A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component

Allen C.-H. Wu; Chin-Yu Sun; TingTing Hwang

REVIEW 4 major objections 6 minor 29 references

A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A deep network split in two, with its output flipped by a secret bit, hides input, output, and model without cryptography.

desk verdict A cheap split-network trick with a matching-bit output mask, but the security proof is a linear-system fiction and the privacy claim collapses. read the letter →

arxiv 1908.07701 v2 pith:3WM2NBJB submitted 2019-08-21 cs.CR cs.LG

Chin-Yu Sun , Allen C.-H. Wu , TingTing Hwang This is my paper · ORCID

classification cs.CRcs.LG

keywords deeplearningneuralnetworksprivacypreservingmodelprotectionsecuritycomplementsignalpartitioningsecureinference

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a privacy-preserving scheme for deep neural networks that claims to protect the customer's input, the predicted output, and the provider's model without using homomorphic encryption, garbled circuits, or watermarks. The provider partitions a trained network at a chosen layer $k$, gives the customer the first $k$ layers, and keeps the rest. The customer runs the local layers on the private data together with a secret random bit; the server completes the inference on the intermediate vector and sends back a result that is flipped or not flipped according to that bit. The paper argues the server cannot recover the input because the linear equations it can build have more unknowns than equations, and cannot recover the output because the complement bit is unknown. If the security argument holds, data owners can use a provider's model without exposing private data, and providers can keep most of the model secret, at far lower cost than encryption-based approaches.

What carries the argument

The central machinery is the triple of a complement signal $cs$, a partition point $k$, and the unsolvability condition $n>m$. The complement signal is a secret random bit concatenated to the input at or before layer $k$; the network is retrained on labels $l'_i = l_i \oplus cs_i$ so that the final output is the true label XOR the signal. The partition point separates the model into a published client-side prefix and a secret server-side suffix, so the server receives only the intermediate vector $d_{out}^c$ and never the raw input. The paper's proof that the input is private rests on showing the server can assemble a linear system in the input pixels whose coefficient matrix is non-square with more unknowns than equations; when the kernel count or stride makes the number of equations exceed the unknowns, the paper recommends reducing the kernel count until $N>M$ again.

What would settle it

Run a partitioned network with known client layers, capture one intermediate activation vector, and apply gradient-descent inversion that searches for an input reproducing that vector; if a recognizable approximation of the customer's input or complement signal emerges, the claimed input and output privacy are refuted for that configuration.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the innate layered computation of a DNN is enough to build a secure two-party inference scheme. A secure model $F_{[1,M]}$ is trained so that $d_{out}\oplus cs = F_{[1,M]}(d_{in}\|cs)$, where $cs\in\{0,1\}$ is a customer-chosen complement signal and $\oplus$ is XOR. The provider splits the model at layer $k$ into a client part $F^c_{[1,k]}$ and a server part $F^s_{[k+1,M]}$; the customer computes $d_{out}^c=F^c_{[1,k]}(d_{in}\|cs)$, the server computes $d_{out}\oplus cs=F^s_{[k+1,M]}(d_{out}^c)$, and the customer removes the flip. Security of the input is argued from Cramer's rule: the server's equations for the input have $n$ unknowns and $m$ equations, and when $n>m$ there is no unique solution. The output is protected because the server can only guess whether the returned label was complemented, and the model is protected because the customer never sees the server layers.

Load-bearing premise

The load-bearing premise is that a server-side adversary who knows the client-side model and receives the intermediate vector cannot recover the input, because the linear equations it can write have more unknowns than equations.

