## 6 Results and Discussion
Additionally, the computational overhead for generating these encodings with RBMs and applying the ENN algorithm is significantly lower than that of cryptographic methods like MPC and HE. For example, encoding 10,000 images from the MNIST dataset [16] using our RBM model takes each client an average of 243.8 ms, while encoding 10,000 images from Fashion-MNIST [17] takes approximately 272.3 ms. Further, applying the ENN algorithm to these 10,000 MNIST encodings takes an average of 6.28 s, and for Fashion-MNIST encodings, it takes an average of 7.63 s.  
To analyze and evaluate the privacy of our framework, we employ qualitative metrics, as suggested by [9]. These metrics include Privacy of the Client (PoC), Privacy of the Model (PoM), and Privacy of the Result (PoR). PoC ensures that neither the server nor other clients can access individual client data. PoM ensures that clients remain unaware of the deep learning model and its parameters, while PoR ensures that clients cannot access information about predicted outcomes. Our framework guarantees all three privacy metrics. We secure the privacy of training datasets by training global models on subsets of user-encoded data rather than the complete raw data. While it is possible that a determined server could decode this subset, our framework, like most privacy-preserving frameworks, assumes that participating parties are honest but may be curious. Also, the server is not required to disclose the trained model or its parameters to the training parties, also known as the donors of the training data. This ensures the Privacy of the Model (PoM). During the inference phase, clients maintain the privacy of their input data by encoding it using a Restricted Boltzmann Machine before sending it to the central server for a prediction. Additionally, we add an extra layer of protection to the prediction outcome: the server only sends back the prediction label without including the confidence score, thereby mitigating the risk of black-box privacy attacks that often leverage such scores. The level of privacy achieved is directly proportional to the reduction rate enabled by the instance reduction technique employed. This makes it important to explore more effective reduction algorithms with higher reduction rates, such as DROP3 [14]. However, such algorithms often require substantial computational resources, especially when applied to image datasets with numerous attributes. Improving the efficiency of these algorithms and developing new, more efficient reduction methods remains an open area for future research. Table 10 compares our framework with some of the Privacy-Preserving Deep Learning (PPDL) works surveyed by [9], using qualitative privacy metrics (PoC, PoM, and PoR). In Table 10, the results listed above the bold line are those provided by [9], while the last two rows are for Instance Encodings [64] and our framework. From Table 10, we observe that our framework and Trusted Execution Environments (TEE) frameworks satisfy all the privacy qualitative metrics compared to other frameworks. In contrast to our framework, TEEs have restricted memory and CPU resources, making it challenging to train complex deep-learning models [46]. Also, the table shows that the secure MPC-based frameworks fail to ensure clients' data privacy (PoC), while the HE-based frameworks fail to ensure model privacy (PoM). Additionally, we compare our work against InstaHide [64] since it proposes a similar idea of encoding the training instances before using them to train machine learning models. Nevertheless, InstaHide [64] does not guarantee model privacy since it is based on federated learning that shares parameters. Further, it does not guarantee the client's data privacy as claimed by the authors, since it is vulnerable to privacy attacks that recover the training data [65]. In summary, our framework protects the learning framework privacy by satisfying all privacy metrics and maintaining utility.