Privacy-preserving Deep Learning Research Articles

Privacy-preserving inference resistant to model extraction attacks

Privacy-Preserving Deep Learning (PPDL) has been successfully applied in the inference phase to preserve the privacy of input data. However, PPDL models are vulnerable to model extraction attacks, in which an adversary attempts to steal the trained model itself. In this paper, we propose a new defense method against model extraction attacks that is specifically designed for PPDL based on secure multi-party computations and homomorphic encryption. The proposed method confounds inference queries for out-of-distribution data by using a fake network with the target network while optimizing computational efficiency for PPDL environments. Furthermore, we introduce Wasserstein regularization to ensure that the fake network’s output distribution is indistinguishable from the target network, thwarting adversaries’ attempts to discern any discrepancies within the PPDL framework. The experimental results demonstrate that our defense method attains a good accuracy-security trade-off and is effective against a wide range of attacks, including adaptive attacks and transfer attacks. Our work contributes to the field of PPDL by providing an extended perspective to improve the algorithm’s security and reliability beyond privacy.

Developing a privacy-preserving deep learning model for glaucoma detection: a multicentre study with federated learning

BackgroundDeep learning (DL) is promising to detect glaucoma. However, patients’ privacy and data security are major concerns when pooling all data for model development. We developed a privacy-preserving DL model...

PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption

In the past decade, we have witnessed an exponential growth of deep learning models, platforms, and applications. While existing DL applications and Machine Learning as a service (MLaaS) frameworks assume fully trusted models, the need for privacy-preserving DNN evaluation arises. In a secure multi-party computation scenario, both the model and the data are considered proprietary, i.e., the model owner does not want to reveal the highly valuable DL model to the user, while the user does not wish to disclose their private data samples either. Conventional privacy-preserving deep learning solutions ask the users to send encrypted samples to the model owners, who must handle the heavy lifting of ciphertext-domain computation with homomorphic encryption. In this paper, we present a novel solution, namely, PrivDNN, which (1) offloads the computation to the user side by sharing an encrypted deep learning model with them, (2) significantly improves the efficiency of DNN evaluation using partial DNN encryption, (3) ensures model accuracy and model privacy using a core neuron selection and encryption scheme. Experimental results show that PrivDNN reduces privacy-preserving DNN inference time and memory requirement by up to 97% while maintaining model performance and privacy. Codes can be found at https://github.com/LiangqinRen/PrivDNN

Privacy-preserving deep learning approaches for effective utilization of wearable health data

Wearable technology can significantly impact human existence by allowing for innovative perspectives on the outside world, such as through the use of augmented reality (AR) programs. Electronic gadgets that are worn as clothing, gadgets, or even incorporated into our bodies are called wearable gadgets. While there are many prospective advantages to smartwatches, their widespread and continuous use raises several privacy problems as well as complex data protection hurdles. Among the newer areas of healthcare informatics involves cognitive computation, which uses biological as well as physical information to autonomously track an individual's emotional status in mobility settings. While effective computation technologies hold great promise for enhancing everyday life, privacy problems and challenges must be addressed before analyzing physical information. Federated knowledge is a viable option for creating high-performing algorithms while protecting people's confidentiality. We used federated training to analyze cardiac activity information that was gathered from smart wristband tracking of anxiety levels during various situations. By protecting the confidentiality of information, we were able to accomplish promising outcomes when implementing federated training in Internet of Things-based wearable physiological tracking devices.

Human-Unrecognizable Differential Private Noised Image Generation Method.

Differential privacy has emerged as a practical technique for privacy-preserving deep learning. However, recent studies on privacy attacks have demonstrated vulnerabilities in the existing differential privacy implementations for deep models. While encryption-based methods offer robust security, their computational overheads are often prohibitive. To address these challenges, we propose a novel differential privacy-based image generation method. Our approach employs two distinct noise types: one makes the image unrecognizable to humans, preserving privacy during transmission, while the other maintains features essential for machine learning analysis. This allows the deep learning service to provide accurate results, without compromising data privacy. We demonstrate the feasibility of our method on the CIFAR100 dataset, which offers a realistic complexity for evaluation.

