Pith. sign in

REVIEW 2 major objections 6 minor 54 references

Enhancing Noisy Functional Encryption for Privacy-Preserving Machine Learning

T0 review · 2 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DyNo, a PRF-based inner-product dynamic noisy multi-client functional encryption scheme, claims one-time IND-security with client corruptions and makes global-DP logistic regression on encrypted data practical.

desk verdict Solid PRF-based DyNMCFE construction with impressive speedups, but the logistic regression DP claim rests on a false sensitivity bound and is unsupported as written. read the letter →

arxiv 2505.05843 v1 pith:JBT3MQL7 submitted 2025-05-09 cs.CR

Linda Scheu-Hachtel , Jasmin Zalonis This is my paper · ORCID
classification cs.CR
keywords noisyfunctionalencryptionmulti-clientdynamicNMCFEdifferentialprivacyprivacy-preservingmachinelearninginner-productlogisticregressionpseudorandomfunction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces dynamic noisy multi-client functional encryption (DyNMCFE), a setting in which an authority can mint encryption keys for clients on the fly and hand analysts decryption keys for labelled subsets of ciphertexts that reveal the desired function evaluation plus controlled noise. The paper's central claim is that its concrete scheme DyNo, an inner-product construction whose security rests only on a pseudorandom function, achieves one-time indistinguishability security even when some clients are corrupted, while being faster and smaller than all prior noisy functional encryption schemes. A sympathetic reader would care because this makes global differential privacy for machine learning on multi-source data, specifically a logistic regression trained on encrypted medical datasets, practical: the paper reports runtimes in milliseconds for encryption and decryption on datasets up to $10^6$ entries, where prior pairing-based schemes take seconds to hours. The scheme also supports the dynamic join and drop-out of data holders across labelled analyses, matching real study workflows.

What carries the argument

The load-bearing object is the label-keyed PRF one-time pad: each ciphertext is the plaintext masked by $\mathrm{PRF}(ek_i,\ell)$, and the decryption key aggregates the corresponding masks for all clients in the chosen subset before subtracting a sampled noise $\nu$. Because the masks are produced by a PRF on per-client keys and labels, label-subset ciphertexts can be combined only when the authority issues the matching key, dynamic registration reduces to handing out a fresh $\lambda$-bit key, and the noise $\nu$ is hidden inside the key rather than in the ciphertexts. The security proof reduces DyNo to the noiseless, information-theoretically secure one-time MIFE scheme by swapping PRF outputs for random values, which is why the construction avoids pairings and achieves its small key sizes.

What would settle it

Compute the actual maximum of $|a_2 z - a_1 z^3|$ on $[-\Theta,\Theta]$ with $a_1=0.81562/8^3$ and $a_2=1.20096/8$ and compare it with the endpoint value $|a_2\Theta - a_1\Theta^3|$ used in Eq. (7); if the true maximum exceeds the endpoint value for some $\Theta$ allowed in training, the noise schedule is miscalibrated. Equivalently, simulate two adjacent datasets whose only difference is one record placed at the maximizer and measure the $\ell^2$ norm of the gradient-vector difference.

Watch

Extended reading notes

Core claim

DyNo works by replacing the vector one-time pad of the basic MIFE scheme with a PRF keyed by each client's secret key and evaluated on the label: the ciphertext for client $i$ under label $\ell$ is $c_i = x_i + \mathrm{PRF}(ek_i,\ell) \bmod q$, and a decryption key for function $y$ and noise distribution $D$ stores $z = \sum_i \langle \mathrm{PRF}(ek_i,\ell), y_i\rangle - \nu$, so decryption returns $\sum_i \langle x_i, y_i\rangle + \nu$ and nothing else. This label-dependent one-time pad is the mechanism that carries the security argument: up to a PRF-to-random-function step and a reduction to the information-theoretically secure one-time NMIFE scheme, the adversary's view is independent of the challenge bit. The paper claims one-time IND-security with static client corruptions, correct decryption in $\mathbb{Z}$ when the modulus is large enough, and concrete efficiency gains: keys and ciphertexts are $\lambda$ and $m\log q$ bits rather than group elements, and all algorithms run in milliseconds in the implementation.

