CutClean: Neural Network Pruning for Privacy-Preserving Inference

# CutClean: Neural Network Pruning for Privacy-Preserving Inference
Source: [https://arxiv.org/html/2608.13773](https://arxiv.org/html/2608.13773)
Vito Paolo PastoreAffiliation:MaLGa\-DIBRIS, University of Genoa, ItalyAffiliation:Istituto Italiano di Tecnologia, ItalyGiuseppe ValenziseAffiliation:Universite Paris\-Saclay, CNRS, CentraleSupélec, L2S, FranceE\-mail[\{leonardo\.magliolo, enzo\.tartaglione\}@telecom\-paris\.fr](mailto:{leonardo.magliolo,%20enzo.tartaglione}@telecom-paris.fr)Enzo TartaglioneE\-mail[giuseppe\.valenzise@l2s\.centralesupelec\.fr](mailto:[email protected])E\-mail[vito\.paolo\.pastore@unige\.it](mailto:[email protected])Affiliation:LTCI, Télécom Paris, Institut Polytechnique de Paris, France

###### Abstract

Neural networks are increasingly deployed in high\-stakes applications with growing privacy leakage concerns\. We show that this privacy leakage can occur even in the absence of representation imbalances that lead to traditional dataset biases\. This poses significant privacy risks when deploying models that process sensitive attributes\. In this context, we propose CutClean, a privacy\-aware pruning method that allows to reduce privacy information flow through the network, while increasing its sparsity\. Our approach employs auxiliary linear privacy heads placed at each network’s block to quantify information leakage, and further applies increasing levels of sparsity to remove the private attribute leakage, measured in terms of the accuracy of the privacy head attached to the last block\. Experiments on synthetic and real\-world datasets demonstrate that our approach effectively minimizes private information flow while achieving high sparsity rates and preserving classification target accuracy\.111This work has been accepted for publication at the International Conference on Pattern Recognition 2026\.

###### Keywords:

Privacy preservation pruning structured sparsity mutual information\.

## 1Introduction

Neural networks are increasingly deployed in high\-stakes domains such as healthcare, finance, biometric authentication, and social services, where automated decisions can have significant societal and individual consequences\. In response to these risks, recent regulatory frameworks—most notably the European Union’s AI Act\[[1](https://arxiv.org/html/2608.13773#bib.bib26)\]—have placed strong emphasis on privacy protection, data minimization, and safeguards against unintended uses of sensitive information\[[22](https://arxiv.org/html/2608.13773#bib.bib27)\]\. Despite these advances, modern neural networks remain prone to side leakage: even when models are trained without explicit access to sensitive attributes, their internal representations can encode private information that may later be extracted by adversaries, auxiliary classifiers, or downstream tasks\[[8](https://arxiv.org/html/2608.13773#bib.bib9),[23](https://arxiv.org/html/2608.13773#bib.bib12)\]\. This misalignment between regulatory intent and model behavior poses substantial privacy risks, particularly in real\-world deployments where access to trained models or intermediate representations cannot be fully controlled\.

Existing work on privacy leakage in neural networks has largely focused on biases induced by dataset imbalances or correlations between sensitive and target attributes\. In these settings, sensitive information emerges as a byproduct of spurious correlations, and mitigation strategies often rely on dataset balancing, fairness constraints, or adversarial representation learning\[[20](https://arxiv.org/html/2608.13773#bib.bib28)\]\. However, privacy leakage can persist even in the absence of such imbalances\[[19](https://arxiv.org/html/2608.13773#bib.bib15),[15](https://arxiv.org/html/2608.13773#bib.bib17)\]: neural networks may encode sensitive attributes simply because they are predictive of intermediate features or useful for representation learning, rather than due to explicit bias in the training data\. This observation challenges the assumption that removing dataset bias alone is sufficient to prevent privacy leakage, and highlights the need for model\-centric privacy interventions\.

In parallel, the machine learning community has explored post\-hoc techniques to modify trained networks in order to improve efficiency, robustness, or interpretability\. Among these, network pruning\[[10](https://arxiv.org/html/2608.13773#bib.bib21),[12](https://arxiv.org/html/2608.13773#bib.bib22)\]has emerged as a powerful tool to reduce model size and computational cost by removing redundant parameters or structures\. Structured pruning methods, in particular, remove entire channels, filters, or blocks, enabling deployment\-friendly sparsity patterns\[[5](https://arxiv.org/html/2608.13773#bib.bib20)\]\. Despite their success in efficiency\-oriented settings, the potential of pruning as a privacy\-preserving mechanism remains underexplored\. Intuitively, removing parts of a network that encode sensitive information could reduce privacy leakage\[[27](https://arxiv.org/html/2608.13773#bib.bib29)\], but doing so in a principled and measurable way remains an open challenge\.

In this work, we propose CutClean, a privacy\-aware structured pruning framework designed to explicitly reduce private attribute leakage in neural networks\. Our approach introduces auxiliary linear privacy heads attached to intermediate blocks of a network, allowing us to quantify how much private information is present at different depths\. Rather than relying on dataset\-level assumptions, CutClean directly measures privacy leakage through the accuracy of these privacy heads\. We then progressively apply structured pruning to remove components that contribute most to private attribute predictability, while monitoring both target task performance and privacy leakage\. We empirically validate CutClean on both synthetic and real\-world datasets, demonstrating that it achieves high sparsity rates and substantial reductions in private attribute predictability without sacrificing classification performance\. We summarize our contributions as follows:

- •We introduce CutClean, the first structured pruning framework explicitly designed to reduce private attribute leakage in trained neural networks, positioning pruning as a privacy\-preserving intervention rather than a compression or robustness tool \(Sec\.[3\.2](https://arxiv.org/html/2608.13773#S3.SS2)\)\.
- •We show that significant reductions in private attribute leakage can be achieved without adversarial minimax optimization, improving stability and post\-deployment applicability \(Sec\.[4\.2](https://arxiv.org/html/2608.13773#S4.SS2)\)\.
- •We demonstrate that CutClean achieves high structured sparsity while preserving target task accuracy, revealing an unexpected compatibility between privacy leakage reduction and efficient model deployment \(Sec\.[4\.3](https://arxiv.org/html/2608.13773#S4.SS3)\)\.

