  We consider the recent privacy preserving methods that train the models not
on original images, but on mixed images that look like noise and hard to trace
back to the original images. We explain that those mixed images will be samples
on the decision boundaries of the trained model, and although such methods
successfully hide the contents of images from the entity in charge of federated
learning, they provide crucial information to that entity about the decision
boundaries of the trained model. Once the entity has exact samples on the
decision boundaries of the model, they may use it for effective adversarial
attacks on the model during training and/or afterwards. If we have to hide our
images from that entity, how can we trust them with the decision boundaries of
our model? As a remedy, we propose a method to encrypt the images, and have a
decryption module hidden inside the model. The entity in charge of federated
learning will only have access to a set of complex-valued coefficients, but the
model will first decrypt the images and then put them through the convolutional
layers. This way, the entity will not see the training images and they will not
know the location of the decision boundaries of the model.
