# Privacy-Preserving Task-Oriented Semantic Communications Against Model
Inversion Attacks

Yanhu Wang, Shuaishuai Guo, _Senior Member_ , _IEEE_ , Yiqin Deng, _Member_ ,
_IEEE_ ,
Haixia Zhang, _Senior Member_ , _IEEE_ , and Yuguang Fang,  _Fellow_ ,  _IEEE_
Yanhu Wang, Shuaishuai Guo, Yiqin Deng, and Haixia Zhang are with School of
Control Science and Engineering, Shandong University, Jinan, 250061, China
(e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>haixia.zhang@s du.edu.cn). Yuguang Fang is with
Department of Computer Science, City University of Hong Kong, Hong Kong, China
(e-mail: my.fang@cityu.edu.hk).

###### Abstract

Semantic communication has been identified as a core technology for the sixth
generation (6G) of wireless networks. Recently, task-oriented semantic
communications have been proposed for low-latency inference with limited
bandwidth. Although transmitting only task-related information does protect a
certain level of user privacy, adversaries could apply model inversion
techniques to reconstruct the raw data or extract useful information, thereby
infringing on users’ privacy. To mitigate privacy infringement, this paper
proposes an information bottleneck and adversarial learning (IBAL) approach to
protect users’ privacy against model inversion attacks. Specifically, we
extract task-relevant features from the input based on the information
bottleneck (IB) theory. To overcome the difficulty in calculating the mutual
information in high-dimensional space, we derive a variational upper bound to
estimate the true mutual information. To prevent data reconstruction from
task-related features by adversaries, we leverage adversarial learning to
train encoder to fool adversaries by maximizing reconstruction distortion.
Furthermore, considering the impact of channel variations on privacy-utility
trade-off and the difficulty in manually tuning the weights of each loss, we
propose an adaptive weight adjustment method. Numerical results demonstrate
that the proposed approaches can effectively protect privacy without
significantly affecting task performance and achieve better privacy-utility
trade-offs than baseline methods.

###### Index Terms:

Semantic communications, privacy-preservation, information bottleneck,
adversarial learning.

##  I Introduction

Recently, deep learning (DL) has achieved tremendous breakthroughs,
demonstrating exciting performance gain in computer vision, natural language
processing, speech recognition, and so on. Inspired by all these successes,
more and more researchers attempt to apply DL to communications. So far, there
exist a large number of papers investigating DL-based joint source-channel
coding (JSCC)[1], channel estimation[2], interference alignment[3], signal
detection[4], wireless resource allocation[5], etc. Numerical results
demonstrate that DL technology can effectively improve the performance of
communication systems[6]. However, many emerging intelligent applications
envisioned to be supported in 5G/6G systems, such as augmented/virtual reality
(AR/VR), autonomous driving, and environmental monitoring, present serious
design challenges to these DL-based communication systems that aim to transmit
data reliably. Taking autonomous driving as an example, during driving, the
in-vehicle sensing system collects large amounts of data, mainly images, high-
definition videos, and point clouds[7]. If all data is directly transmitted to
an edge server on the roadside for inference, it may cause excessive
communication delays when effective decision-making strategies are used to
save lives of passengers and other citizens.

To address the above problem, task-oriented semantic communication has been
proposed and recognized as a new communication paradigm for 6G mobile
communications[8, 9, 10]. This new paradigm has received intensive attention
lately, leading to the implementations of wireless image retrieval at the
edge[11, 12], one-device edge inference[13, 14], and multi-device cooperative
edge inference[7]. It enables low-latency inference by extracting and
transmitting task-relevant information at the transmitter. By transmitting the
task-related features instead of the original data, task-oriented semantic
communications can prevent privacy leakage to some extent. However,
adversaries could still apply model inversion techniques[15, 16, 17] to
recover the raw data or extract useful information, thereby infringing on
users’ privacy. To our best knowledge, there hardly exists any work addressing
privacy issues in task-oriented semantic communications.

Privacy-preservation has been a research focus in mobile devices and wireless
networks[18]. Many methods on privacy-preservation have been proposed in the
current literature, such as _k_ -anonymity[19], _l_ -diversity[20], and _t_
-closeness[21]. However, most of them do not scale well to handle high-
dimensional data. Besides, they cannot be easily adapted to semantic
communication systems. There are several reasons for this. Firstly, most
semantic communication systems are based on autoencoder architectures, and
training is carried out in an end-to-end manner. Directly transplanting
existing privacy methods into semantic communication systems may result in the
inability to train the semantic communication system. Secondly, it may
significantly affect the performance of semantic communication systems, such
as differential privacy methods (DP) [22, 23], which directly inject noise
into transmission features. Motivated by the aforementioned issues, in this
paper, we investigate privacy-preserving techniques for task-oriented semantic
communications to prevent privacy breaches.

In this paper, we propose IBAL - a scheme for privacy-preserving task-oriented
semantic communications. Since the IB theory [24] maximizes the mutual
information between the intermediate representation and the data labels while
reducing the amount of information between the intermediate representation and
the input, we leverage IB theory to extract task-related features. Inspired by
the work[16], we introduce adversarial learning[25] into task-oriented
semantic communications to protect privacy. That is, we simulate the game
between the DNNs of adversaries and the DNNs of the transmitter, and enable
the output features of the transmitter to fool potential adversaries by
maximizing the reconstruction distortion. The reason why we choose to maximize
distortion is that the transmitter may not know the specific intentions of
adversaries in advance. It is difficult to develop a unified and effective
privacy protection criterion considering all the diverse intentions of
adversaries. Maximizing distortion in the recovering raw data can protect all
kinds of private information to some extent. Compared with prior works[11, 12,
13, 14], we focus on the privacy issue in task-oriented semantic
communications. Compared with the DP approach, our approach does not cause a
significant negative impact on task performance. Moreover, considering the
impact of channel variations on task inference performance and privacy, we
propose a communication scheme based on IBAL.

Our main contributions in this paper can be summarized as follows.

  * •

We propose a privacy-preserving task-oriented semantic communication system
based on the IB theory and adversarial learning (IBAL). The proposed system
could extract and transmit task-related features for low-latency edge
inference while enhancing privacy, that is, not transmitting features that can
be used to reconstruct the original data by adversaries through the model
inversion technique.

  * •

To avoid intractable direct estimation of the mutual information in high-
dimensional space, we convert the minimization of IB loss into the
minimization of an upper bound of IB loss by variational approximation method.

  * •

Based on IBAL, we propose a communication scheme suitable for dynamic channel
conditions. In particular, we treat privacy-preserving task-oriented semantic
communications as a multi-objective optimization problem, and then solve it
with the multiple gradient descent algorithm (MGDA), which avoids manually
tuning the weights of each loss.

  * •

We evaluate the effectiveness of the developed privacy-preserving task-
oriented semantic communication schemes on image classification tasks.
Extensive numerical results demonstrate that, compared with baseline methods,
the proposed schemes can effectively protect privacy without significantly
affecting task performance.

The remainder of this paper is organized as follows. Section II introduces the
existing task-oriented semantic communication system model and model inversion
attacks, as well as the performance metrics adopted in the simulation. Problem
formulation is given in Section III, and IBAL and its extensions are proposed
for the problem. Section IV offers the numerical results. Section V concludes
this paper.

_Notation:_ In this paper, $Y$ represents a random variable and $y$ is the
realization of the corresponding random variable. $H(Y)$ stands for the
entropy of $Y$. $I(Y;Z)$ represents the mutual information between $Y$ and
$Z$. $\mathbb{E}(Y)$ represents the expectation of $Y$. $KL(\cdot||\cdot)$
stands for the Kullback-Leibler divergence, measuring the difference between
two probability distributions. $||\cdot||_{2}$ represents the $l_{2}$ norm of
a vector. Finally, $y\sim\mathcal{N}(\mu,\sigma^{2})$ denotes that $y$ follows
a Gaussian distribution with mean $\mu$ and covariance $\sigma^{2}$.

##  II System Model

In this section, we first describe existing task-oriented semantic
communication systems, and then introduce model inversion technique that can
reconstruct the transmitted features as the raw data. Finally, we discuss the
metrics used to evaluate the performance of our proposed privacy-preserving
task-oriented semantic communication system.

Fig. 1: Task-oriented semantic communication system. The green region
corresponds to the transmitting device, and the red region corresponds to the
receiving device. The transmitting device extracts and encodes task-related
information $z$ from the original data $s$ (e.g., an image), and the receiving
device directly leverages $\hat{z}$ to obtain the inference result $\hat{y}$.
Fig. 2: Model inversion attacks. The green region corresponds to the
transmitting device, and the purple region corresponds to the adversary
device. The transmitting device transmits the encoded feature $z$. Then, an
adversary device attempts to produce an approximate reconstruction $\tilde{s}$
of the original data based on the illegally obtained $\tilde{z}$, thereby
infringing the privacy of the user.

###  II-A Task-Oriented Semantic Communication Systems

As shown in Fig. 1, existing task-oriented semantic communication systems
generally consist of a transmitter network, physical channel, and a receiver
network, in which the transmitter network is composed of a feature extractor
and a joint source-channel (JSC) encoder while the receiver network only
includes task inference module.

We assume that the system input is $s\in\mathbb{R}^{n}$, which is from the
image space and contains task-related information and task-irrelevant
information. To enable low-latency inference, task-related information is
extracted by the feature extractor from $s$. Subsequently, the extracted
information is mapped to symbols $z\in\mathbb{C}^{k}$ by the JSC encoder for
efficient and reliable transmission. Note that at the transmitter, the feature
extractor can be designed jointly with the JSC encoder, denoted as
$T_{\theta}(\cdot)$, where $\theta$ is the trainable parameter set. The whole
encoding process can be expressed as

$z=T_{\theta}(s),$ (1)

The transmitted signal can be attenuated over the channel, and thus the
received signal at the receiver can be expressed as

$\hat{z}=hz+\epsilon,$ (2)

where $\hat{z}\in\mathbb{C}^{k}$, $h$ represents the coefficient of the
Rayleigh fading channel, and $\epsilon\sim{\cal
CN}(0,\sigma^{2}\mathbf{I}_{k\times k})$. Finally, the received signal
$\hat{z}$ is used by task inference module for edge inference with the
following inference result:

$\hat{y}=R_{\phi}(\hat{z}),$ (3)

where $\hat{y}\in\mathbb{R}^{l}$, and $R_{\phi}(\cdot)$ denotes the task
inference network with parameter set $\phi$.