Editorial extensions

If this is right

A provider can convert an existing non-secure binary classifier into the secure form by fixing layers $1$ to $k-1$, concatenating the complement signal, and retraining the remaining layers on flipped labels.
Inference needs only one exchange: an intermediate activation vector from customer to provider and one possibly flipped label back, so communication cost is far below homomorphic-encryption or garbled-circuit approaches.
A server that cannot recover the complement signal can do no better than a random guess at the true output, giving output privacy a concrete 50-percent baseline.
The partition layer $k$ is an explicit accuracy-security tradeoff: larger $k$ improves accuracy and cuts retraining time but reveals more of the model to the customer.
The scheme extends from two-class to $n$-class outputs by replacing the flip bit with a random offset that shifts the predicted class label.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial extension: the paper's $N>M$ condition is about exact linear-system solvability; a direct testable extension is to run optimization-based activation inversion against a partitioned network and check whether approximate inputs emerge even when no unique solution exists.
Editorial extension: output privacy and input privacy are coupled through the complement signal, so any attack that recovers the signal (or the intermediate vector) would break both, not just one.
Editorial extension: the same partition-and-shift idea could be carried to regression by adding a secret scalar offset to the numeric output, although the paper develops only classification.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Punchline: the scheme is a neat engineering idea, but the paper's load-bearing claim — that it is 'secure' without cryptography — does not survive contact with its own equations. The security analysis in Section 7 treats the network as a linear system and equates an underdetermined linear system with privacy, which is not what a nonlinear network gives you.

What's genuinely new: the combination of splitting a network at layer k and training the tail to flip its output based on a secret one-bit complement signal. That specific combination is not in the cited HE/garbled-circuit/watermark work. It is also genuinely cheap: no encryption, just a bigger input and a retrained model. The experiments support the efficiency and accuracy claims — preserving a few layers of a pretrained AlexNet gives accuracy close to the baseline with lower training time. That part is fine.

The soft spot is the entire security argument. Section 7.2 models the observed intermediate d_out^c as the linear map y = Wx + b. But the actual client-side model is layers of convolutions, ReLUs, and pooling — nonlinear. Cramer's rule, and Definition 1's 'unsolvability', only say that a particular underdetermined linear system lacks a unique exact solution. They say nothing about approximate inversion by gradient descent, which the paper itself cites (Mahendran and Vedaldi) as a known technique. The provider also knows F_c, because it built it, so the adversary can run exactly that kind of inversion on d_out^c. And the complement signal c_s is one bit; trying both values costs nothing. So input privacy falls, and output privacy falls with it: the provider just flips the received bit. Section 7.5's model privacy claim is similarly hand-wavy: the data owner has part of the network, and model-extraction attacks exist.

There are smaller issues: no comparison to split learning, which is the obvious baseline; the reference list is garbled (duplicate numbering, and [26] is this paper itself). Those are minor next to the security gap but don't help.

Who is this for? Someone cataloguing split-inference tricks might find the complement-bit idea interesting, but as a privacy-preserving scheme it is not there. I would not cite it. If it came to me, I would not send it to peer review as a security paper; the central claim is invalid on its face.

Referee Report

4 major / 6 minor

Summary. The paper proposes a privacy-preserving deep learning scheme that does not rely on cryptographic components. It introduces a complement signal (a secret bit chosen by the client) to fuzz the model output, and it partitions a trained DNN into a client-side part (first k layers) and a server-side part (remaining layers). The client runs the first k layers locally and sends the intermediate representation to the server, which completes the inference and returns a fuzzed output; the client then recovers the true output using the secret complement signal. The paper claims that this scheme protects the privacy of the input, the output, and the model, and it supports the claim with a security analysis based on Cramer's rule and with experiments on AlexNet using the Dogs vs. Cats and MNIST datasets.

