# Qualitative and Quantitative Analysis of Diversity in Cross-document
Coreference Resolution Datasets

Anastasia Zhukova University of Wuppertal, Germany  Felix Hamborg University
of Konstanz, Germany  Bela Gipp University of Wuppertal, Germany

###### Abstract

Cross-document coreference resolution (CDCR) datasets, such as ECB+, contain
manually annotated event-centric mentions of events and entities that form
coreference chains with identity relations. ECB+ is a state-of-the-art CDCR
dataset that focuses on the resolution of events and their descriptive
attributes, i.e., actors, location, and date-time. NewsWCL50 is a dataset that
annotates coreference chains of both events and entities with a strong
variance of word choice and more loosely-related coreference anaphora, e.g.,
bridging or near-identity relations. In this paper, we qualitatively and
quantitatively compare annotation schemes of ECB+ and NewsWCL50 with multiple
criteria. We propose a phrasing diversity metric (PD) that compares lexical
diversity within coreference chains on a more detailed level than previously
proposed metric, e.g., a number of unique lemmas. We discuss the different
tasks that both CDCR datasets create, i.e., lexical disambiguation and lexical
diversity challenges, and propose a direction for further CDCR evaluation.

##  1 Introduction

Cross-document coreference resolution (CDCR) is a set of techniques that aims
to resolve mentions of events and entities across a set of related documents.
CDCR is employed as an essential analysis component in a broad spectrum of use
cases, e.g., to identify potential targets in sentiment analysis or as a part
of discourse interpretation.

Although the CDCR research has been gaining attention, the annotation schemes
and corresponding datasets have been infrequently exploring the mix of
identity and loose coreference relations and lexical diversity of the
annotated chains of mentions. For example, resolution of identity relations,
i.e., coreference resolution, and resolution of more loose relations, i.e.,
bridging, are typically split into two separate tasks Kobayashi and Ng (2020).
Resolution and evaluation of entity and event mentions of the two types of
relation remains a research gap in CDCR research.

In this paper, we explore the qualitative and quantitative characteristics of
two CDCR annotation schemes that annotate both events and entities. (1) ECB+,
a state-of-the-art event-centric CDCR dataset Cybulska and Vossen (2014b) that
annotates mentions with identity coreference relations. (2) NewsWCL50, an
experimental concept-centric dataset for identification of semantic concepts
that contain mentions with a mix of identity, loose coreferential, and
bridging relations, e.g., context-dependent synonyms, metonyms, and meronyms
Hamborg et al. (2019). We propose a phrasing diversity metric (PD) that
describes the variation of wording in annotated coreference chains and
measures the lexical complexity of CDCR datasets. Unlike the number of unique
lemmas, i.e., a previously used metric for lexical diversity Eirew et al.
(2021), the proposed PD allows capturing higher lexical variation in
coreference chains. We discuss the CDCR tasks that each of the datasets
creates for CDCR models, i.e., lexical disambiguation and lexical diversity
challenges. Finally, we continue the discussion of the future of the CDCR
evaluation Bugert et al. (2021) and propose a task-driven CDCR evaluation to
aim at improved robustness of CDCR models.

##  2 Related work

Coreference resolution (CR) and cross-document coreference resolution (CDCR)
are tasks that aim to resolve coreferential mentions in one or multiple
documents, respectively Singh et al. (2019). (CD)CR approaches tend to depend
on the annotation schemes of the CDCR datasets that specify a definition of
mentions and coreferential relations Bugert et al. (2021). The established
CDCR datasets are typically event-centric O’Gorman et al. (2016); Mitamura et
al. (2017, 2015); Cybulska and Vossen (2014b); Hong et al. (2016); Bugert et
al. (2020); Vossen et al. (2018), i.e., triggers annotating a mention at the
presence of an event, or concept-centric Weischedel et al. (2011); Recasens et
al. (2010a); Hasler et al. (2006); Minard et al. (2016), i.e., annotates
mentions if an antecedent contains a minimum number of coreferential mentions
of occurring entities or events in the documents.

Most (CD)CR datasets contain only strict identity relations, e.g., TAC KBP
Mitamura et al. (2017, 2015), ACE Linguistic Data Consortium et al. (2008,
2005), MEANTIME Minard et al. (2016), OntoNotes Weischedel et al. (2011), ECB+
Bejan and Harabagiu (2010); Cybulska and Vossen (2014b), GVC Vossen et al.
(2018), and FCC Bugert et al. (2020). Less commonly used (CD)CR datasets
explore relations beyond strict identity. For example, NiDENT Recasens et al.
(2012) is a CDCR dataset of entities-only mentions that was created by
reannotating NP4E. NiDENT explores coreferential mentions of more loose
coreference relations coined near-identity that among all included metonymy,
e.g., “White House” to refer to the US government, and meronymy, e.g., “US
president” being a part of the US government and representing it. Reacher
Event Description (RED), a dataset for CR, contains also more loose
coreference relations among events O’Gorman et al. (2016).

Mentions coreferential with more loose relations are harder to annotate and
automatically resolve than mentions with identity relations Recasens et al.
(2010b). Bridging relations occur when a connection between mentions is
implied but is not strict, e.g., a “part-of” relation. Bridging relations,
unlike identity relations, form a link between nouns that do not match in
grammatical constraints, i.e., gender and number agreement, and allow linking
noun and verb mentions, thus, constructing abstract entities Kobayashi and Ng
(2020). The existing datasets for identification of bridging relations, e.g.,
ISNotes Hou et al. (2018), BASHI Rösiger (2018), ARRAU Poesio and Artstein
(2008) annotate the relations only of noun phrases (NPs) on a single-document
level and solve the problem as antecedent identification problem rather than
identification of a set of coreferential anaphora Hou et al. (2018). GUM
corpus Zeldes (2017) annotates both coreference and bridging relations but as
two separate tasks. Definition identification in the DEFT dataset Spala et al.
(2019) focuses on annotating mentions that are linked with “definition-like”
verb phrases (e.g., means, is, defines, etc.) but does not address linking the
antecedents and definitions into the coreferential chains.

In the following sections, we discuss and contrast two perspectives on
annotating coreferential relations in CDCR datasets: coreferential relations
of identity strength in event-centric chains of mentions and more loose
coreference relations, i.e., a combination of identity and bridging anaphoric
relations such as synonymy, metonymy, meronymy Poesio and Vieira (1998);
Rösiger (2018), in concept-centric chains. We aim at exploring if loose
coreference relations are a challenge to the CDCR task and if it is possible
to solve with feature-based approaches.

##  3 Coreference anaphora in CDCR

We compare ECB+ Cybulska and Vossen (2014b), a state-of-the-art CDCR dataset,
and NewsWCL50 Hamborg et al. (2019), a dataset that annotates frequently
reported concepts in news articles that tend to contained biased phrases by
word choice and labeling. The two datasets annotate both event and entity
mentions but significantly differ in defining coreference chains. To our best
knowledge, despite focusing on a problem of media bias, NewsWCL50 is the only
CDCR-related dataset that annotated coreferential chains with identity and
more loose relation together in NPs and verb phrases (VPs).

###  3.1 Qualitative comparison

We qualitatively compare the datasets regarding three main factors that
represent viable characteristics in CDCR. First, properties of the topic
composition of the CDCR datasets. Second, how each dataset defines which
phrases should become coreference mentions, i.e., candidates for a single
coreference chain, and how these phrases should be annotated. Third, how
coreferential chains are constructed, i.e., which relations link the
coreferential anaphora.

####  3.1.1 Dataset structure

CDCR is performed on a collection of narrowly-related articles based on topic
or event similarity.

NewsWCL50 contains one level of topically related news articles that report
about the same event. Although reporting about the same event, some parts of
these news articles discuss various aspects of it. For example, in topic 5 of
NewsWCL50, while generally reporting on Trump visiting the UK, some news
articles focused on Trumps plans during this visit, some compared his visit to
the other visits of the US presidents, and others on the demonstrators
opposing this visit.

ECB+ contains news articles that are related on two levels: first, on a
general topic level of on event, e.g., earthquake, second, on a subtopic level
of a specific event that is described by event, actors, location, and time.
Therefore, CDCR on ECB+ is possible on a topic or sub-topic levels.

For ECB+, Cybulska and Vossen (2014b) proposed a split into train, validation,
and test subsets. On the contrary, Hamborg et al. (2019) used the entire
corpus of NewsWCL50 as a test set for their unsupervised approach due to the
small number of annotated topics (see Table 3).

Since the resolution of ECB+ consists of 43 topics with two subtopics per each
topic. Cybulska and Vossen (2014b) Upadhyay et al. (2016) and Cattan et al.
(2021) measure complexity a

Table 1: Comparison of mentions as manually annotated chains in ECB+ and when re-annotated as concepts following the NewsWCL50 coding book (B). Chain’s name |  Coding book |  Annotated mentions
---|---|---
36: Warren Jeffs (entity) |  ECB+ |  t36_warren_jeffs: attorney; FLDS leader’s; he; head; him; his; Jeffs; leader; leader Warren Jeffs; pedophile; Polygamist; polygamist leader Warren Jeffs; Polygamist prophet Warren Jeffs; polygamist sect leader Warren Jeffs; Polygamist Warren Jeffs; Warren Jeffs; Warren Jeffs, Polygamist Leader; who
|  NewsWCL50 |  a handful from day one; a problem; a victim of religious persecution; an accomplice for his role; an accomplice to rape by performing a marriage involving an underage girl; an accomplice to sexual conduct with a minor; an accomplice to sexual misconduct with minors; an accomplice to the rape of a 14-year-old girl; FLDS prophet Warren Jeffs; God’s spokesman on earth; her father; his client; Jeffs; Jeffs, 54; Jeffs, who acted as his own attorney; Jeffs, who was indicted more than two years ago; Mr. Jeffs; one individual, Warren Steed Jeffs; one of the most wicked men on the face of the earth since the days of Father Adam; penitent; Polygamist prophet Warren Jeffs; polygamist sect leader Warren Jeffs; polygamist Warren Jeffs; president; prophet of the Fundamentalist Church of the Jesus Christ of the Latter Day Saints; prophet Warren Jeffs; stone-faced; The 54-year-old Jeffs; the defendant; the ecclesiastical head of the Fundamentalist Church of Jesus Christ of Latter Day Saints; the father of a 15-year-old FLSD member’s child; the highest-profile defendant; the prophet; the self-styled prophet; their client; their spiritual leader; This individual; Warren Jeffs; Warren Jeffs, leader of the Fundamentalist Church of Jesus Christ of Latter Day Saints; Warren Jeffs, polygamist leader
39: Become new Dr.Who (event) |  ECB+ |  t39_capaldi_play_doc: play, take on, take up
|  |  t39_replace_smith: replace, replacing, stepped into, take over, takes over
|  |  t39_play_doc: one, play, role
|  NewsWCL50 |  about to play the best part on television; an incredible incarnation of number 12; become one of the all-time classic Doctors; become the next Doctor Who; becoming the 12th Doctor; becoming the next Doctor; Being asked to play The Doctor; being the doctor; had been chosen; get started; getting it; has been announced as the new star of BBC sci-fi series Doctor Who; has been named as the 12th actor to play the Doctor; his unique take on the Doctor; is about to play the best part on television; is to be the new star of Doctor Who; might be the right person to take on this iconic part; play it; play the Doctor; revealed as 12th Doctor; stepped into Matt Smith’s soon to be vacant Doctor Who shoes; take over from Matt Smith as Doctor Who; take the role for days; takes over Doctor Who Tardis; the Doctor’s appointment; replace Matt Smith on Doctor Who; will be the 12th actor to play the Doctor; will play the 12th Doctor; will replace Matt Smith; will take over from Smith

####  3.1.2 Mentions

ECB+ dataset, the annotation process is centered around events as main
concept-holders. Each event is described using four components, i.e., action,
time, location, and participant Cybulska and Vossen (2014b). Due to its focus
on events, NP and VP phrases are annotated as mentions only if defining an
event, resulting later in (1) many in-text mentions of entities being not
annotated and thus not part of annotated coreference chains or new non-event-
centric coreference chains, (2) many event or entity singleton-mentions of
entities, e.g., location, that occurred only once describing an event.

In contrast, in NewsWCL50, all mentions are annotated if at least five
candidate phrases occur in at least one document in NewsWCL50 Hamborg et al.
(2019). The goal is to identify the most frequently reported concepts within
the related news articles. NewsWCL50 annotates mentions of NPs and VPs. The
annotation scheme distinguishes the mention chains referring to actors,
actions, objects, events, geo-political entities (GPE), and abstract entities
Poesio and Artstein (2008). NewsWCL50 does not annotate date-time and
annotates locations if they are frequently reported concepts.

