Partitioning for Intrinsic Model Inversion Resistance in Collaborative Inference

In collaborative inference (CI), transmitting intermediate representations $Z$ from edge devices enables model inversion attacks (MIA) that reconstruct the original inputs $X$, while existing defenses mainly perturb shallow-layer $Z$ at the cost of utility. We instead ask: *where should an edge–cloud model be partitioned to obtain intrinsic resistance to MIA?* We challenge the intuition that depth is the driver of MIA resistance, and show that depth is sufficient only insofar as it enables a representational transition; this transition is necessary for *intrinsic* resistance and is marked by an abrupt rise in the lower bound of $H(X|Z)$. Correspondingly, the decisive variance term in the entropy bound shifts from a global variance to the intra-class mean-squared radius $R^2_c$ rather than dimensionality alone, yielding an $R^2_c$-based criterion to locate the transition zone, or identify it post hoc from MIA outcomes, which we term the *Golden Partition Zone* (GPZ). We further explain how $R^2_c$ evolves during training and show that it can be controlled through the label distribution; we refer to this controllable dynamic behavior as the *Neural Vortex*, an analysis-backed explanatory concept. Across four representative deep vision models, partitioning at the GPZ yields over 4× higher reconstruction MSE compared to shallow splits; under entropy and inversion-model enhancements, decision-level representations provide 66\% stronger resistance than feature-level ones, and we further observe that data type affects both the transition boundary and reconstruction.

Modern AI services often split a deep vision model between a user’s device and a cloud server. This reduces the computation needed on the device, but it also means that the device must send internal information to the cloud. If an attacker sees this information, they may be able to reconstruct the user’s private input image. We study a simple but important question: where should the model be split so that the transmitted information is naturally harder to invert? A common belief is that using deeper layers is safer. Our work shows that this is not always true. What matters is whether the model’s internal representation has changed from detailed visual features into more decision-focused information. We identify this transition region and call it the Golden Partition Zone. Splitting the model there makes reconstruction much harder, even when attackers use stronger inversion models or try to enrich the transmitted information. We also explain how training choices can shape this transition, a behavior we call the Neural Vortex. Overall, our results provide practical guidance for designing safer edge–cloud AI systems without relying only on extra noise or heavy encryption.