Significance. If the security guarantees were valid, the scheme would offer a practical and efficient alternative to homomorphic encryption and garbled circuits for privacy-preserving inference. The conceptual idea of partitioning the network and using a secret output-flip signal is intuitive, and the experimental results show reasonable accuracy and training-time trade-offs (e.g., Table 3, N=4 reaching 0.9735 accuracy at 200,000 steps). However, the security analysis is not sound: it models the neural network as a linear system and equates the absence of a unique linear solution with privacy, which is inadequate for the claimed guarantees. Because the central security claims are unsupported, the practical significance remains limited, but the problem and approach could motivate future work if a rigorous security analysis were provided.

major comments (4)

[Section 7.2, Eqs. (8)-(10)] The security argument treats the client-side computation as the linear map y = Wx + b shown in Eq. (8), but the actual client-side model F_c includes nonlinear activation functions (ReLU or sigmoid, Eq. (2)) and typically comprises multiple layers and pooling operations. The signal the server receives, d_out^c, is therefore the output of a nonlinear function, not a linear system, so the underdeterminedness condition n > m of the linearized system does not apply to the real computation. This invalidates the input-privacy proof.
[Section 7.2, Definition 1] Even if the linearization were accepted, n > m only implies that a particular linear system has no unique exact solution; it does not preclude approximate recovery or partial information leakage. The server knows the client-side model F_c (it is published in Section 5.2) and receives d_out^c, so it can apply gradient-based inversion, as demonstrated by Mahendran and Vedaldi (the paper's own reference [16]), to recover the input and the complement signal. The absence of a unique solution is therefore not a privacy guarantee, and input privacy is not established.
[Section 7.4] The output-privacy argument is entirely contingent on the server not learning the complement signal cs. Since cs is a single bit (or, in the experiments, a two-class MNIST image), the server can attempt both possible values and check which yields a plausible final output, or it can recover cs via inversion of the client-side representation. Once cs is known, the server can XOR the received d_out XOR cs to obtain the true output d_out, so the claim that the server only has a 50% chance of guessing the output is incorrect. Output privacy fails along with input privacy.
[Section 7.3] The security suggestion contains an internal error: the text says to check 'such that N > N' when it should be 'N > M', and the AlexNet example is inconsistent with the stated definitions. With N = 2187 and M = 2400, the system is overdetermined (M > N), not underdetermined, and the claim that the adversary can 'eliminate 2400 equations to 2187 equations' to obtain a square matrix is not explained. More importantly, the entire calculation rests on the flawed linear-model assumption, so the guidance for choosing kernel counts does not provide a meaningful security criterion.

minor comments (6)

[References] The reference list includes a self-citation to the same paper (Reference [26]) and also repeats the number 26 for two different entries; this is inappropriate and should be corrected.
[Section 8.1, Table 1] Table 1 lists Conv1 with 64 kernels, while Section 7.3 refers to an original kernel count of 96 in AlexNet; the values should be reconciled or the discrepancy explained.
[Section 4, Remarks] The remark states the scheme is DNN-based but not CNN-based, yet the experiments use AlexNet, which is a CNN; the text should clarify how the proposed scheme applies to convolutional layers.
[Section 7.2, Eq. (9)] The notation in Eq. (9) is ambiguous: n is described as 'the length (or the height) of the kernel' but is also used in the input-dimension context; the variables s, l, and k should be defined consistently.
[Section 5.1 and Section 8.1] The complement signal is formally defined as a single bit cs in Eq. (3), but the experimental implementation feeds an entire resized MNIST image as the complement signal; the relationship between the formal definition and the implementation should be clarified.
[Figures] Two figures are labeled 'Fig. 4' (one for the equation-leakage example and one for the difference between non-secure and secure models); the numbering should be corrected.

Circularity Check

1 steps flagged · score 6.0 of 10

Input-privacy proof reduces to a definition: 'unsolvability' is defined as absence of a unique linear solution, then the same condition is reported as security.

self definitional [Section 7.1, Definition 1; Section 7.2, Input's privacy, Eqs. (8)-(10)]
"Definition 1 (Unsolvability) Let 𝒜 be a probabilistic polynomial time adversary, 𝒜 cannot obtain the unique solution by solving the linear equations when the number of unknowns is greater than the number of equations. ... According to Definition 1, 𝒜 cannot obtain the unique 𝑥 when the number of the equation sets 𝑚 is less than the number of the unknowns 𝑛. Hence, the separating phase of the proposed scheme is secure, if 𝑛 > 𝑚."