Load-bearing premise

The claimed $(\epsilon,\delta)$-differential privacy for the logistic regression rests entirely on the sensitivity bound in Eq. (7), which is stated without derivation or a proof that the polynomial deviation is maximized at the endpoint $z=\Theta$; if that bound underestimates the true influence of one record, the Gaussian noise added per iteration is too small and the privacy guarantee collapses.

Editorial extensions

If this is right

  • An analyst can train a logistic regression by querying inner-product keys for polynomial-approximated gradients while data holders encrypt once per label and then stay offline.
  • Because only the analyst and the authority exchange decryption keys after data upload, the same encrypted dataset can support multiple analyses until the participants' privacy budget is exhausted.
  • The security notion allows corrupted clients, so an analyst who colludes with some data holders still learns nothing about the remaining honest clients beyond the noisy function outputs.
  • The reported runtimes place noisy functional encryption in the range of practical encrypted analytics for dataset sizes where prior pairing-based noisy FE schemes do not terminate.
  • Training with global differential privacy becomes possible without per-iteration re-encryption, since the noise is added inside each decryption key rather than to the raw data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: if the sensitivity bound in Eq. (7) does not hold over the full parameter range, the same protocol could be repaired by replacing it with a proven bound or by shrinking the learning rate; the cryptographic scheme itself would be unaffected.
  • Editorial: the one-ciphertext-per-label-per-client restriction means a long-running study that needs repeated submissions from the same data holder under the same analysis label would require a multi-message variant, and DyNo as presented is one-shot per client-label pair.
  • Editorial: because the cubic-sigmoid linearization makes the ciphertext length scale as $O(m^4)$ in the number of attributes, the practical sweet spot is low-dimensional medical data; the paper's mention of a linear-sigmoid variant with $O(m^2)$ slots points to a utility-efficiency trade-off it does not explore.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. This paper extends noisy multi-input functional encryption (NMIFE) to a dynamic multi-client setting (DyNMCFE) with labels, client corruptions, and dynamic registration. The authors propose DyNo, an inner-product DyNMCFE scheme based on a PRF and one-time-pad masking, prove one-time IND-security via a reduction to a static variant and to the one-time NMIFE scheme, and instantiate a privacy-preserving logistic regression protocol with global differential privacy using the analytic Gaussian mechanism. The paper reports substantial efficiency improvements over prior noisy FE schemes in key and ciphertext sizes and in runtimes, and includes benchmarks and utility experiments on medical datasets.

Significance. If the claims hold, the construction is a significant practical step: it removes pairing-based operations from noisy FE, provides a stronger corruption model than prior NMIFE, and demonstrates the first inner-product-FE-based logistic regression. The cryptographic core is standard and the reduction to an information-theoretically secure one-time scheme is plausible, giving confidence in the IND-security claim. The efficiency numbers are compelling. However, the DP guarantee of the logistic regression protocol rests on a sensitivity bound that is not derived and is in fact false (major comment 1), so the application-level privacy claim, which is the paper's main new application contribution, is currently unsupported. The security proof also contains hybrid-index inconsistencies that must be fixed before the security claim can be fully verified.

