Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Local Differential Privacy for Deep Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LATENT claims that randomizing CNN feature vectors on the data owner's device before upload yields an ε-locally-differentially-private deep model that still achieves 91–96% test accuracy at ε=0.5 on MNIST and CIFAR-10.

desk verdict The split-CNN idea has merit, but the UER proof only covers pairs that differ in every bit, so the headline 0.5-LDP claim fails. read the letter →

arxiv 1908.02997 v3 pith:ZGRPFTM5 submitted 2019-08-08 cs.LG cs.CR

M.A.P. Chamikara , P. Bertok , I. Khalil , D. Liu , S. Camtepe , M. Atiquzzaman This is my paper · ORCID
classification cs.LGcs.CR
keywords localdifferentialprivacydeeplearningconvolutionalneuralnetworksrandomizedresponseutilityenhancingrandomizationLATENTIoTunaryencoding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that deep learning can be made locally differentially private without a trusted server by inserting a randomization layer between the convolutional layers and the fully connected layers of a CNN. A data owner runs the convolutional module and randomizes its flattened feature output before anything leaves the device, and the cloud trains only the fully connected module on the randomized bits. The proposed protocol, called LATENT, reports 91–96% test accuracy on MNIST and CIFAR-10 even at a privacy budget of ε=0.5, which is far stronger utility than the global-differential-privacy baselines it compares against. If the guarantee holds, untrusted machine-learning services could train models on sensitive IoT data without ever seeing original features.

What carries the argument

The central object is UER (Utility Enhancing Randomization), the bit-flipping protocol defined by Eq. (9). It randomizes the merged binary string by treating even positions and odd positions differently: a 1 at an even position is kept with probability $\frac{\alpha}{1+\alpha}$, a 1 at an odd position with probability $\frac{1}{1+\alpha^3}$, and a 0 is kept with probability $\frac{\alpha e^{\varepsilon/(rl)}}{1+\alpha e^{\varepsilon/(rl)}}$. The parameter $\alpha$ (set to 7) controls the 0-preservation rate while the proof claims the two parity classes cancel to yield $\varepsilon$-LDP; the merged-string design is what converts the composition bound from $r\varepsilon$ to $\varepsilon$.

What would settle it

Measure the likelihood ratio of Eq. (9) for two flattened feature vectors that differ at a single even-position bit: at $\alpha=7$ and $\varepsilon=0.5$ the ratio is approximately $\alpha^2 e^{\varepsilon/(rl)} \approx 49$, far above $e^{0.5}\approx1.65$, so a direct calculation on LATENT's own encoding and probability parameters would settle whether the $\varepsilon=0.5$ guarantee holds.

Watch

Extended reading notes

Core claim

LATENT is the claim that ε-local differential privacy can be injected into a fixed convolutional feature extractor at the data owner's side. Each real-valued element of the flattened feature map is z-score normalized, converted to a fixed-length binary string, and all strings are merged into one long bit sequence; the merged sequence is then randomized bit-by-bit by UER before the fully connected module is trained on it. The paper argues that randomizing the merged string once keeps the total privacy loss at ε rather than r×ε, and that the UER probability assignment lets α=7 raise the chance of preserving 0s while splitting the behavior on 1s between even and odd positions. The trained FC module is then an ε-differentially-private function of the original data by postprocessing invariance.

Load-bearing premise

The privacy proof assumes that two neighboring inputs encode to binary strings that differ in every position, so the uneven even/odd bit odds cancel exactly; actual feature vectors can differ in only one bit.

