IP Library › Granted Patent US 12,400,031
Granted Patent B2
US 12,400,031 · App. 18/009,765 · Granted Aug 26, 2025

System and method for secure and robust distributed deep learning

Inventors: Sanjeev Arora (Princeton, NJ); Kai Li (Princeton, NJ); Yangsibo Huang (Princeton, NJ); Zhao Song (Princeton, NJ); Danqi Chen (Princeton, NJ)
Assignee: THE TRUSTEES OF PRINCETON UNIVERSITY
G06F21/6254G06F21/602G06N3/098
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,400,031
App. No.
18/009,765
Granted
Aug 26, 2025
Kind
B2
Abstract

According to various embodiments, a method for encrypting image data for a neural network are disclosed. The method includes mixing the image data with other datapoints to form mixed data; and applying a pixel-wise random mask to the mixed data to form encrypted data. According to various embodiments, a method for encrypting text data for a neural network for natural language processing is disclosed. The method includes encoding each text datapoint via a pretrained text encoder to form encoded datapoints; mixing the encoded datapoints with other encoded datapoints to form mixed data; applying a random mask to the mixed data to form encrypted data; and incorporating the encrypted data into training a classifier of the neural network and fine-tuning the text encoder.

Claims (22)

1. A method for encrypting image data for a neural network, the method comprising:

mixing the image data with other datapoints to form mixed data; and

applying a pixel-wise random mask to the mixed data to form encrypted data, where applying the pixel-wise random mask includes (i) allotting each training datapoint a one-time pixel-wise random mask that flips a sign of each pixel in the mixed data with probability ½, and (ii) performing element-wise multiplication between the mixed data and the one-time pixel-wise random mask.

2. The method of claim 1 , wherein mixing the image data further comprises constructing datapoints by randomly picking datapoints from a training dataset and combining them using random coefficients.

3. The method of claim 1 , wherein mixing the image data further comprises mixing the image data with datapoints from other datasets.

4. The method of claim 3 , wherein the datapoints from other datasets are chosen randomly from public datasets.

5. The method of claim 1 , further comprising transferring the encrypted data from at least one of a low-power and low-cost device to a central server.

6. The method of claim 1 , further comprising training the neural network using the encrypted data and corresponding mixed labels.

7. The method of claim 6 , wherein training the neural network using the encrypted data and the corresponding mixed labels further comprises training the neural network to learn a mapping between encrypted images and their corresponding mixed labels.

8. The method of claim 6 , wherein training the neural network further comprises training using Federated learning protocols at a central server.

9. A system for encrypting image data for a neural network, the system comprising:

a memory; and

at least one processor configured to:

mix the image data with other datapoints to form mixed data; and

apply a pixel-wise random mask to the mixed data to form encrypted data by: (i) applying the pixel-wise random mask by allotting each training datapoint a one-time pixel-wise random mask that flips a sign of each pixel in the mixed data with probability 1/2, and (ii) performing element-wise multiplication between the mixed data and the one-time pixel-wise random mask.

10. The system of claim 9 , wherein the processor is further configured to construct datapoints by randomly picking datapoints from a training dataset and combine them using random coefficients.

11. The system of claim 9 , wherein the processor is further configured to mix the image data by mixing the image data with datapoints from other datasets.

12. The system of claim 11 , wherein the datapoints from other datasets are chosen randomly from public datasets.

13. The system of claim 9 , wherein the processor is further configured to transfer the encrypted data to a central server.

14. The system of claim 13 , wherein the central server comprises at least one processor configured to train the neural network using the encrypted data and corresponding mixed labels.

15. The system of claim 13 , wherein the central server processor is further configured to train the neural network using the encrypted data and the corresponding mixed labels by training the neural network to learn a mapping between encrypted images and their corresponding mixed labels.

16. The system of claim 13 , wherein the central server processor is further configured to train the neural network by training using Federated learning protocols.

