Pith. sign in

REVIEW 3 major objections 4 minor 91 references

PrivDNN claims that encrypting only a small subset of a DNN's early convolution filters lets a model owner ship a secretly usable, partially encrypted model to clients, cutting private inference time and memory by up to 97% compared with fu

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 06:25 UTC pith:2YK372DX

load-bearing objection Solid systems work on filter selection under a broken privacy model: the client gets plaintext activations of the encrypted filters, so the headline claim doesn't hold. the 3 major comments →

arxiv 2607.21895 v1 pith:2YK372DX submitted 2026-07-24 cs.CR

PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption

Liangqin Ren , Zeyan Liu , Fengjun Li , Kaitai Liang , Zhu Li , Bo Luo This is my paper
classification cs.CR
keywords privacy-preserving deep learninghomomorphic encryptionmodel encryptionpartial DNN encryptioncore neuron selectionmodel privacyinference accelerationsecure multiparty computation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

PrivDNN argues that protecting a deep learning model during private inference does not require encrypting the whole network. The model owner selects a small set of "core" convolution filters—chosen so that removing them would sharply degrade accuracy—and encrypts only those filters with homomorphic encryption. The client receives this partially encrypted model, runs all plaintext layers locally, and sends the encrypted core-neuron outputs back to the server for decryption; the server returns the decrypted values so the client can finish the forward pass. The paper reports that authorized accuracy stays within about 0.1–1% of the original model, unauthorized users see accuracy drop sharply (e.g., 99.26% to 77.32% on MNIST), and inference time and memory fall by up to 97% compared with full-network encryption. If correct, this makes FHE-based private inference practical on commodity hardware and gives model owners a tunable knob between protection and speed.

Core claim

The paper's central claim is that a DNN can be shipped to a client in partially encrypted form—plaintext weights for most filters, homomorphically encrypted weights for a small subset of core filters—and still behave as a secure, usable classifier. The paper lays out two objectives: authorized accuracy A_s must stay close to the original A_o, and unauthorized accuracy A_r must fall far below A_o. It defines a quality score for choosing the core set, and shows with exhaustive ground truth on small networks that the greedy and pruning-then-greedy selection algorithms find top-ranked core sets. Across five datasets and four architectures, encrypting roughly 15–25% of the filters in the first tw

What carries the argument

The central mechanism is partial DNN encryption driven by core-neuron selection. Core neurons are the convolution filters designated for encryption; selection is guided by the quality score s = −sigmoid(A_o − A_s) + sigmoid((A_s − A_r)/5), which rewards small authorized loss and large unauthorized drop. The selection algorithms (greedy, and pruning-then-greedy using static filter-pruning criteria) produce the small filter subset; the encrypted subset is evaluated with an approximate homomorphic encryption scheme (CKKS) in the ciphertext domain, while the rest of the network runs in plaintext at the client. The paper also adds a server-side polymorphic obfuscation layer to resist weight-steal

Load-bearing premise

The model-privacy guarantee rests on the assumption that a client who receives decrypted intermediate activations from the encrypted core neurons on every authorized query still cannot recover the encrypted weights or rebuild an equivalent model, an attack that the paper's security analysis does not test.

