Dual branches for identity and expression, each privatized with its own history-dependent noise scale, gave a formal clip-level differential privacy guarantee for video generation
AspireAI community · arXiv
The paper presents TADP, a temporally adaptive differential privacy framework for inference-time privacy-preserving video generation under fixed-length clip-replacement adjacency. TADP uses a dual-branch design to extract identity and expression representations, then clips and privatizes both branches with temporally adaptive Gaussian mechanisms whose noise scales depend only on preceding privatized releases within the same clip and are bounded below by history-uniform calibrated minima, accounting for their joint release through adaptive Renyi differential privacy composition. The clip-level RDP guarantee is converted to an epsilon-delta guarantee, while soft quantization and subsequent temporal processing are applied only after privatization as DP post-processing. Experiments on facial expression datasets show reduced identity leakage under the evaluated attacks, usable perceptual quality and temporal stability, and high facial expression recognition utility relative to the evaluated privacy-preserving baselines. The method formally satisfies clip-level DP and empirically provides a favourable privacy-utility trade-off under the evaluated threat models and datasets. The limitation is that the privacy-utility comparison is against the specific baselines the authors evaluated, and the identity-leakage reduction is measured under those attack models rather than in a stronger adversarial setting.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.