The DOI matches its DataCite record; 147 of the 152 references it cites were found in a registry or an index.
Privacy in Deep Learning: A Survey
Open accessAbstract
The ever-growing advances of deep learning in many areas including vision, recommendation systems, natural language processing, etc., have led to the adoption of Deep Neural Networks (DNNs) in production systems. The availability of large datasets and high computational power are the main contributors to these advances. The datasets are usually crowdsourced and may contain sensitive information. This poses serious privacy concerns as this data can be misused or leaked through various vulnerabilities. Even if the cloud provider and the communication link is trusted, there are still threats of inference attacks where an attacker could speculate properties of the data used for training, or find the underlying model architecture and parameters. In this survey, we review the privacy concerns brought by deep learning, and the mitigating techniques introduced to tackle these issues. We also show that there is a gap in the literature regarding test-time inference privacy, and propose possible future research directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“To circumvent these privacy risks, advanced privacy-preserving ML (PPML) techniques such as federated learning (FL), homomorphic encryption (HE), secure multi-party computations (SMPC), and differential privacy (DP) are being thoroughly studied to protect user data and model integrity in the ML pipeline [16, 97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“During the training phase, attacks such as data poisoning, property inference, or Byzantine attacks, and in the inference phase, membership inference, model inversion, or model extraction attacks can undermine the privacy and integrity of both the model and its underlying data [97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“During the training phase, attacks such as data poisoning, property inference, or Byzantine attacks, and in the inference phase, membership inference, model inversion, or model extraction attacks can undermine the privacy and integrity of both the model and its underlying data [97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“In the ML pipeline of an IoV application, privacy risks can arise during the training and inference phases to compromise the confidentiality and integrity of the system [16, 97, 161].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“data poisoning attacks involve adversaries manipulating training data to compromise model integrity or insert backdoors, a significant risk in IoV where data quality is crucial for safety”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“For instance, studies [116], [161], [97], [16] reviewed privacy issues in deep learning (DL), including attacks, privacy-preserving techniques and their challenges.”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [97]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
k-ANONYMITY: A MODEL FOR PROTECTING PRIVACY
SWEENEY, L. (2002) · International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems · doi:10.1142/s0218488502001648 · Cited by 8,571
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Self-citationCalibrating Noise to Sensitivity in Private Data Analysis
Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272
Fully homomorphic encryption using ideal lattices
Gentry, C. (2009) · Proceedings of the forty-first annual ACM symposium on Theory of computing · doi:10.1145/1536414.1536440 · Cited by 6,806
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856
L -diversity: Privacy beyond k -anonymity
Machanavajjhala, A., Kifer, D., Gehrke, J., & Venkitasubramaniam, M. (2007) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1217299.1217302 · Cited by 3,617
t-Closeness: Privacy Beyond k-Anonymity and l-Diversity
Li, N., Li, T., & Venkatasubramanian, S. (2007) · 2007 IEEE 23rd International Conference on Data Engineering · doi:10.1109/icde.2007.367856 · Cited by 3,451
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Robust De-anonymization of Large Sparse Datasets
Narayanan, A., & Shmatikov, V. (2008) · 2008 IEEE Symposium on Security and Privacy (sp 2008) · doi:10.1109/sp.2008.33 · Cited by 2,372
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
Spectre Attacks: Exploiting Speculative Execution
Kocher, P. C., Horn, J., Fogh, A., Genkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., et al. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00002 · Cited by 1,847
RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
Erlingsson, Ú., Pihur, V., & Korolova, A. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660348 · Cited by 1,838
Our Data, Ourselves: Privacy Via Distributed Noise Generation
Dwork, C., Kenthapadi, K., McSherry, F., Mironov, I., & Naor, M. (2006) · Lecture Notes in Computer Science · doi:10.1007/11761679_29 · Cited by 1,835
Secure, privacy-preserving and federated machine learning in medical imaging
Kaissis, G. A., Makowski, M. R., Rückert, D., & Braren, R. F. (2020) · Nature Machine Intelligence · doi:10.1038/s42256-020-0186-1 · Cited by 1,676 · cited 1×
“, has resulted in their deployment in numerous production systems [1, 2, 3, 4].”
