# CryptoNN: Training Neural Networks over Encrypted Data

arXiv: https://arxiv.org/abs/1904.07303 · HTML: https://mlsanity.com/paper/1904.07303/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Apr 2019.

## Built on by (most cited first, 14 of 14)

- [Privacy-Preserving Machine Learning: Methods, Challenges and Directions](https://mlsanity.com/paper/2108.04417/) (2021)
- [Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios](https://mlsanity.com/paper/2306.08386/) (2023)
- [A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks](https://mlsanity.com/paper/2306.08313/) (2023)
- [TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2501.05053/) (2025)
- [Multitask Identity-Aware Image Steganography via Minimax Optimization](https://mlsanity.com/paper/2107.05819/) (2021)
- [SoK: Privacy Preserving Machine Learning using Functional Encryption: Opportunities and Challenges](https://mlsanity.com/paper/2204.05136/) (2022)
- [Towards Privacy-Preserving Neural Architecture Search](https://mlsanity.com/paper/2204.10958/) (2022)
- [Human-imperceptible, Machine-recognizable Images](https://mlsanity.com/paper/2306.03679/) (2023)
- [BlindU: Blind Machine Unlearning without Revealing Erasing Data](https://mlsanity.com/paper/2601.07214/) (2026)
- [Practical, Private Assurance of the Value of Collaboration via Fully Homomorphic Encryption](https://mlsanity.com/paper/2310.02563/) (2023)
- [Functional Encryption in Secure Neural Network Training: Data Leakage and Practical Mitigations](https://mlsanity.com/paper/2509.21497/) (2025)
- [Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks](https://mlsanity.com/paper/2604.16834/) (2026)
- [Sarus: Privacy-Preserving Multi-Vendor Perception Fusion via Homomorphic Encryption](https://mlsanity.com/paper/2607.19146/) (2026)
- [Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach](https://mlsanity.com/paper/2609.22981/) (2026)

## Abstract (arXiv)

Emerging neural networks based machine learning techniques such as deep learning and its variants have shown tremendous potential in many application domains. However, they raise serious privacy concerns due to the risk of leakage of highly privacy-sensitive data when data collected from users is used to train neural network models to support predictive tasks. To tackle such serious privacy concerns, several privacy-preserving approaches have been proposed in the literature that use either secure multi-party computation (SMC) or homomorphic encryption (HE) as the underlying mechanisms. However, neither of these cryptographic approaches provides an efficient solution towards constructing a privacy-preserving machine learning model, as well as supporting both the training and inference phases. To tackle the above issue, we propose a CryptoNN framework that supports training a neural network model over encrypted data by using the emerging functional encryption scheme instead of SMC or HE. We also construct a functional encryption scheme for basic arithmetic computation to support the requirement of the proposed CryptoNN framework. We present performance evaluation and security analysis of the underlying crypto scheme and show through our experiments that CryptoNN achieves accuracy that is similar to those of the baseline neural network models on the MNIST dataset.