The whole task-oriented semantic communications can be trained by the IB loss
function[13], which is given by

$\mathcal{L}_{IB}=-I(\hat{Z};Y)+\beta I(\hat{Z};S),$ (4)

where $S$, $Z$, $\hat{Z}$ and $Y$ are random variables while $s$, $z$,
$\hat{z}$, and $y$ are their instances, respectively. $I(\hat{Z};S)$ is the
mutual information, measuring the amount of information between variables
$\hat{Z}$ and $S$. $I(\hat{Z};Y)$ measures the amount of information between
$Y$ and $\hat{Z}$.

###  II-B Model Inversion Attacks

Model inversion attacks, proposed by Fredrikson[15], are attacks in which the
adversaries reconstruct the received features as the raw input using DNNs, and
then obtain users’ privacy. Below, we provide a detailed description of model
inversion attacks.

As shown in Fig. 2, the left is the transmitter network of the task-oriented
semantic communication system, which is actually deployed on the user’s
device. The right is the DNN $D_{\gamma}$, designed by the adversary and
deployed on the adversary’s device. The encoded feature $z$ of the transmitter
is illegally obtained by the adversary, and the obtained feature
$\tilde{z}\in\mathbb{C}^{k}$ can be expressed as

$\tilde{z}=h_{a}z+\epsilon_{a},$ (5)

where $h_{a}$ represents the adversary channel coefficients, and
$\epsilon_{a}\sim{\cal CN}(\mathbf{0},\sigma^{2}_{a}\mathbf{I}_{k\times k})$.
Then, the adversary attempts to produce an approximate reconstruction
$\tilde{s}$ of the user data based on $\tilde{z}$, i.e.

$\tilde{s}=D_{\gamma}(\tilde{z}).$ (6)

To obtain a better reconstruction, the adversary first trains $D_{\gamma}$. We
assume that the adversary performs model inversion through black-box
attack[26, 27]. In the process, the adversary can continuously access the
network model on the target device, but the adversary cannot obtain the model
parameters and training data on the target device. In detail, the adversary
first inputs the image data $s\in\mathcal{S}_{A}$ into the transmitter
network, and then the encoded feature $\hat{z}$ can be obtained. Here, we use
$\mathcal{S}_{A}$ to distinguish the adversary’s own dataset from the user’s
private data $\mathcal{S}$. After obtaining a large number of data pairs
$\\{\left(s\in\mathcal{S}_{A},\tilde{z}\right)\\}$, the adversary trains its
own decoder $D_{\gamma}$ based on these data pairs. $D_{\gamma}$ is committed
to minimize the reconstruction distortion, thus, the loss function is the mean
squared error (MSE):

$\mathcal{L}_{MSE}=\frac{1}{M}\sum_{i=1}^{M}\left\|s_{i}-\tilde{s}_{i}\right\|^{2},$
(7)

where $s_{i}$ is the $i$-th sample in $M$ image samples, and $\tilde{s}_{i}$
is its reconstruction.

###  II-C Performance Metrics

In this paper, we mainly focus on privacy issues in task-oriented semantic
communications and aim to make the privacy-utility trade-off. We assume that
the image classification task is performed at the receiver, therefore, the
classification accuracy is used to measure the task performance (corresponding
to the “utility”). Classification accuracy can be expressed as

${\rm Classification\ accuracy}=\frac{N_{t}}{N_{o}},$ (8)

where $N_{t}$ is the number of correctly classified images, $N_{o}$ is the
number of classified images.

Through model inversion techniques, adversaries can recover the raw data or
extract useful information, thereby infringing on users’ privacy. We maximize
the distortion of reconstructed images to reduce the invasion of users’
privacy by adversaries. That is, the higher the distortion of the
reconstructed image, the more difficult it is for adversaries to obtain
private information from it. Therefore, we use the quality of images
reconstructed by adversaries to measure the level of privacy protection.
Specifically, we use the peak signal-to-noise ratio (PSNR), which is one of
the commonly used metrics for measuring image quality. It can be expressed as

${\rm PSNR}=10\log_{10}\frac{\rm MaxValue^{2}}{\rm MSE}\quad(dB),$ (9)

where MSE is the mean squared error, MaxValue is the maximum value that a
pixel can take, for example, 8-bit image is $2^{8}-1=255$. The lower PSNR, the
better privacy.

PSNR is a metric of image quality based on the errors between corresponding
pixels, and does not take into account the visual characteristics of human
eyes. The structural similarity (SSIM)[28] measures the similarity between
images based on their luminance, contrast, and structure, which better
reflects the perceptual characteristics of human vision. SSIM is given by

$\begin{split}{\rm SSIM}(s,\hat{s})&={\rm luminance}(s,\tilde{s})^{\alpha
1}+{\rm contrast}(s,\tilde{s})^{\alpha 2}\\\ &\quad+{\rm
structure}(s,\tilde{s})^{\alpha 3}\\\
&=\left(\frac{2\mu_{s}\mu_{\tilde{s}}+c_{1}}{\mu_{s}^{2}+\mu_{\tilde{s}}^{2}+c_{1}}\right)^{\alpha
1}+\left(\frac{2\sigma_{s}\sigma_{\tilde{s}}+c_{2}}{\sigma_{s}^{2}+\sigma_{\tilde{s}}^{2}+c_{2}}\right)^{\alpha
2}\\\
&\quad+\left(\frac{cov(s,\tilde{s})+c_{3}}{\sigma_{s}\sigma_{\tilde{s}}+c_{3}}\right)^{\alpha
3},\end{split}$ (10)

where $\mu_{s}$ and $\mu_{\tilde{s}}$ are the mean values of $s$ and
$\tilde{s}$, $\sigma_{s}$ and $\sigma_{\tilde{s}}$ are the standard deviations
of $s$ and $\tilde{s}$, respectively. $cov(s,\tilde{s})$ is the covariance
between $s$ and $\tilde{s}$. $\alpha_{1}$, $\alpha_{2}$, and $\alpha_{3}$
respectively represent the proportion of the luminance, the contrast, and the
structure in the SSIM, and their values are typically set to 1. $c_{1}$,
$c_{2}$, and $c_{3}$ are typically set to 0.0001 to avoid division by zero.

##  III Privacy-Preserving Task-Oriented Semantic Communications

This paper focuses on privacy issues in task-oriented semantic communications.
More specifically, it aims to achieve low-latency edge inference while
preventing transmitted features from being reconstructed for raw data by
adversaries through model inversion attacks. To this end, combining (4) and
(7), we formulate the optimization problem as

$\begin{split}\min\limits_{\theta,\phi}\quad\lambda\mathcal{L}_{IB}-(1-\lambda)\mathcal{L}_{MSE},\\\
\end{split}$ (11)

where the range of $\lambda$ is $[0,1]$. The smaller $\lambda$, the stronger
the privacy-preservation.

###  III-A Problem Statement

Intuitively, it is promising to use (11) as the objective function for
privacy-preserving task-oriented semantic communications. The first term of
(11) is the loss function of the task inference performance, and the second
one could captures the reconstruction capability of the transmitted signals by
the adversary. However, in practice, there are still many issues to be
resolved as discussed below.

  * •

Problem 1: How to compute $\mathcal{L}_{IB}$?

The mutual information term in (11) (i.e., $\mathcal{L}_{IB}$) can be
expressed as follows:

$\begin{split}\mathcal{L}_{IB}&=-I(\hat{Z};Y)+\beta I(\hat{Z};S)\\\ &=-\int
p(y,\hat{z})\log\frac{p(y,\hat{z})}{p(y)p(\hat{z})}\,{dyd\hat{z}}\\\
&\quad+\beta\int
p(s,\hat{z})\log\frac{p(s,\hat{z})}{p(s)p(\hat{z})}\,{dsd\hat{z}}\\\ &=-\int
p(y|\hat{z})p(\hat{z})\log p(y|\hat{z})\,{dyd\hat{z}}-H(Y)\\\ &\quad+\beta\int
p_{\theta}(\hat{z}|s)p(s)\log\frac{p_{\theta}(\hat{z}|s)}{p(\hat{z})}\,{dsd\hat{z}},\end{split}$
(12)

where the entropy $H(Y)$ depends on input data and can be ignored when
performing optimization in (11). As can be seen from the system shown in Fig.
1 and the description in Section II.A, $p_{\theta}(\hat{z}|s)$ can be
expressed as $p_{\theta}(\hat{z}|s)=p_{\theta}(z|s)p_{channel}(\hat{z}|z)$,
where $p_{\theta}(z|s)$ is the encoding distribution and
$p_{channel}(\hat{z}|z)$ represents the channel model. With $p(\hat{z})$ and
$p(y|\hat{z})$ following Markov chain $Y\leftrightarrow
S\leftrightarrow\hat{Z}$, they can be written as

$\begin{split}p(\hat{z})=\int p(s)p_{\theta}(\hat{z}|s)\,{ds},\end{split}$
(13)

and

$\begin{split}p(y|\hat{z})&=\int p(s,y|\hat{z})\,{ds}\\\ &=\int
p(y|s)p(s|\hat{z})\,{ds}\\\
&=\int{ds}\,\frac{p(y|s)p_{\theta}(\hat{z}|s)p(s)}{p(\hat{z})}.\end{split}$
(14)

In (13) and (14), the calculations of integrals are involved, which is highly
complicated in general, especially in high-dimensional spaces, which also
makes $\mathcal{L}_{IB}$ hard to estimate and optimize. Thus, to make (11)
practical in task-oriented semantic communication systems to solve the privacy
problem, it is necessary to develop effective method to estimate
$\mathcal{L}_{IB}$.

  * •

Problem 2: How to train the whole system?

The existing task-oriented semantic communication system shown in Fig. 1
cannot be trained with (11) because the framework consists of feature
extractor, JSC encoder and task inference module, while (11) involves image
reconstruction. Therefore, it is desirable to design a new task-oriented
semantic communication system framework, in which the transmitter network is
co-trained with the task inference module while coping with the decoder.
Moreover, the extracted and transmitted features by the transmitter network
should be designed to be hard to decode by any decoder of adversaries other
than the intended decoder. So in theory, all possible decoders should be used
in the new communication system framework for the transmitter network to
learn. However, this is not obviously realistic. Thus, to better protect
privacy, an effective method should be developed for the transmitter to learn
to cope with all possible decoders of adversaries, so that the newly designed
task-oriented semantic communication system is not too complicated.

