Pith. sign in

REVIEW 4 major objections 6 minor 28 references

MLQENABLER lets clouds train and answer ML queries on formally encrypted data by pairing AES ciphertexts with GAN-made indices that stay usable yet look random.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 11:28 UTC pith:QRRTALEU

load-bearing objection Solid engineering for image classification over encrypted cloud data, but the four-privacy claim rests on an unproven leap from GAN similarity to cryptographic indistinguishability. the 4 major comments →

arxiv 2607.08197 v1 pith:QRRTALEU submitted 2026-07-09 cs.CR cs.LG

MLQENABLER: Enabling Secure Machine Learning Queries over Encrypted Database in Cloud Computing

Xu Zhou , Haoyang Chen , Xinyu Lei This is my paper
classification cs.CR cs.LG
keywords encrypted databasemachine learning queriescloud computingindex privacygenerative adversarial networkmodel privacyciphertext privacysecure outsourcing
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Cloud storage providers want to offer machine-learning services on the massive datasets clients already store with them, yet clients must encrypt that data against an untrusted cloud. Ordinary encryption turns the data into unusable pseudorandom bits; prior alternatives such as fully homomorphic encryption, differential privacy, or federated learning each leave at least one of ciphertext, index, query, or model privacy unprotected or incur large accuracy costs. MLQENABLER solves the dilemma by keeping every training example under standard AES/3DES encryption while attaching a separate secure index item generated by a specially trained generator network. The generator is trained so that its outputs are statistically indistinguishable from pure random noise (protecting index and token privacy) while a paired reconstructor keeps enough structure that neural nets trained on the indices lose only a few percentage points of accuracy. The usable model is the composition of the secret generator with the cloud-trained network, so the cloud never sees a model it can run on raw data. Experiments on five image classification benchmarks confirm that authorized accuracy drops average roughly one to three points while unauthorized accuracy collapses near random guessing.

Core claim

An index-aided scheme that formally encrypts each data item with AES/3DES while generating companion index items via EncGAN (a generator trained with adversarial loss against random samples plus reconstruction loss) simultaneously yields ciphertext privacy, index/token privacy under ciphertext-only attacks, and model privacy (the real model is G composed with the cloud-trained network), at the cost of only slight authorized-accuracy degradation on image classification tasks.

What carries the argument

EncGAN: a generator G trained jointly with a discriminator (adversarial loss making G(x) indistinguishable from uniform random samples) and a reconstructor R (ℓ1 reconstruction loss enforcing R(G(x))≈x), so that the resulting indices protect privacy yet remain ML-trainable.

Load-bearing premise

That ordinary GAN training with an adversarial loss is enough to make the generated indices cryptographically indistinguishable from true random samples under ciphertext-only attacks, so textbook security claims apply.

What would settle it

Train a strong reconstruction or membership-inference adversary that, given only EncGAN indices, recovers recognizable original images or recovers substantially more than random-guess accuracy on the source labels; success would falsify the claimed index privacy.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Cloud providers can sell ML-as-a-service over client data that remains under standard encryption, expanding the CSS-MLS business model without GDPR-style plaintext exposure.
  • Clients retain model intellectual property because the cloud never obtains a network that can be evaluated on raw inputs.
  • Dynamic add/delete of cloud data items can be followed by selective re-training on the corresponding indices without re-encrypting the entire archive.
  • The same loss-function-controllable noise idea can be reused for other privacy-preserving pipelines that currently rely on coarse differential-privacy noise.
  • Space cost roughly doubles (ciphertext plus index), a trade-off the paper judges acceptable given cheap cloud storage.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the cryptographic indistinguishability claim holds only statistically rather than information-theoretically, later cryptanalytic work could still extract partial structure from the indices, limiting long-term security guarantees.
  • Extending EncGAN beyond images to tabular or sequential data would test whether reconstruction loss alone preserves utility when spatial inductive biases disappear.
  • A formal reduction showing that breaking index privacy implies breaking the underlying AES cipher would convert the current heuristic security argument into a standard cryptographic proof.
  • Unauthorized-accuracy gaps on imbalanced datasets such as GTSRB and CelebA already exceed random guessing, suggesting class-balance or calibration defenses may be needed before deployment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes MLQENABLER, an index-aided scheme for the CSS-MLS setting in which clients outsource AES/3DES-encrypted data items together with GAN-generated secure index items so that a semi-honest cloud can train ML models and answer ML queries without seeing plaintext. EncGAN is trained with an adversarial loss (Eqs. 1–2) so that G(x) is hard for a neural discriminator to distinguish from uniform samples, plus a reconstruction loss (Eq. 3) so that utility is retained; the usable model is argued to be G composed with the cloud-trained M'. Experiments on five image classification datasets with ResNet-18 and SwinV2-T report average authorized-accuracy drops of about 1.13% and 2.86% respectively, with unauthorized accuracy near random guessing on several datasets, and Patch-IE/visual evidence that indices resemble random images.

