Paper deep dive
CutClean: Neural Network Pruning for Privacy-Preserving Inference
Leonardo Magliolo, Vito Paolo Pastore, Giuseppe Valenzise, Enzo Tartaglione
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 8/17/2026, 4:19:11 AM
Summary
The paper introduces CutClean, a privacy-aware structured pruning framework designed to reduce private attribute leakage in neural networks. It employs auxiliary linear privacy heads at network blocks to quantify information leakage and applies increasing levels of sparsity to remove components contributing to private attribute predictability. Experiments on datasets like CelebA, Waterbirds, and Corrupted-CIFAR10 demonstrate that CutClean effectively minimizes private information flow while achieving high sparsity rates and preserving target classification accuracy.
Entities (9)
Relation Signals (8)
CutClean → applies → Structured Pruning
confidence 95% · we propose CutClean, a privacy-aware pruning method... further applies increasing levels of sparsity
CutClean → uses → Privacy Head
confidence 95% · Our approach employs auxiliary linear privacy heads placed at each network's block to quantify information leakage
CutClean → evaluatedon → Waterbirds
confidence 90% · Experiments on synthetic and real-world datasets... Waterbirds
CutClean → evaluatedon → Corrupted-CIFAR10
confidence 90% · Experiments on synthetic and real-world datasets... Corrupted-CIFAR10
CutClean → evaluatedon → CelebA
confidence 90% · Experiments on synthetic and real-world datasets... CelebA
CutClean → optimizesusing → Mutual Information
confidence 90% · online batch Mutual Information (MI)-aware training... minimize I_z
CutClean → supports → ResNet18
confidence 85% · For ResNet18 [11], we consider each residual stage as a pruning block.
CutClean → supports → ViT-B/16
confidence 85% · For the experiments with ViT-B16, we treat each transformer stage... as a block
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Neural networks are increasingly deployed in high-stakes applications with growing privacy leakage concerns. We show that this privacy leakage can occur even in the absence of representation imbalances that lead to traditional dataset biases. This poses significant privacy risks when deploying models that process sensitive attributes. In this context, we propose CutClean, a privacy-aware pruning method that allows to reduce privacy information flow through the network, while increasing its sparsity. Our approach employs auxiliary linear privacy heads placed at each network's block to quantify information leakage, and further applies increasing levels of sparsity to remove the private attribute leakage, measured in terms of the accuracy of the privacy head attached to the last block. Experiments on synthetic and real-world datasets demonstrate that our approach effectively minimizes private information flow while achieving high sparsity rates and preserving classification target accuracy.
Tags
Links
- Source: https://arxiv.org/abs/2608.13773v1
- Canonical: https://arxiv.org/abs/2608.13773v1
Trouble viewing inline? Open PDF directly →
Full Text
41,230 characters extracted from source content.
Expand or collapse full text
CutClean: Neural Network Pruning for Privacy-Preserving Inference Leonardo Magliolo Affiliation: LTCI, Télécom Paris, Institut Polytechnique de Paris, France Vito Paolo Pastore Affiliation: MaLGa-DIBRIS, University of Genoa, Italy Affiliation: Istituto Italiano di Tecnologia, Italy Giuseppe Valenzise Affiliation: Universite Paris-Saclay, CNRS, CentraleSupélec, L2S, France E-mail leonardo.magliolo, enzo.tartaglione@telecom-paris.fr Enzo Tartaglione E-mail giuseppe.valenzise@l2s.centralesupelec.fr E-mail vito.paolo.pastore@unige.it Affiliation: LTCI, Télécom Paris, Institut Polytechnique de Paris, France Abstract Neural networks are increasingly deployed in high-stakes applications with growing privacy leakage concerns. We show that this privacy leakage can occur even in the absence of representation imbalances that lead to traditional dataset biases. This poses significant privacy risks when deploying models that process sensitive attributes. In this context, we propose CutClean, a privacy-aware pruning method that allows to reduce privacy information flow through the network, while increasing its sparsity. Our approach employs auxiliary linear privacy heads placed at each network’s block to quantify information leakage, and further applies increasing levels of sparsity to remove the private attribute leakage, measured in terms of the accuracy of the privacy head attached to the last block. Experiments on synthetic and real-world datasets demonstrate that our approach effectively minimizes private information flow while achieving high sparsity rates and preserving classification target accuracy.11 1 This work has been accepted for publication at the International Conference on Pattern Recognition 2026. Keywords: Privacy preservation pruning structured sparsity mutual information. 