BackgroundPrivacy-Preserving Deep Learning via Additively Homomorphic Encryption
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2787987 · Cited by 1,662
Statistical Fraud Detection: A Review
Bolton, R. J., & Hand, D. J. (2002) · Statistical Science · doi:10.1214/ss/1042727940 · Cited by 1,536
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
A Closer Look at Memorization in Deep Networks
Arpit, D., Jastrzębski, S., Ballas, N., Krueger, D., Bengio, E., Kanwal, M. S., Maharaj, T., Fischer, A., Courville, A., Bengio, Y., et al. (2017) · arXiv · doi:10.48550/arxiv.1706.05394 · Cited by 1,307
(2016) · IACR Cryptology ePrint Archive · Cited by 1,288
(2016) · International Conference on Machine Learning · Cited by 1,270
Homer, N., Szelinger, S., Redman, M., Duggan, D., Tembe, W., Muehling, J., Pearson, J. V., Stephan, D. A., Nelson, S. F., & Craig, D. W. (2008) · PLoS Genetics · doi:10.1371/journal.pgen.1000167 · Cited by 1,221
Andrés, M. E., Bordenabe, N. E., Konstantinos Chatzikokolakis, A., & Catuscia Palamidessi, A. (2013) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2508859.2516735 · Cited by 1,115
Why Johnny can't encrypt: a usability evaluation of PGP 5.0
Whitten, A., & Tygar, J. D. (1999) · Cited by 1,082
Differentially Private Federated Learning: A Client Level Perspective
Geyer, R. C., Klein, T., & Nabi, M. (2017) · arXiv · doi:10.48550/arxiv.1712.07557 · Cited by 1,052
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001
(2011) · PubMed · Cited by 990
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852
Learning Differentially Private Recurrent Language Models
McMahan, H. B., Ramage, D., Talwar, K., & Zhang, L. (2017) · arXiv · doi:10.48550/arxiv.1710.06963 · Cited by 849
Meltdown: reading kernel memory from user space
Lipp, M., Schwarz, M., Gruss, D., Prescher, T., Haas, W., Fogh, A., Horn, J., Mangard, S., Kocher, P. C., Genkin, D., et al. (2018) · USENIX Security Symposium · Cited by 821
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796
Boosting and Differential Privacy
Dwork, C., Rothblum, G. N., & Vadhan, S. (2010) · 2010 IEEE 51st Annual Symposium on Foundations of Computer Science · doi:10.1109/focs.2010.12 · Cited by 784
Certified Robustness to Adversarial Examples with Differential Privacy
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., & Jana, S. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00044 · Cited by 750
Oblivious Neural Network Predictions via MiniONN Transformations
Liu, J., Juuti, M., Lu, Y., & Asokan, N. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134056 · Cited by 733
Distributed learning of deep neural network over multiple agents
Gupta, O., & Raskar, R. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.05.003 · Cited by 726
Self-citationMachine Learning Classification over Encrypted Data
Bost, R., Popa, R. A., Tu, S., & Goldwasser, S. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23241 · Cited by 683
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658
Differentially Private Generative Adversarial NetworkPreprint
Xie, L., Lin, K., Wang, S., Wang, F., & Zhou, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.06739 · Cited by 647
On k -anonymity and the curse of dimensionality
Aggarwal, C. C. (2005) · Cited by 619
Dong, J., Roth, A., & Su, W. (2022) · Journal of the Royal Statistical Society Series B (Statistical Methodology) · doi:10.1111/rssb.12454 · Cited by 554
Privacy-preserving logistic regression
Chaudhuri, K., & Monteleoni, C. (2008) · Cited by 526
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 518
Split learning for health: Distributed deep learning without sharing raw patient data
Vepakomma, P., Gupta, O., Swedish, T., & Raskar, R. (2018) · arXiv · doi:10.48550/arxiv.1812.00564 · Cited by 513
Self-citationStealing Hyperparameters in Machine Learning
Wang, B., & Gong, N. Z. (2018) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2018.00038 · Cited by 505