## 2Related works

Privacy Leakage and Adversarial Attribute Inference\.A growing body of work has shown that neural network representations can leak sensitive information even when protected attributes are not explicitly used during training\[[8](https://arxiv.org/html/2608.13773#bib.bib9),[23](https://arxiv.org/html/2608.13773#bib.bib12)\]\. Attribute inference attacks and auxiliary classifier attacks demonstrate that sensitive attributes such as gender, ethnicity, or health status can often be recovered from learned features with high accuracy\[[8](https://arxiv.org/html/2608.13773#bib.bib9),[24](https://arxiv.org/html/2608.13773#bib.bib11),[13](https://arxiv.org/html/2608.13773#bib.bib10)\]\. These findings have motivated the use of adversarial classifiers, often referred to as privacy heads or attribute classifiers\[[26](https://arxiv.org/html/2608.13773#bib.bib3)\], to quantify or exploit privacy leakage in intermediate representations\[[7](https://arxiv.org/html/2608.13773#bib.bib13),[9](https://arxiv.org/html/2608.13773#bib.bib14)\]\. In this setting, privacy risk is typically measured by the accuracy of an attacker trained to predict a sensitive attribute from a model’s internal features\.

Debiasing and Privacy\.Beyond adversarial training, several approaches have investigated post\-hoc techniques for mitigating bias and privacy leakage, including feature projection, representation obfuscation, and fine\-tuning with regularization constraints\[[19](https://arxiv.org/html/2608.13773#bib.bib15),[3](https://arxiv.org/html/2608.13773#bib.bib16)\]\. These methods often focus on fairness metrics or demographic parity, rather than explicitly quantifying and minimizing information leakage\[[29](https://arxiv.org/html/2608.13773#bib.bib18),[4](https://arxiv.org/html/2608.13773#bib.bib19)\]\. Few works consider structured model modification as a mechanism to control privacy risk after training, particularly without modifying the original loss function or requiring repeated adversarial retraining\.

Pruning in Neural Networks\.Network pruning aims to reduce model complexity by removing redundant parameters, channels, or structural components\[[10](https://arxiv.org/html/2608.13773#bib.bib21),[12](https://arxiv.org/html/2608.13773#bib.bib22),[2](https://arxiv.org/html/2608.13773#bib.bib23)\]\. While pruning has traditionally been studied in the context of model compression, acceleration, and robustness, recent work has begun to explore its impact on representation properties\[[25](https://arxiv.org/html/2608.13773#bib.bib24),[6](https://arxiv.org/html/2608.13773#bib.bib25)\]\. However, most existing pruning strategies are agnostic to privacy or bias considerations and rely solely on task performance or weight magnitude as pruning criteria\.

CutClean differs from prior work by leveraging pruning to privacy leakage reduction, guided by explicit measures of sensitive attribute predictability\. Rather than relying on adversarial minimax optimization, our approach uses auxiliary linear privacy heads solely as diagnostic tools to quantify information flow at different network depths\. By progressively pruning network components that contribute to private attribute leakage, CutClean avoids the instability and retraining overhead of adversarial debiasing while enabling deployment\-friendly sparsity\. This positions structured pruning as a practical and effective post\-hoc privacy\-preserving mechanism, complementing existing training\-time approaches to debiasing and privacy protection\. The success of CutClean is prompted by adversarial robustness works showing that properly pruned architectures can be robust to adversarial attacks\[[28](https://arxiv.org/html/2608.13773#bib.bib2),[16](https://arxiv.org/html/2608.13773#bib.bib1)\]: differently from these, CutClean aims at removing specific attributes that can be in\-distribution at training and are not necessarily outliers\.

## 3Method

### 3\.1Problem Formulation

In this section, we define the main concepts and objectives of this work\. We want a neural networkf:𝒳→𝒴f:\\mathcal\{X\}\\rightarrow\\mathcal\{Y\}to learn the mapping between inputsxxand output labelsy^\\hat\{y\}while preventing the model from conveying information about a secondary private labelz^∈𝒵\\hat\{z\}\\in\\mathcal\{Z\}\. The networkffis composed of successive blocks\{bi\}i=1B\\\{b\_\{i\}\\\}\_\{i=1\}^\{B\}, with intermediate output described as:

∀i∈\[1,B\],hi=bi​\(hi−1\),\\forall i\\in\[1,B\],\\quad h\_\{i\}=b\_\{i\}\(h\_\{i\-1\}\),\(1\)withh0=𝐱h\_\{0\}=\\mathbf\{x\}and𝐲^=gc​\(hB\)\\hat\{\\mathbf\{y\}\}=g^\{c\}\(h\_\{B\}\), wheregcg^\{c\}is the softmaxed linear used as the task\-specific classification head\.

