The DOI matches its DataCite record; 147 of the 152 references it cites were found in a registry or an index.
Privacy in Deep Learning: A Survey
Open accessAbstract
The ever-growing advances of deep learning in many areas including vision, recommendation systems, natural language processing, etc., have led to the adoption of Deep Neural Networks (DNNs) in production systems. The availability of large datasets and high computational power are the main contributors to these advances. The datasets are usually crowdsourced and may contain sensitive information. This poses serious privacy concerns as this data can be misused or leaked through various vulnerabilities. Even if the cloud provider and the communication link is trusted, there are still threats of inference attacks where an attacker could speculate properties of the data used for training, or find the underlying model architecture and parameters. In this survey, we review the privacy concerns brought by deep learning, and the mitigating techniques introduced to tackle these issues. We also show that there is a gap in the literature regarding test-time inference privacy, and propose possible future research directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“To circumvent these privacy risks, advanced privacy-preserving ML (PPML) techniques such as federated learning (FL), homomorphic encryption (HE), secure multi-party computations (SMPC), and differential privacy (DP) are being thoroughly studied to protect user data and model integrity in the ML pipeline [16, 97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“During the training phase, attacks such as data poisoning, property inference, or Byzantine attacks, and in the inference phase, membership inference, model inversion, or model extraction attacks can undermine the privacy and integrity of both the model and its underlying data [97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“During the training phase, attacks such as data poisoning, property inference, or Byzantine attacks, and in the inference phase, membership inference, model inversion, or model extraction attacks can undermine the privacy and integrity of both the model and its underlying data [97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“In the ML pipeline of an IoV application, privacy risks can arise during the training and inference phases to compromise the confidentiality and integrity of the system [16, 97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“data poisoning attacks involve adversaries manipulating training data to compromise model integrity or insert backdoors, a significant risk in IoV where data quality is crucial for safety”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“For instance, studies [116], [161], [97], [16] reviewed privacy issues in deep learning (DL), including attacks, privacy-preserving techniques and their challenges.”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
k-ANONYMITY: A MODEL FOR PROTECTING PRIVACY
SWEENEY, L. (2002) · International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems · doi:10.1142/s0218488502001648 · Cited by 8,571
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Self-citationCalibrating Noise to Sensitivity in Private Data Analysis
Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272
Fully homomorphic encryption using ideal lattices
Gentry, C. (2009) · Proceedings of the forty-first annual ACM symposium on Theory of computing · doi:10.1145/1536414.1536440 · Cited by 6,806
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856
L -diversity: Privacy beyond k -anonymity
Machanavajjhala, A., Kifer, D., Gehrke, J., & Venkitasubramaniam, M. (2007) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1217299.1217302 · Cited by 3,617
t-Closeness: Privacy Beyond k-Anonymity and l-Diversity
Li, N., Li, T., & Venkatasubramanian, S. (2007) · 2007 IEEE 23rd International Conference on Data Engineering · doi:10.1109/icde.2007.367856 · Cited by 3,451
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Flagged first, then by citations
5 of the 152 references couldn’t be matched to a known paper.