Adversarial Attacks and Defences: A SurveyPreprint
Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., & Mukhopadhyay, D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.00069 · Cited by 479
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · cited 4×
“Inference Parameter Inference Property Inference Access to Model Access to Model Output Membership Inference [13] # # # # Blackbox Logits Measuring Membership Privacy[35] # # # # Blackbox Logits ML-Leaks[36] # # # # Blackbox Logits The Natural Auditor [37] # # # # Blackbox Label LOGAN [38] # # # # Both Logits Privacy…”
BackgroundInfluentialKëpuska, V., & Bohouta, G. (2018) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc.2018.8301638 · Cited by 467
Mohassel, P., & Rindal, P. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243760 · Cited by 465
Riazi, M. S., Weinert, C., Tkachenko, O., Songhori, E. M., Schneider, T. H., & Koushanfar, F. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196522 · Cited by 427
ML Confidential: Machine Learning on Encrypted Data
Graepel, T., Lauter, K., & Naehrig, M. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-37682-5_1 · Cited by 423
Protection Against Reconstruction and Its Applications in Private Federated LearningPreprint
Bhowmick, A., Duchi, J. C., Freudiger, J., Kapoor, G., & Rogers, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.00984 · Cited by 420
SecureNN: 3-Party Secure Computation for Neural Network Training
Wagh, S., Gupta, D., & Chandran, N. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0035 · Cited by 418
DeepSecure: Scalable Provably-Secure Deep Learning
Rouhani, B. D., Riazi, M. S., & Koushanfar, F. (2018) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3195970.3196023 · Cited by 413
The composition theorem for differential privacy
Kairouz, P., Oh, S., & Viswanath, P. (2017) · IEEE Transactions on Information Theory · doi:10.1109/tit.2017.2685505 · Cited by 408
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted HardwarePreprint
Tramèr, F., & Boneh, D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.03287 · Cited by 373
Scalable Private Learning with PATE
Papernot, N., Song, S., Mironov, I., Raghunathan, A., Talwar, K., & Erlingsson, Ú. (2018) · arXiv · doi:10.48550/arxiv.1802.08908 · Cited by 373
Fast Homomorphic Evaluation of Deep Discretized Neural Networks
Bourse, F., Minelli, M., Minihold, M., & Paillier, P. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-96878-0_17 · Cited by 321
Model inversion attacks against collaborative inference
He, Z., Zhang, T., & Lee, R. B. (2019) · Proceedings of the 35th Annual Computer Security Applications Conference · doi:10.1145/3359789.3359824 · Cited by 313 · cited 1×
“[47] propose a new set of attacks to compromise the”
BackgroundEnterprise data breach: causes, challenges, prevention, and future directions
Cheng, L., Liu, F., & Yao, D. D. (2017) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1211 · Cited by 308
CryptoDL: Deep Neural Networks over Encrypted Data
Hesamifard, E., Takabi, H., & Ghasemi, M. (2017) · arXiv · doi:10.48550/arxiv.1711.05189 · Cited by 306
Mobile sensor data anonymization
Malekzadeh, M., Clegg, R. G., Cavallaro, A., & Haddadi, H. (2019) · Proceedings of the International Conference on Internet of Things Design and Implementation · doi:10.1145/3302505.3310068 · Cited by 298
Kifer, D., & Machanavajjhala, A. (2014) · ACM Transactions on Database Systems · doi:10.1145/2514689 · Cited by 297
Differentially Private Model Publishing for Deep Learning
Yu, L., Liu, L., Pu, C., Gursoy, M. E., & Truex, S. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00019 · Cited by 285
Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment
Yang, Z., Zhang, J., Chang, E., & Liang, Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354261 · Cited by 274
