{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T16:30:48Z","timestamp":1777653048892,"version":"3.51.4"},"reference-count":78,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2023,12,18]],"date-time":"2023-12-18T00:00:00Z","timestamp":1702857600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Homomorphic encryption (HE) has emerged as a pivotal technology for secure neural network inference (SNNI), offering privacy-preserving computations on encrypted data. Despite active developments in this field, HE-based SNNI frameworks are impeded by three inherent limitations. Firstly, they cannot evaluate non-linear functions such as ReLU, the most widely adopted activation function in neural networks. Secondly, the permitted number of homomorphic operations on ciphertexts is bounded, consequently limiting the depth of neural networks that can be evaluated. Thirdly, the computational overhead associated with HE is prohibitively high, particularly for deep neural networks. In this paper, we introduce a novel paradigm designed to address the three limitations of HE-based SNNI. Our approach is an interactive approach that is solely based on HE, called iLHE. Utilizing the idea of iLHE, we present two protocols: ReLU, which facilitates the direct evaluation of the ReLU function on encrypted data, tackling the first limitation, and HeRefresh, which extends the feasible depth of neural network computations and mitigates the computational overhead, thereby addressing the second and third limitations. Based on HeReLU and HeRefresh protocols, we build a new framework for SNNI, named HeFUN. We prove that our protocols and the HeFUN framework are secure in the semi-honest security model. Empirical evaluations demonstrate that HeFUN surpasses current HE-based SNNI frameworks in multiple aspects, including security, accuracy, the number of communication rounds, and inference latency. Specifically, for a convolutional neural network with four layers on the MNIST dataset, HeFUN achieves 99.16% accuracy with an inference latency of 1.501 s, surpassing the popular HE-based framework CryptoNets proposed by Gilad-Bachrach, which achieves 98.52% accuracy with an inference latency of 3.479 s.<\/jats:p>","DOI":"10.3390\/fi15120407","type":"journal-article","created":{"date-parts":[[2023,12,18]],"date-time":"2023-12-18T11:28:07Z","timestamp":1702898887000},"page":"407","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["HeFUN: Homomorphic Encryption for Unconstrained Secure Neural Network Inference"],"prefix":"10.3390","volume":"15","author":[{"given":"Duy Tung Khanh","family":"Nguyen","sequence":"first","affiliation":[{"name":"Institute of Cybersecurity and Cryptology, School of Computing and Information Technology, University of Wollongong, Northfields Avenue, Wollongong, NSW 2522, Australia"}]},{"given":"Dung Hoang","family":"Duong","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology, School of Computing and Information Technology, University of Wollongong, Northfields Avenue, Wollongong, NSW 2522, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1562-5105","authenticated-orcid":false,"given":"Willy","family":"Susilo","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology, School of Computing and Information Technology, University of Wollongong, Northfields Avenue, Wollongong, NSW 2522, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3348-7014","authenticated-orcid":false,"given":"Yang-Wai","family":"Chow","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology, School of Computing and Information Technology, University of Wollongong, Northfields Avenue, Wollongong, NSW 2522, Australia"}]},{"given":"The Anh","family":"Ta","sequence":"additional","affiliation":[{"name":"CSIRO\u2019s Data61, Corner Vimiera & Pembroke Roads, Marsfield, NSW 2122, Australia"}]}],"member":"1968","published-online":{"date-parts":[[2023,12,18]]},"reference":[{"key":"ref_1","unstructured":"Tan, M., and Le, Q. (2019, January 9\u201315). Efficientnet: Rethinking model scaling for convolutional neural networks. Proceedings of the International Conference on Machine Learning, PMLR, Long Beach, CA, USA."},{"key":"ref_2","unstructured":"Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020). An image is worth 16 \u00d7 16 words: Transformers for image recognition at scale. arXiv."},{"key":"ref_3","first-page":"1877","article-title":"Language models are few-shot learners","volume":"33","author":"Brown","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_4","first-page":"5485","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2020","journal-title":"J. Mach. Learn. Res."