The stakes are framed by law as much as by technology. Under the European Union’s General Data Protection Regulation, processing images for biometric identification or health inference elevates them to Special Category Data, triggering requirements for explicit consent, strict data minimization, and mandatory Data Protection Impact Assessments before deployment. India’s Digital Personal Data Protection Act imposes similarly stringent purpose and storage limitations, demanding granular consent for biometric capture and prompt deletion of raw images once processed. Both regimes treat unencrypted collection and retention of raw imagery as a persistent breach vector, because unlike a password, compromised visual features cannot be reset. A stolen face or a leaked radiograph is compromised for life.

Against this backdrop, researchers have developed three principal families of privacy technique, each with a distinct mathematical character. Federated learning enables model training across decentralized image repositories without transferring raw pixels to a central server; hospitals, for example, can jointly improve diagnostic models while their patient scans never leave institutional storage. Differential privacy provides a formal, quantifiable guarantee that the participation of any single record cannot be inferred from a model’s outputs, typically by injecting carefully calibrated noise into gradients or queries. Secure multi-party computation allows multiple parties to jointly compute a function over encrypted or secret-shared image data, so that no participant ever learns another’s inputs. The review also draws a crucial conceptual line between these privacy-preserving mechanisms, which alter the computation or data pipeline itself, and privacy-aware mechanisms, which shape model behavior, including the explanations a model gives, to avoid inadvertent disclosure.

That distinction matters because of a sobering empirical finding that recurs throughout the literature: keeping raw pixels local is not sufficient on its own. Gradient-inversion and membership-inference studies have demonstrated that near-original images can be recovered from model updates or explanation artifacts once believed to be privacy-neutral. In federated learning, an honest-but-curious server can execute gradient-inversion attacks that reconstruct near-photorealistic radiological scans from shared parameter updates. The review’s authors call this the data locality fallacy: federated learning enforces physical data locality, but it is an organizational paradigm rather than a complete mathematical defense, leaving models vulnerable to gradient leakage, membership inference, model inversion, and malicious-client poisoning.

The review’s methodology is itself a technical contribution. Following PRISMA 2020 guidelines, the team searched five scholarly repositories, IEEE Xplore, ACM Digital Library, Scopus, Web of Science, and PubMed, on June 15, 2026, retrieving 5,214 records. After automated deduplication removed 528 duplicates, two independent reviewers screened titles and abstracts, eliminating 3,644 records that lacked computational privacy frameworks or investigated non-visual modalities. Full-text evaluation of the remaining 1,042 articles excluded 828 more for reasons ranging from purely theoretical treatment to missing methodological detail. The surviving 214 candidates were scored on a structured 10-point rubric covering mathematical rigor, dataset validation, privacy-utility calibration, adversarial evaluation, and reproducibility, with inter-rater reliability measured by Cohen’s kappa of 0.84. Only the top quartile, 50 studies scoring at least 8.5, entered the final synthesis.

The sectoral breakdown reveals where privacy engineering has matured and where it lags. Healthcare imaging dominates the corpus, accounting for 21 of the 50 studies, with federated learning deployed in 14 of them, often layered with differential privacy to bound patient-level leakage during gradient aggregation. Agricultural imaging contributes 10 studies, in which federated learning trains crop-disease detection models across geographically distributed farms without transferring proprietary field imagery between cooperatives. General-purpose vision benchmarks account for another 10 studies, many probing gradient-inversion attacks directly, while 9 studies address IoT and edge imaging, where battery-powered cameras rely on model quantization to transmit only compressed updates over constrained networks. Publication activity accelerated sharply over the review window: just 2 studies appeared in 2016 to 2017, but 18, or 36 percent of the corpus, appeared in 2022 to 2023.

Each sector confronts a mathematically distinct bottleneck. In healthcare, the central challenge is privacy-utility calibration: under the Gaussian mechanism for differential privacy, the noise standard deviation scales with the sensitivity of the gradient function divided by the privacy budget, so a tighter guarantee directly mandates larger noise, degrading optimization and elevating clinical false-negative rates. Unlike natural imagery, where minor Gaussian perturbations are benign, medical scans demand pixel-level diagnostic sensitivity, and calibrating noise for stringent bounds can obscure high-frequency radiological details such as microcalcifications. In agriculture, the problem is statistical heterogeneity: federated averaging weights each client’s contribution by its sample count, so extreme disparities in farm size and localized crop pathology bias the global model toward large commercial holdings and degrade convergence on non-independent data.

Secure multi-party computation faces a different wall. In threshold secret sharing, a visual token is partitioned into shares such that any subset below the threshold leaks zero information, but raising the threshold multiplicatively scales the interactive communication required for every non-linear activation and convolutional layer. The result is provable zero-leakage computation with zero accuracy loss, yet computational costs so extreme that deployment remains limited to small hospital consortiums and pilot prototypes. On the edge, the bottleneck is bandwidth: cumulative network consumption per communication round scales with the number of active devices multiplied by the parameter count and numerical precision of the model backbone, making naive federated updates infeasible for bandwidth-constrained field cameras. And in explainable AI, a subtler threat emerges: saliency maps generated to build clinician trust can themselves leak training-set membership, and under the moments-accountant composition framework, even modest per-query privacy loss rapidly aggregates into significant identification leakage across repeated visual queries.