Notice of Removal: A Hybrid Deep Learning Architecture for Privacy-Preserving Mobile Analytics
Osia, S. A., Shamsabadi, A. S., Sajadmanesh, S., Taheri, A., Katevas, K., Rabiee, H. R., Lane, N. D., & Haddadi, H. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2967734 · Cited by 269
Distributed Differential Privacy via Shuffling
Cheu, A., Smith, A., Ullman, J., Zeber, D., & Zhilyaev, M. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-17653-2_13 · Cited by 268
Large-scale privacy protection in Google Street View
Frome, A., Cheung, G., Abdulkader, A., Zennaro, M., Wu, B., Bissacco, A., Adam, H., Neven, H., & Vincent, L. M. (2009) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2009.5459413 · Cited by 256
CrypTFlow: Secure TensorFlow Inference
Kumar, N., Rathee, M., Chandran, N., Gupta, D., Rastogi, A., & Sharma, R. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00092 · Cited by 245
Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learning
Phan, N., Wu, X., Hu, H., & Dou, D. (2017) · Proceedings · doi:10.1109/icdm.2017.48 · Cited by 237
Canella, C., Genkin, D., Giner, L., Gruss, D., Lipp, M., Minkin, M., Moghimi, D., Piessens, F., Schwarz, M., Sunar, B., et al. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363219 · Cited by 236
Phan, N., Wang, Y., Wu, X., & Dou, D. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10165 · Cited by 225
Privacy-Preserving Classification on Deep Neural Network.Preprint
Chabanne, H., de Wargny, A., Milgram, J., Morel, C., & Prouff, E. (2017) · IACR Cryptology ePrint Archive · Cited by 224
Enabling Video Privacy through Computer Vision
Senior, A., Pankanti, S., Hampapur, A., Brown, L., Tian, Y., Ekin, A., Connell, J. H., Shu, C.-F., & Lu, M. (2005) · IEEE Security & Privacy · doi:10.1109/msp.2005.65 · Cited by 218
Auditing Data Provenance in Text-Generation Models
Song, C., & Shmatikov, V. (2019) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3292500.3330885 · Cited by 217
The Privacy Blanket of the Shuffle Model
Balle, B., Bell, J., Gascón, A., & Nissim, K. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-26951-7_22 · Cited by 214
GANobfuscator: Mitigating Information Leakage Under GAN via Differential Privacy
Xu, C., Ren, J., Zhang, D., Zhang, Y., Qin, Z., & Ren, K. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2897874 · Cited by 214
XONN: XNOR-based Oblivious Deep Neural Network InferencePreprint
Riazi, M. S., Samragh, M., Chen, H., Laine, K., Lauter, K., & Koushanfar, F. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.07342 · Cited by 214
Mo, F., Shamsabadi, A. S., Katevas, K., Demetriou, S., Leontiadis, I., Cavallaro, A., & Haddadi, H. (2020) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3386901.3388946 · Cited by 208
Deep Learning With Gaussian Differential Privacy
Bu, Z., Dong, J., Long, Q., & Wei-Jie, S. (2020) · Harvard Data Science Review · doi:10.1162/99608f92.cfc5dd25 · Cited by 186
White-box vs Black-box: Bayes Optimal Strategies for Membership InferencePreprint
Sablayrolles, A., Douze, M., Ollivier, Y., Schmid, C., & Jeǵou, H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.11229 · Cited by 184
Delphi: A Cryptographic Inference Service for Neural NetworksPreprint
Mishra, P., Lehmkuhl, R., Srinivasan, A., Zheng, W., & Popa, R. A. (2020) · IACR Cryptology ePrint Archive · Cited by 175
Cheetah: Optimizing and Accelerating Homomorphic Encryption for Private Inference
Reagen, B., Choi, W.-S., Ko, Y., Lee, V. T., Lee, H.-H. S., Wei, G.-Y., & Brooks, D. M. (2021) · IEEE International Symposium on High-Performance Computer Architecture (HPCA) · doi:10.1109/hpca51647.2021.00013 · Cited by 167
Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN ArchitecturesPreprint
Yan, M., Fletcher, C. W., & Torrellas, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1808.04761 · Cited by 161
A Methodology for Formalizing Model-Inversion Attacks
