{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,18]],"date-time":"2026-04-18T08:11:16Z","timestamp":1776499876173,"version":"3.51.2"},"reference-count":139,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Department of Defense Scalable Asymmetric Lifecycle Engagement (SCALE) program"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3561721","type":"journal-article","created":{"date-parts":[[2025,4,16]],"date-time":"2025-04-16T17:52:23Z","timestamp":1744825943000},"page":"67821-67855","source":"Crossref","is-referenced-by-count":4,"title":["Privacy-Preserving Deep Learning: A Survey on Theoretical Foundations, Software Frameworks, and Hardware Accelerators"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-5511-7975","authenticated-orcid":false,"given":"Eric","family":"Jahns","sequence":"first","affiliation":[{"name":"Secure, Trusted, and Assured Microelectronics Center (STAM), Arizona State University, Tempe, AZ, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0602-0606","authenticated-orcid":false,"given":"Milan","family":"Stojkov","sequence":"additional","affiliation":[{"name":"Faculty of Technical Sciences, University of Novi Sad, Novi Sad, Serbia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1432-6939","authenticated-orcid":false,"given":"Michel A.","family":"Kinsy","sequence":"additional","affiliation":[{"name":"Secure, Trusted, and Assured Microelectronics Center (STAM), Arizona State University, Tempe, AZ, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-020-01096-5"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/HOTI63208.2024.00013"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2018.2888775"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref5","first-page":"201","article-title":"CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy","volume-title":"Proc. 33rd Int. Conf. Mach. Learn.","volume":"48","author":"Dowlin"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2023.3319492"},{"key":"ref7","article-title":"A fully homomorphic encryption scheme","author":"Gentry","year":"2009"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19571-6_16"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-33386-6_27"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/508171.508174"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20901-7_2"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382279"},{"key":"ref13","article-title":"Federated optimization: Distributed machine learning for on-device intelligence","author":"Konecn\u00fd","year":"2016"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.357"},{"key":"ref15","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103605","article-title":"Preserving data privacy in machine learning systems","volume":"137","author":"El Mestari","year":"2024","journal-title":"Comput. Secur."},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2023.3338220"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CSR57506.2023.10224826"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3058638"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3219049"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-68035-0_9"},{"key":"ref21","article-title":"Privacy-preserving machine learning: Methods, challenges and directions","author":"Xu","year":"2021"},{"key":"ref22","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1016\/j.neucom.2019.11.041","article-title":"A review of privacy-preserving techniques for deep learning","volume":"384","author":"Boulemtafes","year":"2020","journal-title":"Neurocomputing"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2090236.2090262"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70694-8_15"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-019-09319-x"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-45239-0_4"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39568-7_2"},{"key":"ref28","first-page":"420","article-title":"Efficient multiparty protocols using circuit randomization","volume-title":"Advances in Cryptology","author":"Beaver","year":"1992"},{"key":"ref29","first-page":"187","article-title":"How to exchange secrets with oblivious transfer","volume":"2005","author":"Rabin","year":"2005","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3564246.3585127"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/359168.359176"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1986.25"},{"key":"ref33","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103180","article-title":"A survey on the (in)security of trusted execution environments","volume":"129","author":"Mu\u00f1oz","year":"2023","journal-title":"Comput. Secur."},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-021-00105-6"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"issue":"3","key":"ref36","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1515\/popets-2018-0024","article-title":"Privacy-preserving machine learning as a service","volume":"2018","author":"Hesamifard","year":"2018","journal-title":"Proc. Privacy Enhancing Technol."},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/547"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3267973.3267976"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243837"},{"key":"ref40","doi-asserted-by":"crossref","first-page":"507","DOI":"10.1016\/j.ins.2018.12.015","article-title":"Non-interactive privacy-preserving neural network prediction","volume":"481","author":"Ma","year":"2019","journal-title":"Inf. Sci."},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/671"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363207"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3591197.3591306"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00942"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3570361.3592501"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3234278"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1155\/2023\/8292559"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3605098.3635983"},{"key":"ref49","first-page":"1","article-title":"Partially encrypted machine learning using functional encryption","volume-title":"Proc. 33rd Conf. Neural Inf. Process. Syst.","author":"Ryffel"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TPSISA52974.2021.00003"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3579987.3586566"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ALLERTON.2015.7447103"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3195970.3196023"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196522"},{"key":"ref57","volume-title":"Securenn: Efficient and Private Neural Network Training","author":"Wagh","year":"2018"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243760"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00043"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339819"},{"issue":"2","key":"ref61","doi-asserted-by":"crossref","first-page":"459","DOI":"10.2478\/popets-2020-0036","article-title":"FLASH: Fast and robust framework for privacy-preserving machine learning","volume":"2020","author":"Byali","year":"2020","journal-title":"Proc. Privacy Enhancing Technol."