major comments (2)
  1. [Section 7.2, Eq. (7)] The asserted l2-sensitivity bound is not proven and is in fact false. Consider m=3, n=1, alpha=1, theta=(0,8,0,0) so that Theta=8, and adjacent single-record datasets X={x} and X'={x'} with x=(1,0.7,1,1) (y=0) and x'=(1,0,1,1) (y'=1); both records lie in the stated domain [0,1]^4. With the paper's constants a1=0.81562/8^3 and a2=1.20096/8, we have z=theta·x=5.6 and z'=0, hence A=y-g(z)=-1.0611 and A'=y'-g(0)=0.5. The per-record gradient difference is (A-A', A·0.7 - A'·0, A·1 - A'·1, A·1 - A'·1) = (-1.5611, -0.7428, -1.5611, -1.5611), whose l2-norm is sqrt(3·1.5611^2 + 0.7428^2) ≈ sqrt(7.863) ≈ 2.804. Eq. (7) gives sqrt(4)·(1 + |a1·8^3 - a2·8|) = 2·1.3853 ≈ 2.771, which is strictly smaller than the true sensitivity. Thus the bound underestimates the l2-sensitivity for an admissible configuration, so the Gaussian noise calibrated from Eq. (7) is too small and the claimed (epsilon,delta)-DP guarantee for the logistic regression protocol does not follow as written.
  2. [Appendix B.2, Lemma 3 and proof of Theorem 5] The hybrid argument as written is internally inconsistent. Lemma 2 claims to bound |P(A,G0)-P(A,G1)| by h·AdvPRF, and Lemma 3 also claims to bound |P(A,G0)-P(A,G1)|, this time by Advsta-nh-one-IND_NMIFEot. Since the intended sequence is G0->G1 (PRF to random function) and G1->G2 (switch of the challenge bit), one of the two statements must refer to a different pair of games; as printed, the two lemmas cannot both bound the same gap and the proof of Theorem 5 cannot be followed. The same inconsistent indexing appears when the proof later refers back to Lemma 2 and Lemma 3. This needs to be corrected before the security claim can be considered verifiable.
minor comments (6)
  1. [Section 4.2, Definition 7] In the Initialization step, "C runs (pp, ) <- Setup" is missing the master secret key output; it should read (pp, msk) <- Setup.
  2. [Section 5] There is a typo: "teh analyst" should be "the analyst".
  3. [Section 7.2] The sentence "Without loss of generality, we may assume xi in [0,1]^{m+2}" is actually a normalization assumption that affects the sensitivity analysis; it should be stated explicitly as an assumption and linked to the preprocessing step (the mapping M).
  4. [Section 7.2, Eq. (7)] The sensitivity is denoted Delta(F_theta) in Eq. (7) but Definition 3 uses Delta_2(·); please unify the notation.
  5. [Appendix B.1, Theorem 3] The security notion for MIFEot is given as "ad-mh-one-IND" in the first sentence and "ad-nh-one-IND" in the second; the intended abbreviation should be fixed.
  6. [Table 2] For DiffPIPE at N=10^6, the table entries are "-" without a caption note; please add a note that the experiment was aborted after several days due to memory exhaustion.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: DyNo's security reduces to external NMIFEot/PRF; the self-cited NMIFE definition is a base, not a load-bearing result, and the main risk is an underived DP sensitivity bound (a correctness issue, not circularity).

full rationale

DyNo (Construction 2) is obtained by taking the external one-time MIFE of Abdalla et al. [3] and replacing the one-time pad with a PRF keyed by (client, label). The security proof (Theorem 2 with Appendix B.2) is a sequence-of-games reduction to (i) PRF security and (ii) NMIFEot, whose security is proved in Theorem 1 / Appendix B.1 from the information-theoretic security of MIFEot of Abdalla et al. (Theorem 3). These are external results, not assumptions smuggled from the authors' own work, so the central IND-security claim is not circular. The new definitional framework extends the authors' earlier NMIFE [50] with labels and dynamic key generation inspired by [16]; the self-citation to [50] is a definitional base and benchmark baseline, but removing it would not change the DyNo scheme or its reduction. There is no fitted parameter renamed as a prediction and no uniqueness claim imported from the authors' own theorems. The one substantive gap is Section 7.2, Eq (7): the l2-sensitivity bound is asserted without derivation. This is a DP correctness risk (the analytic Gaussian noise is calibrated from it), but it is not a circular step: it is an unproven bound, not a restatement of the DP guarantee or a fitted prediction. Correctness concerns therefore do not raise the circularity score; the minor self-citation to [50] justifies only the low end of the no-significant-circularity band.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The construction itself has no data-fitted parameters. The security rests on the existence of a secure PRF; the application rests on several domain assumptions about the polynomial sigmoid approximation, the integer Gaussian mechanism, and DP composition. The sensitivity bound in Eq (7) is asserted without derivation and is treated here as an unflagged assumption to be verified.

