arXiv CSopen access

A Privacy-Preserving Machine Learning Framework for Edge Intelligence: An Empirical Analysis

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

cloud distributed-computing parallel-computing

distributed computing, parallel computing, cloud

A Privacy-Preserving Machine Learning Framework for Edge Intelligence: An Empirical Analysis Quoc Lap Trieu1*, Bahman Javadi1 and Jim Basilakis1

arXiv:2605.05751v1 [cs.DC] 7 May 2026

Western Sydney University, School of Computer, Data and Mathematical Sciences, Sydney, NSW, Australia.

*Corresponding author(s). E-mail(s): [email protected]; Contributing authors: [email protected]; [email protected]; Abstract As Edge Intelligence (EI) becomes increasingly prevalent in domains such as smart healthcare, manufacturing, and critical infrastructure, ensuring data privacy while maintaining system efficiency is a growing challenge. This paper presents a new privacy-preserving machine learning (PPML) framework tailored for EI applications, including a four-layer system architecture and training and inference algorithms. We focus on three leading approaches: Differential Privacy (DP), Secure Multi-party Computation (SMC), and Fully Homomorphic Encryption (FHE), and assess their impact on key performance metrics, including model accuracy, response time, and energy consumption. Results from real implementation and extensive trace-based simulations of inference tasks show that DP generally preserves throughput and latency close to plaintext baselines, while accuracy drops with model complexity (up to 35% on AlexNet and under 18% on LeNet for FordA). SMC performance is driven by communication; network bandwidth and round complexity determine end-to-end latency. For AlexNet, increasing link capacity from 250 Mbps to 500 Mbps reduces latency by about 30%. FHE is highly sensitive to model structure and numerical precision (bit width), with tighter parameters imposing substantial compute overhead; we observe roughly a 1000× increase in response time compared to DP. Beyond efficiency, DP shifts the privacy-utility-extractability frontier by reducing the attacker’s data efficiency in black-box model stealing, whereas SMC and FHE, while protecting inputs and parameters during inference, require complementary output controls to achieve similar resistance to extraction. These findings provide critical insights into the trade-offs between privacy, performance, and resource efficiency in edge computing scenarios. Keywords: Fully Homomorphic Encryption, Differential Privacy, Secure Multiparty Computation, Edge Intelligence Applications, Privacy-Preserving Machine Learning

1 Introduction

combining edge computing with artificial intelligence, EI enables local devices, such as smartphones, to perform real-time data processing and autonomous decision-making, even under resource

Edge intelligence (EI) is driving advancements in applications such as disease diagnosis in smart healthcare, data acquisition in smart grids, and the management of critical infrastructure [1]. By

constraints [2–4]. However, the widespread deployment of EI brings significant challenges in safeguarding user privacy and securing sensitive data [5]. Recognizing the critical importance of data privacy in modern applications, many developers have decided to leverage privacy-preserving techniques to protect the privacy of users’ sensitive data while performing machine learning tasks [6]. In edge-centric deployments, however, privacy and security requirements extend beyond protecting data at rest: they must hold endto-end across sensing, on-device/edge processing, transmission, and cloud-side analytics. This is especially acute in remote health monitoring, where highly sensitive medical records and continuous patient streams must remain confidential and tamper-resistant as they are accessed and exchanged among stakeholders, motivating decentralized architectures that combine blockchainbacked auditability with identity and accesscontrol mechanisms to reduce reliance on a single trusted party [7]. Meanwhile, edge-IoT environments are routinely exposed to confidentialityand availability-threatening attacks (e.g., manin-the-middle, injection, and distributed denial of service), which have driven the adoption of data-driven defenses—such as deep-learningbased intrusion detection frameworks deployed at the edge for timely detection and response [8]. However, choosing an appropriate privacy scheme remains non-trivial, particularly at the edge where compute and memory resources are constrained and latency budgets are tight [9]. In other words, with the limitation of edge computing on processing power and memory capacity, a comparative evaluation of different privacy-preserving schemes is essential for developing effective privacy-preserving machine learning (PPML) techniques at the edge. In this paper, we perform an extensive evaluation of different privacy-preserving techniques in the context of smart applications at the edge. The methodology provides a comparative analysis of three widely used techniques, namely, Differential Privacy (DP), Secure Multi-party Computation (SMC), and Fully Homomorphic Encryption (FHE) [6, 10]. Basically, DP ensures to preserve users’ privacy by adding a certain noise to the sensitive data during training while keeping the trade-off between the level of model accuracy and

data privacy [11]. The second technique, SMC, allows multiple parties to perform joint computations without sharing data. In other words, the protocol preserves each party’s data privacy but can still perform the operation to get the result [12]. The final technique FHE is one of the main types of homomorphic encryption, a cryptography-based technique that allows computations on encrypted data without the presence of private keys. To evaluate the performance of these three privacy-preserving techniques, we conduct experiments using both real implementation and tracebased simulations on different deep-learning models and time-series datasets. The primary task in the experiments is machine learning inference, which is the most common operation in EI systems. The results are then analyzed across several metrics, including accuracy, response time and energy consumption. To the best of our knowledge, this is the first study to conduct a comprehensive performance evaluation of privacypreserving techniques for EI applications. The main contributions of this work are:

• The development of a new privacy-preserving machine learning (PPML) framework tailored for EI applications, structured into four hierarchical layers—Cloud, Edge Server, Edge Device, and Sensor—and incorporating four core components: Data, Model, System, and Application. • Implementation and evaluation of PPML techniques on heterogeneous edge devices to develop a realistic dataset for performance evaluation. • A trace-based simulation for evaluating PPML techniques using real-world data collected from diverse datasets and edge devices under different workloads. • A comprehensive security analysis and performance evaluation of PPML techniques for various EI application domains, assessing accuracy, response time and energy consumption. The rest of the paper is organized as follows. Section 2 reviews related work on PPML performance evaluation. Section 3 describes the architecture of the proposed framework and its evaluation methodology. Section 4 then details the development of the PPML framework, including the training and inference algorithms, the experimental setup, and the trace collection process. Section 5 reports and analyzes the evaluation 2

of data privacy while being able to collect more data. In [20], the team proposed a system leveraging LDP to enable the ability to train Artificial Intelligence (AI) models at large-scale data while preserving their privacy. Regarding the application of DP in computer vision, Mao, Yunlong, et al. [21] proposed a secure solution for training the Deep Neural Network (DNN) face recognition model. They also applied an offloading strategy to split the DNN among user devices and the edge server while preserving the privacy of both data and model parameters. Another approach to protecting the data privacy of the machine learning models in edge computing systems is from [22]. The approach first partitions the data into blocks and distributes it to edge nodes for training and processing; it then aggregates the entire dataset for further processing. During the whole process, the authors used the Laplace mechanism to add noise to both data blocks and the entire dataset.

results. Section 6 presents a comparative security analysis of the considered privacy-preserving techniques. Finally, Section 7 summarizes the key findings and concludes the paper.

2 Related Work In the following section, we discuss existing research on privacy preservation approaches in edge intelligence and broader machine learning frameworks.

2.1 Privacy-Preserving Techniques for Edge Intelligence Recently, privacy-preserving techniques at the edge have gained significant attention for protecting sensitive user data and ensuring compliance [13, 14]. This section reviews recent studies on implementing PPML applications using various privacy-preserving schemes in EI systems.

2.1.1 Differential Privacy 2.1.2 Secure Multi-party Computation

Introduced in 2006, Differential Privacy (DP) is a key privacy technique [11]. It enables control over the noise added to data, using Laplace, Gaussian, or Exponential mechanisms based on risk and data traits. DP is classified by noise location: Local Differential Privacy (LDP), where noise is added locally before storage, and Global Differential Privacy (gdp), where it is applied to the database post-storage [11, 15]. Many studies in edge computing apply Differential Privacy (DP) for Federated Learning (FL) to preserve privacy during AI model training. Wan et al. [16] proposed integrating blockchain-enabled FL with DP to balance privacy and data utility. Another approach [17] modifies the training method to optimize learning rates while adding noise to the model updates. Studies by Xu et al. [18] and Kai et al. [19] focus on enhancing privacy in blockchain-enabled frameworks. Xu et al. [18] specifically address protecting patient data in coronary heart disease diagnosis using LDP without a trusted entity. In [19], the authors used the Laplace mechanism to protect the privacy of edge locations in the strategy for task allocations. As one of the big tech companies famous for privacy protection, Apple has been working in DP to enhance the level

According to Feng and Yang [12], SMC protocols are typically built from two core primitives: secret sharing and garbled circuits. Secret sharing protects private inputs by distributing shares of the secret, while garbled circuits enable computation over encrypted values. Secret-Sharing Schemes (SSSs) are commonly grouped into three categories: Linear, Additive, and Shamir, distinguished by how they generate, distribute, and reconstruct shares. Several works integrate SMC into FL to provide privacy-preserving training. Li et al. [23] and Kanagavelu et al. [24] both adopt SMC-based mechanisms, with Kanagavelu et al. focusing on overhead and scalability, and Li et al. employing Shamir’s scheme for vehicular fog computing. Other designs rely solely on secret sharing, such as Liu et al. [25] for secure data verification in smart grids, or Praveen et al. [26] for searchable encryption. Olakanmi and Odeyemi [27] further extend SSS by distributing computation across multiple workers and embedding incentive and trust models to ensure fairness. Homomorphic Encryption (HE) is another key building block frequently combined with SMC in practical systems. In vehicular networking, 3

components in the approach. The authors of [36] also employed FHE and the blockchain technology underpinning a privacy-preserving deep learning model for Vehicular Ad-hoc Networks (VANETs) to protect data privacy. In an attempt to apply a privacy-preserving solution at the edge, the author of [37] tested the performance of different HE techniques by using two libraries: Python-Paillier and PyFhel. However, the approach only uses an edge layer to encrypt the data; the computation process still relies on the cloud layer. J Hrzich et al. also showed an experiment on applying different HE techniques for several ML models in [38]. However, the research considers classification prediction models with only a few HE techniques. The research on [39] applied Partial Homomorphic Encryption (PHE) as a solution for a secure blockchain application. The application relies PHE to execute the verification process based on the encrypted value at the blockchain nodes.