Assignments (2)
CONFIRMATORY LICENSE Recorded Feb 3, 2025
From: PRINCETON UNIVERSITY
To: NATIONAL SCIENCE FOUNDATION
Reel/Frame 070084/0901 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 2, 2024
From: ARORA, SANJEEV; LI, KAT; HUANG, YANGSIBO; SONG, ZHAO; CHEN, DANQI
To: THE TRUSTEES OF PRINCETON UNIVERSITY
Reel/Frame 067894/0046 →
Continuity (3)
Provisional Application 63110005 · Nov 5, 2020
Provisional Application 63040300 · Jun 17, 2020
Related Publication 20230289473A1 · Sep 14, 2023
References Cited (99)
US 5159453A · Dhein · 1992 [cited by examiner]
US 6603576B1 · Nakamura · 2003 [cited by examiner]
US 10269155B1 · Brailovskiy · 2019 [cited by examiner]
US 10540757B1 · Bouhnik · 2020 [cited by examiner]
US 20050278402A1 · Ishikawa · 2005 [cited by applicant]
US 20060107070A1 · Rice et al. · 2006 [cited by applicant]
US 20070098166A1 · Candelore et al. · 2007 [cited by applicant]
US 20080037780A1 · Layton · 2008 [cited by applicant]
US 20100067706A1 · Anan et al. · 2010 [cited by applicant]
US 20190236394A1 · Price · 2019 [cited by examiner]
US 20210309248A1 · Choe · 2021 [cited by examiner]
US 20210350555A1 · Fischetti · 2021 [cited by examiner]
US 20220415004A1 · Netsch · 2022 [cited by examiner]
Abadi, Martin et al., “On Hiding Information from an Oracle”, Journal of Computer and System Sciences, vol. 39, pp. 21-50, 1989. [cited by applicant]
Abadi, Martin et al., “Deep Learning with Differential Privacy”, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318, 2016. [cited by applicant]
Abboud, Amir and Lewi, Kevin, “Exact Weight Subgraphs and the k-Sum Conjecture”, International Colloquium on Automata, Languages, and Programming (ICALP), 2013. [cited by applicant]
Abboud, Amir et al., “Losing Weight by Gaining Edges”, European Symposium on Algorithms (ESA), 2014. [cited by applicant]
Abboud, Amir, “Fine-Grained Reductions and Quantum Speedups for Dynamic Programming”, 46th International Colloquium on Automata, Languages, and Programming (ICALP), 2019. [cited by applicant]
Alzantot, Moustafa et al., “Generating Natural Language Adversarial Examples”, arXiv: 1804.07998v2, Sep. 24, 2018. [cited by applicant]
Papernot, Nicolas et al., “Making the Shoe Fit: Architectures, Initializations, and Tuning or Learning with Privacy”, ICLR 2020 Conference Blind Submission, Sep. 25, 2019. [cited by applicant]
Athalye, Anish et al., “Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples”, Proceedings of the 35th International Conference on Machine Learning, 2018. [cited by applicant]
Baran, Ilya et al., “Subquadratic Algorithms for 3SUM”, Algorithmica, vol. 50, No. 4, pp. 584-596, 2008. [cited by applicant]
Beckham, Christopher et al., “On Adversarial Mixup Resynthesis”, NEURIPS, Oct. 2019. [cited by applicant]
Beimel, Amos, “Secret-Sharing Schemes: A Survey”, International Conference on Coding and Cryptology, pp. 11-46, Springer, 2011. [cited by applicant]
Berthelot, David et al., “MixMatch: A Holistic Approach to Semi-Supervised Learning”, NeurIPS, Oct. 2019. [cited by applicant]
Bhattacharyya, Arnab et al., “The Complexity of Linear Dependence Problems in Vector Spaces”, ICS, pp. 496-508, 2011. [cited by applicant]
Biggio, Battista et al., “Evasion attacks against machine learning at test time”, Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 387-402, Springer, 2013. [cited by applicant]
Bonawitz, Keith et al., “Practical Secure Aggregation for Federated Learning on User-Held Data”, NIPS Workshop on Private Multi-Party Machine Learning, 2016. [cited by applicant]
Carlini, Nicholas et al., “Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods”, Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3-14, 2017. [cited by applicant]