1 Introduction Neural networks are increasingly deployed in high-stakes domains such as healthcare, finance, biometric authentication, and social services, where automated decisions can have significant societal and individual consequences. In response to these risks, recent regulatory frameworks—most notably the European Union’s AI Act [1]—have placed strong emphasis on privacy protection, data minimization, and safeguards against unintended uses of sensitive information [22]. Despite these advances, modern neural networks remain prone to side leakage: even when models are trained without explicit access to sensitive attributes, their internal representations can encode private information that may later be extracted by adversaries, auxiliary classifiers, or downstream tasks [8, 23]. This misalignment between regulatory intent and model behavior poses substantial privacy risks, particularly in real-world deployments where access to trained models or intermediate representations cannot be fully controlled. Existing work on privacy leakage in neural networks has largely focused on biases induced by dataset imbalances or correlations between sensitive and target attributes. In these settings, sensitive information emerges as a byproduct of spurious correlations, and mitigation strategies often rely on dataset balancing, fairness constraints, or adversarial representation learning [20]. However, privacy leakage can persist even in the absence of such imbalances [19, 15]: neural networks may encode sensitive attributes simply because they are predictive of intermediate features or useful for representation learning, rather than due to explicit bias in the training data. This observation challenges the assumption that removing dataset bias alone is sufficient to prevent privacy leakage, and highlights the need for model-centric privacy interventions. In parallel, the machine learning community has explored post-hoc techniques to modify trained networks in order to improve efficiency, robustness, or interpretability. Among these, network pruning [10, 12] has emerged as a powerful tool to reduce model size and computational cost by removing redundant parameters or structures. Structured pruning methods, in particular, remove entire channels, filters, or blocks, enabling deployment-friendly sparsity patterns [5]. Despite their success in efficiency-oriented settings, the potential of pruning as a privacy-preserving mechanism remains underexplored. Intuitively, removing parts of a network that encode sensitive information could reduce privacy leakage [27], but doing so in a principled and measurable way remains an open challenge. In this work, we propose CutClean, a privacy-aware structured pruning framework designed to explicitly reduce private attribute leakage in neural networks. Our approach introduces auxiliary linear privacy heads attached to intermediate blocks of a network, allowing us to quantify how much private information is present at different depths. Rather than relying on dataset-level assumptions, CutClean directly measures privacy leakage through the accuracy of these privacy heads. We then progressively apply structured pruning to remove components that contribute most to private attribute predictability, while monitoring both target task performance and privacy leakage. We empirically validate CutClean on both synthetic and real-world datasets, demonstrating that it achieves high sparsity rates and substantial reductions in private attribute predictability without sacrificing classification performance. We summarize our contributions as follows: • We introduce CutClean, the first structured pruning framework explicitly designed to reduce private attribute leakage in trained neural networks, positioning pruning as a privacy-preserving intervention rather than a compression or robustness tool (Sec. 3.2). • We show that significant reductions in private attribute leakage can be achieved without adversarial minimax optimization, improving stability and post-deployment applicability (Sec. 4.2). • We demonstrate that CutClean achieves high structured sparsity while preserving target task accuracy, revealing an unexpected compatibility between privacy leakage reduction and efficient model deployment (Sec. 4.3). 2 Related works Privacy Leakage and Adversarial Attribute Inference. A growing body of work has shown that neural network representations can leak sensitive information even when protected attributes are not explicitly used during training [8, 23]. Attribute inference attacks and auxiliary classifier attacks demonstrate that sensitive attributes such as gender, ethnicity, or health status can often be recovered from learned features with high accuracy [8, 24, 13]. These findings have motivated the use of adversarial classifiers, often referred to as privacy heads or attribute classifiers [26], to quantify or exploit privacy leakage in intermediate representations [7, 9]. In this setting, privacy risk is typically measured by the accuracy of an attacker trained to predict a sensitive attribute from a model’s internal features. Debiasing and Privacy. Beyond adversarial training, several approaches have investigated post-hoc techniques for mitigating bias and privacy leakage, including feature projection, representation obfuscation, and fine-tuning with regularization constraints [19, 3]. These methods often focus on fairness metrics or demographic parity, rather than explicitly quantifying and minimizing information leakage [29, 4]. Few works