  * •

Problem 3: How to adaptively adjust $\lambda$ according to the dynamic channel
conditions?

The impact of channel variations on privacy need to be elaborated in more
detail. The adversary reconstructs the original images from the received
features through model inversion to reveal the privacy of a user. The worse
the image reconstruction quality, the better the privacy protection. When
channel conditions from the transmitter to the adversary become worse, the
transmitted features are more severely corrupted and more difficult to recover
from the raw input, and hence the privacy is enhanced. Of course, the task
inference performance will be affected as well. In practice, in face of worse
(or better) channel conditions, by considering both the requirements of task
inference performance and the enhancement of privacy with channel noise, the
user may increase (or decrease) $\lambda$ in (11). However, due to the trade-
off between privacy and task inference performance, which we call the privacy-
utility trade-off, it is hard to manually tune $\lambda$ to achieve
satisfactory results. Therefore, when considering the privacy-utility trade-
off and the effect of channel variations, it is essential to design a method
that can better achieve the privacy-utility trade-off.

Fig. 3: The framework of proposed IBAL. The green region corresponds to the
transmitting device, and the blue region corresponds to the receiving device.
Training procedure: We update the decoder using dataset $\mathcal{S}_{2}$
while fixing the transmitter network and task inference module. Then, we
update the transmitter network and task inference module using dataset
$\mathcal{S}_{1}$ while fixing the decoder. Communication procedure: The
transmitting device transmits the encoded feature $z$ that fools the
adversary, i.e., prevent reconstructing the input by the adversary, while
achieving edge inference through the task inference module.

###  III-B Variational Information Bottleneck

To solve Problem 1, we leverage the variational method to build a tractable
upper bound of information bottleneck loss. Specifically, due to the fact that
$p(\hat{z})$ and $p(y|\hat{z})$ in $\mathcal{L}_{IB}$ is hard to compute, we
seek a mutual information estimator to compute $\mathcal{L}_{IB}$. Recently,
some works[29, 30, 31] propose to combine the variational approximation with
deep learning to facilitate the estimation of mutual information. Following
these works, we leverage variational approximation to address our problem at
hand, i.e,

$\begin{split}p(\hat{z})=q(\hat{z})\quad{\rm and}\quad
p(y|\hat{z})&=q_{\phi}(y|\hat{z}),\end{split}$ (15)

where $\phi$ is the parameter set of task inference network at the receiver.

By introducing variational approximations (15), we could derive a tractable
variational upper bound for $\mathcal{L}_{IB}$ (see Appendix A), which is
given as[13]:

$\begin{split}\mathcal{\overline{L}}_{VIB}&=\mathbb{E}_{p(s,y)}\\{\mathbb{E}_{p_{\theta}(\hat{z}|s)}[-\log
q_{\phi}(y|\hat{z})]\\\ &\quad+\beta
KL(p_{\theta}(\hat{z}|s)||q(\hat{z}))\\}.\\\ \end{split}$ (16)

To obtain an unbiased estimate for $\mathcal{\overline{L}}_{VIB}$, we utilize
the reparameterization trick[32] and Monte Carlo approximation. In particular,
following [29], we use $\frac{1}{M-1}\sum_{j\neq m}p_{\theta}(\hat{z}|x_{j})$
to approximate $q(\hat{z})$, and then get

$\begin{split}\mathcal{\overline{L}}_{VIB}&\approx\frac{1}{M}\sum_{m=1}^{M}\Bigg{\\{}-\frac{1}{N}\sum_{n=1}^{N}\log
q_{\phi}(y_{m}|\hat{z}_{m,n})\\\
&\quad+\beta\log\frac{p_{\theta}(\hat{z}_{m}|s_{m})}{\frac{1}{M-1}\sum_{j\neq
m}p_{\theta}(\hat{z}_{m}|s_{j})}\Bigg{\\}},\end{split}$ (17)

where $M$ represents the number of sample pairs
$\\{(s_{m},y_{m})\\}_{m=1}^{M}$, and $N$ indicates the number of times to
sample the channel for each pair $(s_{m},y_{m})$. $p_{\theta}(\cdot)$ and
$q_{\phi}(\cdot)$ are the encoding network at the transmitter and task
inference network at the receiver, respectively.

Finally, formulation (11) can then be rewritten as

$\begin{split}\min\limits_{\theta,\phi}\quad\lambda\mathcal{\overline{L}}_{VIB}-(1-\lambda)\mathcal{L}_{MSE}.\\\
\end{split}$ (18)

###  III-C The Proposed IBAL

To solve Problem 2, we propose an information bottleneck and adversarial
learning (IBAL) approach.

####  III-C1 Model Description

The designed IBAL is as shown in Fig. 3. Similar to the transmitter network in
the task-oriented semantic communication system shown in Fig. 1, the
transmitter network in IBAL also consists of a feature extractor and a JSC
encoder to map the extracted feature values to channel input symbols for
subsequent transmissions. The difference is that the feature extractor in IBAL
needs to extract task-related features from raw data to ensure edge inference
performance, while ensuring that the extracted features can fool the
adversary.

The channel is modeled as a non-trainable layer, since the gradients need to
be back-propagated. Since we focus on privacy-preserving task-oriented
semantic communications, in this paper, we only consider additive white
Gaussian noise (AWGN) channels and Rayleigh fading channels for simplicity.
Besides, considering output power of the transmitter, an average power
constraint is imposed on the transmitted signal vectors, which is expressed as

$\frac{1}{k}\sum_{i=1}^{k}z_{i}^{2}\leq 1,$ (19)

where $k$ represents the dimension of $z$.

In practice, the adversary is not fixed, and it is difficult and impractical
to obtain the adversary’s network architecture. We construct a decoder to
simulate the adversary and introduce the designed communication system. The
fundamental purpose is to enable the transmitter network to learn to extract
and transmit features, which are difficult for the true adversary’s DNNs to
decode through model inversion.

####  III-C2 Model Training

To defend against model inversion attacks from any adversary, we utilize
adversarial learning in training a semantic communication system as listed in
Algorithm 1. Specifically, the algorithm describes a game between an adversary
trying to recover the original data from the received signal while a user
aiming to achieve privacy-preserving task-oriented semantic communications. As
illustrated in Algorithm 1, the training process of the IBAL consists of two
stages, which are performed alternately. After initializing the weights $W$
and biases $b$, input the training data $s_{1}\in\mathcal{S}_{1}$ and
$s_{2}\in\mathcal{S}_{2}$. Note that, the algorithm inputs different training
data because it simulates a game between an adversary and a user, and it is
impossible for an adversary to have a user’s dataset. The first stage is to
simulate an adversary. We train the decoder by minimizing the MSE loss
$\mathcal{L}_{MSE}$. In this stage, the parameters of the transmitter network
will not be updated since the transmitter network is deployed on the device of
the user. The second stage is to train the proposed communication system with
(18) as the training objective function. Different from the first stage, in
the second stage, except the decoder, the parameters of other neural networks
are updated. The two phases are performed alternately until the termination
criteria is met.

Algorithm 1 IBAL Training Algorithm

0: Initialize weights _W_ and biases _b_.

1: Input: Input data $s_{1}\in\mathcal{S}_{1}$ and $s_{2}\in\mathcal{S}_{2}$.

2: while termination criteria is not met do

3: Simulate an adversary:

4: $T_{\theta}(s_{2})\rightarrow z_{2}$.

5: Transmit $z_{2}$ over the channel.

6: $D_{\kappa}(\hat{z}_{2})\rightarrow\hat{s}_{2}$.

7: Calculate the loss $\mathcal{L}_{MSE}$ by (7).

8: Only update parameters of the decoder, $\kappa$.

9: Learn the privacy-preserving task-oriented semantic communication system:

10: $T_{\theta}(s_{1})\rightarrow z_{1}$.

11: Transmit $z_{1}$ over the channel.

12: $R_{\phi}(\hat{z}_{1})\rightarrow\hat{y}_{1}$ and
$D_{\kappa}(\hat{z}_{1})\rightarrow\hat{s}_{1}$.

13: Calculate the whole loss by (18).

14: Update parameters of the transmitter network and task inference module,
$\theta$ and $\phi$.

15: end while

16: Output: IBAL network $T_{\theta}(\cdot)$, $R_{\phi}(\cdot)$,
$D_{\kappa}(\cdot)$.

###  III-D The Proposed IBAL-D

To solve Problem 3, we extend the proposed IBAL under dynamic channel
conditions, namely IBAL-D.

####  III-D1 Method Description

As described in Problem 3, channel conditions can affect privacy. To capture
the impact, we modify the original objective function in (18). We use the
noise level $\sigma^{2}$ to represent the channel condition. Considering that
the image reconstruction quality is inversely proportional to noise, we
introduce $\sigma^{2}$ into (18) in the form of a decreasing function. In this
paper, for demonstration purpose, we adopt a heuristic discreasing function
${1}/{(1+\sigma^{2})}$ and reformulate the objective function as

$\begin{split}\min\limits_{\theta,\phi}\quad\lambda\mathcal{\overline{L}}_{VIB}-(1-\lambda)\frac{1}{1+\sigma^{2}}\mathcal{L}_{MSE}.\\\
\end{split}$ (20)

Next, we need to address how to adaptively adjust the value of $\lambda$
according to the channel condition. We treat the considered privacy-preserving
task-oriented semantic communications as a special multi-objective
optimization problem. For multi-objective optimization, its fundamental
purpose is to achieve Pareto efficiency. Under Pareto efficiency, neither task
inference performance nor privacy can be optimized without harming the other.
To solve the problem, we utilize the multiple gradient descent algorithm
(MGDA) proposed in [33]. Specifically, the MGDA performs Pareto optimization
based on the Karush-Kuhn-Tucker (KKT) conditions, which are given as follows:

$\left\\{\begin{array}[]{lr}\lambda\bigtriangledown_{\theta}\mathcal{\overline{L}}_{VIB}-(1-\lambda)\bigtriangledown_{\theta}\left(\frac{1}{1+\sigma^{2}}\mathcal{L}_{MSE}\right)=0,&\\\
0\leq\lambda\leq 1.&\\\ \end{array}\right.$ (21)

The KKT conditions are necessary conditions, and the solution satisfying (21)
is called a Pareto stationary point. To utilize the MGDA, we formulate the
optimization problem:

$\begin{split}\min\limits_{\lambda\in[0,1]}\left\|\lambda\bigtriangledown_{\theta}\mathcal{\overline{L}}_{VIB}-(1-\lambda)\bigtriangledown_{\theta}\left(\frac{1}{1+\sigma^{2}}\mathcal{L}_{MSE}\right)\right\|^{2}_{2}.\\\
\end{split}$ (22)

At this time, achieving Pareto efficiency becomes solving (22) for $\lambda$,
thereby adaptively adjusting $\lambda$.