What would settle it

A curious client who chooses inputs, receives the de-obfuscated plaintext outputs of the encrypted core neurons for each query, and solves a system of linear equations (or uses gradient-based inversion) to reproduce the encrypted filter weights would refute the privacy claim. The paper's Section 6.1 only tests the delete-and-retrain attack, so a successful activation-oracle extraction—even with fewer than 1,000 labeled samples—would be a concrete counterexample.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Private inference time and memory scale almost linearly with the fraction of encrypted filters, so choosing a small N_e (e.g., 15–25% of early-layer filters) yields an order-of-magnitude speedup while keeping A_s within about 1% of the original.
  • Unauthorized users—including those who retrain the visible plaintext parts with up to 1,000 labeled samples—fail to reach the original model's accuracy; for large models with heavily encrypted early layers the recovered accuracy stays well below A_o.
  • The approach is independent of the specific FHE scheme or DNN architecture, so any future improvement in homomorphic encryption or any new FHE-friendly network can be dropped into the same partial-encryption pipeline.
  • The model owner can tune the number of encrypted filters to trade client-side compute against protection level, which the paper demonstrates by pushing A_r down to 1.01% on GTSRB and 2.50% on Tiny-ImageNet when encrypting only a small fraction of all convolution neurons.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The client receives the decrypted output of the encrypted core neurons on every authorized query (after de-obfuscation); this plaintext-activation oracle is not analyzed in the paper's security section, which only studies deleting the encrypted weights and retraining. A determined client could try to invert these activations to recover the encrypted filters—an attack the experiments do not rule ou
  • The "core neuron" notion may transfer to other model families: attention heads or embedding dimensions in transformers might serve the same role as early convolution filters, offering a testable extension with a similar partial-encryption pipeline.
  • Because the unauthorized-accuracy drop varies by dataset (recovery is notably easier on GTSRB, where classes are visually similar), the encryption budget should be tuned per task rather than fixed per architecture.
  • The server-side obfuscation layer resists an all-1s weight-stealing query but does not address the honest-but-curious activation oracle; combining partial encryption with input- or activation-dependent noise could blunt that channel while preserving A_s.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. PrivDNN proposes a two-party framework for privacy-preserving DNN inference in which the server encrypts only a subset of 'core' filters and ships the partially encrypted model to the client. The client evaluates plaintext filters locally, computes the encrypted core filters with CKKS, sends the encrypted outputs to the server for decryption, receives and deobfuscates the plaintext results, and continues the forward pass in plaintext. The authors define a quality score s that trades off authorized accuracy A_s against unauthorized accuracy A_r, and propose random, greedy, pruning-based, and pruning+greedy algorithms for core-filter selection. Experiments on five datasets report A_s close to the original model accuracy while A_r is significantly lower, together with a 29.7x inference speedup over full-model FHE inference and large memory savings. The security analysis focuses on a model-recovery attack in which the client deletes the encrypted weights and retrains with 100–1000 labeled samples.

Significance. If the privacy claim held, this would be a practically relevant contribution: partial FHE encryption is a plausible efficiency direction, and the authors provide a credible experimental methodology. The exhaustive-search ground truth (Table 2), the greedy selection's near-optimal ranking (Table 3), and the operation-count analysis (Figure 5) are careful and useful, and code is promised. However, the central model-privacy claim is not supported. The protocol itself returns plaintext, de-obfuscated intermediate activations of the encrypted core neurons to the client, giving the client a chosen-input oracle for the FHE-encrypted subnetwork. The security analysis in §6.1 does not model this attack, so the headline deliverable—'ensures model accuracy and model privacy'—fails under the stated honest-but-curious adversary. The efficiency results may stand, but the privacy contribution is the core of the paper.

major comments (3)
  1. [§4.1 (Step B2), §3.2, §6.1] The protocol in Step B2 sends the encrypted core-neuron outputs to S for decryption, then returns them to C, who deobfuscates them. Under the honest-but-curious threat model (§3.2), C legitimately receives exact plaintext activations of the FHE-encrypted filters on every authorized query. This gives C a chosen-input oracle for the encrypted subnetwork. Because the encrypted neurons are linear convolutions (with square activation in the FHE-friendly design, §4.2), the client can solve a linear system for the encrypted filters or train a high-fidelity substitute model without any of S's proprietary data. The security analysis in §6.1 only considers deleting the encrypted weights and retraining with 100–1000 labeled samples; it never considers the oracle that the protocol itself provides. The §6.4 concession that 'more effective model recovery attacks may emerge' does not address this immed
  2. [§4.3, Eq. (1); Tables 2–6] The quality score s = −sigmoid(A_o−A_s) + sigmoid((A_s−A_r)/α) is exactly the objective maximized by the Greedy and Pruning+Greedy algorithms (Algorithms 2 and 4). Reporting large A_s−A_r gaps and high s values for the selected sets therefore partially restates the optimization objective as evidence of security. The exhaustive-search ground truth is a strong methodological contribution and shows the greedy selection tracks the optimum of s, but it validates only the proxy objective, not the privacy guarantee. The independent recovery-attack experiments (Table 7) are the right category of evidence, but they operate under a different attack model and, as noted above, omit the oracle attack.
  3. [§6.3, Figure 6] The server-side obfuscation layer proposed in §6.3 does not resolve the oracle problem. In the standard protocol (§4.1 B2), C deobfuscates the returned values herself, so she obtains exact activations. If server-side obfuscation is instead applied in the honest-but-curious setting, the client must still receive enough information to continue the forward pass; the paper does not specify how C inverts the server-side obfuscation, and if she cannot invert it, the protocol becomes a different interactive scheme that is not analyzed. In either reading, the security analysis in §6.1 does not cover the combination of decrypted core outputs with client-side deobfuscation, and the oracle persists.
minor comments (4)
  1. [§4.1 (Notation)] The sentence 'E_i^j and P_i^j together represent the j-th filter' is confusing; the notation should make clear that E_i and P_i are index sets partitioning the filters at layer i.
  2. [§4.3, Eq. (1)] The coefficient α=5 is chosen empirically, but no sensitivity analysis is reported. Since the selection algorithms optimize s, results for other α values would clarify how robust the selection quality is to this hyperparameter.
  3. [Tables 1 and 9] The dataset/model information is repeated in Table 1 and Table 9 with inconsistencies (e.g., GTSRB accuracy is listed as 93.51% in Table 1 but as 93.24% in the note to Table 6). Please unify the tables and correct the value.
  4. [§6.2] The claim that sample-inference attacks are 'highly challenging, if not impossible' is supported only by two empirical attack evaluations (Figures 8 and 9). A formal argument or a broader attack evaluation would be needed to substantiate this statement.