Perhaps the review’s most consequential observation concerns the architectural future. Visual computing is shifting from task-specific convolutional networks toward large-scale medical foundation models, including vision transformers, multi-modal vision-language architectures, and promptable segmentation models. This transition escalates every identified risk. A conventional ResNet-50 carries roughly 25 million parameters, tractable under federated averaging, but foundation models frequently exceed 300 million to a billion parameters, rendering multi-party secret-sharing computationally intractable and forcing a shift toward parameter-efficient fine-tuning methods such as low-rank adaptation, where privacy mechanisms are restricted to adapter layers. Worse, the memorization capacity of these architectures scales with parameter count: broad attention mechanisms retain richer biometric and spatial priors than compact convolutional filters, markedly facilitating high-fidelity patient image recovery from single update batches. Cross-modal binding of pixel data with radiological text and electronic health records compounds membership-inference vulnerabilities further.

The review’s authors are careful to distinguish direct empirical observations from conceptual research trajectories, and they acknowledge structural limitations, including restriction to peer-reviewed English-language publications, publication bias favoring successful defenses, and heterogeneous threat models that preclude formal meta-analysis. Yet the synthesized evidence points clearly toward hybrid architectures that combine federated learning, differential privacy, and secure computation rather than relying on any single mechanism, with differential privacy offering bounded protection only under defined trust assumptions and secure computation safeguarding data strictly in flight. As imaging systems proliferate through hospitals, farms, homes, and factories, the message of this synthesis is unambiguous: privacy in visual computing cannot be an afterthought bolted onto a trained model. It must be engineered into the pipeline from the first pixel, because the images machines learn from are, in the end, images of us.

Subject of Research: Privacy-preserving techniques for imaging data in machine learning, including federated learning, differential privacy, and secure multi-party computation

Article Title: Privacy-preserving techniques in visual computing: applications, challenges, and future directions

Article References: Haripriya, R., Tripti, K., Kaur Bhatia, G., & Pandey, M. (2026). Privacy-preserving techniques in visual computing: applications, challenges, and future directions. Frontiers in Imaging, 5, Article 1981816. https://doi.org/10.3389/fimag.2026.1981816

Image Credits: AI Generated

DOI: 10.3389/fimag.2026.1981816

Keywords: federated learning, differential privacy, secure multi-party computation, medical imaging, gradient inversion, explainable AI, GDPR, IoT edge computing, systematic review, data privacy, computer vision, foundation models

The infrastructure, called Prototype Architecture for Research Advances using Privacy Enhancing Technologies, or PARAPET, is designed to serve a wide range of fields that depend on data analysis, including healthcare, internet security, science, finance and the social sciences. Its central promise is that researchers can analyze medical records, financial information, census statistics and other regulated datasets collaboratively while the data itself remains protected both at rest and during computation. The project also addresses one of the most pressing challenges of the current era: training artificial intelligence models on distributed, sensitive data without exposing the private information those models learn from.

Robert Beverly, director of SDSU’s Cybersecurity Center for Research and Education and professor of computer science, framed the problem in blunt terms. There are many cases, he noted, where privacy considerations preclude researchers from working on data together, and that stands as a genuine impediment to science. Researchers are entrusted with sensitive data, so it must be protected, and moving these technologies into production, he argued, promises to advance the entire field. The grant, awarded under NSF award number 2537035, positions the three-institution team to test whether cutting-edge cryptographic and systems techniques can survive contact with real research workloads at national scale.

The technical core of the challenge is well understood in the cryptography community. Today, data can be encrypted for transmission across networks and for storage on disks, and those protections are mature and widely deployed. Performing computations on encrypted data, however, remains difficult. PARAPET aims to make that process practical. The team plans to equip the platform with specialized software and hardware tools that allow one user to send encrypted data that another user can operate on without decrypting it, ensuring the data is never revealed to anyone other than the original owner. In principle, a hospital could hand an encrypted dataset to an outside analytics collaborator, who could run statistical models against it while remaining mathematically unable to see a single patient record.

These same techniques carry an additional dividend: resilience against future quantum computing attacks, which pose a heightened threat to today’s cyber systems because sufficiently powerful quantum machines could break many widely used public-key encryption schemes. By building computation-on-encrypted-data capabilities into the platform from the start, PARAPET gives the research community a national-scale testbed for exploring tools that could remain secure even in a post-quantum world. The project also takes a defensive posture toward compromise. The entire system is designed so that encrypted data is locked away and accessible only to approved users on secured networks, with the explicit goal that even a successful breach yields little of value.