Carmon, Yair et al., “Unlabeled Data Improves Adversarial Robustness”, Advances in Neural Information Processing Systems, pp. 11190-11201, 2019. [cited by applicant]
Chernoff, Herman, “A Measure of Asymptotic Efficiency for Tests of a Hypothesis Based on the Sum of Observations”, The Annals of Mathematical Statistics, pp. 493-507, 1952. [cited by applicant]
Dhillon, Guneet S. et al., “Stochastic Activation Pruning for Robust Adversarial Defense”, arXiv:1803.01442v1, Mar. 5, 2018. [cited by applicant]
Dolev, Shlomi et al., “Privacy-Preserving Secret Shared Computations using MapReduce”, IEEE Transactions on Dependable and Secure Computing, 2019. [cited by applicant]
Dosovitskiy, Alexey and Brox, Thomas, “Inverting Visual Representations with Convolutional Networks”, CVPR, pp. 4829-4837, 2016. [cited by applicant]
Dwork, Cynthia, “The Differential Privacy Frontier (Extended Abstract)”, Theory of Cryptography Conference, pp. 496-503, Spring, 2006. [cited by applicant]
Wikipedia contributors, “Random oracle”, Wikipedia, https://en.wikipedia.org/wiki/Random_oracle, accessed Jul. 20, 2023. [cited by applicant]
Dwork, Cynthia et al., “Our Data, Ourselves: Privacy via Distributed Noise Generation”, Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 486-503, Springer, 2006. [cited by applicant]
Erickson, Jeff, “Lower Bounds for Linear Satisfiability Problems”, SODA, pp. 388-395, 1995. [cited by applicant]
Foss, Sergey et al., “An Introduction to Heavy-Tailed and Subexponential Distributions”, Oberwolfach Preprints, Apr. 30, 2009. [cited by applicant]
Fredrikson, Matt et al., “Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures”, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1322-1333, 201… [cited by applicant]
Fu, Yingwei et al., “Mixup Based Privacy Preserving Mixed Collaboration Learning”, 2019 IEEE International Conference on Service-Oriented System Engineering (SOSE), pp. 275-2755, 2019. [cited by applicant]
Gentry, Craig, “Fully Homomorphic Encryption Using Ideal Lattices”, Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing (STOC), pp. 169-178, 2009. [cited by applicant]
Goodfellow, Ian J. et al., “Explaining and Harnessing Adversarial Examples”, arXiv:1412.6572v3, Mar. 20, 2015. [cited by applicant]
Graepel, Thore et al., “ML Confidential: Machine Learning on Encrypted Data”, International Conference on Information Security and Cryptology, pp. 1-21, Springer, 2012. [cited by applicant]
Guo, Chuan et al., “Countering Adversarial Images Using Input Transformations”, arXiv:1711.00117v3, Jan. 25, 2018. [cited by applicant]
Haagerup, Uffe, “The best constants in the Khintchine inequality”, Studia Mathematica, vol. 70, No. 3, pp. 231-283, 1981. [cited by applicant]
He, Kaiming et al., “Deep Residual Learning for Image Recognition”, CVPR, pp. 770-778, 2016. [cited by applicant]
Hitaj, Briland et al., “Deep Residual Learning for Image Recognition”, Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 603-618, 2017. [cited by applicant]
Hoeffding, Wassily, “Probability Inequalities for Sums of Bounded Random Variables”, Journal of the American Statistical Association, vol. 58, No. 301, pp. 13-30, 1963. [cited by applicant]
Huang, Yangsibo et al., “InstaHide: Instance-hiding Schemes for Private Distributed Learning”, International Conference on Machine Learning, 2020. [cited by applicant]
Impagliazzo, Russell and Paturi, Ramamohan, “Which Problems Have Strongly Exponential Complexity?”, Journal of Computer and System Sciences, vol. 63, pp. 512-530, 2001. [cited by applicant]
Verma, Vikas et al., “Manifold Mixup: Better Representations by Interpolating Hidden States”, ICML, pp. 6438-6447, 2019. [cited by applicant]
Woodruff, David P., “Sketching as a Tool for Numerical Linear Algebra”, Foundations and Trends in Theoretical Computer Science, vol. 10, Nos. 1-2, pp. 1-157, Feb. 11, 2015. [cited by applicant]