[28] proposes a distributed computation offloading scheme that reduces the processing load on vehicles and roadside units while enhancing model security through the joint use of HE and SMC. Khan et al. [29] design a secure data aggregation protocol for smart grids that leverages Shamir’s secret sharing to transmit data to different nodes and Paillier HE for aggregation. For Internet of Medical Things (IoMT), [30] introduces a composite framework that encrypts medical plaintext with HE and employs SSS to distribute computation across nodes. To mitigate relay and delay attacks during data transmission, the framework also incorporates a secure time-synchronization protocol from [31].

2.1.3 Homomorphic Encryption Homomorphic encryption is used for protecting data privacy in scenarios like outsourcing sensitive data to the cloud [32]. There are three types: partial homomorphic encryption (PHE), levelled homomorphic encryption (LHE), and Fully Homomorphic Encryption (FHE). PHE supports repeated addition or multiplication, with Paillier and RSA as common examples. LHE extends this to both operations but with limited depth; BFV and CKKS are popular LHE schemes used in encrypted machine learning inference [10]. FHE supports an unlimited number of operations and is the most powerful. Among FHE schemes, TFHE excels at fast Boolean gate-level operations, making it ideal for encrypted logic, while the Brakerski-Gentry-Vaikuntanathan (BGV) scheme supports both leveled and fully homomorphic operations with efficient noise management [10]. In smart healthcare applications, Alabdulatif et al. [33] used FHE to enhance privacy in unsupervised clustering techniques like K-Means and Fuzzy C-Means. They also identified the BGV scheme as promising for privacy-preserving applications. Another medical PPML approach [34] combines homomorphic encryption, blockchain, and FL for privacy protection. Around 2020, amid the COVID-19 breakout, it was important to prevent and detect early cases based on data analysis from IoMT applications while ensuring the privacy of sensitive patient-related data. The authors of [35] presented a strategy named privacy-enhanced data fusion, applying Paillier HE as one of the main four

2.2 Privacy-Preserving Machine Learning Evaluation Framework There is limited work on privacy-preserving machine learning evaluation frameworks in edge environments. A privacy-preserving task allocation framework for edge computing based mobile crowdsensing is introduced by Ding et al. [9], which ensures user data confidentiality while efficiently assigning tasks. Using HE and DP, the framework achieves a balance between privacy, computational efficiency, and allocation accuracy. However, while the study compares the efficiency of these techniques across varying numbers of tasks and users, it does not address the performance evaluation of machine learning tasks within the framework. Shokri et al. [40] introduced a framework using membership inference attacks to assess ML privacy risks. Shafee et al. [41] extended this to detect anomalies in electric vehicle charging systems with both membership inference and model inversion attacks. While these frameworks lay the groundwork for assessing the robustness of privacy-preserving techniques, these works do not compare different PPML methods or their practical use in distributed or edge environments. Mercier et al. [6] conducted an evaluation of various privacy-preserving techniques for machine learning, with a focus on time-series classification. 4

The Data component also covers all data manipulations, such as data quantization, encoding, or data encryption.

The paper specifically evaluates the applicability of DP, FL, and SMC on time-series datasets. While it provides a comprehensive analysis of accuracy across different techniques and datasets, it overlooks inference performance and the impact on energy consumption. Additionally, the evaluation is centred on cloud computing environments, with limited consideration of edge computing scenarios. These studies underscore the increasing focus on privacy-preserving techniques for edge computing and IoT systems. Shafee et al. [42] highlight ongoing challenges in evaluating these techniques, particularly due to real-world complexities. Notably, gaps remain in assessing machine learning performance, inference efficiency, and energy consumption within edge environments. Many PPML methods applied at the edge use specific privacy techniques or their combinations, often without a thorough understanding of their performance trade-offs. This lack of systematic evaluation impedes informed choices when selecting methods for diverse applications. Therefore, comprehensive comparative evaluations are essential to guide users in choosing the most suitable privacy-preserving techniques for their specific needs. In this study, we did not consider any FL techniques as they primarily focus on training, whereas our emphasis is on inference, the most common operation in EI applications.

Model component As the core component of an EI system that extends the ability of edge computing, the Model component decides how AI models are trained and deployed. It is related to machine learning models and systematic ways of learning and inference processes. System component The System component represents the computing infrastructure and properties of the EI system, including memory, CPU, edge devices, and their performance including reliability, energy usage, throughput, and latency. Application component The Application component provides the service to users based on the Data, Model, and System components. It is a component that decides how an application can integrate with the EI system. We believe these components play an essential role in implementing every EI application. The data component manages all data-related aspects of EI to ensure the quality and consistency of data for processing. Based on the Data component, the Model component ensures the performance of the AI models in training and inference. At the same time, using the System component, users can easily define different system properties to ensure they meet the expected performance from the Application component, such as expected latency and throughput. Figure 1 provides an overview of our proposed architecture for privacy-preserving EI. The architecture is structured into four layers: the sensor layer, edge device layer, edge server layer, and cloud layer. These layers collectively enable efficient data processing while maintaining privacy and optimizing system performance. As can be seen in the figure, the four components: Data, Model, System, and Application, closely cooperate to form an EI architecture. Our architecture relies on a privacy-preserving module to be developed in the edge server and edge device layer to ensure the application’s privacy while executing the machine learning tasks.

3 System Architecture In this section, the system architecture and implementation tools for privacy-preserving edge intelligence will be explained.

3.1 Architecture We first define four primary components of the EI system: Data, Model, System, and Application.

Data component In general, the Data component involves all the operations related to data and the data itself. In other words, the Data component could include all data generated from real-time data collection of sensor devices, from database import operations or from user’s input of the top-level applications. 5

Fig. 1: The Proposed System Architecture with Data, Model, System, and Application Components

The sensor layer consists of IoT devices that collect data such as images, videos, and temperature readings. Once data is gathered, the edge device layer handles processing tasks within its limited computational capacity. By leveraging both the model and the privacy-preserving module, it performs tasks such as data encryption and pre-processing. However, due to the limitations of embedded devices, more resourceintensive tasks are offloaded to the edge server layer, which offers higher processing power. This edge server layer also integrates the model and privacy-preserving module, maintaining privacy while handling more demanding tasks, such as secure inference. Notably, the edge device and edge server layers may use different AI models tailored to their respective processing capabilities. The architecture also includes a cloud server layer to support application use cases, as shown in Figure 1. Both edge server and cloud layers incorporate the application component, enabling developers to implement and deploy PPML applications via either layer, depending on their requirements. This architecture supports a wide range of privacy-sensitive EI applications. In smart healthcare, for instance, patient data collected from wearable devices (e.g., heart rate, ECG) can be encrypted and processed directly in its encrypted form before being transferred to hospital-edge servers for secure inference. This enables real-time

diagnosis and patient monitoring while preserving data privacy. In autonomous vehicles, each vehicle functions as an edge device, collecting sensor data and performing secure computations locally. The encrypted results can then be transmitted to edge servers for further processing, ensuring low-latency object detection and navigation without compromising data protection. By adopting a multi-layered processing approach, the proposed architecture effectively balances performance, privacy, and scalability, enabling secure and efficient execution of various EI applications.

3.2 Privacy-Preserving Tools We consider various tools for privacy-preserving techniques, edge frameworks and machine learning models during the evaluation process. Even though many tools are available for each privacy technique or framework, we only select recent state-of-the-art PPML techniques [6]. We use TensorFlow Privacy, a Google-led open-source library that applies DP via differentially private stochastic gradient descent (DPSGD) [43]. The library provides a noise multiplier parameter representing how much noise is added to the model during training. Adjusting the parameter value also directly impacts the privacy budget, which represents the allowable amount of information leakage about individual data points. 6

server and edge device layers to reflect latencysensitive deployment. During operation, the sensor layer continuously generates IoT samples x(t), where t denotes the discrete sample index, and each sample is first received by an edge device for local processing. Depending on the selected privacy method, the edge device either applies data sanitisation or encryption prior to outsourcing inference to the edge server. In particular, under the FHE setting the edge device encrypts inputs before transmission so that the edge server can compute predictions directly on ciphertexts, while under the DP setting the privacy protection is incorporated during training and inference proceeds on plaintext features using a DP-trained model. In contrast, SMC distributes the inference computation across the edge server and one or more edge devices in a 2-party or 3-party configuration. In every SMC configuration, the edge server acts as party P0 to orchestrate and mediate message exchange, while the remaining parties correspond to edge devices that jointly execute the secure computation. Throughout the experiments, we record both computation time and communication statistics to quantify the runtime cost introduced by each privacy mechanism, with particular emphasis on the communication overhead inherent to SMC.

This study utilizes CrypTen, a library developed by Meta specifically designed for PPML applications using SMC to enable secure model training and inference [44]. CrypTen provides a robust framework for implementing privacy-preserving techniques in machine learning pipelines, allowing secure computation across data sources without compromising model accuracy. The library supports encryption protocols like TLS (Transport Layer Security) to ensure encrypted communication. While SMC is typically used for collaborative training between organizations, in this study, we employ it for secure inference, ensuring data security across edge nodes within an EI system. Regarding the homomorphic encryption technique, we use the Concrete-ML library to implement EI. Concrete-ML is an open-source framework implementing FHE for PPML applications. The framework is developed by Zama and based on FHE over the Torus (TFHE) [45, 46].