A length of mentions defines which tokens of phrase are annotated as a
mention. Following a “minimum span” strategy, ECB+ demands the annotation of
only phrases with the smallest number of words that preserve the core meaning
of a phrase. Often this annotation style leads to annotating only the heads of
phrases. On the contrary, the NewsWCL50 annotation scheme follows a “maximum
span” style that yields longer phrases. A maximum span style allows capturing
modifiers of the heads of phrases and the overall meaning that can change with
the modifies, e.g., compare “kids” to “undocumented kids who did nothing
wrong” and “American kids of undocumented immigrant parents.” ECB+ focuses on
identifying the most reliable spans if they are to be extracted whereas
NewsWCL50 focuses on the annotation of the longest coreferential phrase as the
determining words my carry the bias by word choice and labeling.

####  3.1.3 Relations

The annotation schemes differ in the strength of the coreferential relations
that link the mentions, i.e., identity or more loose relations that include
bridging and near-identity.

ECB+ links mentions into the chains if (1) mentions are related with strict
identity, e.g., “the United States” – “the U.S.”, (2) VP-mentions belong to
the same event as of participant, location, and time, (3) NP-mentions refer to
the same named entity (NE), e.g., country, organization, location, person, or
the same entity as of action, time, and location and matches grammar
constraints, e.g., number and gender Cybulska and Vossen (2014a). Therefore,
if an article that reports on immigration to the US covers either two points
in time within a couple of weeks difference or if the immigrants are located
on multiple spots on the immigration way, annotators will need to create
multiple separate entities for the entity “immigrants.”

NewsWCL50 links the mentions if they are coreferential with a mix of identity
and bridging relations Poesio and Vieira (1998): (1) mentions refer to the
same entity/event including subject-predicate coreference (e.g., “Donald
Trump” – “the newly-minted president”), (2) synonym relations, (e.g., “a
caravan of immigrants” – “a few hundred asylum seekers”), (3) metonymy (e.g.,
“the Russian government” – “the Kremlin”), (4) metonymy/holonymy (e.g., “the
U.S.-Mexico border” – “the San Ysidro port of entry”), (5) mentions are linked
with definition-like verbs or phrases that establish association (e.g., “Kim
Jong Un” – “Little Rocket Man” or “crossing into the U.S.” – “a crisis at the
border”), (6) meet GPE definitions as of ACE annotation Linguistic Data
Consortium et al. (2008) (e.g., “the U.S.” – “American people’), (7) mentions
are elements of one set (e.g., “guaranteed to disrupt trade” – “drove down
steel prices” – “increased frictions” as members of a set “Consequences of
tariff imposition”). The annotation scheme requires to annotate the generic
use of mentions with “part-of” relations referring to GPEs. For example,
always annotate mentions of the police as referring to the U.S. because the
biased language used to report about the police can affect the perception of
the U.S. in general Hamborg (2019).

####  3.1.4 Reannotation experiment

To provide a qualitative example of the difference of the annotations schemes,
we followed a coding book of Hamborg et al. Hamborg (2019) and reannotated an
entity and events of ECB+.

Table 1 shows a qualitative example of how coreference chains of the two
annotation schemes differ. The table shows how exemplary mentions are
annotated in ECB+ and in NewsWCL50. NewsWCL50 coding book yields coreference
chains that (1) annotate any occurred coreferential mentions in the text, not
only related to an event, (2) contain a mix of strict identity and loose
bridging coreferential anaphora.

The reannotated ECB+ entities contain more mentions compared to the original
ECB+ annotation. ECB+ annotated entities in an event-centric way whereas
NewsWCL50 annotated any occurrence of mentions referring to the same
entity/event. Moreover, NewsWCL50’s coding book annotates coreferential
mentions that were used to describe an entity via association with this
entity, e.g., “Warren Jeffs” – “God’s spokesman on earth” or “become one of
the all-time classic Doctors” – “an incredible incarnation of number 12.”

####  3.1.5 Summary

ECB+ annotations cover narrowly defined entities that describe an event as
precisely as possible regarding the event’s participants, action, time, and
location. In contrast, the annotation scheme employed for the creation of
NewsWCL50 aims at determining broader coreference chains that include mentions
of entities that would have not been annotated or would be split into multiple
chains if the ECB+ annotation scheme was used.

###  3.2 Quantitative comparison

Besides the previously discussed qualitative differences, we also
quantitatively compare the annotation schemes. We compare the lexical
diversity of coreference chains, their sizes, numerical parameters of the
corresponding datasets, and annotation complexity measured by inter-annotator
reliability.

####  3.2.1 Lexical diversity

Lexical diversity indicates how the wording differs within annotated concepts
and how obvious or hard is the task of resolving such mentions. We evaluate
lexical diversity with three metrics: (1) CoNLL F1 score of a primitive same-
head-lemma baseline Cybulska and Vossen (2014b); Pradhan et al. (2012) and (2)
a number of different head-lemmas in coreference chains Eirew et al. (2021),
(3) a new metric for lexical diversity that accounts for more within-chain
phrase variations than a number of unique lemmas. To ensure a more fair
comparison of the datasets, we calculate all metrics for lexical diversity on
the annotated chains that exclude singletons. Table 3 summarizes all metrics
and presents general statistics of the datasets, e.g., a number of annotated
mentions and coreference chains.

#### Accuracy of a lemma CDCR baseline

A baseline method of CDCR is to resolve mentions with same-lemmas within
related sets of documents. The accuracy of a lemma-baseline shows that the
better this method performs, the lower is the lexical variation Cybulska and
Vossen (2014b). Table 3 reports that same-lemmas is more efficient on the
chains in ECB+ dataset and denotes smaller lexical diversity of the mentions
in ECB+ compared to NewsWCL50. Coreferential anaphora with more loose
relations increases the possible number combinations of the predicted chains,
thus, increases the complexity of the CDCR task Kobayashi and Ng (2020).

#### Number of unique lemmas of phrases’ heads

Eirew et al. (2021) proposed to measure lexical diversity with an average
number of unique lemmas of phrases’ heads in coreference chains. Similar to
$F1_{CoNLL}$ on the lemma-baseline, the number of unique lemmas shows that
NewsWCL50 contains almost four times more diverse coreference chains than ECB+
(see Table 3).

Unique lemmas as a metric for lexical diversity used in Eirew et al. (2021)
has the most advantage in a “minimum span” mention annotation style, i.e.,
annotate mainly heads pf phrases. Unfortunately, this metric does not account
for larger phrasing diversity in a “maximum span” style, i.e., the annotation
the largest spans that include all head modifiers instead of only minimum
descriptive ones. Figure 1 depicts the trends in the two annotation styles
where numbers of the unique lemmas in the coreference chains are plotted
against the sizes of the chains. Although the average value of NewsWCL50 is
higher than ECB+, the trends suggest that larger subtopics of many documents
annotated with ECB+ coding book would yield similarly diverse coreference
chains as NewsWCL50.

Figure 1: Very subtle difference between the trends in lexical diversity when
it with measures with unique lemmas per coreference chain as proposed by Eirew
et al. (2021) Figure 2: (a) Comparison of coreference chains from ECB+ and
NewsWCL50 with a phrasing diversity metric (PD): the trend of lexical
diversity of NewsWCL50 is higher than ECB+. (b) The phrasing diversity metric
(PD) proposed in Section 3.2 distinguishes between the levels of diversity
measured by unique lemmas.

#### Phrasing diversity metric

We introduce a new phrasing diversity metric (PD) that represents the
variation of phrases used to refer to the same entity/event. PD measures
lexical variation of coreference chains using the mention frequency and
phrasing diversity:

$PD_{c}=\frac{\sum_{\forall h\in
H_{c}}\frac{|U_{h}|}{|A_{h}|}\cdot\sum_{\forall h\in H_{c}}|U_{h}|}{|M_{c}|}$

where $H_{c}$ represents all unique head words of an annotated chain $c$,
$|U_{h}|$ is the number of unique phrases with head $h$, $|A_{h}|$ is the
number of all phrases with head $h$, and $|M_{c}|$ is a number of all mentions
of an annotated chain $c$. Lastly, to aggregate PD per dataset, we compute
weighted average over all corresponding chains:

$PD=\frac{\sum_{\forall c\in C}|M_{c}|\cdot PD_{c}}{\sum_{\forall c\in
C}|M_{c}|}$

To ensure a fair comparison of the lexical diversity of ECB+ to NewsWCL50, we
need to normalize the annotation styles of the mentions between two schemes,
i.e., minimum versus maximum spans of annotated mentions. We automatically
expand the annotated mentions from ECB+ by extracting NPs and VPs of maximum
length from the structure parsing trees that contain the annotated heads of
phrases. Such phrase expansion seeks to minimize the cases in ECB+ when
$|U_{h}|$ is very small.

Similar to Figure 1, Figure 2a plots PD against the sizes of coreference
chains for each dataset and shows the higher lexical diversity of NewsWCL50
compared to ECB+. The trends suggest that coreference chains of ECB+ are
narrowly defined: the large coreference chains have lower values of PD than
NewsWCL50, i.e., the chains contain a lot of repetitive mentions. The figure
shows that a large majority of the ECB+ concepts do not exceed the size of 20
and PD of 5, whereas NewsWCL50’s concepts are distributed over the entire
plot. Unlike ECB+, coreference chains of NewsWCL50 are more broadly-defined,
i.e., have large values of both PD and an average size of coreference chains
(see Table 3). This finding supports the qualitative example in Section 3.1.4
where reannotating leads to the increased size of original ECB+ chains due to
(1) annotated mentions with more loose coreference relations, (2) merging
together previously annotated chains of ECB+ leading to more broadly-defined
chains.

Table 2: A comparison of two metrics of lexical diversity: unique lemmas and phrasing diversity (PD). While a number of unique lemmas are identical for the two chains in the example, PD accounts more for the variation in the phrases.  | Mentions | # repetitions |  # unique lemmas |  Phrasing diversity (PD)
---|---|---|---|---
chain 1 | Donald Trump | 3 | 2 | 1.1
the president | 1
President Donald Trump | 1
Mr. Trump | 1
chain 2 |  undocumented immigrants | 1 | 2 | 2.0
immigrants seeking hope | 1
unauthorized immigrants | 1
migrant caravan | 1
a caravan of Central American migrants | 1
a caravan of hundreds of migrants | 1

Figure 2b shows a difference between unique lemmas and the proposed PD metric,
i.e., the same unique lemmas have higher or lower PD depending on the fraction
of repetitive phrases to be resolved. Consider an example in the Table 2:

$PD_{chain1}=\frac{(3/5+1/1)\cdot(3+1)}{6}=1.1$
$PD_{chain2}=\frac{(3/3+3/3)\cdot(3+3)}{6}=2.0$

The example shows that for the same number of unique lemmas a PD metric may
differ and show higher or lower variation depending on both a number of unique
head lemmas and variation of phrases with these heads. Figure 2b depicts that
for the same number of unique lemmas NewsWCL50 annotates chains with larger PD
than ECB+. Therefore, PD is capable of indicating larger lexical variation
than unique lemmas.

####  3.2.2 Inter-annotator reliability and general statistics

We explore inter-annotator reliability (IAR, also called inter-coder
reliability, ICR). For the strictly formalized ECB+, Cybulska and Vossen
reported Cohen’s Kappa for the annotation of the event/entity mentions
$\kappa_{C}=0.74$ and for connecting these mentions into coreferential chains
$\kappa_{C}=0.76$. For the more flexible NewsWCL50 scheme, Hamborg et al.
Hamborg et al. (2019) reported an average observed agreement $AOA=0.65$ Byrt
et al. (1993). While these measures cannot be compared directly, they indicate
that schemes including mentions with more loosely related anaphora may result
in lower IAR, since AOA is considered less restrictive than Kappa Recasens et
al. (2012); Byrt et al. (1993).

####  3.2.3 Summary

Table 3 reports numeric properties, i.e., a number of annotated documents and
mentions, and quantitative description parameters of the datasets, i.e.,
lexical diversity. On the one hand, ECB+ includes a larger number of topics
and articles compared to NewsWCL50 (43/982 against 10/50) and annotates almost
three times more mentions (15122 and 5696). On the other hand, the density of
annotations per article in higher in NewsWCL50, i.e., 112 annotations per
article in NewsWCL50 against 15 in ECB+, that shows longer documents in
NewsWCL50 and more thoroughly covered annotation of mentions.

We evaluated the complexity of the coreference chains with the average number
of contained mentions, i.e., the size of the coreference chains, and multiple
metrics of lexical diversity. To ensure fair comparison, we removed singletons
chains from the analysis of datasets’ parameters. An average number of
mentions per coreference chain is more than four times larger in NewsWCL50
than in ECB+. Table 3 shows that coreference chains of ECB+ are 4.5 times
smaller and their lexical diversity measured by PD is almost 4 times lower
than those of NewsWCL50. Moreover, NewsWCL50 has a higher value of
$F1_{CoNLL}$ on the head-lemma baseline on a subtopic level, thus, indicating
a more complex task for a CDCR model.