A privacy-preserving deep learning framework for highly authenticated blockchain secure storage system

A privacy-preserving deep learning framework for highly authenticated blockchain secure storage system

A comprehensive survey and taxonomy on privacy-preserving deep learning

Deep learning (DL) has been shown to be very effective for many application domains of machine learning (ML), including image classification, voice recognition, natural language processing, and bioinformatics. The success of DL techniques is directly related to the availability of large amounts of training data. However, in many cases, the data are sensitive to the users and should be protected to preserve the privacy. Privacy-preserving deep learning (PPDL) has thus become a very active research field to ensure the training process and use of DL models are productive without exposing or leaking information about the data.This paper aims to provide a comprehensive survey of PPDL. We concentrate on the risks that affect data privacy in DL and conduct a detailed investigation into the models that ensure privacy. Finally, we propose a set of evaluation criteria, detailing the advantages and disadvantages of the solutions. Based on the analyzed strengths and weaknesses, the paper has highlighted some important research problems and application cases that have not been studied and these point to certain open research directions.

Privacy-Preserving Deep Learning Framework Based on Restricted Boltzmann Machines and Instance Reduction Algorithms

The combination of collaborative deep learning and Cyber-Physical Systems (CPSs) has the potential to improve decision-making, adaptability, and efficiency in dynamic and distributed environments. However, it brings privacy, communication, and resource restrictions concerns that must be properly addressed for successful implementation in real-world CPS systems. Various privacy-preserving techniques have been proposed, but they often add complexity and decrease accuracy and utility. In this paper, we propose a privacy-preserving deep learning framework that combines Instance Reduction Techniques (IR) and the Restricted Boltzmann Machine (RBM) to preserve privacy while overcoming the limitations of other frameworks. The RBM encodes training data to retain relevant features, and IR selects the relevant encoded instances to send to the server for training. Privacy is preserved because only a small subset of the training data is sent to the server. Moreover, it is sent after encoding it using RBM. Experiments show that our framework preserves privacy with little loss of accuracy and a substantial reduction in training time. For example, using our framework, a CNN model for the MNIST dataset achieves 96% accuracy compared to 99% in a standard collaborative framework (with no privacy measures taken), with training time reduced from 133.259 s to 99.391 s. Our MLP model for MNIST achieves 97% accuracy compared to 98% in the standard collaborative framework, with training time reduced from 118.146 s to 87.873 s. Compared to other studies, our method is a simple approach that protects privacy, maintains the utility of deep learning models, and reduces training time and communication costs.

Survey: Homomorphic Encryption-based Deep Learning that Preserves Privacy

When deep learning methods are effective, the volume of information accessible for training is expanding quickly, with large-scale user data collection in businesses taking the lead. Due to the sensitive nature of user data and the way. Data collection creates privacy concerns because of the potential for this material (images and audio recordings) to be preserved forever. The concepts of privacy and secrecy pertain to the avoidance of sharing this data, and a higher volume of data is required for deep learning to be achieved. When data must be accessed for training, machine-learning algorithms face certain difficulties. Several privacy-preserving deep learning solutions, such as multi-lateral computation secrecy and symmetric encryption within neural networks, have been developed to address these concerns

Privacy-preserving deep learning on big data in cloud

In the analysis of big data, deep learning is a crucial technique. Big data analysis tasks are typically carried out on the cloud since it offers strong computer capabilities and storage areas. Nevertheless, there is a contradiction between the open nature of the cloud and the demand that data owners maintain their privacy. To use cloud resources for privacy-preserving data training, a viable method must be found. A privacy-preserving deep learning model (PPDLM) is suggested in this research to address this preserving issue. To preserve data privacy, we first encrypted the data using homomorphic encryption (HE) approach. Moreover, the deep learning algorithm's activation function—the sigmoid function—uses the least-squares method to process nonaddition and non-multiplication operations that are not allowed by homomorphic. Finally, experimental results show that PPDLM has a significant effect on the protection of data privacy information. Compared with Non-Privacy Preserving Deep Learning Model (NPPDLM), PPDLM has higher computational efficiency.

