Augmented Mixup Procedure for Privacy-Preserving Collaborative Training

ICLR 2026 Conference Submission18201 Authors

Keywords: privacy, mixup, InstaHide

TL;DR: We analyze three major attacks on InstaHide and identify a common vulnerability: attackers can solve the system of equations induced by InstaHide. To address this, we propose a modified mixup procedure that makes the problem ill-posed for attackers.

Abstract: Mixup, introduced by Zhang et al., is a regularization technique for training neural networks that generates convex combinations of input samples and their corresponding labels. Motivated by this approach, Huang et al. proposed InstaHide, an image encryption method designed to preserve the discriminative properties of data while protecting original information during collaborative training across multiple parties. However, recent studies by Carlini et al., Luo et al., and Chen et al. have demonstrated that attacks exploiting the linear system generated by the mixup procedure can compromise the security guarantees of InstaHide. To address this vulnerability, we propose a modified mixing procedure that introduces perturbations into samples before forming convex combinations, making the associated linear inverse problem ill-conditioned for adversaries. We present a theoretical worst-case security analysis and empirically evaluate the performance of our method in mitigating such attacks. Our results indicate that robust attack mitigation can be achieved by increasing the perturbation level, without causing a significant reduction in classification accuracy. Furthermore, we compare the performance of our approach with that of InstaHide on standard benchmark datasets, including MNIST, CIFAR-10, and CIFAR-100.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 18201