Editorial extensions

If this is right

  • No trusted curator is needed: the convolutional module and LATENT run on the data owner's device, and only randomized binary strings reach the cloud.
  • At $\varepsilon=0.5$, the paper reports around 95–96% test accuracy on MNIST and 90–91% on CIFAR-10, exceeding the GDP baselines it compares against in the same budget regime.
  • Because differential privacy is closed under postprocessing, a released FC module trained on $\varepsilon$-LDP randomized inputs is itself an $\varepsilon$-DP model of the original training data.
  • The randomization layer can be deployed as a virtual network function in SDN/NFV edge-cloud settings, making the approach practical for IoT data pipelines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The claimed $\varepsilon=0.5$ bound depends on the binary encodings of neighboring feature vectors differing in every bit position; with real z-score-normalized values, two neighbors can differ in a single even-position bit, in which case Eq. (9) gives a likelihood ratio around $\alpha^2 e^{\varepsilon/(rl)} \approx 49$, not $e^{0.5}$.
  • The reported accuracy is nearly flat over small $\varepsilon$ values because the sensitivity $rl$ is so large that the per-bit noise is almost constant; a meaningful utility comparison would need the effective per-record privacy loss, not just the nominal $\varepsilon$.
  • A direct retest of UER on unary or one-hot encodings with fixed Hamming distance between distinct inputs would match the proof's assumption and could restore the $\varepsilon$-LDP guarantee if the empirical accuracy survives.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes LATENT, a local differential privacy (LDP) framework for deep learning in IoT settings. The method splits a CNN into a convolutional module that runs on the data owner's device, a randomization module that perturbs the flattened feature vector, and a fully connected (FC) module trained on the perturbed output. The central theoretical contribution is a new randomization protocol called utility enhancing randomization (UER), which applies different flip probabilities to even- and odd-indexed bits of a merged binary string. The authors claim that UER provides epsilon-LDP for the whole pipeline and report 91\%--96\% test accuracy at epsilon=0.5 on MNIST and CIFAR-10. The paper also discusses integration with SDN/NFV and reports computational overhead measurements.

Significance. If the privacy guarantee were valid, LATENT would be a practically appealing LDP solution for deep learning, combining a distributed, untrusted-curator setting with surprisingly high accuracy at very small privacy budgets. The architectural idea of placing a randomization layer inside the CNN and relying on postprocessing invariance is interesting, and the experimental study is reasonably extensive. However, the entire contribution rests on a single privacy proof, Theorem III.4 with Appendix F, and that proof is invalid for inputs that differ in only a subset of bits. Since Definition 2 quantifies over all pairs of client values, the claimed 0.5-LDP guarantee does not follow from the presented analysis. The reported experimental numbers cannot compensate for the absence of a valid privacy argument.

major comments (3)
  1. [Appendix F and Section III-A8, Eq. (9)] The UER privacy proof is invalid. In Appendix F, Eq. (26), the product over all bits is replaced by a product of two factors, one for even and one for odd positions, each raised to the power rl/2. This step is correct only if every pair of inputs v1 and v2 differs in exactly rl/2 even-position bits and rl/2 odd-position bits. Definition 2 requires the likelihood ratio to be bounded by e^epsilon for all pairs of client values, and the binary encodings produced by Eq. (5) include pairs that differ in only one bit (e.g. two values whose whole-number parts differ by 1 in the fixed-point encoding). For such a pair, every bit except the single differing bit contributes a factor of 1, so the overall ratio is the single-bit factor. For an even-position bit difference, the probabilities in Eq. (9) give a ratio of order alpha: with alpha=7 and epsilon=0.5, Pr[output=1|input=1]/Pr[output=1|input=0] is approximately 7, which is much larger than e^0.5 ~ 1.65. The alpha factors that cancel in the proof cancel only when even and odd parity classes contain equal numbers of differing bits. The theorem therefore does not establish epsilon-LDP, and the central claim of 0.5-LDP in the abstract and Section IV-A4 is unsupported.
  2. [Section III-A4] The statement that merging the binary strings reduces privacy loss from r*epsilon to epsilon is not justified. Merging changes the sensitivity from 2 to rl, and the protocol divides epsilon by rl in the per-bit probabilities. Whether the merged mechanism satisfies epsilon-LDP depends on a correct analysis of the UER probabilities over all possible input pairs. Since the Appendix F analysis is invalid for inputs with unbalanced parity differences, the claim that privacy loss is maintained at the input value of epsilon is unproven.
  3. [Theorem III.4 and Eq. (9)] The definition of UER in Eq. (9) is under-specified. The piecewise expression lists "Pr[B[v2]=0|v1]" in both branches, which suggests a typo: the conditioning should likely involve the input bit being 0 or 1 for a single bit position. Because the proof relies on an exact product decomposition, the lack of a precise, unambiguous statement of the conditional probability for every bit value (0 or 1) and every parity class makes it impossible to verify the claimed per-bit ratios. This is a presentational issue, but it compounds the mathematical flaw in the proof.
minor comments (5)
  1. [Eq. (9) and Appendix F] The piecewise notation "i in 2n" and "i in 2n+1" is nonstandard and ambiguous; use "i even" and "i odd" or "i mod 2 = 0" and "i mod 2 = 1".
  2. [Eq. (9)] The expression Pr[B[v2]=0|v1] appears in both branches of the piecewise definition, which is likely a typo; one of the branches should condition on the input value at that position being 0, and the notation should make the bit position explicit.
  3. [Algorithm 1, steps 7-8] Step 7 says to calculate the randomization probability according to Eq. (9), but step 8 says to use "probability p." Eq. (9) defines four different probabilities depending on parity and bit value, not a single p. Align the algorithm's language with the piecewise definition.
  4. [Section IV-A4] The choice of alpha=7 is described as "the lowest alpha value that generated reliable convergence," but the paper does not report how alpha interacts with the claimed privacy guarantee. Since alpha is a parameter of the mechanism, its effect on the effective privacy loss should be analyzed or at least discussed.
  5. [Section III-A2] The bounds for z-score normalization and the selection of n and m are not justified beyond a qualitative description. Since these parameters determine the binary representation and hence the sensitivity, the paper should specify how they are chosen in practice and whether the analysis is sensitive to them.