assumptions (6)
  • domain assumption AES-256 is a secure PRF
    The IND-security of DyNo is reduced to the security of the PRF; the paper instantiates the PRF with AES-256 citing NIST and assumes it is a secure PRF.
  • domain assumption The polynomial g(x) = -a1 x^3 + a2 x + 0.5 approximates the sigmoid on [-8,8] with sufficient accuracy for gradient descent convergence and for the sensitivity analysis
    The protocol replaces the sigmoid with this polynomial throughout. The paper cites [29] for the approximation but does not quantify its error or prove that the gradient update remains valid for the DP analysis.
  • domain assumption The analytic Gaussian mechanism with integer/binomial noise, as implemented in the Google DP library, provides (epsilon,delta)-DP
    The protocol uses the library's GM to sample noise; the paper does not prove that the integer rounding meets Definition 4, relying on the library's guarantees.
  • standard math Standard DP composition and post-processing theorems
    The privacy budget is accumulated over iterations using composition; these are classical results from Dwork and Roth [20].
  • standard math The modulus q is large enough that nmXY + d < q (Eq 5), ensuring correct decryption over Z
    The paper states this condition for correctness in Z rather than Zq; the implementation chooses q accordingly.
  • ad hoc to paper The l2-sensitivity bound in Eq (7) is a valid upper bound
    The sensitivity bound is asserted without derivation; it is load-bearing for the DP claim and is not obviously correct for all parameter ranges.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Noisy Functional Encryption for Privacy-Preserving Machine Learning." pith.science (2026). https://pith.science/paper/JBT3MQL7

@misc{pith2026250505843,
  author       = {Pith},
  title        = {Pith review of: Enhancing Noisy Functional Encryption for Privacy-Preserving Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JBT3MQL7}},
  note         = {Machine review of arXiv:2505.05843}
}
read the original abstract

Functional encryption (FE) has recently attracted interest in privacy-preserving machine learning (PPML) for its unique ability to compute specific functions on encrypted data. A related line of work focuses on noisy FE, which ensures differential privacy in the output while keeping the data encrypted. We extend the notion of noisy multi-input functional encryption (NMIFE) to (dynamic) noisy multi-client functional encryption ((Dy)NMCFE), which allows for more flexibility in the number of data holders and analyses, while protecting the privacy of the data holder with fine-grained access through the usage of labels. Following our new definition of DyNMCFE, we present DyNo, a concrete inner-product DyNMCFE scheme. Our scheme captures all the functionalities previously introduced in noisy FE schemes, while being significantly more efficient in terms of space and runtime and fulfilling a stronger security notion by allowing the corruption of clients. To further prove the applicability of DyNMCFE, we present a protocol for PPML based on DyNo. According to this protocol, we train a privacy-preserving logistic regression.

Figures

Figures reproduced from arXiv: 2505.05843 by the authors.

Figure 1
Figure 1. Analysis request and data gathering. holders is exceeded [PITH_FULL_IMAGE:figures/full_fig_p017_1.png] view at source ↗
Figure 2
Figure 2. Training phase. 6.1 Warm up: NMIFEot In the following we refer to the scheme of Abdalla et al. [3] as MIFEot. Extensions implemented to lift MIFEot to a noisy variant NMIFEot are marked in boxes. If D is chosen to be the all-zero distribution, both schemes are equivalent. Construction 1. (NMIFEot) Let F m q,n be the class of multi-input inner products over Zq. NMIFEot scheme for F m q,n consists of the following alg… view at source ↗
Figure 3
Figure 3. Model utility for 50 rounds, in dependency of ϵmax. The dashed line shows peak accuracy on plaintext after 500 rounds. Dotted lines represent the maximal accuracy achieved with LDP with 500 rounds. 1 2 3 4 5 6 7 8 0.0 0.2 0.4 0.6 0.8 ϵmax it = 50 it = 100 it = 150 max acc local DP [PITH_FULL_IMAGE:figures/full_fig_p025_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 44 canonical work pages

  1. [1]

    Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G.S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Levenberg, J., Mané, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., Talwar...