Wu, X., Fredrikson, M., Jha, S., & Naughton, J. F. (2016) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf.2016.32 · Cited by 159
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
Salem, A., Bhattacharya, A., Backes, M., Fritz, M., & Zhang, Y. (2020) · Universität des Saarlandes · doi:10.22028/d291-47370 · Cited by 157
Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study
Wu, Z., Wang, Z., Wang, Z., & Jin, H. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01270-0_37 · Cited by 156
Context-Aware Generative Adversarial Privacy
Huang, C., Kairouz, P., Chen, X., Sankar, L., & Rajagopal, R. (2017) · Entropy · doi:10.3390/e19120656 · Cited by 156
Protecting Sensory Data against Sensitive Inferences
Malekzadeh, M., Clegg, R. G., Cavallaro, A., & Haddadi, H. (2018) · Proceedings of the 1st Workshop on Privacy by Design in Distributed Systems · doi:10.1145/3195258.3195260 · Cited by 154
Smart meter privacy using a rechargeable battery: Minimizing the rate of information leakage
Varodayan, D., & Khisti, A. J. (2011) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2011.5946886 · Cited by 154
Towards Practical Differentially Private Convex Optimization
Iyengar, R., Near, J. P., Song, D. X., Thakkar, O. D., Thakurta, A., & Wang, L. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00001 · Cited by 145
Differentially Private Mixture of Generative Neural Networks
Ács, G., Melis, L., Castelluccia, C., & Cristofaro, E. D. (2017) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/icdm.2017.81 · Cited by 142
Secure Face Matching Using Fully Homomorphic Encryption
Boddeti, V. N. (2018) · IEEE International Conference on Biometrics: Theory, Applications and Systems (BTAS) · doi:10.1109/btas.2018.8698601 · Cited by 134
The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting SecretsPreprint
Carlini, N., Liu, C., Kos, J., Erlingsson, Ú., & Song, D. X. (2018) · arXiv (Cornell University) · Cited by 124
Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution
Weisse, O., Bulck, J. V., Minkin, M., Genkin, D., Kasikci, B., Piessens, F., Silberstein, M., Strackx, R., Wenisch, T. F., & Yarom, Y. (2018) · Lirias · Cited by 119
Auditing Differentially Private Machine Learning: How Private is Private SGD?Preprint
Jagielski, M., Ullman, J., & Oprea, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.07709 · Cited by 113
Learning Privately from Multiparty DataPreprint
Hamm, J., Cao, P. Y., & Belkin, M. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1602.03552 · Cited by 111
Production-level facial performance capture using deep convolutional neural networks
Laine, S., Karras, T., Aila, T., Herva, A., Saito, S., Yu, R., Li, H., & Lehtinen, J. (2017) · ACM SIGGRAPH/Eurographics Symposium on Computer Animation (SCA) · doi:10.1145/3099564.3099581 · Cited by 102
Preserving differential privacy in convolutional deep belief networks
Phan, N., Wu, X., & Dou, D. (2017) · Machine Learning · doi:10.1007/s10994-017-5656-2 · Cited by 99
Notice of Removal: Deep Private-Feature Extraction
Osia, S. A., Taheri, A., Shamsabadi, A. S., Katevas, K., Haddadi, H., & Rabiee, H. R. (2018) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2018.2878698 · Cited by 96
Membership Inference Attacks against Machine Learning ModelsPreprint
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1610.05820 · Cited by 96
TAPAS : tricks to accelerate (encrypted) prediction as a servicePreprint
Sanyal, A., Kusner, M. J., Gascón, A., & Kanade, V. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.03461 · Cited by 95
Respectful cameras: detecting visual markers in real-time to address privacy concerns
Schiff, J., Meingast, M., Mulligan, D. K., Sastry, S., & Goldberg, K. (2007) · IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) · doi:10.1109/iros.2007.4399122 · Cited by 94