Research works printed but not linked: 17
- [29][29] S. A. Ossia, A. Taheri, A. S. Shamsabadi, K. Katevas, H. Haddadi, and H. R. Rabiee, 'Deep private-feature extraction,' IEEE Transactions on Knowledge and Data Engineering , vol. 32, pp. 54-66, 2018. -
- [31][31] F. Mireshghallah, M. Taram, A. Jalali, D. Tullsen, and H. Esmaeilzadeh, 'Shredder: Learning noise distributions to protect inference privacy,' in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , ASPLOS '20, (New York, NY, USA), Association for Computing Machinery, March 2020. -
- [45][45] Z. Yang, E.-C. Chang, and Z. Liang, 'Adversarial neural network inversion via auxiliary knowledge alignment,' ArXiv , vol. abs/1902.08552, 2019. - · arXiv
- [56][56] X. Wu, M. Fredrikson, S. Jha, and J. F. Naughton, 'A methodology for formalizing modelinversion attacks,' in 2016 IEEE 29th Computer Security Foundations Symposium (CSF) , pp. 355-370, June 2016. -
- [70][70] P. Kairouz, S. Oh, and P. Viswanath, 'Extremal mechanisms for local differential privacy,' CoRR , vol. abs/1407.1338, 2014. - · arXiv
- [71][71] Ú. Erlingsson, A. Korolova, and V. Pihur, 'RAPPOR: randomized aggregatable privacypreserving ordinal response,' CoRR , vol. abs/1407.6981, 2014. - · arXiv
- [76][76] D. Kifer and A. Machanavajjhala, 'Pufferfish: A framework for mathematical privacy definitions,' ACM Trans. Database Syst. , vol. 39, Jan. 2014. -
- [78][78] M. E. Andrés, N. E. Bordenabe, K. Chatzikokolakis, and C. Palamidessi, 'Geoindistinguishability: Differential privacy for location-based systems,' in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security , CCS '13, (New York, NY, USA), p. 901-914, Association for Computing Machinery, 2013. -
- [79][79] S. Goldwasser and S. Micali, 'Probabilistic encryption,' Journal of computer and system sciences , vol. 28, no. 2, pp. 270-299, 1984. -
- [110][110] P. Mohassel and P. Rindal, 'Aby3: A mixed protocol framework for machine learning,' in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , CCS '18, (New York, NY, USA), p. 35-52, Association for Computing Machinery, 2018. -
- [123][123] E. Bagdasaryan, O. Poursaeed, and V. Shmatikov, 'Differential privacy has disparate impact on model accuracy,' in Advances in Neural Information Processing Systems , pp. 15479-15488, 2019. -
- [125][125] B. Jayaraman and D. Evans, 'Evaluating differentially private machine learning in practice,' in 28th { USENIX } Security Symposium ( { USENIX } Security 19) , pp. 1895-1912, 2019. -
- [128][128] J. Wang, J. Zhang, W. Bao, X. Zhu, B. Cao, and P. S. Yu, 'Not just privacy,' Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , Jul 2018. -
- [136][136] M. S. Riazi, C. Weinert, O. Tkachenko, E. M. Songhori, T. Schneider, and F. Koushanfar, 'Chameleon: A hybrid secure computation framework for machine learning applications,' CoRR , vol. abs/1801.03239, 2018. - · arXiv
- [140][140] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, 'Gazelle: A low latency framework for secure neural network inference,' in Proceedings of the 27th USENIX Conference on Security Symposium , SEC'18, (USA), p. 1651-1668, USENIX Association, 2018. -
- [153][153] F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi, 'Darknetz: Towards model privacy at the edge using trusted execution environments,' ArXiv , vol. abs/2004.05703, 2020. - · arXiv
- [160][160] C. Canella, D. Genkin, L. Giner, D. Gruss, M. Lipp, M. Minkin, D. Moghimi, F. Piessens, M. Schwarz, B. Sunar, J. Van Bulck, and Y. Yarom, 'Fallout: Leaking data on meltdownresistant cpus,' in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) , ACM, 2019. -
Cited by
Sorted by citations
Items 101–146 of 146
Towards Benchmarking Privacy Risk for Differential Privacy: A Survey
Prokhorenkov, D., & Cao, Y. (2023) · ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation (BuildSys) · doi:10.1145/3600100.3625373 · Cited by 2
ULDP: A User-Centric Local Differential Privacy Optimization Method
Yang, W., & Al‐Masri, E. (2024) · IEEE World AI IoT Congress (AIIoT) · doi:10.1109/aiiot61789.2024.10579023 · Cited by 2
Privacy-preserving Hybrid Learning Framework for Healthcare