Table 3: Quantitative comparison of ECB+ and NewsWCL50. The values marked with a star (*) are calculated for the versions of the datasets without singletons.  Criteria | ECB+ | NewsWCL50
---|---|---
# topics | 43 | 10
# subtopics | 86 | 10
# articles | 982 | 50
# mentions | 15 122 | 5 696
# chains | 4 965 | 171
# singletons | 3006 | 11
average chain size* | 7.2 | 33.4
average # unique lemmas* | 3.2 | 12.0
Phrasing diversity (PD)* | 1.3 | 7.4
F1CoNLL* | 64.4 | 49.9

##  4 Discussion

In our quantitative and qualitative analysis, ECB+ showed the lower average
size of coreference chains and lower lexical diversity measured by all three
metrics, e.g., $F1_{CoNLL}$ on a primitive CDCR method, number of unique
lemmas of phrases’ heads, and phrasing diversity metric (PD). NewsWCL50 shows
that annotating both identity, synonym, metonymy/meronymy, bridging and
subject-predicate coreference relations yields an increase of the lexical
diversity in the annotated chains (see Table 3). Consequently, the increased
lexical diversity results in a higher level of semantic complexity and
abstractness in the annotated coreferential chains, i.e., resolution of some
mentions requires an understanding of the context in which they appear. The
increase in the lexical diversity and in the level of abstractness of
coreference chains poses a new challenge to the established CDCR models.

Although ECB+ annotates narrowly-defined coreference chains with smaller
lexical diversity on a subtopic level, ECB+ creates a lexical ambiguity
challenge, i.e., CDCR models need to resolve mentions on the mixed documents
of two subtopics, which contain verbs that refer to different events Cybulska
and Vossen (2014b); Upadhyay et al. (2016); Cattan et al. (2021). Therefore,
ECB+ and NewsWCL50 establish two diverse CDCR tasks: a lexical ambiguity
challenge and a high lexical diversity challenge.

This diversity of the annotation schemes supports the conclusion of Bugert et
al. (2021) to evaluate CDCR models on multiple CDCR datasets. Bugert et al.
(2021) evaluated the state-of-the-art CDCR models on multiple event-centric
datasets and reported their unstable performance across these datasets. The
authors suggested evaluating every CDCR model on four event-centric datasets
and report the performance on a single-document, within-subtopic, and within-
topic levels.

For further CDCR evaluation, we see a need to evaluate CDCR models on the two
challenges: lexical ambiguity and lexical diversity. Evaluation should consist
not only of multiple event-centric datasets but also include NewsWCL50, which
focuses on the loose context-specific coreference relations, and an additional
concept-centric dataset with identity coreference relations. Such a setup with
diverse CDCR datasets will facilitate the fair and comparable evaluation of
coreferential chains of various natures. Annotation of a large silver-quality
CDCR dataset with multiple diverse annotation layers is a solution towards
robust CDCR models Eirew et al. (2021).

##  5 Conclusion

CDCR research has a long history of focusing on the resolution of mentions
annotated in an event-centric way, i.e., the occurrence of events trigger
annotating mentions of events and entities as their attributes. We compared a
state-of-the-art event-centric CDCR dataset, i.e., ECB+, to a concept-centric
NewsWCL50 dataset that explored the identification of high variance in news
articles as a CDCR task. The reviewed CDCR datasets reveal a large scope of
relations that define coreferential anaphora, i.e, from strict identity in
ECB+ to mixed identity and bridging of coreference relations in NewsWCL50.

We proposed a phrasing diversity metric (PD) that enabled a more fine-grained
comparison of lexical diversity in coreference chains compared to the average
number of unique lemmas. PD of NewsWCL50 is 5.7 times higher than ECB+. Such a
high prevalence in lexical diversity in NewsWCL50 rises a new challenge in the
CDCR research.

To ensure CDCR can robustly handle data variations on the lexical
disambiguation challenge, Bugert et al. (2021) proposed evaluating CDCR models
on three event-centric datasets on multiple levels of coreference resolution,
i.e., a document, subtopic, and topic levels. We propose to create an
additional CDCR challenge, i.e., lexical diversity challenge, and include CDCR
datasets that annotate coreference chains with high lexical variance chains,
e.g., NewsWCL50.

## References

  * Linguistic Data Consortium et al. (2005) Linguistic Data Consortium et al. 2005.  ACE (automatic content extraction) english annotation guidelines for events. version 5.4. 3.  _ACE_.
  * Bejan and Harabagiu (2010) Cosmin Adrian Bejan and Sanda Harabagiu. 2010.  Unsupervised event coreference resolution with rich linguistic features.  In _Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics_ , pages 1412–1422.
  * Bugert et al. (2020) Michael Bugert, Nils Reimers, Shany Barhom, Ido Dagan, and Iryna Gurevych. 2020\.  Breaking the subtopic barrier in cross-document event coreference resolution.  In _Proceedings of Text2Story - Third Workshop on Narrative Extraction From Texts co-located with 42nd European Conference on Information Retrieval, Text2Story@ECIR 2020, Lisbon, Portugal, April 14th, 2020 [online only]_ , volume 2593 of _CEUR Workshop Proceedings_ , pages 23–29. CEUR-WS.org.
  * Bugert et al. (2021) Michael Bugert, Nils Reimers, and Iryna Gurevych. 2021.  Generalizing cross-document event coreference resolution across multiple corpora.  _Computational Linguistics_ , pages 1–43.
  * Byrt et al. (1993) Ted Byrt, Janet Bishop, and John B. Carlin. 1993.  Bias, prevalence and kappa.  _Journal of Clinical Epidemiology_ , 46(5):423–429.
  * Cattan et al. (2021) Arie Cattan, Alon Eirew, Gabriel Stanovsky, Mandar Joshi, and Ido Dagan. 2021.  Realistic evaluation principles for cross-document coreference resolution.  In _Proceedings of *SEM 2021: The Tenth Joint Conference on Lexical and Computational Semantics_ , pages 143–151, Online. Association for Computational Linguistics.
  * Cybulska and Vossen (2014a) Agata Cybulska and Piek Vossen. 2014a.  Guidelines for ECB+ annotation of events and their coreference.  Technical report, Technical Report NWR-2014-1, VU University Amsterdam.
  * Cybulska and Vossen (2014b) Agata Cybulska and Piek Vossen. 2014b.  Using a sledgehammer to crack a nut? lexical diversity and event coreference resolution.  In _Proceedings of the Ninth International Conference on Language Resources and Evaluation (LREC’14)_ , pages 4545–4552, Reykjavik, Iceland. European Language Resources Association (ELRA).
  * Eirew et al. (2021) Alon Eirew, Arie Cattan, and Ido Dagan. 2021.  WEC: Deriving a large-scale cross-document event coreference dataset from Wikipedia.  In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 2498–2510, Online. Association for Computational Linguistics.
  * Hamborg (2019) Felix Hamborg. 2019.  Codebook: Bias by word choice and labeling.  Technical report, Technical report, University of Konstanz.
  * Hamborg et al. (2019) Felix Hamborg, Anastasia Zhukova, and Bela Gipp. 2019.  Automated identification of media bias by word choice and labeling in news articles.  In _Proceedings of the ACM/IEEE Joint Conference on Digital Libraries (JCDL)_.
  * Hasler et al. (2006) Laura Hasler, Constantin Orasan, and Karin Naumann. 2006.  NPs for events: Experiments in coreference annotation.  In _LREC_ , pages 1167–1172. Citeseer.
  * Hong et al. (2016) Yu Hong, Tongtao Zhang, Tim O’Gorman, Sharone Horowit-Hendler, Heng Ji, and Martha Palmer. 2016.  Building a cross-document event-event relation corpus.  In _Proceedings of the 10th Linguistic Annotation Workshop held in conjunction with ACL 2016 (LAW-X 2016)_ , pages 1–6, Berlin, Germany. Association for Computational Linguistics.
  * Hou et al. (2018) Yufang Hou, Katja Markert, and Michael Strube. 2018.  Unrestricted Bridging Resolution.  _Computational Linguistics_ , 44(2):237–284.
  * Kobayashi and Ng (2020) Hideo Kobayashi and Vincent Ng. 2020.  Bridging resolution: A survey of the state of the art.  In _Proceedings of the 28th International Conference on Computational Linguistics_ , pages 3708–3721, Barcelona, Spain (Online). International Committee on Computational Linguistics.
  * Linguistic Data Consortium et al. (2008) Linguistic Data Consortium et al. 2008.  ACE (automatic content extraction) english annotation guidelines for entities.  Technical report, Technical report, Linguistic Data Consortium.
  * Minard et al. (2016) Anne-Lyse Minard, Manuela Speranza, Ruben Urizar, Begoña Altuna, Marieke van Erp, Anneleen Schoen, and Chantal van Son. 2016.  MEANTIME, the NewsReader multilingual event and time corpus.  In _Proceedings of the Tenth International Conference on Language Resources and Evaluation (LREC’16)_ , pages 4417–4422, Portorož, Slovenia. European Language Resources Association (ELRA).
  * Mitamura et al. (2015) Teruko Mitamura, Zhengzhong Liu, and Eduard Hovy. 2015.  Overview of TAC KBP 2015 event nugget track.  In _TAC_.
  * Mitamura et al. (2017) Teruko Mitamura, Zhengzhong Liu, and Eduard H Hovy. 2017.  Events detection, coreference and sequencing: What’s next? overview of the TAC KBP 2017 event track.  In _TAC_.
  * O’Gorman et al. (2016) Tim O’Gorman, Kristin Wright-Bettner, and Martha Palmer. 2016.  Richer event description: Integrating event coreference with temporal, causal and bridging annotation.  In _Proceedings of the 2nd Workshop on Computing News Storylines (CNS 2016)_ , pages 47–56, Austin, Texas. Association for Computational Linguistics.
  * Poesio and Artstein (2008) Massimo Poesio and Ron Artstein. 2008.  Anaphoric annotation in the ARRAU corpus.  In _Proceedings of the Sixth International Conference on Language Resources and Evaluation (LREC’08)_ , Marrakech, Morocco. European Language Resources Association (ELRA).
  * Poesio and Vieira (1998) Massimo Poesio and Renata Vieira. 1998.  A corpus-based investigation of definite description use.  _Comput. Linguist._ , 24(2):183–216.
  * Pradhan et al. (2012) Sameer Pradhan, Alessandro Moschitti, Nianwen Xue, Olga Uryupina, and Yuchen Zhang. 2012.  CoNLL-2012 shared task: Modeling multilingual unrestricted coreference in OntoNotes.  In _Joint Conference on EMNLP and CoNLL - Shared Task_ , pages 1–40, Jeju Island, Korea. Association for Computational Linguistics.
  * Recasens et al. (2010a) Marta Recasens, Eduard Hovy, and M. Antònia Martí. 2010a.  A typology of near-identity relations for coreference (NIDENT).  In _Proceedings of the Seventh International Conference on Language Resources and Evaluation (LREC’10)_ , Valletta, Malta. European Language Resources Association (ELRA).
  * Recasens et al. (2010b) Marta Recasens, Eduard Hovy, and M Antònia Martí. 2010b.  A typology of near-identity relations for coreference (NIDENT).  In _Proceedings of the Seventh International Conference on Language Resources and Evaluation (LREC’10)_.
  * Recasens et al. (2012) Marta Recasens, M. Antònia Martí, and Constantin Orasan. 2012.  Annotating near-identity from coreference disagreements.  In _Proceedings of the Eighth International Conference on Language Resources and Evaluation (LREC’12)_ , pages 165–172, Istanbul, Turkey. European Language Resources Association (ELRA).
  * Rösiger (2018) Ina Rösiger. 2018.  BASHI: A corpus of Wall Street Journal articles annotated with bridging links.  In _Proceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018)_ , Miyazaki, Japan. European Language Resources Association (ELRA).
  * Singh et al. (2019) Sandhya Singh, Krishnanjan Bhattacharjee, Hemant Darbari, and Seema Verma. 2019\.  Analyzing coreference tools for NLP application.  _International Journal of Computer Sciences and Engineering_ , 7:608–615.
  * Spala et al. (2019) Sasha Spala, Nicholas A. Miller, Yiming Yang, Franck Dernoncourt, and Carl Dockhorn. 2019.  DEFT: A corpus for definition extraction in free- and semi-structured text.  In _Proceedings of the 13th Linguistic Annotation Workshop_ , pages 124–131, Florence, Italy. Association for Computational Linguistics.
  * Upadhyay et al. (2016) Shyam Upadhyay, Nitish Gupta, Christos Christodoulopoulos, and Dan Roth. 2016.  Revisiting the evaluation for cross document event coreference.  In _Proceedings of COLING 2016, the 26th International Conference on Computational Linguistics: Technical Papers_ , pages 1949–1958, Osaka, Japan. The COLING 2016 Organizing Committee.
  * Vossen et al. (2018) Piek Vossen, Filip Ilievski, Marten Postma, and Roxane Segers. 2018.  Don’t annotate, but validate: a data-to-text method for capturing event data.  In _Proceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018)_ , Miyazaki, Japan. European Language Resources Association (ELRA).
  * Weischedel et al. (2011) Ralph Weischedel, Sameer Pradhan, Lance Ramshaw, Martha Palmer, Nianwen Xue, Mitchell Marcus, Ann Taylor, Craig Greenberg, Eduard Hovy, Robert Belvin, et al. 2011.  OntoNotes release 4.0.  _LDC2011T03, Philadelphia, Penn.: Linguistic Data Consortium_.
  * Zeldes (2017) Amir Zeldes. 2017.  The gum corpus: Creating multilayer resources in the classroom.  _Lang. Resour. Eval._ , 51(3):581–612.


