{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T17:30:30Z","timestamp":1785259830868,"version":"3.55.0"},"reference-count":160,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100004410","name":"The Scientific and Technological Research Council of Turkey (TUBITAK) through the 1515 Frontier Research and Development Laboratories Support Program","doi-asserted-by":"publisher","award":["5169902"],"award-info":[{"award-number":["5169902"]}],"id":[{"id":"10.13039\/501100004410","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100010661","name":"European Commission through the H2020 Project Hexa-X","doi-asserted-by":"publisher","award":["101015956"],"award-info":[{"award-number":["101015956"]}],"id":[{"id":"10.13039\/100010661","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/access.2022.3204037","type":"journal-article","created":{"date-parts":[[2022,9,5]],"date-time":"2022-09-05T20:05:37Z","timestamp":1662408337000},"page":"97495-97519","source":"Crossref","is-referenced-by-count":33,"title":["A Survey and Guideline on Privacy Enhancing Technologies for Collaborative Machine Learning"],"prefix":"10.1109","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7908-1469","authenticated-orcid":false,"given":"Elif","family":"Ustundag Soykan","sequence":"first","affiliation":[{"name":"Ericsson Research, Istanbul, Türkiye"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8878-9904","authenticated-orcid":false,"given":"Leyli","family":"Karacay","sequence":"additional","affiliation":[{"name":"Ericsson Research, Istanbul, Türkiye"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6139-6668","authenticated-orcid":false,"given":"Ferhat","family":"Karakoc","sequence":"additional","affiliation":[{"name":"Ericsson Research, Istanbul, Türkiye"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8985-4974","authenticated-orcid":false,"given":"Emrah","family":"Tomur","sequence":"additional","affiliation":[{"name":"Ericsson Research, Istanbul, Türkiye"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Artificial intelligence in next-generation connected systems","author":"Berggren","year":"2021"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2017.2718515"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2020.2997051"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2021.3110104"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29053-5_14"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref8","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018","journal-title":"arXiv:1810.00069"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.10.007"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2021.104468"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2019.11.041"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2021.3124599"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3460427"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1561\/2200000083"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/DSC.2018.00104"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.001.1900506"},{"key":"ref18","article-title":"No peek: A survey of private distributed deep learning","author":"Vepakomma","year":"2018","journal-title":"arXiv:1812.03288"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_1"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-70604-3_8"},{"key":"ref22","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume-title":"Proc. 20th Int. Conf. Artif. Intell. Statist.","author":"McMahan"},{"key":"ref23","article-title":"TensorFlow: Large-scale machine learning on heterogeneous distributed systems","author":"Abadi","year":"2016","journal-title":"arXiv:1603.04467"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2929409"},{"key":"ref25","article-title":"Applied federated learning: Improving Google keyboard query suggestions","author":"Yang","year":"2018","journal-title":"arXiv:1812.02903"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.2200\/s00960ed2v01y201910aim043"},{"key":"ref27","first-page":"125","article-title":"Privacy-preserving analysis of vertically partitioned data using secure matrix products","volume":"25","author":"Karr","year":"2009","journal-title":"J. Off. Statist."},{"key":"ref28","article-title":"Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption","author":"Hardy","year":"2017","journal-title":"arXiv:1711.10677"},{"key":"ref29","article-title":"A communication efficient vertical federated learning framework","author":"Liu","year":"2019","journal-title":"arXiv:1912.11187"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2009.191"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.2988525"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006280"},{"key":"ref34","article-title":"Split learning for health: Distributed deep learning without sharing raw patient data","author":"Vepakomma","year":"2018","journal-title":"arXiv:1812.00564"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i8.20825"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384740"},{"key":"ref37","article-title":"Federated learning with non-IID data","author":"Zhao","year":"2018","journal-title":"arXiv:1806.00582"},{"key":"ref38","article-title":"Deep gradient compression: Reducing the communication bandwidth for distributed training","author":"Lin","year":"2017","journal-title":"arXiv:1712.01887"},{"key":"ref39","article-title":"Detailed comparison of communication efficiency of split learning and federated learning","author":"Singh","year":"2019","journal-title":"arXiv:1909.09145"},{"key":"ref40","article-title":"Comparing decentralized learning to federated learning when training deep neural networks under churn","author":"Vikstr\u00f6m","year":"2021"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ai.100-2"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref43","article-title":"Adversarial