Significance. If the simultaneous four-privacy claim and the modest utility loss both hold under a realistic threat model, the work would be a useful systems contribution for cloud storage with ML add-ons, sitting between FHE (too slow), DP (coarse noise), and FL (model leakage). The empirical package is a genuine strength: multi-dataset AA/UA tables, two modern architectures, and a clear security–utility tradeoff narrative. The main novelty is packaging formal encryption with a learnable index generator and arguing model privacy via composition with a secret G. Those claims, however, currently rest on informal arguments rather than reductions or attack games, so significance is conditional on a substantially tightened security treatment.

major comments (4)
  1. Section III-A (adversarial loss, Eqs. 1–2) and Section IV-A (Index Privacy / Token Privacy) assert that ordinary GAN training yields index items that are cryptographically indistinguishable from uniform random samples and therefore inherit ciphertext-only security in the sense of Katz–Lindell [14]. No distinguishing game, advantage bound, or reduction is given. Visual inspection (Fig. 4) and Patch IE (Fig. 5) are statistical similarity measures, not cryptographic evidence. This leap is load-bearing for the simultaneous-security claim: if a practical distinguisher or inversion attack exists, index and token privacy collapse while the reported AA numbers remain unchanged. Either supply a formal definition and analysis, or reframe the claim as empirical obfuscation rather than cryptographic ciphertext-only security.
  2. Section IV-A (Model Privacy) and Fig. 3 define model privacy as the cloud holding only M' while the usable model is G ∘ M'. This is closer to key-gated access control than to standard model-IP or extraction resistance: any party that later obtains G (including authorized clients, or a compromised KGS) can use M' on plaintext-equivalent tokens. The paper does not analyze extraction, membership inference, or whether M' itself leaks training-set structure. The model-privacy row of Table I should be restated to match what is actually proven or measured.
  3. Section V defines AA/UA with references to DP, InstaHide, and VIM, yet Tables II–V report only Original vs Index. Without head-to-head numbers under a common evaluation protocol (same models, same datasets, same train/test obfuscation convention), the claim of only slight degradation relative to prior privacy techniques is unsupported. Add at least one strong baseline (e.g., DP or a published image-obfuscation method) under the paper’s own AA/UA definitions.
  4. Section II-C treats the KGS as fully trusted and the sole holder of the global secret G, which is then distributed to all authorized clients. G is a large neural network, not a short cryptographic key; compromise or collusion of KGS or any authorized client breaks index/token privacy for all parties. The threat model and design goals should explicitly bound this trust and discuss key distribution, revocation, and multi-client collusion, or the privacy claims must be qualified accordingly.
minor comments (6)
  1. Throughout the manuscript the scheme name is often concatenated without a space or hyphen (e.g., “MLQENABLERemploys”, “MLQENABLERachieves”). Normalize spacing and capitalization.
  2. Table I uses nonstandard symbols (blank, #, G #) without a fully self-contained legend in the caption; expand the caption so the table is readable in isolation.
  3. Section IV-A “Loss-Functions-Controllable Noise Addition” is presented as a new general technique; either cite related learnable-obfuscation / adversarial-privacy literature or clearly mark it as a perspective rather than a claimed contribution.
  4. Fig. 1 caption and body refer to both “EncGAN” and “EncryptionGAN”; pick one name and use it consistently.
  5. The abstract and introduction promise “acceptable security level” without defining a quantitative criterion; align wording with whatever security notion is adopted after revision.
  6. Experiments are restricted to images and classification (acknowledged in Section V-A). A short discussion of what would break for tabular or sequential data would help scope the contribution.