The proof of input privacy is a direct application of the paper's own Definition 1 rather than an independent derivation. Definition 1 defines 'unsolvability' as the inability to obtain a unique solution when unknowns exceed equations; Section 7.2 then observes that the linear system has this property and concludes that the partitioning phase is 'secure'. Thus the conclusion 'the input is protected' is the definitional condition restated through Cramer's rule. No argument connects the absence of a unique exact linear solution to the real adversary task of recovering the input or complement signal from the actual client-side network, which includes ReLU/Sigmoid nonlinearities, pooling, and multi-layer composition.

full rationale

The paper's experimental comparisons are not circular: accuracy and training time are measured on real datasets rather than fitted to the claimed guarantees, and the complement/partitioning scheme is not obtained by renaming a fitted parameter as a prediction. The main circularity-burden step is the security proof itself. The paper defines 'unsolvability' as the absence of a unique linear solution and then uses that definition as the entire argument that the model provider cannot recover the input. That is a self-definitional security claim: the privacy conclusion is the assumed definitional criterion, not an independent result. The reference list also contains a self-citation to the same paper, reference [26], but it is attached only to a standard description of backpropagation and is not load-bearing for the security claim. Other weaknesses, such as the feasibility of optimization-based inversion or the one-bit complement signal being enumerable, are correctness/security flaws rather than circularity, but they reinforce that the definitional proof does not establish the claimed result.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The scheme's security rests on the adversary being unable to solve an underdetermined linear system; this is the main assumption. No genuinely new physical or mathematical entities are introduced. Two design parameters (partition layer k and first-layer kernel count) are adjusted by hand to satisfy the security condition.

free parameters (2)

partition layer k = N=1,2,3,4 in experiments
The model provider chooses k; the claimed security condition n > m depends on it, and it controls the accuracy/leakage tradeoff (Section 5.3 Remarks 2).
kernel count in first convolutional layer = 64 (AlexNet default 96)
Adjusted in Eq. (10) to make M < N and restore the claimed security condition; no accuracy comparison for this change is provided, and the experimental config already uses 64.

assumptions (4)

standard math Cramer's rule for square matrices
Used as Theorem 1 to define unsolvability in Definition 1.
domain assumption An underdetermined linear system implies input privacy
Section 7.2 asserts the adversary cannot obtain a unique input when n > m; non-uniqueness is not equivalent to privacy against realistic priors and optimization attacks.
ad hoc to paper Neural network layers can be treated as linear equations in the security analysis
Equation (8) omits activation functions; ReLU and sigmoid make the actual mapping nonlinear.
domain assumption The adversary only attempts linear equation solving
Section 7.2 models the adversary exclusively through Cramer's rule and does not consider gradient-based inversion, model extraction, or membership inference.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component." pith.science (2026). https://pith.science/paper/3WM2NBJB

@misc{pith2026190807701,
  author       = {Pith},
  title        = {Pith review of: A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3WM2NBJB}},
  note         = {Machine review of arXiv:1908.07701}
}

read the original abstract

Recently, deep learning, which uses Deep Neural Networks (DNN), plays an important role in many fields. A secure neural network model with a secure training/inference scheme is indispensable to many applications. To accomplish such a task usually needs one of the entities (the customer or the service provider) to provide private information (customer's data or the model) to the other. Without a secure scheme and the mutual trust between the service providers and their customers, it will be an impossible mission. In this paper, we propose a novel privacy-preserving deep learning model and a secure training/inference scheme to protect the input, the output, and the model in the application of the neural network. We utilize the innate properties of a deep neural network to design a secure mechanism without using any complicated cryptography component. The security analysis shows our proposed scheme is secure and the experimental results also demonstrate that our method is very efficient and suitable for real applications.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 24 canonical work pages

[26]