Joann Chen, assistant professor of computer science at SDSU, described that philosophy directly: the long-term goal is that even if the infrastructure were compromised and an attacker obtained a copy of encrypted data, they could not do much with it. That assumption-that breach is eventual and design must assume it-marks a shift from perimeter-focused security toward architectures where the data itself carries its protection. It also reflects a growing consensus in the security research community that anonymization alone is not enough. Beverly pointed out that many attackers can conduct re-identification attacks, reverse engineering supposedly de-identified datasets to link records back to specific individuals, a technique demonstrated repeatedly in studies of released medical and census data.

To counter those risks, PARAPET will lean on a family of privacy-enhancing technologies that have matured rapidly in recent years. Differential privacy adds carefully calibrated statistical noise so that aggregate results reveal population-level patterns without exposing any individual contribution. Homomorphic encryption allows arithmetic to be performed directly on ciphertext. Federated learning lets machine learning models be trained across many devices or institutions without any raw data leaving its source. With secure computing hardware combining these approaches, PARAPET seeks to provide a vastly more secure option for supporting high-performance computing needs than either raw data transfer or simple anonymization.

The rise of artificial intelligence makes this work especially timely. As AI spreads into virtually every discipline, protecting data while models are built has become essential, and PARAPET is designed to safeguard users’ data during the fine-tuning of central AI models that can be used nationwide. One approach the team will test is federated: users train a local model on their own device and share only the model updates with PARAPET, which then aggregates the information from those updates to improve its larger model without ever accessing the raw data. Chen offered an intuitive explanation, noting that any AI model can be seen as a giant math function, and the system essentially takes the outputs from that function and averages them across the different local models. Unlike systems that require organizations to transfer raw data to a central service, PARAPET will test methods that let participating institutions retain far greater control over their sensitive research data.

Each partner institution brings a distinct mandate. At the University of Utah, Manish Parashar, chief AI officer and executive director of the Scientific Computing and Imaging Institute, will help manage PARAPET’s hardware and ensure the infrastructure is ready for deployment at national scale. Parashar observed that data-driven and AI-enabled research is revolutionizing science, but that progress in critical fields such as cybersecurity and public health is hampered by the inability to obtain, create, compute on and share regulated data. PARAPET, he said, takes an important step toward solving that problem by leveraging advances in privacy-enhancing technologies, and Utah looks forward to contributing expertise and leadership in designing and operating the compliant, regulated environments the platform needs to safely accelerate research with sensitive data.

At Arizona State University, Carolyn Ellis, an expert on regulatory and policy compliance and director of ASU’s Research Technology Office, will ensure PARAPET meets rapidly evolving regulatory requirements and will lead efforts to recruit users from across the nation to test the platform once a prototype is ready. Ellis, a co-principal investigator on the project, said privacy-enhancing technologies have enormous potential to change how research is conducted with sensitive or regulated datasets, but that the team must first understand how these new capabilities fit within institutional policies, research workflows and the privacy expectations established through data-sharing agreements. Through ASU’s leadership of the national Regulated Research Community of Practice, the project gains a vital institutional perspective that bridges the gap between new technical capabilities and the practical realities of protecting sensitive research data. At SDSU, chief technology research officer Mike Farley, who oversees the on-campus data center where PARAPET’s servers will be housed, emphasized that the project is assembling specialized hardware, software, networking, security and data workflows into a prototype researchers can actually use, helping clarify what it takes to move these technologies from the lab into practical research cyberinfrastructure. The effort builds on SDSU’s growing portfolio of interdisciplinary cyber initiatives and its development of new cybersecurity and data privacy curricula under the Cybersecurity Center for Research and Education, positioning the university as an emerging hub for privacy-preserving computation research.

Subject of Research: A national privacy-enhancing cyberinfrastructure for secure sharing and computation on sensitive research data

Article Title: NSF awards $5M across three institutions to enhance data protection for users nationwide

Article References: NSF awards $5M across three institutions to enhance data protection for users nationwide. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: privacy-enhancing technologies, cybersecurity, NSF grant, PARAPET, data sharing, homomorphic encryption, federated learning, differential privacy, AI model training, research cyberinfrastructure, data protection, San Diego State University

The starting point is PRISM, a framework for privacy-preserving set computation over outsourced secret-shared databases. In PRISM, multiple data owners split their records into cryptographic shares and distribute them across servers that never see plaintext data. The servers can execute private set intersection and aggregation queries directly over the shares, and the system offers verifiability guarantees against dishonest servers. But PRISM, like most systems in this family, rests on a quiet assumption: that the data owners themselves behave honestly and follow the protocol. In real consortiums of competing organizations, that assumption is often unrealistic.