consider structured model modification as a mechanism to control privacy risk after training, particularly without modifying the original loss function or requiring repeated adversarial retraining. Pruning in Neural Networks. Network pruning aims to reduce model complexity by removing redundant parameters, channels, or structural components [10, 12, 2]. While pruning has traditionally been studied in the context of model compression, acceleration, and robustness, recent work has begun to explore its impact on representation properties [25, 6]. However, most existing pruning strategies are agnostic to privacy or bias considerations and rely solely on task performance or weight magnitude as pruning criteria. CutClean differs from prior work by leveraging pruning to privacy leakage reduction, guided by explicit measures of sensitive attribute predictability. Rather than relying on adversarial minimax optimization, our approach uses auxiliary linear privacy heads solely as diagnostic tools to quantify information flow at different network depths. By progressively pruning network components that contribute to private attribute leakage, CutClean avoids the instability and retraining overhead of adversarial debiasing while enabling deployment-friendly sparsity. This positions structured pruning as a practical and effective post-hoc privacy-preserving mechanism, complementing existing training-time approaches to debiasing and privacy protection. The success of CutClean is prompted by adversarial robustness works showing that properly pruned architectures can be robust to adversarial attacks [28, 16]: differently from these, CutClean aims at removing specific attributes that can be in-distribution at training and are not necessarily outliers. 3 Method 3.1 Problem Formulation In this section, we define the main concepts and objectives of this work. We want a neural network f:→f:X to learn the mapping between inputs x and output labels y y while preventing the model from conveying information about a secondary private label z^∈ z . The network f is composed of successive blocks bii=1B\b_i\_i=1^B, with intermediate output described as: ∀i∈[1,B],hi=bi(hi−1),∀ i∈[1,B], h_i=b_i(h_i-1), (1) with h0=h_0=x and ^=gc(hB) y=g^c(h_B), where gcg^c is the softmaxed linear used as the task-specific classification head. We estimate the amount of information conveyed by each intermediate output throughout the network attaching one auxiliary linear layer to the output of each block, acting as a privacy head: ∀i∈[1,B],z^i=gip(hi).∀ i∈[1,B], z_i=g^p_i(h_i). (2) In the naive setup, the main model is trained by minimization of a cross-entropy loss ℒy(y^)L_y( y) and each privacy head gipg^p_i is trained by minimization of the cross-entropy loss ℒz(z^i)L_z( z_i) whose error is not propagated to the backbone f. The performance of the privacy heads can be seen as a measure of the private information that can be extracted from the corresponding block outputs. We propose to compute a series of pruning masks mii=1B\m_i\_i=1^B applied to network channels in each corresponding block, aiming to reach the best trade-off between performance on the main task and sparsity in the pruned network, while minimizing the amount of private information extractable from the network representations, i.e. decreasing the performance of the privacy heads close to random guess. The definition of a block depends on the specific architecture, as described in Sec. 4.1. 3.2 Proposed Approach Figure 1: Schematic overview of CutClean. The goal of this work is to prune the network under the constraint of minimizing the private information flowing through the network representations. To do so, we add adversarial terms in the optimization objective to reduce the performance of optimally trained privacy heads attached to the outputs of all blocks. We measure the private information flow as the accuracy of the privacy head attached to the last network’s block. The proposed privacy-aware pruning strategy, that we refer to as CutClean, is schematically represented in Fig. 1, while its pseudocode description is reported in the Supplementary material. First, we pre-train our network applying an alternating training procedure to obtain a privacy-aware backbone, that we refer to as online batch Mutual Information (MI)-aware training. Then, we perform a custom pruning scheme exploring different candidate sparsity levels with a grid search over a fixed grid (s∈[0,1]s∈ [0,1 ]). To control the trade-off between sparsity and private information flow, we monitor the validation accuracy of the last privacy head. We define a sparsity level as admissible, if the last privacy head accuracy, after fine-tuning, is lower or equal to a defined threshold PthresholdP^threshold. We fine-tune each pruned model corresponding to an admissible sparsity level for a small fixed number of epochs, using the alternating MI-aware training procedure employed for the pre-training. Among the admissible pruned models, the one performing best on the validation set is selected and employed for evaluation on the test set. We will now provide more details on the main components of our pipeline, including the online batch MI-aware training (Sec. 3.3) and the designed pruning strategy (Sec. 3.4). 