A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component

Sun, C.Y., Wu, A.C.H., Hwang, T., 2019. A novel privacypreserving deep learning scheme without acryptography component. CoRR abs/1908.07701. URL: http://arxiv.org/abs/1908.07701, arXiv:1908.07701 31

work page Pith review arXiv 2019
[16]

Understanding deep image representations by inverting them, in: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

Mahendran, A., Vedaldi, A., 2015. Understanding deep image representations by inverting them, in: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

work page 2015
[1]

Machine learning in vlsi computer -aided design URL: https://www.springer.com/us/book/9783030046651, doi:10.1007/978-3-030-04666-8

, 2019. Machine learning in vlsi computer -aided design URL: https://www.springer.com/us/book/9783030046651, doi:10.1007/978-3-030-04666-8

work page arXiv 2019
[2]

A logic of authentication

Abadi, M., Tuttle, M.R., 1990. A logic of authentication. ACM Transactions on Computer Systems

work page 1990
[3]

QUOTIENT: Two-Party Secure Neural Network Training and Prediction

Agrawal, N., Shamsabadi, A.S., Kusner, M.J., Gascón, A., 2019. QUOTIENT: two-party secure neural network training and prediction.CoRR abs/1907.03372. URL: http://arxiv.org/abs/1907.03372, arXiv:1907.03372

work page Pith review arXiv 2019
[4]

Cryptology ePrint Archive,Report 2019/338

Ball, M., Carmer, B., Malkin, T., Rosulek, M., Schimanski, N., 2019.Garbled neural networks are practical. Cryptology ePrint Archive,Report 2019/338. https://eprint.iacr.org/2019/338

work page 2019
[5]

A privacy -preserving protocol for neural-network-based computation, in: Proceedings of the8th Workshop on Multimedia and Security, ACM, New York, NY,USA

Barni, M., Orlandi, C., Piva, A., 2006. A privacy -preserving protocol for neural-network-based computation, in: Proceedings of the8th Workshop on Multimedia and Security, ACM, New York, NY,USA. pp. 146–151. URL: http://doi.acm.org/10.1145/ 1161366.1161393, doi:10.1145/1161366.1161393

work page arXiv 2006
[6]

Bellare, M., Rogaway, P., 1993. Random oracles are practical: A paradigm for designing efficient protocols, in: CCS ’93, Proceedings of the 1st ACM Conference on Computer and Co mmunications Security, Fairfax, Virginia, USA, November 3 -5, 1993., pp. 62–73. URL: https://doi.org/10.1145/168588.168596, doi:10.1145/168588.168596

work page arXiv 1993

Show all 29 references

[7]

Numerical Analysis

Burden, R.L., Faires, J.D., 1989. Numerical Analysis. The Prindle, Weber and Schmidt Series in Mathematics. fourth ed., PWS- Kent Publishing Company, Boston

1989
[8]

Privacy-preserving classification on deep neural network

Chabanne, H., de Wargny, A., Milgram, J., Morel, C., Prouff, E., 2017. Privacy-preserving classification on deep neural network. 30 Cryptology ePrint Archive, Report 2017/035. https://eprint.iacr.org/2017/035

2017
[9]

Automatic detection of invasive ductal carcinoma in whole slide images with convolutional neural networks

Cruz-Roa, A., Basavanhally, A., González, F., Gilmore, H., Feldman, M., Ganesan, S., Shih, N., Tomaszewski, J., Madabhushi, A., 2014. Automatic detection of invasive ductal carcinoma in whole slide images with convolutional neural networks. Progress in Biomedical Optics and Im...

2014 doi
[10]

Dowlin, N., Gilad-Bachrach, R., Laine, K., Lauter, K., Naehrig, M., Wernsing, J., 2016. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy, in: Proceedings of the 33rd International Conference on International Conference on Machine Learnin...