Wright, Farroll T., “A Bound on Tail Probabilities for Quadratic Forms in Independent Random Variables Whose Distributions are not Necessarily Symmetric”, The Annals of Probability, vol. 1, No. 6, pp. 1068-1070, Dec. 19… [cited by applicant]
Xie, Cihang et al., “Mitigating Adversarial Effects Through Randomization”, ICLR, arXiv:1711.01991v3, Feb. 28, 2018. [cited by applicant]
Yang, Yuzhe et al., “ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation”, ICML, arXiv:1905.11971v1, May 28, 2019. [cited by applicant]
Yao, Andrew C., “Protocols for Secure Computations”, 23rd Annual Symposium on Foundations of Computer Science (SFCS 1982), pp. 160-164, Nov. 1982. [cited by applicant]
Zhang, Hongyi et al., “Mixup: Beyond Empirical Risk Minimization”, ICLR, arXiv:1710.09412v2, Apr. 27, 2018. [cited by applicant]
Zhu, Ligeng et al., “Deep Leakage from Gradients”, NeurIPS, arXiv:1906.08935v2, Dec. 19, 2019. [cited by applicant]
California State Legislature, “California Consumer Privacy Act (CPPA)”, https://oag.ca.gov/privacy/ccpa, 2018. [cited by applicant]
Tramer, Florian et al., “Ensemble Adversarial Training: Attacks and Defenses”, ICLR, arXiv:1705.07204v5, Apr. 26, 2020. [cited by applicant]
Deng, Jia et al., “ImageNet: A Large-Scale Hierarchical Image Database”, CVPR, pp. 248-2555, IEEE, 2009. [cited by applicant]
Tropp, Joel A., “An introduction to matrix concentration inequalities”, Foundations and Trends in Machine Learning, vol. 8, Nos. 1-2, pp. 1-230, 2015. [cited by applicant]
Dwork, Cynthia and Roth, Aaron, “The Algorithmic Foundations of Differential Privacy”, Foundations and Trends in Theoretical Computer Science, vol. 9, Nos. 3-4, pp. 211-407, 2014. [cited by applicant]
Mao, Xiao-Jiao et al., “Image Restoration Using Very Deep Convolutional Encoder-Decoder Networks with Symmetric Skip Connections”, NIPS, pp. 2802-2810, 2016. [cited by applicant]
Jiang, Shunhua et al., “Faster Dynamic Matrix Inverse for Faster LPs”, arXiv 2004:07470v1, Apr. 16, 2020. [cited by applicant]
The European Parliament and the Council of the European Union, “Regulation (EU) 2016/679 . . . on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, a… [cited by applicant]
Karp, Richard M., “Reducibility Among Combinatorial Problems”, Complexity of Computer Computations, pp. 85-103, Plenum Press, 1972. [cited by applicant]
Kermany, Daniel S. et al., “Identifying Medical Diagnoses and Treatable Diseases by Image-Based Deep Learning”, Cell, vol. 172, pp. 1122-1131, Feb. 22, 2018. [cited by applicant]
Kingma, Diederik P. and BA, Jimmy Lei, “ADAM: A Method for Stochastic Optimization”, ICLR, arXiv:1412.6980v9, Jan. 30, 2017. [cited by applicant]
Konecny, Jakub et al., “Federated Learning: Strategies for Improving Communication Efficiency”, NIPS Workshop on Private Multi-Party Machine Learning, arXiv:1610.05492v2, Oct. 30, 2017. [cited by applicant]
Krizhevsky, Alex, “Learning Multiple Layers of Features from Tiny Images”, technical report, Citeseer, Apr. 8, 2009. [cited by applicant]
Lamb, Alex et al., “Interpolated Adversarial Training: Achieving robust neural networks without sacrificing too much accuracy”, Neural Networks, vol. 154, pp. 218-233, Jul. 16, 2022. [cited by applicant]
Laurent, B. and Massart, P., “Adaptive Estimation of a Quadratic Functional by Model Selection”, The Annals of Statistics, vol. 28, No. 5, pp. 1302-1338, 2000. [cited by applicant]
Lee, Yin Tat et al., “Solving Empirical Risk Minimization in the Current Matrix Multiplication Time”, COLT, arXiv:1905.04447v1, May 11, 2019. [cited by applicant]
Li, Ping et al., “Multi-key privacy-preserving deep learning in cloud computing”, Future Generation Computer Systems, vol. 74, pp. 76-85, 2017. [cited by applicant]
