Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications

Aylin Yener; Sennur Ulukus; Tugba Erpek; Yalin E. Sagduyu

arxiv: 2606.31973 · v1 · pith:BZXOJPXBnew · submitted 2026-06-30 · 💻 cs.NI · cs.CR· cs.IT· cs.LG· eess.SP· math.IT

Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications

Yalin E. Sagduyu , Tugba Erpek , Aylin Yener , Sennur Ulukus This is my paper

Pith reviewed 2026-07-01 02:30 UTC · model grok-4.3

classification 💻 cs.NI cs.CRcs.ITcs.LGeess.SPmath.IT

keywords semantic communicationprivacy preservationrelay-assisted systemsadversarial trainingsemantic leakagelatent representationseavesdropping

0 comments

The pith

A relay without source data can still infer semantic meaning from latent representations at levels comparable to the intended receiver.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that relay-assisted semantic communication systems carry a privacy vulnerability because the intermediate relay can extract semantic information directly from transmitted latent representations. It shows the relay achieves reconstruction and semantic inference performance close to the legitimate receiver despite having no access to the original source data. To counter this, the authors introduce an iterative adversarial training process that pits the legitimate system against an adaptively trained eavesdropper at the relay. The resulting representations keep strong semantic decoding at the receiver while weakening inference at the relay, enlarging the accuracy gap across channel conditions while preserving reconstruction fidelity. A reader would care because semantic communications promise efficiency gains but this work identifies an underappreciated leakage path in any system that routes through intermediate nodes.

Core claim

The relay node, operating directly on learned latent representations without access to source data, can reliably infer semantic meaning and reconstruct signals with performance comparable to that of the legitimate receiver. This reveals a fundamental privacy vulnerability of semantic representations. An iterative adversarial training framework is proposed that alternates between optimizing the relay's eavesdropping function and the legitimate system, resulting in representations that preserve semantic decoding performance at the intended receiver while degrading semantic inference at the relay. The semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly en

What carries the argument

Iterative adversarial training framework that explicitly accounts for a strong adaptively trained eavesdropper at the relay to suppress semantic leakage while preserving receiver performance.

If this is right

The semantic accuracy gap between the legitimate receiver and the eavesdropper enlarges significantly.
High reconstruction fidelity is maintained at the receiver while semantic leakage is suppressed.
The protection holds across varying channel conditions.
The approach selectively weakens inference at the relay without degrading the main communication task.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Semantic communication designs may need to incorporate privacy constraints directly into representation learning rather than treating them as an afterthought.
The demonstrated leakage could appear at any intermediate node in multi-hop semantic networks.
The method could be tested by implementing the adversarial training loop in actual wireless hardware to quantify leakage reduction under real propagation.

Load-bearing premise

The relay can extract semantic meaning from latent representations at levels comparable to the receiver even without any access to the source data.

What would settle it

A measurement showing that the relay's semantic inference accuracy remains comparable to the receiver's after the adversarial training is applied, or that the accuracy gap fails to enlarge under the proposed method.

Figures

Figures reproduced from arXiv: 2606.31973 by Aylin Yener, Sennur Ulukus, Tugba Erpek, Yalin E. Sagduyu.

**Figure 3.** Figure 3: Performance (semantic accuracy, PSNR, and SSIM) of the destination and eavesdropping relay across SNR for different latent dimensions [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

**Figure 4.** Figure 4: Evolution of semantic accuracy at the destination and the relay during [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

**Figure 5.** Figure 5: Effect of adversarial loss weight γeve on semantic accuracy at the destination and the relay, and the resulting accuracy gap. content, achieving semantic-specific degradation without noticeable signal distortion. Overall, a large semantic accuracy gap with minimal reconstruction difference indicates effective selective information hiding. IV. CONCLUSION This paper addressed the privacy implications of rel… view at source ↗