According to [33] and [34], the solution of (22) is either 0 and the result
point satisfies (21), or the solution provides the gradient descent direction
of the improved edge inference task. From [35], it is known that (22) is a
convex quadratic optimization problem with linear constraints. We use the
Frank-Wolfe algorithm developed in [35] to obtain the optimal $\lambda^{*}$
(see Appendix B for details).

####  III-D2 Training Procedure

The training process of the communication network suitable for different
channel conditions is illustrated in Algorithm 2. Similar to Algorithm 1, the
whole process is still performed alternately between a simulating an adversary
and a learning user for privacy-preserving task-oriented semantic
communications. The difference mainly lies in the phase for learning privacy-
preserving task-oriented semantic communications.

Algorithm 2 IBAL-D Training Algorithm

0: Initialize weights _W_ and biases _b_.

1: Input: Input data $s_{1}\in\mathcal{S}_{1}$ and $s_{2}\in\mathcal{S}_{2}$.

2: while termination criteria is not met do

3: Simulate an adversary:

4: $T_{\theta}(s_{2})\rightarrow z_{2}$.

5: Transmit $z_{1}$ over the channel.

6: $D_{\kappa}(\hat{z}_{2})\rightarrow\hat{s}_{2}$.

7: Calculate the loss $\mathcal{L}_{MSE}$ by (7).

8: Only update parameter set of the decoder, $\kappa$.

9: Learn the privacy-preserving task-oriented semantic communication system:

10: $T_{\theta}(s_{1})\rightarrow z_{1}$.

11: Transmit $z_{1}$ over the channel.

12: $R_{\phi}(\hat{z}_{1})\rightarrow\hat{y}_{1}$ and
$D_{\kappa}(\hat{z}_{1})\rightarrow\hat{s}_{2}$.

13: Calculate $\mathcal{\overline{L}}_{VIB}$ and update $\phi$. Calculate
$\mathcal{L}_{MSE}$ but not update $\kappa$.

14: Solve (22) to obtain $\lambda^{*}$.

15: $T_{\theta}(s_{1})\rightarrow z_{1}$.

16: Transmit $z_{1}$ over the channel.

17: $R_{\phi}(\hat{z}_{1})\rightarrow\hat{y}_{1}$ and
$D_{\kappa}(\hat{z}_{1})\rightarrow\hat{s}_{1}$.

18: Calculate the whole loss by (18) and update $\theta$: $\theta=$
$\theta-\eta[\lambda^{*}\bigtriangledown_{\theta}\mathcal{\overline{L}}_{VIB}-(1-\lambda^{*})\bigtriangledown_{\theta}(\frac{1}{1+\sigma^{2}}\mathcal{L}_{MSE})]$.

19: end while

20: Output: IBAL-D network $T_{\theta}(\cdot)$, $R_{\phi}(\cdot)$,
$D_{\kappa}(\cdot)$.

###  III-E Convergence and Computational Complexity Analysis

This subsection first analyzes the convergence of our algorithm. The Adam
optimizer is adopted for the proposed IBAL approach due to its outstanding
convergence speed and performance. Thus, the convergence analysis is related
to the Adam optimizer. For simplicity, the objective function is denoted as
$F(\textbf{\emph{w}})$, where $\textbf{\emph{w}}=\\{\theta,\phi\\}$. Before
analyzing convergence, we present several assumptions commonly made in the
literature.

######  Assumption 1.

$F(\textbf{w})$ has an L-Lipschitz gradient in the sense that there exists
$L>0$, such that for any w and $\textbf{w}^{\prime}$ satisfying:

$\begin{split}F(\textbf{w}^{\prime})-F(\textbf{w})\leq\langle\nabla
F(\textbf{w}),\textbf{w}^{\prime}-\textbf{w}\rangle+\frac{L}{2}\left\|\textbf{w}^{\prime}-\textbf{w}\right\|_{2}^{2}\end{split}$
(23)

######  Assumption 2.

The gradient is bounded in the sense that $\mathbf{g}_{t}=\nabla
F_{t}\left(\textbf{w}^{(t)}\right)$ has an upper bound, i.e.

$\left\\{\begin{array}[]{lr}\left\|\nabla
F\left(\textbf{w}^{(t)}\right)\right\|_{2}\leq G,\forall t,&\\\
\left\|\mathbf{g}_{t}\right\|_{2}\leq G,\forall t.&\\\ \end{array}\right.$
(24)

######  Assumption 3.

The noisy gradient is unbiased and the noise is independent, i.e.,
$\textbf{g}_{t}=\nabla F\left(\textbf{w}^{(t)}\right)+\textbf{n}_{t}$,
$\textbf{n}_{t}$ satisfies $\mathbb{E}\left[\textbf{n}_{t}\right]=\textbf{0}$,
and $\textbf{n}_{t_{1}}$ is independent of $\textbf{n}_{t_{2}}$ when
$t_{1}\neq t_{2}$.

######  Assumption 4.

$\mathbf{g}_{1}=\nabla F_{1}\left(\textbf{w}^{(t)}\right)$ has a lower bound,
i.e.,

$\begin{split}\left\|\mathbf{g}_{1}\right\|_{2}\geq c,\forall t\end{split}$
(25)

######  Remark 1.

Assumptions 1-3 are the commonly used assumptions in analyzing convergence
[36, 37]. For Assumption 4, it refers to the scenario that the algorithm not
converging at the initial value, which is easily satisfied.

Our algorithm converges because of the following proposition.

######  Proposition 1.

Supposing that the assumptions 1-4 hold, with
$\beta_{1,t}\leq\beta_{1}\in[0,1)$ and $\beta_{1,t}$ is non-increasing,
$\eta_{t}=\frac{1}{\sqrt{t}}$, for any number of iterations $T$, we have

$\begin{split}{\rm min}_{t=1,2,\ldots,T}\mathbb{E}\left[\left\|\nabla
F\left(\textbf{w}^{(t)}\right)\right\|^{2}\right]=\frac{1}{\sqrt{T}}\left(G_{1}+G_{2}\log
T\right),\end{split}$ (26)

where $G_{1}$ and $G_{2}$ are two constants that are independent of $T$. It
can be observed that the convergence rate of our proposed algorithm is
$\mathcal{O}\left(\frac{\log T}{\sqrt{T}}\right)$.

_Proof:_ See Appendix C.

The computational complexity of the proposed IBAL mainly comes from
convolution operations, because they involve multiplications and additions.
The computational cost of a convolution layer can be expressed as $F\times
F\times C_{in}\times C_{out}\times W_{1}\times W_{2}$, where $F\times F$ is
the size of the filter, $C_{out}$ is the number of filters, $C_{in}$
represents the number of input channels, and $W_{1}\times W_{2}$ is the size
of the feature map. Assuming that the network has $K$ convolution layers, the
computational complexity of the proposed IBAL is
$\mathcal{O}\left(\sum\limits_{i=1}\limits^{K}(F^{(i)})^{2}C_{in}^{(i)}C_{out}^{(i)}W_{1}^{(i)}W_{2}^{(i)}\right)$.

##  IV Experiments and Discussions

In this section, we compare the proposed privacy-preserving task-oriented
semantic communications schemes with other DL-based communication schemes
under static and dynamic AWGN and Rayleigh fading channels. Image
classification task is chosen as an example to demonstrate the key idea of the
proposed approaches, which is to develop an end-to-end learning framework to
extract privacy-preserving task-oriented channel-robust low-dimensional latent
representations of data for transmission. It is noteworthy that the proposed
approaches are not specified for the image classification task.

TABLE I: The architecture settings of each module for MNIST classification task | Layer name |  | Output
---
dimensions
Transmitter | Dense+Tanh | 64
| Receiver
---
(Classifier)
| Dense+ReLU
---
Dense+ReLU
Dense+Softmax
| 1024
---
256
10
| Receiver
---
(Decoder)
Dense+Tanh | 784
TABLE II: The architecture settings of each module for CIFAR-10 classification task | Layer name |  | Output
---
dimensions
Transmitter |  |  (Convolutional layer+ReLU)$\times$2
---
Residual Block
(Convolutional layer+ReLU)$\times$3
Reshape+Dense+Tanh
|  128$\times$16$\times$16
---
128$\times$16$\times$16
8$\times$4$\times$4
128
| Receiver
---
(Classifier)
| Dense+ReLU+Reshape
---
Convolutional layer+ReLU
Residual Block
Pooling
Dense+Softmax
|  8$\times$4$\times$4
---
512$\times$4$\times$4
512$\times$4$\times$4
512
10
| Receiver
---
(Decoder)
| Dense+Tanh+Reshape
---
Convolutional layer+ReLU
(Deconvolutional layer+ReLU)$\times$2
Residual Block
Deconvolutional layer+ReLU
Convolutional layer+Sigmoid
|  8$\times$4$\times$4
---
512$\times$4$\times$4
128$\times$16$\times$16
128$\times$16$\times$16
64$\times$32$\times$32
3$\times$32$\times$32
TABLE III: The network architecture built by the adversary in the model inversion attack | Layer name |  | Output
---
dimensions
MNIST | Dense+Tanh | 784
| CIFAR-10
---
| Dense+Tanh+Reshape
---
Convolutional layer+ReLU
Convolutional layer+ReLU+Upsampling
Residual Block
Convolutional layer+ReLU+Upsampling
Residual Block
Convolutional layer+ReLU+Upsampling
Residual Block
Convolutional layer+Sigmoid
|  8$\times$4$\times$4
---
512$\times$4$\times$4
256$\times$8$\times$8
256$\times$8$\times$8
128$\times$16$\times$16
128$\times$16$\times$16
64$\times$32$\times$32
64$\times$32$\times$32
3$\times$32$\times$32

###  IV-A Experiment Setup

####  IV-A1 Datasets

To demonstrate the performance of the proposed schemes, the benchmark datasets
MNIST and CIFAR-10 are adopted. The MNIST dataset contains 70,000 grayscale
images of handwritten digits with a resolution of $28\times 28$, of which
60,000 are training images and 10,000 are testing images. The CIFAR-10 is a
color image dataset with 10 classes. There are 6000 images in each class,
including 5000 training images and 1000 testing images. The resolution of each
image is $32\times 32$. Note that for training images in the MNIST dataset, we
further split them into two parts, $\mathcal{S}_{2}$ with 2/3 for updating
$T_{\theta}$ and $R_{\phi}$, $\mathcal{S}_{1}$ with 1/3 for updating
$D_{\kappa}$. The same goes for the CIFAR-10 dataset.