Circularity Check

1 steps flagged

Security metric s doubles as both the selection objective and the reported evidence, making the large A_s−A_r gap partly the optimization objective restated as a result.

specific steps
  1. self definitional [Section 4.3 (Eq. 1), Section 4.4 (Algorithm 2), Section 6.1 (Honest Data Owners)]
    "The core neuron selection algorithms ensure that A_r is always much lower than A_s (accuracy for the authorized users). This is also demonstrated by experiments in Tables 5 and 6."

    In Eq. (1), s is defined as −sigmoid(A_o−A_s)+sigmoid((A_s−A_r)/α), so the security goal G2 (large A_s−A_r) is built into s. Algorithm 2 then selects each core neuron by computing s_j and picking 'the neuron that produces the best s_j'. The §6.1 statement that the selection algorithms 'ensure that A_r is always much lower than A_s' and the Tables 5/6 accuracy gaps are therefore the maximized objective reported as an achieved security property, not an independent consequence. The A_s/A_r values themselves are measured, and the exhaustive-search ground truth and recovery-attack (A_rec) results provide independent support, so the circularity is partial.

full rationale

The paper's efficiency and accuracy claims are not circular: the 29.7x speedup and 97% memory savings are computed from measured ciphertext/plaintext operation distributions and concrete inference times, independent of the selection objective. The core-neuron-selection algorithms are also evaluated against a real exhaustive-search ground truth (Table 2), and the model-recovery attack experiments (Table 7) provide an external, behavior-based check on whether the encrypted parameters are useful to an attacker. Those elements give the central empirical claims genuine content. The main circularity is narrower but real: the security objective s in Eq. (1) is exactly the quantity the greedy and pruning+greedy selection algorithms maximize (Algorithm 2 and Algorithm 4), and the paper then uses the resulting A_s and A_r values as evidence that the selection 'ensures' A_r << A_s. Thus the headline privacy gap is partly the optimization objective restated as a measured outcome. This is not a complete definitional collapse, because the actual accuracies after removing selected filters are computed rather than assumed, and the exhaustive search shows that not all selections achieve the reported gap. The security analysis does not model the chosen-input oracle created by §4.1 B2, where the client receives decrypted intermediate activations of the encrypted core filters; that is a security-modeling gap rather than a circularity, so it does not further raise the circularity score. No load-bearing self-citation or imported uniqueness theorem appears. Overall, the partial conflation of objective and evidence warrants a score of 4.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 2 invented entities

The efficiency side of PrivDNN depends mainly on the chosen encryption ratio (free parameter n_i1/N). The privacy side depends on several unstated or weakly supported axioms: that client-visible decrypted activations are not exploitable, that accuracy gap is a sufficient privacy metric, and that the client cannot obtain training data. The most fragile of these is the decryption-oracle assumption, because the protocol explicitly hands the client plaintext intermediate values.