Mireshghallah, F., Taram, M., Ramrakhyani, P., Jalali, A., Tullsen, D. M., & Esmaeilzadeh, H. (2020) · International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) · doi:10.1145/3373376.3378522 · Cited by 92
Self-citationTaram, M., Venkat, A., & Tullsen, D. M. (2019) · International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) · doi:10.1145/3297858.3304060 · Cited by 90
Self-citationAnalyzing Information Leakage of Updates to Natural Language Models
Zanella-Béguelin, S., Wutschitz, L., Tople, S., Rühle, V., Paverd, A., Ohrimenko, O., Köpf, B., & Brockschmidt, M. (2020) · Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3372297.3417880 · Cited by 86
Mitigating Information Leakage in Image Representations: A Maximum Entropy Approach
Roy, P. C., & Boddeti, V. N. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00269 · Cited by 85
Towards Demystifying Membership Inference AttacksPreprint
Truex, S., Liu, L., Gürsoy, M. E., Yu, L., & Wei, W. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.09173 · Cited by 84
Privacy-preserving Machine Learning through Data ObfuscationPreprint
Zhang, T., He, Z., & Lee, R. B.-L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.01860 · Cited by 82
Learning Differentially Private Language Models Without Losing Accuracy
McMahan, H. B., Ramage, D., Talwar, K., & Zhang, L. (2017) · Cited by 80
Kobbi Nissim, B., & Wood, A. (2018) · Philosophical Transactions of the Royal Society A Mathematical Physical and Engineering Sciences · doi:10.1098/rsta.2017.0358 · Cited by 75
Privacy-Preserving Visual Learning Using Doubly Permuted Homomorphic Encryption
Yonetani, R., Boddeti, V. N., Kitani, K., & Sato, Y. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.225 · Cited by 72
Towards Measuring Membership PrivacyPreprint
Long, Y., Bindschaedler, V., & Gunter, C. A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.09136 · Cited by 72
Scalable and Differentially Private Distributed Aggregation in the Shuffled Model
Ghazi, B., Pagh, R., & Velingker, A. (2019) · arXiv · doi:10.48550/arxiv.1906.08320 · Cited by 62
LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks.Preprint
Hayes, J., Melis, L., Danezis, G., & Cristofaro, E. D. (2017) · arXiv (Cornell University) · Cited by 59
On the Robustness of Information-Theoretic Privacy Measures and Mechanisms
Díaz, M., Wang, H., Calmon, F. P., & Sankar, L. (2019) · IEEE Transactions on Information Theory · doi:10.1109/tit.2019.2939472 · Cited by 57
Mirjalili, V., Raschka, S., & Ross, A. A. (2019) · IEEE Access · doi:10.1109/access.2019.2924619 · Cited by 57
Privacy-Preserving Inference in Machine Learning Services Using Trusted Execution EnvironmentsPreprint
Narra, K. G., Lin, Z., Wang, Y., Balasubramaniam, K., & Annavaram, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.03485 · Cited by 52
Private Collaborative Neural Network Learning.Preprint
Chase, M., Gilad-Bachrach, R., Laine, K., Lauter, K., & Rindal, P. (2017) · IACR Cryptology ePrint Archive · Cited by 52
EPIC: Efficient Private Image Classification (or: Learning from the Masters)
Makri, E., Rotaru, D., Smart, N. P., & Vercauteren, F. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-12612-4_24 · Cited by 51
Encrypted statistical machine learning: new privacy preserving methodsPreprint
Aslett, L. J. M., Esperança, P. M., & Holmes, C. C. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1508.06845 · Cited by 48
Privacy and utility preserving sensor-data transformations
Malekzadeh, M., Clegg, R. G., Cavallaro, A., & Haddadi, H. (2020) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2020.101132 · Cited by 44
Olympus: Sensor Privacy through Utility Aware Obfuscation
Raval, N., Machanavajjhala, A., & Pan, J. Y. (2018) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0002 · Cited by 41
Privacy-Preserving Distributed Deep Learning for Clinical DataPreprint
Beaulieu‐Jones, B. K., Yuan, W., Finlayson, S. G., & Wu, Z. S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.01484 · Cited by 38