####  IV-A2 Neural Network Architecture

(a) AWGN (b) Rayleigh Fading

Fig. 4: Classification accuracy and SSIM comparison of IBAL with baseline
schemes on the MNIST dataset over (a) AWGN and (b) Rayleigh fading channels.
Fig. 5: MNIST: from left to right, original, IBAL, NECST-G, NECST-G-
DP$\sim$0.9, NECST-G-DP$\sim$0.1, NECST-G-DP$\sim$0.05 and ESCS.

In the experiments, we design different neural network structures for the
MNIST and CIFAR-10 datasets as there is still no universal encoder/decoder
network for different datasets. The detailed architecture settings can be
found in Table I and Table II. During the training process, we adopt the Adam
optimizer with $\beta_{1}=0.9$, $\beta_{2}=0.99$, and learning rate
$lr=0.001$.

To verify the privacy-preserving capabilities of several baselines and the
proposed scheme, we simulate the adversary using model inversion attack to
reconstruct input images using the features transmitted through all
communication schemes. Table III shows the network architecture built by the
adversary in the model inversion attack. Besides, all baselines adopt the same
classification network as the proposed schemes for fair comparison.

####  IV-A3 Comparison algorithms

This paper selects the following DL-based communication schemes as baselines.

  * •

NECST-G: NECST[38] is a DL-based JSCC scheme, where the encoder outputs are
processed with discrete Bernoulli distributions and then pass through the
binary erasure channel (BEC) and the binary symmetric channel (BSC). In the
experiments, we process the outputs with Gaussian distributions and directly
transmit the encoder output through the AWGN channel and the Rayleigh channel.
To distinguish the original NECST, the adopted NECST is denoted as NECST-G. We
use the cross-entropy as the loss function of NECST-G.

  * •

NECST-G-DP: DP[22] offers a strong mathematical foundation for privacy
preservation. By adding Laplace noise within the DP framework, the privacy
level can be precisely controlled. In the experiments, we will combine NECST-G
with DP. Specifically, we inject Laplace noise into the transmitted features.
In the experiments, we will combine NECST-G with DP. Specifically, we inject
Laplace noise into the transmitted features. In the following experiments, we
set the location and scale parameters of Laplace distribution to $0$ and the
reciprocal of the privacy budget, respectively. The privacy budget is set to
$0.05$, $0.1$ and $0.9$, respectively. A smaller privacy budget means more
noise injected into the transmitted features, which also implies stronger
privacy protection.

  * •

ESCS[39]: ESCS is an encrypted semantic communication system for privacy
preserving, which utilizes symmetric encryption algorithms. Both the encryptor
and decryptor are composed of neural networks, and according to the setup in
[39], we use a key with one token in the experiment. The loss function of ESCS
is set to the cross-entropy.

###  IV-B Experiment Under Static Channel Conditions

Firstly, we investigate the performance of the proposed IBAL under static
channel conditions. The performance of the proposed IBAL is compared with
ESCS, NECST-G, NECST-G-DP$\sim$ $0.9$, NECST-G-DP$\sim$$0.1$, and NECST-G-
DP$\sim$$0.05$. The proposed IBAL and comparison schemes are trained under
SNR=15dB and tested under 7dB, 11dB, 15dB, 19dB and 23dB, respectively. In the
proposed IBAL, $\lambda$ is set to 0.5. In the experiment, we simulate the
adversary using features transmitted through all communication schemes to
reconstruct input images, and calculate the SSIM and PSNR between the
reconstructed and original images to characterize the privacy protection
capability of communication schemes. We also use the classification accuracy
to characterize edge inference performance.

Fig. 4 shows the classification accuracy versus SNR and SSIM versus SNR for
various schemes under AWGN and Rayleigh fading channels on the MNIST dataset.
As can be seen from Fig. 4(a), compared with NECST-G, the classification
accuracy of IBAL is slightly decreased, but the privacy protection ability is
significantly enhanced. When NECST-G uses DP to enhance privacy, edge
inference performance is more seriously affected. For example, NECST-G-
DP$\sim$0.05 provides the similar privacy protection to IBAL, but the
classification accuracy is $0.15\sim 0.2$ lower than IBAL. The classification
accuracy of ESCS is higher than that of IBAL, but its privacy protection
capability is significantly weaker than IBAL, and its performance is roughly
similar to NECST-G-DP$\sim$0.9. Fig. 4(b) shows the same tendency. Fig. 5
intuitively shows the MNSIT images obtained after reconstructing the
transmitted signals of each communication scheme using model inversion
attacks. These imply the necessity of our study on privacy-preserving task-
oriented semantic communications. It can be found that NECST-G-DP$\sim$0.05 is
comparable to the proposed IBAL in privacy preservation, where the former
injects Laplace noise into NECST with a privacy budget pf 0.05. In DP, the
smaller the privacy budget, the more noise is being injected. Due to the
injection of more Laplacian noise, the privacy protection capability of NECST-
G-DP$\sim$0.05 is enhanced, but its classification accuracy is greatly
reduced. On the contrary, the proposed IBAL obtains the smallest SSIM with
acceptable task performance loss.

Fig. 6: Classification accuracy and SSIM of communication schemes in the MNIST
classification task under different latency with SNR=15dB.

In addition, we assume that the wireless channel models have the same SNR
value 15dB in the training and testing phases. Then, we record the inference
accuracy as well as the level of privacy protection for different
communication latency. In the experiments, the bandwidth is set to $12.5$kHz
with a symbol rate of $9,600$ Baud, corresponding to a limited bandwidth. Fig.
6 shows the classification accuracy and SSIM values of IBAL, ESCS, NECST-G,
and NECST-G-DP$\sim$0.1 on the MNIST dataset. It is observed that, under the
same latency, compared with other algorithms, our proposed IBAL can not only
provide the best privacy protection, but also ensure good task inference
performance. This shows that our proposed method can extract task-related
features efficiently, and these features are difficult to decode by the
adversary’s decoder.

Next, we also investigate the classification accuracy and PSNR obtained by the
proposed IBAL and NECST-G, and NECST-G-DP on the CIFAR-10 dataset, as
illustrated in Fig. 7. It can be seen that the proposed IBAL not only achieves
the best classification accuracy but also obtains the smallest PSNR. In Fig.
8, the CIFAR-10 images obtained after reconstructing the transmitted signals
of these schemes using model inversion attacks are shown. These results
further validate that the proposed IBAL improves the privacy-preserving
ability without significantly affecting the task inference performance, which
achieves better privacy-utility trade-off compared to baselines.

Fig. 7: Classification accuracy and PSNR comparison of IBAL with baseline
schemes on the CIFAR-10 dataset over AWGN channels. Fig. 8: CIFAR-10: from
left to right, original, IBAL, NECST-G, NECST-G-DP$\sim$0.9, NECST-G-
DP$\sim$0.1 and NECST-G-DP$\sim$0.05. Fig. 9: Classification accuracy and SSIM
comparison of IBAL-D with other schemes on the MNIST dataset over AWGN
channel.

###  IV-C Experiment Under Dynamic Channel Conditions

The main purpose of this experiment is to evaluate the performance of the
proposed IBAL-D under dynamic channel conditions. We use NECST-G, NECST-G-
DP$\sim$0.1, and IBAL as comparison algorithms for IBAL-D. In the proposed
IBAL, $\lambda$ is set to 0.5. All comparison algorithms are evaluated under
SNR=15dB. For IBAL-D, we let the SNR vary between 7dB and 23dB during
training.

Fig. 9 shows the classification accuracy and SSIM obtained by the proposed
IBAL-D and the comparison algorithms on the MNIST dataset. It can be observed
that compared with the baselines and IBAL, IBAL-D could ensure a smaller
reduction in classification accuracy while achieving privacy protection. The
proposed IBAL-D can adjust the level of privacy protection according to the
channel state, and better guarantee the edge task inference under low SNR.
Specifically, when the channel state is poor, IBAL-D will increase $\lambda$,
and hence the extracted features can better maintain the inference
performance. The poor channel state can make up for the decrease in the
privacy protection ability caused by the increase of $\lambda$. When the
channel state is good, IBAL-D will decrease $\lambda$, making it more
difficult for the transmitted features to be restored as the original data,
hence enhancing privacy protection.

In Section III, we treat the privacy-preserving task-oriented semantic
communications problem as a multi-objective optimization problem, and then
solve it with the MGDA algorithm. To verify the effectiveness of the proposed
method, we choose IBAL-D without using the method, namely IBAL-D-NO, as the
comparison algorithm. To ensure fairness, the SNR during training was also set
to vary from 7dB to 23dB for IBAL-D-NO. Fig. 10 shows the classification
accuracy and SSIM obtained by the proposed IBAL-D and IBAL-D-NO under AWGN and
Rayleigh fading channels on the MNIST dataset. It can be seen that with the
help of the proposed method, IBAL-D obtained better privacy-utility trade-off
while avoiding manually adjusting the weights.

Fig. 10: Classification accuracy and SSIM comparison of IBAL-D with IBAL-D-NO
on the MNIST dataset over AWGN channel (top) and Rayleigh fading channel
(bottom).

###  IV-D Performance over Rapidly Changing Channel Conditions

Fig. 11: Performance over rapidly changing channel conditions.