    2015

  2. [2]

    In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016)

    2016

  3. [3]

    Abdalla, M., Benhamouda, F., Kohlweiss, M., Waldner, H.: Decentralizing inner- product functional encryption. pp. 128–157 (2019). https://doi.org/10.1007/ 978-3-030-17259-6_5

    work page 2019

  4. [4]

    Abdalla, M., Catalano, D., Fiore, D., Gay, R., Ursu, B.: Multi-input functional en- cryption for inner products: Function-hiding realizations and constructions without pairings. pp. 597–627 (2018).https://doi.org/10.1007/978-3-319-96884-1_20

    work page doi:10.1007/978-3-319-96884-1_20 2018

  5. [5]

    In: Theory of Cryptography Conference

    Agrawal, S., Goyal, R., Tomida, J.: Multi-input quadratic functional encryption: Stronger security, broader functionality. In: Theory of Cryptography Conference. pp. 711–740. Springer (2022) Enhancing Noisy FE for PPML 27

    work page 2022

  6. [6]

    Agrawal, S., Libert, B., Stehlé, D.: Fully secure functional encryption for inner products, from standard assumptions. pp. 333–362 (2016).https://doi.org/10. 1007/978-3-662-53015-3_12

    work page 2016

  7. [7]

    https://pkg.go.dev/crypto/aes@go1.23.2 (2024), https://pkg.go.dev/crypto/aes@go1.23.2, version go1.23.2

    Authors, T.G.: crypto/aes package. https://pkg.go.dev/crypto/aes@go1.23.2 (2024), https://pkg.go.dev/crypto/aes@go1.23.2, version go1.23.2

    work page 2024

  8. [8]

    Heal the Privacy: Functional Encryption and Privacy-Preserving Analytics

    Bakas, A., Michalas, A.: Heal the privacy: Functional encryption and privacy- preserving analytics. arXiv preprint arXiv:2205.03083 (2022)

    work page Pith review arXiv 2022

Show all 54 references
  1. [9]

    In: Proceedings of the Twelveth ACM Conference on Data and Application Security and Privacy

    Bakas, A., Michalas, A., Dimitriou, T.: Private lives matter: A differential private functional encryption scheme. In: Proceedings of the Twelveth ACM Conference on Data and Application Security and Privacy. pp. 300–311 (2022)

    2022

  2. [10]

    In: Dy, J., Krause, A

    Balle, B., Wang, Y.X.: Improving the Gaussian mechanism for differential pri- vacy: Analytical calibration and optimal denoising. In: Dy, J., Krause, A. (eds.) Proceedings of the 35th International Conference on Machine Learning. Proceed- ings of Machine Learning Research, vol...

    2018

  3. [11]

    In: Annual In- ternational Cryptology Conference

    Baltico, C.E.Z., Catalano, D., Fiore, D., Gay, R.: Practical functional encryption for quadratic functions with applications to predicate encryption. In: Annual In- ternational Cryptology Conference. pp. 67–98. Springer (2017)

    2017

  4. [12]

    Boyle, E., Chung, K.M., Pass, R.: On extractability obfuscation. pp. 52–73 (2014). https://doi.org/10.1007/978-3-642-54242-8_3

    2014 doi

  5. [13]

    Proceedings on Privacy Enhancing Technologies2020(2), 5–23 (2020)

    Carpov, S., Fontaine, C., Ligier, D., Sirdey, R.: Illuminating the dark or how to recover what should not be seen in fe-based classifiers. Proceedings on Privacy Enhancing Technologies2020(2), 5–23 (2020)

    2020

  6. [14]

    IEEE Transactions on Information Forensics and Security 18, 1855–1869 (2023)

    Chang, Y., Zhang, K., Gong, J., Qian, H.: Privacy-preserving federated learning via functional encryption, revisited. IEEE Transactions on Information Forensics and Security 18, 1855–1869 (2023)

    2023

  7. [15]

    Chotard, J., Dufour Sans, E., Gay, R., Phan, D.H., Pointcheval, D.: Decentralized multi-client functional encryption for inner product. pp. 703–732 (2018).https: //doi.org/10.1007/978-3-030-03329-3_24

    2018 doi

  8. [16]