QUOTIENT: Two-Party Secure Neural Network Training and PredictionPreprint
Agrawal, N., Shamsabadi, A. S., Kusner, M. J., & Gascón, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.03372 · Cited by 38
Generating Differentially Private Datasets Using GANsPreprint
Triastcyn, A., & Faltings, B. V. (2018) · arXiv (Cornell University) · Cited by 30
A Non-Parametric Test to Detect Data-Copying in Generative ModelsPreprint
Meehan, C., Chaudhuri, K., & Dasgupta, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05675 · Cited by 27
DeepObfuscator: Adversarial Training Framework for Privacy-Preserving Image ClassificationPreprint
Li, A., Guo, J., Yang, H., & Chen, Y. (2019) · arXiv (Cornell University) · Cited by 26
PrivEdge: From Local to Distributed Private Training and Prediction
Shamsabadi, A. S., Gascón, A., Haddadi, H., & Cavallaro, A. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.2988132 · Cited by 22
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural NetworksPreprint
Hashemi, H., Wang, Y., & Annavaram, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.01300 · Cited by 20
Data-Driven Generation of Synthetic Load Datasets Preserving Spatio-Temporal Features
Pinceti, A., Kosut, O., & Sankar, L. (2019) · IEEE Power Engineering Society General Meeting · doi:10.1109/pesgm40551.2019.8973532 · Cited by 20
Trident: Efficient 4PC Framework for Privacy Preserving Machine Learning.Preprint
Rachuri, R., & Suresh, A. (2019) · IACR Cryptology ePrint Archive · Cited by 20
Profile-based Privacy for Locally Private Computations
Geumlek, J., & Chaudhuri, K. (2019) · IEEE International Symposium on Information Theory (ISIT) · doi:10.1109/isit.2019.8849549 · Cited by 18
Packet Chasing: Spying on Network Packets over a Cache Side-Channel
Taram, M., Venkat, A., & Tullsen, D. M. (2020) · Proceedings - International Symposium on Computer Architecture/Proceedings · doi:10.1109/isca45697.2020.00065 · Cited by 18
Self-citationApproximate Data Deletion from Machine Learning Models: Algorithms and Evaluations.Preprint
Izzo, Z., Smart, M. A., Chaudhuri, K., & Zou, J. (2020) · arXiv (Cornell University) · Cited by 15
Censored and Fair Universal Representations using Generative Adversarial Models
Kairouz, P., Liao, J., Huang, C. X., & Sankar, L. (2019) · Cited by 15
The Natural Auditor: How To Tell If Someone Used Your Words To Train Their Model.
Song, C., & Shmatikov, V. (2018) · Cited by 13
A Principled Approach to Learning Stochastic Representations for Privacy in Deep Neural Inference
Mireshghallah, F., Taram, M., Jalali, A., Elthakeb, A. T., Tullsen, D. M., & Esmaeilzadeh, H. (2020) · Cited by 12
Self-citationPrivacy-preserving Analysis of Correlated Data.Preprint
Wang, Y., Song, S., & Chaudhuri, K. (2016) · arXiv (Cornell University) · Cited by 11
Differentially Private Set Union
Gulhane, P., Gopi, S., Kulkarni, J., Shen, J. H., Shokouhi, M., & Yekhanin, S. (2020) · International Conference on Machine Learning · Cited by 11
Benchmarking Differentially Private Residual Networks for Medical ImageryPreprint
Singh, S., Sikka, H., Kotti, S., & Trask, A. (2020) · doi:10.31219/osf.io/v2ms6 · Cited by 11
Privacy-Preserving Collaborative Deep Learning with Irregular Participants.Preprint
Zhao, L., Zhang, Y., Wang, Q., Chen, Y., Wang, C., & Zou, Q. (2018) · arXiv (Cornell University) · Cited by 9
Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring ConstraintsPreprint
Liao, J., Huang, C. X., Kairouz, P., & Sankar, L. (2019) · arXiv (Cornell University) · Cited by 9
Obfuscation via Information Density EstimationPreprint
Hsu, H., Asoodeh, S., & Calmon, F. P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.08109 · Cited by 9
Semantic Security: Privacy Definitions Revisited
Liu, J., Xiong, L., & Luo, J. (2013) · Cited by 8
Flagged first, then by citations
5 of the 152 references couldn’t be matched to a known paper.