To show the performance of the proposed IBAL approach over rapidly changing
channel conditions, we further conduct more experiments. Specifically, when
the channel is rapidly changing, the estimated channel information $\hat{h}$
may be outdated. We model the fast variation of the channel as a Gaussian
random variable, and the real channel can be expressed as

$h=\hat{h}+h_{\epsilon},$ (27)

where $h_{\epsilon}$ is Gaussian distributed with zero mean and covariance
$\sigma^{2}_{e}$. Simulation results are demonstrated in Fig. 11. It is shown
that the comparison algorithm can achieve better privacy protection
performance due to the channel mismatch, resulting in a lower SSIM. However,
its classification accuracy also significantly decreases due to the channel
mismatch. On the contrary, our proposed algorithm possesses better robustness
and significantly outperforms the comparison algorithms in terms of
classification accuracy under fast-varying channels. Moreover, our method can
realize the improvement of privacy protection performance with the increase of
SNR due to the introduction of the adaptive weight adjustment strategy.

###  IV-E Test with Imperfect Source Data

The quality of the data also affects the performance of the training. To show
the robustness of the proposed IBAL approach with an imperfect source data, we
conduct experiments on sparse source data with different sparsity ratios.
Specifically, we randomly zero out some elements in the data set to achieve
sparsification. In Fig. 12 we perform sparse processing on the CIFAR-$10$
dataset with sparse ratios of $10\%$ and $30\%$, respectively. It can be
observed that as the sparsity increases, both our proposed algorithm and the
comparative algorithm experience a decrease in classification accuracy and
SSIM performance. This is because data sparsity leads to a reduction in useful
information, which in turn affects the training performance. However, despite
this decline, our algorithm outperforms the comparative algorithm in terms of
both classification accuracy and privacy protection. Specifically, the
classification accuracy of the comparative algorithm significantly decreases
due to the impact of data sparsity, whereas our proposed algorithm utilizes
information bottleneck to better extract meaningful semantic information. As a
result, it demonstrates robust performance even in sparse data scenarios.

Fig. 12: Test results with imperfect source data of different sparsity ratios.

###  IV-F Test with Large-scale Dataset

Fig. 13: Classification accuracy and SSIM of IBAL and NECST-G and
NECST-G$\sim$0.05 on the ImageNet2012 dataset.

In order to enhance the generality of our proposed method across multiple
datasets, we introduce a data adaptation network that maps large-scale complex
datasets into lower-dimensional and easier-to-process datasets. To evaluate
the performance of the proposed IBAL approach with large-scale dataset, we
conduct more experiments on ImageNet2012 dataset. ImageNet2012 contains $1000$
image classes, the training dataset has about $1300$ images per class, and the
validation set has $50$ images per class. For the experiments in this
subsection, we select $10$ of these classes. Following the basic settings in
Section IV.B, we compare the proposed IBAL with NECST-G and NECST-G-DP$\sim
0.05$. Fig. 13. shows that our proposed method has the best classification
accuracy and good privacy protection.

Fig. 14: The framework of combining IBAL with encryption. Fig. 15:
Classification accuracy and SSIM of combining IBAL with encryption on the
MNIST dataset.

###  IV-G Experiments of Combining IBAL with Encryption

The proposed IBAL approach and existing privacy-preserving techniques are not
mutually exclusive. In Fig. 14, we give the framework of combining IBAL with a
non-blackbox approach. Specifically, an encryptor is incorporated to perform
encryption using the key after the output of the JSC encoder, and a decryptor
is introduced before the task inference network using the shared key, and the
key is only shared between the transmitter and receiver, but cannot be
accessed by the decoder. Then in Fig. 15, we present the performance of the
proposed algorithm in combination with the non-blackbox approach, which is
depicted by the ‘IBAL-E’ curve in Fig. 15. It is shown that integrating non-
black-box algorithms with the proposed approach can substantially enhance the
performance of privacy protection. Specifically, based on the SSIM metric, the
performance shows a significant improvement of $21\%$. At the same time,
IBAL-E still maintains high classification accuracy.

##  V Conclusion

In this paper, we have proposed a privacy-preserving task-oriented semantic
communication system, named IBAL, which could effectively protect users’
privacy while enabling low-latency edge inference. In IBAL, task-related
information is extracted from the input at the transmitter based on the IB
theory. To overcome the computational difficulty in calculating some mutual
information metrics needed for the IB loss, we have derived a tractable
variational upper bound for the IB loss by leveraging the variational
approximation. Moreover, we have adopted adversarial learning to make it more
difficult to uncover the original data from the intercepted transmitted
features through model inversion. Extensive experimental results have
demonstrated that the IBAL achieves a significantly better privacy-utility
trade-off. Further, we have extended the IBAL to make it more suitable under
dynamic channel conditions. In particular, to avoid manually tuning the loss
weights, we have treated the privacy-preserving task-oriented semantic
communication problem as a multi-objective optimization problem and solved it
with the MGDA. Extensive simulation results show that our proposed algorithm
is effective on dynamic channels, fast-varying channels, imperfect datasets,
and large-scale datasets.

##  Appendix A Derivation of Variational Upper Bound for $\mathcal{L}_{IB}$

In this appendix, we derive the variational upper bound of $\mathcal{L}_{IB}$,
i.e., $\mathcal{\overline{L}}_{VIB}$. The process is divided into the
derivation of the variational upper bound of $I(\hat{Z};S)$ and the derivation
of the variational lower bound of $I(\hat{Z};Y)$, as shown below.

The definition of $I(\hat{Z};S)$ can be written as

$\begin{split}I(\hat{Z};S)&=\int
p(s)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)}{p(\hat{z})}\,{dsd\hat{z}},\end{split}$
(28)

where $p(\hat{z})$ is intractable, as described in Section III. We introduce
the variational approximation $q(\hat{z})$ into (28), so that (28) can be
rewritten as

$\begin{split}I(\hat{Z};S)&=\int
p(s)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)q(\hat{z})}{p(\hat{z})q(\hat{z})}\,{dsd\hat{z}}\\\
&=\int
p(s)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)}{q(\hat{z})}\,{dsd\hat{z}}\\\
&\quad+\int p(\hat{z})\log\frac{q(\hat{z})}{p(\hat{z})}\,{d\hat{z}}\\\ &=\int
p(s)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)}{q(\hat{z})}\,{dsd\hat{z}}\\\
&\quad-KL(p(\hat{z})||q(\hat{z})),\end{split}$ (29)

where KL divergence is non-negative. Drop the term and we obtain the
variational upper bound of $I(\hat{Z};S)$, i.e.,

$\begin{split}I(\hat{Z};S)&\leq\int
p(s)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)}{q(\hat{z})}\,{dsd\hat{z}}\\\
&=\int
p(s,y)p_{\theta}(\hat{z}|s)\log\frac{p_{\theta}(\hat{z}|s)}{q(\hat{z})}\,{dsdyd\hat{z}}\\\
&=\mathbb{E}_{p(s,y)}KL(p_{\theta}(\hat{z}|s)||q(\hat{z})).\end{split}$ (30)

$I(\hat{Z};Y)$ can be written as

$\begin{split}I(\hat{Z};Y)&=\int
p(\hat{z})p(y|\hat{z})\log\frac{p(y|\hat{z})}{p(y)}\,{dyd\hat{z}}\\\ &=\int
p(\hat{z})p(y|\hat{z})\log p(y|\hat{z})\,{dyd\hat{z}}\\\ &\quad-\int p(y)\log
p(y)\,{dy}\\\ &=\int p(\hat{z})p(y|\hat{z})\log
p(y|\hat{z})\,{dyd\hat{z}}+H(Y),\end{split}$ (31)

where $H(Y)$, representing the entropy of $Y$, is a constant. Drop $H(Y)$ and
we get a lower bound of $I(\hat{Z};Y)$ as follows:

$\begin{split}I(\hat{Z};Y)&\geq\int p(\hat{z})p(y|\hat{z})\log
p(y|\hat{z})\,{dyd\hat{z}}\\\ &=\int p(s,y,\hat{z})\log
p(y|\hat{z})\,{dsdyd\hat{z}}\\\ &=\int p(s,y)p_{\theta}(\hat{z}|s)\log
p(y|\hat{z})\,{dsdyd\hat{z}}\\\
&=\mathbb{E}_{p(s,y)}\mathbb{E}_{p_{\theta}(\hat{z}|s)}[\log
p(y|\hat{z})].\end{split}$ (32)

Since $p(y|\hat{z})$ is intractable, we use $q_{\phi}(y|\hat{z})$ to
approximate $p(y|\hat{z})$, so that (32) can rewritten as

$\begin{split}I(\hat{Z};Y)&\geq\mathbb{E}_{p(s,y)}\mathbb{E}_{p_{\theta}(\hat{z}|s)}[\log
q_{\phi}(y|\hat{z})].\end{split}$ (33)

Combining (30) and (33), we obtain the tractable variational upper bound of
$\mathcal{L}_{IB}$ as follows:

$\begin{split}\mathcal{\overline{L}}_{VIB}&=\mathbb{E}_{p(s,y)}\\{\mathbb{E}_{p_{\theta}(\hat{z}|s)}[-\log
q_{\phi}(y|\hat{z})]\\\ &\quad+\beta
KL(p_{\theta}(\hat{z}|s)||q(\hat{z}))\\}.\end{split}$ (34)

##  Appendix B The Solution of (22)

For simplicity, we use $\bm{\Theta}$ and $\bm{\overline{\Theta}}$ to represent
$\bigtriangledown_{\theta}\mathcal{\overline{L}}_{VIB}$ and
$-\bigtriangledown_{\theta}(\frac{1}{1+\sigma^{2}}\mathcal{L}_{MSE})$ in (22),
respectively, and then (22) is rewritten as

$\begin{split}\min_{\lambda\in[0,1]}\parallel\lambda\bm{\Theta}+(1-\lambda)\bm{\overline{\Theta}}\parallel_{2}^{2}.\end{split}$
(35)

From [34], the optimization problem defined by (35) is equivalent to finding
the minimum norm point in the convex hull of two points. In computational
geometry, it is equivalent to finding the closest point in the convex hull to
a given query point. Following the work[34], we use the Frank-Wolfe algorithm
developed in [35] to solve our optimization problem at hand, i.e., (35). The
specific procedures for Frank-Wolfe are illustrated in Algorithm 4.

Algorithm 3
$\min_{\lambda\in[0,1]}\parallel\lambda\bm{\Theta}+(1-\lambda)\bm{\overline{\Theta}}\parallel_{2}^{2}$

1: if $\bm{\Theta^{\top}\overline{\Theta}\geq\Theta^{\top}\Theta}$ then

2: $\lambda=1$.

