{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/honest-but-curious-nets-sensitive-attributes","title":"Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputs","arxiv_id":"2105.12049","date":"2021-05-25","proceeding":null,"authors":["Mohammad Malekzadeh","Anastasia Borovykh","Deniz Gündüz"],"abstract":"It is known that deep neural networks, trained for the classification of non-sensitive target attributes, can reveal sensitive attributes of their input data through internal representations extracted by the classifier. We take a step forward and show that deep classifiers can be trained to secretly encode a sensitive attribute of their input data into the classifier's outputs for the target attribute, at inference time. Our proposed attack works even if users have a full white-box view of the classifier, can keep all internal representations hidden, and only release the classifier's estimations for the target attribute. We introduce an information-theoretical formulation for such attacks and present efficient empirical implementations for training honest-but-curious (HBC) classifiers: classifiers that can be accurate in predicting their target attribute, but can also exploit their outputs to secretly encode a sensitive attribute. Our work highlights a vulnerability that can be exploited by malicious machine learning service providers to attack their user's privacy in several seemingly safe scenarios; such as encrypted inferences, computations at the edge, or private knowledge distillation. Experimental results on several attributes in two face-image datasets show that a semi-trusted server can train classifiers that are not only perfectly honest but also accurately curious. We conclude by showing the difficulties in distinguishing between standard and HBC classifiers, discussing challenges in defending against this vulnerability of deep classifiers, and enumerating related open directions for future studies.","url_abs":"https://arxiv.org/abs/2105.12049v3","url_pdf":"https://arxiv.org/pdf/2105.12049v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"honest-but-curious-nets-sensitive-attributes","repo_url":"https://github.com/mmalekzadeh/honest-but-curious-nets","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"attribute","task_name":"Attribute"},{"task_slug":"knowledge-distillation","task_name":"Knowledge Distillation"}],"methods":[{"method_slug":null,"method_name":null}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2105.12049","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2105.12049"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mmalekzadeh/honest-but-curious-nets","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":7},"by_repo_kind":{"official":{"samples":7,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"e8946d1ecabc29d4","entry":"evaluate_acc_get_preds","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/utils.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e8946d1ecabc29d4"}},{"code_sha256_prefix":"b39b08f87d4bb04e","entry":"evaluate_acc_par","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/utils.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b39b08f87d4bb04e"}},{"code_sha256_prefix":"c7a39c876507ab4b","entry":"get_data_loader","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/trainers.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/trainers.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c7a39c876507ab4b"}},{"code_sha256_prefix":"6b08d3288e7055fa","entry":"get_dataset","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/datasets.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6b08d3288e7055fa"}},{"code_sha256_prefix":"3b73a4b6772ca97d","entry":"prepare_labels","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/datasets.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3b73a4b6772ca97d"}},{"code_sha256_prefix":"eae8f48cdd38e317","entry":"train_model_par","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/trainers.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/trainers.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eae8f48cdd38e317"}},{"code_sha256_prefix":"b819f03228dbb4a9","entry":"train_model_reg","repo":"mmalekzadeh/honest-but-curious-nets","repo_kind":"official","path":"hbcnets/trainers.py","file_url":"https://github.com/mmalekzadeh/honest-but-curious-nets/blob/HEAD/hbcnets/trainers.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b819f03228dbb4a9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}