{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,15]],"date-time":"2026-07-15T03:31:14Z","timestamp":1784086274242,"version":"3.55.0"},"reference-count":109,"publisher":"Springer Science and Business Media LLC","issue":"9","license":[{"start":{"date-parts":[[2021,9,17]],"date-time":"2021-09-17T00:00:00Z","timestamp":1631836800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2021,9,17]],"date-time":"2021-09-17T00:00:00Z","timestamp":1631836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100009375","name":"Technical University of Munich | Graduate School, Technische Universit\u00e4t M\u00fcnchen","doi-asserted-by":"publisher","award":["JADS"],"award-info":[{"award-number":["JADS"]}],"id":[{"id":"10.13039\/501100009375","id-type":"DOI","asserted-by":"publisher"}]},{"name":"UK Research and Innovation London Medical Imaging & Artificial Intelligence Centre for Value Based Healthcare"},{"name":"UK Research and Innovation London Medical Imaging & Artificial Intelligence Centre for Value Based Healthcare"},{"DOI":"10.13039\/501100009394","name":"Technical University of Munich | Fakult\u00e4t f\u00fcr Medizin, Technische Universit\u00e4t M\u00fcnchen","doi-asserted-by":"publisher","award":["H14"],"award-info":[{"award-number":["H14"]}],"id":[{"id":"10.13039\/501100009394","id-type":"DOI","asserted-by":"publisher"}]},{"name":"UK Research and Innovation London Medical Imaging & Artificial Intelligence Centre for Value Based Healthcare"},{"name":"UK Research and Innovation London Medical Imaging & Artificial Intelligence Centre for Value Based Healthcare"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Nat Mach Intell"],"DOI":"10.1038\/s42256-021-00390-3","type":"journal-article","created":{"date-parts":[[2021,9,17]],"date-time":"2021-09-17T16:03:58Z","timestamp":1631894638000},"page":"749-758","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":57,"title":["Adversarial interference and its mitigations in privacy-preserving collaborative machine learning"],"prefix":"10.1038","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0179-6138","authenticated-orcid":false,"given":"Dmitrii","family":"Usynin","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3242-0195","authenticated-orcid":false,"given":"Alexander","family":"Ziller","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcus","family":"Makowski","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6039-6957","authenticated-orcid":false,"given":"Rickmer","family":"Braren","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Daniel","family":"Rueckert","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4897-9356","authenticated-orcid":false,"given":"Ben","family":"Glocker","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8382-8062","authenticated-orcid":false,"given":"Georgios","family":"Kaissis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3178-9502","authenticated-orcid":false,"given":"Jonathan","family":"Passerat-Palmbach","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,9,17]]},"reference":[{"key":"390_CR1","doi-asserted-by":"crossref","unstructured":"Radley-Gardner, O., Beale, H. & Zimmermann, R. (eds) Fundamental Texts On European Private Law (Hart Publishing, 2016); http:\/\/www.bloomsburycollections.com\/book\/fundamental-texts-on-european-private-law-1","DOI":"10.5040\/9781782258674"},{"key":"390_CR2","unstructured":"Health Insurance Portability and Accountability Act (CDC, 2020)."