3: else if
$\bm{\Theta^{\top}\overline{\Theta}\geq\overline{\Theta}^{\top}\overline{\Theta}}$
then

4: $\lambda=0$.

5: else

6:
$\lambda=\frac{(\bm{\overline{\Theta}}-\bm{\Theta})^{\top}\bm{\overline{\Theta}}}{\parallel\bm{\Theta}-\bm{\overline{\Theta}}\parallel^{2}_{2}}$.

7: end if

Algorithm 4 Procedures for Frank-Wolfe Algorithm

1: Initialize $\bm{\Lambda}=(\lambda,1-\lambda)=(0.5,0.5)$.

2: Precompute M,
$\rm\textbf{M}=\left[\begin{array}[]{lr}\Theta^{\top}\Theta,\quad\Theta^{\top}\overline{\Theta}&\\\
\overline{\Theta}^{\top}\Theta,\quad\overline{\Theta}^{\top}\overline{\Theta}&\end{array}\right]$

3: repeat

4:
$\hat{t}=\arg\min_{\emph{r}}\sum_{\emph{t}}\bm{\Lambda}_{t}\textbf{M}_{rt}$.

5: Using Algorithm 3:
$\hat{\lambda}=\arg\min_{\lambda}((1-\lambda)\bm{\Lambda}+\lambda\bm{e_{\hat{t}}})^{\top}\textbf{M}((1-\lambda)\bm{\Lambda}+\lambda\bm{e_{\hat{t}}})$.

6: $\bm{\Lambda}=(1-\hat{\lambda})\bm{\Lambda}+\hat{\lambda}\bm{e_{\hat{t}}}$.

7: until $\hat{\lambda}\sim 0$ or number of iterations limit.

8: return $\bm{\Lambda}$.

##  Appendix C Proof of proposition 1

###### Proof:

To facilitate the understanding of the proof, we first provide the iteration
formula of variables for Adam, i.e.

$\left\\{\begin{array}[]{lr}\mathbf{m}^{(t)}=\beta_{1}\mathbf{m}^{(t-1)}+(1-\beta_{1})\mathbf{g}_{t},&\\\
\hat{\mathbf{m}}^{(t)}=\mathbf{m}^{(t)}/(1-\beta_{1}^{t}),&\\\
\mathbf{v}^{(t)}=\beta_{2}\mathbf{v}^{(t-1)}+(1-\beta_{2})\mathbf{g}^{2}_{t},&\\\
\hat{\mathbf{v}}^{(t)}=\max\left(\hat{\mathbf{v}}^{(t-1)},\mathbf{v}^{(t)}/\left(1-\beta_{2}^{t}\right)\right),&\\\
\textbf{\emph{w}}^{(t+1)}=\textbf{\emph{w}}^{(t)}-\eta_{t}\hat{\mathbf{m}}^{(t)}/\sqrt{\hat{\mathbf{v}}^{(t)}},&\\\
\end{array}\right.$ (36)

where $\mathbf{g}_{t}=\nabla F_{t}\left(\textbf{\emph{w}}^{(t)}\right)$.

According to the analysis in [37], we can get

$\begin{split}&\mathbb{E}\left[\sum_{t=1}^{T}\eta_{t}\left\langle\nabla
F\left(\textbf{\emph{w}}^{(t)}\right),\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)/\sqrt{\hat{\mathbf{v}}^{(t-1)}}\right\rangle\right]\\\
&\leq\mathbb{E}\Bigg{[}\underbrace{C_{1}\sum_{t=1}^{T}\left\|\eta_{t}\mathbf{g}_{t}/\sqrt{\hat{\mathbf{v}}^{(t)}}\right\|^{2}}_{\rm{Term\
A}}\\\
&\quad+\underbrace{C_{2}\sum_{t=2}^{T}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|_{1}}_{\rm{Term\
B}}\\\
&\quad+\underbrace{C_{3}\sum_{t=2}^{T-1}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|^{2}}_{\rm{Term\
C}}\Bigg{]}+C_{4},\end{split}$ (37)

where $C_{1}$, $C_{2}$, $C_{3}$ are constants independent of the vector
dimension $d$ and the number of iterations $T$ , $C_{4}$ is a constant
independent of $T$. Next, we will handle items: $\rm{Term\ A}$, $\rm{Term\
B}$, and $\rm{Term\ C}$, separately.

For $\rm{Term\ A}$, $\hat{\mathbf{v}}^{(1)}$ satisfies: ${\rm
min}_{i=1,2,\ldots,d}\left(\sqrt{\hat{v}^{(1)}_{i}}\right)\geq c>0$. Proof by
contradiction is easy to demonstrate. If the condition is not satisfied, i.e.,
$\exists\sqrt{\hat{v}^{(1)}_{i}}=0$, then w cannot be updated in (36), and the
algorithm will cause an error. Substituting the condition in $\rm{Term\ A}$,
we can obtain

$\begin{split}&\mathbb{E}\left[\sum_{t=1}^{T}\left\|\eta_{t}\mathbf{g}_{t}/\sqrt{\hat{\mathbf{v}}^{(t)}}\right\|^{2}\right]\\\
&\overset{(a)}{\leq}\mathbb{E}\left[\sum_{t=1}^{T}\left\|\eta_{t}\mathbf{g}_{t}/c\right\|^{2}\right]\\\
&=\mathbb{E}\left[\sum_{t=1}^{T}\left\|\frac{1}{\sqrt{t}}\mathbf{g}_{t}/c\right\|^{2}\right]\\\
&=\mathbb{E}\left[\sum_{t=1}^{T}\left(\frac{1}{c\sqrt{t}}\right)^{2}\left\|\mathbf{g}_{t}\right\|^{2}\right]\\\
&\overset{(b)}{\leq}G^{2}/c^{2}\sum_{t=1}^{T}\frac{1}{t}\\\
&\overset{(c)}{\leq}G^{2}/c^{2}(1+\log T),\end{split}$ (38)

where (a) is due to
$\hat{v}^{(t)}_{i}=\max\left(\hat{v}^{(t-1)}_{i},\frac{v^{(t)}}{1-\beta_{2}^{t}}\right)\geq\hat{v}^{(t-1)}_{i}$,
(b) is due to Assumption 4, i.e., $\left\|\mathbf{g}_{t}\right\|=\left\|\nabla
F_{t}\left(\textbf{\emph{w}}^{(t)}\right)\right\|\leq G$, and (c) is due to
$\sum_{t=1}^{T}\frac{1}{t}\leq 1+\log T$.

For $\rm{Term\ B}$, we have

$\small\begin{split}&\mathbb{E}\left[\sum_{t=2}^{T}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|_{1}\right]\\\
&\overset{(a)}{=}\mathbb{E}\left[\sum_{i=1}^{d}\sum_{t=2}^{T}\left(\frac{\eta_{t-1}}{\sqrt{\hat{v}^{(t-1)}_{i}}}-\frac{\eta_{t}}{\sqrt{\hat{v}^{(t)}_{i}}}\right)\right]\\\
&\overset{(b)}{=}\mathbb{E}\left[\sum_{i=1}^{d}\left(\frac{\eta_{1}}{\sqrt{\hat{v}^{(1)}_{i}}}-\frac{\eta_{T}}{\sqrt{\hat{v}^{(T)}_{i}}}\right)\right]\\\
&\leq\mathbb{E}\left[\sum_{i=1}^{d}\frac{\eta_{1}}{\sqrt{\hat{v}^{(1)}_{i}}}\right]\\\
&\leq d/c,\end{split}$ (39)

where (a) is because $\hat{v}^{(t)}_{i}\geq\hat{v}^{(t-1)}_{i}$ and
$\eta_{t}\leq\eta_{t-1}$, and (b) is by expanding $\sum_{t=2}^{T}$ and
merging.

For $\rm{Term\ C}$, it can be transformed into

$\begin{split}&\mathbb{E}\left[\sum_{t=2}^{T-1}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|^{2}\right]\\\
&\overset{(a)}{\leq}\mathbb{E}\left[\frac{1}{c}\sum_{t=2}^{T-1}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|_{1}\right]\\\
&\leq d/c^{2},\end{split}$ (40)

where (a) is due to
$\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|_{1}\leq
1/c$ which can be seen from (LABEL:termb).

Combining with (LABEL:EUB), (LABEL:terma), (LABEL:termb), and (LABEL:termc),
we obtain

$\small\begin{split}&\mathbb{E}\Bigg{[}C_{1}\sum_{t=1}^{T}\left\|\eta_{t}\mathbf{g}_{t}/\sqrt{\hat{\mathbf{v}}^{(t)}}\right\|^{2}+C_{2}\sum_{t=2}^{T}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|_{1}\\\
&\quad+C_{3}\sum_{t=2}^{T-1}\left\|\frac{\eta_{t}}{\sqrt{\hat{\mathbf{v}}^{(t)}}}-\frac{\eta_{t-1}}{\sqrt{\hat{\mathbf{v}}^{(t-1)}}}\right\|^{2}\Bigg{]}+C_{4}\\\
&\leq C_{1}G^{2}/c^{2}\left(1+\log
T\right)+C_{2}d/c+C_{3}d/c^{2}+C_{4}.\end{split}$ (41)

Scaling the left side of (LABEL:EUB), we get

$\begin{split}&\mathbb{E}\left[\sum_{t=1}^{T}\eta_{t}\left\langle\nabla
F\left(\textbf{\emph{w}}^{(t)}\right),\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)/\sqrt{\hat{\mathbf{v}}^{(t-1)}}\right\rangle\right]\\\
&\overset{(a)}{\geq}\mathbb{E}\left[\sum_{t=1}^{T}\frac{1}{G\sqrt{t}}\left\|\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)\right\|^{2}\right]\\\
&\geq\frac{\sqrt{T}}{G}{\rm min}_{t=1,2,\ldots,T}\mathbb{E}\left[\left\|\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)\right\|^{2}\right].\end{split}$ (42)

As $\hat{\mathbf{v}}^{(t)}$ is the exponential moving average of
$\mathbf{g}_{t}^{2}$, and $\left\|\mathbf{g}_{t}\right\|\leq G$, we obtain
$\hat{\mathbf{v}}^{(t)}\leq G^{2}$. And (a) is precisely due to this fact.

