Privacy defense against classification attack on Medical
12.6Attack Success Rate (Atk)ShredMI
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| ShredMIBackbone model=LLaMA-2-7B, Split layer (k)=4, r=2562026.06 | 12.6 | 5,213 | |
| LaplaceBackbone model=LLaMA-2-7B, Split layer (k)=4, b=0.52026.06 | 19.9 | 16,316 | |
| GaussianBackbone model=LLaMA-2-7B, Split layer (k)=4, σ=0.52026.06 | 26.7 | 4,222 | |
| Privacy AdaptersBackbone model=LLaMA-2-7B, Split layer (k)=4, r=256, λ=0.52026.06 | 51 | 60.1 | |
| LaplaceBackbone model=LLaMA-2-7B, Split layer (k)=4, b=0.12026.06 | 61.1 | 31.5 | |
| GaussianBackbone model=LLaMA-2-7B, Split layer (k)=4, σ=0.12026.06 | 68.7 | 21.4 | |
| NoPeekBackbone model=LLaMA-2-7B, Split layer (k)=42026.06 | 75.5 | 35.5 | |
| PCABackbone model=LLaMA-2-7B, Split layer (k)=4, PCA k=2562026.06 | 82.6 | 26.5 | |
| PCABackbone model=LLaMA-2-7B, Split layer (k)=4, PCA k=5122026.06 | 84.2 | 20.5 | |
| FisherBackbone model=LLaMA-2-7B, Split layer (k)=42026.06 | 84.4 | 10,134 | |
| No DefenseBackbone model=LLaMA-2-7B, Split layer (k)=42026.06 | 85.1 | 17.3 |