Research map / Federated learning and privacy / Privacy attacks and secure learning
Encryption-based private learning
Use homomorphic encryption and private synthetic data for privacy-preserving learning.
105 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Privacy attacks and secure learning, keyword cluster “preserving · vfl · encryption”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Leveling off Several papers from 2025–26 still report on 1 tracked benchmark, but the best result has barely moved since 2024.
33 papers in 2023–24 and 35 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 25.2% to 24.6%.
What looks settled
- CIFAR-10 (accuracy): best up to 2024 96.57, best in 2025–26 93.02 from 2 papers, at most 0.2% better, if at all.
No longer reported by papers here: MNIST (accuracy, last in 2023).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy (ICML 2016 · 1,289 citations)
- 2017 · Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data (ICLR 2017 · 174 citations)
- 2018 · Distributed Learning without Distress: Privacy-Preserving Empirical Risk Minimization (NeurIPS 2018 · 109 citations)
- 2019 · Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (ICLR 2019 · 245 citations)
- 2020 · Synthetic Learning: Learn From Distributed Asynchronized Discriminator GAN Without Sharing Medical Image Data (CVPR 2020 · 94 citations)
- 2021 · CrypTen: Secure Multi-Party Computation Meets Machine Learning (NeurIPS 2021 · 62 citations)
- 2022 · Privacy for Free: How does Dataset Condensation Help Privacy? (ICML 2022 · 29 citations)
- 2023 · PPGenCDR: A Stable and Robust Framework for Privacy-Preserving Cross-Domain Recommendation (AAAI 2023 · 25 citations)
- 2024 · Blind-Touch: Homomorphic Encryption-Based Distributed Neural Network Inference for Privacy-Preserving Fingerprint Authentication (AAAI 2024 · 17 citations)
- 2025 · A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · 4 citations)
- 2026 · Towards Benchmarking Privacy Vulnerabilities in Selective Forgetting with Large Language Models (AAAI 2026 · 4 citations)
Earliest papers here
- CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy (ICML 2016 · 1,289 citations)
- Fast Distributed Submodular Cover: Public-Private Data Summarization (NeurIPS 2016 · 36 citations)
- Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data (ICLR 2017 · 174 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR-10 · accuracy (higher is better)
10 papers, 2019–2025 · flat since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2019 | 84.57 | Private Model Compression via Knowledge Distillation (AAAI 2019 · 120 citations) |
| 2020 | 95.55 | CryptoNAS: Private Inference on a ReLU Budget (NeurIPS 2020 · 37 citations) |
| 2023 | 96.57 | HETAL: Efficient Privacy-preserving Transfer Learning with Homomorphic Encryption (ICML 2023 · 9 citations) |
MNIST · accuracy (higher is better)
5 papers, 2019–2023 · not reported since 2023
| Year | Best so far | Set by |
|---|---|---|
| 2019 | 99.28 | Private Model Compression via Knowledge Distillation (AAAI 2019 · 120 citations) |
CIFAR-100 · accuracy (higher is better)
4 papers, 2020–2025 · one report since 2024, not better
| Year | Best so far | Set by |
|---|---|---|
| 2020 | 79.59 | CryptoNAS: Private Inference on a ReLU Budget (NeurIPS 2020 · 37 citations) |
What has been tried
80 papers here report 733 measured changes (a component added, removed or swapped, compared with a baseline): helped 61%, no clear effect 10%, hurt 26%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| compute FC-16 after encryption rather than in plaintext on the client | 5,000 fingerprints · Evaluation time | 0.65 seconds -> 15,096 seconds | Hurt | Blind-Touch: Homomorphic Encryption-Based Distributed Neural Network Inference for Privacy-Preserving Fingerprint Authentication (AAAI 2024 · 17 citations) |
| Add the merge module | GPT-2, sequence length 128 · speedup | 1.59x -> 7.75x | Helped | MERGE: Fast Private Text Generation (AAAI 2024 · 8 citations) |
| reduce DP-OPT privacy budget ε to 1 | SST-2 · accuracy (%) | accuracy drops to 86% approximately | Hurt | DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineer (ICLR 2024 · 5 citations) |
| Replace user-side denoising with server-side denoising without noise-level knowledge | BERT, MRPC · AUC | over 10% | Hurt | Split-and-Denoise: Protect large language model inference with local differential privacy (ICML 2024 · 4 citations) |
| replace softmax with a quadratic function | CIFAR-10 · accuracy | 93.02% -> 93.02% | No clear effect | PrivDNFIS: Privacy-preserving and Efficient Deep Neuro-Fuzzy Inference System (AAAI 2025 · 3 citations) |
| Add the CS regularizer | Popularity Attack · Recall@20 | 0.134 -> 0.144 | Helped | RRL: Recommendation Reverse Learning (AAAI 2024 · 3 citations) |
| replace iterative multi-step optimization with a single selection step | DrugLib 3.5K · test MSE | 9.2 -> 9.0 | Helped | Data Acquisition via Experimental Design for Data Markets (NeurIPS 2024 · 2 citations) |
| add the generator's image-reconstruction information (λ > 0) | MNIST, SVHN, and CIFAR-10 across measurement rates 0.05(%), 0.1(%), and 0.25(%) · classification accuracy | Helped | Practical Privacy-Preserving MLaaS: When Compressive Sensing Meets Generative Networks (AAAI 2024 · 1 citation) | |
| perturb IRres instead of the full IR | CIFAR-10 · accuracy | 69.6% -> 92.4% | Helped | All Rivers Run to the Sea: Private Learning with Asymmetric Flows (CVPR 2024 · 1 citation) |
| Use random numbers instead of fixed r in ABY3 probabilistic truncation | CIFAR10 AlexNet, P-SecureML · accuracy | 69.63% -> 12.74% | Hurt | On Probabilistic Truncation in Privacy-preserving Machine Learning (AAAI 2025 · 0 citations) |
| Use the proposed noise instead of the Unlearn (+) noise for Unlearn (-) | Synthetic datasets · forget score | Helped | A Certified Unlearning Approach without Access to Source Data (ICML 2025 · 0 citations) | |
| Add keyword-based conditions during DP finetuning | PubMed, ε=∞ · perplexity | 63.1 -> 49.3 | Helped | Synthesizing Privacy-Preserving Text Data via Finetuning *without* Finetuning Billion-Scale LLMs (ICML 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 19 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 5 of 19 papers
- MNIST · 3 of 19 papers
- ImageNet · 3 of 19 papers
- CIFAR-100 · 2 of 19 papers
Baselines
- Falcon · 3 of 19 papers
- BumbleBee · 2 of 19 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 68 papers; from OpenAlex and the papers' affiliations).
- Massachusetts Institute of Technology · 5 papers
- Zhejiang University · 4 papers
- J.P. Morgan Chase · 4 papers
- Fudan University · 3 papers
- University of Southern California · 3 papers
- University of Illinois, Urbana Champaign · 3 papers
- National University of Singapore · 3 papers
- Stanford University · 3 papers
- Shanghai Jiao Tong University · 2 papers
- University of California, Berkeley · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Private federated aggregation (50 papers)
- Visual privacy and face de-identification (39 papers)
Elsewhere in the topic
- Defending federated learning against poisoning (76 papers)
- Gradient inversion attacks (47 papers)
- Membership inference and auditing (47 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).