4 The Proposed PPML Framework This section first introduces the proposed PPML framework and then formalizes its workflow by summarizing the cloud-based training/preparation and edge-based inference procedures in two algorithms. It then describes the development process for the proposed framework, starting with the deep learning models and datasets used for evaluating privacy-preserving techniques. Next, it provides an overview of the experimental setup, which is divided into two stages: a hardware experiment and a trace-based simulation. The hardware experiment involves testing AI models with privacy techniques on edge hardware, while the software simulation evaluates system performance and energy efficiency in a large-scale environment using traces from the first experiments. The results are analyzed based on three metrics: inference accuracy, response time, and energy consumption. Figure 2 depicts the developed architecture used to evaluate three privacy-preserving techniques for EI applications across the cloud-edge hierarchy. The cloud layer performs model training, whereas inference is executed within the edge

4.1 PPML Training and Inference Algorithms Building on the architecture in Figure 2, we formalize the experimental workflow with two algorithms: a cloud-based model training and deployment preparation, followed by an edge-based privacy-preserving inference and measurement. Algorithm 1 specifies the cloud-based training and preparation stage, producing all artifacts required to execute secured inference at the edge. When m = DP, the cloud trains a differentially private model via DP-SGD using TensorFlowPrivacy and deploys the resulting DP-trained model to the edge servers for standard (plaintext) inference. When m ∈ {FHE, SMC}, the cloud first trains a baseline model. For m = FHE, the trained model is compiled into an FHEexecutable representation using Concrete-ML in line 8. The associated cryptographic material is then split across layers: the edge device retains the secret key required for decryption, whereas 7

Fig. 2: Developed Architecture for Privacy-Preserving Edge Intelligence Framework

the edge server is provisioned only with the public/evaluation information needed to evaluate the model directly on ciphertexts. During compilation, the precision bit-width p and quantization bit-width q are provided as configuration parameters to control the numerical representation and accuracy-performance trade-off of the compiled model. For m = SMC, the baseline model is packaged for CrypTen and deployed to the edge server (P0 ), enabling secure inference via secret sharing and interactive multi-party computation protocols. Algorithm 2 describes the inference procedure triggered by each incoming sensor sample x(t). Each sample is first received by an edge device, which performs standard local preprocessing before following one of three methodspecific branches. Under DP, the pre-processed input is forwarded to the edge server, which runs plaintext inference using the DP-trained model and returns the prediction ŷ (t). Under FHE, the edge device encodes and encrypts the preprocessed input, the edge server evaluates the compiled model directly over encrypted data to produce an encrypted output, and the edge device decrypts the result locally (lines 10–15). Under SMC, the edge server serves as both model owner and coordinator. It keeps the model weights in

plaintext and distributes them to the other parties as secret shares, so that each edge device receives only a share and cannot reconstruct the full model on its own (line 18). The input is secretshared and inference is executed jointly by the edge server (P0 ) and the edge devices (Pi ) in 2PC/3PC mode, revealing only the final prediction to the authorised party. Across all settings, we record per-sample computation time and communication cost (e.g., transmitted bytes and round duration) to enable a consistent comparison of privacy overheads, with particular emphasis on the network-dependent overheads of SMC. For ease of reference, Table 1 summaries the notation used in Algorithms 1 and 2, including model artifacts, party roles, and timing variables, thereby avoiding repeated symbol definitions in the algorithm text.

4.2 Development of the PPML Framework This section describes how the proposed PPML framework is realized in practice, covering both the edge hardware implementation and the tracedriven simulation environment used for large-scale evaluation. 8

Algorithm 1 Training and Deployment (DP/FHE/SMC) Require: Privacy method m ∈ {DP, FHE, SMC}; training set Dtrain ; DP params (ε, δ, C, σ ); FHE params (calib set Dcalib , p, q ); SMC setting (2PC/3PC with P0 as EdgeServer). Ensure: Deployed artifacts for edge inference (model and, if applicable, cryptographic/SMC setup). 1: if m = DP then 2: Mdp ← TrainDP SGD(Dtrain , ε, δ, C, σ ) # Train DP model using DP-SGD 3: DeployToEdgeServer(Mdp ) # Deploy model to edge servers 4: else 5: M ← TrainModel(Dtrain ) # Train baseline model 6: if m = FHE then 7: # Compile model for FHE inference (Concrete-ML) 8: Mfhe ← CompileFHE(M, Dcalib , p, q ) 9: # Generate keys and distribute to edge layers 10: (sk, pk, evk ) ← F HEKeyGenegation 11: else if m = SMC then 12: DeployToEdgeServer(M ) # Deploy model to edge servers 13: CrypTenInit(world size, rank) # initialize CrypTen parties (EdgeServer is P0 ) 14: end if 15: end if Algorithm 2 Edge Inference and Metric Collection (DP/FHE/SMC) Require: Privacy method m ∈ {DP, FHE, SMC}; deployed artifacts from Algorithm 1; sensor stream {x(t)}. Ensure: Predicted output ŷ (t) and logged performance measurements. 1: while true do 2: xraw ← SensorRead 3: xprep ← Preprocess(xraw ) 4: if m = DP then 5: # Transmit the pre-processed sample xprep to the edge server for inference 6: Send(EdgeDevice→EdgeServer, xprep ) 7: ŷ (t) ← Forward(Mdp , xprep ) 8: Log(DP, comm=optional) 9: else if m = FHE then 10: xpt ← Encode(xprep , calib info) 11: xenc ← Encrypt(pk, xpt ) 12: # Transmit the pre-processed sample xprep to the edge server for inference 13: Send(EdgeDevice→EdgeServer, xenc ) 14: ŷenc (t) ← FHEForward(Mfhe , xenc , evk ) 15: ŷ (t) ← Decrypt(sk, ŷenc (t)) # Decrypt ŷenc (t) with sk 16: Log(FHE, comm=bytes/time) 17: else 18: Msmc ← Encrypt(M, source = 0) # Encrypt model on P0 and secret share with all parties 19: Select input owner Pi (EdgeDevice) 20: xsmc ← Encrypt(xprep , source = i) 21: ŷmpc (t) ← SMCForward(Msmc , xmpc ) 22: ŷ (t) ← Reveal(ŷmpc (t), destination = i) # Decrypt ŷmpc (t) 23: stats ← CrypTenCommStats 24: Log(SMC, bytes=stats ) 25: end if 26: end while 9

preserving performance. AlexNet, introduced by Krizhevsky et al. [48], consists of five convolutional layers and three fully connected layers. To evaluate the effectiveness of privacypreserving techniques in smart applications, three real-world datasets from the UEA & UCR Time Series Classification Archive are used [49]. Key dataset characteristics, such as the number of training and testing samples and input length, are summarized in Table 2. For the smart healthcare scenario, the ECG5000 dataset is employed, which contains 5,000 heartbeat samples from a patient with severe congestive heart failure. In the smart grid application, the ElectricDevices dataset provides energy consumption data from 251 households, classified into seven categories based on device usage patterns, representing diverse household energy behaviors. For the manufacturing use case, the FordA dataset supports binary classification to detect the presence of specific symptoms in an automotive subsystem.

Table 1: Notation used in Algorithms 1 and 2. Symbol

Meaning

Selected privacy {DP, FHE, SMC}

x(t)

Sensor input at discrete sample index t

xraw , xprep

Raw sample and pre-processed sample at the edge device

xpt

Encoded plaintext representation of xprep prior to FHE encryption

Baseline (non-private) trained model

Mdp

DP-trained model (trained with DPSGD)

method:

ŷ(t)

Predicted output for sample x(t)

Privacy budget (smaller ε implies stronger privacy)

Failure probability in (ε, δ)-DP

Gradient clipping norm bound in DPSGD

Noise multiplier for Gaussian noise in DP-SGD

pk, sk, evk

FHE public key, secret key, and evaluation key material

Precision bit-width

Quantization bit-width

Mfhe

FHE-compiled model representation (Concrete-ML)

Msmc

SMC-encrypted model

world size

Number of SMC parties

Party 0 (edge server; coordinator in SMC)

Remaining parties (edge devices) in 2PC/3PC

4.2.2 Implementation Setup The implementation setup includes the process of training AI models on the cloud server and testing on devices in the edge computing environment to collect the execution time traces. In this study, we use an r6i.4xlarge EC2 instance on AWS to train and evaluate the accuracy of various privacypreserving techniques across multiple AI models and datasets. Training is performed with a batch size of 50, over 25 epochs, and with a learning rate of 0.001. For a baseline comparison, we also measure the models’ accuracy and inference times before applying any privacy techniques. Then, we conduct inference testing on an edge computing environment, comprising three edge devices and one edge server, as shown in Table 3, to assess the real-world impact of privacy-preserving techniques in edge-based machine learning. The collected traces include 500 inference times from heterogeneous edge devices. Table 4 provides a detailed configuration for each privacy-preserving technique, including the parameters for running experiments on various datasets. TensorFlow Privacy running DP is configured to run on different noise multiplier levels, starting from 0.1 to 0.7. In the case of SMC, Crypten leverages multi-threading on a single EC2

4.2.1 Deep Learning Models and Datasets This section presents the main deep-learning models and datasets used for evaluation. The experiments were conducted on three common models with varying layers and inputs, which have been used in similar studies [6, 47]. LeNet-5, a wellknown model in the LeNet family, includes two convolutional layers and is commonly used for digit recognition tasks. SqueezeNet is a compact architecture designed to achieve AlexNetlevel accuracy with significantly fewer parameters, leveraging Fire modules to reduce model size while 10