free parameters (4)
  • alpha (α) in quality score = 5
    Equation (1) uses α as a normalization factor between the authorized-accuracy penalty and unauthorized-accuracy benefit; the paper states it is empirically selected (§4.3).
  • p in Pruning+Greedy selection pool size = 2
    Algorithm 4 uses a greedy selection pool of size p times the target core set; the paper states p=2 is chosen empirically (§4.4).
  • Core-neuron counts/ratios n_i1 per layer = 15%-100% of first two conv layers in experiments
    The model owner presets how many filters to encrypt per layer; this is the main performance-security knob and varies across experiments (§4.4, §6.4).
  • CKKS parameter instance = not reported
    Timing and memory depend on SEAL/CKKS parameters (scale, poly_modulus_degree, security level), which are not specified beyond 'Microsoft SEAL 4.1.1' (§5.1).
axioms (6)
  • domain assumption Hardness of Ring-LWE and security of the CKKS FHE scheme
    The security analysis assumes the client cannot break CKKS encryption (§3.2, §6.1). This is a standard cryptographic assumption, but it is load-bearing for the claimed model privacy.
  • domain assumption Honest-but-curious (semi-honest) parties
    Both server and client follow the protocol but may inspect all received messages (§3.2). This is exactly what makes the decrypted intermediate outputs a potential oracle.
  • domain assumption Client does not possess the server's proprietary training data
    Threat model assumption 3 (§3.2) says the data owner lacks the training data; otherwise model recovery becomes trivial.
  • ad hoc to paper Model privacy can be operationalized as a gap between authorized and unauthorized accuracy (A_s vs A_r)
    The paper defines security objectives G1 and G2 in terms of A_s−A_r (§4.3) and uses this gap as the main evidence of protection, without proving that an accuracy drop prevents model extraction or functional cloning.
  • ad hoc to paper Returning decrypted intermediate outputs to the client is harmless
    The protocol in §4.1 B2 sends decrypted, de-obfuscated activations back to the client; the security analysis assumes these do not enable weight recovery, but never analyzes oracle-based extraction.
  • domain assumption FHE-friendly square/linear activations preserve enough accuracy
    All models are trained or converted to use FHE-friendly activations (§4.2); the reported A_o values assume this design choice is acceptable for the target applications.
invented entities (2)
  • Core neuron selection (subset of filters designated as 'core') no independent evidence
    purpose: Identify a small set of filters whose encryption degrades unauthorized accuracy while keeping authorized accuracy high.
    A design construct rather than a physical entity. Its effectiveness is measured empirically, but no independent falsifiable handle is provided outside the paper's own experiments.
  • Server-side polymorphic obfuscation layer no independent evidence
    purpose: Prevent a malicious client from recovering plaintext model weights by sending encrypted weights back to the server for decryption.
    Introduced in §6.3 as a defense against weight-stealing. The paper reports minimal accuracy loss but gives no formal security analysis, and it does not show that the layer prevents extraction via the decryption oracle.

pith-pipeline@v1.3.0-alltime-deepseek · 29801 in / 16109 out tokens · 168452 ms · 2026-08-01T06:25:08.681915+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption." pith.science (2026). https://pith.science/paper/2YK372DX

@misc{pith2026260721895,
  author       = {Pith},
  title        = {Pith review of: PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2YK372DX}},
  note         = {Machine review of arXiv:2607.21895}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In the past decade, we have witnessed an exponential growth of deep learning models, platforms, and applications. While existing DL applications and Machine Learning as a service (MLaaS) frameworks assume fully trusted models, the need for privacy-preserving DNN evaluation arises. In a secure multi-party computation scenario, both the model and the data are considered proprietary, i.e., the model owner does not want to reveal the highly valuable DL model to the user, while the user does not wish to disclose their private data samples either. Conventional privacy-preserving deep learning solutions ask the users to send encrypted samples to the model owners, who must handle the heavy lifting of ciphertext-domain computation with homomorphic encryption. In this paper, we present a novel solution, namely, PrivDNN, which (1) offloads the computation to the user side by sharing an encrypted deep learning model with them, (2) significantly improves the efficiency of DNN evaluation using partial DNN encryption, (3) ensures model accuracy and model privacy using a core neuron selection and encryption scheme. Experimental results show that PrivDNN reduces privacy-preserving DNN inference time and memory requirement by up to 97% while maintaining model performance and privacy. Codes can be found at https://github.com/LiangqinRen/PrivDNN

Figures

Figures reproduced from arXiv: 2607.21895 by Bo Luo, Fengjun Li, Kaitai Liang, Liangqin Ren, Zeyan Liu, Zhu Li.