read the original abstract

Semantic communication (SemCom) has emerged as a promising paradigm in which the transmission of task-relevant information is prioritized over raw data, enabling efficient and robust communication under resource and channel constraints. In this paper, the privacy implications of relay-assisted SemCom systems are studied, where the intermediate relay node operates directly on learned latent representations. It is shown that the relay, even without access to source data, can reliably infer semantic meaning and reconstruct signals with performance comparable to that of the legitimate receiver, revealing a fundamental privacy vulnerability of semantic representations. To address this issue, an iterative adversarial training framework is proposed in which a strong, adaptively trained eavesdropper at the relay is explicitly accounted for. The proposed approach alternates between optimizing the relay's eavesdropping function and the legitimate system, resulting in representations that preserve semantic decoding performance at the intended receiver while degrading semantic inference at the relay. The semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly enlarged across channel conditions. Importantly, this protection is achieved in a stealthy manner, with high reconstruction fidelity maintained while semantic leakage is selectively suppressed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper flags semantic leakage at relays from latent reps and gives an iterative adversarial training fix, but the leak may hinge on shared task labels rather than the reps alone.

read the letter

The main point is that relays in semantic comms can pull semantic meaning from the transmitted latents even without raw source data, and the authors propose alternating adversarial training to widen the performance gap between the legitimate receiver and the relay eavesdropper while keeping reconstruction quality high.

What stands out as new is the specific iterative loop applied to the relay-assisted setup. They train a strong eavesdropper at the relay and then update the legitimate system to produce latents that stay useful at the intended end but lose value for the relay. This is a straightforward extension of adversarial ideas to this privacy angle in semantic systems.

The paper does a decent job laying out the vulnerability in plain terms and offering a concrete countermeasure that aims to be stealthy. The focus on relay nodes operating directly on latents is a reasonable place to look for leakage risks in future wireless setups.

The soft spot is the one the stress-test note flags. If the relay decoder gets trained on the same semantic labels or correlated task data as the receiver, then the comparable inference performance may come from that shared supervision rather than anything inherent in the latent representation itself. The paper should spell out exactly what information the eavesdropper has access to during its training and testing phases. Without those details or the actual quantitative results, error bars, and ablations, the claim of a fundamental vulnerability looks narrower than stated.

This is aimed at people working on semantic communications and privacy in wireless networks. A reader already following that subfield would pick up the training procedure and the relay-specific framing. It has a clear enough problem and method to deserve a serious referee, though the experiments will need close checking on the data access question.

I would send it to peer review.

Referee Report

2 major / 0 minor

Summary. The paper examines privacy vulnerabilities in relay-assisted semantic communication systems. It claims that an intermediate relay operating directly on learned latent representations can reliably infer semantic meaning and reconstruct signals with performance comparable to the legitimate receiver, even without access to source data. To mitigate this, the authors propose an iterative adversarial training framework that alternates between strengthening an eavesdropper at the relay and optimizing the legitimate system, producing representations that preserve semantic decoding performance at the intended receiver while degrading inference at the relay and enlarging the semantic accuracy gap across channel conditions, all while maintaining high reconstruction fidelity in a stealthy manner.

Significance. If the empirical claims hold with rigorous validation, the work identifies a privacy leakage risk specific to latent semantic representations in relay settings and demonstrates an adversarial training countermeasure that selectively suppresses semantic inference. This could contribute to the design of privacy-aware semantic communication protocols. The iterative training procedure follows established adversarial ML techniques but is applied here to the relay-assisted SemCom context.

major comments (2)

[Abstract] Abstract: The central claims that the relay achieves 'performance comparable to that of the legitimate receiver' and that 'the semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly enlarged' are stated without any quantitative metrics, tables, figures, error bars, dataset descriptions, or ablation results. This absence makes it impossible to assess the magnitude of the reported vulnerability or the effectiveness of the proposed countermeasure.
[Abstract] Abstract: The premise that the relay infers semantic meaning 'even without access to source data' is load-bearing for the claim of a 'fundamental privacy vulnerability.' Clarification is required on whether the eavesdropper decoder is trained using task-specific semantic labels or data drawn from the same distribution as the source task; if supervision is shared, the leakage may depend on correlated task knowledge rather than being intrinsic to the latent representations alone.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments, which help strengthen the presentation of our results. We address each major comment below and will incorporate revisions to improve clarity and support for the claims.

read point-by-point responses

Referee: [Abstract] Abstract: The central claims that the relay achieves 'performance comparable to that of the legitimate receiver' and that 'the semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly enlarged' are stated without any quantitative metrics, tables, figures, error bars, dataset descriptions, or ablation results. This absence makes it impossible to assess the magnitude of the reported vulnerability or the effectiveness of the proposed countermeasure.