    In: Micciancio, D., Ristenpart, T

    Chotard, J., Dufour-Sans, E., Gay, R., Phan, D.H., Pointcheval, D.: Dynamic de- centralized functional encryption. In: Micciancio, D., Ristenpart, T. (eds.) Ad- vances in Cryptology – CRYPTO 2020. pp. 747–775. Springer International Pub- lishing, Cham (2020)

    2020

  9. [17]

    Datta, P., Okamoto, T., Tomida, J.: Full-hiding (unbounded) multi-input inner product functional encryption from thek-Linear assumption. pp. 245–277 (2018). https://doi.org/10.1007/978-3-319-76581-5_9

    2018 doi

  10. [18]

    arXiv preprint arXiv:2111.00173 (2021)

    Du, J., Li, S., Chen, X., Chen, S., Hong, M.: Dynamic differential-privacy preserv- ing sgd. arXiv preprint arXiv:2111.00173 (2021)

    2021 arXiv

  11. [19]

    Cryptology ePrint Archive (2018)

    Dufour-Sans, E., Gay, R., Pointcheval, D.: Reading in the dark: Classifying en- crypted digits with functional encryption. Cryptology ePrint Archive (2018)

    2018

  12. [20]

    Founda- tions and Trends® in Theoretical Computer Science9(3–4), 211–407 (2014)

    Dwork, C., Roth, A.: The algorithmic foundations of differential privacy. Founda- tions and Trends® in Theoretical Computer Science9(3–4), 211–407 (2014)

    2014

  13. [21]

    Proceedings on Privacy Enhancing Technologies4, 583–604 (2024)

    Escobar, F.A., Canard, S., Laguillaumie, F., Phan, D.H.: Computational differ- ential privacy for encrypted databases supporting linear queries. Proceedings on Privacy Enhancing Technologies4, 583–604 (2024)

    2024

  14. [22]

    arXiv preprint arXiv:2310.10049 (2023)

    Fan, T., Kang, Y., Ma, G., Chen, W., Wei, W., Fan, L., Yang, Q.: Fate-llm: A industrial grade federated learning framework for large language models. arXiv preprint arXiv:2310.10049 (2023)

    2023 arXiv

  15. [23]

    SIAM Journal on Computing45(3), 882–929 (2016) 28 L

    Garg, S., Gentry, C., Halevi, S., Raykova, M., Sahai, A., Waters, B.: Candidate indistinguishability obfuscation and functional encryption for all circuits. SIAM Journal on Computing45(3), 882–929 (2016) 28 L. Scheu-Hachtel and J. Zalonis

    2016

  16. [24]

    In: Proceedings of the forty-first annual ACM symposium on Theory of computing

    Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Proceedings of the forty-first annual ACM symposium on Theory of computing. pp. 169–178 (2009)

    2009

  17. [25]

    Manuscript

    Goldreich, O.: Secure multi-party computation. Manuscript. Preliminary version 78(110), 1–108 (1998)

    1998

  18. [26]

    In: Pro- ceedings of the 2020 ACM SIGSAC conference on computer and communications security

    Keller, M.: Mp-spdz: A versatile framework for multi-party computation. In: Pro- ceedings of the 2020 ACM SIGSAC conference on computer and communications security. pp. 1575–1590 (2020)

    2020

  19. [27]

    BMC medical genomics 11, 23–31 (2018)

    Kim, A., Song, Y., Kim, M., Lee, K., Cheon, J.H.: Logistic regression model train- ing based on the approximate homomorphic encryption. BMC medical genomics 11, 23–31 (2018)

    2018

  20. [28]

    IEEE Transactions on Infor- mation Forensics and Security15, 695–710 (2019)

    Kim, M., Lee, J., Ohno-Machado, L., Jiang, X.: Secure and differentially private logistic regression for horizontally distributed data. IEEE Transactions on Infor- mation Forensics and Security15, 695–710 (2019)

    2019

  21. [29]

    JMIR medical infor- matics 6(2), e8805 (2018)

    Kim, M., Song, Y., Wang, S., Xia, Y., Jiang, X., et al.: Secure logistic regression based on homomorphic encryption: Design and evaluation. JMIR medical infor- matics 6(2), e8805 (2018)