Circularity Check

0 steps flagged · score 0.0 of 10

No material circularity: the UER privacy proof is a self-contained derivation from OUE/RAPPOR, alpha is utility-only, and self-citations are not load-bearing.

full rationale

LATENT's privacy guarantee is derived in Theorem III.4 and Appendix F from the likelihood-ratio bounds of unary encoding and optimized unary encoding (Eqs. 8 and 10-24), not from the reported accuracy results and not from a fitted parameter. The coefficient alpha appears only in the perturbation probabilities and is selected empirically in Section IV-A4 to stabilize convergence; the claimed epsilon-LDP bound is constructed so that alpha cancels between the even and odd parity blocks, so alpha is not a hidden input that is later renamed as a privacy guarantee. The 91%-96% accuracies at epsilon=0.5 are reported experimental outcomes from training the FC module on randomized MNIST and CIFAR-10 features, with no privacy parameter fitted from those accuracies. Self-citations such as [12], [35], and [37] are contextual prior work and do not carry the UER derivation. The Appendix F cancellation does assume inputs differing in all rl bits, which is a correctness gap for the stated binary encodings, but that is a soundness flaw rather than circularity: the proof does not assume its conclusion, nor does it relabel an input as an output. The derivation chain is therefore self-contained with respect to circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central mechanism depends on the hand-chosen coefficient alpha, hand-set bit allocations, and an unstated balance assumption in the UER proof. No new physical entities are introduced. The sensitivity and normalization assumptions are load-bearing but not independently established.

free parameters (3)
  • alpha (privacy budget coefficient) = 7, chosen as the lowest alpha giving reliable convergence
    Hand-chosen in Section IV-A4. It controls the per-bit randomization probabilities in UER: larger alpha preserves zeros at the expense of ones, and alpha=7 is used for all reported accuracy results.
  • bit allocations n and m = MNIST: n=4, m=5; CIFAR-10: n=2, m=7
    Set in Section IV-A1. These define the binary encoding, the sensitivity r times l = 92160, and the precision of the randomized representation.
  • z-score normalization bounds = not reported
    Section III-A1 requires upper and lower bounds for binary conversion. The bounds are estimated from data, which itself would need privacy protection, and they determine the sensitivity used in the privacy proof.
assumptions (4)
  • domain assumption Binary conversion of any two adjacent z-score normalized feature vectors differs in at most r times l bits.
    Section III-A5 uses this sensitivity value to set p = e^(epsilon/(r l)) / (1 + e^(epsilon/(r l))). It requires fixed normalization bounds and no clipping or overflow in the conversion.
  • ad hoc to paper Even- and odd-position bit differences balance so that the alpha factors in UER cancel for every adjacent pair.
    Appendix F multiplies over all r l bits and cancels alpha to the r l from even positions with alpha to the minus r l from odd positions. This balance is not stated and is false for arbitrary binary encodings of real-valued features.
  • domain assumption The untrained convolutional module can be treated as a fixed public transform whose output sensitivity is covered by the LDP analysis.
    Section III-C places an untrained convolutional module on the data owner. The LDP guarantee is applied after this deterministic dimension-reducing transform, but the sensitivity of that transform is assumed rather than proven.
  • domain assumption Global z-score statistics are available to each data owner without consuming privacy budget.
    Section III-A1 normalizes using what appear to be global mean and standard deviation. In a purely local setting, these statistics must be estimated, which consumes privacy budget or requires public data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Local Differential Privacy for Deep Learning." pith.science (2026). https://pith.science/paper/ZGRPFTM5