3.3 Online Batch MI-aware Training Naively, we could employ an optimization function such as =ℒy(y^)−∑i=1Bℒz(z^i).J=L_y( y)- _i=1^BL_z( z_i). (3) However, as shown in [26], such an optimization goal could lead to degenerate solutions in which the privacy head systematically misclassifies the private attributes with high confidence. This behavior still requires the backbone to encode the private attribute reliably (the head must infer the correct class in order to invert it), and therefore does not effectively remove private information from the representation. To avoid this issue, in this work we rely on a differentiable proxy for the mutual information between the output z z of a privacy head and the private labels, similarly to [26]. For a given head output z^i z_i, this proxy of mutual information is computed as ℐz(z^i)=∑j=1||∑k=1||p~(z^i=j,z=k)log[p~(z^i=j,z=k)p~(z^i=j)p~(z=k)],I_z( z_i)=Σ^|Z|_j=1Σ^|Z|_k=1 p( z_i=j,z=k) [ p( z_i=j,z=k) p( z_i=j) p(z=k) ], (4) being, across the minibatch: • p~(z^i=j) p( z_i=j), the empirical frequency of private class j, • p~(z=k) p(z=k), the mean of the kthk^th softmaxed output of the privacy head, • p~(z^i=j,z=k) p( z_i=j,z=k), the mean of the kthk^th softmaxed output of the privacy head when the true label is j. Our optimization function can thus be defined as =ℒy(y^)+∑i=1Bγiℐz(z^i),J=L_y( y)+ _i=1^B _iI_z( z_i), (5) where γii=1B=γ∀i\ _i\_i=1^B=γ\ ∀ i, and γ is a fundamental hyperparameter controlling the strength of the regularization for each privacy head. In our experiment, we set γ with a tuning procedure choosing the value bringing the lowest validation accuracy of the last privacy head. Contrary to maximizing ℒzL_z, minimizing ℐzI_z forces the representation to discard information about the private attribute: in the limit ℐz→0I_z→ 0, the optimal privacy classifier is forced to avoid exploiting the prior over z, and its accuracy is upper bounded by maxz∈p(z) _z p(z) (which reduces to 1/||1/|Z| only in the perfectly balanced case). Our objective is therefore to obtain block outputs hii=1B\h_i\_i=1^B such that the privacy heads cannot extract meaningful private information from them. In practice, we first pre-train the model with the objective J defined in (5) for a fixed number of epochs. Specifically, for each mini-batch, we alternate between: • updating the privacy heads gipi=1B\g^p_i\_i=1^B with the cross-entropy loss ∑i=1Bℒz(z^i) _i=1^BL_z( z_i) while keeping the backbone f fixed; • updating the backbone and task head by minimizing J while keeping all privacy heads fixed. The same batchwise alternating scheme is reused whenever we fine-tune a pruned model, so that the privacy objective is enforced consistently throughout all training stages. 3.4 Designed pruning strategy Building on the insights of [17], we know that depending on the task, and the private features at hand, it is possible to prune very heavily specific layers in the network without compromising performance on the main task, while other layers tend to be very sensitive to pruning. Therefore, we prune our network by gradually increasing a global sparsity level s applied to all blocks, within an upper bound on the accuracy of the privacy head connected to the last network’s block, that we employ as a proxy for the private attribute flow. We use L1L_1-norm structured pruning to maximize the impact on memory efficiency and energy consumption. Specifically, our pruning approach removes entire channels from layers based on their (normalized) L1L_1-norm values. Let us consider a convolutional layer with weight tensor i∈ℝCout×Cin×KH×KWW_i ^C_out× C_in× K_H× K_W, where c indexes channels, j indexes input channels, and (h,w)(h,w) index spatial kernel dimensions. For each output channel c in a prunable layer, we compute the normalized L1L_1-norm ∥i[c,:,:,:]∥1=1CinKHKW∑j,h,w|i[c,j,h,w]|,\|W_i[c,:,:,:]\|_1= 1C_inK_HK_W _j,h,w|W_i[c,j,h,w]|, and then permanently remove the channels with the lowest norms by applying a structured mask ℳis∈0,1CoutM_i^s∈\0,1\^C_out where ℳis[c]=1M_i^s[c]=1 if channel c is among the top-(1−s)⋅Cout(1-s)· C_out channels of its layer by normalized L1L_1-norm, and ℳis[c]=0M_i^s[c]=0 otherwise, with s being the target sparsity level. This structured approach offers significant practical advantages over unstructured pruning methods: • Memory-wise, removing entire channels reduces the actual tensor dimensions from ℝCout×Cin×KH×KWR^C_out× C_in× K_H× K_W to ℝ(1−s)⋅Cout×Cin×KH×KWR^(1-s)· C_out× C_in× K_H× K_W, leading to genuine memory savings during both training and inference. • Computationally, eliminating output channels reduces the number of convolution operations from O(Cout⋅Cin⋅KH⋅KW⋅H⋅W)O(C_out· C_in· K_H· K_W· H· W) to O((1−s)⋅Cout⋅Cin⋅KH⋅KW⋅H⋅W)O((1-s)· C_out· C_in· K_H· K_W· H· W), resulting in measurable speedup proportional to the sparsity level. These benefits in model size and energy consumption are shown in Sec. 4. Working with blocks. While we ideally could define and prune channels at the output of each and every layer of a model, this can, in practice, result in too long an optimization process and in architectures that are difficult to deploy efficiently. Furthermore, in models such as ResNets [11] that have skip connections, information