Table 2: Time-series Datasets Dataset

Sector

Train

Test

Length

Classes

FordA

Critical manufacturing

3601

1320

500

ElectricDevices

Energy

8926

7711

ECG5000

Public health

500

4500

140

4.2.3 Simulation Setup Table 3: Hardware Configuration Device

Type

Capacity

EC2 Instance

Cloud Server

16 cores, 128 GB RAM, 3.7 GHz Xeon

Desktop

Edge Server

16 cores, 32 GB RAM, 3.7 GHz Xeon

Intel NUC

Edge Device

8 cores, 8 GB RAM, 1.1 GHz i7

Jetson AGX

Edge Device

8 cores, 32 GB RAM, ARMv8

Raspberry Pi 5

Edge Device

4 cores, 4 GB RAM, 2.4 GHz Cortex-A76

To achieve a more realistic performance evaluation, we conducted trace-based simulations using real-world traces collected from the system implementation. EdgeSimPy [51], a simulation toolkit for edge computing systems, is selected for our simulation approach. Developed in Python, the library also includes several built-in models for assessing power consumption and application composition for tracking the performance of edge computing applications. Using the response time traces gathered from the hardware experiment described in Section 4.2.2, we conducted different experiments in a simulated environment featuring four edge servers and twelve edge devices. The simulation framework, built using EdgeSimPy, was evaluated on three privacy-preserving techniques and executed on a desktop system equipped with a 16-core 3.7 GHz Xeon CPU and 128 GB of memory. Energy consumption was calculated based on the power usage of active devices during the simulation, which was monitored and recorded by EdgeSimPy. A linear server power model was employed to estimate power consumption, assuming a direct correlation between a server’s power usage and workload demand. Additionally, a simple heuristic scheduler was implemented, which allocates tasks to the nodes with the most available resources, prioritizing those with the highest combined CPU and memory availability. It is important to note that the scheduling algorithm was intentionally left unchanged to isolate and assess the performance impacts of PPML techniques. Table 5 provides a detailed overview of the configuration parameters, including the number of edge servers, devices, and the simulation setup. To introduce system heterogeneity, the four edge servers were equipped with 16 CPUs and 32GB of RAM each, while the 12 edge devices were randomly chosen from Intel NUCs, Jetson AGX

instance, with two and three as the number of parties. Since the EC2 server experiment runs entirely on one EC2 instance, it focuses on computation cost and ignores communication overhead. This differs from a real-world edge computing setup, where each edge server or device would act as an independent party running its own instance of Crypten. In the hardware edge experimental setup, we evaluate the performance of SMC by applying deep learning models across two and three parties. Concrete-ML enables PPML with FHE but is constrained by the maximum number of bits it can handle in its current library version [50]. The current version of Concrete-ML 1.7 supports only a maximum of 8 bits. To meet this constraint and achieve practical performance, deep learning models must be quantized prior to execution. We explore different quantization levels in our setup, applying 4, 5, and 6 bits to reduce the model size while retaining accuracy. Additionally, the quantized model is compiled into an operational circuit graph that FHE can interpret. During this compilation, we specify the number of precision bits used for privacy-preserving computation. 11

Table 4: Implementation Parameters Technique

Configuration Parameters

Tool

Security bit (128), FHE

Precision bit-width p (5), Quantization bit-width q (4, 5, 6)

Concrete-ML

SMC

world size (2, 3)

Crypten

Noise multiplier σ (0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7), Gradient clipping C (1.0),

TensorFlow Privacy

δ (1e-5)

boards, and Raspberry Pi 5s. Experiments simulated varying levels of concurrent user requests, starting at 30 and incrementing to 40, 50, 60, and 70, to evaluate performance under different workload intensities. These concurrent users affect the number of simultaneous requests received by the framework. For the SMC technique, two network bandwidths (250 Mbps and 500 Mbps) were tested to assess the impact of SMC communication on the evaluation metrics. The simulation measured two key performance indicators: inference response times for each model and average energy consumption per inference, calculated using the maximum power draw (Pmax ) and idle power consumption (Pstatic ) of each device as listed in Table 5. A comparative analysis is conducted across different privacy-preserving techniques and selected models against their baseline results measured without applying any privacy-preserving techniques. Table 6 shows the raw model performance, measured in terms of training time and accuracy on the EC2 instance, and inference time on the edge server. The results reveal that AlexNet generally provides the highest accuracy, especially for FordA, but with a higher inference time. LeNet5 and SqueezeNet are more efficient in terms of inference time but may sacrifice some accuracy. Due to space constraints, we present only a subset of the results in the following sections; however, similar trends were observed in experiments conducted with other datasets.

Table 5: Simulation Parameters Parameter

Value

Total Requests

3000

Response Time Traces

500 data points

Users

30, 40, 50, 60, 70

Edge Nodes

4 Edge Servers, 12 Edge Devices

Bandwidth (SMC)

250Mbps, 500Mbps

Parties (SMC)

2, 3 parties

Power Consumption

Edge Server (Pmax : 150W, Pstatic : 4.5W) Raspberry Pi 5 (Pmax : 10W, Pstatic : 0.5W) NUC Intel (Pmax : 32W, Pstatic : 6W) Jetson AGX (Pmax : 11.6W, Pstatic : 2.75W)

FHE bit widths

4-bit quantization; 5-bit precision

5.1 Empirical Evaluation on Edge Platforms This section reports empirical results for three privacy-preserving techniques on edge platforms. First, we quantify the accuracy impact of DP and FHE across models and datasets, varying noise levels for DP and quantization bit-widths for FHE, measured on edge servers. Next, we examine FHE accuracy–latency trade-offs under different quantization and numeric precision settings, also on edge servers. Finally, we study how party size impacts SMC inference time across models and datasets, with one edge server as the first

5 Results and Discussion This section presents real-system experimentation results (edge devices and servers), then tracebased simulation results using the collected traces, and finally a detailed discussion of the evaluation. 12

party and additional edge servers as the remaining parties. The DP technique enhances privacy by adding noise to the gradients during training, but this comes at the cost of accuracy as shown in Figs. 3a– 3c. Accuracy declines monotonically with the noise multiplier, with sensitivity to both model and dataset. AlexNet is the most sensitive: on ECG5000 its accuracy drops by 3–4% as noise increases from 0.1 to 0.7, by 21–22% on ElectricDevices, and by 35% on FordA. By contrast, LeNet-5 and SqueezeNet are more robust: 1–2% on ECG5000, ≤3% on ElectricDevices, and 13– 18% on FordA. This argues that we should set the DP budget separately for each model and dataset, not use one value for everything. For the FHE technique in Concrete-ML with 5-bit precision (Figure 3d), accuracy improves with quantization bit width and shows diminishing returns beyond 5 bits. From 4 to 6 bits, AlexNet and SqueezeNet gain roughly 3–7%, while LeNet-5 changes by ≤1%. At 6 bits, all models are close to their non-encrypted accuracy (In Table 6), at the cost of higher compute, since FHE latency generally grows with precision. DP can induce sizable drops on some (model, dataset) pairs, most notably AlexNet on FordA and ElectricDevices, while FHE with 5– 6 bits typically retains accuracy within a few percent of baseline on ECG5000. Thus, when accuracy headroom is tight, favor FHE (or SMC); when inference cost must stay minimal, DP is attractive but requires careful noise calibration. It is worth noting that SMC is omitted here because its inference accuracy is essentially indistinguishable. Figure 4 isolates the accuracy–latency tradeoff of FHE by varying quantization bit width (4–6) and numeric precision (5 vs. 6). The left panel (4a) plots inference time on a log scale for ElectricDevices; the right (4b) shows accuracy on FordA. Regarding the latency scaling (Fig. 4a), Inference time grows super linearly with quantization bit width, and the growth factor depends strongly on the model: AlexNet increases by roughly 7–9 times from 4 to 6 bits, SqueezeNet by 3–4 times, and LeNet-5 by 2–3 times. At any fixed bit width, moving from precision 5 to 6 further increases runtime (typically 20–60%, and largest for AlexNet), so precision amplifies the cost of higher bit widths.

(a) DP accuracy (ECG5000)

(b) DP accuracy (ElectricDevices)

(d) FHE accuracy (ECG5000)

Fig. 3: Accuracy of privacy-preserving techniques across datasets (DP and FHE). 13

Table 6: Raw Model Performance on Various Datasets Dataset ECG5000

ElectricDevices

FordA

Model

Accuracy (%)

Inference (ms)

LeNet-5

93.13

45.9

14.0

SqueezeNet AlexNet

93.53 95.80

46.8 58.5

109.5 169.6

LeNet-5 SqueezeNet

67.00 65.66

44.2 44.9

52.8 293.2

AlexNet

64.44

56.0

631.2

LeNet-5 SqueezeNet

80.38 77.50

46.7 48.6

56.1 388.7

AlexNet

92.31

64.0

499.4

Model complexity is the dominant factor: AlexNet ≫ SqueezeNet > LeNet-5 in absolute latency. Figure 4b shows accuracy generally rising with quantized bit-width: most gains occur from 4 to 5 bits, with smaller changes from 5 to 6. Across 4 to 6 bits, AlexNet improves by 10–20%, SqueezeNet by 4–9%, and LeNet-5 by ≤ 5%. Changing numeric precision (5–6) has only minor, modeldependent effects for SqueezeNet and LeNet-5, but a noticeable impact for AlexNet, likely due to its more complex architecture. For AlexNet, precision 6 trails precision 5 by 8–15% at each bitwidth; for SqueezeNet and LeNet-5, precision 6 is slightly higher by 1–2%. Bit width drives most accuracy gains but incurs superlinear latency; precision 6 adds further cost. If latency-bound, choose the smallest bit width meeting the target (often 5) and lighter models. LeNet-5 is near-saturated at 4–5 bits and much faster, making it a strong FHE choice for constrained edge platforms. We also evaluate how party size affects SMC latency. As shown in Fig. 5, inference time grows at least linearly with the number of parties due to added interactive multiplications and communication rounds. The effect is architecture- rather than dataset-driven: AlexNet accelerates sharply beyond 4 parties, SqueezeNet grows moderately, and LeNet-5 remains nearly flat. In practice, choose the smallest size that meets the threat model and prefer lighter architectures or reduced multiplicative depth to limit rounds and traffic.

Training (s)

the trace-based simulation. Figure 6a presents the simulation results of applying the DP technique to deep learning models across three timeseries datasets. Since the inference time with DP remains comparable to that of the raw model, minimal overhead is expected, even with a large number of concurrent users. The results reveal that LeNet-5 generally achieves the lowest response times, especially as the number of concurrent users increases, making it well-suited for high-load environments. In contrast, AlexNet consistently exhibits the highest average response time across all datasets, likely due to its more complex architecture. For example, at 70 concurrent users, AlexNet’s response time is approximately 60-80% higher than SqueezeNet on the ElectricDevices dataset. A similar pattern is observed for the FordA dataset, where LeNet-5 and SqueezeNet maintain significantly lower response times compared to AlexNet, with LeNet-5 slightly outperforming SqueezeNet as concurrency increases. Overall, the average response time of models running DP increases with the number of simultaneous users across all datasets, indicating a strain on the system under higher user concurrency. LeNet-5 consistently shows the most efficient scaling, with a steady increase in response time and a smaller slope relative to the other models. In contrast, AlexNet experiences the steepest increase, reflecting its higher computational load due to architectural complexity. This analysis highlights LeNet-5’s suitability for real-time applications, particularly in scenarios with multiple concurrent users.

