Kamalika Chaudhuri1, Chuan Guo1, Laurens van der Maaten1, Saeed Mahloujifar1,Mark Tygert11- Fundamental Artificial Intelligence Research at MetaProtecting privacy during inference with deep neural networks is possible by adding noise to the activationsin the last layers prior to the final classifiers or other task-specific layers. The activations insuch layers are known as “features” (or, less commonly, as “embeddings” or “feature embeddings”).The added noise helps prevent reconstruction of the inputs from the noisy features. Lower boundingthe variance of every possible unbiased estimator of the inputs quantifies the confidentiality arisingfrom such added noise. Convenient, computationally tractable bounds are available from classic inequalitiesof Hammersley and of Chapman and Robbins — the HCR bounds. Numerical experimentsindicate that the HCR bounds are on the precipice of being effectual for small neural nets with thedata sets, “MNIST” and “CIFAR-10,” which contain 10 classes each for image classification. TheHCR bounds appear to be insufficient on their own to guarantee confidentiality of the inputs toinference with standard deep neural nets, “ResNet-18” and “Swin-T,” pre-trained on the data set,“ImageNet-1000,” which contains 1000 classes. Supplementing the addition of noise to features withother methods for providing confidentiality may be warranted in the case of ImageNet. In all cases,the results reported here limit consideration to amounts of added noise that incur little degradation inthe accuracy of classification from the noisy features. Thus, the added noise enhances confidentialitywithout much reduction in the accuracy on the task of image classification.