## 4 Our Proposed Framework
### Privacy of the Proposed Framework  
Our framework is designed for collaborative deep learning scenarios, specifically for image classification models that involve a service provider and various client institutions, which could be in fields such as healthcare or finance. In these collaborations, we adopt a commonly assumed behavior model in data privacy research--participants are considered to be \"honest-but-curious\" [9]. This means participants adhere to the proposed training protocol but may have an interest in gaining additional knowledge about others' training datasets. The reason this assumption is common in data privacy is that it reflects a realistic scenario where entities follow protocol rules but might attempt to infer more information if possible. It allows us to develop mechanisms that protect sensitive information, even when entities are curious to learn beyond what they are permitted, hence ensuring robust privacy protection. Using our framework, we seek to guarantee the privacy of the training datasets by training a global model on subsets of users' data after encoding them using RBM. Thus, clients do not reveal their complete raw training data to the server. Furthermore, the trained model and its parameters are protected from other clients. Similarly, in the prediction phase, the client encodes the data to be classified using the RBM model before sending it to the central server. The central server runs the deep learning models and returns the prediction output's label, not the prediction vector. Therefore, our model satisfies the privacy-preserving framework requirements [8] where a framework preserves the privacy of the client's training data, the model and its parameters, and the client's data point in the inference phase. Furthermore, common privacy violation attacks cannot be used against our framework based on the definition of our framework. Membership Inference Attacks are built based on two assumptions: the first is that overfitting in machine learning models is the cause of the high confidence score for member instances more than it would be for non-member instances [42]. The second is that the gradient distribution is more distinct for member  
Figure 5: Sending the subsets of encoded training data to the central server. and non-member instances [35]. In our framework, we prevent such attacks by addressing these assumptions. We only share the output label in the inference phase; we do not share the prediction vector. Further, we prevent direct access to the model and its parameters. Therefore, it is more challenging to launch a membership attack on our framework to determine if a specific data point is included in the training set or not. The target model training set is made up of a subset of the encoded versions of the data points rather than the entire data. Also, sharing the output label and preventing direct access to the model and its parameters prevent model-stealing attacks. The model extraction attacks [5] require the obtaining of the confidence score while hyperparameter-stealing attacks [4] require obtaining access to the training data and model parameters. Similarly, attribute inference attacks are prevented since they are used with collaborative systems that enable training parties to access the models or their parameters, as in federated learning. Furthermore, data extraction attacks are inapplicable to our frameworks because the training dataset is made up of encodings rather than real data points. If the adversary in a black box setting tries to influence the model to leak information, it might do so with the encodings rather than the actual data. Also, by using Instance Reduction Techniques, we eliminate the effect of the outliers and the near-border instances, therefore reducing overfitting [27] and, thus, susceptibility to these privacy attacks [66]. Moreover, is it possible for a malicious server or a training party to retrieve the original instance from the encoding?