The researchers catalog the ways a malicious owner can sabotage a query without ever breaking encryption. An owner might distribute inconsistent secret shares so that different servers hold contradictory versions of the same record. It might outsource values that violate declared attribute-level constraints, such as a numeric field exceeding its permitted range, quietly poisoning every aggregate computed downstream. It might issue unauthorized queries that breach the consortium’s access policies. Or it might interfere at the final stage, selectively approving or refusing to confirm aggregation results, or sending conflicting confirmations to different participants. Each of these attacks preserves data confidentiality while corrupting the correctness of the answers everyone relies on.

To close these gaps, the team built a framework that combines verifiable data outsourcing with query-level governance. The first pillar uses verifiable secret sharing, based on Pedersen commitments, to guarantee that every accepted share is consistent with a single committed plaintext value. When a data owner distributes shares of a value, it also publishes commitments derived from the sharing polynomial’s coefficients. Each server can then check locally, through a simple algebraic relation, whether the share it received matches the committed value. A malicious owner cannot hand out mutually inconsistent shares that still pass this check, and the verification requires no interaction between servers.

Consistency alone, however, is not enough. A malicious owner could share a perfectly consistent value that is simply wrong, such as an out-of-range cost figure or a Boolean indicator that is neither zero nor one. The framework therefore layers zero-knowledge proofs on top of the commitments. For Boolean attributes, the owner proves that the committed value satisfies the equation v times (v minus 1) equals zero, which holds only for zero or one, without revealing which. For numeric attributes, the owner supplies a range proof demonstrating that the committed value lies between zero and a public bound. The same commitment anchors both the share-consistency check and the validity proof, so the two guarantees are cryptographically bound to one another. In experiments, these mechanisms detected every injected malicious input, including tampered shares, invalid Boolean values, and out-of-range numbers, with a false-positive rate of zero.

The second pillar, called Adaptive Query Consensus or AQC, governs the query lifecycle itself. Rather than deploying heavyweight Byzantine fault-tolerant protocols that replicate an entire system state, AQC operates strictly per query under an honest-majority assumption, tolerating fewer than one third malicious owners. Before any query reaches the servers, data owners collectively vote on its admissibility against a consortium-wide policy. Only when at least a two-thirds quorum signs the same query descriptor does the coordinator assemble an authorization certificate, and servers refuse to execute anything without one. For aggregation queries, a second certificate confirms the final result: at least Q owners must sign the same result digest before the answer is accepted.

The safety argument is elegant. Because any two valid quorums must overlap in at least one honest owner, and honest owners sign at most one authorization and one result digest per query instance, two conflicting queries or two conflicting results can never both obtain valid certificates. The coordinator, notably, is not trusted at all; it merely collects votes and cannot determine outcomes without sufficient honest signatures. To handle unstable or malicious coordinators, AQC selects them adaptively based on observed behavior, such as vote-collection latency and certificate-assembly success. Certified timeouts or provable equivocation exclude a coordinator for the remainder of that query phase, and the protocol retries with growing timeout windows, guaranteeing eventual progress when the network stabilizes and enough honest owners participate.

The experimental evaluation is striking for its scale and restraint. Using a Python prototype with datasets drawn from the TPC-H benchmark, the team tested workloads of up to 50 data owners and datasets of up to 5 million records. The cryptographic machinery added only moderate cost: query-computation overhead over the PRISM baseline ranged from roughly 5.3 to 7.9 percent and stayed below 8 percent in every tested configuration. Signature processing contributed just 18 milliseconds to the critical path of a two-phase query, and coordinator selection cost less than a millisecond of local computation. Under congested networks and a 30 percent malicious-owner ratio, full two-phase queries completed in under two seconds. Because verification happens during data outsourcing, its cost amortizes across many subsequent queries.

The adaptive coordinator selection proved its worth in adversarial settings. At a 30 percent malicious ratio, adaptive selection cut completion times by roughly 18.6 to 30.5 percent compared with round-robin and random strategies, required about 0.15 to 0.26 retries per query instead of roughly 0.8, and maintained completion rates between 99 and 99.9 percent. A static-leader strategy, by contrast, collapsed to a 70 percent completion rate when its fixed leader turned malicious. The authors are careful about limits: the framework verifies protocol-level integrity, not the real-world truthfulness of syntactically valid data, and its guarantees hold only under the honest-majority assumption, with the 40 percent malicious setting reported purely as a stress test.

The broader significance lies in reframing where trust must be established in collaborative analytics. Cryptographic privacy has long been treated as sufficient protection for multi-party computation, yet the integrity of shared answers depends on participants who may be strategically misaligned, compromised, or simply unreliable. By binding verifiable secret sharing, zero-knowledge validity proofs, and lightweight query-scoped consensus into a single lifecycle-aware workflow, the researchers show that outsourced multi-owner databases can survive their own owners’ misbehavior without the crushing overhead of full Byzantine replication. The team plans to extend the work toward stronger robustness beyond honest majorities, real cloud deployments with heterogeneous latency, and richer query types and policy constraints, pointing toward consortium analytics that are resilient from data submission to confirmed result.