∎

11institutetext: Department of Computer Applications, National Institute of
Technology, Kurukshetra, Haryana, INDIA
11email<EMAIL_ADDRESS>
11email<EMAIL_ADDRESS>
This article has been accepted in Springer Multimedia Tools and Applications
Journal $\copyright$ 2022 Springer Nature. Personal use of this material is
permitted. Permission from Springer must be obtained for all other uses in any
current or future media, including reprinting/republishing this material for
advertising or promotional purposes, creating new collective works, for resale
or redistribution to servers or lists, or reuse of any copyrighted component
of this work in other works. This work is freely available for survey and
citation.

# A Privacy-Preserving Model based on Differential Approach for Sensitive Data
in Cloud Environment

Ashutosh Kumar Singh  Rishabh Gupta  Ashutosh Kumar Singh  Rishabh Gupta

###### Abstract

A large amount of data and applications need to be shared with various parties
and stakeholders in the cloud environment for storage, computation, and data
utilization. Since a third party operates the cloud platform, owners cannot
fully trust this environment. However, it has become a challenge to ensure
privacy preservation when sharing data effectively among different parties.
This paper proposes a novel model that partitions data into sensitive and non-
sensitive parts, injects the noise into sensitive data, and performs
classification tasks using k-anonymization, differential privacy, and machine
learning approaches. It allows multiple owners to share their data in the
cloud environment for various purposes. The model specifies communication
protocol among involved multiple untrusted parties to process owners’ data.
The proposed model preserves actual data by providing a robust mechanism. The
experiments are performed over Heart Disease, Arrhythmia, Hepatitis, Indian-
liver-patient, and Framingham datasets for Support Vector Machine, K-Nearest
Neighbor, Random Forest, Naive Bayes, and Artificial Neural Network
classifiers to compute the efficiency in terms of accuracy, precision, recall,
and F1-score of the proposed model. The achieved results provide high
accuracy, precision, recall, and F1-score up to 93.75%, 94.11%, 100%, and
87.99% and improvement up to 16%, 29%, 12%, and 11%, respectively, compared to
previous works.

###### Keywords:

Machine learning Cloud computing Differential privacy Laplace distribution
k-anonymity

##  1 Introduction

Data storage, computation, utilization, analysis, and sharing are the vital
required services for any organization to improve performance R1 . Numerous
applications and data are shifting from the local to the cloud due to various
benefits such as minimum cost, maximum efficiency, and high scalability R2 .
Sensitive sample data also are shared with the cloud or other parties for
distinguish services R30 . However, users hesitate to share data with the
cloud for computation and storage since a third party manages it R31 , and
data may be misused as well as owners lose control of their data R3  R4 . The
cloud may also provide outsourced data to other entities for different
purposes R5 . Due to these reasons, data protection has become a critical
challenge for any organization. Therefore, there is a need for a mechanism
that can protect sensitive data. For this, the different kind of techniques,
such as cryptography, differential privacy, k-anonymity, etc., are used to
preserve the data for privacy reasons before transferring it to the cloud
platforms R6  R7 .

To address the aforementioned challenges, we propose a novel Privacy-
Preserving Model based on Differential approach (PPMD) for sensitive data in
the cloud environment. In the proposed model, owners partition their data into
sensitive & non-sensitive R21 -R23 , and different statistical noise is
injected into sensitive data according to various applications and owner’s
queries R24 -R26 . Differential privacy protection is considered on the
owner’s side because they do not want to share actual data. The resulted data
is uploaded to the cloud platform, and classification services are provided
R27 . The machine learning algorithms are applied over resulted data for
classification. The cloud platform obtains classified data from the
classification model and sends it to the data owner rather than other parties.
Fig. 1 presents a bird-eye view of the proposed work and highlights our
consecutive contributions to preserve data privacy and perform classification
tasks in the cloud environment. The summary of the main contributions of PPMD
are as follows:

  * $\bullet$

PPMD allows various data owners to share outsourced data securely. To protect
data against stealing or leakage, noise is injected, and noise-added data is
shared.

  * $\bullet$

PPMD uses the cloud platform for storage, computation, and performing
classification tasks over collected data from multiple owners. All entities
are considered to be untrusted to protect data with enhanced privacy.

  * $\bullet$

PPMD maintains the degree of accuracy because of the data partition into
sensitive & non-sensitive parts and statistical noise addition.

  * $\bullet$

A series of experiments are conducted using the distinct dataset to validate
the practicality of the proposed model. Besides, the comparisons are performed
among the various a) datasets, b) classifiers, and c) distinctly preprocessed
data using differential privacy and with the state-of-the-art works to prove
the superiority of PPMD.

Figure 1: Bird eye view of the proposed work

Organization: The rest of this paper proceeds as follows. Section 2 describes
the related work. In Section 3, we present the proposed model PPMD, and the
process of data partition is shown in Section 4. The data classification steps
are defined in Section 5. Section 6 shows the implementation and evaluates the
results of the experiment with statistical analysis. Finally, a conclusion and
the direction of the future work are described in Section 7. The list of
notations with their definitions is shown in Table 1 used in this paper.

Table 1: List of Terminologies with their Explanatory Terms $DO_{id}$: | Data Owners |  $CSP$: | Cloud Service Provider
---|---|---|---
$P_{id}$: | Patients |  $D_{i}$: | Actual data
$N_{i}$: | Noise |  $CM$: | Classification Model
$D_{i}^{S}$: | Sensitive data |  $CA$: | Classification Accuracy
$D_{i}^{NS}$: | Non-sensitive data |  $P$: | Precision
$\bar{D}_{i}^{S}$: | Noise-added data |  $\hat{D_{i}}$: | Preprocessed data
$R$: | Recall |  $\hat{D}_{t^{{}^{\prime}}}$: | Training data
$\hat{D}_{t^{{}^{\prime\prime}}}$: | Testing data |  $FS$: | F1-score
$A_{i}$: | Data attribute | $s^{{}^{\prime}}$ | Scaling parameter
$\mu$: | Mean |  $\sigma$: | Standard deviation
$\epsilon$: | Privacy budget |  $n^{*}$: | Count of classes
$n$: | Number of data objects |  $L$: | Label item
$C$: | Object category |  |

##  2 Related work

Yuan and Yu R8  proposed a secure, efficient, and accurate multiparty Back-
Propagation Neural (BPN) network-based scheme that allowed two or more
parties, each having an arbitrarily partitioned data set, to conduct the
learning collaboratively. But, this scheme focused on facilitating data
processing without considering the algorithm efficiency. Yonetani et al. R9
proposed a doubly permuted homomorphic encryption (DPHE) based privacy-
preserving framework. It enabled multiparty protected scalar products with a
reduction of the high computational cost. However, DPHE supports either
addition or multiplications at a particular time. A system that utilizes
additively homomorphic encryption to protect the gradients against the curious
server is presented in R10 . This system achieved identical accuracy to a
corresponding deep learning system, i.e., asynchronous stochastic gradient
descent (ASGD) trained over the common dataset of all participants. All
classifiers from multiple parties are trained over the single-source domain in
this scheme, but the trade-off is a lower accuracy rate. To provide the
privacy-preserving classification service for users, Li et al. R11  proposed a
scheme for a classifier owner to delegate a remote server. But during the
launch of a classification query, user interactions were often involved in
this scheme. Li et al. R12  proposed a data protection scheme that enables a
trainer to train a Naive Bayes classifier over the dataset provided jointly by
the different data owners. To preserve the privacy of the data,
$\epsilon$-differential privacy is utilized. But, adversaries still have the
ability to forge and manipulate the data in this scheme. Ma et al. R13
proposed a privacy-preserving deep learning model, namely PDLM, to train the
model over the encrypted data under multiple keys. A privacy-preserving
calculation toolkit was adopted to train the model based on stochastic
gradient descent (SGD) in a privacy-preserving manner. The model reduced the
storage overhead, but the classification accuracy is less, and the computation
cost is high. Li et al. R14  proposed a privacy-preserving machine learning
with multiple data provider (PMLM) scheme with improved computational
efficiency and data analysis accuracy. The authors used public-key encryption
with a double decryption algorithm (DD-PKE) and $\epsilon$-differential
privacy. But the scheme suffered from less accuracy as well as less data
sharing. To protect the confidentiality of sensitive data without leakage, a
privacy-conserving outsourced classification in cloud computing (POCC)
framework was introduced R15  under various public keys using a fully
homomorphic encryption proxy technique. However, data owners and storage
servers are deemed to be in the same trustworthy domain that no longer exists
in the cloud environment. Gao et al. R16  proposed a scheme to avoid
information leakage under the substitution-then-comparison (STC) attack. A
privacy-preserving classification mechanism was designed by adopting a double-
blinding technique for Naive Bayes, and both the communication and computation
overhead was reduced. But this scheme is unable to obtain the discovery of
truth that protects privacy. To apply the deep neural network algorithms over
the encrypted data, Hesamifard et al. R17  revert a neural networking-based
framework named CryptoDL while considering the existing limitations of
homomorphic encryption schemes. Although the approach works well to secure
private data, but the data is protected using a key that is not feasible.
Phong and Phuong R18  constructed a privacy-preserving system, namely the
server-aided network topology (SNT) system, and the fully-connected network
topology (FNT) system, depending on the connection with SNT and FNT server. In
these systems, multiple machine-learning trainers can use the SGD or its
variants over the combined dataset without sharing the local dataset of each
trainer. The constructed systems used the weight parameters rather than the
gradient parameters and achieved an accuracy similar to SGD. Wei et al. R29
proposed a framework, namely, noising before model aggregation federated
learning (NbAFL), which prevents the information leakage effectively. The
client’s data is protected by using a differential privacy mechanism. However,
this framework requires a large amount of noise to add and sacrificing mode
utility. Gupta et al. R19  proposed a machine learning and probabilistic
analysis-based model, namely MLPAM. It supports multiple participants to share
their data safely for different purposes by using encryption, machine
learning, and probabilistic approaches. The proposed model provided a
mechanism that reduced the risk associated with the leakage for prevention
coupled with detection. The experimental results showed that the proposed
model ensured high accuracy and precision. A summary of the literature review
is depicted in Table 2.