We estimate the amount of information conveyed by each intermediate output throughout the network attaching one auxiliary linear layer to the output of*each*block, acting as aprivacy head:

∀i∈\[1,B\],z^i=gip​\(hi\)\.\\forall i\\in\[1,B\],\\quad\\hat\{z\}\_\{i\}=g^\{p\}\_\{i\}\(h\_\{i\}\)\.\(2\)
In the naive setup, the main model is trained by minimization of a cross\-entropy lossℒy​\(y^\)\\mathcal\{L\}\_\{y\}\(\\hat\{y\}\)and each privacy headgipg^\{p\}\_\{i\}is trained by minimization of the cross\-entropy lossℒz​\(z^i\)\\mathcal\{L\}\_\{z\}\(\\hat\{z\}\_\{i\}\)whose error is not propagated to the backboneff\. The performance of the privacy heads can be seen as a measure of the private information that can be extracted from the corresponding block outputs\.

We propose to compute a series of pruning masks\{mi\}i=1B\\\{m\_\{i\}\\\}\_\{i=1\}^\{B\}applied to network channels in each corresponding block, aiming to reach the best trade\-off between performance on the main task and sparsity in the pruned network, while minimizing the amount of private information extractable from the network representations,i\.e\.decreasing the performance of the privacy heads close to random guess\. The definition of a block depends on the specific architecture, as described in Sec\.[4\.1](https://arxiv.org/html/2608.13773#S4.SS1)\.

### 3\.2Proposed Approach

Figure 1:Schematic overview of CutClean\.The goal of this work is to prune the network under the constraint of minimizing the private information flowing through the network representations\. To do so, we add adversarial terms in the optimization objective to reduce the performance of optimally trained privacy heads attached to the outputs of all blocks\. We measure the private information flow as the accuracy of the privacy head attached to the last network’s block\. The proposed privacy\-aware pruning strategy, that we refer to as CutClean, is schematically represented in Fig\.[1](https://arxiv.org/html/2608.13773#S3.F1), while its pseudocode description is reported in the Supplementary material\. First, we pre\-train our network applying an alternating training procedure to obtain a privacy\-aware backbone, that we refer to as online batch Mutual Information \(MI\)\-aware training\. Then, we perform a custom pruning scheme exploring different candidate sparsity levels with a grid search over a fixed grid \(s∈\[0,1\]s\\in\\left\[0,1\\right\]\)\. To control the trade\-off between sparsity and private information flow, we monitor the validation accuracy of the last privacy head\. We define a sparsity level as admissible, if the last privacy head accuracy, after fine\-tuning, is lower or equal to a defined thresholdPthresholdP^\{\\text\{threshold\}\}\. We fine\-tune each pruned model corresponding to an admissible sparsity level for a small fixed number of epochs, using the alternating MI\-aware training procedure employed for the pre\-training\. Among the admissible pruned models, the one performing best on the validation set is selected and employed for evaluation on the test set\. We will now provide more details on the main components of our pipeline, including the online batch MI\-aware training \(Sec\.[3\.3](https://arxiv.org/html/2608.13773#S3.SS3)\) and the designed pruning strategy \(Sec\.[3\.4](https://arxiv.org/html/2608.13773#S3.SS4)\)\.

### 3\.3Online Batch MI\-aware Training

Naively, we could employ an optimization function such as

𝒥=ℒy​\(y^\)−∑i=1Bℒz​\(z^i\)\.\\mathcal\{J\}=\\mathcal\{L\}\_\{y\}\(\\hat\{y\}\)\-\\sum\_\{i=1\}^\{B\}\\mathcal\{L\}\_\{z\}\(\\hat\{z\}\_\{i\}\)\.\(3\)
However, as shown in\[[26](https://arxiv.org/html/2608.13773#bib.bib3)\], such an optimization goal could lead to degenerate solutions in which the privacy head systematically misclassifies the private attributes with high confidence\. This behavior still requires the backbone to encode the private attribute reliably \(the head must infer the correct class in order to invert it\), and therefore does not effectively remove private information from the representation\.

To avoid this issue, in this work we rely on a differentiable proxy for the mutual information between the outputz^\\hat\{z\}of a privacy head and the private labels, similarly to\[[26](https://arxiv.org/html/2608.13773#bib.bib3)\]\. For a given head outputz^i\\hat\{z\}\_\{i\}, this proxy of mutual information is computed as

ℐz​\(z^i\)=∑j=1\|𝒵\|∑k=1\|𝒵\|p~​\(z^i=j,z=k\)​log⁡\[p~​\(z^i=j,z=k\)p~​\(z^i=j\)​p~​\(z=k\)\],\\mathcal\{I\}\_\{z\}\(\\hat\{z\}\_\{i\}\)=\\sum^\{\|\\mathcal\{Z\}\|\}\_\{j=1\}\\sum^\{\|\\mathcal\{Z\}\|\}\_\{k=1\}\\tilde\{p\}\(\\hat\{z\}\_\{i\}=j,z=k\)\\log\\left\[\\frac\{\\tilde\{p\}\(\\hat\{z\}\_\{i\}=j,z=k\)\}\{\\tilde\{p\}\(\\hat\{z\}\_\{i\}=j\)\\tilde\{p\}\(z=k\)\}\\right\],\(4\)being, across the minibatch:

- •p~​\(z^i=j\)\\tilde\{p\}\(\\hat\{z\}\_\{i\}=j\), the empirical frequency of private classjj,
- •p~​\(z=k\)\\tilde\{p\}\(z=k\), the mean of thekthk^\{\\text\{th\}\}softmaxed output of the privacy head,
- •p~​\(z^i=j,z=k\)\\tilde\{p\}\(\\hat\{z\}\_\{i\}=j,z=k\), the mean of thekthk^\{\\text\{th\}\}softmaxed output of the privacy head when the true label isjj\.