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Park, D.S., Chan, W., Zhang, Y., Chiu, C.C., Zoph, B., Cubuk, E.D., and Le, Q.V. (2019). Specaugment: A simple data augmentation method for automatic speech recognition. arXiv.","DOI":"10.21437\/Interspeech.2019-2680"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Gulati, A., Qin, J., Chiu, C.C., Parmar, N., Zhang, Y., Yu, J., Han, W., Wang, S., Zhang, Z., and Wu, Y. (2020). Conformer: Convolution-augmented transformer for speech recognition. arXiv.","DOI":"10.21437\/Interspeech.2020-3015"},{"key":"ref_7","unstructured":"OpenAI (2023, November 03). ChatGPT. Available online: https:\/\/chat.openai.com."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017, January 22\u201326). Membership inference attacks against machine learning models. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.41"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3711","DOI":"10.1109\/TDSC.2021.3105111","article-title":"Minimax approximation of sign function by composite polynomial for homomorphic comparison","volume":"19","author":"Lee","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_10","unstructured":"Cheon, J.H., Kim, D., and Kim, D. (2020). Advances in Cryptology\u2013ASIACRYPT 2020, Proceedings of the 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, Republic of Korea, 7\u201311 December 2020, Springer. Proceedings, Part II 26."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Boemer, F., Costache, A., Cammarota, R., and Wierzynski, C. (2019, January 11). nGraph-HE2: A high-throughput framework for neural network inference on encrypted data. Proceedings of the 7th ACM Workshop on Encrypted Computing & Applied Homomorphic Cryptography, London, UK.","DOI":"10.1145\/3338469.3358944"},{"key":"ref_12","unstructured":"Gilad-Bachrach, R., Dowlin, N., Laine, K., Lauter, K., Naehrig, M., and Wernsing, J. (2016, January 20\u201322). Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. Proceedings of the International Conference on Machine Learning, PMLR, New York, NY, USA."},{"key":"ref_13","unstructured":"Gentry, C. (June, January 31). Fully homomorphic encryption using ideal lattices. Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing, Bethesda, MD, USA."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"117477","DOI":"10.1109\/ACCESS.2022.3219049","article-title":"A survey of deep learning architectures for privacy-preserving machine learning with fully homomorphic encryption","volume":"10","author":"Podschwadt","year":"2022","journal-title":"IEEE Access"},{"key":"ref_15","unstructured":"Juvekar, C., Vaikuntanathan, V., and Chandrakasan, A. (2018, January 15\u201317). GAZELLE: A low latency framework for secure neural network inference. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Boemer, F., Cammarota, R., Demmler, D., Schneider, T., and Yalame, H. (2020, January 25\u201328). MP2ML: A mixed-protocol machine learning framework for private inference. Proceedings of the 15th International Conference on Availability, Reliability and Security, Virtual Event.","DOI":"10.1145\/3407023.3407045"},{"key":"ref_17","unstructured":"Lehmkuhl, R., Mishra, P., Srinivasan, A., and Popa, R.A. (2021, January 11\u201313). Muse: Secure inference resilient to malicious clients. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual Event."},{"key":"ref_18","unstructured":"Chen, S., and Fan, J. (2022). SEEK: Model extraction attack against hybrid secure inference protocols. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Yao, A.C.C. (1986, January 27\u201329). How to generate and exchange secrets. Proceedings of the 27th Annual Symposium on Foundations of Computer Science (Sfcs 1986), Toronto, ON, Canada.","DOI":"10.1109\/SFCS.1986.25"},{"key":"ref_20","unstructured":"Mohassel, P., and Rindal, P. (2018, January 15\u201319). ABY3: A mixed protocol framework for machine learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada."},{"key":"ref_21","unstructured":"Goldreich, O. (2009). Foundations of Cryptography: Volume 2, Basic Applications, Cambridge University Press."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1007\/s001459910006","article-title":"Security and composition of multiparty cryptographic protocols","volume":"13","author":"Canetti","year":"2000","journal-title":"J. Cryptol."},{"key":"ref_23","unstructured":"Fan, J., and Vercauteren, F. (2023, November 13). Somewhat Practical Fully Homomorphic Encryption. Available online: https:\/\/eprint.iacr.org\/2012\/144."