can bypass some layers. For these reasons, we group layers into blocks. The structured pruning scheme described above is applied channel-wise across all blocks of the network, while the privacy objective is enforced at the end of each block via its corresponding privacy head. 4 Experiments 4.1 Setup Datasets. We perform experiments on both syntethic and real-world datasets, evaluating CutClean performance with diverse private attributes. Specifically, we employ Corrupted-Cifar10 [18] where the private attribute corresponds to image corruptions, Waterbirds [21] where it is in the background, and CelebA [14], a face dataset that present multiple labels, with high-level sensitive attributes such as gender or ethnicity. Here, we consider two target attributes for CelebA, that is "blonde" and "heavy make-up". For all these datasets, we build custom versions balanced with respect to target and private attribute, as detailed in the Supplementary material. Data pre-processing and pruning details. For each model, we start from ImageNet-1k pre-trained weights. For each dataset, images are resized to 224×224224× 224, and we employ horizontal flips and random crops during training. For ResNet18 [11], we consider each residual stage as a pruning block. For the experiments with ViT-B16, we treat each transformer stage between downsampling operations as a block, and we prune the output channels of convolutional projections and feed-forward layers consistently within a block. The last privacy head threshold is defined according to the number of classes. Specifically, we set Pthreshold=65%P^threshold=65\% for waterbirds and Celeb-A, with two target classes, and Pthreshold=20%P^threshold=20\% for the syntethic dataset Corrupted-CIFAR10. Training details. We employ SGD with momentum 0.90.9 as optimizer, with a cosine learning-rate decay. The MI pretraining phase runs for 400400 epochs with an initial learning rate of 10−210^-2, while the MI fine-tuning phase after pruning runs for 1010 epochs with an initial learning rate of 10−210^-2. Weight decay is set to 10−410^-4, and a batch size of 124124 is used for all the datasets. 4.2 Results In this section, we present CutClean results on the selected datasets, reporting the best γ selection procedure, and then evaluating the corresponding pruned model in terms of sparsity, target and privacy head test accuracy. Results on Celeb-A: Blonde target attribute. Table 1 shows the target accuracy and the last privacy head accuracy on the validation set for Celeb-A, considering the target attribute “blonde", for different values of γ. We can notice how γ=0γ=0, which corresponds to our baseline model with no MI-aware training, brings a high validation accuracy for the last privacy head of 90.61%90.61\%, confirming a clear privacy information flow through the model. On the other hand, γ=1000γ=1000 provides the lowest privacy head accuracy and is therefore selected for the rest of our pipeline. Table 2 summarizes the corresponding CutClean results. While preserving task accuracy, with a negligible reduction of less than 1.5%1.5\% on the test accuracy, our method allows to obtain a significant reduction of the privacy information flow, with a minus 24.86%24.86\% in the privacy head accuracy, further allowing to compress the model with a sparsity level of 60%60\%. Table 1: Target and last privacy head accuracy on the validation set for different values of γ for Celeb-A "blonde" attribute. γ Target Accuracy (%) Last PH accuracy (%) 0 91.71±0.8491.71± 0.84 90.61±0.4590.61± 0.45 0.01 92.17±0.7992.17± 0.79 87.68±0.5887.68± 0.58 0.10 89.93±0.5889.93± 0.58 74.13±1.6974.13± 1.69 1 89.15±1.8589.15± 1.85 71.34±2.3871.34± 2.38 5 89.47±0.7589.47± 0.75 71.15±0.6771.15± 0.67 10 89.61±0.2689.61± 0.26 69±0.6669± 0.66 50 89.47±0.6489.47± 0.64 65.75±2.5765.75± 2.57 100 90.02±0.3990.02± 0.39 64.06±1.8864.06± 1.88 500 89.29±1.3689.29± 1.36 61.45±1.8261.45± 1.82 γ⋆=1000γ =1000 89.65±0.7189.65± 0.71 61.13 ± 1.46 Table 2: Target accuracy, last privacy head accuracy on the test set and sparsity level on Celeb-A "blonde" attribute. Model Target Accuracy (%) Last PH Accuracy (%) Sparsity (%) Baseline 91.81±0.8591.81± 0.85 87.59±1.1487.59± 1.14 0 CutClean 90.32±0.6490.32± 0.64 62.73±1.2462.73± 1.24 60 CutClean w/o fine-tuning 88.84±1.1688.84± 1.16 61.02±2.3661.02± 2.36 5 Results on Celeb-A: Heavy make-up target attribute. Table 3 summarizes the target and the last privacy head validation accuracy for the attribute "Heavy make-up" in Celeb-A with respect to different values of γ. Similarly to the previous attribute, a naive training (γ=0γ=0) brings a high accuracy in the last privacy head, while γ=5γ=5 allows to reduce privacy flow with a decreasing in the privacy head accuracy of almost 20%20\%, and is therefore selected for the rest of our pipeline. Table 4 shows the corresponding CutClean results. On the test set, our pruned model achieves a reduction of privacy head accuracy of 15.91%15.91\%, while preserving a good target accuracy of 73.11%73.11\%, with a final sparsity of 30%30\%. Table 3: Target and last privacy head accuracy on the validation set for different values of γ for Celeb-A "Heavy make-up" attribute. γ Target Accuracy (%) Last PH accuracy (%) 0 74.07±3.4674.07± 3.46 81.48±7.2981.48± 