@misc{pith2026190802997,
  author       = {Pith},
  title        = {Pith review of: Local Differential Privacy for Deep Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZGRPFTM5}},
  note         = {Machine review of arXiv:1908.02997}
}
abstract

The internet of things (IoT) is transforming major industries including but not limited to healthcare, agriculture, finance, energy, and transportation. IoT platforms are continually improving with innovations such as the amalgamation of software-defined networks (SDN) and network function virtualization (NFV) in the edge-cloud interplay. Deep learning (DL) is becoming popular due to its remarkable accuracy when trained with a massive amount of data, such as generated by IoT. However, DL algorithms tend to leak privacy when trained on highly sensitive crowd-sourced data such as medical data. Existing privacy-preserving DL algorithms rely on the traditional server-centric approaches requiring high processing powers. We propose a new local differentially private (LDP) algorithm named LATENT that redesigns the training process. LATENT enables a data owner to add a randomization layer before data leave the data owners' devices and reach a potentially untrusted machine learning service. This feature is achieved by splitting the architecture of a convolutional neural network (CNN) into three layers: (1) convolutional module, (2) randomization module, and (3) fully connected module. Hence, the randomization module can operate as an NFV privacy preservation service in an SDN-controlled NFV, making LATENT more practical for IoT-driven cloud-based environments compared to existing approaches. The randomization module employs a newly proposed LDP protocol named utility enhancing randomization, which allows LATENT to maintain high utility compared to existing LDP protocols. Our experimental evaluation of LATENT on convolutional deep neural networks demonstrates excellent accuracy (e.g. 91%- 96%) with high model quality even under low privacy budgets (e.g. $\varepsilon=0.5$).

Figures

Figures reproduced from arXiv: 1908.02997 by the authors.

Figure 1
Figure 1. Global vs. Local differential privacy II. BACKGROUND This section provides brief descriptions of the underlying concepts of LATENT. It includes brief summaries of basic principles related to "Differential Privacy" and to "Deep Learn￾ing", which are used in LATENT. A. Differential Privacy Differential privacy (DP) is a privacy model that is known to render maximum privacy by minimizing the chance of individual record… view at source ↗
Figure 2
Figure 2. Generic architecture of a convolutional neural network [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Direct mapping of a float/integer to binary [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (9 more)
Figure 3
Figure 3. Figure 3: CNN architecture with the LATENT randomization [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 5
Figure 5. Figure 5: LDP configurations of LATENT The proposed component distribution of the CNN architec￾ture, which moves the convolutional module to the data owner, produces additional privacy even before the randomization, as the output of the CNN module is a dimension-reduced 1-D vect…
Figure 6
Figure 6. Figure 6: Integration of LATENT with SDN and NFV in edge [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Architectural differences between the non-private [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Architectural differences between the baseline models [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: The model convergence of the FC module for the [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Change of accuracy of LATENT against ε 3) Image augmentation to improve robustness of the DPCNN trained using CIFAR-10 : Although we could im￾prove the accuracy of the DPCNN for CIFAR-10 using hy￾perparameter tuning, the model was still not performing well and tended …
Figure 11
Figure 11. Figure 11: The change of accuracy vs. the number of epochs [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: Time consumption analysis for the binary encoding [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 38 canonical work pages

  1. [1]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2016, pp. 308–318

    2016

  2. [2]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in Security and Privacy (SP), 2017 IEEE Symposium on . IEEE, 2017, pp. 3–18

    work page 2017

  3. [3]

    Tensorflow: a system for large- scale machine learning

    M. Abadi, P. Barham, J. Chen, Z. Chen, A. Davis, J. Dean, M. Devin, S. Ghemawat, G. Irving, M. Isard et al., “Tensorflow: a system for large- scale machine learning.” in OSDI, vol. 16, 2016, pp. 265–283

    2016

  4. [4]

    Distributed graphlab: a framework for machine learning and data mining in the cloud,

    Y . Low, D. Bickson, J. Gonzalez, C. Guestrin, A. Kyrola, and J. M. Hellerstein, “Distributed graphlab: a framework for machine learning and data mining in the cloud,” Proceedings of the VLDB Endowment , vol. 5, no. 8, pp. 716–727, 2012

