Adversarial Robustness and Privacy Leakage of Edge-Deployed Vision-Language Models for GDPR Compliance - Codebase

This master’s thesis, Adversarial Robustness and Privacy Leakage of Edge-DeployedVision-Language Models for GDPR Compliance, by Nika Asatiani, supervised by EleneTabidze and advised by Ankur Chattopadhyay, investigates the reliability of VisionLanguage Models (VLMs) as automated privacy screeners under the General DataProtection Regulation (GDPR). VLMs offer a promising approach to identifying personaldata in visual content, as their instruction-based reasoning allows privacy policies to beenforced through prompts rather than retraining dedicated classifiers. However, deployingVLMs for privacy screening raises questions about adversarial robustness and the risk thatthe screening process itself leaks sensitive information.This thesis introduces a reusable, model-agnostic benchmark framework and comparesan edge-deployed VLM (Qwen2-VL-7B, 4-bit quantized) with a cloud alternative (GoogleGemini API) on a 108-image VISPR subset across pixel-level perturbations (Gaussiannoise, FGSM, PGD), semantic attacks (typographic injection, contextual camouflage),membership inference, and an explainability-leakage audit of Chain-of-Thought reasoning.The edge model achieves 85% recall—a 37% relative improvement over the cloud model’s62%—driven by a conservative bias that aligns with GDPR’s precautionary principle. Pixellevel adversarial attacks prove largely ineffective, with baseline-aware attack successrates at or below 2.22%; stronger perturbations paradoxically increase recall rather thandegrade it. Typographic injection emerges as the most significant vulnerability at 20.0%attack success rate, exploiting the model’s tendency to treat embedded text as authoritative input, while contextual camouflage has negligible impact at 2.22%. Membershipinference accuracy is indistinguishable from random guessing, confirming no exploitabledata memorization. However, the model’s reasoning text can disclose the very personalattributes it is deployed to protect, even when the binary verdict reads “Safe,” revealing anexplainability–privacy tension.These findings demonstrate that edge deployment can outperform cloud alternatives onGDPR-critical metrics while eliminating cross-border data transfer concerns. Defensiveefforts should prioritize typographic-injection mitigation, and reasoning outputs must betreated as potentially sensitive data. The benchmark framework provides a foundation forextending these evaluations to emerging VLM architectures