attacks on neural network policies","author":"Huang","year":"2017","journal-title":"arXiv:1702.02284"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref45","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","volume":"97","author":"Guo"},{"key":"ref46","first-page":"551","volume-title":"A note on the relation between the definitions of security for semi-honest and malicious adversaries","volume":"2010","author":"Hazay","year":"2010"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1602.05629"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref50","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"Chen","year":"2018","journal-title":"arXiv:1811.03728"},{"key":"ref51","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Bagdasaryan"},{"key":"ref52","article-title":"Mitigating sybil attacks on differential privacy based federated learning","author":"Jiang","year":"2020","journal-title":"arXiv:2010.10572"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CISS.2018.8362326"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ALLERTON.2015.7447103"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2019.2897554"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475591"},{"key":"ref58","article-title":"Prediction poisoning: Towards defenses against DNN model stealing attacks","author":"Orekondy","year":"2019","journal-title":"arXiv:1906.10908"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/GCWkshps45667.2019.9024520"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3338027"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1561\/9781601988195"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/csf.2017.11"},{"key":"ref63","first-page":"1","article-title":"Learning differentially private recurrent language models","volume-title":"Proc. 6th Int. Conf. Learn. Represent.","author":"McMahan"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/focs.2014.56"},{"key":"ref65","first-page":"1","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","volume-title":"Proc. 5th Int. Conf. Learn. Represent.","author":"Papernot"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"key":"ref67","first-page":"7575","article-title":"cpSGD: Communication-efficient and differentially-private distributed SGD","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Agarwal"},{"key":"ref68","article-title":"Protection against reconstruction and its applications in private federated learning","author":"Bhowmick","year":"2018","journal-title":"arXiv:1812.00984"},{"key":"ref69","article-title":"Differentially private federated learning: A client level perspective","author":"Geyer","year":"2017","journal-title":"arXiv:1712.07557"},{"key":"ref70","article-title":"Learning differentially private recurrent language models","author":"McMahan","year":"2017","journal-title":"arXiv:1710.06963"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31594-7_39"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/focs.2013.53"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660348"},{"key":"ref74","volume-title":"Learning With Privacy AT Scale","year":"2022"},{"key":"ref75","first-page":"3571","article-title":"Collecting telemetry data privately","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ding"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2018.2805356"},{"key":"ref77","first-page":"967","article-title":"PCKV: Locally differentially private correlated key-value data collection with optimized utility","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Gu"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2019.00018"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/icde.2019.00063"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.2017.1389735"},{"key":"ref81","article-title":"Collecting and analyzing data from smart device users with local differential privacy","author":"Nguy\u011bn","year":"2016","journal-title":"arXiv:1606.05053"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/cns.2019.8802778"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/icde48307.2020.00050"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2020.3037194"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394533"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/217"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23054"},{"key":"ref88","article-title":"Can you really backdoor federated learning?","author":"Sun","year":"2019","journal-title":"arXiv:1911.07963"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-24178-9_9"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2015.2484326"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-17653-2_13"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611975482.151"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132769"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-17653-2_13"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/isit.2008.4595310"},{"key":"ref98","article-title":"A fully homomorphic encryption scheme","author":"Gentry","year":"2009"},{"key":"ref99","first-page":"1","article-title":"Analysis of partially and fully homomorphic encryption","author":"Morris","year":"2013"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48910-x_16"},{"key":"ref101","first-page":"144","volume-title":"Somewhat practical fully homomorphic