7.29 0.01 78.70±1.3178.70± 1.31 85.19±7.2985.19± 7.29 0.10 74.07±5.7174.07± 5.71 78.70±4.7278.70± 4.72 1 73.15±4.7273.15± 4.72 76.85±1.3176.85± 1.31 γ⋆=5γ =5 75±3.9375± 3.93 62.04 ± 14.76 10 70.37±2.6270.37± 2.62 63.89±3.9363.89± 3.93 50 67.59±1.3167.59± 1.31 67.59±1.3167.59± 1.31 100 68.52±1.3168.52± 1.31 64.81±7.9764.81± 7.97 500 64.81±5.7164.81± 5.71 69.44±7.8669.44± 7.86 1000 70.37±4.7270.37± 4.72 64.81±2.6264.81± 2.62 Table 4: CutClean performance on Celeb-A, "Heavy make-up" attribute Model Target Accuracy (%) Last PH Accuracy (%) Sparsity (%) Baseline 77.65±4.7677.65± 4.76 80.30±0.5380.30± 0.53 0 CutClean 73.11±6.2973.11± 6.29 64.39±4.9864.39± 4.98 30 CutClean w/o fine-tuning 55.30±9.1955.30± 9.19 59.47±7.5659.47± 7.56 40 Results on Corrupted-CIFAR10. Table 5 shows the results of our hyperparameter tuning procedure for selecting the best γ on Corrupted-CIFAR10. Despite the different semantics of the private attribute, which here is an image corruption, without our MI-aware training procedure (γ=0γ=0), the privacy head accuracy on the validation set is around 64%64\%, confirming privacy information flow through the network. Similarly to the "blonde" target attribute in Celeb-A, γ=1000γ=1000 provides the lowest privacy head accuracy, which is close to random guess (14.57%14.57\%), and is employed in the rest of CutClean procedure. Table 6 shows the results on the test set for the pruned model. Here, we can reach very low accuracy on the privacy head (13.33%13.33\%), while maintaining good performances on the target classification task (81.36%81.36\%), and with a corresponding sparsity value of 10%10\%. Table 5: Target and last privacy head accuracy on the validation set for different values of γ for Corrupted-CIFAR10. γ Target Accuracy (%) Last PH accuracy (%) 0 83.89±0.2783.89± 0.27 64.41±0.8164.41± 0.81 0.01 84.05±0.5184.05± 0.51 63.92±0.8463.92± 0.84 0.10 82.07±0.5982.07± 0.59 41.93±0.5441.93± 0.54 1 80.09±0.1380.09± 0.13 25.44±0.7925.44± 0.79 5 79.53±0.5879.53± 0.58 19.67±0.5119.67± 0.51 10 78.11±0.4978.11± 0.49 17.69±0.5417.69± 0.54 50 77.27±0.5077.27± 0.50 16±1.5016± 1.50 100 76.84±0.7876.84± 0.78 16.56±0.6016.56± 0.60 500 76.05±0.5176.05± 0.51 15.97±0.6615.97± 0.66 γ⋆=1000γ =1000 76.37±0.5276.37± 0.52 14.57 ± 0.69 Table 6: Target accuracy, last privacy head accuracy on the test set and sparsity level on Corrupted-CIFAR10. Model Target Accuracy (%) Last PH Accuracy (%) Sparsity (%) Baseline 84.23±0.4984.23± 0.49 62.87±1.1662.87± 1.16 0 CutClean 81.36±0.3681.36± 0.36 13.33±0.5013.33± 0.50 10 CutClean w/o fine-tuning 75.54±0.3375.54± 0.33 14.59±0.9714.59± 0.97 0 Results on Waterbirds. Table 7 summarizes the target validation accuracy and the last privacy head accuracy at the varying of γ for the waterbirds dataset, where the private attribute is the background. Here, with γ=0γ=0 the privacy information flow is very high, with a corresponding privacy head accuracy of 91.47%91.47\%, while γ=1γ=1 allows to reduce this value up to 69.23%69.23\%, and is used for the rest of CutClean pipeline. As reported in Table 8, with a negligible decrease of 2.21%2.21\% in the target accuracy, our pruned models is capable of providing a reduction in the privacy head accuracy of 24.4%24.4\%, allowing to obtain a sparsity level of 20%20\%. Table 7: Target and last privacy head accuracy on the validation set for different values of γ for Waterbirds. γ Target Accuracy (%) Last PH accuracy (%) 0 90.31±0.0790.31± 0.07 91.47±0.2691.47± 0.26 0.01 90.46±0.5190.46± 0.51 90.36±0.9390.36± 0.93 0.10 89.46±0.6189.46± 0.61 71.64±1.4771.64± 1.47 γ⋆=1γ =1 89.26±0.1989.26± 0.19 69.23 ± 3.50 5 88.20±0.8488.20± 0.84 75.05±0.9475.05± 0.94 10 88±0.7088± 0.70 77.51±2.8677.51± 2.86 50 88.76±0.3188.76± 0.31 78.56±0.8278.56± 0.82 100 88±0.3888± 0.38 80.27±1.3080.27± 1.30 500 87.20±0.6587.20± 0.65 82.93±0.9282.93± 0.92 1000 87.25±0.6287.25± 0.62 83.63±0.8783.63± 0.87 Table 8: Target accuracy, last privacy head accuracy on the test set and sparsity level on waterbirds. Model Target Accuracy (%) Last PH Accuracy (%) Sparsity (%) Baseline 88.76±0.5188.76± 0.51 88.96±0.6188.96± 0.61 0 CutClean 86.55±0.7586.55± 0.75 64.56±1.4864.56± 1.48 20 ClutClean w/o fine-tuning 50.00±0.0150.00± 0.01 50.00±0.0150.00± 0.01 95 4.3 Ablations In this Section, we perform ablation studies to evaluate the impact of the main components of our method. First, we explore vision transformer architectures, replicating our pipeline with a ViT-B16 model. Then, we measure the impact of fine-tuning pruned models and the last privacy head, prior to evaluation on the validation set. Finally, we provide the last privacy head and the target accuracy on the test set for our pruned models as a function of the complete grid of candidate sparsity levels. Results on Transformers. We here replicate the entire CutClean pipeline on the "blonde" target class for Celeb-A dataset, exploiting a ViTB-16 model. First, in Table 9 we report the tuning experiment to select the best γ value, confirming how a naive training procedure shows a significant leakage for the private attribute, while our procedure with γ=50γ=50 provides the best reduction in the last privacy head accuracy. Then, we employ this value of γ for performing CutClean’s pipeline, with results