Table 2: Tabular sketch of the literature review

Model/Scheme /Framework |  Workflow & Implementation |  Outcomes |  Drawback
---|---|---|---
A secured scheme for processing ciphered text R8  |  • The arbitrarily partitioned data is encrypted using a doubly homomorphic encryption scheme • Experiments are per-formed on the Amazon EC2 cloud |  • Security analysis proves that this scheme is secure, scalable, and efficient • Less error rates |  High computation and communication complexity
A privacy-preserving framework for visual learning R9  |  • A homomorphic cryptosystem is used to update high-dimensional classifiers • The experiments are performed on the CelebA and Life-logging datasets |  • Achieve 84% accuracy by performing facial recognition tasks • Minimize the computational cost of homomorphic encryption |  Does not assist the multiple operations (addition or multiplication)
A secure deep learning system for parameters protection R10  |  • The homomorphic encryption and asynchronous stochastic gradient are adopted to encrypt trained parameters • The Adam optimizer is used for training with input learning rate $10^{−4}$ |  • More effective in protecting sensitive information from the curious server • Achieve the same accuracy as that of the centralized DL algorithm |  The local data can still be surreptitiously extracted from two adjacent versions of parameters
A secure outsourcing scheme for the classification service R11  |  • The additive homomorphic encryption technique is used to protect the data • The experiments are conducted on the LAN server |  • More practical and less communication cost |  Only support a single-party setting
A privacy-preserving scheme for learning algorithms R12  |  • The differential privacy mechanism was used to protect the data • The LAN server was used to conduct the experiments |  • Achieve data privacy will not break while the training data • Less computational time requires for training |  Paillier cryptosystem can only work with integers
A privacy preserving deep learning model to train over the encrypted data R13  |  • The model is trained based on stochastic gradient descent, the feed-forward, and a back-propagation procedure • The experiments were conducted over MNIST, CIFAR-10 datasets |  • Minimize the storage overhead • Errors are calculated to evaluate the performance of the model |  Low efficiency utilizing the distributed two trapdoors public-key cryptosystem
A privacy-preserving machine learning scheme for data protection R14  |  • A double encryption algorithm and differential privacy mechanism was used to preserve data privacy • MAGMA programming is used to perform the cryptosystem |  • Enhance the computational efficiency and data analysis accuracy • The security analysis proves that the model is more secure |  High computational cost due to the dependence on integer factorization
A privacy-preserving outsourced classification framework for confidentiality of sensitive data R15  |  • A fully homomorphic encryption proxy technique is utilized to encrypt data • The naive bayes classifier is performed over multiple datasets for experiment work |  • Reduce power consumption by cloud clusters • Less computational overhead |  The data is encrypted with a single key, and it is not suitable for multi-user systems
A privacy-preserving Naive Bayes classifier scheme to prevent information leakage R16  |  • A double-blinding technique is used to avoid the attacks • The GNU Multi-Precision library and the OpenSSL library are used for programming |  • Reduce the computation cost because of not using fully homomorphic encryptions • More efficient due to offline phase of server |  Not suitable for the multi-label dataset
A CryptoDL framework for applying deep neural network algorithms over encrypted data R17  |  • The polynomial approximation is used for continuous activation functions • The experiments are conducted on MNIST and CIFAR-10 datasets |  • Perform proper privacy-preserving training and classification tasks • The security model proves that the server cannot access the input data |  High computation cost and less accuracy
A privacy-preserving deep learning model for input privacy R18  |  • The input data is protected through symmetric encryption • A multilayer perceptron and a convolutional neural network are used for experiments |  • Achieve the same learning accuracy as SGD • The security analysis proves that no training information will be revealed using the weight parameters |  To update weight causes low efficiency and no consideration for output privacy
A privacy-preserving framework for data protection R29  |  • To preserve privacy of data, the Gaussian noise is added to it • The experiments are performed on the MNIST dataset using multi-layer perception |  • Maintain a privacy level with a low-performance loss • Achieve high level privacy-preserving and secure capabilities |  Noise inevitably reduces the accuracy
A machine learning and probabilistic analysis-based model for secure sharing data R19  |  • The differential privacy, encryption, machine learning, and probabilistic approaches are used to encrypt, noise addition, and share the data of multiple participants • The SVM, Random Forest, KNN, and Naive Bayes classifiers train the model on Glass, Iris, Wine, and Balance Scale datasets |  • Minimize the risk affiliated with the leakage for prevention and detection • Achieve high accuracy and precision up to 97% and 100% |  Does not provide efficient data sharing and management in multiple environments

The major limitations of the existing works are that the models injected the
noise into entire data and/or protected it using various encryption approaches
followed by machine learning-based classification, which reduced accuracy
and/or increased computation cost. The earlier models considered a single
owner and/or a single untrusted entity. Unlike the previous works, PPMD
partitions the data using k-anonymization, injecting the noise into the
sensitive part of data to make it private and applying various state-of-art
classifiers. It also permits multiple owners to share outsourced data securely
while treating all participating entities involved as untrustworthy.

##  3 Proposed model

The proposed model architecture, named PPMD (Fig. 2), comprises the involved
entities and their communication with essential flows.

Figure 2: Proposed PPMD architecture

This architecture contains two entities Data Owners ($DO_{id}$) and Cloud
Service Provider ($CSP$) which are described as follow:

  1. 1)

$DO_{id}$: An entity that generates data and requests to $CSP$ for services.
$DO_{id}$ sends sensitive/non-sensitive data, but noise is added into
sensitive data before transferring it to $CSP$. $DO_{id}$ applies
$\epsilon$-differential privacy to protect sensitive data. Since it is assumed
that $DO_{id}$ can’t leak its data but may leak other owners’ data. Therefore,
$DO_{id}$ is considered an untrusted entity.

  2. 2)

$CSP$: An entity that gathers all data from $DO_{id}$ and provides facilities
of storage and computation. It offers classification services to $DO_{id}$
through the classification model (CM). It trains CM using machine learning
algorithms over collected data and accesses classified data from CM. These
obtained results are shared among $DO_{id}$. In PPMD, $CSP$ is treated as a
semi-trusted entity, as it strictly follows the protocol but is curious to
learn the information.

Let the data owners $DO_{id}$ = {$DO_{1}$, $DO_{2}$, $\dots$, $DO_{n}$} has
data $D$ = {$D_{1}$, $D_{2}$, $\dots$, $D_{n}$}, where the data object
$D_{i}\in\textit{D}$ is independent and can be of any type and size. $DO_{id}$
needs to share $D$ with the semi-trusted party like $CSP$ for storage,
computation, and performance enhancement. But, $DO_{id}$ can’t share $D$
because it contains sensitive data also. Therefore, before sharing, $DO_{id}$
partitions his data into sensitive data $D^{S}$ and non-sensitive data
$D^{NS}$ using the k-anonymization mechanism. In order to make $D^{S}$
private, {$DO_{1}$, $DO_{2}$, $\dots$, $DO_{n}$} procure noisy data
$\bar{D}^{S}$ = {$\bar{D}_{1}^{S},\bar{D}_{2}^{S},$…$,\bar{D}_{n}^{S}$} by
adding noise $N$ = {$N_{1}$, $N_{2}$, $\dots$, $N_{n}$} into $D^{S}$ =
{$D_{1}^{S}$, $D_{2}^{S}$, $\dots$, $D_{n}^{S}$} using the
$\epsilon$-differential privacy. $DO_{id}$ has noise-added data $\bar{D}^{S}$
& non-sensitive data $D^{NS}$ that are combined, and sanitized data
$\hat{D}=\\{\hat{D}_{t,1},\hat{D}_{t,2},\dots,\hat{D}_{t,n}\\}$ is obtained.
$DO_{id}$ sends $\hat{D}$ to $CSP$ that performs the classification tasks over
it to make a fit CM. Any query can be made by $DO_{1}$, $DO_{2}$, $\dots$,
$DO_{n}$ to $CSP$. The results of these queries are received by $CSP$ from CM,
and sent to the corresponding entity $DO_{1}$, $DO_{2}$, $\dots$, $DO_{n}$.
Algorithm 1 shows the operational summary of the proposed model. Initially,
data $D_{i}$ is divided into $D_{i}^{S}$ and $D_{i}^{NS}$. Afterward, noise
vector $N_{i}$ is generated and performed the addition operation on
$D_{i}^{S}$ and $N_{i}$. The classification operation is carried out over
noisy & non-sensitive data using the machine learning algorithms, and unknown
class labels are obtained from CM. The accuracy, precision, recall, and
F1-score are calculated using these class labels.

Input: Actual data $D$, Sensitive data $D^{S}$, Non-sensitive data $D^{NS}$,
Noise vector $N$, input vector $\hat{D}$

Output: $CA$, $P$, $R$, and $FS$

1 Initialize data $D$ := {$D_{1}$, $D_{2}$, $\dots$, $D_{n}$}, $\bar{D}^{S}$
:= {$\bar{D}_{1}^{S}$, $\bar{D}_{2}^{S}$, $\dots$, $\bar{D}_{n}^{S}$}, $N$ :=
{$N_{1}$, $N_{2}$, $\dots$, $N_{n}$}

2 for $i$ = $1$, $2$, $\dots$, $n$ do

3 Data_Partition ($D_{i}$)

4 $N_{i}$ = Lap(0,1)

5 $\bar{D}_{i}^{S}$ = $D_{i}^{S}$ \+ $N_{i}$

6 $\hat{D}_{i}$ = ($\bar{D}_{i}^{S}$, $D_{i}^{NS}$)

7 Data_Classification ($\hat{D}_{i}$)

8 end for

9 $CA$ = (#$Correctly$ $classified$ $sample$ / #$test$ $sample$) * 100

10 $P$ = $(TP)/(TP+FP)$

11 $R$ = $(TP)/(TP+FN)$

$FS$ = $2*(P*R)/(P+R)$

Algorithm 1 PPMD model operational summary

##  4 Data partition & noise addition

In PPMD, $DO_{id}$ = {$DO_{1}$, $DO_{2}$, $\dots$, $DO_{n}$} has data $D$ =
{$D_{1}$, $D_{2}$, $\dots$, $D_{n}$} in the form of relation, $D_{1}$,
$D_{2}$, $\dots$, $D_{n}$ has attributes $\\{A_{1}$, $A_{2}$, $\dots$,
$A_{t_{1}}\\}$, $\\{A_{1}$, $A_{2}$, $\dots$, $A_{t_{2}}\\}$, $\dots$,
$\\{A_{1}$, $A_{2}$, $\dots$, $A_{t_{n}}\\}$. These relations {$D_{1}$,
$D_{2}$, $\dots$, $D_{n}$} are partitioned into two relations sensitive and
non-sensitive based on row-level data sensitivity of using k-anonymization
approach by applying Eq. (1) and (2). The Algorithm 2 presents the partition
of data $D_{1}$ into $D_{1}^{S}$ = {$A_{1}$, $A_{2}$, $\dots$, $A_{t_{1}-p}$}
and $D_{1}^{NS}$ = {$A_{t_{1}-p+1}$, $A_{t_{1}-p+2}$, $\dots$, $A_{t_{1}}$},
$D_{2}$ is partitioned into $D_{2}^{S}$ = {$A_{1}$, $A_{2}$, $\dots$,
$A_{t_{2}-q}$} and $D_{2}^{NS}$ = {$A_{t_{2}-q+1}$, $A_{t_{2}-q+2}$, $\dots$,
$A_{t_{2}}$}, $\dots$, $D_{n}$ is partitioned into $D_{n}^{S}$ = {$A_{1}$,
$A_{2}$, $\dots$, $A_{t_{n}-r}$} and $D_{n}^{NS}$ = {$A_{t_{n}-r+1}$,
$A_{t_{n}-r+2}$, $\dots$, $A_{t_{n}}$} respectively, where $p,q,r,s\in Z$.

$D_{i}^{S}=\prod_{(A_{1},A_{2},\dots,A_{t_{i}-s})}\left(D_{i}\right)$ (1)

$D_{i}^{NS}=\prod_{(A_{t_{i}-s+1},A_{t_{i}-s+2},\dots,A_{t_{i}})}\left(D_{i}\right)$
(2)

1

Input: Actual data $D$ with $\ddot{n}$ records, the value of $\ddot{k}$ for
k-anonymity

Output: Sensitive data $D^{S}$, Non-sensitive data $D^{NS}$

2 Initialize data $D$ := {$D_{1}$, $D_{2}$, $\dots$, $D_{n}$}, $D^{S}$ :=
{$D_{1}^{S}$, $D_{2}^{S}$, $\dots$, $D_{n}^{S}$}, $D^{NS}$ := {$D_{1}^{NS}$,
$D_{2}^{NS}$, $\dots$, $D_{n}^{NS}$}

3 Set $\ddot{p}$ = $\left\lfloor\frac{\ddot{n}}{\ddot{k}}\right\rfloor$

4

5for $i$ = $1$, $2$, $\dots$, $n$ do

6 for $\ddot{e}$ = $1$, $\dots$, $\ddot{p}$ do

7 Randomly select distinct records $r_{\ddot{e}}$ $\in$ $D_{i}$

8 while ($D_{i}$ $\neq$ $\phi$) do

9 Add the records $r_{\ddot{e}}$ to $D_{i}^{S}$

10 $D_{i}^{NS}$ = $D_{i}$ $\setminus$ {$r_{\ddot{e}}$}

11 end while

12 end for

13 return $D_{i}^{S}$, $D_{i}^{NS}$

14 end for

Algorithm 2 Data Partition

Table 3: Patients Report Age | Gender | TB | DB | ALG | Disease
---|---|---|---|---|---
65 | Male | 0.7 | 0.1 | 3.3 | 1
62 | Female | 10.9 | 5.5 | 0.2 | 0
68 | Female | 7.3 | 4.1 | 3.3 | 1
58 | Male | 3.9 | 2.0 | 0.4 | 1
72 | Female | 3.2 | 3.7 | 3.4 | 0
46 | Male | 6.4 | 1.0 | 2.2 | 1
⋮ | ⋮ | ⋮ | ⋮ | ⋮ | ⋮
34 | Female | 4.6 | 2.4 | 3.1 | 1

Table 4: Patients Report1 (Sensitive) Age | Gender
---|---
65 | Male
62 | Female
68 | Female
58 | Male
72 | Female
46 | Male
⋮ | ⋮
34 | Female

Table 5: Patients Report2 (Non-sensitive) TB | DB | ALG | Disease
---|---|---|---
0.7 | 0.1 | 3.3 | 1
10.9 | 5.5 | 0.2 | 0
7.3 | 4.1 | 3.3 | 1
3.9 | 2.0 | 0.4 | 1
3.2 | 3.7 | 3.4 | 0
6.4 | 1.0 | 2.2 | 1
⋮ | ⋮ | ⋮ | ⋮
4.6 | 2.4 | 3.1 | 1

For instance, let the proposed PPMD model consist of fifty patients $P_{id}$ =
{$P_{1}$, $P_{2}$, $\dots$, $P_{50}$} having data $D$ = {$D_{1}$, $D_{2}$,
$\dots$, $D_{50}$} in the vector form {$x_{\ddot{i}}$,$y_{\ddot{i}}$}, shown
in Table 3, which contains both sensitive and non-sensitive data. Therefore,
we need to separate the Patients Report into two relations $a)$ Patients
Report1 with attributes Age & Gender, and $b)$ Patient Report2 with attributes
TB, DB, ALG, and Disease, correspondingly shown in Tables 4 and 5. In this
way, diseases can’t be recognized without knowing Age and Gender.