Membership inference attack on differentially private block coordinate descent.

The extraordinary success of deep learning is made possible due to the availability of crowd-sourced large-scale training datasets. Mostly, these datasets contain personal and confidential information, thus, have great potential of being misused, raising privacy concerns. Consequently, privacy-preserving deep learning has become a primary research interest nowadays. One of the prominent approaches adopted to prevent the leakage of sensitive information about the training data is by implementing differential privacy during training for their differentially private training, which aims to preserve the privacy of deep learning models. Though these models are claimed to be a safeguard against privacy attacks targeting sensitive information, however, least amount of work is found in the literature to practically evaluate their capability by performing a sophisticated attack model on them. Recently, DP-BCD is proposed as an alternative to state-of-the-art DP-SGD, to preserve the privacy of deep-learning models, having low privacy cost and fast convergence speed with highly accurate prediction results. To check its practical capability, in this article, we analytically evaluate the impact of a sophisticated privacy attack called the membership inference attack against it in both black box as well as white box settings. More precisely, we inspect how much information can be inferred from a differentially private deep model's training data. We evaluate our experiments on benchmark datasets using AUC, attacker advantage, precision, recall, and F1-score performance metrics. The experimental results exhibit that DP-BCD keeps its promise to preserve privacy against strong adversaries while providing acceptable model utility compared to state-of-the-art techniques.

Privacy-preserving multi-party deep learning based on homomorphic proxy re-encryption

Deep learning is an important branch of artificial intelligence. However, the first task of deep learning is to collect data, which will seriously threaten user data privacy. The existing dual server privacy-preserving deep learning schemes operate under the assumption that two semi-honest servers will not collude, but this security assumption may be too robust. This paper proposes a privacy-preserving multiparty deep learning scheme based on a homomorphic proxy re-encryption scheme, which can resist collusion between the semi-honest servers. Introducing a fog node with high response and low latency characteristics as a proxy and leveraging a one-way homomorphic proxy re-encryption scheme to convert the user-end ciphertext to server-end ciphertext reduces the possibility of privacy leakage due to cooperation between two servers or participants and servers. To avoid a rise in the rounds of interaction caused by the increase in the number of participants, a multi-party random numbers aggregation method is proposed based on verifiable secret sharing. Ensuring the sensitive data remains undisclosed while enhancing the global model’s precision. Theoretical analysis and experimental evaluation have both demonstrated that this privacy-preserving deep learning scheme is equipped to handle multiple keys, resist collusion attacks, and achieve higher accuracy.

Privacy-preserving deep learning in medical informatics: applications, challenges, and solutions

Privacy-preserving deep learning in medical informatics: applications, challenges, and solutions

Towards realistic privacy-preserving deep learning over encrypted medical data.

Cardiovascular disease supposes a substantial fraction of healthcare systems. The invisible nature of these pathologies demands solutions that enable remote monitoring and tracking. Deep Learning (DL) has arisen as a solution in many fields, and in healthcare, multiple successful applications exist for image enhancement and health outside hospitals. However, the computational requirements and the need for large-scale datasets limit DL. Thus, we often offload computation onto server infrastructure, and various Machine-Learning-as-a-Service (MLaaS) platforms emerged from this need. These enable the conduction of heavy computations in a cloud infrastructure, usually equipped with high-performance computing servers. Unfortunately, the technical barriers persist in healthcare ecosystems since sending sensitive data (e.g., medical records or personally identifiable information) to third-party servers involves privacy and security concerns with legal and ethical implications. In the scope of Deep Learning for Healthcare to improve cardiovascular health, Homomorphic Encryption (HE) is a promising tool to enable secure, private, and legal health outside hospitals. Homomorphic Encryption allows for privacy-preserving computations over encrypted data, thus preserving the privacy of the processed information. Efficient HE requires structural optimizations to perform the complex computation of the internal layers. One such optimization is Packed Homomorphic Encryption (PHE), which encodes multiple elements on a single ciphertext, allowing for efficient Single Instruction over Multiple Data (SIMD) operations. However, using PHE in DL circuits is not straightforward, and it demands new algorithms and data encoding, which existing literature has not adequately addressed. To fill this gap, in this work, we elaborate on novel algorithms to adapt the linear algebra operations of DL layers to PHE. Concretely, we focus on Convolutional Neural Networks. We provide detailed descriptions and insights into the different algorithms and efficient inter-layer data format conversion mechanisms. We formally analyze the complexity of the algorithms in terms of performance metrics and provide guidelines and recommendations for adapting architectures that deal with private data. Furthermore, we confirm the theoretical analysis with practical experimentation. Among other conclusions, we prove that our new algorithms speed up the processing of convolutional layers compared to the existing proposals.