Subject of Research: Verifiable and robust query processing for multi-owner secret-shared databases under malicious data owners

Article Title: Verifiable and robust query processing for multi-owner secret-shared databases under malicious owners

Article References: Gu, L., Li, J., & Shi, J. (2026). Verifiable and robust query processing for multi-owner secret-shared databases under malicious owners. Cybersecurity, 9(1), Article 231. https://doi.org/10.1186/s42400-026-00674-4

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00674-4

Keywords: privacy-preserving computation, secret sharing, verifiable secret sharing, zero-knowledge proofs, private set intersection, outsourced databases, Byzantine consensus, query governance, malicious data owners, data integrity, multi-party computation, cybersecurity

The core problem the researchers address is one that has haunted privacy-preserving machine learning for years. Techniques such as fully homomorphic encryption, secure multi-party computation, and differential privacy can, in principle, guarantee that data remains usable but not visible. Homomorphic encryption, for example, allows mathematical operations to be performed directly on encrypted values, so the underlying information is never decrypted during computation. Secure multi-party computation lets several parties jointly compute a function over their combined inputs while keeping those inputs hidden from one another. Differential privacy adds carefully calibrated noise so that the contribution of any single individual cannot be reverse-engineered from the final model. In theory, these tools deliver exactly what privacy-conscious institutions need. In practice, they have struggled to keep up with the demands of modern deep learning.

The difficulty lies in overhead. Fully homomorphic encryption can slow training by orders of magnitude, turning what would take hours on unencrypted data into computations that stretch across days or weeks. Secure multi-party computation imposes heavy communication burdens, requiring participants to exchange large volumes of messages for every step of the training process. Meanwhile, the deep architectures that dominate contemporary artificial intelligence, such as ResNet convolutional networks and Transformer models, involve millions or billions of parameters whose gradients must be computed, encrypted, and aggregated at every iteration. The result is a gap between what privacy theory promises and what deployment reality allows, a gap that has kept many hospitals, banks, and agencies from adopting encrypted training at all.

Bao and Su’s framework attacks this gap from four directions at once. The first is a distributed key collaboration mechanism built on Shamir secret sharing, a classical cryptographic technique in which a secret, here an encryption key, is split into multiple shares distributed among different parties. No single participant holds the complete key; only a sufficient quorum of shares can reconstruct it. This design eliminates centralized trust dependence, meaning there is no single server or administrator whose compromise would expose the entire system. If one party is breached or behaves maliciously, the key remains safe as long as the attacker has not collected enough shares, a property that dramatically raises the bar for any would-be adversary.

The second innovation is the heart of the framework’s efficiency gains: the integration of partial homomorphic encryption with Top-k gradient sparsity performed directly in the ciphertext domain. Unlike fully homomorphic encryption, which supports arbitrary computation on encrypted data at enormous cost, partial homomorphic encryption supports a limited set of operations, such as addition, at a fraction of the computational price. Gradient sparsification exploits the observation that in most training iterations, only a small fraction of a model’s gradient components carry meaningful magnitude. By selecting and transmitting only the top-k largest gradient values, the framework slashes the amount of data that must be encrypted and exchanged. Crucially, the researchers perform this selection and aggregation on encrypted values, so the sparsification itself never exposes which parameters matter most, a detail that could otherwise leak information about the training data.

The third component is a lightweight adaptive scheduling strategy that dynamically balances three competing demands: the heterogeneity of participating devices, the desired strength of security, and the overall efficiency of training. In real-world collaborative settings, participants range from powerful data-center servers to modest edge devices, and a rigid protocol that treats them all identically will be throttled by its weakest member. The adaptive scheduler adjusts workloads and security parameters on the fly, allowing faster devices to contribute more while maintaining the cryptographic guarantees that make the whole exercise worthwhile. This kind of systems-level thinking, the authors argue, is what separates a laboratory demonstration from a deployable platform.

Finally, the team wrapped these mechanisms into a unified, end-to-end software system that provides closed-loop protection across the entire machine learning lifecycle, from the moment data enters the pipeline, through encrypted collaborative training, to the point where the finished model is served to end users. This holistic architecture matters because privacy failures often occur not during training itself but at the boundaries, when data is ingested, when intermediate results are exchanged, or when model predictions are exposed. By covering the full pipeline, the system reduces the attack surface that piecemeal solutions leave open.

The experimental results are striking. On benchmark datasets including CIFAR-10, FEMNIST, and a real-world medical dataset, the framework trained ResNet-18 and Transformer models 3.2 times faster than CryptoNets and 2.7 times faster than HE-Transformer, two well-known homomorphic encryption baselines. Communication overhead, often the hidden killer in distributed encrypted training, came in at 42.3 megabytes, dramatically lower than the homomorphic baseline schemes. Perhaps most importantly for practitioners, the accuracy penalty relative to an unencrypted federated averaging baseline was held to just 1.2 percent, a margin small enough that most applications could absorb it without noticing. The authors also report strong scalability and robustness against real-world privacy attacks, suggesting the protections hold up under adversarial pressure rather than only in idealized conditions.

