# Privacy-Preserving Outsourced Artificial Neural Network Training for Secure Image Classification
## 1 Introduction  
Artificial Neural Network (ANN) learning is well-suited to tackle problems in which the training samples correspond to complex image data, such as inputs from video cameras and mobile phones [1]. In recent work, ANN has proven successful in text and image classification and is observed to achieve high accuracy in these tasks. Consequently, image classifier based on ANN has been widely used in many real-life fields [2, 3, 4]. Conceptually, ANN-based solutions rely on elaborate algorithms, but even more on large-scale training data. As the volume of data owned by a single user is insufficient to train reliable classifiers, aggregation of data is a solution to address the local limitations. However, images are private mediums with the message intended to be used only by the owner. Due to the sensitive nature of the information content, there might be confidentiality and security constraints against sharing and using image data. These constraints form form formidable obstacles in many image applications, including image classification [5], image synthesis [6], image retrieval [7, 8], image sharing [9], and protection of location privacy in camera data of auto-driving vehicles [10]. As a consequence, the construction of privacy-preserving image classifiers is worth researchExisting approaches to train machine learning models in privacy-preserving settings mainly rely on secure multi-party computation [11], fully or partially homomorphic encryption [12; 13; 14; 15] and secret sharing [16; 17]. Most of these approaches have several limitations: _(i)_ First, in traditional privacy-preserving machine learning schemes, the non-linear functions are hard to support using common cryptographic techniques, such as homomorphic encryption and boolean circuit. Hence, prior work proposes to approximate the non-linear function using polynomial or piecewise linear function [12; 15; 16; 17; 18]. It can be shown that approximation using a high-degree polynomial is able to provide a higher accuracy. While--to the best of our knowledge--for efficiency reasons, the degree of the approximation polynomial is limited to 5 or less, which results in a large accuracy loss of the trained model. _(ii)_ Secondly, the majority of prior work requires multi-round communications between data users and servers [19; 20; 21; 22; 23; 24; 25; 26], making a substantial overhead of computation and transmission cost. Furthermore, in practice, most of the users are unlikely to participate in the whole training process online. Consequently, the classifier needs to be learned only on encrypted image data without the help of users. Moreover, non-interactive setting is easy to extend to dynamical participation or dropping during the training phase. The first known privacy-preserving scheme for neural network with non-interactive and lossless features simultaneously presented by [11], named NPMML. This method uses hybrid cryptographic techniques, including Paillier cryptosystem, RSA, and random mask to preserve data. Since the implementation of the NPMML utilizes multiple cryptosystems, the two servers need to interact several rounds for updating the parameters to accommodate the transformation of different masked techniques. Towards this, we propose a solution that enables multiple users to share their private data to achieve a high-precision image classifier without violating privacy laws and communicating with the servers frequently. Specifically, we present a non-interactive and privacy-preserving image classifier based on an ANN model, named _IPPNN_. This scheme _(i)_ substantially reduces the amount of communication required to train ANN model, which requires only one transmission for users; and _(ii)_ does not require any approximation for non-linear functions and can support lossless training. To achieve these benefits, _IPPNN_ orchestrates mask matrix and functional encryption for inner-product (FEIP) [27]. To summarize, our contributions are:  
* **Non-Interactive.