To preserve the privacy of sensitive data, noise is inserted into the tuples
of Patients Report1 using differential privacy before transferring to the
cloud platform. But, Patients Report2 is outsourced to the same cloud platform
without performing any operation. $DO_{id}$ generates a noise vector $N$ =
{$N_{1}$, $N_{2}$, $\dots$, $N_{n}$} using the probability density function,
and distribution function using Eq. (3).

$N=\frac{1}{2s^{{}^{\prime}}}\cdot(exp(\frac{-|rn|}{s^{{}^{\prime}}}))$ (3)

where $rn$ is input, $s^{{}^{\prime}}$ is the scale parameter, and $N$ is a
noise vector, which is drawn from the Laplacian distribution with scale
$s^{{}^{\prime}}$. The generated noise vector $N$ is added in the
corresponding data $D^{S}$ = {$D_{1}^{S}$, $D_{2}^{S}$, $\dots$, $D_{n}^{S}$}
as $\bar{D}_{i}^{S}$ = $D_{i}^{S}$ \+ $N_{i}$ where $i$ $\in$ [$1$, $n$].
After adding noise, $D^{S}$ data becomes noise-added data $\bar{D}^{S}$ =
{$\bar{D}_{1}^{S},\bar{D}_{2}^{S},$…$,\bar{D}_{n}^{S}$} i.e. Patients Report3,
shown in Table 6. $\bar{D}^{S}$ and $D^{NS}$ data are combined using the
sanitization process, and sanitized data
$\hat{D}=\\{\hat{D}_{t,1},\hat{D}_{t,2},\dots,\hat{D}_{t,n}\\}$ is transferred
to $CSP$.

Table 6: Patients Report3 (Noise-added Data) Age | Gender
---|---
65.23 | 1.65
62.35 | 0.79
68.64 | 0.69
58.75 | 1.49
72.96 | 0.67
46.74 | 1.69
⋮ | ⋮
34.56 | 0.96

##  5 Data classification

$CSP$ obtains $\hat{D}=\\{\hat{D}_{t,1},\hat{D}_{t,2},\dots,\hat{D}_{t,n}\\}$
from $DO_{id}$ and prepossess it by using the normalization function given in
Eq. (4), where $T_{s}$ is training sample, $\mu$, and $\sigma$ are the mean
and the standard deviation of the training sample, respectively.

$\hat{D}=\frac{(T_{s}-\mu)}{\sigma}$ (4)

It is assumed that data $\hat{D}$= {$\hat{D}_{t,1}$, $\hat{D}_{t,2}$, $\dots$,
$\hat{D}_{t,n}$} belong to $n^{*}$ $\leq$ $n$ classes
$C=\\{C_{1},C_{2},\dots,C_{n^{*}}\\}$ where $n^{*}$ is count of classes,
$\bigcup_{i=1}^{n^{*}}$ $C_{i}=D$ and $C_{i}\bigcap C_{j}$ =
$\Phi,\forall_{i,j}=1,2,\dots,n^{*}\wedge i\neq j$. The steps for the
classification of data are illustrated in Fig. 3. In which, data
$\\{\hat{D}_{t,1},\hat{D}_{t,2},\dots,\hat{D}_{t,n}\\}$ is divided into
training data $\hat{D}_{t^{{}^{\prime}}}$ = {$\hat{D}_{t,1}$, $\hat{D}_{t,2}$,
$\dots$, $\hat{D}_{t,n-k}$}, and testing data
$\hat{D}_{t^{{}^{\prime\prime}}}$ = {$\hat{D}_{t,n-k+1}$, $\hat{D}_{t,n-k+2}$,
$\dots$, $\hat{D}_{t,n}$}. The training data
{$\hat{D}_{t,1},\hat{D}_{t,2},\dots,\hat{D}_{t,n-k}$} is used to train $CM$,
whereas accuracy of $CM$ can be measured by testing data {$\hat{D}_{t,n-k+1}$,
$\hat{D}_{t,n-k+2}$, $\dots$, $\hat{D}_{t,n}$}. During the testing process,
the data object {$\hat{D}_{t,n-k+1}$, $\hat{D}_{t,n-k+2}$, $\dots$,
$\hat{D}_{t,n}$} is given to $CM$, which identifies their classes. $CM$
analyzes {$\hat{D}_{t,n-k+1}$, $\hat{D}_{t,n-k+2}$, $\dots$, $\hat{D}_{t,n}$}
and produces a Label vector $L=\\{L_{t,n-k+1},L_{t,n-k+2},\dots,L_{t,n}\\}$ as
an output, whereas $L_{i^{{}^{\prime}}}\in L$ specifies $C_{i}\in C$ to which
$\hat{D}_{t^{{}^{\prime\prime}},i^{{}^{\prime}}}\in\hat{D}_{t^{{}^{\prime\prime}}}$
pertains. The classification accuracy ($CA$) is calculated using Eq. (5),
whereas $CI$ indicates the number of items correctly classified and $TI$
indicates the total number of test items.

$CA=\frac{CI}{TI}$ (5)

The precision ($P$), and recall ($R$) are calculated using Eq. (6) and (7)
respectively, whereas $TR$ indicates the total number of items returned by the
classifier and $RI$ indicates the total number of relevant items. The F1-score
($FS$) is measured using Eq. (8).

$P=\frac{CI}{TR}$ (6) $R=\frac{CI}{RI}$ (7) $FS=\frac{2PR}{P+R}$ (8)

Figure 3: Classification flow for shared data

Sanitized data $\hat{D}$ is the combination of both noisy data $\bar{D}^{S}$
and non-sensitive data $D^{NS}$, which is given to the input layer with $n$
nodes. A multi-layer perceptron (Fig. 4) architecture consists of three
layers: one input layer, one hidden layer, and one output layer. The input
layer receives the data and prepares it for feeding the hidden layer $H$ with
$n_{2}$ nodes. The hidden layer $H$ is responsible to process the acquired
results from input layer. The results of $H$ is
$H_{n_{2}}=\\{\varphi_{1}\hat{D}_{t_{1}},\varphi_{2}\hat{D}_{t_{2}},\dots,\varphi_{n_{2}}\hat{D}_{t_{n}}+b_{1}\\}$,
where $\varphi$, $b_{1}$ are the weight and bias, respectively. The obtained
results from the hidden layer is given to the output layer. The activation
function is used to activate the neuron at the hidden layer as well as at the
output layer. The results of the last layer with $n_{3}$ nodes as
$y=\\{\varphi_{1}h_{1},\varphi_{2}h_{2},\dots,\varphi_{n_{3}}h_{n_{2}}+b_{2}\\}$
is achieved, where $b_{2}$ is the bias. The final classification result
$L=\\{L_{t,n-k+1},L_{t,n-k+2},\dots,L_{t,n}\\}$ is obtained from $CM$.

Figure 4: Learning Model for privacy preserving

The steps for the data classification have been described by Algorithm 3.
Steps 3 to 5 in this algorithm display the Support Vector Machine (SVM)
classifier’s efficiency. In steps 6 to 8, the procedure for the K-Nearest
Neighbor (KNN) classifier is provided. Using steps 9 to 11, the Random Forest
(RF) classifier classifies the data. The Naive Bayes (NB) classifier is
conducted using step 12. Finally, the Artificial Neural Network (ANN) task is
addressed in steps 13 to 18.

In algorithm 1, steps 2 to 8 perform the classification over noised data using
a classification model, whose time complexity depends on the data partition,
noise addition, and classifier usage. The data is separated using step 3,
which takes the time $\mathcal{O}(n^{2})$, and space $\mathcal{O}(n)$, where
$n$ be the total number of input records. To preserve the privacy of the data,
noise is generated in step 3 and added using the Laplace mechanism in step 4,
which requires $\mathcal{O}(n^{2})$ time, and $\mathcal{O}(n)$ space. The
classification model is performed using steps 7, which needs
$\mathcal{O}(n^{3})$ time, and $\mathcal{O}(n^{2})$ space. Therefore, the
total time complexity, and space complexity of PPMD is $\mathcal{O}(n^{3})$ =
($\mathcal{O}(n^{2})$ \+ $\mathcal{O}(n^{2})$ \+ $\mathcal{O}(n^{3})$),
$\mathcal{O}(n^{2})$ = ($\mathcal{O}(n)$ \+ $\mathcal{O}(n)$ \+
$\mathcal{O}(n^{2})$), respectively. PPMD complexity analysis implies that the
aid of endurable time and space protects the data, which establishes its
potency.

Input: Input vector $\hat{D}$, weight $w$, bias $b$, activation function
$f(x)$

Output: unknown class label $\bar{y}$, tree numbers $n\\_tree$

1 Initialize input vector $\hat{D}$ = {$\hat{D}_{1}$, $\hat{D}_{2}$, $\dots$,
$\hat{D}_{n}$}, $\hat{D}_{1}$ = {$(x_{1},y_{1})$, $(x_{2},y_{2})$, $\dots$,
$(x_{\ddot{i}},y_{\ddot{j}})$}, $w$, $b$

2 for $i$ = $1$, $2$, $\dots$, $n$ do

3 $z_{i}$ = $\sum$ $\hat{D}_{i}$ $\cdot$ $w^{T}$ \+ $b$

4 $f(z_{i})$ $>$ 0, $\bar{y}_{i}$ := 1

5 $f(z_{i})$ $<$ 0, $\bar{y}_{i}$ := 0

6 for Compute Set $I$ contains the minimum sets of $k$ do

7 distance $d$ ($\hat{D}_{i}$, $\bar{y}_{i}$)

8 end for

9 for $\ddot{t}$ = $1$, $2$, $\dots$, $n\\_tree$ do

10 tree_classification($\hat{D}_{i}$, $\bar{y}_{i}$)

11 end for

12 $\bar{y}_{i}$ = $argmax_{y}$ $P(y)$ $\prod$ $P(X_{i}\mid y)$

13 for $\ddot{k}$ = $1$, $2$ do

14 for $\ddot{l}$ = $1$, $\dots$, $n_{\ddot{k}+1}$ do

15 $z_{\ddot{l}}^{(\ddot{k}+1)}$ = $\sum\limits_{\hat{t}=1}^{n}$
$x_{\hat{t}}^{(\ddot{k})}$ $\cdot$ $w_{\hat{t}}^{(\ddot{k})}$ \+
$b_{\ddot{l}}^{(\ddot{k})}$

16 $\bar{y}_{i}$ = $f(z_{\ddot{l}}^{(\ddot{k}+1)})$

17 end for

18 end for

19 return $\bar{y}_{i}$

end for

Algorithm 3 Data Classification

##  6 Performance evaluation

###  6.1 Experimental setup

The experiments are performed on a machine equipped with Intel (R) Core (TM)
i5-4210U CPU @ 1.70GHz clock speed. The computing machine runs Ubuntu 64-bit
and has 8 GB of the main memory RAM. Python 2.7.15 programming language is
used to complete the classification tasks. The five distinct classifiers: SVM,
KNN, RF, NB, and ANN, have been used to train CM over training data.

###  6.2 Datasets and classification parameters

Heart Disease, Arrhythmia, Hepatitis, Indian-liver-patient, and Framingham
datasets are taken from the UCI Machine Learning Repository R20  to train CM.
There are 303, 452, 155, 583, 303 instances, 75, 280, 20, 11, 14 attributes,
and 2, 13, 2, 2, 2 classes (binary and multi-class) in these datasets,
correspondingly as shown in Table 7.