5.2 Performance Analysis We measure the performance of the system using the average response time of inference tasks using 14

of AlexNet’s complexity and resulting in considerably higher latency across all user counts. A similar trend is observed in the FordA dataset, where AlexNet’s response time is roughly 1.2 times that of SqueezeNet and 10 times that of LeNet-5 at 30 users, highlighting the significant computational demand of AlexNet under FHE. Overall, AlexNet consistently exhibits the highest response times across all datasets, with the FordA dataset showing the most extreme values (up to 10,000 seconds at 70 users). This increase in response time is primarily due to AlexNet’s complexity, which imposes a substantial computational load under FHE. Additionally, response times generally increase with higher user concurrency, ranging from 150% to 400% across different models and datasets. LeNet-5 scales more efficiently with user load, while AlexNet experiences the steepest increase. These results highlight the significant computational overhead introduced by FHE, which is about a 1000-fold increase in response time compared to DP results in Figure 6a. This impact is particularly pronounced for complex models like AlexNet and challenging datasets such as FordA. In contrast, simpler models like LeNet-5 exhibit relatively better performance in encrypted environments, making them more suitable for applications requiring real-time performance. Figures 6c, 6d, 6e, and 6f illustrate the results of simulating the SMC technique across various models with different time-series datasets in twoparty and three-party configurations. As outlined in the experimental setup, the goal is to assess the impact of communication between parties in SMC; thus, experiments are conducted in both 250 Mbps and 500 Mbps bandwidth environments. At the two-party configuration in 250 Mbps bandwidth, LeNet-5 on ECG5000 shows the lowest response times, from 0.7 seconds at 30 users and increasing to 1.2 seconds at 70 users. AlexNet on FordA is the slowest, reaching about 100 seconds at 70 users. This is over 8,000% higher than LeNet-5 on ECG5000, highlighting the significant computational load of AlexNet. The response times in 500 Mbps configuration decrease across all models compared to that of 250 Mbps. For example, AlexNet on FordA in a two-party setting remains the slowest, reaching approximately 70 seconds at 70 users, a 30% reduction from the

(a) Inference Time (ElectricDevices)

(b) Accuracy (FordA)

Fig. 4: Effect of precision and quantization bit widths on FHE inference time and accuracy across datasets.

Regarding the simulation results for FHE, Figure 6b shows the average response times for various models and datasets with increasing numbers of concurrent users. While the average response time grows by approximately 40% for every 10 additional users, there is a significant gap in performance between LeNet-5, SqueezeNet, and AlexNet. In the ECG5000 dataset, SqueezeNet’s response time is about 8-9 times higher than LeNet-5 at 30 users, and this difference remains consistent as user load increases. In contrast, AlexNet’s response time is nearly 11 times higher than LeNet-5’s at 30 users, reflecting the impact 15

(a) ECG5000

(b) ElectricDevices

Fig. 5: Effect of parties on SMC inference time across models and datasets.

(a) DP average responses for different concurrent users

(b) FHE average responses for different concurrent users

(d) SMC two-party average responses in 500Mbps bandwidth

(e) SMC three-party average responses in 250Mbps bandwidth

(f) SMC three-party average responses in 500Mbps bandwidth

Fig. 6: Average response times of privacy-preserving techniques with different numbers of concurrent users

250 Mbps setting but still much higher than the other models. Regarding the three-party configuration in Figures 6e and 6f, SqueezeNet running on ElectricDevices in 250 Mbps bandwidth sees an increase, with response times around 4 seconds

at 30 users, increasing to about 8 seconds at 70 users, representing a 100% increase compared to two-party settings. In 500 Mbps bandwidth, the model performance reduced to around 2 seconds at 30 users, rising to 4 seconds at 70 users, about a 33% reduction from 250 Mbps.

(a) DP

(b) SMC 3-party in 500Mbps bandwidth

Fig. 7: PDF-CDF of response times for three techniques in AlexNet model on ECG5000 with 70 concurrent users

Overall, the results demonstrate the significant overhead introduced by applying SMC compared to DP, with a 9-fold increase in response time for the two-party configuration. While the twoparty setup consistently achieves lower average response times than the three-party configuration across all datasets and bandwidths, doubling the bandwidth from 250 Mbps to 500 Mbps generally reduces response times for both configurations. This improvement is particularly evident for more complex models like AlexNet. Notably, the impact of increased bandwidth is more pronounced in the three-party setting, where response times at 250 Mbps are significantly higher than at 500 Mbps. These findings underscore the importance of carefully selecting the optimal setup to balance computational and communication overhead. Additionally, Figure 7 illustrates the cumulative distribution function (CDF) and the probability density function (PDF) of response times for the simulation experiment and implementation for the AlexNet model with 70 concurrent users on the ECG5000 dataset. It provides a detailed analysis of response time distributions across all three techniques. The PDF curves in each subplot (7a, 7b, and 7c) resemble mixtures of Gaussian distributions, with multiple peaks indicating distinct response time clusters. Each subplot also includes the PDF of inference time traces obtained from the hardware implementation, offering additional insight into real-world performance variations. Among the techniques, DP exhibits the least variability, forming a nearly

Gaussian distribution similar to the trace distribution, with average response times of 0.0452s and 0.185s, respectively. In contrast, SMC shows moderate variability, likely influenced by network conditions, multi-party interaction, and resource allocation, resulting in a bimodal distribution. FHE has the highest variability, with multiple peaks suggesting diverse response time clusters, primarily due to the computational overhead of homomorphic encryption. Also, Table 7 shows the average response time breakdown for three privacy techniques on the AlexNet model with 70 concurrent users. The queuing time was measured during the simulation experiment, but the other components are based on the collected traces. DP is the fastest (0.185s) due to minimal processing overhead, making it ideal for real-time use. FHE is significantly time consuming (3102.03s), with massive inference time (663.91s) and queuing time (2433.16s). SMC offers a middle ground (76.775s), but still suffers from significant inference time (11.403s) and communication (9.6s) overhead. While DP achieves performance comparable to the raw model, FHE and SMC exhibit notable performance trade-offs. FHE’s response time is heavily influenced by model complexity, leading to significant delays, whereas SMC’s performance is primarily constrained by communication overhead and the number of parties involved.

Table 7: Average response time breakdown for AlexNet model on ECG5000 with 70 concurrent users. Technique

SMC - 3-party - 500Mbps

FHE

0.001

N/A

Data/Model Encryption

N/A

0.147

4.960

Inference Time

0.0442

11.403

663.91

Communication

N/A

9.6

N/A

Queuing Time

0.1398

55.624

2433.16

Total

0.185

76.775

3102.03

Time (s) Data Pre-processing

5.3 Energy Consumption

low-latency and high-reliability processing [52]. In these edge intelligence scenarios, PPML plays a critical role in achieving this balance, enabling secure, real-time inference while adapting to the constraints of edge devices and networks. In smart healthcare, devices like wearable monitors or hospital-edge servers must process sensitive data in real time, for instance, to detect early signs of cardiac events or predict sepsis [53, 54]. Here, DP can be employed during model training via DP-SGD to ensure patient-level privacy without exposing raw medical records. However, this approach introduces noise that may slightly reduce model accuracy, necessitating a careful trade-off between diagnostic precision and privacy guarantees. For collaborative inference involving multiple devices on sensitive physiological data, SMC combined with TLS ensures that patient data remains encrypted throughout the inference process and during transmission to edge servers. This setup maintains strong privacy protection even when operating over unsecured networks, enabling secure real-time diagnostics without exposing raw patient data. In autonomous vehicles, low-latency decisionmaking is crucial, for example, real-time object detection, obstacle avoidance, or vehicle-to-vehicle coordination [55]. FHE enables vehicles to process encrypted sensor inputs (like LiDAR or camera data) on edge servers without ever decrypting them, thus protecting in-transit data. Due to FHE’s computational demands in ConcreteML, systems must be optimized by reducing model complexity, quantizing models (e.g., to 4–6 bits), and offloading computation to powerful edge servers. These optimizations ensure encrypted inference can meet strict latency requirements (e.g., less than 50 milliseconds) while keeping

We measure the average energy consumption per inference for each model for ECG5000 dataset with different techniques. As shown in Table 8, Concrete-ML running FHE is the most energyintensive technique, especially for complex models. The energy consumption reaches 20.0167 Wh for AlexNet, making FHE a costly choice for high-accuracy, privacy-preserving machine learning on resource-constrained devices. The experiment with SMC ranks second to FHE in terms of energy intensity. SMC energy consumption increases with model complexity and is affected by network bandwidth, with faster connections resulting in lower energy usage. For example, a 2party SMC with AlexNet at 250 Mbps consumes 0.4766 Wh, while at 500 Mbps, it decreases to 0.3093 Wh. Increasing from 2-party to 3-party SMC further raises energy requirements, indicating that each additional participant introduces a small but measurable increase in resource usage. The third technique, DP, consistently yields the lowest energy consumption across all models (0.0009–0.0011 Wh), demonstrating high energy efficiency. Energy usage also scales with model complexity, AlexNet consumes the most, while simpler models like LeNet-5 require less.