Differentially private block coordinate descent

Deep learning models have revolutionized AI tasks by producing accurate predictions. These models′ success largely depends on precise training using large-scale datasets, mostly crowdsourced from the target population. The training datasets may contain sensitive personal information, and the model parameters can encode this information on internal wirings of hidden layers, thus bearing the risk of a privacy breach. The modern trend of sharing trained models has grown the privacy breach risk manifold. The performance of existing privacy-preserving deep learning models trying to address this issue is unsatisfactory. Consequently, only a marginal proportion of these privacy-preserved models have been adopted in the industry. Therefore, we developed the first differentially private version of the block coordinate descent (BCD) algorithm. Our proposed mechanism considerably cuts the privacy cost by injecting an appropriate amount of noise in block variables. It achieves high accuracy comparable to its non-private equivalents. It improves the convergence speed and provides a provable privacy guarantee by performing privacy accounting using advanced composition and moments accountant methods. We empirically evaluate the robustness of our proposed mechanism on benchmark datasets. The results demonstrate the competitive performance in terms of both privacy cost reduction and speedy convergence against the state-of-the-art differential privacy-based mechanisms.

A Novel Chaos-Based Privacy-Preserving Deep Learning Model for Cancer Diagnosis

Early cancer identification is regarded as a challenging problem in cancer prevention for the healthcare community. In addition, ensuring privacy-preserving healthcare data becomes more difficult with the growing demand for sharing these data. This study proposes a novel privacy-preserving non-invasive cancer detection method using Deep Learning (DL). Initially, the clinical data is collected over the Internet via wireless channels for diagnostic purposes. It is paramount to secure personal clinical data against eavesdropping by unauthorized users that may exploit it for personalized interests. Therefore, the collected data is encrypted before transmission over the channel to prevent data theft. Various security measures, including correlation, entropy, contrast, structural content, and energy, are used to assess the proposed encryption method's efficiency. In this paper, we proposed using the Convolutional Neural Network (CNN)-based model and Magnetic Resonance Imaging (MRI) with different techniques, including transfer learning, fine-tuning, and K-fold analysis cancer detection. Extensive experiments are carried out to evaluate the performance of the proposed DL techniques with regard to traditional machine learning approaches such as Decision Tree (DT), Naive Bayes (NB), Random Forest (RF), and Support Vector Machine (SVM). Results show that the CNN-based model has achieved an accuracy of 98.9% and outperforms conventional ML algorithms. Further experiments demonstrate the efficiency of both encryption schemes, achieving entropy, contrast, and energy of 7.9999, 10.9687, and 0.0151, respectively.

IIB-CPE: Inter and Intra Block Processing-Based Compressible Perceptual Encryption Method for Privacy-Preserving Deep Learning.

Perceptual encryption (PE) of images protects visual information while retaining the intrinsic properties necessary to enable computation in the encryption domain. Block–based PE produces JPEG-compliant images with almost the same compression savings as that of the plain images. The methods represent an input color image as a pseudo grayscale image to benefit from a smaller block size. However, such representation degrades image quality and compression savings, and removes color information, which limits their applications. To solve these limitations, we proposed inter and intra block processing for compressible PE methods (IIB–CPE). The method represents an input as a color image and performs block-level inter processing and sub-block-level intra processing on it. The intra block processing results in an inside–out geometric transformation that disrupts the symmetry of an entire block thus achieves visual encryption of local details while preserving the global contents of an image. The intra block-level processing allows the use of a smaller block size, which improves encryption efficiency without compromising compression performance. Our analyses showed that IIB–CPE offers 15% bitrate savings with better image quality than the existing PE methods. In addition, we extended the scope of applications of the proposed IIB–CPE to the privacy-preserving deep learning (PPDL) domain.