Figure 1
Figure 1. Figure 1: Approaches for privacy-preserving DNN evaluation: (A) clear text approach (no privacy protection); (B) trusted third [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: An overview of the PrivDNN approach. 4 The PrivDNN Approach 4.1 PrivDNN Overview An overview of the proposed PrivDNN approach is shown in Fig￾ure 2. As we have described in the system model, the privacy￾preserving DNN evaluation system involves two parties: the model owner (S) and the data owner (C). PrivDNN contains two stages: the initialization phase and the evaluation phase. The initialization phase is… view at source ↗
Figure 3
Figure 3. Figure 3: The partial DNN encryption approach. ciphertext world and the cleartext world, but it does not generate output to the cleartext world until the very last layer, where the ciphertext outputs are decrypted by S (shown in green in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The distribution of {𝐴𝑠 , 𝐴𝑟 } for all possible core neuron set selections for MNIST/LeNet-5 (𝑛1,1 = 2, 𝑛2,1 = 6). for pre-trained models and tune the modified model. In the exper￾iments, we train all the models from scratch. As shown in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Distribution of addition (+) and multiplication ( [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: PrivDNN with a server-side obfuscation layer. 6.2 Data Privacy Privacy Expectations. The model owner, S, should not be able to reconstruct the raw pixels of any testing image or to recover the visual features of any testing image. We discuss the following aspects: (1) information that is (not) disclosed to the model owner, (2) the capability of the honest-but-curious model owners, and (3) the capability of… view at source ↗
Figure 7
Figure 7. Figure 7: We can observe the following: (1) we achieve consistently [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 7
Figure 7. Figure 7: The performance-security trade-off: the distribution of [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The model owner’s sample recovery attack with [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: The model owner’s sample recovery attack with an [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

91 extracted references · 10 linked inside Pith

  1. [1]

    Ahmad Al Badawi, Chao Jin, Jie Lin, Chan Fook Mun, Sim Jun Jie, Benjamin Hong Meng Tan, Xiao Nan, Khin Mi Mi Aung, and Vijay Ramaseshan Chan- drasekhar. 2020. Towards the alexnet moment for homomorphic encryption: Hcnn, the first homomorphic cnn on encrypted data with gpus.IEEE Transactions on Emerging Topics in Computing9, 3 (2020), 1330–1343

    2020

  2. [2]

    Mohammad Al-Rubaie and J Morris Chang. 2019. Privacy-preserving machine learning: Threats and solutions.IEEE Security & Privacy17, 2 (2019), 49–58

    2019

  3. [3]

    Frederik Armknecht, Colin Boyd, Christopher Carr, Kristian Gjosteen, Angela Jäschke, Christian A Reuter, and Martin Strand. 2015. A guide to fully homomor- phic encryption.Cryptology ePrint Archive(2015)

    2015

  4. [4]

    Raphael Bost, Raluca Ada Popa, Stephen Tu, and Shafi Goldwasser. 2014. Machine learning classification over encrypted data.Cryptology ePrint Archive(2014)

    2014

  5. [5]

    Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. 2018. Fast homomorphic evaluation of deep discretized neural networks. In38th Annual International Cryptology Conference (CRYPTO). Springer, 483–512

    2018

  6. [6]

    Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. 2014. (Leveled) fully homomorphic encryption without bootstrapping.ACM Transactions on Computation Theory (TOCT)6, 3 (2014), 1–36

    2014

  7. [7]

    Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. 2019. Low latency privacy preserving inference. InInternational Conference on Machine Learning. PMLR, 812–821

    2019

  8. [8]

    Linhang Cai, Zhulin An, Chuanguang Yang, Yangchun Yan, and Yongjun Xu

  9. [9]

    Hervé Chabanne, Amaury De Wargny, Jonathan Milgram, Constance Morel, and Emmanuel Prouff. 2017. Privacy-preserving classification on deep neural network.Cryptology ePrint Archive(2017)

    2017

  10. [10]

    Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020. Exploring connections between active learning and model extraction. In29th USENIX Security Symposium (USENIX Security 20). 1309–1326

    2020

  11. [11]

    Shuangshuang Chen and Wei Guo. 2023. Auto-Encoders in Deep Learning—A Review with New Perspectives.Mathematics11, 8 (2023), 1777

    2023

  12. [12]

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homo- morphic encryption for arithmetic of approximate numbers. InInternational Conference on the Theory and Applications of Cryptology and Information Security (ASIACRYPT). Springer, 409–437

    2017

  13. [13]

    Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei

  14. [14]

    Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. 2017. EM- NIST: Extending MNIST to handwritten letters. InInternational joint conference on neural networks (IJCNN). IEEE, 2921–2926

    2017

  15. [15]

    Jack LH Crawford, Craig Gentry, Shai Halevi, Daniel Platt, and Victor Shoup

  16. [16]

    Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. 2019. CHET: an optimizing compiler for fully-homomorphic neural-network inferencing. InACM PLDI. 142– 156

    2019

  17. [17]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition. Ieee, 248–255

    2009

  18. [18]