Why does this matter beyond the benchmark suite? Consider a consortium of hospitals that wants to train a diagnostic model on millions of patient records scattered across institutions. Legal frameworks such as data protection regulations often prohibit sharing raw records, and even anonymized data has been re-identified in past studies. Encrypted collaborative training offers a way out: each hospital keeps its records local, gradients are encrypted before leaving the building, and the aggregated model emerges without any participant ever seeing another’s data. Similar scenarios apply to banks pooling fraud-detection intelligence, telecommunications operators improving network models, and government agencies collaborating across jurisdictions. A framework that makes such training fast enough and cheap enough to run on realistic hardware could convert privacy-preserving machine learning from a theoretical curiosity into standard practice.

The study, published in the special issue on Cognitive based Information Processing and Applications 2024, was supported by research projects in Jiangsu higher education institutions, and the authors state they have no competing interests. Its significance lies less in any single technique than in the demonstration that security and efficiency need not be opposing forces. By combining established cryptographic primitives, secret sharing and partial homomorphic encryption, with machine learning optimizations like gradient sparsification and adaptive scheduling, and by engineering the whole into a deployable software system, Bao and Su have sketched what practical privacy-preserving AI might look like. As cognitive computing continues to penetrate healthcare, finance, and government, frameworks of this kind may become the invisible infrastructure that lets intelligent systems learn from humanity’s most sensitive data while keeping that data exactly where it belongs: out of sight.

Subject of Research: Privacy-preserving collaborative machine learning using encryption-based training and data protection systems

Article Title: Collaborative encryption-based machine learning model training method and data protection software system construction

Article References: Bao, D., & Su, W. (2026). Collaborative encryption-based machine learning model training method and data protection software system construction. Neural Computing and Applications, 38(19), Article 770. https://doi.org/10.1007/s00521-026-12383-7

Image Credits: AI Generated

DOI: 10.1007/s00521-026-12383-7

Keywords: privacy-preserving machine learning, homomorphic encryption, Shamir secret sharing, federated learning, gradient sparsification, data privacy, secure multi-party computation, Transformer models, ResNet, adaptive scheduling, encrypted training, data protection

Secure multi-party computation is a branch of cryptography in which several parties jointly compute a function over their private inputs without revealing those inputs to one another. In the quantum version of this problem, quantum states and quantum operations supplement or replace classical techniques to provide security guarantees rooted in the laws of physics rather than in assumptions about computational hardness. Multiplication is a particularly important target operation: once parties can multiply their secret values securely, they can build a wide range of more elaborate privacy-preserving applications, from secure auctions and electronic voting to privacy-preserving machine learning and distributed statistical analysis. The new protocol addresses multiplication directly, allowing multiple participants to combine their secret inputs into a shared product while keeping every individual input hidden.

The central technical innovation lies in the protocol’s use of the multiplicative homomorphic property of the RSA encryption algorithm. Homomorphic encryption allows arithmetic to be performed directly on encrypted data: a party can encrypt a value, and the structure of the encryption ensures that combining ciphertexts corresponds to combining the underlying plaintexts. In the multiplicative case, the product of two ciphertexts decrypts to the product of the two plaintexts. This property means participants can contribute encrypted shares of their secrets, the encrypted shares can be multiplied together, and only the final decrypted result reveals anything about the combined product—never the individual contributions. By anchoring the protocol in RSA’s well-understood multiplicative homomorphism, the authors inherit a mature cryptographic foundation while layering quantum techniques on top for input protection and verification.

What distinguishes this work from earlier quantum secure multiplication protocols is its verifiability. In many existing schemes, participants simply have to trust that the final result is correct. If a malicious participant injects a corrupted share, or if noise and error creep into the process, the output may be silently wrong. The new protocol allows every participant to check the integrity of the final computation result and to detect any error affecting correctness, whether that error was introduced intentionally by a cheater or unintentionally by some failure in the process. Verification transforms the protocol from a trust-based arrangement into an auditable one, which is essential for any realistic deployment involving parties who may have conflicting interests.

The dynamic aspect of the protocol is equally significant. Real-world collaborations are rarely static: organizations join consortiums, employees leave companies, and partners withdraw from joint ventures. A secure multi-party protocol that must be restarted from scratch every time the participant list changes would be impractically rigid. The new scheme supports dynamic updates, meaning participants can be added or removed while the computation’s security guarantees are preserved. This flexibility, however, creates a dangerous loophole that the authors explicitly confront: a participant who is being revoked has a clear incentive to cheat during the update process, corrupting the computation on the way out. The protocol’s verification mechanism is specifically designed to detect deceptive behavior by revoked participants during these dynamic updates, closing an attack window that earlier dynamic protocols left open.