5.4 Discussion Selecting the right privacy-preserving technique is essential for ensuring both performance and privacy for EI applications. This decision involves balancing two key considerations: the required level of privacy and the distributed nature of edge infrastructure. In particular, applications such as smart healthcare and autonomous vehicles demand not only strong data protection but also 18

Table 8: Average energy consumption in watt-hours (Wh) per inference for different techniques running on ECG5000. Model

LeNet-5

SqueezeNet

AlexNet

0.0009

0.0011

SMC - 2-party - 250Mbps

0.0111

0.0417

0.4766

SMC - 2-party - 500Mbps

0.0088

0.0296

0.3093

SMC - 3-party - 250Mbps

0.0186

0.0713

0.7436

SMC - 3-party - 500Mbps

0.0158

0.0519

0.4997

FHE

1.1168

13.1325

20.0167

Technique

energy consumption within acceptable limits (e.g., around 5 Watt per vehicle). Similarly, in SMCbased collaborative perception tasks, reducing the number of participants and improving network bandwidth can significantly lower latency, allowing timely navigation decisions. Our findings indicate that the system-level performance of PPML techniques is shaped by both the underlying communication infrastructure and the scale of deployment. For example, SMC protocols degrade as party counts and network delays increase, whereas FHE is bounded primarily by compute availability. Furthermore, while Concrete-ML automates the process of compiling models, it does not encrypt or secure the model itself. As a result, careful quantization and parameter tuning are essential to maintain both inference accuracy and energy efficiency. Across these applications, privacy methods must be selected and configured not in isolation, but in the context of real-world requirements such as detection accuracy, latency thresholds, energy budgets, and regulatory constraints. By grounding PPML deployment in specific edge-intelligent use cases, designers can achieve secure, efficient, and responsive systems that uphold both functional and ethical standards.

encrypted inference. Table 9 summarizes the key aspects of this security analysis for each technique.

6.1 DP with TensorFlow Privacy Threat model and guarantee. DP bounds what can be inferred about any single training example from the learned model. A randomized mechanism M is (ε, δ )-DP if for all adjacent datasets D, D′ differing in one record and all measurable sets S [11, 56], Pr[M(D) ∈ S ] ≤ eε Pr[M(D′ ) ∈ S ] + δ.

(1)

Smaller ε (for fixed δ ) implies stronger privacy. The parameter δ is a failure probability: with probability at most δ , the mechanism may deviate from the pure ε-DP bound. To make such events vanishingly unlikely, δ is chosen negligible in the dataset size. In our setting, we fix δ to a negligible rate, e.g., δ ≤ N −(1+γ) , so the overall guarantee holds except with probability at most δ . Here N denotes the size of the private training dataset (the number of distinct training records that incur privacy loss). We train with DP-SGD: per-example gradients are ℓ2 -clipped and Gaussian noise N (0, σ 2 C 2 I ) is added to the clipped sum each step. A privacy accountant based on Moments Accountant (MA) or Rényi Differential Privacy (RDP) composes the per-step guarantees to an overall (ε, δ ) given the noise multiplier σ , batch size B , sampling rate q =B/N , and number of steps T (epochs ≈ T · B/N ).

6 Security Analysis We analyze the protection goals, threat models, and practical leak channels for three families of privacy technologies used in our edge inference pipeline: (i) DP with TensorFlow Privacy during training, (ii) SMC with CrypTen for encrypted inference, and (iii) FHE with Concrete-ML for

Security knobs and side effects. Increasing σ lowers ε (stronger privacy) but typically reduces utility (accuracy). DP constrains 19

Table 9: Privacy focus, main knobs, and extraction impact. Method

Privacy Focus

Primary Knobs

Extraction Impact

DP (TensorFlow Privacy)

Training-data privacy; (ε, δ)DP

Noise multiplier σ, clipping, sampling rate; accountant ⇒ (ε, δ)

Outputs unchanged; higher σ typically increases ∆metrics (harder extraction) but reduces target accuracy

SMC (CrypTen)

Inference-time confidentiality among parties

#parties, 16-bit fixed-point precision, ring Z264 , Beaver triples

Predictions (in clear to querier) comparable to plaintext; extraction feasibility similar to non-private unless outputs restricted

FHE ML)

Client input confidentiality under 128-bit security

Security level (e.g., 128-bit), quantization, circuit depth

Predictions decrypted to client; extraction similar to non-private unless outputs perturbed/accesscontrolled

(Concrete-

training-time leakage and provides robustness against inference that targets the inclusion or attributes of specific training points; however, it does not cryptographically hide inference inputs/parameters and does not, by itself, prevent black-box model extraction from released predictions.

the semi-honest model. Malicious-secure variants require additional checks (e.g., MACs/consistency proofs) and are not enabled by default.

Implementation characteristics. The communication layer must use authenticated encryption, such as TLS, which is supported by CrypTen, to prevent traffic inspection, tampering, and session hijacking that could otherwise leak metadata or enable active disruption [44]. Trust in the execution platform is likewise foundational: each party should run on an isolated, hardened node (VMs or container sandboxes with least privilege), because a compromised host can capture plaintext at ingress/egress or instrument the runtime to exfiltrate shares. Side channels remain a residual risk: variable batch sizes, data-dependent control flow, and non-constant-time kernels can correlate timing, message sizes, or round counts with private inputs. Finally, code provenance and binary integrity are part of the threat surface, if an adversary can alter delivered artifacts or dependencies, they can introduce covert disclosure while preserving protocol transcripts.

Attacks mitigated vs. not mitigated. DP directly mitigates training-data inference attacks such as membership inference, attribute inference about individual training records, and certain property/linkage tests that rely on overfitting to specific examples. By contrast, DP does not hide the functional behavior of the deployed model: a black-box API can still be queried to distill a surrogate (model stealing), unless outputs are restricted or perturbed at inference time [57, 58]. In our evaluation (Section 6.4), we quantify this tension by sweeping σ , reporting the induced (ε, δ ), and measuring how the extraction gap ∆ changes with the attacker’s query budget.

6.2 SMC with CrypTen Threat model and guarantee. SMC protects data in use during inference against semi-honest (honest-but-curious) parties [12]. In CrypTen, inputs and model parameters are secretshared and the network is evaluated over an arithmetic ring without revealing raw values to any single party. The default instantiation provides information-theoretic privacy against up to one corrupted party (i.e., t=1 < n/2) under

Security knobs and side effects. Our results show that increasing the number of parties primarily impacts communication, latency, and round complexity, but does not change model accuracy, since the secure protocol computes the same function. In contrast, precision/quantization settings (e.g., fixed-point fractional bits under the default 16-bit encoding and the Z264 ring) directly affect numerical error and thus can impact 20

6.4 Privacy under Model Stealing

accuracy: too few fractional bits or poor scaling increase quantization error; overly aggressive scaling risks modular wraparound. SMC does not degrade performance like DP; accuracy typically matches plaintext given adequate precision. SMC does not prevent model extraction when an adversary can query the black-box and observe cleartext outputs, since the confidentiality guarantee covers inputs/parameters during computation, not the information content of released predictions. Reducing precision (fewer fractional bits) can substantially improve throughput and bandwidth, but the trade is purely numerical : it may lower task accuracy or increase wraparound risk; it does not reduce the t=1 semi-honest corruption threshold or the information-theoretic privacy of shares. Conversely, moving from semi-honest to malicious security strengthens guarantees (detecting active tampering) at additional compute/communication cost.

A model–stealing (model–extraction) attack treats the deployed predictor as a black box: the adversary collects or synthesizes inputs x, queries the API, records the returned predictions, and trains a surrogate to mimic the target’s decision function. This is prominent in EI deployments, where prediction endpoints are exposed to field devices: even without access to weights or training data, a compromised device can generate realistic query traffic and harvest outputs. We adapt a protocol previously examined for FHE in cloud settings [59], but tailor it to EI: rather than presuming the attacker holds a subset of the training data, we assume the adversary compromises an edge device, harvests sensor traces, and issues black–box queries to the remotely hosted target model at the edge server layer, observing only top–1 outputs. This captures the operational reality of EI, where training data are centralized and inaccessible, but field devices can be subverted. We concentrate our empirical study on DP rather than SMC or FHE because DP changes the learned model in a way that can affect extractability. DP-SGD clips per-example gradients and adds Gaussian noise. This lowers target accuracy and smooths decision boundaries; with a fixed query budget, the surrogate lags further behind, revealing a privacy–utility–stealability trade-off controlled by σ . In contrast, SMC (CrypTen) and FHE (Concrete-ML) cryptographically protect inputs, parameters, and the evaluation procedure, but once predictions are revealed their information content matches plaintext unless extra defenses (output perturbation, throttling, access control) are applied, so stealing curves would resemble plaintext, only slower to run. Practically, DP (via TensorFlow Privacy) is easy to sweep over σ , letting us report both attack outcomes and the corresponding ε. Accordingly, we quantify how DP training, via a σ sweep, affects the attacker’s ability to approach the target under fixed query budgets in our EI threat model.

6.3 FHE with Concrete-ML Threat model and guarantee. FHE protects data in use by enabling computation directly on encrypted inputs (and optionally encrypted model parameters depending on the deployment pattern). Concrete-ML uses leveled/FHE circuits (with programmable bootstrapping) and by default targets at least 128-bit classical security [50]. Implementation characteristics. Models are quantized (e.g., to 4-bit integers) and compiled to FHE circuits; inference returns encrypted outputs that the client decrypts. As with SMC, FHE keeps inputs hidden from the model owner and infrastructure. Security knobs and side effects. Security level (e.g., 128-bit) is set by lattice parameters; increasing precision or circuit depth increases latency. Like SMC, FHE does not inherently mitigate model extraction from accessible (decrypted) outputs. With sufficient numeric precision (e.g., appropriate quantization scale and polynomial approximations), its predictive accuracy typically matches the plaintext model. Any residual loss is due to implementation limits (precision, polynomial depth, compiler constraints).

6.4.1 Attack Model and Protocol We consider a black-box adversary that can submit inputs to the target and observe top-1 predictions (no white-box access). The attacker selects a fraction q of the held-out test set as queries and augments them with synthetic samples generated 21

by Gaussian perturbations around queried points. The DP-trained target is queried on this union to obtain stolen labels ŷ (t). A non-private substitute model is then trained with cross-entropy on the attacker dataset (real+synthetic, stolen labels) using a validation split for early selection. Finally, both the DP target and the substitute model are evaluated on the disjoint (1−q ) holdout. We report macro-averaged Accuracy, Precision, Sensitivity (Recall), and F1 . In addition, following security-centric practice, we measure the performance gaps ∆Acc = Acctarget − Accsub , ∆Prec = Prectarget − Precsub , ∆Sens = Senstarget − Senssub ,

Fig. 8: Differential Privacy vs. model stealing on FordA with LeNet. We vary the DP noise multiplier σ and compare two attacker query-pool fractions q ∈ {0.15, 0.30}. Top: target accuracy; middle: substitute accuracy; bottom: accuracy gap ∆Acc.