},{"key":"ref_24","unstructured":"Cheon, J.H., Kim, A., Kim, M., and Song, Y. (2017). Advances in Cryptology\u2013ASIACRYPT 2017, Proceedings of the 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, 3\u20137 December 2017, Springer. Proceedings, Part I 23."},{"key":"ref_25","unstructured":"Hesamifard, E., Takabi, H., and Ghasemi, M. (2017). CryptoDL: Deep neural networks over encrypted data. arXiv."},{"key":"ref_26","unstructured":"Chabanne, H., De Wargny, A., Milgram, J., Morel, C., and Prouff, E. (2023, November 13). Privacy-Preserving Classification on Deep Neural Network. Available online: https:\/\/eprint.iacr.org\/2017\/1114."},{"key":"ref_27","unstructured":"Chou, E., Beal, J., Levy, D., Yeung, S., Haque, A., and Fei-Fei, L. (2018). Faster cryptonets: Leveraging sparsity for real-world encrypted inference. arXiv."},{"key":"ref_28","first-page":"1330","article-title":"Towards the alexnet moment for homomorphic encryption: Hcnn, the first homomorphic cnn on encrypted data with gpus","volume":"9","author":"Jin","year":"2020","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Jiang, X., Kim, M., Lauter, K., and Song, Y. (2018, January 15\u201319). Secure outsourced matrix computation and application to neural networks. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3243837"},{"key":"ref_30","unstructured":"Brutzkus, A., Gilad-Bachrach, R., and Elisha, O. (2019, January 9\u201315). Low latency privacy preserving inference. Proceedings of the International Conference on Machine Learning. PMLR, Long Beach, CA, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Dathathri, R., Saarikivi, O., Chen, H., Laine, K., Lauter, K., Maleki, S., Musuvathi, M., and Mytkowicz, T. (2019, January 22). CHET: An optimizing compiler for fully-homomorphic neural-network inferencing. Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation, Phoenix, AZ, USA.","DOI":"10.1145\/3314221.3314628"},{"key":"ref_32","unstructured":"van Elsloo, T., Patrini, G., and Ivey-Law, H. (2019). SEALion: A framework for neural network inference on encrypted data. arXiv."},{"key":"ref_33","unstructured":"Boemer, F., Lao, Y., Cammarota, R., and Wierzynski, C. (May, January 30). nGraph-HE: A graph compiler for deep learning on homomorphically encrypted data. Proceedings of the 16th ACM International Conference on Computing Frontiers, Alghero, Italy."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1007\/s10623-012-9720-4","article-title":"Fully homomorphic SIMD operations","volume":"71","author":"Smart","year":"2014","journal-title":"Des. Codes Cryptogr."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Zagoruyko, S., and Komodakis, N. (2016). Wide residual networks. arXiv.","DOI":"10.5244\/C.30.87"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"34","DOI":"10.1007\/s00145-019-09319-x","article-title":"TFHE: Fast fully homomorphic encryption over the torus","volume":"33","author":"Chillotti","year":"2020","journal-title":"J. Cryptol."},{"key":"ref_38","unstructured":"Hubara, I., Courbariaux, M., Soudry, D., El-Yaniv, R., and Bengio, Y. (2016). Advances in Neural Information Processing Systems 29 (NIPS 2016), Curran Associates, Inc."},{"key":"ref_39","unstructured":"Bourse, F., Minelli, M., Minihold, M., and Paillier, P. (2018). Advances in Cryptology\u2013CRYPTO 2018, Proceedings of the 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, 19\u201323 August 2018, Springer. Proceedings, Part III 38."},{"key":"ref_40","unstructured":"Sanyal, A., Kusner, M., Gascon, A., and Kanade, V. (2018, January 10\u201315). TAPAS: Tricks to accelerate (encrypted) prediction as a service. Proceedings of the International Conference on Machine Learning. PMLR, Stockholm, Sweden."},{"key":"ref_41","first-page":"10035","article-title":"SHE: A fast and accurate deep neural network for encrypted data","volume":"32","author":"Lou","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_42","unstructured":"Clet, P.E., Stan, O., and Zuber, M. (2021). Applied Cryptography and Network Security Workshops, Proceedings of the ACNS 2021 Satellite Workshops, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S&P, SCI, SecMT, and SiMLA, Kamakura, Japan, 21\u201324 June 2021, Springer. Proceedings."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Rouhani, B.D., Riazi, M.S., and Koushanfar, F. (2018, January 24\u201329). Deepsecure: Scalable provably-secure deep learning. Proceedings of the 55th Annual Design Automation Conference, San Francisco, CA, USA.","DOI":"10.1145\/3195970.3196023"},{"key":"ref_44","unstructured":"Riazi, M.S., Samragh, M., Chen, H., Laine, K., Lauter, K., and Koushanfar, F. (2019, January 14\u201316). XONN: XNOR-based oblivious deep neural network inference. Proceedings of the 28th USENIX Security Symposium (USENIX Security 19), Santa Clara, CA, USA."