},{"key":"390_CR3","doi-asserted-by":"publisher","unstructured":"Drainakis, G., Katsaros, K. V., Pantazopoulos, P., Sourlas, V. & Amditis, A. Federated vs. centralized machine learning under privacy-elastic users: a comparative analysis. In 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA) 1\u20138 (IEEE, 2020); https:\/\/doi.org\/10.1109\/nca51143.2020.9306745","DOI":"10.1109\/nca51143.2020.9306745"},{"key":"390_CR4","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1038\/s42256-020-0186-1","volume":"2","author":"GA Kaissis","year":"2020","unstructured":"Kaissis, G. A., Makowski, M. R., R\u00fcckert, D. & Braren, R. F. Secure, privacy-preserving and federated machine learning in medical imaging. Nat. Mach. Intell. 2, 305\u2013311 (2020).","journal-title":"Nat. Mach. Intell."},{"key":"390_CR5","unstructured":"McMahan, H. B., Moore, E., Ramage, D., Hampson, S. & Ag\u00fcera y Arcas, B. In Proc. 20th International Conference on Artificial Intelligence and Statistics Vol. 54 (eds Sing, A. & Zhu, J.) 1273\u20131282 (PMLR, 2017)"},{"key":"390_CR6","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1038\/s41586-021-03583-3","volume":"594","author":"S Warnat-Herresthal","year":"2021","unstructured":"Warnat-Herresthal, S. et al. Swarm learning for decentralized and confidential clinical machine learning. Nature 594, 265\u2013270 (2021).","journal-title":"Nature"},{"key":"390_CR7","unstructured":"Vepakomma, P., Gupta, O., Swedish, T. & Raskar, R. Split learning for health: distributed deep learning without sharing raw patient data. Preprint at https:\/\/arxiv.org\/abs\/1812.00564 (2018)."},{"key":"390_CR8","unstructured":"Brundage, M. et al. Toward trustworthy AI development: mechanisms for supporting verifiable claims. Preprint at https:\/\/arxiv.org\/abs\/2004.07213 (2020)."},{"key":"390_CR9","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1109\/MSEC.2020.3039941","volume":"19","author":"MS Jere","year":"2021","unstructured":"Jere, M. S., Farnan, T. & Koushanfar, F. A taxonomy of attacks on federated learning. IEEE Secur. Priv. 19, 20\u201328 (2021).","journal-title":"IEEE Secur. Priv."},{"key":"390_CR10","doi-asserted-by":"publisher","first-page":"70","DOI":"10.1561\/3300000019","volume":"2","author":"D Evans","year":"2018","unstructured":"Evans, D., Kolesnikov, V. & Rosulek, M. A pragmatic introduction to secure multi-party computation. Found. Trends Priv. Secur. 2, 70\u2013246 (2018).","journal-title":"Found. Trends Priv. Secur."},{"key":"390_CR11","doi-asserted-by":"crossref","unstructured":"Riazi, M. S. & Koushanfar, F. Privacy-preserving deep learning and inference. In 2018 IEEE\/ACM International Conference on Computer-Aided Design (ICCAD) 1\u20134 (IEEE, 2018).","DOI":"10.1145\/3240765.3274560"},{"key":"390_CR12","unstructured":"Fredrikson, M. et al. Privacy in pharmacogenetics: an end-to-end case study of personalized warfarin dosing. In Proc. 23rd USENIX Security Symposium 14 17\u201332 (USENIX, 2014)."},{"key":"390_CR13","doi-asserted-by":"publisher","unstructured":"Ganju, K., Wang, Q., Yang, W., Gunter, C. A. & Borisov, N. Property inference attacks on fully connected neural networks using permutation invariant representations. In Proc. 2018 ACM SIGSAC Conference on Computer and Communications Security 619-633 (ACM, 2018); https:\/\/doi.org\/10.1145\/3243734.3243834","DOI":"10.1145\/3243734.3243834"},{"key":"390_CR14","unstructured":"Mansourifar, H. & Shi, W. Vulnerability of face recognition systems against composite face reconstruction attack. Preprint at http:\/\/arxiv.org\/abs\/2009.02286 (2020)."},{"key":"390_CR15","unstructured":"Long, Y., Bindschaedler, V. & Gunter, C. A. Towards measuring membership privacy. Preprint at http:\/\/arxiv.org\/abs\/1712.09136 (2017)."},{"key":"390_CR16","doi-asserted-by":"crossref","unstructured":"He, Y., Rahimian, S., Schiele, B. & Fritz, M. In Computer Vision \u2013 ECCV 2020: Lecture Notes in Computer Science Vol. 12368 (eds Vedaldi, A. et al.) 519\u2013535 (Springer, 2020).","DOI":"10.1007\/978-3-030-58592-1_31"},{"key":"390_CR17","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C. & Shmatikov, V. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP) 3\u201318 (IEEE, 2017).","DOI":"10.1109\/SP.2017.41"},{"key":"390_CR18","unstructured":"Fang, M., Cao, X., Jia, J. & Gong, N. Local model poisoning attacks to Byzantine-robust federated learning. In Proc. 29th USENIX Security Symposium 20 1605\u20131622 (USENIX, 2020)."},{"key":"390_CR19","unstructured":"Bhagoji, A. N., Chakraborty, S., Mittal, P. & Calo, S. In International Conference on Machine Learning 634\u2013643 (PMLR, 2019)."},{"key":"390_CR20","unstructured":"Hayes, J. & Ohrimenko, O. Contamination Attacks and Mitigation in Multi-Party Machine Learning (NeurIPS, 2018)."},{"key":"390_CR21","unstructured":"Chang, H., Shejwalkar, V., Shokri, R. & Houmansadr, A. Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer. Preprint at http:\/\/arxiv.org\/abs\/1912.11279 (2019)."},{"key":"390_CR22","unstructured":"Wenger, E., Passananti, J., Yao, Y., Zheng, H. & Zhao, B. Y. Backdoor Attacks on Facial Recognition in the Physical World (CVPR, 2021)."},{"key":"390_CR23","unstructured":"Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D. & Shmatikov, V. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics 2938\u20132948 (PMLR, 2020)."},{"key":"390_CR24","unstructured":"Bagdasaryan, E. & Shmatikov, V. Blind Backdoors in Deep Learning Models (USENIX Security, 2021)."},{"key":"390_CR25","doi-asserted-by":"crossref","unstructured":"Biggio, B. et al. Evasion attacks against machine learning at test time. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases 387\u2013402 (Springer, 2013).","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"390_CR26","doi-asserted-by":"crossref","unstructured":"Chernikova, A., Oprea, A., Nita-Rotaru, C. & Kim, B. Are self-driving cars secure? Evasion attacks against deep neural networks for steering angle prediction. In 2019 IEEE Security and Privacy Workshops (SPW) 132\u2013137 (IEEE, 2019).","DOI":"10.1109\/SPW.2019.00033"},{"key":"390_CR27","unstructured":"Yan, M., Fletcher, C. W. & Torrellas, J. Cache telepathy: leveraging shared resource attacks to learn DNN architectures. In Proc. 29th USENIX Security Symposium 20 2003\u20132020 (USENIX, 2020)."},{"key":"390_CR28","doi-asserted-by":"publisher","first-page":"107","DOI":"10.46586\/tches.v2019.i2.107-131","volume":"2019","author":"B Timon","year":"2019","unstructured":"Timon, B. Non-profiled deep learning-based side-channel attacks with sensitivity analysis. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2019, 107\u2013131 (2019).","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"390_CR29","unstructured":"Leino, K. & Fredrikson, M. Stolen memories: leveraging model memorization for calibrated white-box membership inference. In Proc. 29th USENIX Security Symposium 20 1605\u20131622 (USENIX, 2020)."},{"key":"390_CR30","first-page":"61","volume":"11","author":"MA Rahman","year":"2018","unstructured":"Rahman, M. A., Rahman, T., Lagani\u00e8re, R., Mohammed, N. & Wang, Y. Membership inference attack against differentially private deep learning model. Trans. Data Priv. 11, 61\u201379 (2018).","journal-title":"Trans. Data Priv."},{"key":"390_CR31","unstructured":"Song, L. & Mittal, P. Systematic evaluation of privacy risks of machine learning models. In Proc. 30th USENIX Security Symposium 21 2615\u20132632 (USENIX, 2021)."},{"key":"390_CR32","unstructured":"Choo, C. A. C., Tramer, F., Carlini, N. & Papernot, N. In International Conference on Machine Learning 1964\u20131974 (PMLR, 2021)."},{"key":"390_CR33","unstructured":"Kaya, Y., Hong, S. & Dumitras, T. On the effectiveness of regularization against membership inference attacks. Preprint at https:\/\/arxiv.org\/abs\/2006.05336 (2020)."