Ermiş, O., Joymangul, J. S., Bouhamoum, R., Masmoudi, M., Khanouche, M. E., Zghal, H. B., Biennier, F., Ghedira-Guegan, C., & Khadraoui, D. (2024) · Procedia Computer Science · doi:10.1016/j.procs.2024.09.215 · Cited by 2
Double Momentum Backdoor Attack in Federated Learning
Panigrahi, S., Bouacida, N., & Mohapatra, P. (2023) · Journal of Student Research · doi:10.47611/jsrhs.v12i1.3644 · Cited by 2
Tran, A.-T., & Pham, X. S. (2023) · International Conference on Knowledge and Systems Engineering/Proceedings · doi:10.1109/kse59128.2023.10299433 · Cited by 2
A Comparative Study for Privacy-Aware Recommendation Systems
Canbay, Y., & Utku, A. (2024) · Gazi University Journal of Science Part A Engineering and Innovation · doi:10.54287/gujsa.1393692 · Cited by 2
Authenticating Edge Neural Network through Hardware Security Modules and Quantum-Safe Key Management
Vembu, S. K., Chattopadhyay, A., & Saha, S. (2024) · International Conference on VLSI Design · doi:10.1109/vlsid60093.2024.00059 · Cited by 2
Computing-Model and Computing-Hardware Selection for ICT Under Societal and Judicial Constraints
Bock, Y. N., Boche, H., Fitzek, F. H. P., & Gitta Kutyniok, B. (2024) · IEEE Access · doi:10.1109/access.2024.3519979 · Cited by 2
AI Accelerators for Standalone Computer
Kim, T., Lee, J., Jung, H., & Kim, S. (2023) · Springer eBooks · doi:10.1007/978-3-031-22170-5_2 · Cited by 2
Tutorial on Fair and Private Deep Learning
Padala, M., Damle, S., & Gujar, S. (2024) · Joint International Conference on Data Science & Management of Data (CODS-COMAD) · doi:10.1145/3632410.3633294 · Cited by 2
Joint Federated Learning and Personalization for on-Device ASR
Jia, J., Li, K., Malek, M., Malik, K., Mahadeokar, J., Kalinli, O., & Seide, F. T. B. (2023) · IEEE Workshop on Automatic Speech Recognition and Understanding (ASRU) · doi:10.1109/asru57964.2023.10389738 · Cited by 3
Verkijk, S., & Vossen, P. T. J. M. (2022) · Language Resources and Evaluation Conference (LREC) · doi:10.63317/4jkv4oq2gtcf · Cited by 2
On Deep Research Problems in Deep LearningPreprint
Ulhaq, A. (2021) · doi:10.31224/osf.io/r78ds · Cited by 4
Islam, N., & Zulkernine, M. (2025) · arXiv · doi:10.48550/arxiv.2503.01089 · Cited by 9
“The application domains are D1: Intelligent transportation and traffic management, D2: Autonomous driving and safety-critical applications and D3: Communication infrastructure and smart services.”
InfluentialFuture Directions in Computational Intelligence: Anticipating the Next Wave
Kumar, L., Raj, A., Singh, N., Sandhu, R., Gangwar, G., & Ghai, D. (2025) · Information systems engineering and management · doi:10.1007/978-3-031-96871-6_3 · Cited by 1
FlexHE: A flexible Kernel Generation Framework for Homomorphic Encryption-Based Private Inference
Yu, J., Zeng, W., Xu, T., Chen, R., Liang, Y. E., Wang, R., Huang, R., & Li, M. (2024) · doi:10.1145/3676536.3676739 · Cited by 1
Verkijk, S., & Vossen, P. T. J. M. (2025) · Artificial Intelligence in Medicine · doi:10.1016/j.artmed.2025.103148 · Cited by 2
The Tug of War Within: Mitigating the Fairness-Privacy Conflicts in Large Language Models
Qian, C., Liu, D., Zhang, J., Liu, Y., & Shao, J. (2025) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2025.acl-long.590 · Cited by 15
Enhance while protecting: privacy preserving image filtering
Arcelli, D., Baia, A. E., Milani, A., & Poggioni, V. (2021) · WI/IAT · doi:10.1145/3486622.3493999 · Cited by 1
Privacy preserving layer partitioning for Deep Neural Network models
Rajasekar, K. P., Loh, R., Fok, K. W., & Thing, V. L. L. (2024) · IEEE Conference on Artificial Intelligence (CAI) · doi:10.1109/cai59869.2024.00202 · Cited by 1
On the impact of randomization on robustness in machine learning
Pinot, R. (2020) · theses.fr (ABES) · doi:10.70675/0c663121zbccez4affza78az8028a3491269 · Cited by 1
Privacy and Integrity Preserving Training Using Trusted HardwarePreprint
Hashemi, H., Wang, Y., & Annavaram, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.00334
Secure Machine Intelligence and Distributed Ledger
Arseniev, D. G., Baskakov, D., & Shkodyrev, V. P. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-86970-0_17
Pejó, B., & Desfontaines, D. (2022) · SpringerBriefs in computer science · doi:10.1007/978-3-030-96398-9_2