(2)

∆F1 = F1target − F1sub . where larger gaps indicate the attacker is further from the target (harder extraction).

6.4.2 Implementation We evaluate on the FordA time-series dataset. The target is trained with TensorFlow Privacy applying DP-SGD (per-example clipping and Gaussian noise) while sweeping the noise multiplier σ ∈ {0.1, 0.2, . . . , 1.0, 2.0}; A standard privacy accountant reports the corresponding (ε, δ ) at the end of training. For the attacker, we sample a fraction q ∈ {0.15, 0.30} of the test set as the query pool, then generate synthetic queries by resampling with replacement and adding IID Gaussian jitter (noise scale 0.05). We set the synthetic factor to 1.0, producing as many synthetic points as real ones, and query the black-box target on the union of real and synthetic inputs to obtain stolen labels. The substitute is a plain LeNet trained with cross-entropy on the stolen labels; we select the best checkpoint by validation accuracy on a held-out split of the attacker’s data. Evaluation uses the disjoint (1−q ) holdout to compute macro Accuracy, Precision, Sensitivity (Recall), and F1 for both target and substitute, and we log per-run JSON (including ∆-metrics, Target−Substitute). All experiments are repeated with 5 random seeds; we report mean±std for every metric across seeds and across the σ sweep. For each σ , we also compute the privacy loss ε(σ ; N, B, T, δ ) using an RDP-based accountant.

We then plot the ∆-metrics against σ and overlay (or co-plot) the corresponding ε values, enabling a joint view of utility/extractability (via ∆-metrics) versus formal privacy (via ε). This makes it easy to identify operating points where ε is small (stronger privacy) while ∆Acc remains large (the substitute lags the target).

6.4.3 Results Summary Figure 8 shows three coupled trends. First, as σ increases (i.e., privacy strengthens), the target’s accuracy falls roughly monotonically: for q =0.15 it drops from about 72% at σ =0.1 to about 60% at σ =2.0. Second, the substitute’s accuracy is governed mainly by the attack budget: the q =0.30 curve sits consistently above q =0.15 (e.g., around 62% vs. 57% at small σ ), reflecting that more queries plus synthetic augmentation yield a better surrogate. Consequently, the gap ∆Acc narrows both when q increases (stronger extractability) and when σ becomes very large (the target itself weakens). In the mid-noise regime, the target remains viable while the attacker’s gains are modest, producing a larger and more desirable ∆Acc (about 0.10 near σ≈0.5 for q =0.15, tapering to ∼ 0.05 by σ =2.0). 22

The overlaid ε curve (top panel, right log axis) quantifies privacy as a function of σ for FordA with training size N =3601, batch size 50, 25 epochs, and δ =1/N . The accountant yields a precipitous drop in ε as σ grows: at very small noise (σ =0.1), ε is extremely large (order 104 –105 ), offering little practical privacy; by σ≈0.5, ε is already well below 10, and around σ≈1.0 it reaches the O(1) regime (substantially stronger privacy). Thus, increasing σ simultaneously reduces extractability (keeping the substitute behind the target) and lowers ε, but at the cost of target utility. Across seeds we observe low variance for the target and higher variance for the substitute, especially at q =0.15, indicating that DP training also makes the attack less stable when the adversary’s query budget is constrained. Overall, the figure exposes a three-way tradeoff: raising σ strengthens formal privacy (lower ε) and dampens stealing success (larger ∆Acc at moderate noise), while larger q improves the attacker (shrinking ∆Acc) without affecting the target directly. The most defensible operating points lie where ε is in the single-digits and the target still retains acceptable accuracy (mid-σ ), keeping the attacker data-limited. To make this concrete, Table 10 summarizes how the extraction gap (Target − Substitute) varies with the DP noise multiplier σ on FordA/LeNet when the attacker controls 30% of the test set for queries. The gaps are largest at low noise and shrink as σ increases: ∆Acc is about 0.097 at σ =0.1, around 0.052 at σ =0.5, and falls to 0.024 at σ =2.0. Precision, Sensitivity, and F1 track accuracy closely (typically within ≈ 0.002), indicating that DP noise affects the surrogate’s class-wise behavior uniformly rather than skewing a particular metric.

Table 10: Gap metrics (Target − Substitute) vs. DP noise multiplier σ on FordA with LeNet for attacker fraction q = 0.30. Means over 5 seeds. σ

∆Acc

∆Prec

∆Sens

∆F1

0.1

0.097

0.098

0.099

0.2

0.098

0.099

0.100

0.3

0.080

0.081

0.085

0.4

0.059

0.060

0.059

0.060

0.5

0.052

0.053

0.051

0.052

0.6

0.056

0.058

0.7

0.062

0.063

0.062

0.063

0.8

0.060

0.062

0.060

0.061

0.9

0.054

0.053

0.054

1.0

0.049

0.050

0.048

2.0

0.024

0.026

0.024

analysis and the experimental setup. We also present a case study of a black-box model–stealing attack against DP, including an implementation and quantitative results. Our findings reveal that while DP achieves performance close to the raw model, it suffers significant accuracy loss due to added noise, particularly in complex models like AlexNet. FHE faces substantial computational overhead, requiring careful system design, such as reducing model complexity and offloading inference to high-performance edge servers. SMC performance is highly sensitive to network bandwidth and the number of participating parties, with increasing parties leading to greater communication overhead and performance degradation. In future work, we plan to work on optimizing these techniques and developing new task scheduling algorithms to improve their performance in edge computing environments.

7 Conclusion Privacy is a key challenge in EI applications, driven by concerns over sensitive data and its potential impacts. This paper focuses on evaluating different privacy-preserving techniques for EI applications using trace-based simulation. We provide an overview of the primary privacypreserving approaches and their applications in edge environments, followed by a detailed description of the framework’s architecture, privacypreserving frameworks, the associated security

Acknowledgment This work was supported in part by AerVision Technologies.

Declarations • Funding: This research was supported in part by AerVision Technologies. 23

• Conflict of interest/Competing interests: The authors declare that they have no competing interests. • Ethics approval and consent to participate: This study did not involve human participants or animals, and therefore ethics approval and consent to participate were not required. • Consent for publication: Not applicable. • Data availability: The datasets used in this study are publicly available. • Materials availability: Not applicable. • Code availability: The code used to reproduce the experiments is available from the corresponding author upon reasonable request. • Author contribution: Quoc Lap Trieu (QLT) conceived the study, designed the methodology, implemented the framework, conducted the experiments, analyzed the results, and drafted the manuscript. Bahman Javadi Jahantigh (BJJ) supervised the research, contributed to study design and interpretation of results, and revised the manuscript critically. Jim Basilakis (JB) contributed to the experimental design and evaluation methodology, assisted with interpretation of results, and revised the manuscript. All authors reviewed and approved the final manuscript.

[4] Altintas I, Purawat S, Perez I, Lee J, Floca M, Block J, et al. Streamlined Edge Computing for Fire Science and Management using WIFIRE Edge. In: 2024 IEEE 20th International Conference on e-Science (e-Science). IEEE; 2024. p. 1–10. [5] Singh R, Gill SS. Edge AI: a survey. Internet of Things and Cyber-Physical Systems. 2023;3:71–92. [6] Mercier D, Lucieri A, Munir M, Dengel A, Ahmed S. Evaluating privacy-preserving machine learning in critical infrastructures: A case study on time-series classification. IEEE Transactions on Industrial Informatics. 2021;18(11):7834–7842. [7] Seidi S, Abdellaoui A. Securing and Ensuring the Confidentiality of Medical Data in the Era of Decentralized Technologies: A Blockchain and Self-Sovereign Identity-Based Approach. Journal of Network and Systems Management. 2025;33(4):81. [8] Boubertakh O, Sahnoun A, Zitouni A, Harous S. HyMD2I: Hybrid MetaheuristicDeep Learning Approach for Intrusion Detection in IoT. Journal of Network and Systems Management. 2025;33(3):74. [9] Ding X, Lv R, Pang X, Hu J, Wang Z, Yang X, et al. Privacy-preserving task allocation for edge computing-based mobile crowdsensing. Computers & Electrical Engineering. 2022;97:107528.

References [1] Kamruzzaman MM, Alrashdi I, Alqazzaz A. New Opportunities, Challenges, and Applications of Edge-AI for Connected Healthcare in Internet of Medical Things for Smart Cities [Journal Article]. Journal of healthcare engineering. 2022;2022:2950699–14.

[10] Yang Y, Huang X, Liu X, Cheng H, Weng J, Luo X, et al. A Comprehensive Survey on Secure Outsourced Computation and Its Applications [Journal Article]. IEEE access. 2019;7:159426–159465.

[2] Zhou Z, Chen X, Li E, Zeng L, Luo K, Zhang J. Edge intelligence: Paving the last mile of artificial intelligence with edge computing [Journal Article]. Proceedings of the IEEE. 2019;107(8):1738–1762.

[11] Dwork C. A firm foundation for private data analysis [Journal Article]. Communications of the ACM. 2011;54(1):86–95. [12] Feng D, Yang K. Concretely efficient secure multi-party computation protocols: survey and more [Journal Article]. Security and Safety. 2022;1:2021001.

[3] Shi Y, Yang K, Jiang T, Zhang J, Letaief KB. Communication-Efficient Edge AI: Algorithms and Systems [Journal Article]. IEEE Communications surveys and tutorials. 2020;22(4):2167–2191. 24

[22] Du M, Wang K, Xia Z, Zhang Y. Differential Privacy Preserving of Training Model in Wireless Big Data with Edge Computing [Journal Article]. IEEE transactions on big data. 2020;6(2):283–295.