The authors describe this threat as a dishonest revocation attack, and their security analysis demonstrates that the protocol resists it alongside a series of other typical external and internal attacks. External attacks, in the quantum setting, include eavesdropping attempts in which an outsider tries to extract information from the quantum states exchanged between honest participants; the protocol’s quantum components are designed so that such interference leaves detectable traces. Internal attacks are subtler and often more damaging, since they come from participants who hold legitimate credentials but choose to deviate from the protocol to learn others’ inputs or to bias the result. By combining homomorphic encryption with verification checks, the protocol ensures that neither class of adversary can compromise either the privacy of the inputs or the correctness of the product without being caught.

Efficiency matters as much as security in this domain, because quantum protocols can impose heavy computational and communication burdens. The authors report that their scheme achieves relatively low computational costs compared with existing multiplication protocols, making it a more practical candidate for real applications. The reliance on classical RSA homomorphic operations for the arithmetic core, rather than on expensive quantum computations for every step, helps keep the overhead manageable, while quantum resources are deployed where they add the most security value. The result, the authors argue, is a protocol that offers enhanced practicality and meaningful security guarantees at a computational price that realistic deployments could afford.

The work builds on a substantial body of prior research in quantum secure multi-party computation. Earlier protocols have addressed secure summation using single photons, quantum Fourier transforms, Grover’s search algorithm and mutually unbiased bases, and secure multiplication has been explored through secret sharing and hybrid quantum-classical approaches. Previous work by members of the same team introduced a (k, n)-threshold dynamic quantum secure multiparty multiplication protocol and a verifiable threshold quantum secure multiparty summation protocol, and the present study extends that lineage by adding verifiable result integrity to the dynamic multiplication setting through homomorphic encryption. The broader field also draws on foundational results in quantum state determination, secret sharing with d-level systems, and analyses of practical attacks such as Trojan-horse attacks on quantum communication systems, all of which inform the threat model the new protocol is designed to survive.

The implications extend beyond the immediate technical contribution. As quantum computers edge closer to threatening classical public-key cryptography, and as organizations increasingly need to compute jointly over sensitive data—financial positions, medical records, proprietary models—protocols that combine quantum security with classical efficiency are likely to attract growing attention. A verifiable, dynamic multiplication protocol offers a building block for such systems: it demonstrates that participant churn need not be a security liability, and that even a departing adversary with every reason to cheat can be prevented from corrupting a shared computation. The research was supported by the National Natural Science Foundation of China, and the authors declare no conflict of interest. While laboratory-scale quantum networks and practical homomorphic quantum deployments remain works in progress, this protocol represents a concrete step toward secure multi-party computation that is simultaneously quantum-resistant in its guarantees, flexible in its membership, and honest in its arithmetic.

Subject of Research: A verifiable dynamic quantum secure multi-party multiplication protocol based on RSA homomorphic encryption that resists cheating by revoked participants.

Article Title: Verifiable dynamic quantum secure multi-party multiplication protocol based on homomorphic encryption

Article References: Li, F., Li, R., Sun, Y., & Zhu, S. (2026). Verifiable dynamic quantum secure multi-party multiplication protocol based on homomorphic encryption. Quantum Information Processing, 25(10), Article 317. https://doi.org/10.1007/s11128-026-05347-2

Image Credits: AI Generated

DOI: 10.1007/s11128-026-05347-2

Keywords: quantum cryptography, secure multi-party computation, homomorphic encryption, RSA, verifiability, dynamic protocols, multiplication protocol, dishonest revocation attack, quantum information, privacy-preserving computation, Quantum Information Processing, Hefei University of Technology

Using a PRISMA-style systematic review methodology, the researchers analyzed papers from the last five years of literature, the period in which privacy attacks against machine learning evolved from academic curiosities into practical threats. Their contribution is not a single new technique but a map of the entire battlefield: a unified taxonomy of attack families, a parallel taxonomy of defenses, recommended evaluation metrics for each attack type, and a reproducibility checklist alongside an attack-by-defense protection matrix that distills the qualitative findings of hundreds of studies into a single comparative view.

The taxonomy of attacks is sobering in its breadth. Membership inference attacks ask a deceptively simple question of a model: was this specific person’s record part of your training data? First demonstrated systematically by Shokri and colleagues in 2017 and refined since through approaches that exploit overfitting, prediction sensitivity, and quantile regression, these attacks now extend even to large language models, recommender systems, graph neural networks, and diffusion models. Model inversion attacks go further, reconstructing representative images or attributes of training classes from a model’s outputs, exploiting the confidence information that models emit so freely. Model extraction attacks steal entire architectures and weights through prediction APIs, converting years of training investment into a target for intellectual property theft as well as privacy abuse.