Authors: We agree that the abstract would benefit from including key quantitative results to substantiate the claims. The full manuscript contains these details (accuracy values, gap enlargements, error bars, dataset descriptions, and ablations) in Sections 4 and 5 with supporting figures and tables. In the revision, we will update the abstract to concisely report representative metrics (e.g., specific accuracy percentages and gap sizes across channel conditions) while referencing the relevant experimental sections. This addresses the concern without altering the abstract's length constraints. revision: yes
Referee: [Abstract] Abstract: The premise that the relay infers semantic meaning 'even without access to source data' is load-bearing for the claim of a 'fundamental privacy vulnerability.' Clarification is required on whether the eavesdropper decoder is trained using task-specific semantic labels or data drawn from the same distribution as the source task; if supervision is shared, the leakage may depend on correlated task knowledge rather than being intrinsic to the latent representations alone.

Authors: The eavesdropper is trained exclusively on the received latent representations using data drawn from the same distribution as the source task, but without access to the original source data or the task-specific semantic labels employed by the legitimate receiver. The eavesdropper's inference relies on unsupervised or self-supervised objectives applied to the latents alone. This setup is described in the system model and training procedure sections. We will add explicit clarification to the abstract and methodology to emphasize the absence of shared supervision, confirming that the observed leakage arises from the semantic content encoded in the representations themselves. revision: yes

Circularity Check

0 steps flagged

No circularity; derivation is self-contained experimental proposal

full rationale

The paper describes a vulnerability in relay-assisted semantic communications and proposes an iterative adversarial training framework to mitigate it. No equations, fitted parameters, or self-citations are presented in the abstract or description that reduce any prediction or result to an input by construction. The central claims rely on the proposed training procedure and experimental comparisons rather than tautological redefinitions or load-bearing self-references. This is the normal case of a self-contained method paper.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

The work rests on domain assumptions of the semantic communications paradigm; no free parameters or invented entities are described in the abstract.

axioms (2)

domain assumption Semantic communication prioritizes transmission of task-relevant information over raw data via learned latent representations
Stated as the foundational paradigm enabling both the leakage observation and the mitigation approach.
domain assumption A relay node processing latent representations can extract semantic meaning without source data access
Core premise required for the privacy vulnerability claim.

pith-pipeline@v0.9.1-grok · 5748 in / 1375 out tokens · 46356 ms · 2026-07-01T02:30:46.842755+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

15 extracted references

[1]

Semantic index assignment,

B. Guler and A. Yener, “Semantic index assignment,” inIEEE In- ternational Conference on Pervasive Computing and Communication Workshops (PERCOM WORKSHOPS), 2014

2014
[2]

Beyond transmitting bits: Context, semantics, and task-oriented communications,

D. G ¨und¨uz, Z. Qin, I. E. Aguerri, H. S. Dhillon, Z. Yang, A. Yener, K. K. Wong, and C.-B. Chae, “Beyond transmitting bits: Context, semantics, and task-oriented communications,”IEEE Journal on Selected Areas in Communications, vol. 41, no. 1, pp. 5–41, 2023

2023
[3]

Toward semantic communications: Deep learning-based image semantic coding,

D. Huang, F. Gao, X. Tao, Q. Du, and J. Lu, “Toward semantic communications: Deep learning-based image semantic coding,”IEEE Journal on Selected Areas in Communications, vol. 41, no. 1, pp. 55–71, 2022

2022
[4]

Deep learning enabled seman- tic communication systems,

H. Xie, Z. Qin, G. Y . Li, and B.-H. Juang, “Deep learning enabled seman- tic communication systems,”IEEE Transactions on Signal Processing, vol. 69, pp. 2663–2675, 2021

2021
[5]

Will 6G be semantic communications? Opportunities and challenges from task oriented and secure communications to integrated sensing,

Y . E. Sagduyu, T. Erpek, A. Yener, and S. Ulukus, “Will 6G be semantic communications? Opportunities and challenges from task oriented and secure communications to integrated sensing,”IEEE Network, vol. 38, no. 6, pp. 72–80, 2024