summarized in Table 10. Our results are similar to the ones obtained with ResNet18, allowing to obtain a sparsity level of 50%50\%, with a corresponding reduction in the last privacy head accuracy of 25.11%25.11\%, and a reduction in target accuracy of only 5.48%5.48\%. Table 9: Target and last privacy head accuracy on the validation set for different values of γ for Celeb-A "blonde" attribute, employing a ViTb-16 model. γ Target Accuracy (%) Last PH accuracy (%) 0 90.20±1.6090.20± 1.60 86.86±0.3986.86± 0.39 0.01 89.38±0.9789.38± 0.97 86.08±1.0486.08± 1.04 0.10 87.13±1.1987.13± 1.19 76.28±2.6976.28± 2.69 1 87.96±0.2687.96± 0.26 73.58±1.8073.58± 1.80 5 87.41±1.1387.41± 1.13 76.42±2.6476.42± 2.64 10 87.59±1.9287.59± 1.92 70.42±1.7270.42± 1.72 γ⋆=50γ =50 86.90±2.2286.90± 2.22 68.68 ± 4.13 100 84.80±1.6584.80± 1.65 70.92±2.2770.92± 2.27 500 83.52±0.7983.52± 0.79 71.84±1.1871.84± 1.18 1000 82.60±0.5182.60± 0.51 73.08±1.5873.08± 1.58 Table 10: Target accuracy, last privacy head accuracy on the test set and sparsity level on Celeb-A "blonde" attribute, employing a ViTb-16 model. Model Target Accuracy (%) Last PH Accuracy (%) Sparsity (%) Baseline 90.19±1.0490.19± 1.04 86.90±1.9186.90± 1.91 0 Without retrain after pruning 79.03±3.0179.03± 3.01 64.02±4.0264.02± 4.02 10 With retrain after pruning 84.72±2.1484.72± 2.14 61.73±2.8461.73± 2.84 50 Figure 2: Target and privacy head accuracy on the test set for the investigated datasets for CutClean (Left) and CutClean without fine-tuning (Right). Results are averaged across three runs, standard deviations in the shaded area. Impact of fine-tuning. We replicate our approach without fine-tuning the pruned models prior to evaluation on the validation set. The results reported in the last line of Tables 2, 4, 6, and 8 confirm how fine-tuning allows to retain more the target classification performance of the original model. Furthermore, as within the admissible sparsity levels we select the one corresponding to the pruned models with the highest validation accuracy, even when the target performance can be partially recovered, we end-up selecting models with significantly lower sparsity values (e.g., for waterbirds and "blonde" target attribute in Celeb-A). Analogous results are obtained for the ViT-B16 model (last entry of Table 10), confirming the importance of fine-tuning in our method. Performance at different sparsity levels. In Fig. 2 we report the target and the last privacy head accuracy on the test set, for our complete set of candidate sparsity levels. Again, fine-tuning proves to better maintain the target classification performance for all the datasets, allowing to prune more aggressively before obtaining a severe reduction (for instance, up to 60%60\% of sparsity for the "blonde" target attribute in Celeb-A). Generally, higher level of sparsity values force the pruned models towards random guess, though the last privacy head accuracy shows a slighly different behavior, being capable of recovering private information for higher level of sparsities, as in the case of Celeb-A concerning the "blonde" target attribute. Without fine-tuning, moderate sparsity values are already sufficient to completely destroy the target classification performance, leading to random guess. This value can be as low as 0.150.15 for waterbirds, or higher as in Celeb-A "blonde" target attribute, where it is 0.350.35. 5 Conclusion Despite the wide-spread adoption of deep neural networks, privacy leakage is still a major concern, potentially impacting real-world applications. On the other hand, it is known that deep neural networks are computationally expensive, with pruning techniques generally proposed to improve efficiency while maintaining performance on the target task. In this work, we tackle both issues proposing CutClean, a privacy-aware pruning method capable of significantly reducing the private information flow in a neural network. Exploiting external classifiers connected at each block of the network, that we refer to as privacy heads, we obtain a proxy of the privacy information flow at each block. Spanning over a set of candidate sparsity levels, we prune the network with our custom procedure, considering each level as admissible, if the last privacy head accuracy is below a fixed threshold, set according to the number of target classes, finally selecting the model that performs best on the validation set, in terms of target accuracy. Our results on four datasets confirm that with naive training there is a significant private information leakage, successfully reduced in the pruned models obtained through the proposed CutClean method, with consistent findings on vision transformer architectures. Acknowledgements This work is supported by Hi! PARIS and ANR/France 2030 program (ANR-23-IACL-0005). References [1] E. A. I. Act (2024) The eu artificial intelligence act. European Union. Cited by: §1. [2] M. S. Ali, M. Qamar, S. Bae, and E. Tartaglione (2024) Trimming the fat: efficient compression of 3d gaussian splats through pruning. arXiv preprint arXiv:2406.18214. Cited by: §2. [3] N. Belrose, D. Schneider-Joseph, S. Ravfogel, R. Cotterell, E. Raff, and S. Biderman (2023) Leace: perfect linear concept erasure in closed form. Advances in Neural Information Processing