Our optimization function can thus be defined as

𝒥=ℒy​\(y^\)\+∑i=1Bγi​ℐz​\(z^i\),\\mathcal\{J\}=\\mathcal\{L\}\_\{y\}\(\\hat\{y\}\)\+\\sum\_\{i=1\}^\{B\}\\gamma\_\{i\}\\mathcal\{I\}\_\{z\}\(\\hat\{z\}\_\{i\}\),\(5\)
where\{γi\}i=1B=γ​∀i\\\{\\gamma\_\{i\}\\\}\_\{i=1\}^\{B\}=\\gamma\\ \\forall i, andγ\\gammais a fundamental hyperparameter controlling the strength of the regularization for each privacy head\. In our experiment, we setγ\\gammawith a tuning procedure choosing the value bringing the lowest validation accuracy of the last privacy head\. Contrary to maximizingℒz\\mathcal\{L\}\_\{z\}, minimizingℐz\\mathcal\{I\}\_\{z\}forces the representation to discard information about the private attribute: in the limitℐz→0\\mathcal\{I\}\_\{z\}\\to 0, the optimal privacy classifier is forced to avoid exploiting the prior overzz, and its accuracy is upper bounded bymaxz∈𝒵⁡p⁡\(z\)\\max\_\{z\\in\\mathcal\{Z\}\}p\(z\)\(which reduces to1/\|𝒵\|1/\|\\mathcal\{Z\}\|only in the perfectly balanced case\)\. Our objective is therefore to obtain block outputs\{hi\}i=1B\\\{h\_\{i\}\\\}\_\{i=1\}^\{B\}such that the privacy heads cannot extract meaningful private information from them\.

In practice, we first pre\-train the model with the objective𝒥\\mathcal\{J\}defined in \([5](https://arxiv.org/html/2608.13773#S3.E5)\) for a fixed number of epochs\. Specifically, for each mini\-batch, we alternate between:

- •updating the privacy heads\{gip\}i=1B\\\{g^\{p\}\_\{i\}\\\}\_\{i=1\}^\{B\}with the cross\-entropy loss∑i=1Bℒz​\(z^i\)\\sum\_\{i=1\}^\{B\}\\mathcal\{L\}\_\{z\}\(\\hat\{z\}\_\{i\}\)while keeping the backbonefffixed;
- •updating the backbone and task head by minimizing𝒥\\mathcal\{J\}while keeping all privacy heads fixed\.

The same batchwise alternating scheme is reused whenever we fine\-tune a pruned model, so that the privacy objective is enforced consistently throughout all training stages\.

### 3\.4Designed pruning strategy

Building on the insights of\[[17](https://arxiv.org/html/2608.13773#bib.bib4)\], we know that depending on the task, and the private features at hand, it is possible to prune very heavily specific layers in the network without compromising performance on the main task, while other layers tend to be very sensitive to pruning\. Therefore, we prune our network by gradually increasing a*global*sparsity levelssapplied to all blocks, within an upper bound on the accuracy of the privacy head connected to the last network’s block, that we employ as a proxy for the private attribute flow\.

We useL1L\_\{1\}\-norm structured pruning to maximize the impact on memory efficiency and energy consumption\. Specifically, our pruning approach removes entire channels from layers based on their \(normalized\)L1L\_\{1\}\-norm values\. Let us consider a convolutional layer with weight tensor𝐖i∈ℝCout×Cin×KH×KW\\mathbf\{W\}\_\{i\}\\in\\mathbb\{R\}^\{C\_\{\\text\{out\}\}\\times C\_\{\\text\{in\}\}\\times K\_\{H\}\\times K\_\{W\}\}, whereccindexes channels,jjindexes input channels, and\(h,w\)\(h,w\)index spatial kernel dimensions\. For each output channelccin a prunable layer, we compute the normalizedL1L\_\{1\}\-norm

∥𝐖i\[c,:,:,:\]∥1=1Cin​KH​KW∑j,h,w\|𝐖i\[c,j,h,w\]\|,\\\|\\mathbf\{W\}\_\{i\}\[c,:,:,:\]\\\|\_\{1\}=\\frac\{1\}\{C\_\{\\text\{in\}\}K\_\{H\}K\_\{W\}\}\\sum\_\{j,h,w\}\|\\mathbf\{W\}\_\{i\}\[c,j,h,w\]\|,and then permanently remove the channels with the lowest norms by applying a structured maskℳis∈\{0,1\}Cout\\mathcal\{M\}\_\{i\}^\{s\}\\in\\\{0,1\\\}^\{C\_\{\\text\{out\}\}\}whereℳis​\[c\]=1\\mathcal\{M\}\_\{i\}^\{s\}\[c\]=1if channelccis among the top\-\(1−s\)⋅Cout\(1\-s\)\\cdot C\_\{\\text\{out\}\}channels of its layer by normalizedL1L\_\{1\}\-norm, andℳis​\[c\]=0\\mathcal\{M\}\_\{i\}^\{s\}\[c\]=0otherwise, withssbeing the target sparsity level\.

