Privacy-Preserving Deep Learning Based on Multiparty Secure Computation: A Survey
Abstract
Deep learning (DL) has demonstrated superior success in various of applications, such as image classification, speech recognition, and anomalous detection. The unprecedented performance gain of DL largely depends on tremendous training data, high-performance computation resources, and well-designed model structures. However, privacy concerns raise from such necessities. First, as the training data are usually distributed among multiple parties, directly exposing and collecting such large amount of data could violate the laws especially for private information, such as personal identities, medical records, and financial profiles. Second, locally deploying advantageous computation resources is costly for individual party having partial data. Third, direct release of well-trained model parameters threatens the information about training data or the intellectual property of model owners. Therefore, individual party prefers outsourcing computation (data) in a secure way to powerful cloud servers such as Microsoft Azure, and how to enable the cloud servers to perform DL algorithms without revealing data owners’ private information and model owners’ valuable parameters is emerging as an urgent task, which is termed as privacy-preserving (outsourcing) DL. In this article, we review the state-of-the-art researches in privacy-preserving DL based on multiparty secure computation with data encryption and summarize these techniques in both training phase and inference phase. Specifically,…
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Hybrid HE-SMPC frameworks -where linear layers are computed under HE and non-linear activations under SMPC -offer a promising trade-off.
“Recent work on hybrid HE-SMPC frameworks -where linear layers are computed under HE and non-linear activations under SMPC -offers a promising trade-off [184].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [184]
Pairwise masking-based secure aggregation, common in SMPC, further strains scalability for DNNs.
“Pairwise maskingbased secure aggregation, common in SMPC, further strains scalability for DNNs [184].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [184]
Hardware-software co-design, such as integrating HE operations into AI accelerators (such as TPUs) or leveraging TEEs for secure SMPC coordination, may further reduce latency.
“Hardware-software co-design, such as integrating HE operations into AI accelerators (such as TPUs) or leveraging TEEs for secure SMPC coordination, may further reduce latency [184].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [184]
Reducing garbled circuit gates via automated circuit optimization tools (e.g., TinyGarble) and parallelizing operations could enhance scalability in SMPC integration.
“Reducing garbled circuit gates via automated circuit optimization tools (e.g., TinyGarble) and parallelizing operations could enhance scalability in SMPC integration [184].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [184]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Paillier, P. (2007) · Lecture Notes in Computer Science · doi:10.1007/3-540-48910-x_16 · Cited by 7,250 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001 · see citing works
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890 · see citing works
CrypTFlow: Secure TensorFlow Inference
Kumar, N., Rathee, M., Chandran, N., Gupta, D., Rastogi, A., & Sharma, R. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00092 · Cited by 245 · see citing works
A review of privacy-preserving techniques for deep learning
Boulemtafes, A., Derhab, A., & Challal, Y. (2020) · Neurocomputing · doi:10.1016/j.neucom.2019.11.041 · Cited by 211 · see citing works
Privacy in Deep Learning: A Survey
Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H. (2020) · arXiv · doi:10.48550/arxiv.2004.12254 · Cited by 106 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Security and Privacy for 6G: A Survey on Prospective Technologies and Challenges
Nguyen, V.-L., Lin, P.-C., Cheng, B.-C., Hwang, R.-H., & Lin, Y.-D. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3108618 · Cited by 515 · see citing works
Islam, N., & Zulkernine, M. (2025) · arXiv · doi:10.48550/arxiv.2503.01089 · Cited by 1 · see citing works
“Most remote sensing images or vehicle positioning data are retrieved from widely used global navigation satellite systems (GNSS) and inertial navigation systems (INS).”
Influential
- Authors
- Zhang, Q., Xin, C., & Wu, H.
- Affiliations
- Old Dominion University (US)
- Venue
- IEEE Internet of Things Journal
- Published
- 2021-07-01
- Volume
- 8
- Issue
- 13
- Pages
- 10412-10429
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3130108574
- Cited by
- 53
- References
- 9
- Citations by year
- 2026: 4 · 2025: 25 · 2024: 13 · 2023: 3 · 2022: 5 · 2021: 3
- FWCI
- 2.12
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- Funders
- National Science Foundation (CNS-1828593, OAC-1829771, EEC-1840458, CNS-1950704)
- Office of Naval Research (N00014-20-1-2065)
- Commonwealth Cyber Initiative, an Investment in the Advancement of Cyber Research and Development, Innovation and Workforce Development
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- privacy-preserving deep learning, secure multi-party computation, data privacy, data encryption, secure inference, cloud computing
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review