# Privacy-Preserving Outsourced Artificial Neural Network Training for Secure Image Classification
## 2 Related Work  
Image processing is a well established field and has been researched extensively [4; 28]. As the artificial intelligence (AI) and big data develop by leaps and bounds, the image-processing technology, such as image recognition [29], image classification [30], face recognition system [31], smart agriculture [3], lung cancer classification and prediction [2], surface defect detection system [32], are also renewing, people lead a more convenient and have a higher quality of life.  
However, the application of AI techniques can cause privacy leakage and security risks since solutions based on AI are reliant on a large number of training samples commonly belonging to different users. To make effective and safe use of data distributed in different locations while satisfying privacy requirements, some approaches have incorporated privacy-preserving techniques into image processing [5; 6; 7; 8; 9; 14; 33]. For example, [PERSON] et al. [5] proposed a secure intelligent computing framework for image classification based on deep learning and edge computing. [PERSON] et al. [6] presented a lightweight secure GAN framework for image synthesis based on secret sharing. [PERSON] et al. [7] proposed a privacy-preserving medical image retrieval system based on blockchain.  
Multiple privacy-preserving machine learning approaches have been presented for classification tasks. Prior work [19; 20; 21; 22; 23; 24; 25; 26] proposed schemes with an interactive fashion which requires users to communicate with servers multiple rounds. The online computation resources constraints form an obstacle in developing based-AI classification systems. Although non-interactive approaches have been proposed in the last few years, most of fall into fully homomorphic encryption (FHE) [12; 15] or secret sharing (SS) [16; 17] algorithms. Protocols based-FHE are hardly to be applied in the real world due to a very considerable computation costs. Methods based on SS still have higher requirements for the network since the two servers need to communicate frequently. Our proposed privacy-preserving method for constructing image classifiers realizes non-interactive between users and servers. Moreover, the protocol is feasible and efficient to use in practice using functional encryption cryptographic scheme.  
Due to the limitation of FHE and SS cryptographic primitive, some privacy computation schemes are forced to use polynomials or piecewise linear functions to appropriate original non-linear functions [15; 16; 17; 18; 26; 34]. For support vector machines and logistic regression, the obtained model precision is acceptable. However, for neural network or deep learning, such approximation methods will cause a loss of precision, which is not comparable to the original model and can not be applied in production and life. Our method removes the need for the approximation functions. That is, the private training protocol does not alter the original ANN model and result in a loss of accuracy.  
The closest approach to our _IPPNN_ is the NPMML method [11], which is a non-interactive privacy-preserving multi-party neural network framework with a dual server architecture. The protocol is complicated for the reason that NPMML employs multiple cryptographic technologies to preserve data. The benefit of non-interactive and lossless features (quite similar to ours) comes with a substantial overhead of computation and communication costs. The detailed comparison of the _IPPNN_ and the NPMML are covered in Sections 5.6 and 5.7.