This structured approach offers significant practical advantages over unstructured pruning methods:

- •Memory\-wise, removing entire channels reduces the actual tensor dimensions fromℝCout×Cin×KH×KW\\mathbb\{R\}^\{C\_\{\\text\{out\}\}\\times C\_\{\\text\{in\}\}\\times K\_\{H\}\\times K\_\{W\}\}toℝ\(1−s\)⋅Cout×Cin×KH×KW\\mathbb\{R\}^\{\(1\-s\)\\cdot C\_\{\\text\{out\}\}\\times C\_\{\\text\{in\}\}\\times K\_\{H\}\\times K\_\{W\}\}, leading to genuine memory savings during both training and inference\.
- •Computationally, eliminating output channels reduces the number of convolution operations fromO⁡\(Cout⋅Cin⋅KH⋅KW⋅H⋅W\)O\(C\_\{\\text\{out\}\}\\cdot C\_\{\\text\{in\}\}\\cdot K\_\{H\}\\cdot K\_\{W\}\\cdot H\\cdot W\)toO⁡\(\(1−s\)⋅Cout⋅Cin⋅KH⋅KW⋅H⋅W\)O\(\(1\-s\)\\cdot C\_\{\\text\{out\}\}\\cdot C\_\{\\text\{in\}\}\\cdot K\_\{H\}\\cdot K\_\{W\}\\cdot H\\cdot W\), resulting in measurable speedup proportional to the sparsity level\.

These benefits in model size and energy consumption are shown in Sec\.[4](https://arxiv.org/html/2608.13773#S4)\. Working with blocks\.While we ideally could define and prune channels at the output of each and every layer of a model, this can, in practice, result in too long an optimization process and in architectures that are difficult to deploy efficiently\. Furthermore, in models such as ResNets\[[11](https://arxiv.org/html/2608.13773#bib.bib5)\]that have skip connections, information can bypass some layers\. For these reasons, we group layers into*blocks*\. The structured pruning scheme described above is applied channel\-wise across all blocks of the network, while the privacy objective is enforced at the end of each block via its corresponding privacy head\.

## 4Experiments

### 4\.1Setup

Datasets\.We perform experiments on both syntethic and real\-world datasets, evaluating CutClean performance with diverse private attributes\. Specifically, we employ Corrupted\-Cifar10\[[18](https://arxiv.org/html/2608.13773#bib.bib7)\]where the private attribute corresponds to image corruptions, Waterbirds\[[21](https://arxiv.org/html/2608.13773#bib.bib6)\]where it is in the background, and CelebA\[[14](https://arxiv.org/html/2608.13773#bib.bib8)\], a face dataset that present multiple labels, with high\-level sensitive attributes such as gender or ethnicity\. Here, we consider two target attributes for CelebA, that is "blonde" and "heavy make\-up"\. For all these datasets, we build custom versions balanced with respect to target and private attribute, as detailed in the Supplementary material\. Data pre\-processing and pruning details\.For each model, we start from ImageNet\-1k pre\-trained weights\. For each dataset, images are resized to224×224224\\times 224, and we employ horizontal flips and random crops during training\. For ResNet18\[[11](https://arxiv.org/html/2608.13773#bib.bib5)\], we consider each residual stage as a pruning block\. For the experiments with ViT\-B16, we treat each transformer stage between downsampling operations as a block, and we prune the output channels of convolutional projections and feed\-forward layers consistently within a block\. The last privacy head threshold is defined according to the number of classes\. Specifically, we setPthreshold=65%P^\{\\text\{threshold\}\}=65\\%for waterbirds and Celeb\-A, with two target classes, andPthreshold=20%P^\{\\text\{threshold\}\}=20\\%for the syntethic dataset Corrupted\-CIFAR10\. Training details\.We employ SGD with momentum0\.90\.9as optimizer, with a cosine learning\-rate decay\. The MI pretraining phase runs for400400epochs with an initial learning rate of10−210^\{\-2\}, while the MI fine\-tuning phase after pruning runs for1010epochs with an initial learning rate of10−210^\{\-2\}\. Weight decay is set to10−410^\{\-4\}, and a batch size of124124is used for all the datasets\.

### 4\.2Results

In this section, we present CutClean results on the selected datasets, reporting the bestγ\\gammaselection procedure, and then evaluating the corresponding pruned model in terms of sparsity, target and privacy head test accuracy\. Results on Celeb\-A: Blonde target attribute\.Table[1](https://arxiv.org/html/2608.13773#S4.T1)shows the target accuracy and the last privacy head accuracy on the validation set for Celeb\-A, considering the target attribute “blonde", for different values ofγ\\gamma\. We can notice howγ=0\\gamma=0, which corresponds to our baseline model with no MI\-aware training, brings a high validation accuracy for the last privacy head of90\.61%90\.61\\%, confirming a clear privacy information flow through the model\. On the other hand,γ=1000\\gamma=1000provides the lowest privacy head accuracy and is therefore selected for the rest of our pipeline\. Table[2](https://arxiv.org/html/2608.13773#S4.T2)summarizes the corresponding CutClean results\. While preserving task accuracy, with a negligible reduction of less than1\.5%1\.5\\%on the test accuracy, our method allows to obtain a significant reduction of the privacy information flow, with a minus24\.86%24\.86\\%in the privacy head accuracy, further allowing to compress the model with a sparsity level of60%60\\%\.

Table 1:Target and last privacy head accuracy on the validation set for different values ofγ\\gammafor Celeb\-A "blonde" attribute\.Table 2:Target accuracy, last privacy head accuracy on the test set and sparsity level on Celeb\-A "blonde" attribute\.Results on Celeb\-A: Heavy make\-up target attribute\.Table[3](https://arxiv.org/html/2608.13773#S4.T3)summarizes the target and the last privacy head validation accuracy for the attribute "Heavy make\-up" in Celeb\-A with respect to different values ofγ\\gamma\. Similarly to the previous attribute, a naive training \(γ=0\\gamma=0\) brings a high accuracy in the last privacy head, whileγ=5\\gamma=5allows to reduce privacy flow with a decreasing in the privacy head accuracy of almost20%20\\%, and is therefore selected for the rest of our pipeline\. Table[4](https://arxiv.org/html/2608.13773#S4.T4)shows the corresponding CutClean results\. On the test set, our pruned model achieves a reduction of privacy head accuracy of15\.91%15\.91\\%, while preserving a good target accuracy of73\.11%73\.11\\%, with a final sparsity of30%30\\%\.