Table 7: Basic information of four datasets

Dataset | #Instances | #Features | #Classes | Samples in | Samples in
---|---|---|---|---|---
|  |  |  | training set | test set
Heart Disease | 303 | 75 | 2 | 272 | 31
Arrhythmia | 452 | 280 | 13 | 406 | 46
Hepatitis | 155 | 20 | 2 | 139 | 16
Indian-liver-patient | 583 | 11 | 2 | 524 | 59
Framingham | 303 | 14 | 2 | 272 | 31

To train CM, 9/10 of data is used as training data from the entire dataset,
while the rest is used as test data. For a particular case, there are 303
instances in the Heart Disease dataset. The 272 instances (i.e., 9/10 of 303
instances) are used as training samples and the remaining 31 instances for
testing samples. The machine learning model is carried out over Clean, PPMD,
PMLM R14 , NbAFL R29 , and MLPAM R19 . We have used the Laplace mechanism to
generate the noise. However, PPMD, PMLM, NbAFL, and MLPAM schemes contain
noise. The results of $CM$ are measured using test data, and the $CA$, $P$,
$R$, and $FS$ are computed from these results.

###  6.3 Results

The $CM$ obtains the classification results including $CA$, $P$, $R$, and $FS$
over Clean, PPMD, PMLM R14 , NbAFL R29 , and MLPAM R19 , as demonstrated in
Figs. 5(a)-(e) to 8(a)-(e). In PPMD, the maximum value of $CA$ is 93.75% on
the Arrhythmia dataset using the ANN classifier. The minimum value of $CA$ is
62.50% on the Hepatitis dataset using the KNN classifier. The average value of
$CA$ is 72.20%, 73.40%, 73.61%, 70.03%, and 84.11% over Heart Disease,
Arrhythmia, Hepatitis, Indian-liver-patient, and Framingham dataset,
respectively. The highest value of $P$ is 94.11% on the Indian-liver-patient
dataset using the NB classifier. The lowest value of $P$ is 43.33% on the
Heart Disease dataset using the ANN classifier. The average value of $P$ is
69.33%, 53.51%, 74.18%, 78.23%, and 76.15% over Heart Disease, Arrhythmia,
Hepatitis, Indian-liver-patient, and Framingham dataset, respectively. The
maximum value of $R$ is 100% on the Indian-liver-patient dataset using the SVM
classifier. The minimum value of $R$ is 39.13% on the Arrhythmia dataset using
the ANN classifier. The average value of $R$ is 59.62%, 62.48%, 82.30%,
76.95%, and 84.06% over Heart Disease, Arrhythmia, Hepatitis, Indian-liver-
patient, and Framingham dataset, respectively. The highest value of $FS$ is
87.99% on the Hepatitis dataset using the RF classifier. The lowest value of
$FS$ is 41.37% on the Arrhythmia dataset using the ANN classifier. The average
value of $FS$ is 62.84%, 57.20%, 79.48%, 75.97%, and 78.77% over Heart
Disease, Arrhythmia, Hepatitis, Indian-liver-patient, and Framingham dataset,
respectively. The datasets’ performance descends in order: Framingham,
Hepatitis, Indian-liver-patient, Heart Disease, and Arrhythmia.

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$CAClean DataPPMDPMLM R14 NbAFL R29
MLPAM R19  (a) SVM

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$CAClean DataPPMDPMLM R14 NbAFL R29
MLPAM R19  (b) KNN

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$CAClean DataPPMDPMLM R14 NbAFL R29
MLPAM R19  (c) RF

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$CAClean DataPPMDPMLM R14 NbAFL R29
MLPAM R19  (d) NB

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$CAClean DataPPMDPMLM R14 NbAFL R29
MLPAM R19  (e) ANN

Figure 5: Accuracy of CM in PPMD

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$P$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (a) SVM

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$P$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (b) KNN

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$P$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (c) RF

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$P$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (d) NB

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$P$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (e) ANN

Figure 6: Precision of CM in PPMD

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$R$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (a) SVM

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$R$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (b) KNN

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$R$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (c) RF

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$R$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (d) NB

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$R$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (e) ANN

Figure 7: Recall of CM in PPMD

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$FS$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (a) SVM

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$FS$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (b) KNN

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$FS$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (c) RF

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$FS$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (d) NB

HDArrHepIndLivFram$0$$0.2$$0.4$$0.6$$0.8$$1$$FS$Clean DataPPMDPMLM R14 NbAFL
R29 MLPAM R19  (e) ANN

Figure 8: F1-score of CM in PPMD

###  6.4 Comparison

The experimental results are compared with clean data, PMLM R14 , NbAFL R29
as well as MLPAM R19 , which is implemented on the same platform (Figs.
5(a)-(e) to 8(a)-(e)). The PPMD outperforms PMLM R14 , NbAFL R29 , and MLPAM
R19  in all the cases because the proposed model reduces the impact of
injecting noise by separating data into sensitive and non-sensitive parts.
From Table 8, it is observed that the highest difference for $CA$ among PPMD,
PMLM, NbAFL, and MLPAM is 15.83% on the Hepatitis dataset using ANN
classifier, and the lowest difference is found 0.0% on the Heart Disease
dataset using SVM classifier, and the Hepatits dataset using KNN classifier.

Table 8: Improvement in the values of $CA$, $P$, $R$, and $FS$ of PPMD in comparison with the values on PMLM R14 , NbAFL R29 , MLPAM R19  Data |  Class | Decrements in the value of parameters
---|---|---
set |  ifier | $CA$ | $P$ | $R$ | $FS$
|  |  R14  |  R29  |  R19  |  R14  |  R29  |  R19  |  R14  |  R29  |  R19  |  R14  |  R29  |  R19
|  SVM |  3.22 |  0.0 |  6.45 |  5.00 |  4.04 |  7.26 |  10.9 |  4.72 |  11.19 |  5.33 |  4.43 |  8.79
|  KNN |  3.23 |  3.23 |  3.23 |  1.92 |  2.17 |  5.81 |  4.16 |  2.15 |  5.37 |  2.19 |  1.47 |  2.69
Heart |  RF |  1.01 |  1.01 |  1.01 |  24.45 |  22.94 |  28.39 |  11.33 |  1.5 |  1.72 |  5.25 |  3.63 |  7.64
Disease |  NB |  3.22 |  3.22 |  3.75 |  2.67 |  1.13 |  4.58 |  3.51 |  2.15 |  4.37 |  2.30 |  1.09 |  5.03
|  ANN |  0.61 |  3.06 |  3.80 |  0.48 |  0.48 |  0.48 |  3.23 |  3.23 |  3.23 |  1.95 |  0.20 |  1.95
|  SVM |  2.18 |  2.18 |  4.35 |  5.86 |  5.58 |  5.93 |  2.18 |  2.18 |  4.35 |  5.59 |  5.14 |  5.73
|  KNN |  6.52 |  2.17 |  6.52 |  9.30 |  8.45 |  10.77 |  6.52 |  2.17 |  6.52 |  9.98 |  4.01 |  10.56
Arrhy |  RF |  4.35 |  2.17 |  8.70 |  3.94 |  0.93 |  5.00 |  4.35 |  4.35 |  8.70 |  6.32 |  4.92 |  7.91
thmia |  NB |  1.56 |  1.56 |  3.74 |  1.13 |  1.26 |  1.76 |  1.56 |  1.56 |  3.74 |  3.07 |  0.29 |  3.91
|  ANN |  0.25 |  0.25 |  1.08 |  0.0 |  0.53 |  1.05 |  1.75 |  0.67 |  2.18 |  2.24 |  0.56 |  4.06
|  SVM |  6.25 |  6.25 |  6.25 |  4.10 |  4.58 |  4.58 |  9.85 |  4.16 |  10.41 |  6.48 |  4.56 |  9.48
|  KNN |  6.25 |  0.0 |  0.0 |  4.76 |  2.19 |  2.19 |  1.52 |  1.52 |  2.08 |  4.92 |  1.92 |  4.93
Hepa |  RF |  12.50 |  6.25 |  12.50 |  1.65 |  1.65 |  11.91 |  1.28 |  3.36 |  9.61 |  7.99 |  3.38 |  9.73
titis |  NB |  6.25 |  6.25 |  6.25 |  6.41 |  4.76 |  11.97 |  5.50 |  1.92 |  1.92 |  1.81 |  0.33 |  5.43
|  ANN |  15.11 |  8.0 |  15.83 |  4.28 |  2.48 |  5.95 |  0.0 |  0.0 |  8.34 |  2.57 |  1.67 |  2.09
|  SVM |  1.69 |  3.39 |  5.08 |  1.69 |  3.39 |  6.15 |  0.0 |  0.0 |  2.44 |  1.12 |  2.27 |  3.43
Indian |  KNN |  1.69 |  1.69 |  3.39 |  1.67 |  2.75 |  3.26 |  0.0 |  0.39 |  0.75 |  1.35 |  1.35 |  1.77
Liver |  RF |  1.69 |  3.39 |  5.08 |  6.01 |  0.24 |  4.60 |  0.0 |  1.06 |  4.3 |  1.54 |  2.62 |  4.81
Patient |  RF |  1.70 |  1.70 |  3.39 |  2.45 |  1.81 |  5.23 |  2.77 |  0.05 |  7.03 |  4.87 |  2.98 |  5.14
|  ANN |  3.05 |  1.46 |  3.24 |  9.49 |  3.77 |  9.49 |  4.48 |  1.70 |  2.56 |  3.82 |  1.67 |  5.24
|  SVM |  0.71 |  0.24 |  2.12 |  2.76 |  1.18 |  4.09 |  0.71 |  0.24 |  2.12 |  1.21 |  0.55 |  2.37
|  KNN |  0.71 |  0.24 |  1.18 |  0.90 |  0.74 |  2.29 |  0.71 |  0.24 |  1.18 |  0.03 |  0.04 |  0.98
Frami |  RF |  1.18 |  0.71 |  2.13 |  2.04 |  1.77 |  3.24 |  1.18 |  0.71 |  2.13 |  0.35 |  0.38 |  1.32
ngham |  NB |  0.95 |  0.24 |  2.13 |  1.62 |  0.28 |  2.26 |  0.95 |  0.24 |  2.13 |  1.49 |  0.23 |  1.56
|  ANN |  0.24 |  1.13 |  9.23 |  0.09 |  1.08 |  1.29 |  1.69 |  1.22 |  1.69 |  0.11 |  0.90 |  0.90

Likewise, the maximum gap for $P$ is 28.39% on the Heart Disease dataset using
the RF classifier, but the lowest difference is found 0.0% on the Arrhythmia
dataset using the ANN classifier. The $R$ of PPMD maximum improved by 11.33%
from PMLM, NbAFL, and MLPAM on the Heart Disease dataset using the RF
classifier, whereas the smallest improvement is 0.0% on the Hepatitis dataset
using ANN classifier, and on the Indian-liver-patient dataset using the SVM,
KNN, RF classifiers. The highest difference for $FS$ is 10.56% on the
Arrhythmia dataset using the KNN classifier, while the lowest difference for
$FS$ is 0.03% on the Framingham dataset using the KNN classifier.

Moreover, the results of PPMD are less than the results of Clean data in all
the cases due to noise addition. Table 9 shows that the maximum gap for $CA$
between PPMD and clean data is 6.25% on the Hepatitis dataset using the SVM,
KNN, RF, and NB classifiers, but the smallest gap is found 0.12% on the
Framingham dataset using the ANN classifier. Similarly, the highest difference
for $P$ is 8.09% on the Hepatitis dataset using the RF classifier, while the
lowest difference is found 0.0% on the Hepatitis dataset using the KNN
classifier. The $R$ of PPMD the maximum decrement by 8.72% from clean data on
the Hepatitis dataset using the RF classifier. The smallest decrement is 0.0%
on the Arrhythmia dataset using the ANN, Hepatitis dataset using SVM, and
Indian-liver-patient dataset using SVM and ANN classifiers. The highest
difference for $FS$ is 11.71% on the Heart Disease dataset using the RF
classifier, but the lowest difference for $FS$ is 0.03% on the Framingham
dataset using the ANN classifier. But still, the results of PPMD are almost
equal and also offer more protection compared to the clean data.