Liu, Zhijian et al., “FaceMix: Privacy-Preserving Face Attribute Classification on the Cloud”, Han Lab Tech report, 2019. [cited by applicant]
Lu, Yichao et al., “Faster Ridge Regression via the Subsampled Randomized Hadamard Transform”, Advances in Neural Information Processing Systems, pp. 369-377, 2013. [cited by applicant]
Madry, Aleksander et al., “Towards Deep Learning Models Resistant to Adversarial Attacks”, ICLR, arXiv:1706.06083v4, Sep. 4, 2019. [cited by applicant]
Mohassel, Payman and Zhang, Yupeng, “SecureML: A System for Scalable Privacy-Preserving Machine Learning”, 2017 IEEE Symposium on Security and Privacy (SP), pp. 19-38, 2017. [cited by applicant]
Pang, Tianyu et al., “Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks”, ICLR, arXiv:1909.11515v2, Feb. 20, 2020. [cited by applicant]
Papernot, Nicolas et al., “Practical Black-Box Attacks against Machine Learning”, Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp. 506-519, 2017. [cited by applicant]
Paszke, Adam et al., “PyTorch: An Imperative Style, High-Performance Deep Learning Library”, NeurIPS, pp. 8024-8035, 2019. [cited by applicant]
Patrascu, Mihai, “Towards Polynomial Lower Bounds for Dynamic Problems”, Proceedings of the 42nd ACM Symposium on Theory of Computing (STOC), 2010. [cited by applicant]
Phong, Le Trieu et al., “Privacy-Preserving Deep Learning via Additively Homomorphic Encryption”, 8th International Conference on Applications and Techniques in Information Security (ATIS), 2017. [cited by applicant]
Qian, Ning, “On the momentum term in gradient descent learning algorithms”, Neural Networks, vol. 12, pp. 145-151, 1999. [cited by applicant]
Rudelson, Mark and Vershynin, Roman, “Hanson-Wright inequality and sub-gaussian concentration”, Electronic Communications in Probability, vol. 18, No. 82, pp. 1-9, 2013. [cited by applicant]
Russakovsky, Olga et al., “ImageNet Large Scale Visual Recognition Challenge”, arXiv:1409.0575v3, Jan. 30, 2015. [cited by applicant]
Shokri, Reza and Shmatikov, Vitaly, “Privacy-Preserving Deep Learning”, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1310-1321, 2015. [cited by applicant]
Simonyan, Karen and Zisserman, Andrew, “Very Deep Convolutional Networks for Large-Scale Image Recognition”, ICLR, arXiv:1409.1556v6, Apr. 10, 2015. [cited by applicant]
Song, Yang et al., “PixelDefend: Leveraging Generative Models to Understand and Defend Against Adversarial Examples”, ICLR, arXiv:1710.10766v3, May 21, 2018. [cited by applicant]
Szegedy, Christian et al., “Intriguing properties of neural networks”, NeurIPS, 2013. [cited by applicant]
Tramer, Florian et al., “On Adaptive Attacks to Adversarial Example Defenses”, arXiv:2002.08347v2, Oct. 23, 2020. [cited by applicant]
Lecun, Yann et al., “The Mnist Database of Handwritten Digits”, AT&T Labs, http://yann.lecun.com/exdb/mnist, accessed Jul. 20, 2023. [cited by applicant]
United States Department of Health & Human Services, “Summary of the HIPAA Privacy Rule”, OCR Privacy Rule Summary, revised May 2003. [cited by applicant]
Vepakomma, Praneeth et al., “Split learning for health: Distributed deep learning without sharing raw patient data”, CLR Workshop on AI for Social Good, arXiv:1812.00564v1, Dec. 3, 2018. [cited by applicant]
International Search Report and Written Opinion for corresponding International Application No. PCT/US2021/037813, dated Sep. 23, 2021. [cited by applicant]
Sharma et al., “Hiding Data in Images Using Cryptography and Deep Neural Network”, Journal of Artificial Intelligence and System, vol. 1, pp. 143-162, 2019. [cited by applicant]
Huang et al., “InstaHide: Instance-hiding Schemes for Private Distributed Learning”, arXiv:2010.02772v2 [cs.CR], Feb. 24, 2021. Retrieved from <URL:https://arxiv.org/pdf/2010.02772.pdf>, Retrieved on Aug. 27, 2021. [cited by applicant]
Cited By (1)
US 12,634,328