2016
[11]

A Fully Homomorphic Encryption Scheme

Gentry, C., 2009. A Fully Homomorphic Encryption Scheme. Ph.D. thesis. Stanford, CA, USA. AAI3382729

2009
[12]

Kaggle, 2013. Dogs vs. cats. URL: https://www.kaggle.com/c/dogs-vs-cats/

2013
[13]

Cell 172, 1122–1131

Kermany, D.S., Goldbaum, M., Cai, W., Valentim, C.C., Liang, H.,Baxter, S.L., McKeown, A., Yang, G., Wu, X., Yan, F., et al., 2018.Identifying medical diagnoses and treatable diseases by image-based deep learning. Cell 172, 1122–1131

2018
[14]

MNIST handwritten digit database URL: http://yann.lecun.com/exdb/mnist/

LeCun, Y., Cortes, C., 2010. MNIST handwritten digit database URL: http://yann.lecun.com/exdb/mnist/

2010
[15]

Oblivious neural network predictions via minionn transformations, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ACM, New York, NY, USA

Liu, J., Juuti, M., Lu, Y., Asokan, N., 2017. Oblivious neural network predictions via minionn transformations, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ACM, New York, NY, USA. pp. 619–631. URL: http://doi.acm.org/10.1145/31339...

2017
[17]

Aby 3: A mixed protocol framework for machine learning, pp

Mohassel, P., Rindal, P., 2018. Aby 3: A mixed protocol framework for machine learning, pp. 35–52. doi:10.1145/3243734. 3243760

2018 doi
[18]

Secureml: A system for s calable privacy-preserving machine learning, in: 2017 IEEE Symposium on Security and Privacy (SP), pp

Mohassel, P., Zhang, Y., 2017. Secureml: A system for s calable privacy-preserving machine learning, in: 2017 IEEE Symposium on Security and Privacy (SP), pp. 19–38

2017
[19]

Computationally secure oblivious transfer

Naor, M., Pinkas, B., 2005. Computationally secure oblivious transfer. Journal of Cryptology 18, 1 –35. URL: https://doi.org/10.1007/s00145-004-0102-6, doi:10.1007/s00145-004-0102-6

2005 doi
[20]

Oblivious neural network computing via homomorphic encryption

Orlandi, C., Piva, A., Barni, M., 2007. Oblivious neural network computing via homomorphic encryption. EURASIP Journal on Information Security 2007, 037343. URL: https://doi.org/10.1155/2007/37343, doi:10.1155/2007/37343

2007 doi
[21]

Enhancing privacy in remote data classification, in: Jajodia, S., Samarati,P., Cimato, S

Piva, A., Orlandi, C., Caini, M., Bianchi, T., Barni, M., 2008. Enhancing privacy in remote data classification, in: Jajodia, S., Samarati,P., Cimato, S. (Eds.), Proceedings of The Ifip Tc 11 23rd International Information Security Conference, Springer US, Boston, MA. pp. 33–46

2008
[22]

Deepsecure: Scalable provably-secure deep learning

Rouhani, B.D., Riazi, M.S., Koushanfar, F., 2017. Deepsecure: Scalable provably-secure deep learning. CoRR abs/1705.08963. URL: http://arxiv.org/abs/1705.08963,arXiv:1705.08963

2017 arXiv
[23]

Tapas: Tricks to accelerate (encrypted) prediction as a service

Sanyal, A., Kusner, M., Gascón, A., Kanade, V., 2018. Tapas: Tricks to accelerate (encrypted) prediction as a service

2018
[24]

Deep learning in neural networks: An overview doi:10.1016/j.neunet.2014.09.003,arXiv:arXiv:1404.7828

Schmidhuber, J., 2014. Deep learning in neural networks: An overview doi:10.1016/j.neunet.2014.09.003,arXiv:arXiv:1404.7828

2014 arXiv
[25]

Towards reverse-engineering black-box neural networks

Seong Joon Oh, Max Augustin, B.S., Fritz, M., 2018. Towards reverse-engineering black-box neural networks. CoRR abs/1711.01768. URL: http://arxiv.org/abs/1711.01768, arXiv:1711.01768

2018 arXiv
[27]

Stealing machine learning models via prediction apis, in: 25th USENIX Security Symposium (USENIX Security 16), USENIX Association, Austin, TX

Tramèr, F., Zhang, F., Juels, A., Reiter, M.K., Ristenpart, T., 2016. Stealing machine learning models via prediction apis, in: 25th USENIX Security Symposium (USENIX Security 16), USENIX Association, Austin, TX. pp. 601–618. URL: https: //www.usenix.org/conference/usenixsecur...