encryption","author":"Fan","year":"2012"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-12229-8_3"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/access.2019.2949782"},{"key":"ref104","first-page":"493","article-title":"BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Zhang"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0071"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1145\/2213977.2214086"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/CCEM.2014.7015496"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1587\/transinf.2015inp0020"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2017.2787987"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.2988604"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.3390\/fi13040094"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.3390\/app12020734"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1007\/s40747-021-00519-2"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1986.25"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3335741.3335755"},{"key":"ref116","first-page":"187","article-title":"How to exchange secrets with oblivious transfer","volume":"2005","author":"Rabin","year":"2005","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45146-4_9"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354255"},{"key":"ref119","article-title":"Privacy-preserving aggregation of time-series data","volume-title":"Proc. NDSS","author":"Shi"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN49398.2020.9209670"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463572"},{"key":"ref122","first-page":"25","article-title":"FLGUARD: Secure and private federated learning","volume":"2021","author":"Nguyen","year":"2021","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/SPW53761.2021.00017"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2012.6459985"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88313-5_13"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58951-6_20"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/1161366.1161393"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/DAC.2018.8465894"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972740.21"},{"key":"ref133","article-title":"PrivPy: Enabling scalable and general privacy-preserving computation","author":"Li","year":"2018","journal-title":"arXiv:1801.10117"},{"key":"ref134","first-page":"35","article-title":"ABY3: A mixed protocol framework for machine learning","volume-title":"Proc. ACM SIGSAC Conf. Comput. Commun. Secur.","author":"Mohassel"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2017-0053"},{"key":"ref136","article-title":"A survey of published attacks on Intel SGX","author":"Nilsson","year":"2020","journal-title":"arXiv:2006.13598"},{"key":"ref137","article-title":"Mitigating sybils in federated learning poisoning","author":"Fung","year":"2018","journal-title":"arXiv:1808.04866"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3345447"},{"key":"ref139","article-title":"Chiron: Privacy-preserving machine learning as a service","author":"Hunt","year":"2018","journal-title":"arXiv:1803.05961"},{"key":"ref140","article-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware","author":"Tram\u00e8r","year":"2018","journal-title":"arXiv:1806.03287"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00044"},{"key":"ref142","article-title":"Efficient deep learning on multi-source private data","author":"Hynes","year":"2018","journal-title":"arXiv:1807.06689"},{"key":"ref143","article-title":"Privacy-preserving inference in machine learning services using trusted execution environments","author":"Narra","year":"2019","journal-title":"arXiv:1912.03485"},{"key":"ref144","article-title":"DarKnight: A data privacy scheme for training and inference of deep neural networks","author":"Hashemi","year":"2020","journal-title":"arXiv:2006.01300"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i17.17746"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.02.037"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.18280\/isi.270117"},{"key":"ref148","article-title":"Efficient and private federated learning using tee","volume-title":"Proc. EuroSyst. Conf.","author":"Mo"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1145\/3386901.3388946"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1145\/3458864.3466628"},{"key":"ref151","article-title":"Yerbabuena: Securing deep learning inference data via enclave-based ternary model partitioning","author":"Gu","year":"2018","journal-title":"arXiv:1807.00969"},{"key":"ref152","first-page":"165","article-title":"A survey on entity alignment of knowledge base","volume":"53","author":"Yan","year":"2016","journal-title":"J. Comput. Res. Develop."},{"key":"ref153","article-title":"Pervasive artificial intelligence in next generation wireless: The Hexa-X project perspective","volume-title":"Proc. 1st Int. Workshop Artif. Intell. Beyond 5G 6G Wireless Networks","author":"Miltiadis"},{"key":"ref154","article-title":"CECILIA: Comprehensive secure machine learning framework","author":"\u00dcnal","year":"2022","journal-title":"arXiv:2202.03023"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3322205.3311076"},{"key":"ref156","first-page":"645","article-title":"Graphene-SGX: A practical library OS for unmodified applications on SGX","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Tsai"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378469"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1145\/3152701.3152710"},{"key":"ref159","volume-title":"Anjuna Confidential Cloud Software","year":"2022"},{"key":"ref160","first-page":"689","article-title":"SCONE: Secure Linux containers with Intel SGX","volume-title":"Proc. OSDI","author":"Arnautov"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9668973\/09875277.pdf?arnumber=9875277","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T12:18:14Z","timestamp":1706789894000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9875277\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":160,"URL":"https:\/\/doi.org\/10.1109\/access.2022.3204037","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}