Perhaps most alarming for the federated learning era is gradient leakage. In collaborative training settings where participants share gradient updates instead of raw data, researchers showed as early as 2019 with the Deep Leakage from Gradients work that those updates can be inverted to reconstruct training inputs almost pixel-perfectly. The survey also covers property and attribute inference, in which adversaries deduce sensitive characteristics of training populations, alongside poisoning and backdoor attacks that corrupt models from within, side-channel attacks that exploit hardware implementations, and a rapidly growing family of large language model specific leakage, including verbatim training data extraction from production models and membership inference against in-context learning.

Against this arsenal, the survey organizes defenses into coherent families. Differential privacy, introduced by Cynthia Dwork in 2006, remains the workhorse: by injecting carefully calibrated noise into gradients during training, typically through the DP-SGD algorithm of Abadi and colleagues, it provides a mathematically provable bound on how much any single individual’s data can influence the model. The literature has spawned refinements including Rényi and Gaussian differential privacy, concentrated variants, adaptive gradient clipping, and privacy accounting improvements, along with integration into generative adversarial networks, Bayesian neural networks, and stochastic gradient Langevin dynamics.

Federated learning itself constitutes a second defense pillar, allowing organizations such as hospitals to train shared models without centralizing patient records, a principle already demonstrated in real multicenter studies for glaucoma detection, skin cancer diagnosis, and medical image analysis. Yet the survey is clear that federated learning alone is not privacy protection: gradient reconstruction, membership inference, and property inference all remain viable against naive federated systems, which is why the pairing with robust and privacy-preserving aggregation rules, secure aggregation protocols, and blockchain-based verification has become an active research frontier.

At the strongest end of the guarantee spectrum sit cryptographic approaches: homomorphic encryption, which permits computation directly on encrypted data, and secure multi-party computation, which distributes computation so no party sees another’s inputs. These techniques offer mathematically rigorous confidentiality, and standardized frameworks from IEEE and ITU now exist to guide their deployment. But the survey’s comparative analysis is unambiguous about the price: cryptographic stacks impose computational and communication overheads that can be orders of magnitude higher than plaintext training, making them practical today mainly for inference workloads, smaller models, or high-stakes domains such as healthcare and finance where the value of the data justifies the cost. Hybrid architectures, such as federated learning combined with homomorphic encryption or differential privacy layered over secure aggregation, attempt to balance these trade-offs.

The authors sharpen their analysis with three case studies covering centralized image classification, federated learning, and large language models. The verdict on the current landscape is nuanced. Noise-based methods such as differential privacy remain the practical baseline, deployable at scale and increasingly efficient, but they offer only partial protection, and their privacy-utility trade-off still forces difficult choices in accuracy-sensitive applications. Cryptographic methods deliver the strongest theoretical guarantees at substantially higher cost. Most urgently, the survey identifies large language model and multimodal leakage as an under-benchmarked gap: while training data extraction and membership inference against language models have been repeatedly demonstrated, standardized evaluation of defenses in this space lags far behind the pace of model deployment.

What makes this survey particularly valuable for practitioners is its insistence on evaluation discipline. For each attack family, the authors recommend specific metrics, recognizing, for example, that membership inference success should be measured against realistic background-knowledge assumptions rather than favorable shadow-model setups, and that privacy claims must be tested against adaptive attackers rather than fixed benchmarks. The reproducibility checklist addresses a chronic weakness of the field, where attack papers and defense papers often use incompatible threat models, making headline claims difficult to compare. The attack-by-defense protection matrix gives system designers a direct way to reason about which combination of techniques addresses which threats, and where residual risk remains.

The stakes of getting this right are rising alongside regulation. Data protection laws around the world increasingly impose concrete obligations on organizations whose models memorize personal information, and the survey situates the technical landscape within this regulatory context, noting that healthcare, finance, and government deployments face the tightest constraints. For the field as a whole, the message is one of guarded optimism paired with urgency. The defensive toolkit is now rich, mathematically grounded, and increasingly practical, and surveys like this one provide the coordination infrastructure the field has lacked. But as models grow larger, more multimodal, and more deeply embedded in everyday services, the attack surface grows with them, and the gap between what can be attacked and what has been rigorously defended remains widest precisely where the data is most personal. Closing that gap, the authors suggest, will require the same systematic, benchmark-driven rigor that this survey brings to mapping the problem.

Subject of Research: Privacy-preserving methodologies and privacy attacks in deep learning

Article Title: Privacy-preserving methodologies against privacy attacks on deep learning: a survey

Article References: Ghosh, S., & Mandal, A. K. (2026). Privacy-preserving methodologies against privacy attacks on deep learning: a survey. Knowledge and Information Systems, 68(1), Article 255. https://doi.org/10.1007/s10115-026-02865-4

Image Credits: AI Generated

DOI: 10.1007/s10115-026-02865-4

Keywords: deep learning, privacy attacks, differential privacy, federated learning, homomorphic encryption, membership inference, model inversion, gradient leakage, large language models, secure multi-party computation, data privacy, machine learning security