From (LABEL:EUB), (LABEL:eq42), and (LABEL:eq43), we derive

$\begin{split}&\frac{\sqrt{T}}{G}{\rm
min}_{t=1,2,\ldots,T}\mathbb{E}\left[\left\|\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)\right\|^{2}\right]\\\ &\leq
C_{1}G^{2}/c^{2}\left(1+\log T\right)+C_{2}d/c+C_{3}d/c^{2}+C_{4}.\end{split}$
(43)

Rearranging (LABEL:eq44), we get

$\begin{split}&{\rm min}_{t=1,2,\ldots,T}\mathbb{E}\left[\left\|\nabla
F\left(\textbf{\emph{w}}^{(t)}\right)\right\|^{2}\right]\\\
&\leq\frac{G}{\sqrt{T}}\left(C_{1}G^{2}/c^{2}\left(1+\log
T\right)+C_{2}d/c+C_{3}d/c^{2}+C_{4}\right)\\\
&=\frac{1}{\sqrt{T}}\left(G_{1}+G_{2}\log T\right),\end{split}$ (44)

where $G_{1}$ and $G_{2}$ are constants independent of $T$. Then, the proof is
completed. ∎

## References

  * [1] D. B. Kurka and D. Gündüz, “Deepjscc-f: Deep joint source-channel coding of images with feedback,” _IEEE J. Sel. Areas Inf. Theory_ , vol. 1, no. 1, pp. 178–193, Apr. 2020.
  * [2] C. Luo, J. Ji, Q. Wang, X. Chen, and P. Li, “Channel state information prediction for 5g wireless communications: A deep learning approach,” _IEEE Trans. Netw. Sci. Eng._ , vol. 7, no. 1, pp. 227–236, Jun. 2018.
  * [3] Y. He, C. Liang, F. R. Yu, N. Zhao, and H. Yin, “Optimization of cache-enabled opportunistic interference alignment wireless networks: A big data deep reinforcement learning approach,” in _Proc. IEEE Int. Conf. Commun. (ICC)_ , Paris, France, May 2017, pp. 1–6.
  * [4] H. He, C.-K. Wen, S. Jin, and G. Y. Li, “Model-driven deep learning for mimo detection,” _IEEE Trans. Signal Process._ , vol. 68, pp. 1702–1715, Feb. 2020.
  * [5] Y. Shen, Y. Shi, J. Zhang, and K. B. Letaief, “Graph neural networks for scalable radio resource management: Architecture design and theoretical analysis,” _IEEE J. Sel. Areas Commu._ , vol. 39, no. 1, pp. 101–115, Nov. 2021.
  * [6] Z. Weng and Z. Qin, “Semantic communication systems for speech transmission,” _IEEE J. Sel. Areas in Commun._ , vol. 39, no. 8, pp. 2434–2444, Aug. 2021.
  * [7] J. Shao, Y. Mao, and J. Zhang, “Task-oriented communication for multi-device cooperative edge inference,” _IEEE Trans. Wirel. Commun._ , vol. 22, no. 1, pp. 73–87, July 2023.
  * [8] E. C. Strinati and B. Sergio, “6G networks: Beyond Shannon towards semantic and goal-oriented communications,” _Comput. Netw._ , vol. 190, p. 107930, May. 2021.
  * [9] S. Guo, Y. Wang, and P. Zhang, “Signal shaping for semantic communication systems with a few message candidates,” in _Proc. IEEE 96th Veh. Technol. Conf. (VTC2022-Fall)_ , London, United Kingdom, Sept. 2022, pp. 1–5.
  * [10] Z. Qin, X. Tao, J. Lu, W. Tong, and G. Y. Li, “Semantic communications: Principles and challenges,” _arXiv preprint arXiv: arXiv.2201.01389_ , 2022.
  * [11] M. Jankowski, D. Gündüz, and K. Mikolajczyk, “Deep joint source-channel coding for wireless image retrieval,” in _Proc. IEEE Int. Conf. Acoust., Speech Signal Process. (ICASSP)_ , Barcelona, Spain, May 2020, pp. 5070–5074.
  * [12] ——, “Wireless image retrieval at the edge,” _IEEE J. Sel. Areas Commun._ , vol. 39, no. 1, pp. 89–100, Jan. 2021.
  * [13] J. Shao, Y. Mao, and J. Zhang, “Learning task-oriented communication for edge inference: An information bottleneck approach,” _IEEE J. Sel. Areas Commun._ , vol. 40, no. 1, pp. 197–211, Jan. 2022.
  * [14] J. Shao and J. Zhang, “Bottlenet++: An end-to-end approach for feature compression in device-edge co-inference systems,” in _Proc. IEEE Int. Conf. Commun. (ICC)_ , Dublin, Ireland, Jun 2020, pp. 1–6.
  * [15] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in _Proc. ACM SIGSAC Conf. Computer Commun. Secur. (CCS)_ , New York, USA, Oct 2015, pp. 1322–1333.
  * [16] T. Xiao, Y.-H. Tsai, K. Sohn, M. Chandraker, and M.-H. Yang, “Adversarial learning of privacy-preserving and task-oriented representations,” in _Proc. AAAI Conf. Artif. Intell. (AAAI)_ , New York, USA, Feb 2020, pp. 12 434–12 441.
  * [17] A. Li, Y. Duan, H. Yang, Y. Chen, and J. Yang, “TIPRDC: Task-independent privacy-respecting data crowdsourcing framework for deep learning with anonymized intermediate representations,” in _Proc. ACM SIGKDD Int. Conf. Knowl. Discov. Data Min. (KDD)_ , Virtual, Online, USA, Aug 2020, pp. 824–832.
  * [18] K. Gai, K.-K. R. Choo, M. Qiu, and L. Zhu, “Privacy-preserving content-oriented wireless communication in internet-of-things,” _IEEE Internet Things_ , vol. 5, no. 4, pp. 3059–3067, Apr. 2018.
  * [19] L. Sweeney, “k-anonymity: A model for protecting privacy,” _Int. J. Uncertain. Fuzz._ , vol. 10, no. 5, pp. 557–570, Oct. 2002.
  * [20] A. Machanavajjhala, D. Kifer, J. Gehrke, and M. Venkitasubramaniam, “l-diversity: Privacy beyond k-anonymity,” _ACM T. Knowl. Discov. D._ , vol. 1, no. 1, pp. 3–es, Mar. 2007.
  * [21] N. Li, T. Li, and S. Venkatasubramanian, “t-closeness: Privacy beyond k-anonymity and l-diversity,” in _Proc. Int. Conf. Data Eng. (ICDE)_ , Istanbul, Turkey, Apr 2007, pp. 106–115.
  * [22] C. Dwork, “Differential privacy,” in _Proc. Int. Conf. Auto. Lang. Program. (ICALP)_ , Berlin, Germany, Jul. 2006, pp. 1–12.
  * [23] C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in _Proc. Theory of Cryptography Conf. (TCC)_ , New York, USA, Jun 2006, pp. 265–284.
  * [24] N. Tishby, F. C. Pereira, and W. Bialek, “The information bottleneck method,” in _Proc. Annu. Allerton Conf. Commun. Control Comput., Monticello, IL, USA_ , Oct. 1999, pp. 368–377.
  * [25] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” in _Proc. Int. Conf. Neural Inf. Process. Syst. (NIPS)_ , Montreal, Quebec, Canada, Dec 2014, pp. 2672–2680.
  * [26] X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and defenses for deep learning,” _IEEE Trans. Neural Netw. Learn. Syst._ , vol. 30, no. 9, pp. 2805–2824, Sep. 2019.
  * [27] H. Mohaghegh Dolatabadi, S. Erfani, and C. Leckie, “Advflow: Inconspicuous black-box adversarial attacks using normalizing flows,” in _Proc. Int. Conf. Neural Inf. Process. Syst. (NIPS)_ , Vancouver, Canada, Dec. 2020, pp. 15 871–15 884.
  * [28] Z. Wang, A. Bovik, H. Sheikh, and E. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” _IEEE T. Image Process._ , vol. 13, no. 4, pp. 600–612, Apr. 2004.
  * [29] B. Poole, S. Ozair, A. Van Den Oord, A. Alemi, and G. Tucker, “On variational bounds of mutual information,” in _Proc. Int. Conf. Mach. Learn. (ICML)_ , Long Beach, USA, May 2019, pp. 5171–5180.
  * [30] A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy, “Deep variational information bottleneck,” _arXiv preprint arXiv:1612.00410_ , 2016.
  * [31] P. Cheng, W. Hao, S. Dai, J. Liu, Z. Gan, and L. Carin, “Club: A contrastive log-ratio upper bound of mutual information,” in _Proc. Int. Conf. Mach. Learn. (ICML)_ , Vienna, Austria, Jul 2020, pp. 1779–1788.
  * [32] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” _arXiv preprint arXiv:1312.6114_ , 2013.
  * [33] J. Désidéri, “Multiple-gradient descent algorithm (MGDA) for multiobjective optimization,” _C. R. Math._ , vol. 350, no. 5, pp. 313–318, Mar. 2012.
  * [34] O. Sener and V. Koltun, “Multi-task learning as multi-objective optimization,” in _Proc. Int. Conf. Neural Inf. Process. Syst. (NIPS)_ , Montreal, Canada, Dec 2018, pp. 525–536.
  * [35] M. Jaggi, “Revisiting frank-wolfe: Projection-free sparse convex optimization,” in _Proc. Int. Conf. Mach. Learn. (ICML)_ , Atlanta, GA, USA, Jun 2013, pp. 427–435.
  * [36] S. J. Reddi, S. Kale, and S. Kumar, “On the convergence of adam and beyond,” in _Proc. Int. Conf. Learn. Represent. (ICLR)_ , Vancouver, Canada, Apr. 2018, pp. 1–23.
  * [37] X. Chen, S. Liu, R. Sun, and M. Hong, “On the convergence of a class of adam-type algorithms for non-convex optimization,” in _Proc. Int. Conf. Learn. Represent. (ICLR)_ , New Orleans, USA, May 2019, pp. 1–30.
  * [38] K. Choi, K. Tatwawadi, T. Weissman, and S. Ermon, “NECST: Neural joint source-channel coding.” in _Proc. Int. Conf. Mach. Learn. (ICML)_ , Long Beach, USA, May 2019, pp. 1182–1192.
  * [39] X. Luo, Z. Chen, M. Tao, and F. Yang, “Encrypted semantic communication using adversarial training for privacy preserving,” _IEEE Commun. Lett._ , vol. 27, no. 6, pp. 1486–1490, June 2023.