## 3 Preliminaries
### System and Security Models  
We assume that the drones have _limited_ computing power, such as low-end or mid-range drones that may benefit from edge computing. Our scenario is similar to the one described in [8], where the drone captures video footage and uses a lightweight onboard _image classification_ model to determine frames of interest (e.g., determining if a video frame contains a human subject). After identifying relevant video frames, intensive computation--such as _object detection_, which generates a bounding box around each human subject in the video (or facial recognition, if necessary) -is offloaded to a cloudlet at the edge. The key idea is that end-to-end transmission latency is shorter than performing object detection directly on the drone, which necessitates using a cloudlet in our system. Our proposed scheme is shown in Figure 1.  
We leverage the commonalities between DNN-based image classification and object detection models to develop an efficient privacy-preserving distributed deep learning model. Image classification models can be used for inference onboard the drone without incurring a significant latency overhead. For example, MobileNetV3 [9] and SqueezeNet [10] are small  
Figure 1: Simplified diagram of core system logistics, showing how the drone receives an input image frame through its camera. The onboard model extracts the feature maps and sends them in a non-invertible form to the cloudlet. The cloudlet sends the predictions (i.e., the location of the bounding box for the human object) to the drone without needing to access the original video frames.  
models that have fast CPU inference times and are suitable for edge devices. However, downstream tasks like object detection or object tracking are inherently compute-intensive because they require calculating the bounding boxes of objects in addition to classifying the objects in the scene. Rather than choosing a fast but less accurate model solely on the drone, we can use a relatively powerful model in a distributed setup. DNN-based object detection models consist of a backbone network and object detection modules that leverage the features extracted by the backbone network. The backbone network is based on an image classification network (e.g., MobileNet) and has fewer layers, as it is designed to extract features rather than assign class labels. The backbone network functions like an image classification network without the last few layers.  
In our system, when the onboard image classification model detects relevant video frames, the drone sends the features extracted from the video frames to the cloudlet for processing. The cloudlet contains additional modules to compute the bounding box and classification predictions, and these modules use the extracted features, rather than raw video frames, as inputs. Thus, any potentially sensitive information in the video frames is not directly exposed to the cloudlet.  
The cloudlet is treated as a semi-trusted entity and as mentioned in [2], the cloudlet is an \"honest-but-curious\" adversary that may try to learn additional information from the images it receives from the drone. The drone is treated as a trusted party within the security model. That is, we do not assume the drone operator is a professional hacker who can change or control the hardware and firmware of the drone in use. Our proposed approach prevents sensitive information from being leaked to the cloudlet while respecting the design goals discussed in the following subsection.