserving inference of pre-trained models.
  arXiv  Detail & Related papers  (2022-06-01T03:49:18Z)
• On the Importance of Encrypting Deep Features [15.340540198612823]
  We analyze model inversion attacks with only two assumptions: feature vectors of user data are known, and a black-box API for inference is provided. Experiments have been conducted on state-of-the-art models in person re-identification, and two attack scenarios (i.e., recognizing auxiliary attributes and reconstructing user data) are investigated. Results show that an adversary could successfully infer sensitive information even under severe constraints.
  arXiv  Detail & Related papers  (2021-08-16T15:22:33Z)
• Is Private Learning Possible with Instance Encoding? [68.84324434746765]
  We study whether a non-private learning algorithm can be made private by relying on an instance-encoding mechanism. We formalize both the notion of instance encoding and its privacy by providing two attack models.
  arXiv  Detail & Related papers  (2020-11-10T18:55:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.