},{"key":"390_CR34","unstructured":"Park, Y. & Kang, M. Membership inference attacks against object detection models. Preprint at http:\/\/arxiv.org\/abs\/2001.04011 (2020)."},{"key":"390_CR35","doi-asserted-by":"crossref","unstructured":"Salem, A. et al. Ml-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (NDSS, 2019).","DOI":"10.14722\/ndss.2019.23119"},{"key":"390_CR36","unstructured":"Long, Y. et al. Understanding membership inferences on well-generalized learning models. Preprint at https:\/\/arxiv.org\/abs\/1802.04889 (2018)."},{"key":"390_CR37","first-page":"133","volume":"2019","author":"J Hayes","year":"2019","unstructured":"Hayes, J., Melis, L., Danezis, G. & De Cristofaro, E. Logan: membership inference attacks against generative models. Proc. Priv. Enhanc. Technol. 2019, 133\u2013152 (2019).","journal-title":"Proc. Priv. Enhanc. Technol."},{"key":"390_CR38","doi-asserted-by":"crossref","unstructured":"Samani, S. S. et al. Quantifying genomic privacy via inference attack with high-order SNV correlations. In 2015 IEEE Security and Privacy Workshops 32\u201340 (IEEE, 2015); https:\/\/ieeexplore.ieee.org\/document\/7163206\/","DOI":"10.1109\/SPW.2015.21"},{"key":"390_CR39","unstructured":"Wu, M. et al. Evaluation of inference attack models for deep learning on medical data. Preprint at http:\/\/arxiv.org\/abs\/2011.00177 (2020)."},{"key":"390_CR40","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R. & Houmansadr, A. Comprehensive privacy analysis of deep learning: passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE Symposium on Security and Privacy (SP) 739\u2013753 (IEEE, 2019).","DOI":"10.1109\/SP.2019.00065"},{"key":"390_CR41","unstructured":"Luo, X. & Zhu, X. Exploiting defenses against GAN-based feature inference attacks in federated learning. Preprint at https:\/\/arxiv.org\/abs\/2004.12571 (2020)."},{"key":"390_CR42","doi-asserted-by":"crossref","unstructured":"Melis, L., Song, C., Cristofaro, E. D. & Shmatikov, V. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP) 691\u2013706 (IEEE, 2019).","DOI":"10.1109\/SP.2019.00029"},{"key":"390_CR43","doi-asserted-by":"crossref","unstructured":"He, Z., Zhang, T. & Lee, R. B. Model inversion attacks against collaborative inference. In Proc. 35th Annual Computer Security Applications Conference 148\u2013162 (ACM, 2019).","DOI":"10.1145\/3359789.3359824"},{"key":"390_CR44","doi-asserted-by":"crossref","unstructured":"Hitaj, B., Ateniese, G. & Perez-Cruz, F. Deep models under the GAN: information leakage from collaborative deep learning. In Proc. 2017 ACM SIGSAC Conference on Computer and Communications Security 603\u2013618 (ACM, 2017).","DOI":"10.1145\/3133956.3134012"},{"key":"390_CR45","unstructured":"Zhang, Y. et al. In Proc. IEEE\/CVF Conference on Computer Vision and Pattern Recognition 253\u2013261 (CVPR, 2020)."},{"key":"390_CR46","unstructured":"Zhao, B., Mopuri, K. R. & Bilen, H. iDLG: Improved Deep Leakage from Gradients. Preprint at https:\/\/arxiv.org\/abs\/2001.02610 (2020)."},{"key":"390_CR47","first-page":"14747","volume":"32","author":"L Zhu","year":"2019","unstructured":"Zhu, L., Liu, Z. & Han, S. Deep leakage from gradients. Adv. Neural Inf. Process. Syst. 32, 14747\u201314756 (2019).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR48","unstructured":"Geiping, J., Bauermeister, H., Dr\u00f6ge, H. & Moeller, M. Inverting gradients\u2014how easy is it to break privacy in federated learning? Preprint at https:\/\/arxiv.org\/abs\/2003.14053 (2020)."},{"key":"390_CR49","doi-asserted-by":"publisher","unstructured":"Kaissis, G. et al. End-to-end privacy preserving deep learning on multi-institutional medical imaging. Nat. Mach. Intell. https:\/\/doi.org\/10.1038\/s42256-021-00337-8 (2021).","DOI":"10.1038\/s42256-021-00337-8"},{"key":"390_CR50","unstructured":"Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A. & Papernot, N. High accuracy and high fidelity extraction of neural networks. In Proc. 29th USENIX Security Symposium 20 (USENIX, 2020)."