Circularity Check

0 steps flagged

No circular derivation chain; AA/UA numbers and privacy claims are independent empirical/design results, not rearrangements of fitted inputs or self-cited uniqueness.

full rationale

The paper trains EncGAN once on DIV2K via the ordinary adversarial-plus-reconstruction objective (Eqs. 1-5, Alg. 1), then freezes G and measures authorized/unauthorized accuracy of ResNet-18 and SwinV2-T on five held-out classification sets (Tables II-V). Those accuracy figures are ordinary train/test evaluations; they are not algebraically forced by any parameter fitted to the same quantities. Index-privacy and model-privacy arguments rest on the design (G composed with cloud M', ciphertext-only security via textbook [14]) plus visual/Patch-IE similarity (Figs. 4-5), not on a self-definitional identity or a uniqueness theorem imported from the authors. No load-bearing self-citation of prior uniqueness results appears, and the CSS-MLS framing is merely nomenclature. Consequently the derivation chain contains no circular steps of the six enumerated kinds.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 2 invented entities

The central privacy-plus-utility claim rests on a small set of modeling choices (semi-honest cloud, trusted KGS, IID data, open labels), on the unproven assertion that ordinary GAN training yields cryptographic indistinguishability, and on two invented constructs (EncGAN and LFC noise addition) that have no independent external evidence. Hyper-parameters such as lambda_rec and the precise generator architecture are free and affect the privacy-utility trade-off that the paper reports.

free parameters (3)
  • lambda_rec
    Scalar weight balancing adversarial loss against reconstruction loss (Eq. 4); its value is never stated yet directly controls the privacy-utility trade-off claimed in the abstract and Section IV.
  • EncGAN architecture and capacity
    Exact layer counts, channel widths and activation choices for G, D and R are omitted; capacity choices determine how well indices approximate random while remaining reconstructible.
  • training hyper-parameters (lr schedule, epochs, betas)
    Adam betas, learning-rate decay, 200-epoch schedule and batch size 1 are chosen by hand and affect the quality of the final generator used as the secret key.
axioms (5)
  • domain assumption Cloud server is semi-honest (honest-but-curious) and follows the protocol while trying to infer secrets from observed indices and models.
    Stated in Section II-C; all privacy claims are relative to this adversary model.
  • domain assumption Storage clients’ data items are independent and identically distributed.
    Explicit assumption in Section II-C; used to justify joint training of a single global generator.
  • ad hoc to paper A generator whose outputs are statistically hard for a neural discriminator to distinguish from uniform random samples achieves ciphertext-only security in the cryptographic sense of Katz-Lindell.
    Invoked in Challenge 1 and Section IV-A via citation [14]; equates GAN equilibrium with cryptographic indistinguishability without a reduction.
  • domain assumption Class labels attached to index items may be disclosed to the cloud without compromising the stated privacy goals.
    Stated in Section III-B; enables supervised training on the cloud.
  • standard math Standard symmetric encryption (AES/3DES) with client-local keys provides ciphertext privacy against the cloud.
    Standard cryptographic assumption used in Section IV-A for the encrypted data items.
invented entities (2)
  • EncGAN (EncryptionGAN) no independent evidence
    purpose: Jointly trains generator, discriminator and reconstructor so that indices look random yet remain ML-usable.
    Core technical construct introduced in Figure 1 and Algorithm 1; no prior independent definition or external validation is supplied.
  • Loss-Functions-Controllable (LFC) noise addition no independent evidence
    purpose: Frames the generator as a fine-grained alternative to differential privacy’s coarse noise scale.
    Named in Section IV-A as a ‘new type privacy-preserving technique’; exists only inside this paper’s narrative.