Research works printed but not linked: 17
- [29][29] S. A. Ossia, A. Taheri, A. S. Shamsabadi, K. Katevas, H. Haddadi, and H. R. Rabiee, 'Deep private-feature extraction,' IEEE Transactions on Knowledge and Data Engineering , vol. 32, pp. 54-66, 2018. -
- [31][31] F. Mireshghallah, M. Taram, A. Jalali, D. Tullsen, and H. Esmaeilzadeh, 'Shredder: Learning noise distributions to protect inference privacy,' in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , ASPLOS '20, (New York, NY, USA), Association for Computing Machinery, March 2020. -
- [45][45] Z. Yang, E.-C. Chang, and Z. Liang, 'Adversarial neural network inversion via auxiliary knowledge alignment,' ArXiv , vol. abs/1902.08552, 2019. - · arXiv
- [56][56] X. Wu, M. Fredrikson, S. Jha, and J. F. Naughton, 'A methodology for formalizing modelinversion attacks,' in 2016 IEEE 29th Computer Security Foundations Symposium (CSF) , pp. 355-370, June 2016. -
- [70][70] P. Kairouz, S. Oh, and P. Viswanath, 'Extremal mechanisms for local differential privacy,' CoRR , vol. abs/1407.1338, 2014. - · arXiv
- [71][71] Ú. Erlingsson, A. Korolova, and V. Pihur, 'RAPPOR: randomized aggregatable privacypreserving ordinal response,' CoRR , vol. abs/1407.6981, 2014. - · arXiv
- [76][76] D. Kifer and A. Machanavajjhala, 'Pufferfish: A framework for mathematical privacy definitions,' ACM Trans. Database Syst. , vol. 39, Jan. 2014. -
- [78][78] M. E. Andrés, N. E. Bordenabe, K. Chatzikokolakis, and C. Palamidessi, 'Geoindistinguishability: Differential privacy for location-based systems,' in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security , CCS '13, (New York, NY, USA), p. 901-914, Association for Computing Machinery, 2013. -
- [79][79] S. Goldwasser and S. Micali, 'Probabilistic encryption,' Journal of computer and system sciences , vol. 28, no. 2, pp. 270-299, 1984. -
- [110][110] P. Mohassel and P. Rindal, 'Aby3: A mixed protocol framework for machine learning,' in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , CCS '18, (New York, NY, USA), p. 35-52, Association for Computing Machinery, 2018. -
- [123][123] E. Bagdasaryan, O. Poursaeed, and V. Shmatikov, 'Differential privacy has disparate impact on model accuracy,' in Advances in Neural Information Processing Systems , pp. 15479-15488, 2019. -
- [125][125] B. Jayaraman and D. Evans, 'Evaluating differentially private machine learning in practice,' in 28th { USENIX } Security Symposium ( { USENIX } Security 19) , pp. 1895-1912, 2019. -
- [128][128] J. Wang, J. Zhang, W. Bao, X. Zhu, B. Cao, and P. S. Yu, 'Not just privacy,' Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , Jul 2018. -
- [136][136] M. S. Riazi, C. Weinert, O. Tkachenko, E. M. Songhori, T. Schneider, and F. Koushanfar, 'Chameleon: A hybrid secure computation framework for machine learning applications,' CoRR , vol. abs/1801.03239, 2018. - · arXiv
- [140][140] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, 'Gazelle: A low latency framework for secure neural network inference,' in Proceedings of the 27th USENIX Conference on Security Symposium , SEC'18, (USA), p. 1651-1668, USENIX Association, 2018. -
- [153][153] F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi, 'Darknetz: Towards model privacy at the edge using trusted execution environments,' ArXiv , vol. abs/2004.05703, 2020. - · arXiv
- [160][160] C. Canella, D. Genkin, L. Giner, D. Gruss, M. Lipp, M. Minkin, D. Moghimi, F. Piessens, M. Schwarz, B. Sunar, J. Van Bulck, and Y. Yarom, 'Fallout: Leaking data on meltdownresistant cpus,' in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) , ACM, 2019. -
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Self-citationMembership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 662
FedML: A Research Library and Benchmark for Federated Machine LearningPreprint
He, C., Li, S., So, J., Zeng, X., Zhang, M., Wang, H., Wang, X., Vepakomma, P., Singh, A., Qiu, H., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.13518 · Cited by 668
Self-citationDifferential Privacy for Deep and Federated Learning: A Survey
Ouadrhiri, A. E., & Abdelhadi, A. (2022) · IEEE Access · doi:10.1109/access.2022.3151670 · Cited by 445
Federated Learning for Open Banking
Long, G., Tan, Y., Jiang, J. B., & Chengqi Zhang, B. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-63076-8_17 · Cited by 308
Metadata
- Authors
- Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H.
- ORCID
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2004.12254
- OpenAlex
- W3018763859
- Cited by
- 106
- References
- 152
- Citations by year
- 2026: 1 · 2025: 6 · 2024: 26 · 2023: 19 · 2022: 22 · 2021: 26 · 2020: 6
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- inference attacks, deep neural network, sensitive data, data leakage, privacy-preserving techniques, crowdsourced data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