},{"key":"ref_45","unstructured":"Ball, M., Carmer, B., Malkin, T., Rosulek, M., and Schimanski, N. (2023, November 13). Garbled Neural Networks Are Practical. Available online: https:\/\/eprint.iacr.org\/2019\/338."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Ng, L.K., and Chow, S.S. (2023, January 22\u201324). SoK: Cryptographic Neural-Network Computation. Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46215.2023.10179483"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"612","DOI":"10.1145\/359168.359176","article-title":"How to share a secret","volume":"22","author":"Shamir","year":"1979","journal-title":"Commun. ACM"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Micali, S., Goldreich, O., and Wigderson, A. (1987, January 25\u201327). How to play any mental game. Proceedings of the Nineteenth ACM Symposium on Theory of Computing (STOC), New York, NY, USA.","DOI":"10.1145\/28395.28420"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Mohassel, P., and Zhang, Y. (2017, January 22\u201326). SecureML: A system for scalable privacy-preserving machine learning. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.12"},{"key":"ref_50","unstructured":"Patra, A., Schneider, T., Suresh, A., and Yalame, H. (2021, January 11\u201313). ABY2. 0: Improved Mixed-Protocol Secure Two-Party Computation. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual Event."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Agrawal, N., Shahin Shamsabadi, A., Kusner, M.J., and Gasc\u00f3n, A. (2019, January 11\u201315). QUOTIENT: Two-party secure neural network training and prediction. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3339819"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Riazi, M.S., Weinert, C., Tkachenko, O., Songhori, E.M., Schneider, T., and Koushanfar, F. (2018, January 4\u20138). Chameleon: A hybrid secure computation framework for machine learning applications. Proceedings of the 2018 on Asia Conference on Computer and Communications Security, Incheon, Republic of Korea.","DOI":"10.1145\/3196494.3196522"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"26","DOI":"10.2478\/popets-2019-0035","article-title":"SecureNN: 3-Party Secure Computation for Neural Network Training","volume":"2019","author":"Wagh","year":"2019","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Wagh, S., Tople, S., Benhamouda, F., Kushilevitz, E., Mittal, P., and Rabin, T. (2020). Falcon: Honest-majority maliciously secure framework for private deep learning. arXiv.","DOI":"10.2478\/popets-2021-0011"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Kumar, N., Rathee, M., Chandran, N., Gupta, D., Rastogi, A., and Sharma, R. (2020, January 18\u201321). CrypTFlow: Secure tensorflow inference. Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP40000.2020.00092"},{"key":"ref_56","first-page":"4961","article-title":"Crypten: Secure multi-party computation meets machine learning","volume":"34","author":"Knott","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Demmler, D., Schneider, T., and Zohner, M. (2015, January 8\u201311). ABY-A framework for efficient mixed-protocol secure two-party computation. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2015.23113"},{"key":"ref_58","unstructured":"Halevi, S., and Shoup, V. (2014). Advances in Cryptology\u2013CRYPTO 2014, Proceedings of the 34th Annual Cryptology Conference, Santa Barbara, CA, USA, 17\u201321 August 2014, Springer. Proceedings, Part I 34."},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"30039","DOI":"10.1109\/ACCESS.2022.3159694","article-title":"Privacy-preserving machine learning with fully homomorphic encryption for deep neural network","volume":"10","author":"Lee","year":"2022","journal-title":"IEEE Access"},{"key":"ref_60","unstructured":"Benaissa, A., Retiat, B., Cebere, B., and Belfedhal, A.E. (2021). TenSEAL: A library for encrypted tensor operations using homomorphic encryption. arXiv."},{"key":"ref_61","unstructured":"Lou, Q., and Jiang, L. (2021, January 18\u201324). Hemet: A homomorphic-encryption-friendly privacy-preserving mobile neural network architecture. Proceedings of the International Conference on Machine Learning, PMLR, Virtual."},{"key":"ref_62","unstructured":"Lyubashevsky, V., Peikert, C., and Regev, O. (2010). Advances in Cryptology\u2013EUROCRYPT 2010, Proceedings of the 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, 30 May\u20133 June 2010, Springer. Proceedings 29."