pith-pipeline@v1.1.0-grok45 · 15703 in / 3404 out tokens · 43886 ms · 2026-07-10T11:28:40.670848+00:00 · methodology

0 comments
read the original abstract

In cloud computing, the public cloud service providers (CSPs) can provide cloud storage as the primary service while providing additional machine learning (ML)-based services by using the clients' data in storage. This business model extends the border of cloud computing services and brings in new business growth possibilities. Although it is promising, the model also brings in security concerns since the public commercial cloud cannot be fully trusted. For example, the public commercial clouds may sell clients' sensitive data to the government or other companies. To address the security concerns, an immediate solution is to require clients to encrypt their datasets before outsourcing to the cloud. However, if a database is formally encrypted, then the database contains only pseudorandom numbers, making it impossible to enable ML over it. In this project, we propose MLQENABLER (ML Queries Enabler) scheme to enable secure ML queries over encrypted database in cloud storage. MLQENABLER employs an index-aid approach to achieve security and ML capability simultaneously. Our initial experiments show that MLQENABLER achieves an acceptable security level while incurring only a slight ML performance degradation.

Figures

Figures reproduced from arXiv: 2607.08197 by Haoyang Chen, Xinyu Lei, Xu Zhou.

Figure 1
Figure 1. Figure 1: How to generate secure index items by using EncGAN. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: MLQENABLER system model. a large dataset (consisting of many data items) to be stored in the cloud server. The storage clients expect the cloud to additionally provide ML queries processing services. The non￾storage clients do not use the cloud storage service, but they intend to use the ML queries processing services. The cloud server is responsible for rendering data storage services as well as respondin… view at source ↗
Figure 3
Figure 3. Figure 3: , a client needs to first send an original data item to G and then send the output to M′ . Therefore, the real usable ML model is M = G ◦ M′ (i.e., G has the series connection with M′ ). Since the cloud only has access to M′ and the secret key G is kept secret from the cloud, the cloud unable to correctly use the ML model. Thus, the model privacy is protected. Trained ML model Real usable ML model: Cloud O… view at source ↗
Figure 4
Figure 4. Figure 4: Visual comparison of original images, EncGAN [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Patch IE of original images, EncGAN-generated index items, and random images across datasets and patch sizes. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

28 extracted references · 28 canonical work pages · 3 internal anchors

  1. [1]

    Data volumes set to hit 175zb with a tectonic shift to the cloud, 2018

    Antony Adshead. Data volumes set to hit 175zb with a tectonic shift to the cloud, 2018

    work page 2018

  2. [2]

    Ntire 2017 chal- lenge on single image super-resolution: Dataset and study

    Eirikur Agustsson and Radu Timofte. Ntire 2017 chal- lenge on single image super-resolution: Dataset and study. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 126–135, 2017

    work page 2017

  3. [3]

    Fully homo- morphic encryption from ring-lwe and security for key dependent messages

    Zvika Brakerski and Vinod Vaikuntanathan. Fully homo- morphic encryption from ring-lwe and security for key dependent messages. InAnnual cryptology conference (Crypto), pages 505–524. Springer, 2011

    work page 2011

  4. [4]

    Conditional backdoor attack via jpeg compression

    Qiuyu Duan, Zhongyun Hua, Qing Liao, Yushu Zhang, and Leo Yu Zhang. Conditional backdoor attack via jpeg compression. InProceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 38, pages 19823– 19831, 2024

    work page 2024

  5. [5]

    Differential privacy

    Cynthia Dwork. Differential privacy. InInternational Colloquium on Automata, Languages, and Programming (ICALP), pages 1–12. Springer, 2006

    work page 2006

  6. [6]

    Differential privacy: A survey of results

    Cynthia Dwork. Differential privacy: A survey of results. InInternational conference on theory and applications of models of computation (TAMC), pages 1–19. Springer, 2008

    work page 2008

  7. [7]