    2018

  22. [30]

    In: 2021 International Conference on Networking and Network Applications (NaNA)

    Li, M., Tian, Y., Zhang, J., Fan, D., Zhao, D.: The trade-off between pri- vacy and utility in local differential privacy. In: 2021 International Conference on Networking and Network Applications (NaNA). pp. 373–378 (2021).https: //doi.org/10.1109/NaNA53684.2021.00071

    2021

  23. [31]

    IEEE signal processing magazine37(3), 50–60 (2020)

    Li, T., Sahu, A.K., Talwalkar, A., Smith, V.: Federated learning: Challenges, meth- ods, and future directions. IEEE signal processing magazine37(3), 50–60 (2020)

    2020

  24. [32]

    Libert, B., Titiu, R.: Multi-client functional encryption for linear functions in the standard model from LWE. pp. 520–551 (2019).https://doi.org/10.1007/ 978-3-030-34618-8_18

    2019

  25. [33]

    In: International Conference on Information Systems Security and Privacy

    Ligier, D., Carpov, S., Fontaine, C., Sirdey, R.: Privacy preserving data classifi- cation using inner-product functional encryption. In: International Conference on Information Systems Security and Privacy. vol. 2, pp. 423–430. SciTePress (2017)

    2017

  26. [34]

    lbw: Low birth weight study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/lbw.html

    LogisticDx: Diagnostic tests for models with a binomial response. lbw: Low birth weight study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/lbw.html

    2024

  27. [35]

    nhanes3: Nhanes iii data (8 2024),https://rdrr.io/rforge/LogisticDx/man/nhanes3.html

    LogisticDx: Diagnostic tests for models with a binomial response. nhanes3: Nhanes iii data (8 2024),https://rdrr.io/rforge/LogisticDx/man/nhanes3.html

    2024

  28. [36]

    pcs: Prostate cancer study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/pcs.html

    LogisticDx: Diagnostic tests for models with a binomial response. pcs: Prostate cancer study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/pcs.html

    2024

  29. [37]

    uis: Umaru im- patct study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/uis.html

    LogisticDx: Diagnostic tests for models with a binomial response. uis: Umaru im- patct study data (8 2024),https://rdrr.io/rforge/LogisticDx/man/uis.html

    2024

  30. [38]

    IEEE Internet of Things Journal 7(7), 5827–5842 (2020).https://doi.org/10.1109/JIOT.2019.2952146

    Mahawaga Arachchige, P.C., Bertok, P., Khalil, I., Liu, D., Camtepe, S., Atiquz- zaman, M.: Local differential privacy for deep learning. IEEE Internet of Things Journal 7(7), 5827–5842 (2020).https://doi.org/10.1109/JIOT.2019.2952146

    2020

  31. [39]

    Mera, J.M.B., Karmakar, A., Marc, T., Soleimanian, A.: Efficient lattice-based inner-product functional encryption. pp. 163–193 (2022). https://doi.org/10. 1007/978-3-030-97131-1_6

    2022

  32. [40]

    CoRR abs/2009.03561 (2020), https://arxiv.org/abs/2009.03561

    Naseri, M., Hayes, J., Cristofaro, E.D.: Toward robustness and privacy in fed- erated learning: Experimenting with local and central differential privacy. CoRR abs/2009.03561 (2020), https://arxiv.org/abs/2009.03561

    2020 arXiv

  33. [41]

    In: Proceedings of the 9th ACM International Workshop on Security and Privacy Analytics

    Panzade, P., Takabi, D.: Fenet: Privacy-preserving neural network training with functional encryption. In: Proceedings of the 9th ACM International Workshop on Security and Privacy Analytics. pp. 33–43 (2023)

    2023

  34. [42]

    Rao, S., Mahto, D., Yadav, D.K., Khan, D.: The aes-256 cryptosystem resists quantum attacks. Int. J. Adv. Res. Comput. Sci8(3), 404–408 (2017) Enhancing Noisy FE for PPML 29

    2017

  35. [43]

    arXiv preprint arXiv:1905.10214 (2019)

