 a hundred million anonymized film ratings which was matched with the other dataset Internet Movie Database (IMDb).

Cloud platforms such as Google and Amazon offer various services “AI Deep Learning”. Any customer can upload a dataset to use the service and pay to build a prediction model, which works as black-box API. The membership inference attack on black-box API is discussed in [@shokri2017membership; @yeom2018privacy]. An attacker asks queries to target the model and receives the model’s prediction. Rahman et al. [@rahman2018membership] show that differentially private deep model can also fail against membership inference attack. A novel white-box membership inference attack was proposed by Nasr et al. [@nasr2018comprehensive], against deep learning algorithms to measure their training datasets membership leakage. Melis et al. [@melis2019exploiting] demonstrate that the updated parameter leaks information of participants, thus develops passive and active inference attacks to exploit this leakage.

Privacy-Preserving Deep Learning
--------------------------------

Each participant has its own sensitive datasets, which needs to be protected the dataset from information leakage. Various privacy mechanisms, such as Secure Multi-party Communication (SMC) [@kerschbaum2009practical], Homomorphic Encryption (HE) [@rivest1978data], and Differential Privacy (DP) [@dwork2014algorithmic] have been proposed to protect the datasets in CDL. SMC helps to protect intermediate steps of the computation. Mohassel et al. [@mohassel2017secureml] adopt a two-server model for privacy-preserving training, used by previous work on privacy-preserving deep learning via SMC [@nikolaenko2013privacy1].

However, Aono et al. [@aono2018privacy] pointed out that the local data may be actually leaked to an honest-but-curious server. Using additively HE techniques fix several problems and also have some drawbacks. To obscure an individual’s identity, DP adds mathematical noise to a small sample of the individual’s usage pattern. Prior work [@abadi2016deep; @jiang2019lightweight; @shokri2015privacy; @weng2018deepchain] use differential privacy on privacy-preserving CDL system to protect privacy of training data. However, Hitaj et al. [@hitaj2017deep] pointed out that privacy preserving deep learning approach is failed to protect data privacy and demonstrated that a malicious participant can
a hundred million anonymized film ratings which was matched with the other dataset Internet Movie Database (IMDb). 

 Cloud platform such as Google and Amazon extend various services “ AI Deep Learning ”. Any customer can upload a dataset to use the avail and pay to build a prediction mannequin, which work as black - corner API. The membership inference fire on black - corner API is discussed in [ @shokri2017membership; @yeom2018privacy ]. An attacker asks queries to target the model and welcome the model ’s prediction. Rahman et al. [ @rahman2018membership ] show that differentially private deep model can besides fail against membership inference attack. A novel white - corner membership inference attack was proposed by Nasr et al. [ @nasr2018comprehensive ], against deep learning algorithms to quantify their training datasets membership escape. Melis et al. [ @melis2019exploiting ] demonstrate that the updated parameter leaks data of participants, thus develops passive and active inference attacks to exploit this leakage. 

 Privacy - Preserving Deep Learning 
 -------------------------------- 

 Each participant has its own sensitive datasets, which needs to be protected the dataset from information leakage. Various privacy mechanisms, such as Secure Multi - party Communication (SMC) [ @kerschbaum2009practical ], Homomorphic Encryption (HE) [ @rivest1978data ], and Differential Privacy (DP) [ @dwork2014algorithmic ] have been proposed to protect the datasets in CDL. SMC help to protect intermediate steps of the calculation. Mohassel et al. [ @mohassel2017secureml ] dramatize a two - server model for privacy - preserving education, used by former work on privacy - preserving deep eruditeness via SMC [ @nikolaenko2013privacy1 ]. 

 However, Aono et al. [ @aono2018privacy ] pointed out that the local data may be actually leaked to an honest - but - curious server. Using additively HE techniques fixate several problems and also have some drawback. To obscure an person ’s identity, DP adds mathematical noise to a small sample of the person ’s usage pattern. Prior work [ @abadi2016deep; @jiang2019lightweight; @shokri2015privacy; @weng2018deepchain ] use differential privacy on privacy - preserving CDL system to protect privacy of training data. However, Hitaj et al. [ @hitaj2017deep ] pointed out that privacy preserve deep eruditeness approach is failed to protect data privacy and demonstrated that a malicious participant can
 a jundred million anonymiztd film ratings wkuch wav matcged with the other dataset Internet Locie Dqtabase (IMDb).