Table 9: Reduction in the values of $CA$, $P$, $R$, and $FS$ of PPMD in comparison to the values on clean data  Dataset | Classifier | % decrement in the value of parameters
---|---|---
|  | $CA$ | $P$ | $R$ | $FS$
| SVM | 3.23 | 1.92 | 2.19 | 2.05
| KNN | 3.22 | 3.08 | 4.76 | 2.65
Heart Disease | RF | 2.21 | 4.61 | 7.78 | 11.71
| NB | 3.23 | 3.58 | 3.92 | 4.37
| ANN | 0.61 | 1.83 | 3.23 | 2.54
| SVM | 2.17 | 3.07 | 2.17 | 2.86
| KNN | 2.18 | 2.28 | 2.18 | 1.45
Arrhythmia | RF | 2.17 | 3.80 | 2.17 | 1.86
| NB | 1.75 | 3.84 | 1.75 | 3.94
| ANN | 0.65 | 1.10 | 0.00 | 0.49
| SVM | 6.25 | 5.24 | 0.00 | 3.13
| KNN | 6.25 | 0.00 | 7.57 | 3.08
Hepatitis | RF | 6.25 | 8.09 | 8.72 | 2.91
| NB | 6.25 | 6.67 | 4.89 | 3.90
| ANN | 2.63 | 7.94 | 6.25 | 7.24
| SVM | 1.70 | 1.70 | 0.00 | 1.10
| KNN | 1.70 | 2.99 | 0.37 | 0.42
Indian Liver | RF | 1.70 | 0.97 | 1.67 | 0.96
Patient | NB | 1.69 | 0.33 | 1.28 | 1.06
| ANN | 3.05 | 1.23 | 0.00 | 0.63
| SVM | 0.71 | 0.37 | 0.71 | 1.43
| KNN | 0.71 | 0.95 | 0.71 | 1.37
Framingham | RF | 0.41 | 0.21 | 0.41 | 0.35
| NB | 1.41 | 1.17 | 1.41 | 1.15
| ANN | 0.12 | 0.02 | 0.05 | 0.03

###  6.5 Statistical analysis

Statistical analysis is used to validate the $CA$, $P$, $R$, and $FS$ of the
proposed model. In this context, the non-parametric test is applied to the
dataset that is not normally distributed. The null hypothesis states that the
acquired results from different methods are statistically identical in the
Wilcoxon signed-rank test. This test compares the performance of PPMD model to
that of the existing PMLM R14 , NbAFL R29 , and MLPAM R19  models. The test is
run on the dataset with a significance level R28  (p-value) of 0.05 to
determine the importance of classifying parameters. Table 10 demonstrates the
results of the test statistics.

While comparing PPMD and PMLM R14 , it is observed that the null hypothesis
for $CA$, $P$, $R$, and $FS$ is rejected because their p-values are less than
0.05, indicating that PPMD for the Heart Disease dataset is valid. The null
hypothesis is rejected for $CA$, $R$, and $FS$ but accepted for $P$ on the
Arrhythmia dataset. The null hypothesis is rejected for $CA$, $P$, and $FS$,
whereas accepted for $R$ on the Hepatitis, and Indian-Liver-Patient datasets.
The null hypothesis is rejected for $CA$, $P$, $R$, and $FS$ on the Framingham
dataset.

Similarly, comparing PPMD, and NbAFL R29 , the null hypothesis is rejected for
$P$, $R$, and $FS$ but accepted for $CA$ on the Heart Disease dataset. The
null hypothesis is rejected for $CA$, $P$, $R$, and $FS$ on the Arrhythmia
dataset. The null hypothesis is rejected for $P$, and $FS$ but accepted for
$CA$, and $R$ on the Hepatitis dataset. The null hypothesis is rejected for
$CA$, $P$, and $FS$, whereas accepted for $R$ on Indian-live-Patient dataset.
The null hypothesis is rejected for $CA$, $P$, $R$, and $FS$ on the Framingham
dataset.

Moreover, comparing PPMD and MLPAM R19 , the null hypothesis is rejected for
$CA$, $P$, $R$, and $FS$ on the Heart Disease and Arrhythmia datasets. The
null hypothesis is rejected for $P$, $R$, and $FS$ but accepted for $CA$ on
the Hepatitis dataset. The null hypothesis is rejected for $CA$, $P$, $R$, and
$FS$ on the Indian-Liver-Patient and Framingham datasets.

Table 10: Wilcoxon test statistics (p-value is 0.05)

Data |  Classification | Comparison of | Comparison of | Comparison of
---|---|---|---|---
set |  Parameters | PPMD, PMLM R14  | PPMD, NbAFL R29  | PPMD, MLPAM R19
|  | p-value | Result | p-value | Result | p-value | Result
|  $CA$ | 0.042 | RE | 0.68 | AC | 0.43 | RE
Heart |  $P$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
Disease |  $R$ | 0.043 | RE | 0.42 | RE | 0.43 | RE
|  $FS$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
|  $CA$ | 0.043 | RE | 0.42 | RE | 0.43 | RE
Arrhy |  $P$ | 0.068 | AC | 0.43 | RE | 0.43 | RE
thmia |  $R$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
|  $FS$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
|  $CA$ | 0.039 | RE | 0.59 | AC | 0.66 | AC
Hepa |  $P$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
titis |  $R$ | 0.068 | AC | 0.68 | AC | 0.43 | RE
|  $FS$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
|  $CA$ | 0.042 | RE | 0.43 | RE | 0.41 | RE
Indian |  $P$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
Liver |  $R$ | 0.180 | AC | 0.68 | AC | 0.43 | RE
Patient |  $FS$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
|  $CA$ | 0.043 | RE | 0.42 | RE | 0.42 | RE
Frami |  $P$ | 0.043 | RE | 0.43 | RE | 0.43 | RE
ngham |  $R$ | 0.043 | RE | 0.42 | RE | 0.42 | RE
|  $FS$ | 0.043 | RE | 0.43 | RE | 0.43 | RE

AC: The null hypothesis is accepted, RE: The null hypothesis is rejected

##  7 Conclusion and future work

This paper proposed a novel model named PPMD that preserves the privacy of
outsourced sensitive data provided by various data owners in a real cloud
environment. PPMD allows multiple data owners to outsource their data to the
cloud for storing and computation. In this work, data owners added different
statistical noise to sensitive data according to their queries for data
protection. The cloud service provider has also provided the classification
service. The experiments have been conducted, and results show that PPMD
ensures high accuracy, precision, recall, and F1-score improvement up to 29%
over the existing works. The model’s performance over the well-known data sets
and comparison with existing works showed that PPMD is more secure, efficient,
and optimal. The future aim of this work would be to share collected data
among requesting users and devise a more efficient privacy-preserving
mechanism to protect the data for various owners.

###### Acknowledgements.

This work is supported by University Grant Commission, New Delhi, India under
the scheme of National Eligibility Test-Junior Research Fellowship (NET-JRF)
with reference id-3515/(NET-NOV 2017).

## Compliance with ethical standards

Conflict of interest The authors have no conflict of interest regarding the
publication.

Ethical approval This article does not contain any studies with human
participants or animals performed by any of the authors.

Informed consent Informed consent was obtained from all individual
participants included in the study.

Authors’ contribution Both the authors have discussed and constructed the
ideas, designed the privacy-preserving model, and wrote the paper together.

## References

  * (1) Zaghloul, E., Zhou, K., & Ren, J. (2019). P-mod: Secure privilege-based multilevel organizational data-sharing in cloud computing. IEEE Transactions on Big Data.
  * (2) Xu, S., Yang, G., Mu, Y., & Deng, R. H. (2018). Secure fine-grained access control and data sharing for dynamic groups in the cloud. IEEE Transactions on Information Forensics and Security, 13(8), 2101-2113.
  * (3) Wei, L., Zhu, H., Cao, Z., Dong, X., Jia, W., Chen, Y., & Vasilakos, A. V. (2014). Security and privacy for storage and computation in cloud computing. Information sciences, 258, 371-386.
  * (4) Ali, M., Khan, S. U., & Vasilakos, A. V. (2015). Security in cloud computing: Opportunities and challenges. Information sciences, 305, 357-383.
  * (5) Stergiou, C., & Psannis, K.E. (2017). Efficient and secure big data delivery in cloud computing. Multimedia Tools and Applications, 76(21), 22803-22822.
  * (6) Singh, A.K. & Gupta, I. (2020). Online information leaker identification scheme for secure data sharing. Multimedia Tools and Applications, 79(41), 31165-31182.
  * (7) Ali, M., Dhamotharan, R., Khan, E., Khan, S. U., Vasilakos, A. V., Li, K., & Zomaya, A. Y. (2015). SeDaSC: secure data sharing in clouds. IEEE Systems Journal, 11(2), 395-404.
  * (8) Wei, J., Liu, W., & Hu, X. (2016). Secure data sharing in cloud computing using revocable-storage identity-based encryption. IEEE Transactions on Cloud Computing, 6(4), 1136-1148.
  * (9) Fu, Z., Xia, L., Sun, X., Liu, A. X., & Xie, G. (2018). Semantic-aware searching over encrypted data for cloud computing. IEEE Transactions on Information Forensics and Security, 13(9), 2359-2371.
  * (10) Casino, F., Domingo-Ferrer, J., Patsakis, C., Puig, D., & Solanas, A. (2015). A k-anonymous approach to privacy preserving collaborative filtering. Journal of Computer and System Sciences, 81(6), 1000-1011.
  * (11) Jang, S.B. & Ko, Y.W. (2017). Efficient multimedia big data anonymization. Multimedia Tools and Applications, 76(17), 17855-17872.
  * (12) Sudhakar, R. V., & Rao, T. C. M. (2020). Security aware index based quasi–identifier approach for privacy preservation of data sets for cloud applications. Cluster Computing, 1-11.
  * (13) Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006, March). Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference (pp. 265-284). Springer, Berlin, Heidelberg.
  * (14) Zhao, X., Dong, Y., & Pi, D. (2019). Novel trajectory data publishing method under differential privacy. Expert Systems with Applications, 138, 112791.
  * (15) Fan, W., He, J., Guo, M., Li, P., Han, Z., & Wang, R. (2020). Privacy preserving classification on local differential privacy in data centers. Journal of Parallel and Distributed Computing, 135, 70-82.
  * (16) Tanuwidjaja, H. C., Choi, R., Baek, S., & Kim, K. (2020). Privacy-Preserving Deep Learning on Machine Learning as a Service—a Comprehensive Survey. IEEE Access, 8, 167425-167447.
  * (17) Yuan, J., & Yu, S. (2013). Privacy preserving back-propagation neural network learning made practical with cloud computing. IEEE Transactions on Parallel and Distributed Systems, 25(1), 212-221.
  * (18) Yonetani, R., Naresh Boddeti, V., Kitani, K. M., & Sato, Y. (2017). Privacy-preserving visual learning using doubly permuted homomorphic encryption. In Proceedings of the IEEE International Conference on Computer Vision (pp. 2040-2050).
  * (19) Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2017). Privacy-preserving deep learning via additively homomorphic encryption. IEEE Transactions on Information Forensics and Security, 13(5), 1333-1345.
  * (20) Li, T., Huang, Z., Li, P., Liu, Z., & Jia, C. (2018). Outsourced privacy-preserving classification service over encrypted data. Journal of Network and Computer Applications, 106, 100-110.
  * (21) Li, T., Li, J., Liu, Z., Li, P., & Jia, C. (2018). Differentially private Naive Bayes learning over multiple data sources. Information Sciences, 444, 89-104.
  * (22) Ma, X., Ma, J., Li, H., Jiang, Q., & Gao, S. (2018). PDLM: Privacy-preserving deep learning model on cloud with multiple keys. IEEE Transactions on Services Computing.
  * (23) Li, P., Li, T., Ye, H., Li, J., Chen, X., & Xiang, Y. (2018). Privacy-preserving machine learning with multiple data providers. Future Generation Computer Systems, 87, 341-350.
  * (24) Li, P., Li, J., Huang, Z., Gao, C. Z., Chen, W. B., & Chen, K. (2018). Privacy-preserving outsourced classification in cloud computing. Cluster Computing, 21(1), 277-286.
  * (25) Gao, C. Z., Cheng, Q., He, P., Susilo, W., & Li, J. (2018). Privacy-preserving Naive Bayes classifiers secure against the substitution-then-comparison attack. Information Sciences, 444, 72-88.
  * (26) Hesamifard, E., Takabi, H., Ghasemi, M., & Wright, R. N. (2018). Privacy-preserving machine learning as a service. Proceedings on Privacy Enhancing Technologies, 2018(3), 123-142.
  * (27) Phuong, T. T. (2019). Privacy-preserving deep learning via weight transmission. IEEE Transactions on Information Forensics and Security, 14(11), 3003-3015.
  * (28) Wei, K., Li, J., Ding, M., Ma, C., Yang, H. H., Farokhi, F., … & Poor, H. V. (2020). Federated learning with differential privacy: Algorithms and performance analysis. IEEE Transactions on Information Forensics and Security, 15, 3454-3469.
  * (29) Gupta, I., Gupta, R., Singh, A. K., & Buyya, R. (2020). MLPAM: A Machine Learning and Probabilistic Analysis Based Model for Preserving Security and Privacy in Cloud Environment. IEEE Systems Journal.
  * (30) Frank, A., & Asuncion, A. (2010). UCI Machine Learning Repository [http://archive. ics. uci. edu/ml]. Irvine, CA: University of California. School of information and computer science, 213, 2-2.
  * (31) Kumar, J., Saxena, D., Singh, A.K. and Mohan, A. (2020). Biphase adaptive learning-based neural network model for cloud datacenter workload forecasting, 1-18.