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Cheon, J.H., Kim, D., Kim, D., Lee, H.H., and Lee, K. (2019, January 8\u201312). Numerical method for comparison on homomorphically encrypted numbers. Proceedings of the International Conference on the Theory and Application of Cryptology and Information Security, Kobe, Japan.","DOI":"10.1007\/978-3-030-34621-8_15"},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"26163","DOI":"10.1109\/ACCESS.2022.3155882","article-title":"Optimization of homomorphic comparison algorithm on rns-ckks scheme","volume":"10","author":"Lee","year":"2022","journal-title":"IEEE Access"},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1007\/BF00994018","article-title":"Support-vector networks","volume":"20","author":"Cortes","year":"1995","journal-title":"Mach. Learn."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"603","DOI":"10.1109\/34.1000236","article-title":"Mean shift: A robust approach toward feature space analysis","volume":"24","author":"Comaniciu","year":"2002","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"1189","DOI":"10.1214\/aos\/1013203451","article-title":"Greedy function approximation: A gradient boosting machine","volume":"29","author":"Friedman","year":"2001","journal-title":"Ann. Stat."},{"key":"ref_68","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2633600","article-title":"(Leveled) fully homomorphic encryption without bootstrapping","volume":"6","author":"Brakerski","year":"2014","journal-title":"ACM Trans. Comput. Theory (TOCT)"},{"key":"ref_69","doi-asserted-by":"crossref","unstructured":"Mishra, P., Lehmkuhl, R., Srinivasan, A., Zheng, W., and Popa, R.A. (2020, January 9\u201313). Delphi: A cryptographic inference system for neural networks. Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, Virtual Event.","DOI":"10.1145\/3411501.3419418"},{"key":"ref_70","unstructured":"Al Badawi, A., and Polyakov, Y. (2023, November 13). Demystifying Bootstrapping in Fully Homomorphic Encryption. Available online: https:\/\/eprint.iacr.org\/2023\/149."},{"key":"ref_71","unstructured":"Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., and Antiga, L. (2019). Pytorch: An imperative style, high-performance deep learning library. Adv. Neural Inf. Process. Syst., 8024\u20138035."},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Albrecht, M., Chase, M., Chen, H., Ding, J., Goldwasser, S., Gorbunov, S., Halevi, S., Hoffstein, J., Laine, K., and Lauter, K. (2021). Protecting Privacy through Homomorphic Encryption, Springer.","DOI":"10.1007\/978-3-030-77287-1_2"},{"key":"ref_73","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-based learning applied to document recognition","volume":"86","author":"LeCun","year":"1998","journal-title":"Proc. IEEE"},{"key":"ref_74","unstructured":"Samaria, F.S., and Harter, A.C. (1994, January 5\u20137). Parameterisation of a stochastic model for human face identification. In Proceedings of 2nd IEEE Workshop on Applications of Computer Vision, Sarasota, FL, USA."},{"key":"ref_75","unstructured":"Tram\u00e8r, F., Zhang, F., Juels, A., Reiter, M.K., and Ristenpart, T. (2016, January 10\u201312). Stealing machine learning models via prediction APIs. Proceedings of the 25th USENIX security symposium (USENIX Security 16), Austin, TX, USA."},{"key":"ref_76","doi-asserted-by":"crossref","unstructured":"Carlini, N., Jagielski, M., and Mironov, I. (2020, January 17\u201321). Cryptanalytic extraction of neural network models. Proceedings of the Annual International Cryptology Conference, Barbara, CA, USA.","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"ref_77","unstructured":"A\u00efvodji, U., Gambs, S., and Ther, T. (2019). Gamin: An adversarial approach to black-box model inversion. arXiv."},{"key":"ref_78","doi-asserted-by":"crossref","unstructured":"Bekman, T., Abolfathi, M., Jafarian, H., Biswas, A., Banaei-Kashani, F., and Das, K. (2021, January 13\u201317). Practical black box model inversion attacks against neural nets. Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases, Bilbao, Spain.","DOI":"10.1007\/978-3-030-93733-1_3"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/12\/407\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:41:06Z","timestamp":1760132466000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/12\/407"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12,18]]},"references-count":78,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["fi15120407"],"URL":"https:\/\/doi.org\/10.3390\/fi15120407","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,12,18]]}}}