Table 3:Target and last privacy head accuracy on the validation set for different values ofγ\\gammafor Celeb\-A "Heavy make\-up" attribute\.Table 4:CutClean performance on Celeb\-A, "Heavy make\-up" attributeResults on Corrupted\-CIFAR10\.Table[5](https://arxiv.org/html/2608.13773#S4.T5)shows the results of our hyperparameter tuning procedure for selecting the bestγ\\gammaon Corrupted\-CIFAR10\. Despite the different semantics of the private attribute, which here is an image corruption, without our MI\-aware training procedure \(γ=0\\gamma=0\), the privacy head accuracy on the validation set is around64%64\\%, confirming privacy information flow through the network\. Similarly to the "blonde" target attribute in Celeb\-A,γ=1000\\gamma=1000provides the lowest privacy head accuracy, which is close to random guess \(14\.57%14\.57\\%\), and is employed in the rest of CutClean procedure\. Table[6](https://arxiv.org/html/2608.13773#S4.T6)shows the results on the test set for the pruned model\. Here, we can reach very low accuracy on the privacy head \(13\.33%13\.33\\%\), while maintaining good performances on the target classification task \(81\.36%81\.36\\%\), and with a corresponding sparsity value of10%10\\%\.

Table 5:Target and last privacy head accuracy on the validation set for different values ofγ\\gammafor Corrupted\-CIFAR10\.Table 6:Target accuracy, last privacy head accuracy on the test set and sparsity level on Corrupted\-CIFAR10\.Results on Waterbirds\.Table[7](https://arxiv.org/html/2608.13773#S4.T7)summarizes the target validation accuracy and the last privacy head accuracy at the varying ofγ\\gammafor the waterbirds dataset, where the private attribute is the background\. Here, withγ=0\\gamma=0the privacy information flow is very high, with a corresponding privacy head accuracy of91\.47%91\.47\\%, whileγ=1\\gamma=1allows to reduce this value up to69\.23%69\.23\\%, and is used for the rest of CutClean pipeline\. As reported in Table[8](https://arxiv.org/html/2608.13773#S4.T8), with a negligible decrease of2\.21%2\.21\\%in the target accuracy, our pruned models is capable of providing a reduction in the privacy head accuracy of24\.4%24\.4\\%, allowing to obtain a sparsity level of20%20\\%\.

Table 7:Target and last privacy head accuracy on the validation set for different values ofγ\\gammafor Waterbirds\.Table 8:Target accuracy, last privacy head accuracy on the test set and sparsity level on waterbirds\.
### 4\.3Ablations

In this Section, we perform ablation studies to evaluate the impact of the main components of our method\. First, we explore vision transformer architectures, replicating our pipeline with a ViT\-B16 model\. Then, we measure the impact of fine\-tuning pruned models and the last privacy head, prior to evaluation on the validation set\. Finally, we provide the last privacy head and the target accuracy on the test set for our pruned models as a function of the complete grid of candidate sparsity levels\. Results on Transformers\.We here replicate the entire CutClean pipeline on the "blonde" target class for Celeb\-A dataset, exploiting a ViTB\-16 model\. First, in Table[9](https://arxiv.org/html/2608.13773#S4.T9)we report the tuning experiment to select the bestγ\\gammavalue, confirming how a naive training procedure shows a significant leakage for the private attribute, while our procedure withγ=50\\gamma=50provides the best reduction in the last privacy head accuracy\. Then, we employ this value ofγ\\gammafor performing CutClean’s pipeline, with results summarized in Table[10](https://arxiv.org/html/2608.13773#S4.T10)\. Our results are similar to the ones obtained with ResNet18, allowing to obtain a sparsity level of50%50\\%, with a corresponding reduction in the last privacy head accuracy of25\.11%25\.11\\%, and a reduction in target accuracy of only5\.48%5\.48\\%\.