},{"key":"390_CR51","doi-asserted-by":"crossref","unstructured":"Oh, S. J., Schiele, B. & Fritz, M. in Explainable AI: Interpreting, Explaining and Visualizing Deep Learning (eds Samek, W. et al.) 121\u2013144 (Springer, 2019).","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"390_CR52","doi-asserted-by":"crossref","unstructured":"Chen, D., Yu, N., Zhang, Y. & Fritz, M. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proc. 2020 ACM SIGSAC Conference on Computer and Communications Security 343\u2013362 (ACM, 2020).","DOI":"10.1145\/3372297.3417238"},{"key":"390_CR53","doi-asserted-by":"crossref","unstructured":"Jagielski, M. et al. Manipulating machine learning: poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy (SP) 19\u201335 (IEEE, 2018).","DOI":"10.1109\/SP.2018.00057"},{"key":"390_CR54","doi-asserted-by":"publisher","first-page":"1893","DOI":"10.1109\/JBHI.2014.2344095","volume":"19","author":"M Mozaffari-Kermani","year":"2014","unstructured":"Mozaffari-Kermani, M., Sur-Kolay, S., Raghunathan, A. & Jha, N. K. Systematic poisoning attacks on and defenses for machine learning in healthcare. IEEE J. Biomed. Health Informatics 19, 1893\u20131905 (2014).","journal-title":"IEEE J. Biomed. Health Informatics"},{"key":"390_CR55","first-page":"1","volume":"33","author":"H Wang","year":"2020","unstructured":"Wang, H. et al. Attack of the tails: yes, you really can backdoor federated learning. Adv. Neural Inf. Process. Syst. 33, 1\u201315 (2020).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR56","doi-asserted-by":"crossref","unstructured":"Narodytska, N. & Kasiviswanathan, S. P. Simple Black-Box Adversarial Attacks on Deep Neural Networks Vol. 2 (CVPR Workshops, 2017).","DOI":"10.1109\/CVPRW.2017.172"},{"key":"390_CR57","unstructured":"Goodfellow, I. J., Shlens, J. & Szegedy, C. Explaining and Harnessing Adversarial Examples (ICLR, 2014)."},{"key":"390_CR58","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D. & Vladu, A. Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR, 2018)."},{"key":"390_CR59","doi-asserted-by":"crossref","unstructured":"Wang, J. & Zhang, H. Bilateral adversarial training: towards fast training of more robust models against adversarial attacks. In Proc. IEEE International Conference on Computer Vision 6629\u20136638 (IEEE, 2019).","DOI":"10.1109\/ICCV.2019.00673"},{"key":"390_CR60","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1145\/3446776","volume":"64","author":"C Zhang","year":"2016","unstructured":"Zhang, C., Bengio, S., Hardt, M., Recht, B. & Vinyals, O. Understanding deep learning (still) requires rethinking generalization. Comms ACM 64, 107\u2013115 (2016).","journal-title":"Comms ACM"},{"key":"390_CR61","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C. & Shmatikov, V. Membership Inference Attacks Against Machine Learning Models (IEEE, 2017).","DOI":"10.1109\/SP.2017.41"},{"key":"390_CR62","unstructured":"Hinton, G., Vinyals, O. & Dean, J. Distilling the Knowledge in a Neural Network (NIPS, 2014)."},{"key":"390_CR63","unstructured":"Papernot, N., McDaniel, P., Sinha, A. & Wellman, M. Towards the science of security and privacy in machine learning. Preprint at https:\/\/arxiv.org\/abs\/1611.03814 (2016)."},{"key":"390_CR64","unstructured":"Papernot, N., Abadi, M., Erlingsson, U., Goodfellow, I. & Talwar, K. Semi-Supervised Knowledge Transfer for Deep Learning from Private Training Data (ICLR, 2017)."},{"key":"390_CR65","unstructured":"Papernot, N. et al. Scalable Private Learning with Pate (ICLR, 2018)."