},{"key":"ref62","first-page":"1501","article-title":"XONN: XNOR-based oblivious deep neural network inference","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Riazi"},{"key":"ref63","article-title":"Soteria: In search of efficient neural networks for private inference","author":"Aggarwal","year":"2020"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3138611"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/IEMCON51383.2020.9284891"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0011"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/sp40000.2020.00092"},{"key":"ref68","volume-title":"Blaze: Blazing Fast Privacy-preserving Machine Learning","author":"Patra","year":"2020"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23005"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2913362"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/JSAIT.2021.3053220"},{"key":"ref72","article-title":"Swift: Super-fast and robust privacy-preserving machine learning","author":"Koti","year":"2021"},{"key":"ref73","volume-title":"Tetrad: Actively Secure 4pc for Secure Training and Inference","author":"Koti","year":"2021"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3029899"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/DSC61021.2023.10354193"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00045"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW60847.2023.00033"},{"key":"ref78","volume-title":"Aegis: A Lightning Fast Privacy-preserving Machine Learning Platform Against Malicious Adversaries","author":"Lu","year":"2023"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357371"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/s00287-019-01205-x"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2952332"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3507473.3507478"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/EEBDA53927.2022.9744805"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3625343.3625344"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/csp58884.2023.00026"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2946202"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2952146"},{"issue":"23","key":"ref88","first-page":"1","article-title":"Deep learning with Gaussian differential privacy","volume":"2020","author":"Bu","year":"2020","journal-title":"Harvard Data Sci. Rev."},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/EMBC48229.2022.9871742"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/cscwd57460.2023.10152822"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/CSCWD57460.2023.10152847"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SiPS47522.2019.9020592"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD46524.2019.00053"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/tetc.2020.3014636"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3114032"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS51556.2021.9401623"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/ASID52932.2021.9651679"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/FPL53798.2021.00027"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA51647.2021.00013"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3508352.3549413"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/ICFPT56656.2022.9974369"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2022.3228628"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1145\/3613424.3614302"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2023.3292211"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPS54959.2023.00084"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1145\/3242899"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/h2rc49586.2019.00008"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/3411501.3419418"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2021.3059108"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/sp40001.2021.00098"},{"key":"ref111","article-title":"Crypten: Secure multi-party computation meets machine learning","author":"Knott","year":"2022","journal-title":"arXiv:2109.00984"},{"key":"ref112","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102782","article-title":"LEGO: A hybrid toolkit for efficient 2PC-based privacy-preserving machine learning","volume":"120","author":"Zhou","year":"2022","journal-title":"Comput. Secur."},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1145\/3613424.3614297"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/DAC56929.2023.10247663"},{"key":"ref115","first-page":"681","article-title":"Graviton: Trusted execution environments on GPUs","volume-title":"Proc. 13th USENIX Symp. Operating Syst. Design Implement.","author":"Volos"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.12794\/metadc1703277"},{"key":"ref117","article-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Tram\u00e8r"},{"key":"ref118","article-title":"Privacy-preserving inference in machine learning services using trusted execution environments","author":"Narra","year":"2019"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421376"},{"key":"ref120","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1016\/j.ins.2020.02.037","article-title":"A training-integrity privacy-preserving federated learning scheme with trusted execution environment","volume":"522","author":"Chen","year":"2020","journal-title":"Inf. Sci."},{"key":"ref121","article-title":"Customizing trusted AI accelerators for efficient privacy-preserving machine learning","author":"Xie","year":"2020"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/3386901.3388946"},{"key":"ref123","volume-title":"Chex-mix: Combining Homomorphic Encryption With Trusted Execution Environments for Two-party Oblivious Inference in the Cloud","author":"Natarajan","year":"2021"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/IC-NIDC54101.2021.9660433"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480112"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/3489517.3530439"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/PerComWorkshops53856.2022.9767528"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/DAC56929.2023.10247768"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2024-0119"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/csr57506.2023.10224999"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD57390.2023.10323851"},{"key":"ref132","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103509","article-title":"HT2ML: An efficient hybrid framework for privacy-preserving machine learning using HE and TEE","volume":"135","author":"Wang","year":"2023","journal-title":"Comput. Secur."},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/ICC45041.2023.10278683"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/iccad57390.2023.10323746"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.14711\/thesis-991012879963103412"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3093711"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3347521"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/HOST55118.2023.10133266"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-42045-0_16"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/10966886.pdf?arnumber=10966886","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,24]],"date-time":"2025-04-24T17:07:08Z","timestamp":1745514428000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10966886\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":139,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3561721","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}