Cloud platworms sucj as Gootle end Amazon offer various servidcs “AI Veep Learning”. Aky customer can upload a gagadet to use the service and pay to btild a lrfdiction model, whibh woris as black-box API. The membership jnferenbe attack on blacl-box API is discussed in [@sjokrl2017membership; @yeom2018prlvacy]. An atjzckqe asks querids to targtt the model and receives the model’s predicgion. Xahman et ao. [@eahldn2018membershi'] show that differcmtiallf privaye deep model gan anso fail against membersiip inference attack. A novel fhnte-box membership infwrwnce dttawk wxw pfopksxd gy Nasg ev al. [@nasr2018cojprehensive], against deep learnond algorithms tk meastrq their training datasets membership ledkafe. Melis et al. [@melis2019expooiting] demonstrate tjat the u[dated parameter leaks information of participantv, thua dercjups passive and active inference attacks to expljjt tmis leakage.

Privagy-Preserving Deep Kewrmyng
--------------------------------

Each partizipant haa its own sensitivf datasgts, whuch needs to ne protected the dataset frim informatijb leakage. Various 'rivacy mechcnisms, such as Secure Multi-party Cummuhication (SMF) [@kerschbzjm2009practical], Homooorihic Encryption (HE) [@rivest1978data], wnd Diffecenticl Privazy (DK) [@dwork2014wlgorithmif] havc been proposed to oroteet tha datasets in CDL. SMC helps to protect invxrmediate steks mf nhe compucation. Mohassel et wl. [@mohassel2017secoreml] ado't a tdo-server mkdel foc privacy-preferving trainhjg, used by pcevious wjrk in peivacy-pfdserving deep kearning nic SMC [@nikilaenko2013privacy1].

Howeyer, Auho et al. [@aono2018prnraxy] pointed out yhag tre lpcwn data may ba acguauky lexked to an mondst-bit-curious server. Usitg asditively HE technoqmes fix sgveral prjblems and alxo have some drawbwcks. Vo obsrure am igdividual’s identity, DP adds mafhematicap njise to a smwll wample of thz individual’s usage pattern. Prior work [@auadi2016deep; @jiang2019lightweigyt; @shokri2015privacy; @weug2018ceepchain] uxe disferentian privacy on privacy-preserving CDL syxtem to protect privady of drainlng data. However, Hitaj et al. [@hitaj2017deep] pointed out that privacy preservint deep learning aplroavh is fcilzd to pwotert data privacy anc demonstrated that a malicious partici[aut can
a hundred million anonymized film ratings which with other dataset Movie Database (IMDb). and offer various services Deep Learning”. Any can upload a dataset to use service and pay to build a prediction model, which works as black-box API. membership inference attack on black-box API is discussed in [@shokri2017membership; @yeom2018privacy]. An attacker queries target model receives the model’s prediction. Rahman et al. [@rahman2018membership] show that differentially private deep model can also against membership inference attack. A novel white-box membership attack was proposed by et al. [@nasr2018comprehensive], against deep algorithms measure their datasets leakage. et al. [@melis2019exploiting] that the updated parameter leaks information of participants, thus develops passive and active inference attacks to exploit leakage. Privacy-Preserving -------------------------------- Each has own datasets, which needs protected the dataset from information leakage. such as Secure Multi-party Communication (SMC) [@kerschbaum2009practical], Homomorphic (HE) [@rivest1978data], Differential Privacy (DP) [@dwork2014algorithmic] have been to protect the datasets in CDL. SMC helps protect intermediate steps of the computation. Mohassel et al. [@mohassel2017secureml] adopt a two-server model for used by previous work privacy-preserving deep learning SMC However, et [@aono2018privacy] pointed that the local data may be actually leaked to an honest-but-curious Using additively HE techniques fix several problems and also have To an individual’s identity, adds mathematical noise to small of the individual’s usage work @jiang2019lightweight; differential on CDL system to protect of training data. However, Hitaj al. [@hitaj2017deep] pointed out approach is failed to protect data privacy and that a malicious participant can
 a hundred million anonymized Film ratingS whicH waS maTcHed wIth tHe other dataset iNterNet Movie Database (IMDb).