Paaß, G., & Giesselbach, S. (2023) · Artificial intelligence: foundations, theory, and algorithms/Artificial intelligence: Foundations, theory, and algorithms · doi:10.1007/978-3-031-23190-2_8
Frameworks for interpretability of deep learning-based prognostics and health management
Barraza, J. E. F. (2022) · Digital Library of Theses and Dissertations (Universidade de São Paulo) · doi:10.11606/t.3.2022.tde-22052023-151410
Compliant multimedia storage and data extraction from the untrusted and privacy-sensitive edge
Ovesen, A. B., Nordmo, T.-A. S., & Johansen, D. (2023) · International Conference on Multimedia Computing, Networking and Applications (MCNA) · doi:10.1109/mcna59361.2023.10185828
A Novel Privacy-Aware Traffic Speed Prediction Model Based on Recurrent Neural NetworksPreprint
Akın, M., Canbay, Y., & Sağıroğlu, Ş. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4591259
Private Training Approaches - A Primer
Reuben, J., & Alaqra, A. S. (2024) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-57978-3_20
Privacy-preserving with Flexible Autoencoder for Video Coding for Machines
Gou, A., Sun, H., Zeng, X., & Fan, Y. (2024) · IEEE International Symposium on Circuits and Systems proceedings · doi:10.1109/iscas58744.2024.10558330
Nguyen, L., & Savchenko, A. V. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-67008-4_16
Tran, A.-T., Huynh, V., & Dang, V.-H. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-67977-3_11
Advances in Partitioning Techniques
Guggari, S., Umadevi, V., & Kadappa, V. (2025) · Chapman & Hall/CRC eBooks · doi:10.1201/9781003471905
EGIS: Entropy Guided Image Synthesis for Dataset-Agnostic Testing of RRAM-Based DNNs
Saha, A., Amarnath, C., Ma, K., & Chatterjee, A. (2025) · Design, Automation, and Test in Europe · doi:10.23919/date64628.2025.10993185
Integrating On-Device and Cloud Learning for Efficient AI SystemsPreprint
Chen, A. M., Kumar, R., Hofstad, L., Owens, D. M., Tanaka, Y., El-Sayed, M., García, E., & Nadine, J. (2025) · doi:10.36227/techrxiv.175502731.19924620/v1
Fundamentals of artificial intelligence
Bagherzadeh, P., Sevyeri, L. R., Zou, Y., & Enger, S. A. (2025) · Institute of Physics eBooks · doi:10.1088/978-0-7503-6119-4ch1
Mitigating Attribute Inference in Split Learning via Channel Pruning and Adversarial Training
Alhindi, A., Al-Ahmadi, S. A., & Ismail, M. M. B. (2025) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2025.072625
Probing Privacy Risks in Deep Neural Networks: A Jacobian Rank-Based Analysis of Intermediate Layers
Liu, S., Zhang, X., Huang, T., Zheng, G., Yang, W., & Zhang, J. (2026) · Intelligent Computing · doi:10.34133/icomputing.0270
Huang, X., & Xie, F. (2026) · Entropy · doi:10.3390/e28040409
Davey, G. (2026) · Advances in Artificial Intelligence and Robotics Research · doi:10.4236/airr.2026.22004
From points to clusters: rethinking shadow dataset generation for enhanced membership inference
Lal, A. K., & Karthikeyan, S. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01800-4
Scalable privacy risk assessment of medical data processed by large language models
Jalali, F., & Nia, M. A. (2026) · The Journal of Supercomputing · doi:10.1007/s11227-026-08747-4
Privacy in the Age of Robotics: Protecting Personal Data in Classrooms
Drobnjak, A., Terzic, I., Kirin, B., & Botički, I. (2025) · International Conference on Computers in Education · doi:10.58459/icce.2025.6060
Chaturvedi, P., & Ahmad, S. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-0685-6.ch006
Prenestini, A., Rella, A., & Ferrari, G. M. D. (2026) · MECOSAN · doi:10.3280/mesa2025-135oa23434
Metadata
- Authors
- Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H.
- ORCID
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2004.12254
- OpenAlex
- W3018763859
- Cited by
- 106
- References
- 152
- Citations by year
- 2026: 1 · 2025: 6 · 2024: 26 · 2023: 19 · 2022: 22 · 2021: 26 · 2020: 6
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- inference attacks, deep neural network, sensitive data, data leakage, privacy-preserving techniques, crowdsourced data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