    Stanford university, 2009

    Craig Gentry.A fully homomorphic encryption scheme. Stanford university, 2009

    work page 2009

  8. [8]

    Generative adversarial nets.Advances in Neural Information Processing Sys- tems, 27, 2014

    Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets.Advances in Neural Information Processing Sys- tems, 27, 2014

    work page 2014

  9. [9]

    Deepmih: Deep invertible network for multiple image hiding.IEEE Transactions on Pattern Analysis and Machine Intelli- gence (TPAMI), 45(1):372–390, 2022

    Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. Deepmih: Deep invertible network for multiple image hiding.IEEE Transactions on Pattern Analysis and Machine Intelli- gence (TPAMI), 45(1):372–390, 2022

    work page 2022

  10. [10]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016

    work page 2016

  11. [11]

    Deep neural networks classification over encrypted data

    Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. Deep neural networks classification over encrypted data. InProceedings of the Ninth ACM Conference on Data and Application Security and Privacy, pages 97–108, 2019

    work page 2019

  12. [12]

    Hinet: Deep image hiding by invertible network

    Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 4733– 4742, 2021

    work page 2021

  13. [13]

    Advances and Open Problems in Federated Learning

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aur´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, 7 Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning.arXiv preprint arXiv:1912.04977, 2019

    work page internal anchor Pith review Pith/arXiv arXiv 1912

  14. [14]

    CRC press, 2020

    Jonathan Katz and Yehuda Lindell.Introduction to modern cryptography. CRC press, 2020

    work page 2020

  15. [15]

    Adam: A Method for Stochastic Optimization

    Diederik P Kingma. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  16. [16]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    work page 2009

  17. [17]

    Ya Le and Xuan S. Yang. Tiny imagenet visual recogni- tion challenge. 2015

    work page 2015

  18. [18]

    Swin transformer v2: Scaling up capacity and resolution

    Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, et al. Swin transformer v2: Scaling up capacity and resolution. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12009–12019, 2022

    work page 2022

  19. [19]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InProceedings of the IEEE International Conference on Computer Vi- sion (ICCV), pages 3730–3738, 2015

    work page 2015

  20. [20]

    Assessing the cost, legal fallout of capital one data breach.Legal Fallout Of Capital One Data Breach, 2019

    Jack Lu. Assessing the cost, legal fallout of capital one data breach.Legal Fallout Of Capital One Data Breach, 2019

    work page 2019

  21. [21]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. InArtificial intelligence and statistics, pages 1273–

    work page

  22. [22]

    WaNet -- Imperceptible Warping-based Backdoor Attack

    Anh Nguyen and Anh Tran. Wanet–imperceptible warping-based backdoor attack.arXiv preprint arXiv:2102.10369, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  23. [23]

    Pytorch: An imperative style, high-performance deep learning library.Advances in Neural Information Processing Systems (NIPS), 32, 2019

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zem- ing Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library.Advances in Neural Information Processing Systems (NIPS), 32, 2019

    work page 2019

  24. [24]

    Dynamic backdoor attacks against machine learning models

    Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor attacks against machine learning models. In2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 703–718. IEEE, 2022

    work page 2022

  25. [25]

    Pearson Education India, 2006

    William Stallings.Cryptography and network security, 4/E. Pearson Education India, 2006

    work page 2006

  26. [26]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking ma- chine learning algorithms for traffic sign recognition. Neural Networks (NN), 32:323–332, 2012

    work page 2012

  27. [27]

    The eu gen- eral data protection regulation (gdpr).A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10:3152676, 2017

    Paul V oigt and Axel V on dem Bussche. The eu gen- eral data protection regulation (gdpr).A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10:3152676, 2017

    work page 2017

  28. [28]

    Federated machine learning: Concept and appli- cations.ACM Transactions on Intelligent Systems and Technology (TIST), pages 1–19, 2019

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and appli- cations.ACM Transactions on Intelligent Systems and Technology (TIST), pages 1–19, 2019. 8

    work page 2019