    2012

  5. [5]

    Machine learning models that remember too much,

    C. Song, T. Ristenpart, and V . Shmatikov, “Machine learning models that remember too much,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . ACM, 2017, pp. 587–601

    work page 2017

  6. [6]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. ACM, 2015, pp. 1322–1333

    work page 2015

  7. [7]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Roth et al. , “The algorithmic foundations of differential privacy,” Foundations and Trends R© in Theoretical Computer Science , vol. 9, no. 3–4, pp. 211–407, 2014

    work page 2014

  8. [8]

    Privacy-preserving deep learning,

    R. Shokri and V . Shmatikov, “Privacy-preserving deep learning,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security. ACM, 2015, pp. 1310–1321

    work page 2015

Show all 51 references
  1. [9]

    Output perturbation with query relaxation,

    X. Xiao and Y . Tao, “Output perturbation with query relaxation,” Proceedings of the VLDB Endowment , vol. 1, no. 1, pp. 857–869, 2008

    2008

  2. [10]

    Extremal mechanisms for local differential privacy,

    P. Kairouz, S. Oh, and P. Viswanath, “Extremal mechanisms for local differential privacy,” in Advances in neural information processing systems, 2014, pp. 2879–2887

    2014

  3. [11]

    J. A. Fox, Randomized response and related methods: Surveying Sensi- tive Data. SAGE Publications, 2015, vol. 58

    2015

  4. [12]

    An efficient and scalable privacy preserving algorithm for big data and data streams,

    M. Chamikara, P. Bertok, D. Liu, S. Camtepe, and I. Khalil, “An efficient and scalable privacy preserving algorithm for big data and data streams,” Computers & Security , vol. 87, p. 101570, 2019

    2019

  5. [13]

    Differentially private continual monitoring of heavy hitters from distributed streams,

    T.-H. H. Chan, M. Li, E. Shi, and W. Xu, “Differentially private continual monitoring of heavy hitters from distributed streams,” in In- ternational Symposium on Privacy Enhancing Technologies Symposium . Springer, 2012, pp. 140–159

    2012

  6. [14]

    Rappor: Randomized aggre- gatable privacy-preserving ordinal response,

    Ú. Erlingsson, V . Pihur, and A. Korolova, “Rappor: Randomized aggre- gatable privacy-preserving ordinal response,” in Proceedings of the 2014 ACM SIGSAC conference on computer and communications security . ACM, 2014, pp. 1054–1067

    2014

  7. [15]

    Randomized response: A survey technique for eliminating evasive answer bias,

    S. L. Warner, “Randomized response: A survey technique for eliminating evasive answer bias,” Journal of the American Statistical Association , vol. 60, no. 309, pp. 63–69, 1965

    1965

  8. [16]

    Using randomized response for differential privacy preserving data collection

    Y . Wang, X. Wu, and D. Hu, “Using randomized response for differential privacy preserving data collection.” in EDBT/ICDT Workshops , vol. 1558, 2016

    2016

  9. [17]

    Heavy hitter estimation over set-valued data with local differential privacy,

    Z. Qin, Y . Yang, T. Yu, I. Khalil, X. Xiao, and K. Ren, “Heavy hitter estimation over set-valued data with local differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2016, pp. 192–203

    2016

  10. [18]

    Concentrated differential privacy: Simplifi- cations, extensions, and lower bounds,

    M. Bun and T. Steinke, “Concentrated differential privacy: Simplifi- cations, extensions, and lower bounds,” in Theory of Cryptography Conference. Springer, 2016, pp. 635–658

    2016

  11. [19]

    Mvg mecha- nism: Differential privacy under matrix-valued query,

    T. Chanyaswad, A. Dytso, H. V . Poor, and P. Mittal, “Mvg mecha- nism: Differential privacy under matrix-valued query,” arXiv preprint arXiv:1801.00823, 2018

    2018 arXiv

  12. [20]

    Deep learning in neural networks: An overview,

    J. Schmidhuber, “Deep learning in neural networks: An overview,” Neural networks, vol. 61, pp. 85–117, 2015

    2015

  13. [21]

    Convolutional neural networks for sentence classification,

    Y . Kim, “Convolutional neural networks for sentence classification,” arXiv preprint arXiv:1408.5882 , 2014