},{"key":"390_CR66","unstructured":"Fay, D., Sj\u00f6lund, J. & Oechtering, T. J. Decentralized differentially private segmentation with pate. Preprint at https:\/\/arxiv.org\/abs\/2004.06567 (2020)."},{"key":"390_CR67","doi-asserted-by":"crossref","unstructured":"M\u00fcft\u00fco\u011flu, Z., Kizrak, M. A. & Yildlnm, T. Differential privacy practice on diagnosis of COVID-19 radiology imaging using EfficientNet. In 2020 International Conference on INnovations in Intelligent Systems and Applications (INISTA) 1\u20136 (IEEE, 2020).","DOI":"10.1109\/INISTA49547.2020.9194651"},{"key":"390_CR68","unstructured":"Dhillon, G. S. et al. Stochastic activation pruning for robust adversarial defense. Preprint at https:\/\/arxiv.org\/abs\/1803.01442 (2018)."},{"key":"390_CR69","doi-asserted-by":"crossref","unstructured":"Song, L., Shokri, R. & Mittal, P. Membership inference attacks against adversarially robust deep learning models. In 2019 IEEE Security and Privacy Workshops (SPW) 50-56 (IEEE, 2019).","DOI":"10.1109\/SPW.2019.00021"},{"key":"390_CR70","unstructured":"Xie, C., Koyejo, S. & Gupta, I. In International Conference on Machine Learning 10495\u201310503 (PMLR, 2020)."},{"key":"390_CR71","doi-asserted-by":"publisher","first-page":"30071","DOI":"10.1073\/pnas.1907375117","volume":"117","author":"D Bau","year":"2020","unstructured":"Bau, D. et al. Understanding the role of individual units in a deep neural network. Proc. Natl Acad. Sci. USA 117, 30071\u201330078 (2020).","journal-title":"Proc. Natl Acad. Sci. USA"},{"key":"390_CR72","doi-asserted-by":"crossref","unstructured":"Fu, Y., Wang, H., Xu, K., Mi, H. & Wang, Y. Mixup based privacy preserving mixed collaboration learning. In 2019 IEEE International Conference on Service-Oriented System Engineering (SOSE) 275\u20132755 (IEEE, 2019).","DOI":"10.1109\/SOSE.2019.00047"},{"key":"390_CR73","doi-asserted-by":"publisher","first-page":"960","DOI":"10.1214\/18-EJS1403","volume":"12","author":"P Vepakomma","year":"2018","unstructured":"Vepakomma, P., Tonde, C. & Elgammal, A. et al. Supervised dimensionality reduction via distance correlation maximization. Electron. J. Stat. 12, 960\u2013984 (2018).","journal-title":"Electron. J. Stat."},{"key":"390_CR74","unstructured":"Yin, D., Chen, Y., Ramchandran, K. & Bartlett, P. In International Conference on Machine Learning 5650\u20135659 (PMLR, 2018)."},{"key":"390_CR75","first-page":"3517","volume":"31","author":"J Steinhardt","year":"2017","unstructured":"Steinhardt, J., Koh, P. W. W. & Liang, P. S. Certified defenses for data poisoning attacks. Adv. Neural Inf. Process. Syst. 31, 3517\u20133529 (2017).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR76","first-page":"7167","volume":"31","author":"K Lee","year":"2018","unstructured":"Lee, K., Lee, K., Lee, H. & Shin, J. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Adv. Neural Inf. Process. Syst. 31, 7167\u20137177 (2018).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR77","unstructured":"Metzen, J. H., Genewein, T., Fischer, V. & Bischoff, B. On Detecting Adversarial Perturbations (ICLR, 2017)."},{"key":"390_CR78","doi-asserted-by":"crossref","unstructured":"Meng, D. & Chen, H. Magnet: a two-pronged defense against adversarial examples. In Proc. 2017 ACM SIGSAC Conference on Computer and Communications Security 135\u2013147 (ACM, 2017).","DOI":"10.1145\/3133956.3134057"},{"key":"390_CR79","first-page":"119","volume":"31","author":"P Blanchard","year":"2017","unstructured":"Blanchard, P., Guerraoui, R. & Stainer, J. et al. Machine learning with adversaries: Byzantine tolerant gradient descent. Adv. Neural Inf. Process. Syst. 31, 119\u2013129 (2017).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR80","first-page":"8635","volume":"32","author":"G Baruch","year":"2019","unstructured":"Baruch, G., Baruch, M. & Goldberg, Y. A little is enough: circumventing defenses for distributed learning. Adv. Neural Inf. Process. Syst. 32, 8635\u20138645 (2019).