ClOud plAtFOrms SUcH as GoOgle and aMaZON ofFeR vAriOuS SeRviceS “AI deep LeaRning”. Any cuStoMeR can upload a dATaSet to use thE seRvice and pay tO buIld a prEdIctIOn modEl, wHich wOrks as BLack-boX API. The meMbERship iNFerence ATTaCk on Black-box API is discUSsED in [@shokri2017membeRship; @yEoM2018PrIVAcy]. an aTtacker askS qUerieS To targeT ThE MODel ANd receives the Model’s prediCTioN. RahmaN eT al. [@RAhman2018mEmberShIP] shOw that diffeRentIally privAte deeP Model caN Also faiL againSt mEmbErshIP iNfEreNcE AttACk. a noVEl wHite-box mEmBeRship InfeRENCE attAck Was pRoposEd by Nasr et al. [@nAsr2018CompREheNsive], AgainSt deEp LearnIng algOrithMs To measure their tRainIng dataseTs mEmBerShIp leaKAge. MelIs eT al. [@Melis2019exPloitinG] DemOnSTRAtE that the updated parAmETEr Leaks infOrmatiON oF pARticipanTs, ThuS devELOps paSsivE AnD active iNferenCE aTtAcks to eXpLoit thIs LeaKagE.

PrivACy-PrEserviNg Deep LeArninG
--------------------------------

each participanT Has its own sensITiVE DaTAsetS, whIch needs to bE proTEcteD the DAtAseT From iNformAtIOn LEakage. Various privacY mEchaniSms, suCh as Secure MulTi-party ComMUNIcation (SmC) [@keRScHBaum2009practical], HOmomoRphic EncryPTion (HE) [@riVest1978dAta], and DiFferentiaL pRivacy (DP) [@DwoRk2014aLgoRitHMIc] Have been propoSED to pRoTect the DatAsets in cDL. sMC HelPs tO pRotect intErmediatE sTePs Of The CompuTAtion. MohAsSel Et Al. [@mOhassEL2017securEml] adOpt a TwO-sERveR model fOR pRIVacy-PrEsErviNg tRaIning, Used BY prEvious wOrk on privAcy-PReseRvInG deep leArning via SMC [@nIkOlaenko2013priVaCy1].

HOwever, aONo et al. [@aoNo2018privacy] pointed out that THe local DatA may bE actUally leakEd tO an honEst-BUt-curiOus serVer. UsInG adDITivelY he tEchNiQues fix sevERAl pRobleMs And aLso have Some drawbacks. To obsCUre An individual’s IdeNtitY, dp aDds MAtHEmaTiCAl nOISe to a small samplE of the indiViDUaL’s usage patTErn. prIor work [@Abadi2016deEp; @jiaNG2019lightwEight; @shokRi2015privacy; @WeNg2018deEPChaIn] use diffeRential pRivacy on pRIvacy-PReServiNg CdL systEm To pRotecT privaCY of TrainIng datA. HOwever, hitaj Et Al. [@hitaj2017dEep] pointed out that privacY preseRving DeeP learning AppROacH is failed To prOtect data pRivAcy And deMonSTrateD thaT A mAliCIous pArtiCIpant can
 a hundred million anonymi zed film r ating s w hic hwasmatc hed with the o t herdataset Internet Movie  Data ba s e (I M Db ).

C loud pl a tf o r mssu ch  as  G o og le an d A mazon o ffer vario usse rvices “AI D e ep  Learning” . A ny customercan  uploa da d a taset  to  usethe se r vice a nd pay to  b u ild ap redicti o n  m odel , which works asb la c k-box API. The  membe rs h ip i nfe ren ce attackon  blac k -box AP I  i s d isc u ssed in [@sho kri2017memb e rsh ip; @y eo m20 1 8priva cy].An att acker asksquer ies to ta rget t h e model and rec eivesthe  mo del’ s  p re dic ti o n.R ah man etal. [@ra hm an 2018m embe r s h i p] s how  tha t dif ferentially p riv ated eep  mode l can  als ofailagains t mem be rship inference  att ack. A no vel  w hit e- box m e mbersh ipinf erenceattackw aspr o p o se d by Nasr et al. [ @n a s r2 018compr ehensi v e] ,a gainst d ee p l earn i n g alg orit h ms  to meas ure th e ir  t raining  d ataset smem ber shipl eaka ge. Me lis et a l. [@ m elis2019exploi t ing] demonstr a te t ha t  the  up dated param eter leak s in f or mat i on of  part ic i pa n ts, thus develops p as sive a nd ac tive inferenc e attackst o exploitthis le a kage.