    2014 arXiv

  14. [22]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in Advances in neural infor- mation processing systems , 2012, pp. 1097–1105

    2012

  15. [23]

    Finding your way in the fog: Towards a comprehensive definition of fog computing,

    L. M. Vaquero and L. Rodero-Merino, “Finding your way in the fog: Towards a comprehensive definition of fog computing,” ACM SIGCOMM Computer Communication Review, vol. 44, no. 5, pp. 27–32, 2014

    2014

  16. [24]

    An energy-driven network function virtualization for multi- domain software defined networks,

    K. Kaur, S. Garg, G. Kaddoum, F. Gagnon, N. Kumar, and S. H. Ahmed, “An energy-driven network function virtualization for multi- domain software defined networks,” arXiv preprint arXiv:1903.09924 , 2019

    1903 arXiv

  17. [25]

    Keras: Deep learning library for theano and tensor- flow,

    F. Chollet et al. , “Keras: Deep learning library for theano and tensor- flow,” URL: https://keras. io/k , vol. 7, no. 8, 2015

    2015

  18. [26]

    Locally differentially private pro- tocols for frequency estimation,

    T. Wang, J. Blocki, N. Li, and S. Jha, “Locally differentially private pro- tocols for frequency estimation,” in26th{USENIX} Security Symposium ({USENIX} Security 17), 2017, pp. 729–745

    2017

  19. [27]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  20. [28]

    An efficient and fine-grained big data access control scheme with privacy-preserving policy,

    K. Yang, Q. Han, H. Li, K. Zheng, Z. Su, and X. Shen, “An efficient and fine-grained big data access control scheme with privacy-preserving policy,” IEEE Internet of Things Journal , vol. 4, no. 2, pp. 563–571, 2017

    2017

  21. [29]

    Privacy-preserving record linkage for big data: Current approaches and research challenges,

    D. Vatsalan, Z. Sehili, P. Christen, and E. Rahm, “Privacy-preserving record linkage for big data: Current approaches and research challenges,” in Handbook of Big Data Technologies . Springer, 2017, pp. 851–895

    2017

  22. [30]

    A random rotation perturbation approach to privacy preserving data classification,

    K. Chen and L. Liu, “A random rotation perturbation approach to privacy preserving data classification,” 2005. [Online]. Available: https://corescholar.libraries.wright.edu/knoesis/916/

    2005

  23. [31]

    Geometric data perturbation for privacy preserving outsourced data mining,

    ——, “Geometric data perturbation for privacy preserving outsourced data mining,” Knowledge and Information Systems , vol. 29, no. 3, pp. 657–695, 2011

    2011

  24. [32]

    Searchable encryption to reduce encryption degradation in adjustably encrypted databases,

    F. Kerschbaum and M. Härterich, “Searchable encryption to reduce encryption degradation in adjustably encrypted databases,” in IFIP Annual Conference on Data and Applications Security and Privacy . Springer, 2017, pp. 325–336

    2017

  25. [33]

    Privacy-aware adaptive data encryption strategy of big data in cloud computing,

    K. Gai, M. Qiu, H. Zhao, and J. Xiong, “Privacy-aware adaptive data encryption strategy of big data in cloud computing,” in Cyber Security and Cloud Computing (CSCloud), 2016 IEEE 3rd International Conference on. IEEE, 2016, pp. 273–278

    2016

  26. [34]

    Building confidential and efficient query services in the cloud with rasp data perturbation,

    H. Xu, S. Guo, and K. Chen, “Building confidential and efficient query services in the cloud with rasp data perturbation,” IEEE transactions on knowledge and data engineering , vol. 26, no. 2, pp. 322–335, 2014

    2014

  27. [35]

    Efficient data perturbation for privacy preserving and accurate data stream mining,

    M. A. P. Chamikara, P. Bertok, D. Liu, S. Camtepe, and I. Khalil, “Efficient data perturbation for privacy preserving and accurate data stream mining,” Pervasive and Mobile Computing , 2018

    2018

  28. [36]

    Designing statistical privacy for your data,

    A. Machanavajjhala and D. Kifer, “Designing statistical privacy for your data,” Communications of the ACM , vol. 58, no. 3, pp. 58–67, 2015

    2015

  29. [37]