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"390_CR81","unstructured":"Mhamdi, E. M. E., Guerraoui, R. & Rouault, S. In International Conference on Machine Learning 3521\u20133530 (PMLR, 2018)."},{"key":"390_CR82","unstructured":"Levine, A. & Feizi, S. (De)randomized Smoothing for Certifiable Defense Against Patch Attacks (NeurIPS, 2020)."},{"key":"390_CR83","unstructured":"Gilmer, J. et al. In International Conference on Machine Learning 2280\u20132289 (PMLR, 2019)."},{"key":"390_CR84","unstructured":"Pinot, R., Ettedgui, R., Rizk, G., Chevaleyre, Y. & Atif, J. In International Conference on Machine Learning 7717\u20137727 (PMLR, 2020)."},{"key":"390_CR85","unstructured":"Mejia, F. A. et al. Robust or private? adversarial training makes models more vulnerable to privacy attacks. Preprint at https:\/\/arxiv.org\/abs\/1906.06449 (2019)."},{"key":"390_CR86","doi-asserted-by":"crossref","unstructured":"Nissenbaum, H. Privacy in Context: Technology, Policy, and the Integrity of Social Life (Stanford Univ. Press, 2009).","DOI":"10.1515\/9780804772891"},{"key":"390_CR87","unstructured":"Trask, A., Bluemke, E., Garfinkel, B., Cuervas-Mons, C. G. & Dafoe, A. Beyond privacy trade-offs with structured transparency. Preprint at https:\/\/arxiv.org\/abs\/2012.08347 (2020)."},{"key":"390_CR88","unstructured":"Roy, A. G., Siddiqui, S., P\u00f6lsterl, S., Navab, N. & Wachinger, C. Braintorrent: a peer-to-peer environment for decentralized federated learning. Preprint at https:\/\/arxiv.org\/abs\/1905.06731 (2019)."},{"key":"390_CR89","unstructured":"Wang, J., Cheng, Y., Li, Q. & Jiang, Y. Interface-based side channel attack against intel SGX. Preprint at https:\/\/arxiv.org\/abs\/1811.05378 (2018)."},{"key":"390_CR90","doi-asserted-by":"crossref","unstructured":"Liu, F., Yarom, Y., Ge, Q., Heiser, G. & Lee, R. B. Last-level cache side-channel attacks are practical. In 2015 IEEE Symposium on Security and Privacy 605\u2013622 (IEEE, 2015).","DOI":"10.1109\/SP.2015.43"},{"key":"390_CR91","unstructured":"Mu\u00f1oz-Gonz\u00e1lez, L., Co, K. T. & Lupu, E. C. Byzantine-robust federated machine learning through adaptive model averaging. Preprint at https:\/\/arxiv.org\/abs\/1909.05125 (2019)."},{"key":"390_CR92","unstructured":"Suciu, O., Marginean, R., Kaya, Y., Daume, H. III & Dumitras, T. When does machine learning fail? Generalized transferability for evasion and poisoning attacks. In Proc. 27th USENIX Security Symposium 18 1299\u20131316 (USENIX, 2018)."},{"key":"390_CR93","unstructured":"Chen, X., Liu, C., Li, B., Lu, K. & Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. Preprint at https:\/\/arxiv.org\/abs\/1712.05526 (2017)."},{"key":"390_CR94","unstructured":"Hesamifard, E., Takabi, H. & Ghasemi, M. Cryptodl: deep neural networks over encrypted data. Preprint at https:\/\/arxiv.org\/abs\/1711.05189 (2017)."},{"key":"390_CR95","unstructured":"Gilad-Bachrach, R. et al. Cryptonets: applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning 201\u2013210 (PMLR, 2016)."},{"key":"390_CR96","doi-asserted-by":"crossref","unstructured":"Mohassel, P. & Zhang, Y. SecureML: a system for scalable privacy-preserving machine learning. In 2017 IEEE Symposium on Security and Privacy (SP) 19\u201338 (IEEE, 2017).","DOI":"10.1109\/SP.2017.12"},{"key":"390_CR97","unstructured":"Juvekar, C., Vaikuntanathan, V. & Chandrakasan, A. GAZELLE: a low latency framework for secure neural network inference. In Proc. 27th USENIX Security Symposium 18 1651\u20131669 (USENIX, 2018)."