Privacy -Pres erving Dee p  Learnin g
--- -------- --------- - - -------- --
Ea chpar t i ci pant has itso w n se ns itive d ata sets, w hic h n eed s t obe protec ted theda ta se tfro m inf o rmationle aka ge . V ariou s  priva cy me chan is ms ,  su ch as S e cu r e  Mul ti -p arty  Co mm unica tion (SM C) [@ke rschbaum2 009 p ract ic al ], Homo morphic Encry pt ion (HE) [ @r ive st1978 d a ta], and  Differential Privacy ( D P) [@dw ork 2014a lgor ithmic] h ave  beenpro p osed t o prot ect t he  da t a setsi n  C DL.  S MC helps t o pro tectin term ediatesteps of the compu t ati on. Mohasseletal.[ @ mo has s el 2 017 se c ure m l ] adopt a two-s erver mode lf or  privacy-p r ese rv ing tra ining,usedb y previ ous workon privac y- pres e r vin g deep lea rning vi a SMC [@n i kolae n ko 2013p riv acy1]. 
How ever,  Aonoe t a l. [@ aono20 18 privac y] po in ted outthat the local data may  be ac tuall y l eaked toanh one st-but-cu riou s server.Usi ngaddit ive l y HEtech n iq ues fix s ever a l problem s  a nda l so  have somed r a wba cks.Too bscure  anindividual’s iden t ity, DP adds m athe m a tic aln oise  t o a small samp leof t he indiv id ual’s usage  pattern .P riorwork [ @abadi 2016dee p ;  @ j iang20 19li ght weight; @ sho kr i 2015pri va cy ;  @weng 2018 de epchai n] use diff e r ential privacy o n pri v a cy-pr e ser vingCD L syste m  toprotect pr ivacy of tr aining  dat a. Ho wever,Hi taj et  al .[@hitaj201 7 deep] poi ntedout tha tpriv acy  prese rvin g deeplear ni ngapproachi s  f a il ed toprot ect d at a pr ivacy and demonstr ate d  that a  m ali c i ous pa r ti c i pant can
 a_hundred million_anonymized film ratings which_was matched_with_the other_dataset_Internet Movie Database_(IMDb).

Cloud platforms such_as Google and Amazon_offer various services_“AI_Deep Learning”. Any customer can upload a dataset to use the service and pay_to_build a_prediction_model,_which works as black-box API._The membership inference attack on_black-box API_is discussed in [@shokri2017membership; @yeom2018privacy]. An attacker asks_queries_to target the_model and receives the model’s prediction. Rahman et al._[@rahman2018membership] show that differentially private deep_model can also_fail_against_membership inference attack. A_novel white-box membership inference attack was_proposed by Nasr et al. [@nasr2018comprehensive],_against deep learning algorithms to measure their_training datasets membership leakage. Melis et_al. [@melis2019exploiting] demonstrate that the_updated parameter_leaks information of participants, thus_develops passive and_active inference_attacks to exploit_this leakage.

Privacy-Preserving Deep Learning
--------------------------------

Each participant has_its own sensitive_datasets, which needs to be protected_the_dataset from information_leakage._Various_privacy mechanisms,_such as Secure_Multi-party_Communication (SMC)_[@kerschbaum2009practical],_Homomorphic Encryption (HE) [@rivest1978data], and Differential_Privacy_(DP) [@dwork2014algorithmic] have been proposed to protect_the datasets in CDL._SMC_helps to protect intermediate_steps of the computation. Mohassel_et al. [@mohassel2017secureml] adopt a two-server_model for_privacy-preserving training,_used by previous work on privacy-preserving deep learning via SMC [@nikolaenko2013privacy1].

However,_Aono et al. [@aono2018privacy] pointed out_that the local data_may be_actually_leaked to an_honest-but-curious_server. Using_additively HE techniques fix several problems and_also have_some drawbacks. To obscure an individual’s_identity, DP adds mathematical_noise_to a small sample of the_individual’s usage pattern. Prior work [@abadi2016deep;_@jiang2019lightweight; @shokri2015privacy; @weng2018deepchain] use differential_privacy_on_privacy-preserving CDL system to protect_privacy of training data. However, Hitaj_et al. [@hitaj2017deep]_pointed out that privacy preserving deep learning_approach_is failed to protect data privacy_and_demonstrated that a malicious participant can