ML Security PapersCLOAK: Contrastive Guidance for Latent Diffusion-Based Data Obfuscation
Published on arXiv
2512.12086
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
CLOAK consistently outperforms GAN-based and prior diffusion-based obfuscation methods across four time-series sensing datasets and facial images while being lightweight enough for resource-constrained IoT deployment.
CLOAK (Contrastive Classifier-Free Guidance)
Novel technique introduced
Data obfuscation is a promising technique for mitigating attribute inference attacks by semi-trusted parties with access to time-series data emitted by sensors. Recent advances leverage conditional generative models together with adversarial training or mutual information-based regularization to balance data privacy and utility. However, these methods often require modifying the downstream task, struggle to achieve a satisfactory privacy-utility trade-off, or are computationally intensive, making them impractical for deployment on resource-constrained mobile IoT devices. We propose Cloak, a novel data obfuscation framework based on latent diffusion models. In contrast to prior work, we employ contrastive learning to extract disentangled representations, which guide the latent diffusion process to retain useful information while concealing private information. This approach enables users with diverse privacy needs to navigate the privacy-utility trade-off with minimal retraining. Extensive experiments on four public time-series datasets, spanning multiple sensing modalities, and a dataset of facial images demonstrate that Cloak consistently outperforms state-of-the-art obfuscation techniques and is well-suited for deployment in resource-constrained settings.
Key Contributions
- CLOAK: a latent diffusion-based data obfuscation framework that operates in compressed latent space, making it deployable on resource-constrained IoT devices
- Contrastive Classifier-Free Guidance (CCFG) that uses contrastive learning to extract disentangled representations for guiding the diffusion process to suppress private while retaining public attributes
- Negated Classifier Guidance enabling flexible, user-configurable privacy-utility trade-off with minimal retraining
🛡️ Threat Analysis
CLOAK's obfuscated data is functionally adversarially crafted input designed to cause incorrect outputs (failed attribute inference) at inference time — a defense-side evasion attack against attribute inference classifiers. The threat model is a semi-trusted adversary running ML inference on shared data to extract private attributes; CLOAK defeats this by generating transformed inputs that fool the classifier while preserving utility for public tasks.