    Efficient privacy preservation of big data for accurate data mining,

    M. A. P. Chamikara, P. Bertok, D. Liu, S. Camtepe, and I. Khalil, “Efficient privacy preservation of big data for accurate data mining,” Information Sciences, 2019

    2019

  30. [38]

    t-closeness: Privacy beyond k-anonymity and l-diversity,

    N. Li, T. Li, and S. Venkatasubramanian, “t-closeness: Privacy beyond k-anonymity and l-diversity,” in Data Engineering, 2007. ICDE 2007. IEEE 23rd International Conference on . IEEE, 2007, pp. 106–115

    2007

  31. [39]

    Information disclosure under realistic assumptions: Privacy versus optimality,

    L. Zhang, S. Jajodia, and A. Brodsky, “Information disclosure under realistic assumptions: Privacy versus optimality,” in Proceedings of IEEE INTERNET OF THINGS JOURNAL, VOL. XX, NO. XX 16 the 14th ACM conference on Computer and communications security . ACM, 2007, pp. 573–583

    2007

  32. [40]

    Composition attacks and auxiliary information in data privacy,

    S. R. Ganta, S. P. Kasiviswanathan, and A. Smith, “Composition attacks and auxiliary information in data privacy,” in Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, 2008, pp. 265–273

    2008

  33. [41]

    Can the utility of anonymized data be used for privacy breaches?

    R. C.-W. Wong, A. W.-C. Fu, K. Wang, P. S. Yu, and J. Pei, “Can the utility of anonymized data be used for privacy breaches?” ACM Transactions on Knowledge Discovery from Data (TKDD), vol. 5, no. 3, p. 16, 2011

    2011

  34. [42]

    The differential privacy frontier,

    C. Dwork, “The differential privacy frontier,” in Theory of Cryptography Conference. Springer, 2009, pp. 496–502

    2009

  35. [43]

    Differentially private data release for data mining,

    N. Mohammed, R. Chen, B. Fung, and P. S. Yu, “Differentially private data release for data mining,” in Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining . ACM, 2011, pp. 493–501

    2011

  36. [44]

    Towards practical differential privacy for sql queries,

    N. Johnson, J. P. Near, and D. Song, “Towards practical differential privacy for sql queries,” Proceedings of the VLDB Endowment , vol. 11, no. 5, pp. 526–539, 2018

    2018

  37. [45]

    Privacy integrated queries: an extensible platform for privacy-preserving data analysis,

    F. D. McSherry, “Privacy integrated queries: an extensible platform for privacy-preserving data analysis,” in Proceedings of the 2009 ACM SIGMOD International Conference on Management of data . ACM, 2009, pp. 19–30

    2009

  38. [46]

    Local, private, efficient protocols for succinct histograms,

    R. Bassily and A. Smith, “Local, private, efficient protocols for succinct histograms,” inProceedings of the forty-seventh annual ACM symposium on Theory of computing . ACM, 2015, pp. 127–135

    2015

  39. [47]

    Multi- key privacy-preserving deep learning in cloud computing,

    P. Li, J. Li, Z. Huang, T. Li, C.-Z. Gao, S.-M. Yiu, and K. Chen, “Multi- key privacy-preserving deep learning in cloud computing,” Future Gen- eration Computer Systems , vol. 74, pp. 76–85, 2017

    2017

  40. [48]

    Semi-supervised knowledge transfer for deep learning from private training data,

    N. Papernot, M. Abadi, U. Erlingsson, I. Goodfellow, and K. Talwar, “Semi-supervised knowledge transfer for deep learning from private training data,” arXiv preprint arXiv:1610.05755 , 2016

    2016 arXiv

  41. [49]

    A hybrid deep learning architecture for privacy-preserving mobile analytics,

    S. A. Osia, A. S. Shamsabadi, A. Taheri, K. Katevas, S. Sajadmanesh, H. R. Rabiee, N. D. Lane, and H. Haddadi, “A hybrid deep learning architecture for privacy-preserving mobile analytics,” arXiv preprint arXiv:1703.02952, 2017

    2017 arXiv

  42. [50]

    Scikit-learn: Machine learning in python,

    F. Pedregosa, G. Varoquaux, A. Gramfort, V . Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V . Dubourg et al. , “Scikit-learn: Machine learning in python,” Journal of machine learning research, vol. 12, no. Oct, pp. 2825–2830, 2011

    2011

  43. [51]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining . ACM, 2016, pp. 785–794

    2016

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.