    InProceedings of the 6th Workshop on Encrypted Computing & Applied Homomorphic Cryptography

    Doing real work with FHE: the case of logistic regression. InProceedings of the 6th Workshop on Encrypted Computing & Applied Homomorphic Cryptography. 1–12

  19. [19]

    Emily L Denton, Wojciech Zaremba, Joan Bruna, Yann LeCun, and Rob Fergus

  20. [20]

    Danny Dolev and Andrew Yao. 1983. On the security of public key protocols. IEEE Transactions on information theory29, 2 (1983), 198–208

    1983

  21. [21]

    Li Deng. 2012. The mnist database of handwritten digit images for machine learning research.IEEE Signal Processing Magazine29, 6 (2012), 141–142

    2012

  22. [22]

    Abigail English and Carol A. Ford. 2004. The HIPAA Privacy Rule and Adolescents: Legal Questions and Clinical Challenges.Perspectives on Sexual and Reproductive Health36, 2 (2004), 80–86. http://www.jstor.org/stable/3181198

    arXiv 2004

  23. [23]

    Ege Erdoğan, Alptekin Küpçü, and A Ercüment Çiçek. 2022. Unsplit: Data- oblivious model inversion, model stealing, and label inference attacks against split learning. InProceedings of the 21st Workshop on Privacy in the Electronic Society. 115–124

    2022

  24. [24]

    Junfeng Fan and Frederik Vercauteren. 2012. Somewhat practical fully homomor- phic encryption.Cryptology ePrint Archive(2012)

    2012

  25. [25]

    Wenliang Du and Mikhail J Atallah. 2001. Secure multi-party computation problems and their applications: a review and open problems. InProceedings of the 2001 workshop on New security paradigms. 13–22

    2001

  26. [26]

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. InInternational conference on machine learning. PMLR, 201–210

    2016

  27. [27]

    Xavier Glorot, Antoine Bordes, and Yoshua Bengio. 2011. Deep sparse rectifier neural networks. InProceedings of the fourteenth international conference on artificial intelligence and statistics. JMLR Workshop and Conference Proceedings, 315–323

    2011

  28. [28]

    2009.Foundations of cryptography: volume 2, basic applications

    Oded Goldreich. 2009.Foundations of cryptography: volume 2, basic applications. Cambridge university press

    2009

  29. [29]

    Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. InProceed- ings of the forty-first annual ACM symposium on Theory of computing. 169–178

    2009

  30. [30]

    Jun Han and Claudio Moraga. 1995. The influence of the sigmoid function parameters on the speed of backpropagation learning. InFrom Natural to Artificial Neural Computation: International Workshop on Artificial Neural Networks. 195– 201

    1995

  31. [31]

    Song Han, Jeff Pool, John Tran, and William Dally. 2015. Learning both weights and connections for efficient neural network.Advances in neural information processing systems28 (2015)

    2015

  32. [32]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

    2016

  33. [33]

    Rafael Rodrigo Guillén, Higinio Mora Mora, and Jorge Azorín-López. 2022. A Review of Deep Learning Methods for Detection of Gatherings and Abnormal Events for Public Security. InInternational Conference on Ubiquitous Computing and Ambient Intelligence. Springer, 809–814

    2022

  34. [34]

    Yang He, Ping Liu, Ziwei Wang, Zhilan Hu, and Yi Yang. 2019. Filter pruning via geometric median for deep convolutional neural networks acceleration. InCVPR. 4340–4349

    2019

  35. [35]

    Yang He and Lingao Xiao. 2023. Structured Pruning for Deep Convolutional Neural Networks: A survey.arXiv preprint arXiv:2303.00566(2023)

    Pith/arXiv arXiv 2023

  36. [36]

    Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. 2017. Cryptodl: Deep neural networks over encrypted data.arXiv preprint arXiv:1711.05189(2017)

    Pith/arXiv arXiv 2017

  37. [37]

    Yang He, Guoliang Kang, Xuanyi Dong, Yanwei Fu, and Yi Yang. 2018. Soft filter pruning for accelerating deep convolutional neural networks.arXiv preprint arXiv:1808.06866(2018)

    Pith/arXiv arXiv 2018

  38. [38]

    Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Chris- tian Igel. 2013. Detection of Traffic Signs in Real-World Images: The German Traffic Sign Detection Benchmark. InInternational Joint Conference on Neural Networks

    2013

  39. [39]

    Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xinfeng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, et al. 2020. Deepsniffer: A dnn model extraction framework based on learning architectural hints. InProceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems. 385–399