},{"key":"390_CR98","doi-asserted-by":"crossref","unstructured":"Goldreich, O., Micali, S. & Wigderson, A. In Providing Sound Foundations for Cryptography: On the Work of Shafi Goldwasser and Silvio Micali 307\u2013328 (ACM Books, 2019).","DOI":"10.1145\/3335741.3335759"},{"key":"390_CR99","doi-asserted-by":"crossref","unstructured":"Rouhani, B. D., Riazi, M. S. & Koushanfar, F. Deepsecure: scalable provably-secure deep learning. In Proc. 55th Annual Design Automation Conference 2 (ACM, 2018).","DOI":"10.1145\/3195970.3196023"},{"key":"390_CR100","first-page":"1","volume":"2016","author":"V Costan","year":"2016","unstructured":"Costan, V. & Devadas, S. Intel SGX Explained. IACR Cryptol. ePrint Archive 2016, 1\u2013118 (2016).","journal-title":"IACR Cryptol. ePrint Archive"},{"key":"390_CR101","unstructured":"Ohrimenko, O. et al. Oblivious multi-party machine learning on trusted processors. In Proc. 25th USENIX Security Symposium 16 619\u2013636 (USENIX, 2016)."},{"key":"390_CR102","unstructured":"Dessouky, G., Frassetto, T. & Sadeghi, A.-R. HybCache: hybrid side-channel-resilient caches for trusted execution environments. In Proc. 29th USENIX Security Symposium 20 451\u2013468 (USENIX, 2020)."},{"key":"390_CR103","doi-asserted-by":"crossref","unstructured":"Sattler, F., Wiedemann, S., M\u00fcller, K.-R. & Samek, W. Robust and communication-efficient federated learning from non-iid data. IEEE Trans. Neural Netw. Learn. Syst. (2019).","DOI":"10.1109\/TNNLS.2019.2944481"},{"key":"390_CR104","unstructured":"Cisse, M., Bojanowski, P., Grave, E., Dauphin, Y. & Usunier, N. In International Conference on Machine Learning 854\u2013863 (PMLR, 2017)."},{"key":"390_CR105","doi-asserted-by":"crossref","unstructured":"Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D. & Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP) 656\u2013672 (IEEE, 2019).","DOI":"10.1109\/SP.2019.00044"},{"key":"390_CR106","unstructured":"Choudhury, O. et al. Differential Privacy-Enabled Federated Learning for Sensitive Health Data (NeurIPS, 2019)."},{"key":"390_CR107","doi-asserted-by":"crossref","unstructured":"Wu, B. et al. P3SGD: Patient privacy preserving SGD for regularizing deep CNNs in pathological image classification. In Proc. IEEE Conference on Computer Vision and Pattern Recognition 2099\u20132108 (IEEE, 2019).","DOI":"10.1109\/CVPR.2019.00220"},{"key":"390_CR108","unstructured":"McMahan, H. B. et al. A General Approach to Adding Differential Privacy to Iterative Training Procedures (NeurIPS, 2018)."},{"key":"390_CR109","doi-asserted-by":"crossref","unstructured":"Xu, M., Papadimitriou, A., Feldman, A. & Haeberlen, A. Using differential privacy to efficiently mitigate side channels in distributed analytics. In Proc. 11th European Workshop on Systems Security 1\u20136 (ACM, 2018).","DOI":"10.1145\/3193111.3193115"}],"container-title":["Nature Machine Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.nature.com\/articles\/s42256-021-00390-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s42256-021-00390-3","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s42256-021-00390-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T20:37:42Z","timestamp":1670099862000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.nature.com\/articles\/s42256-021-00390-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,9,17]]},"references-count":109,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2021,9]]}},"alternative-id":["390"],"URL":"https:\/\/doi.org\/10.1038\/s42256-021-00390-3","relation":{},"ISSN":["2522-5839"],"issn-type":[{"value":"2522-5839","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,9,17]]},"assertion":[{"value":"7 January 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 August 2021","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 September 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no competing interests.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}]}}