Table 9:Target and last privacy head accuracy on the validation set for different values ofγ\\gammafor Celeb\-A "blonde" attribute, employing a ViTb\-16 model\.Table 10:Target accuracy, last privacy head accuracy on the test set and sparsity level on Celeb\-A "blonde" attribute, employing a ViTb\-16 model\.Figure 2:Target and privacy head accuracy on the test set for the investigated datasets for CutClean \(Left\) and CutClean without fine\-tuning \(Right\)\. Results are averaged across three runs, standard deviations in the shaded area\.![Refer to caption](https://arxiv.org/html/2608.13773v1/fig/CUT_clean.png)Impact of fine\-tuning\.We replicate our approach without fine\-tuning the pruned models prior to evaluation on the validation set\. The results reported in the last line of Tables[2](https://arxiv.org/html/2608.13773#S4.T2),[4](https://arxiv.org/html/2608.13773#S4.T4),[6](https://arxiv.org/html/2608.13773#S4.T6), and[8](https://arxiv.org/html/2608.13773#S4.T8)confirm how fine\-tuning allows to retain more the target classification performance of the original model\. Furthermore, as within the admissible sparsity levels we select the one corresponding to the pruned models with the highest validation accuracy, even when the target performance can be partially recovered, we end\-up selecting models with significantly lower sparsity values \(e\.g\., for waterbirds and "blonde" target attribute in Celeb\-A\)\. Analogous results are obtained for the ViT\-B16 model \(last entry of Table[10](https://arxiv.org/html/2608.13773#S4.T10)\), confirming the importance of fine\-tuning in our method\. Performance at different sparsity levels\.In Fig\.[2](https://arxiv.org/html/2608.13773#S4.F2)we report the target and the last privacy head accuracy on the test set, for our complete set of candidate sparsity levels\. Again, fine\-tuning proves to better maintain the target classification performance for all the datasets, allowing to prune more aggressively before obtaining a severe reduction \(for instance, up to60%60\\%of sparsity for the "blonde" target attribute in Celeb\-A\)\. Generally, higher level of sparsity values force the pruned models towards random guess, though the last privacy head accuracy shows a slighly different behavior, being capable of recovering private information for higher level of sparsities, as in the case of Celeb\-A concerning the "blonde" target attribute\. Without fine\-tuning, moderate sparsity values are already sufficient to completely destroy the target classification performance, leading to random guess\. This value can be as low as0\.150\.15for waterbirds, or higher as in Celeb\-A "blonde" target attribute, where it is0\.350\.35\.

## 5Conclusion

Despite the wide\-spread adoption of deep neural networks, privacy leakage is still a major concern, potentially impacting real\-world applications\. On the other hand, it is known that deep neural networks are computationally expensive, with pruning techniques generally proposed to improve efficiency while maintaining performance on the target task\. In this work, we tackle both issues proposing CutClean, a privacy\-aware pruning method capable of significantly reducing the private information flow in a neural network\. Exploiting external classifiers connected at each block of the network, that we refer to as privacy heads, we obtain a proxy of the privacy information flow at each block\. Spanning over a set of candidate sparsity levels, we prune the network with our custom procedure, considering each level as admissible, if the last privacy head accuracy is below a fixed threshold, set according to the number of target classes, finally selecting the model that performs best on the validation set, in terms of target accuracy\. Our results on four datasets confirm that with naive training there is a significant private information leakage, successfully reduced in the pruned models obtained through the proposed CutClean method, with consistent findings on vision transformer architectures\.

## Acknowledgements

This work is supported by Hi\! PARIS and ANR/France 2030 program \(ANR\-23\-IACL\-0005\)\.