2024
[6]

Semantic-forward relaying: A novel framework toward 6G cooperative communications,

W. Lin, Y . Yan, L. Li, Z. Han, and T. Matsumoto, “Semantic-forward relaying: A novel framework toward 6G cooperative communications,” IEEE Communications Letters, vol. 28, no. 3, pp. 518–522, 2024

2024
[7]

Semantic forwarding for next gener- ation relay networks,

E. Arda, E. Kutay, and A. Yener, “Semantic forwarding for next gener- ation relay networks,” inIEEE Conference on Information Sciences and Systems (CISS), 2024

2024
[8]

Distributed task-oriented communication networks with multimodal semantic relay and edge intelligence,

J. Guo, H. Chen, B. Song, Y . Chi, C. Yuen, F. R. Yu, G. Y . Li, and D. Niyato, “Distributed task-oriented communication networks with multimodal semantic relay and edge intelligence,”IEEE Communications Magazine, vol. 62, no. 6, pp. 82–89, 2024

2024
[9]

Autoencoder-based semantic communication systems with relay channels,

X. Luo, B. Yin, Z. Chen, B. Xia, and J. Wang, “Autoencoder-based semantic communication systems with relay channels,” inIEEE Interna- tional Conference on Communications (ICC) Workshops, 2022

2022
[10]

Is semantic communication secure? A tale of multi-domain adversarial attacks,

Y . E. Sagduyu, T. Erpek, S. Ulukus, and A. Yener, “Is semantic communication secure? A tale of multi-domain adversarial attacks,”IEEE Communications Magazine, vol. 61, no. 11, pp. 50–55, 2023

2023
[11]

Task-oriented communications for nextG: End-to-end deep learning and AI security aspects,

Y . E. Sagduyu, S. Ulukus, and A. Yener, “Task-oriented communications for nextG: End-to-end deep learning and AI security aspects,”IEEE Wireless Communications, vol. 30, no. 3, pp. 52–60, 2023

2023
[12]

Secure semantic communications: Fundamentals and challenges,

Z. Yang, M. Chen, G. Li, Y . Yang, and Z. Zhang, “Secure semantic communications: Fundamentals and challenges,”IEEE Network, vol. 38, no. 6, pp. 513–520, 2024

2024
[13]

Semprotector: A unified framework for semantic protection in deep learning-based semantic communication systems,

X. Liu, G. Nan, Q. Cui, Z. Li, P. Liu, Z. Xing, H. Mu, X. Tao, and T. Q. Quek, “Semprotector: A unified framework for semantic protection in deep learning-based semantic communication systems,” IEEE Communications Magazine, vol. 61, no. 11, pp. 56–62, 2023

2023
[14]

Encrypted semantic com- munication using adversarial training for privacy preserving,

X. Luo, Z. Chen, M. Tao, and F. Yang, “Encrypted semantic com- munication using adversarial training for privacy preserving,”IEEE Communications Letters, vol. 27, no. 6, pp. 1486–1490, 2023

2023
[15]

Privacy-preserving task-oriented semantic communications against model inversion attacks,

Y . Wang, S. Guo, Y . Deng, H. Zhang, and Y . Fang, “Privacy-preserving task-oriented semantic communications against model inversion attacks,” IEEE Transactions on Wireless Communications, vol. 23, no. 8, pp. 10 150–10 165, 2024

2024

[1] [1]

Semantic index assignment,

B. Guler and A. Yener, “Semantic index assignment,” inIEEE In- ternational Conference on Pervasive Computing and Communication Workshops (PERCOM WORKSHOPS), 2014

2014

[2] [2]

Beyond transmitting bits: Context, semantics, and task-oriented communications,

D. G ¨und¨uz, Z. Qin, I. E. Aguerri, H. S. Dhillon, Z. Yang, A. Yener, K. K. Wong, and C.-B. Chae, “Beyond transmitting bits: Context, semantics, and task-oriented communications,”IEEE Journal on Selected Areas in Communications, vol. 41, no. 1, pp. 5–41, 2023

2023

[3] [3]

Toward semantic communications: Deep learning-based image semantic coding,

D. Huang, F. Gao, X. Tao, Q. Du, and J. Lu, “Toward semantic communications: Deep learning-based image semantic coding,”IEEE Journal on Selected Areas in Communications, vol. 41, no. 1, pp. 55–71, 2022

