With the proliferation of Internet of Things (IoT) devices, deep learning model inference that guarantees data privacy has attracted significant research interest. Secure inference based on homomorphic encryption offers a promising solution by ensuring rigorous data confidentiality. However, in typical cloud-based inference services, ciphertexts are encrypted under a single key, requiring all participants to share the same decryption key. This contradicts real-world scenarios where multiple participants (e.g., individual IoT devices or users) typically hold their own private keys. To address this issue, this paper designs a series of secure sub-protocols based on multi-key homomorphic encryption (MK-HE), enabling the computation of nonlinear functions while preserving data privacy across multiple keys. Furthermore, considering the potential malicious nature of cloud servers, we incorporate a commitment protocol to ensure the verifiability of inference results and prevent the server from returning incorrect outcomes. Theoretical and security analyses demonstrate the efficiency and privacy of our proposed protocol, which achieves lower computational time and reduced communication overhead without compromising security.

With the rapid development of large language models, the fine-tuning of downstream tasks has become a key problem. As a new learning paradigm, prompt learning can greatly reduce the number of updated parameters and effectively reduce the communication cost in federated learning scenarios by freezing the pre-trained model and fine-tuning soft prompt parameters. However, for the federated prompt tuning, the local prompt usually contains the user's personal information, and the text input of the user are easily leaked through the aggregation directly on the server. Meanwhile, the soft prompt is vulnerable to poisoning attacks launched by malicious users (such as backdoor). For the above problems, this paper proposes a privacy-preserving federated prompt fine-tuning against poisoning attacks. Specifically, we use homomorphic encryption to ensure the confidentiality of local prompts, and aggregate prompts under ciphertext to generate global prompts. Secondly, the proposed mechanism of backdoor detection is used to judge whether the prompt contains backdoors to resist the malicious attacks in the form of ciphertext. Both local and global prompts are invisible to the server during the entire training process. Finally, theoretical analysis and experimental results show that the accuracy error between the plaintext domain and the ciphertext domain is controlled within 2%-5% under backdoor attack, which effectively enhances the robustness of the model.

We propose a novel data hiding framework based on a multimodal generative model, named Burn After Reading Data Hiding (BarDH). Unlike previous related work in the field of data hiding, our proposed BarDH introduces a novel function: once the receiver extracts the secret data, the secret data cannot be extracted again. We have named this function as ‘Burn After Reading’. The concept of ‘Burn After Reading’ was first introduced into data hiding research. We believe that this mechanism constitutes a highly effective means of safeguarding secret data, such as in scenarios where the receiver's device has been hacked or stolen. Our proposed BarDH model enhances the multimodal generative model, Latent Diffusion Models (LDMs), better aligning it with data hiding tasks and requirements. Experimental results demonstrate that the proposed BarDH framework effectively facilitates the functionality of ‘Burn After Reading’. Simultaneously, the framework demonstrates competitiveness in both the accuracy of secret data extraction and security.

Generative artificial intelligence has made great progress in enabling clients to create a variety of realistic visual content (such as images, videos and audios), where diffusion model as an emerging generative model can obtain higher quality images than generative adversarial networks (GANs). For resource-constrained devices, high-definition images can be generated by outsourcing the AI model to the server, but the client’s local prompts and generated images may contain private information, increasing the risk of privacy disclosure. In order to alleviate these concerns, we adopt the idea of split learning and homomorphic encryption technology to ensure the privacy of data and prevent the attacker from stealing. Specifically, adopt homomorphic encryption to ensure the confidentiality of the text embedding and prevent the server from obtaining the prompt and text embedding. Secondly, during the process of denoising, a secure cross-attention mechanism is designed for ciphertext based on the embedding matrix to ensure the normal follow-up steps and prevent denoising model parameters from leaking to clients. In addition, since the decoder is deployed locally, the image generated by the denoising model is latent spatial features rather than pixel spatial features, so the generated image is not visible to the server. Finally, through the theoretical analysis and quantitative index of experiments, it is proved that the image generated under ciphertext prompt is almost the same as the image generated under plaintext prompt, which indicates the security and effectiveness of the proposed protocol.

Remote heart rate (HR) estimation via facial videos has emerged as an attractive application for healthcare monitoring. Long short-term memory (LSTM) is a kind of deep recurrent neural network architecture used for modeling sequential information, which can be utilized for remote HR estimation. Outsourcing computation is an emerging paradigm for enterprises or individuals with a huge volume of private data but limited computing power for data modeling and analysis, but the risks of privacy leakage cannot be ignored. Prior privacy-preserving LSTM-based protocols only protect sensitive data or model parameters, or approximate nonlinear functions with somewhat utility degradation. To mitigate the aforementioned issues, we propose a verifiable outsourcing protocol of LSTM training for HR estimation (VOLHR) based on batch homomorphic encryption, which not only ensures the confidentiality of the local data and model parameters but also guarantees the verifiability of the model predictions to resist the deceptive attacks. Theoretical analysis proves that VOLHR provides a higher level of privacy protection than the prior works. Computational cost analysis demonstrates that VOLHR can reduce the computational overhead greatly compared with the original LSTM models with different structures. To exhibit the practical utility, we implement VOLHR on two real-world data sets for HR estimation. Extensive evaluations demonstrate that VOLHR achieves almost the same performance as the original LSTM model and outperforms prior related protocols.

Outsourced inference services have greatly promoted the popularization of deep learning, and neural network models can help users customize a series of personalized applications, e.g., face recognition, image classification, etc. However, untrustworthy service providers also bring a variety of security issues, such as data privacy, network model privacy, etc. Meanwhile, the malicious example will result in the output of model incorrectly. For the above concerns, this paper proposes a privacy-reserving neural network inference against adversarial example attack (PPNNI) under two non-colluding cloud servers, where a series of efficient security protocols are designed to realize private prediction based on the additive secret sharing protocol. In the semi-honest model, the servers implement the neural network's private inference in the context of an unknown input and network model. Moreover, in order to prevent malicious examples from affecting the model accuracy, we produce a method of kernel density estimation and uncertainty value in the last layer of the hidden layer to determine whether the input is adversarial examples in the domain of ciphertext. The proposed PPNNI protocol is the first effort to efficiently detect adversarial attack behaviors under the ciphertexts. The theoretical analysis illustrate that the protocol can guarantee the privacy of input data, model parameters and the inference result. The results of the experiments demonstrate that the model accuracy are about 89% and 83% respectively with malicious examples on MNIST and CIFAR10 in the domain of ciphertext and they are nearly same as 91% and 85% in the domain of plaintext, which shows the effectiveness of our protocol.