2016
[28]

Stealing hyperparameters in machine learning

Wang, B., Gong, N.Z., 2018. Stealing hyperparameters in machine learning. CoRR abs/1802.05351. URL: http://arxiv.org/ abs/1802.05351, arXiv:1802.05351

2018 arXiv
[29]

How to generate and exchange secrets, in: 27th Annual Symposium on Foundations of Computer Science (sfcs 1986), pp

Yao, A.C., 1986. How to generate and exchange secrets, in: 27th Annual Symposium on Foundations of Computer Science (sfcs 1986), pp. 162–167. doi:10.1109/SFCS.1986.25

1986 doi

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [26]

A Novel Privacy-Preserving Deep Learning Scheme without Using Cryptography Component

Sun, C.Y., Wu, A.C.H., Hwang, T., 2019. A novel privacypreserving deep learning scheme without acryptography component. CoRR abs/1908.07701. URL: http://arxiv.org/abs/1908.07701, arXiv:1908.07701 31

work page Pith review arXiv 2019

[2] [16]

Understanding deep image representations by inverting them, in: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

Mahendran, A., Vedaldi, A., 2015. Understanding deep image representations by inverting them, in: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

work page 2015

[3] [1]

Machine learning in vlsi computer -aided design URL: https://www.springer.com/us/book/9783030046651, doi:10.1007/978-3-030-04666-8

, 2019. Machine learning in vlsi computer -aided design URL: https://www.springer.com/us/book/9783030046651, doi:10.1007/978-3-030-04666-8

work page arXiv 2019

[4] [2]

A logic of authentication

Abadi, M., Tuttle, M.R., 1990. A logic of authentication. ACM Transactions on Computer Systems

work page 1990

[5] [3]

QUOTIENT: Two-Party Secure Neural Network Training and Prediction

Agrawal, N., Shamsabadi, A.S., Kusner, M.J., Gascón, A., 2019. QUOTIENT: two-party secure neural network training and prediction.CoRR abs/1907.03372. URL: http://arxiv.org/abs/1907.03372, arXiv:1907.03372

work page Pith review arXiv 2019

[6] [4]

Cryptology ePrint Archive,Report 2019/338

Ball, M., Carmer, B., Malkin, T., Rosulek, M., Schimanski, N., 2019.Garbled neural networks are practical. Cryptology ePrint Archive,Report 2019/338. https://eprint.iacr.org/2019/338

work page 2019

[7] [5]

A privacy -preserving protocol for neural-network-based computation, in: Proceedings of the8th Workshop on Multimedia and Security, ACM, New York, NY,USA

Barni, M., Orlandi, C., Piva, A., 2006. A privacy -preserving protocol for neural-network-based computation, in: Proceedings of the8th Workshop on Multimedia and Security, ACM, New York, NY,USA. pp. 146–151. URL: http://doi.acm.org/10.1145/ 1161366.1161393, doi:10.1145/1161366.1161393

work page arXiv 2006

[8] [6]

Bellare, M., Rogaway, P., 1993. Random oracles are practical: A paradigm for designing efficient protocols, in: CCS ’93, Proceedings of the 1st ACM Conference on Computer and Co mmunications Security, Fairfax, Virginia, USA, November 3 -5, 1993., pp. 62–73. URL: https://doi.org/10.1145/168588.168596, doi:10.1145/168588.168596

work page arXiv 1993