# Privacy-Preserving Outsourced Artificial Neural Network Training for Secure Image Classification
## 5 Analysis and Evaluation
### Comparison of Feature  
For the purpose of measuring the properties of state-of-the-art privacy-preserving neural network algorithms, we compare the properties of current work in the literature in terms of lossless training, non-interactivity between users and cloud servers and techniques employed by the algorithms. From the Table 2, we can find most of schemes can not have non-interactive and lossless features simultaneously. One of the main novelties of the _IPPNN_ method is to remove the need for multiple communications between the users and the servers. In other words, the _IPPNN_ is a non-interactive scheme which only requires communication between the users and the servers as a one-way transmission. The key point is that the encrypted data are specific-designed through two folds: _(i)_ by the public key of function encryption and _(ii)_ by the random mask matrix. The server \(\mathcal{S}_{\mathcal{ML}}\) will obtain the information of inner \(\mathbf{w}\cdot\mathbf{x}\), by exploiting the blinded data \(\mathbf{x}\) and mask matrix \(A\). After computing the outputs of all neurons and sending them to the server \(\mathcal{S}_{\mathcal{NN}}\), the tasks of the \(\mathcal{S}_{\mathcal{ML}}\) are completed. The rest of the work can be completed by the server \(\mathcal{S}_{\mathcal{NN}}\) alone by using the encrypted data by the public key. To summarize, the two servers are able to utilize the encrypted data to train the image classifier by cooperation without the help of the users. Once the users upload the encrypted data to the servers, they can be offline. Although NPMML method has both of the characters with non-interactive and lossless, its efficiency is lower than ours. A few factors contribute to the _IPPNN_ outperforms the NPMML. _(i)_ Cryptographic primitive employed--reducing computation overhead. The running time gap between NPMML and _IPPNN_ lies in the cryptographic techniques employed by these two algorithms. In NPMML, the neural network model is built using the combination of Paillier cryptosystem and a CCA-2 secure public-key encryption scheme, such as RSA, while the _IPPNN_ employs the only one cryptographic technique, i.e., function encryption for inner product. Consequently, the NPMML has more complex implementation than ours. _(ii)_ Well-designed encryption method--reducing communication overhead. At each iteration, the NPMML needs two-way transmission between the servers, while the _IPPNN_ only needs one time to transfer the information. \begin{table}
\begin{tabular}{|c c c c c|} \hline
**Network Architecture** & **Datasets** & **Bits of Security Parameter** & \multicolumn{3}{c|}{**Training Time (s)**} \\  & & & **IPPNN** & **NPMML** \\ \hline \(784\to 256\to 10\) & digits-MNIST & 1024 & 1315 & 31,054 \\ \(784\to 128\to 10\) & digits-MNIST & 1024 & 532 & 13,583 \\ \(784\to 256\to 10\) & Fashion-MNIST & 1024 & 1355 & 31,154 \\ \(784\to 128\to 10\) & Fashion-MNIST & 1024 & 552 & 13,267 \\ \(784\to 256\to 10\) & digits-MNIST & 2048 & 2102 & 52,590 \\ \(784\to 128\to 10\) & digits-MNIST & 2048 & 903 & 24,887 \\ \(784\to 256\to 10\) & Fashion-MNIST & 2048 & 2238 & 52,990 \\ \(784\to 128\to 10\) & Fashion-MNIST & 2048 & 931 & 23,183 \\ \hline \end{tabular}  
* Training time: execution time for training one mini-batch (60 samples). Network architecture: No. neurons in input layer \(\to\) No. neurons in hidden layer \(\to\) No. neurons in output layer.  
\end{table} 
Table 1: Comparison of time cost for training one mini-batch (60 samples).