Ensembler: Combating model inversion attacks using model ensemble during
  collaborative inference
Dancheng Liu Jinjun Xiong
Deep learning models have exhibited remarkable performance across various
domains. Nevertheless, the burgeoning model sizes compel edge devices to
offload a significant portion of the inference process to the cloud. While this
practice offers numerous advantages, it also raises critical concerns regarding
user data privacy. In scenarios where the cloud server's trustworthiness is in
question, the need for a practical and adaptable method to safeguard data
privacy becomes imperative. In this paper, we introduce Ensembler, an
extensible framework designed to substantially increase the difficulty of
conducting model inversion attacks for adversarial parties. Ensembler leverages
model ensembling on the adversarial server, running in parallel with existing
approaches that introduce perturbations to sensitive data during colloborative
inference. Our experiments demonstrate that when combined with even basic
Gaussian noise, Ensembler can effectively shield images from reconstruction
attacks, achieving recognition levels that fall below human performance in some
strict settings, significantly outperforming baseline methods lacking the
Ensembler framework.