## 3 Related Work  
Much work has addressed privacy-preserving in deep learning. [PERSON] et al. [PERSON] et al. (2016) define privacy objectives as protecting the privacy of the model, the privacy of the model's output, and essentially the data used to learn the model. Additionally, they distinguish between direct and indirect data leakage. Direct leakage may occur during the training phase when training sets are revealed to other parties, as well as during the prediction phase when input data or the model output are revealed to another party. In contrast, sharing model parameters and updates across parties may result in indirect leakage. In their work, [PERSON] et al. [PERSON] et al. (2019) explore the topic of privacy in collaborative deep learning settings. Collaborative deep learning involves two main phases: the training phase, where algorithm parameters are optimized using labeled data, and the prediction phase, which utilizes user input to make predictions. The authors classify collaborative deep learning frameworks into two modes: direct collaborative deep learning and indirect collaborative deep learning. They further investigate the privacy-preserving technologies commonly employed in collaborative deep learning and examine their respective advantages and drawbacks. According to their analysis, current approaches in the field aim to strike a balance between data privacy and utility by combining secure multi-party computing, homomorphic encryption, and differential privacy techniques. These approaches strive to provide a reasonable trade-off between preserving the privacy of data and maintaining the usefulness of the collaborative deep learning process. In [PERSON] et al. (2018), [PERSON] et al. employ white-box inference attacks to conduct privacy analysis on deep learning models. They define privacy leakage as the information that an adversary can extract from a model regarding its training data, which cannot be obtained from other models trained on different data from the same distribution. The authors utilize inference attacks to measure the extent of privacy leakage and provide empirical evidence showing the high effectiveness of white-box membership inference attacks against well-generalized models. In their review paper [PERSON] et al. (2018), [PERSON] et al. delve into the current advancements in deep learning with a specific focus on security and privacy. They highlight the privacy-preserving requirements that a framework should fulfill, including the non-disclosure of training party data and predictions, as well as the client's lack of awareness of the server and global model configurations. The authors conduct a comprehensive analysis of threats and attacks related to deep learning from both the security and privacy domains. They also provide a thorough examination of existing privacy-preserving techniques and frameworks in the literature. Furthermore, [PERSON] et al. emphasize the need for further research and emphasis on the development of efficient private training methods in deep learning. They point out that existing solutions proposed in the literature often come with a higher computational overhead, highlighting the importance of exploring more efficient approaches in order to achieve privacy preservation in deep learning effectively. In their studies [9; 36], [PERSON] et al. provide a comprehensive overview of privacy-preserving deep learning (PPDL) in the context of Machine Learning as a Service (MLaaS). The authors also delve into traditional privacy-preserving techniques like differential privacy and cryptography and discuss their applicability to deep learning architectures. They highlight that some adjustments need to be made to combine these traditional approaches with deep learning, such as the approximation of activation functions, inclusion of batch normalization layers, and utilization of large stride convolutional layers. Additionally, [PERSON] et al. critically examine the challenges and limitations faced by privacy-preserving deep learning frameworks.