The SecureCROWN framework is built upon secure two-party computation (2PC), and enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model.
Abstract
Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties'private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.
The widespread adoption of Machine Learning as a Service raises critical privacy and security concerns, particularly about data confidentiality and trust in both cloud providers and the machine learning models provided. Homomorphic Encryption (HE) has emerged as a promising solution to these problems, allowing computations on encrypted data without decryption. Despite its potential, existing works that integrate HE into neural networks are often limited to specific architectures or classes. This leaves a wide gap in providing a framework for easy development of HE-friendly privacy-preserving neural network models similar to what we have in the broader field of machine learning. In this paper, we present FHEON, an open-source configurable framework for developing privacy-preserving neural network models for inference using the CKKS scheme of HE. FHEON introduces optimized and configurable implementations of privacy-preserving neural network layers, including convolution layers, average pooling layers, ReLU activation functions, and fully connected layers. These layers are configured using standard parameters such as input channels, output channels, kernel size, stride, and padding to support arbitrary convolution neural network (CNN) architectures. Furthermore, FHEON provides utility functions that ease usage and adoption. We assess the performance of FHEON using several CNN architectures, including LeNet-5, VGG-11, VGG-16, ResNet-20, and ResNet-34. FHEON maintains encrypted-domain accuracies within +-1% of their plaintext counterparts for ResNet-20 and LeNet-5 models. Notably, on a consumer-grade CPU, the models built on FHEON achieved 98.5% accuracy with a latency of 13 seconds on MNIST using LeNet-5, and 92.2% accuracy with a latency of 403 seconds on CIFAR-10 using ResNet-20. Though configurable, FHEON outperform all state-of the-art HE inference works in both latency and memory utilization. Additionally, FHEON operates within a practical memory budget requiring not more than 42.3 GB for VGG-16.
Nges Brian Njungle, Eric Jahns, Michel A. Kinsy· Proceedings on Privacy Enhan...· 1 citation
PANDA is a scalable system that uses zero-knowledge proofs to prove the robustness and fairness properties of a model without revealing its private parameters, and can generate proofs of local robustness for neural networks with more than 2.9M parameters in 5 minutes, and can verify them in 10 seconds.
Youwei Zhong, Ben Merbaum, Timos Antonopoulos et al.· 0 citations
: Searchable symmetric encryption enables efficient keyword search over encrypted outsourced data, making it a key primitive for cloud storage. Since searchable symmetric encryption protocols inevitably leak side information through repeated searches, access patterns, update behaviour, and timing, an analysis of their privacy properties is crucial. Prior work along this direction considers leakage functions capturing what is revealed, and privacy guarantees often remain difficult to compare across schemes. We propose a privacy model for searchable symmetric encryption protocols that makes adversarial power a central parameter. We formalise adversaries capabilities and organise them into four classes based on two orthogonal dimensions, observational power (low vs. high) and privacy guarantee strength (minimal vs. strong). These classes induce four privacy levels giving rise to a privacy lattice, capturing implication relations between guarantees under increasingly powerful adversaries. This enables reasoning about how privacy guarantees change under different adversarial capabilities. We validate the privacy model by showing that representative symmetric encryption protocols schemes from the literature naturally instantiate the proposed privacy classes.
Manuela Horduna· Proceedings of the 23rd Inte...· 0 citations
Computing systems managing large-scale, heterogeneous data are increasingly vulnerable to privacy breaches and adversarial attacks. This study presents a federated deep learning framework that systematically integrates adaptive privacy noise mechanisms and trust-weighted aggregation within a distributed architecture. The proposed method ensures the protection of sensitive data during collaborative analysis, even in highly dynamic environments, through precise differential privacy control and advanced neural network models. It is capable of real-time adjustments to privacy budgets and aggregation strategies to reduce the likelihood of information leakage while also lowering the risk for each node. Through comprehensive experiments integrating IoT sensor streams and medical transaction data, it has been demonstrated that the system consistently achieves high prediction accuracy while significantly reducing the success rate of participant inference and reconstruction attacks. Quantitative analysis confirms the strong robustness and cross-domain deployment scalability of this solution. Direct comparisons with state-of-the-art technologies show that privacy enhances resilience and significantly reduces utility loss. Providing feasible technical guidelines for secure and compliant big data analysis, it has verified the effectiveness of integrated privacy-preserving deep learning in protecting critical information infrastructure.
Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.
The rapid growth of distributed computing paradigms, such as the Internet of Things (IoT), edge computing, cloud computing and cyber-physical systems, has made privacypreserving anomaly detection a pressing research challenge. This paper presents a systematic literature review, conducted following the PRISMA 2020 guidelines, of 50 studies published between 2018 and 2026 that combine machine-learningbased anomaly detection with privacy-enhancing technologies. We organise the literature along four axes: detection models (Isolation Forest, autoencoders, one-class SVM, graph neural networks and transformers), learning paradigms (centralized versus federated learning, FL), privacy mechanisms (homomorphic encryption, differential privacy, secure multi-party computation and zero-knowledge proofs), and integrity mechanisms based on blockchain. The reviewed applications span IoT security, healthcare, finance, industrial control, V2X networks, the metaverse and supply-chain management. Synthesising the reported evidence, the review finds that FL combined with the lightweight Isolation Forest (IF) is the approach most frequently associated with a favourable trade-off between detection quality, privacy protection and computational cost on resource-constrained edge devices, while hybrid designs that add differential privacy or homomorphic encryption offer stronger formal guarantees at a measurable cost in accuracy and latency. We critically discuss the methodological limitations of cross-study comparison, and we identify open challenges including non-IID data distributions, resistance to poisoning attacks, post-quantum cryptographic resilience and model explainability under privacy constraints. We close with future directions: adaptive privacy-budget mechanisms, federated unlearning for the right to be forgotten, and the integration of quantum-safe cryptographic primitives. All quantitative figures reported in this review are attributed to their original studies; no new experiments were performed.
Mahnoor Fatima, Ahmad Ijaz, Aoun E. Muhammad et al.· ICACNC 2026 Proceedings· 0 citations