    2020

  40. [40]

    Zehao Huang and Naiyan Wang. 2018. Data-driven sparse structure selection for deep neural networks. InProceedings of the European conference on computer vision (ECCV). 304–320

    2018

  41. [41]

    Sanghyun Hong, Michael Davinroy, Yigitcan Kaya, Stuart Nevans Locke, Ian Rackow, Kevin Kulda, Dana Dachman-Soled, and Tudor Dumitras. 2018. Security analysis of deep neural networks operating in the presence of cache side-channel attacks. CoRR abs/1810.03487 (2018).arXiv preprint arXiv:1810.03487(2018)

    Pith/arXiv arXiv 2018

  42. [42]

    Takumi Ishiyama, Takuya Suzuki, and Hayato Yamana. 2020. Highly accurate CNN inference using approximate activation functions over homomorphic en- cryption. InIEEE International Conference on Big Data (Big Data). 3989–3995

    2020

  43. [43]

    Nayna Jain, Karthik Nandakumar, Nalini Ratha, Sharath Pankanti, and Uttam Kumar. 2021. Efficient CNN building blocks for encrypted data.arXiv preprint arXiv:2102.00319(2021)

    Pith/arXiv arXiv 2021

  44. [44]

    Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. 2019. PRADA: protecting against DNN model stealing attacks. In2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 512–527

    2019

  45. [45]

    Alberto Ibarrondo and Melek Önen. 2018. Fhe-compatible batch normalization for privacy preserving deep learning. InESORICS Workshops on Data Privacy Management, Cryptocurrencies and Blockchain Technology. 389–404

    2018

  46. [46]

    Justin Ker, Lipo Wang, Jai Rao, and Tchoyoson Lim. 2017. Deep learning applica- tions in medical image analysis.Ieee Access6 (2017), 9375–9389

    2017

  47. [47]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  48. [48]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2017. Imagenet classi- fication with deep convolutional neural networks.Commun. ACM60, 6 (2017), 84–90

    2017

  49. [49]

    Barry L Kalman and Stan C Kwasny. 1992. Why tanh: choosing a sigmoidal function. InInternational Joint Conference on Neural Networks, Vol. 4. IEEE, 578– 581. 14 PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption Proceedings on Privacy Enhancing Technologies YYYY(X)

    1992

  50. [50]

    Yann LeCun, John Denker, and Sara Solla. 1989. Optimal brain damage.Advances in neural information processing systems2 (1989)

    1989

  51. [51]

    Joon-Woo Lee, Hyungchul Kang, Yongwoo Lee, Woosuk Choi, Jieun Eom, Maxim Deryabin, Eunsang Lee, Junghyun Lee, Donghoon Yoo, Young-Sik Kim, and Jong- Seon No. 2022. Privacy-Preserving Machine Learning With Fully Homomorphic Encryption for Deep Neural Network.IEEE Access10 (2022), 30039–30054

    2022

  52. [52]

    Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. 2016. Pruning filters for efficient convnets.arXiv preprint arXiv:1608.08710(2016)

    Pith/arXiv arXiv 2016

  53. [53]

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. 1998. Gradient- based learning applied to document recognition.Proc. IEEE86, 11 (1998), 2278– 2324

    1998

  54. [54]

    Ji Lin, Yongming Rao, Jiwen Lu, and Jie Zhou. 2017. Runtime neural pruning. Advances in neural information processing systems30 (2017)

    2017

  55. [55]

    Mingbao Lin, Rongrong Ji, Yan Wang, Yichen Zhang, Baochang Zhang, Yonghong Tian, and Ling Shao. 2020. Hrank: Filter pruning using high-rank feature map. InCVPR. 1529–1538

    2020

  56. [56]

    Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. 2018. Rethinking the value of network pruning.arXiv preprint arXiv:1810.05270(2018)

    Pith/arXiv arXiv 2018

  57. [57]

    Shutao Li, Weiwei Song, Leyuan Fang, Yushi Chen, Pedram Ghamisi, and Jon Atli Benediktsson. 2019. Deep learning for hyperspectral image classification: An overview.IEEE Transactions on Geoscience and Remote Sensing57, 9 (2019), 6690–6709

    2019

  58. [58]

    Shervin Minaee, Yuri Boykov, Fatih Porikli, Antonio Plaza, Nasser Kehtarnavaz, and Demetri Terzopoulos. 2021. Image segmentation using deep learning: A survey.IEEE transactions on pattern analysis and machine intelligence44, 7 (2021), 3523–3542