## References

- \[1\]E\. A\. I\. Act\(2024\)The eu artificial intelligence act\.European Union\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p1.1)\.
- \[2\]M\. S\. Ali, M\. Qamar, S\. Bae, and E\. Tartaglione\(2024\)Trimming the fat: efficient compression of 3d gaussian splats through pruning\.arXiv preprint arXiv:2406\.18214\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p3.1)\.
- \[3\]N\. Belrose, D\. Schneider\-Joseph, S\. Ravfogel, R\. Cotterell, E\. Raff, and S\. Biderman\(2023\)Leace: perfect linear concept erasure in closed form\.Advances in Neural Information Processing Systems36,pp\. 66044–66063\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p2.1)\.
- \[4\]A\. Beutel, J\. Chen, Z\. Zhao, and E\. H\. Chi\(2017\)Data decisions and theoretical implications when adversarially learning fair representations\.arXiv preprint arXiv:1707\.00075\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p2.1)\.
- \[5\]A\. Bragagnolo, E\. Tartaglione, A\. Fiandrotti, and M\. Grangetto\(2021\)On the role of structured pruning for neural network compression\.In2021 IEEE International Conference on Image Processing \(ICIP\),pp\. 3527–3531\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p3.1)\.
- \[6\]E\. Cassano, R\. Renzulli1, and A\. Bragagnolo\(2025\)When does pruning benefit vision representations?\.InImage Analysis and Processing–ICIAP 2025: 23rd International Conference, Rome, Italy, September 15–19, 2025, Proceedings, Part II,pp\. 152\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p3.1)\.
- \[7\]H\. Edwards and A\. Storkey\(2015\)Censoring representations with an adversary\.arXiv preprint arXiv:1511\.05897\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[8\]M\. Fredrikson, S\. Jha, and T\. Ristenpart\(2015\)Model inversion attacks that exploit confidence information and basic countermeasures\.InProceedings of the 22nd ACM SIGSAC conference on computer and communications security,pp\. 1322–1333\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p1.1),[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[9\]Y\. Ganin, E\. Ustinova, H\. Ajakan, P\. Germain, H\. Larochelle, F\. Laviolette, M\. March, and V\. Lempitsky\(2016\)Domain\-adversarial training of neural networks\.Journal of machine learning research17\(59\),pp\. 1–35\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[10\]S\. Han, J\. Pool, J\. Tran, and W\. Dally\(2015\)Learning both weights and connections for efficient neural network\.Advances in neural information processing systems28\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p3.1),[§2](https://arxiv.org/html/2608.13773#S2.p3.1)\.
- \[11\]K\. He, X\. Zhang, S\. Ren, and J\. Sun\(2016\)Deep residual learning for image recognition\.InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 770–778\.Cited by:[§3\.4](https://arxiv.org/html/2608.13773#S3.SS4.p3.2),[§4\.1](https://arxiv.org/html/2608.13773#S4.SS1.p1.1)\.
- \[12\]Z\. Liao, V\. Quétu, V\. Nguyen, and E\. Tartaglione\(2023\)Can unstructured pruning reduce the depth in deep neural networks?\.InProceedings of the IEEE/CVF international conference on computer vision,pp\. 1402–1406\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p3.1),[§2](https://arxiv.org/html/2608.13773#S2.p3.1)\.
- \[13\]L\. Liu, Y\. Wang, G\. Liu, K\. Peng, and C\. Wang\(2022\)Membership inference attacks against machine learning models via prediction sensitivity\.IEEE Transactions on Dependable and Secure Computing20\(3\),pp\. 2341–2347\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[14\]Z\. Liu, P\. Luo, X\. Wang, and X\. Tang\(2015\)Deep learning face attributes in the wild\.InProceedings of the IEEE International Conference on Computer Vision \(ICCV\),pp\. 3730–3738\.Cited by:[§4\.1](https://arxiv.org/html/2608.13773#S4.SS1.p1.1)\.
- \[15\]F\. Locatello, S\. Bauer, M\. Lucic, G\. Raetsch, S\. Gelly, B\. Schölkopf, and O\. Bachem\(2019\)Challenging common assumptions in the unsupervised learning of disentangled representations\.Ininternational conference on machine learning,pp\. 4114–4124\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p2.1)\.
- \[16\]D\. Madaan, J\. Shin, and S\. J\. Hwang\(2020\)Adversarial neural pruning with latent vulnerability suppression\.InInternational conference on machine learning,pp\. 6575–6585\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p4.1)\.
- \[17\]R\. Nahon, I\. De Moura Matos, V\. Nguyen, and E\. Tartaglione\(2025\)Debiasing surgeon: fantastic weights and how to find them\.InComputer Vision – ECCV 2024,A\. Leonardis, E\. Ricci, S\. Roth, O\. Russakovsky, T\. Sattler, and G\. Varol \(Eds\.\),Cham,pp\. 435–452\.External Links:ISBN 978\-3\-031\-73013\-9Cited by:[§3\.4](https://arxiv.org/html/2608.13773#S3.SS4.p1.1)\.
- \[18\]J\. Nam, H\. Cha, S\. Ahn, J\. Lee, and J\. Shin\(2020\)Learning from failure: training debiased classifier from biased classifier\.InAdvances in Neural Information Processing Systems,Cited by:[§4\.1](https://arxiv.org/html/2608.13773#S4.SS1.p1.1)\.
- \[19\]S\. Ravfogel, Y\. Elazar, H\. Gonen, M\. Twiton, and Y\. Goldberg\(2020\)Null it out: guarding protected attributes by iterative nullspace projection\.arXiv preprint arXiv:2004\.07667\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p2.1),[§2](https://arxiv.org/html/2608.13773#S2.p2.1)\.
- \[20\]S\. Sagawa, A\. Raghunathan, P\. W\. Koh, and P\. Liang\(2020\)An investigation of why overparameterization exacerbates spurious correlations\.InInternational Conference on Machine Learning,pp\. 8346–8356\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p2.1)\.
- \[21\]S\. Sagawa\*, P\. W\. Koh\*, T\. B\. Hashimoto, and P\. Liang\(2020\)Distributionally robust neural networks\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=ryxGuJrFvS)Cited by:[§4\.1](https://arxiv.org/html/2608.13773#S4.SS1.p1.1)\.
- \[22\]A\. D\. Selbst, D\. Boyd, S\. A\. Friedler, S\. Venkatasubramanian, and J\. Vertesi\(2019\)Fairness and abstraction in sociotechnical systems\.InProceedings of the conference on fairness, accountability, and transparency,pp\. 59–68\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p1.1)\.
- \[23\]R\. Shokri, M\. Stronati, C\. Song, and V\. Shmatikov\(2017\)Membership inference attacks against machine learning models\.In2017 IEEE symposium on security and privacy \(SP\),pp\. 3–18\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p1.1),[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[24\]C\. Song and V\. Shmatikov\(2019\)Auditing data provenance in text\-generation models\.InProceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining,pp\. 196–206\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p1.1)\.
- \[25\]B\. Stahl and H\. Gamper\(2025\)Distillation and pruning for scalable self\-supervised representation\-based speech quality assessment\.InICASSP 2025\-2025 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 1–5\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p3.1)\.
- \[26\]E\. Tartaglione\(2022\)Information removal at the bottleneck in deep neural networks\.External Links:2210\.00891,[Link](https://arxiv.org/abs/2210.00891)Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p1.1),[§3\.3](https://arxiv.org/html/2608.13773#S3.SS3.p2.1),[§3\.3](https://arxiv.org/html/2608.13773#S3.SS3.p3.1)\.
- \[27\]E\. Voita, D\. Talbot, F\. Moiseev, R\. Sennrich, and I\. Titov\(2019\)Analyzing multi\-head self\-attention: specialized heads do the heavy lifting, the rest can be pruned\.arXiv preprint arXiv:1905\.09418\.Cited by:[§1](https://arxiv.org/html/2608.13773#S1.p3.1)\.
- \[28\]S\. Ye, K\. Xu, S\. Liu, H\. Cheng, J\. Lambrechts, H\. Zhang, A\. Zhou, K\. Ma, Y\. Wang, and X\. Lin\(2019\)Adversarial robustness vs\. model compression, or both?\.InProceedings of the IEEE/CVF international conference on computer vision,pp\. 111–120\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p4.1)\.
- \[29\]B\. H\. Zhang, B\. Lemoine, and M\. Mitchell\(2018\)Mitigating unwanted biases with adversarial learning\.InProceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society,pp\. 335–340\.Cited by:[§2](https://arxiv.org/html/2608.13773#S2.p2.1)\.