    Ryffel, T., Dufour-Sans, E., Gay, R., Bach, F., Pointcheval, D.: Partially encrypted machine learning using functional encryption. arXiv preprint arXiv:1905.10214 (2019)

    2019 arXiv

  36. [44]

    OECD Health Working Papers No

    Slawomirski, L., et al.: Progress on implementing and using electronic health record systems: Developments in oecd countries as of 2021. OECD Health Working Papers No. 160 (2023). https://doi.org/10.1787/4f4ce846-en

    2023 doi

  37. [45]

    https://doi.org/https://doi.org/10.6028/NIST.FIPS.197-upd1, https: //tsapps.nist.gov/publication/get_pdf.cfm?pub_id=936594

    of Standards, N.I., (NIST), T., Dworkin, M.J., Turan, M.S., Mouha, N.: Advanced encryption standard (aes) (2023-05-09 04:05:00 2023). https://doi.org/https://doi.org/10.6028/NIST.FIPS.197-upd1, https: //tsapps.nist.gov/publication/get_pdf.cfm?pub_id=936594

    2023 doi

  38. [46]

    com/google/differential-privacy

    Team, D.P.: Differential privacy library (dp lib v2.0.0) (2024),https://github. com/google/differential-privacy

    2024

  39. [47]

    Viand, A., Knabenhans, C., Hithnawi, A.: Verifiable fully homomorphic encryption (2023), https://arxiv.org/abs/2301.07041

    2023 arXiv

  40. [48]

    In: Annual Cryptology Conference

    Waters, B.: A punctured programming approach to adaptively secure functional encryption. In: Annual Cryptology Conference. pp. 678–697. Springer (2015)

    2015

  41. [49]

    In: 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS)

    Xu,R.,Joshi,J.B.,Li,C.:Cryptonn:Trainingneuralnetworksoverencrypteddata. In: 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS). pp. 1199–1209. IEEE (2019)

    2019

  42. [50]

    Proceedings on Privacy Enhancing Technologies2, 509–530 (2024)

    Zalonis, J., Armknecht, F., Scheu-Hachtel, L.: Differentially private functional en- cryption. Proceedings on Privacy Enhancing Technologies2, 509–530 (2024)

    2024

  43. [51]

    Information Sciences476, 357–372 (2019)

    Zhao, C., Zhao, S., Zhao, M., Chen, Z., Gao, C.Z., Li, H., Tan, Y.a.: Secure multi- party computation: theory, practice and applications. Information Sciences476, 357–372 (2019)

    2019

  44. [52]

    Federated Learning Systems: Towards Next-Generation AI pp

    Ziller, A., Trask, A., Lopardo, A., Szymkow, B., Wagner, B., Bluemke, E., Nouna- hon, J.M., Passerat-Palmbach, J., Prakash, K., Rose, N., et al.: Pysyft: A library for easy federated learning. Federated Learning Systems: Towards Next-Generation AI pp. 111–139 (2021) A Broader ...

    2021

  45. [53]

    Dec(dkf,ℓ, ct1,ℓ,..., ctn,ℓ): Takes as input the decryption keydkf,ℓ andn cipher- texts ct1,ℓ,..., ctn,ℓ, all encrypted under the same label used for the decryp- tion key

    Sampleν← D and output a decryption keydkf,ℓ. Dec(dkf,ℓ, ct1,ℓ,..., ctn,ℓ): Takes as input the decryption keydkf,ℓ andn cipher- texts ct1,ℓ,..., ctn,ℓ, all encrypted under the same label used for the decryp- tion key. It outputs a function evaluationf (x1,...,x n) +ν∈Y . 30 L. ...

  46. [54]

    Enhancing Noisy FE for PPML 37 Proof

    Then, for anyPPT adversaryA against theIND-security ofDyNo, there exists a PPT adversaryB such that AdvIND DyNo,A(λ)≤ Advsta-nh-one-lab-IND NMCFE,B (λ). Enhancing Noisy FE for PPML 37 Proof. We denote by 0k the all-zero vector of lengthk.B simulatesA’s view as follows. Upon in...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.