    2021

  59. [59]

    Mohammed Ali mnmoustafa. 2017. Tiny ImageNet. https://kaggle.com/ competitions/tiny-imagenet

    2017

  60. [60]

    Jianjun Ni, Yinan Chen, Yan Chen, Jinxiu Zhu, Deena Ali, and Weidong Cao

  61. [61]

    Daniel Lowd and Christopher Meek. 2005. Adversarial learning. InProceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining. 641–647

    2005

  62. [62]

    Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. 2023. I know what you trained last summer: A survey on stealing machine learning models and defences. Comput. Surveys(2023)

    2023

  63. [63]

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. InProceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition. 4954–4963

    2019

  64. [64]

    Ahmet Murat Ozbayoglu, Mehmet Ugur Gudelek, and Omer Berat Sezer. 2020. Deep learning for financial applications: A survey.Applied Soft Computing93 (2020), 106384

    2020

  65. [65]

    Soham Pal, Yash Gupta, Aditya Shukla, Aditya Kanade, Shirish Shevade, and Vinod Ganapathy. 2020. Activethief: Model extraction using active learning and unannotated public data. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 865–872

    2020

  66. [66]

    Srinath Obla, Xinghan Gong, Asma Aloufi, Peizhao Hu, and Daniel Takabi. 2020. Effective Activation Functions for Homomorphic Evaluation of Deep Neural Networks.IEEE Access8 (2020), 153098–153112

    2020

  67. [67]

    Prajit Ramachandran, Barret Zoph, and Quoc V Le. 2017. Searching for activation functions.arXiv preprint arXiv:1710.05941(2017)

    Pith/arXiv arXiv 2017

  68. [68]

    Robert Nikolai Reith, Thomas Schneider, and Oleksandr Tkachenko. 2019. Effi- ciently stealing your machine learning models. InProceedings of the 18th ACM Workshop on Privacy in the Electronic Society. 198–210

    2019

  69. [69]

    Ronald L Rivest, Len Adleman, Michael L Dertouzos, et al. 1978. On data banks and privacy homomorphisms.Foundations of secure computation4, 11 (1978), 169–180

    1978

  70. [70]

    Victor Sanh, Thomas Wolf, and Alexander Rush. 2020. Movement pruning: Adaptive sparsity by fine-tuning.Advances in Neural Information Processing Systems33 (2020), 20378–20389

    2020

  71. [71]

    Li Pengcheng, Jinfeng Yi, and Lijun Zhang. 2018. Query-efficient black-box attack by active learning. In2018 IEEE International Conference on Data Mining (ICDM). IEEE, 1200–1205

    2018

  72. [72]

    Microsoft SEAL (release 4.0)

    SEAL 2022. Microsoft SEAL (release 4.0). https://github.com/Microsoft/SEAL. Microsoft Research, Redmond, WA

    2022

  73. [73]

    Dinggang Shen, Guorong Wu, and Heung-Il Suk. 2017. Deep learning in medical image analysis.Annual review of biomedical engineering19 (2017), 221–248

    2017

  74. [74]

    Li Shen, Laurie R Margolies, Joseph H Rothstein, Eugene Fluder, Russell McBride, and Weiva Sieh. 2019. Deep learning to improve breast cancer detection on screening mammography.Scientific reports9, 1 (2019), 12495

    2019

  75. [75]

    Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556(2014)

    Pith/arXiv arXiv 2014

  76. [76]

    Sunandini Sanyal, Sravanti Addepalli, and R Venkatesh Babu. 2022. Towards data-free model stealing in a hard label setting. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 15284–15293

    2022

  77. [77]

    Jinjiang Wang, Yulin Ma, Laibin Zhang, Robert X Gao, and Dazhong Wu. 2018. Deep learning for smart manufacturing: Methods and applications.Journal of manufacturing systems48 (2018), 144–156

    2018

  78. [78]

    Mengjia Yan, Christopher W Fletcher, and Josep Torrellas. 2020. Cache telepathy: Leveraging shared resource attacks to learn{DNN} architectures. In29th USENIX Security Symposium (USENIX Security 20). 2003–2020

    2020

  79. [79]

    Andrew C Yao. 1982. Protocols for secure computations. In23rd annual sympo- sium on foundations of computer science (sfcs 1982). IEEE, 160–164

    1982

  80. [80]

    Mao Ye, Chengyue Gong, Lizhen Nie, Denny Zhou, Adam Klivans, and Qiang Liu

Showing first 80 references.