2022

[4] [4]

Deep learning enabled seman- tic communication systems,

H. Xie, Z. Qin, G. Y . Li, and B.-H. Juang, “Deep learning enabled seman- tic communication systems,”IEEE Transactions on Signal Processing, vol. 69, pp. 2663–2675, 2021

2021

[5] [5]

Will 6G be semantic communications? Opportunities and challenges from task oriented and secure communications to integrated sensing,

Y . E. Sagduyu, T. Erpek, A. Yener, and S. Ulukus, “Will 6G be semantic communications? Opportunities and challenges from task oriented and secure communications to integrated sensing,”IEEE Network, vol. 38, no. 6, pp. 72–80, 2024

2024

[6] [6]

Semantic-forward relaying: A novel framework toward 6G cooperative communications,

W. Lin, Y . Yan, L. Li, Z. Han, and T. Matsumoto, “Semantic-forward relaying: A novel framework toward 6G cooperative communications,” IEEE Communications Letters, vol. 28, no. 3, pp. 518–522, 2024

2024

[7] [7]

Semantic forwarding for next gener- ation relay networks,

E. Arda, E. Kutay, and A. Yener, “Semantic forwarding for next gener- ation relay networks,” inIEEE Conference on Information Sciences and Systems (CISS), 2024

2024

[8] [8]

Distributed task-oriented communication networks with multimodal semantic relay and edge intelligence,

J. Guo, H. Chen, B. Song, Y . Chi, C. Yuen, F. R. Yu, G. Y . Li, and D. Niyato, “Distributed task-oriented communication networks with multimodal semantic relay and edge intelligence,”IEEE Communications Magazine, vol. 62, no. 6, pp. 82–89, 2024

2024

[9] [9]

Autoencoder-based semantic communication systems with relay channels,

X. Luo, B. Yin, Z. Chen, B. Xia, and J. Wang, “Autoencoder-based semantic communication systems with relay channels,” inIEEE Interna- tional Conference on Communications (ICC) Workshops, 2022

2022

[10] [10]

Is semantic communication secure? A tale of multi-domain adversarial attacks,

Y . E. Sagduyu, T. Erpek, S. Ulukus, and A. Yener, “Is semantic communication secure? A tale of multi-domain adversarial attacks,”IEEE Communications Magazine, vol. 61, no. 11, pp. 50–55, 2023

2023

[11] [11]

Task-oriented communications for nextG: End-to-end deep learning and AI security aspects,

Y . E. Sagduyu, S. Ulukus, and A. Yener, “Task-oriented communications for nextG: End-to-end deep learning and AI security aspects,”IEEE Wireless Communications, vol. 30, no. 3, pp. 52–60, 2023

2023

[12] [12]

Secure semantic communications: Fundamentals and challenges,

Z. Yang, M. Chen, G. Li, Y . Yang, and Z. Zhang, “Secure semantic communications: Fundamentals and challenges,”IEEE Network, vol. 38, no. 6, pp. 513–520, 2024

2024

[13] [13]

Semprotector: A unified framework for semantic protection in deep learning-based semantic communication systems,

X. Liu, G. Nan, Q. Cui, Z. Li, P. Liu, Z. Xing, H. Mu, X. Tao, and T. Q. Quek, “Semprotector: A unified framework for semantic protection in deep learning-based semantic communication systems,” IEEE Communications Magazine, vol. 61, no. 11, pp. 56–62, 2023

2023

[14] [14]

Encrypted semantic com- munication using adversarial training for privacy preserving,

X. Luo, Z. Chen, M. Tao, and F. Yang, “Encrypted semantic com- munication using adversarial training for privacy preserving,”IEEE Communications Letters, vol. 27, no. 6, pp. 1486–1490, 2023

2023

[15] [15]

Privacy-preserving task-oriented semantic communications against model inversion attacks,

Y . Wang, S. Guo, Y . Deng, H. Zhang, and Y . Fang, “Privacy-preserving task-oriented semantic communications against model inversion attacks,” IEEE Transactions on Wireless Communications, vol. 23, no. 8, pp. 10 150–10 165, 2024

2024