[13] Parikh S, Dave D, Patel R, Doshi N. Security and privacy issues in cloud, fog and edge computing [Journal Article]. Procedia Computer Science. 2019;160:734–739. [14] Du M, Wang K, Chen Y, Wang X, Sun Y. Big data privacy preserving in multi-access edge computing for heterogeneous Internet of Things [Journal Article]. IEEE Communications Magazine. 2018;56(8):62–67.

[23] Li Y, Li H, Xu G, Xiang T, Lu R. Practical privacy-preserving federated learning in vehicular fog computing [Journal Article]. IEEE Transactions on Vehicular Technology. 2022;71(5):4692–4705.

[15] Hassan MU, Rehmani MH, Chen J. Differential privacy techniques for cyber physical systems: a survey [Journal Article]. IEEE Communications Surveys & Tutorials. 2019;22(1):746–789.

[24] Kanagavelu R, Wei Q, Li Z, Zhang H, Samsudin J, Yang Y, et al. CE-Fed: Communication efficient multi-party computation enabled federated learning [Journal Article]. Array. 2022;15:100207.

[16] Wan Y, Qu Y, Gao L, Xiang Y. Privacypreserving blockchain-enabled federated learning for B5G-Driven edge computing [Journal Article]. Computer Networks. 2022;204(108671).

[25] Liu Z, Cao Z, Dong X, Zhao X, Bao H, Shen J. A verifiable privacy-preserving data collection scheme supporting multi-party computation in fog-based smart grid [Journal Article]. Frontiers of Computer Science. 2022;16:1–11.

[17] Wu X, Zhang Y, Shi M, Li P, Li R, Xiong NN. An adaptive federated learning scheme with differential privacy preserving [Journal Article]. Future Generation Computer Systems. 2022;127:362–372.

[26] Praveen K, KS GA, Ray IG, Adhikari A, Datta S, Biswas AK. On the Design of a Searchable Encryption Protocol for Keyword Search using Proactive Secret Sharing. In: 2024 IEEE 20th International Conference on e-Science (e-Science). IEEE; 2024. p. 1–8.

[18] Liu X, Zhou P, Qiu T, Wu DO. BlockchainEnabled Contextual Online Learning under Local Differential Privacy for Coronary Heart Disease Diagnosis in Mobile Edge Computing [Journal Article]. IEEE Journal of Biomedical and Health Informatics. 2020;24(8):2177– 2188.

[27] Olakanmi OO, Odeyemi KO. Trust-aware and incentive-based offloading scheme for secure multi-party computation in Internet of Things [Journal Article]. Internet of Things. 2022;19:100527.

[19] Gai K, Wu Y, Zhu L, Zhang Z, Qiu M. Differential Privacy-Based Blockchain for Industrial Internet-of-Things [Journal Article]. IEEE Transactions on Industrial Informatics. 2020;16(6):4156–4165.

[28] Liu D, Sun F, Wang W, Dev K. Distributed Computation Offloading with Low Latency for Artificial Intelligence in Vehicular Networking [Journal Article]. IEEE Communications Standards Magazine. 2023;7(1):74–80.

[20] Apple D. Learning with Privacy at Scale [Journal Article]. Apple Machine Learning Journal. 2017;1(8).

[29] Khan HM, Khan A, Jabeen F, Anjum A, Jeon G. Fog-enabled secure multiparty computation based aggregation scheme in smart grid [Journal Article]. Computers & Electrical Engineering. 2021;94:107358.

[21] Mao Y, Yi S, Li Q, Feng J, Xu F, Zhong S. A privacy-preserving deep learning approach for face recognition with edge computing. In: Proc. USENIX Workshop Hot Topics Edge Comput.(HotEdge); 2018. p. 1–6.

[30] Salim MM, Kim I, Doniyor U, Lee C, Park JH. Homomorphic Encryption Based

[39] Xu G, Zhang J, Wang L. An edge computing data privacy-preserving scheme based on blockchain and homomorphic encryption. In: 2022 International Conference on Blockchain Technology and Information Security (ICBCTIS). IEEE; 2022. p. 156–159.

Privacy-Preservation for IoMT [Journal Article]. Applied Sciences. 2021;11(18):8757. [31] Qiu T, Liu X, Han M, Ning H, Wu DO. A secure time synchronization protocol against fake timestamps for large-scale Internet of Things [Journal Article]. IEEE Internet of Things Journal. 2017;4(6):1879–1889.

[40] Shokri R, Stronati M, Song C, Shmatikov V. Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP). IEEE; 2017. p. 3–18.

[32] Cheon JH, Costache A, Moreno RC, Dai W, Gama N, Georgieva M, et al. Introduction to homomorphic encryption and schemes. In: Protecting Privacy through Homomorphic Encryption. Springer; 2022. p. 3–28.

[41] Shafee A, Mahmoud M, Bruce J, Srivastava G, Balamsh A, Aljohani AJ. False Data Detector for Electrical Vehicles Temporal-Spatial Charging Coordination Secure Against Evasion and Privacy Adversarial Attacks. IEEE Transactions on Dependable and Secure Computing. 2023;21(4):2027–2044.

[33] Alabdulatif A, Khalil I, Yi X, Guizani M. Secure Edge of Things for Smart Healthcare Surveillance Framework [Journal Article]. IEEE Access. 2019;7:31010–31021. [34] Cheng W, Ou W, Yin X, Yan W, Liu D, Liu C. A Privacy-Protection Model for Patients [Journal Article]. Security and Communication Networks. 2020;2020:1–12.

[42] Shafee A, Hasan S, Awaad TA. Privacy and security vulnerabilities in edge intelligence: An analysis and countermeasures. Computers and Electrical Engineering. 2025;123:110146.

[35] Lin H, Garg S, Hu J, Wang X, Piran MJ, Hossain MS. Privacy-enhanced data fusion for COVID-19 applications in intelligent Internet of medical Things [Journal Article]. IEEE Internet of Things Journal. 2020;8(21):15683–15693.

[43] Papernot N. Machine learning at scale with differential privacy in TensorFlow. In: 2019 {USENIX} Conference on Privacy Engineering Practice and Respect ({PEPR} 19); 2019. .

[36] Chen J, Li K, Philip SY. Privacy-preserving deep learning model for decentralized vanets using fully homomorphic encryption and blockchain [Journal Article]. IEEE Transactions on Intelligent Transportation Systems. 2021;23(8):11633–11642.

[44] Knott B, Venkataraman S, Hannun A, Sengupta S, Ibrahim M, van der Maaten L. Crypten: Secure multi-party computation meets machine learning. Advances in Neural Information Processing Systems. 2021;34:4961–4973.

[37] Catalfamo A, Celesti A, Fazio M, Villari M. A homomorphic encryption service to secure data processing in a cloud/edge continuum context. In: 2022 9th International Conference on Future Internet of Things and Cloud (FiCloud). IEEE; 2022. p. 55–61.

[45] Chillotti I, Gama N, Georgieva M, Izabachène M. TFHE: fast fully homomorphic encryption over the torus [Journal Article]. Journal of Cryptology. 2020;33(1):34–91.

[38] Hrzich J, Basra G, Halabi T. Experimental evaluation of homomorphic encryption in cloud and edge machine learning. In: 2022 14th International Conference on Knowledge and Systems Engineering (KSE). IEEE; 2022. p. 1–6.

[46] Chillotti I, Joye M, Ligier D, Orfila JB, Tap S. Concrete: Concrete operates on ciphertexts rapidly by extending tfhe. In: WAHC 20208th Workshop on Encrypted Computing & Applied Homomorphic Cryptography; 2020. .

[47] Wang X, Jia W. Optimizing Edge AI: A Comprehensive Survey on Data, Model, and System Strategies. arXiv preprint arXiv:250103265. 2025;.

[57] Liu J, Oya S, Kerschbaum F. Generalization techniques empirically outperform differential privacy against membership inference. arXiv preprint arXiv:211005524. 2021;.

[48] Krizhevsky A, Sutskever I, Hinton G. ImageNet Classification with Deep Convolutional Neural Networks. In: Advances in Neural Information Processing Systems. vol. 25. Curran Associates, Inc.; 2012. p. 1097–1105.

[58] Zhao K, Li L, Ding K, Gong NZ, Zhao Y, Dong Y. A systematic survey of model extraction attacks and defenses: State-ofthe-art and perspectives. arXiv preprint arXiv:250815031. 2025;.

[49] Bagnall A, Lines J, Vickers W, Keogh E.: The UEA & UCR Time Series Classification Repository. http: //www.timeseriesclassification.com. Online.

[59] Balaban B, Magara SS, Yilgor C, Yucekul A, Obeid I, Pizones J, et al. Privacy-preserving machine learning (PPML) inference for clinically actionable models. IEEE Access. 2025;.

[50] Zama.: Concrete-ML: Get Started. Accessed: 2024-10-08. https://docs.zama.ai/ concrete-ml/get-started/concepts. [51] Souza PS, Ferreto T, Calheiros RN. EdgeSimPy: Python-Based Modeling and Simulation of Edge Computing Resource Management Policies. Future Generation Computer Systems. 2023;148:446–459. [52] Rancea A, Anghel I, Cioara T. Edge computing in healthcare: Innovations, opportunities, and challenges. Future internet. 2024;16(9):329. [53] Ochoa GFT, Clavijo PEC, Tonato JLM, Guartatanga PGP, Vela MPM, Nuñez FIN, et al. Efficacy of wearable cardiac monitoring devices versus traditional methods in detecting atrial fibrillation: a systematic review and meta-analysis. Salud, Ciencia y TecnologÃa. 2024;4. [54] Qiu J, Wang Y. A smartwatch to identify atrial fibrillation. The New England journal of medicine. 2020;382(10):974–975. [55] Mao J, Shi S, Wang X, Li H. 3D object detection for autonomous driving: A comprehensive survey. International Journal of Computer Vision. 2023;131(8):1909–1963. [56] Dwork C, Roth A, et al. The algorithmic foundations of differential privacy. Foundations and trends® in theoretical computer science. 2014;9(3–4):211–407.

Record · ID 168274 · SHA-256 3edea49e239738bb
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.