Privacy-preserving deep learning for electricity consumer characteristics identification

Deep learning models trained from smart meter data have proven to be effective in predicting socio-demographic characteristics of electricity consumers, which can help retailers provide personalized service to electricity customers. Traditionally, deep learning models are trained in a centralized manner to gather large amounts of data to ensure effectiveness and efficiency. However, gathering smart meter data in plaintext may raise privacy concerns since the data is privately owned by different retailers. This indicates an imminent need for privacy-preserving deep learning. This paper proposes several secure multi-party computation (MPC) protocols that enable deep learning training and inference for electricity consumer characteristics identification while keeping the retailer’s raw data confidential. In our protocols, the retailers secret-share their raw data to three computational servers, which implement deep learning training and inference through lightweight replicated secret sharing techniques. We implement and benchmark multiple neural network models and optimization strategies. Comprehensive experiments are conducted on the Irish Commission for Energy Regulation (CER) dataset to verify that our MPC-based protocols have comparable performance.

A Hybrid Privacy-Preserving Deep Learning Approach for Object Classification in Very High-Resolution Satellite Images

Deep learning (DL) has shown outstanding performances in many fields, including remote sensing (RS). DL is turning into an essential tool for the RS research community. Recently, many cloud platforms have been developed to provide access to large-scale computing capacity, consequently permitting the usage of DL architectures as a service. However, this opened the door to new challenges associated with the privacy and security of data. The RS data used to train the DL algorithms have several privacy requirements. Some of them need a high level of confidentiality, such as satellite images related to public security with high spatial resolutions. Moreover, satellite images are usually protected by copyright, and the owner may strictly refuse to share them. Therefore, privacy-preserving deep learning (PPDL) techniques are a possible solution to this problem. PPDL enables training DL on encrypted data without revealing the original plaintext. This study proposes a hybrid PPDL approach for object classification for very-high-resolution satellite images. The proposed encryption scheme combines Paillier homomorphic encryption (PHE) and somewhat homomorphic encryption (SHE). This combination aims to enhance the encryption of satellite images while ensuring a good runtime and high object classification accuracy. The method proposed to encrypt images is maintained through the public keys of PHE and SHE. Experiments were conducted on real-world high-resolution satellite images acquired using the SPOT6 and SPOT7 satellites. Four different CNN architectures were considered, namely ResNet50, InceptionV3, DenseNet169, and MobileNetV2. The results showed that the loss in classification accuracy after applying the proposed encryption algorithm ranges from 2% to 3.5%, with the best validation accuracy on the encrypted dataset reaching 92%.

A differential privacy‐preserving deep learning caching framework for heterogeneous communication network systems

Caching and artificial intelligence technology are means to improve the content transmission rate and solve the delay problem in heterogeneous communication networks, which provide an important technical basis for telemedicine diagnosis, disease monitoring, and other medical and healthcare fields. However, since the data used for caching recommendations and mining usually includes a lot of sensitive information, collecting these data will inevitably cause users to worry about personal privacy security. This paper proposes a differential privacy-preserving deep learning caching framework (DP-DLCF) for heterogeneous communication networks. First, the multivariate randomized response mechanism is used to perturb the mobile client's sensitive information while introducing the least square method to balance the data privacy and utility, and realize the adaptive allocation of the privacy budget. Then use selective integrated learning methods to further improve the local cache accuracy of the neural network training model. Therefore, the framework not only improves the prediction accuracy of the cache network but also solves the problem of privacy leakage in data sharing. Finally, four simulation examples verify the DP-DLCF framework's effectiveness.