Systems 36, p. 66044–66063. Cited by: §2. [4] A. Beutel, J. Chen, Z. Zhao, and E. H. Chi (2017) Data decisions and theoretical implications when adversarially learning fair representations. arXiv preprint arXiv:1707.00075. Cited by: §2. [5] A. Bragagnolo, E. Tartaglione, A. Fiandrotti, and M. Grangetto (2021) On the role of structured pruning for neural network compression. In 2021 IEEE International Conference on Image Processing (ICIP), p. 3527–3531. Cited by: §1. [6] E. Cassano, R. Renzulli1, and A. Bragagnolo (2025) When does pruning benefit vision representations?. In Image Analysis and Processing–ICIAP 2025: 23rd International Conference, Rome, Italy, September 15–19, 2025, Proceedings, Part I, p. 152. Cited by: §2. [7] H. Edwards and A. Storkey (2015) Censoring representations with an adversary. arXiv preprint arXiv:1511.05897. Cited by: §2. [8] M. Fredrikson, S. Jha, and T. Ristenpart (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, p. 1322–1333. Cited by: §1, §2. [9] Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. March, and V. Lempitsky (2016) Domain-adversarial training of neural networks. Journal of machine learning research 17 (59), p. 1–35. Cited by: §2. [10] S. Han, J. Pool, J. Tran, and W. Dally (2015) Learning both weights and connections for efficient neural network. Advances in neural information processing systems 28. Cited by: §1, §2. [11] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 770–778. Cited by: §3.4, §4.1. [12] Z. Liao, V. Quétu, V. Nguyen, and E. Tartaglione (2023) Can unstructured pruning reduce the depth in deep neural networks?. In Proceedings of the IEEE/CVF international conference on computer vision, p. 1402–1406. Cited by: §1, §2. [13] L. Liu, Y. Wang, G. Liu, K. Peng, and C. Wang (2022) Membership inference attacks against machine learning models via prediction sensitivity. IEEE Transactions on Dependable and Secure Computing 20 (3), p. 2341–2347. Cited by: §2. [14] Z. Liu, P. Luo, X. Wang, and X. Tang (2015) Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), p. 3730–3738. Cited by: §4.1. [15] F. Locatello, S. Bauer, M. Lucic, G. Raetsch, S. Gelly, B. Schölkopf, and O. Bachem (2019) Challenging common assumptions in the unsupervised learning of disentangled representations. In international conference on machine learning, p. 4114–4124. Cited by: §1. [16] D. Madaan, J. Shin, and S. J. Hwang (2020) Adversarial neural pruning with latent vulnerability suppression. In International conference on machine learning, p. 6575–6585. Cited by: §2. [17] R. Nahon, I. De Moura Matos, V. Nguyen, and E. Tartaglione (2025) Debiasing surgeon: fantastic weights and how to find them. In Computer Vision – ECCV 2024, A. Leonardis, E. Ricci, S. Roth, O. Russakovsky, T. Sattler, and G. Varol (Eds.), Cham, p. 435–452. External Links: ISBN 978-3-031-73013-9 Cited by: §3.4. [18] J. Nam, H. Cha, S. Ahn, J. Lee, and J. Shin (2020) Learning from failure: training debiased classifier from biased classifier. In Advances in Neural Information Processing Systems, Cited by: §4.1. [19] S. Ravfogel, Y. Elazar, H. Gonen, M. Twiton, and Y. Goldberg (2020) Null it out: guarding protected attributes by iterative nullspace projection. arXiv preprint arXiv:2004.07667. Cited by: §1, §2. [20] S. Sagawa, A. Raghunathan, P. W. Koh, and P. Liang (2020) An investigation of why overparameterization exacerbates spurious correlations. In International Conference on Machine Learning, p. 8346–8356. Cited by: §1. [21] S. Sagawa*, P. W. Koh*, T. B. Hashimoto, and P. Liang (2020) Distributionally robust neural networks. In International Conference on Learning Representations, External Links: Link Cited by: §4.1. [22] A. D. Selbst, D. Boyd, S. A. Friedler, S. Venkatasubramanian, and J. Vertesi (2019) Fairness and abstraction in sociotechnical systems. In Proceedings of the conference on fairness, accountability, and transparency, p. 59–68. Cited by: §1. [23] R. Shokri, M. Stronati, C. Song, and V. Shmatikov (2017) Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), p. 3–18. Cited by: §1, §2. [24] C. Song and V. Shmatikov (2019) Auditing data provenance in text-generation models. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, p. 196–206. Cited by: §2. [25] B. Stahl and H. Gamper (2025) Distillation and pruning for scalable self-supervised representation-based speech quality assessment. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p. 1–5. Cited by: §2. [26] E. Tartaglione (2022) Information removal at the bottleneck in deep neural networks. External Links: 2210.00891, Link Cited by: §2, §3.3, §3.3. [27] E. Voita, D. Talbot, F. Moiseev, R. Sennrich, and I. Titov (2019) Analyzing multi-head self-attention: specialized heads do the heavy lifting, the rest can be pruned. arXiv preprint arXiv:1905.09418. Cited by: §1. [28] S. Ye, K. Xu, S. Liu, H. Cheng, J. Lambrechts, H. Zhang, A. Zhou, K. Ma, Y. Wang, and X. Lin (2019) Adversarial robustness vs. model compression, or both?. In Proceedings of the IEEE/CVF international conference on computer vision, p. 111–120. Cited by: §2. [29] B. H. Zhang, B. Lemoine, and M. Mitchell (2018) Mitigating unwanted biases with adversarial learning. In Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, p. 335–340. Cited by: §2.