Privacy-Preserving Ensemble Infused Enhanced Deep Neural Network
  Framework for Edge Cloud Convergence
We propose a privacy-preserving ensemble infused enhanced Deep Neural Network
(DNN) based learning framework in this paper for Internet-of-Things (IoT),
edge, and cloud convergence in the context of healthcare. In the convergence,
edge server is used for both storing IoT produced bioimage and hosting DNN
algorithm for local model training. The cloud is used for ensembling local
models. The DNN-based training process of a model with a local dataset suffers
from low accuracy, which can be improved by the aforementioned convergence and
Ensemble Learning. The ensemble learning allows multiple participants to
outsource their local model for producing a generalized final model with high
accuracy. Nevertheless, Ensemble Learning elevates the risk of leaking
sensitive private data from the final model. The proposed framework presents a
Differential Privacy-based privacy-preserving DNN with Transfer Learning for a
local model generation to ensure minimal loss and higher efficiency at edge
server. We conduct several experiments to evaluate the performance of our
proposed framework.
Veronika Stephanie, Ibrahim Khalil, Mohammad Saidur Rahman, Mohammed Atiquzzaman
Privacy-Preserving Ensemble Infused Enhanced Deep Neural Network Framework for Edge Cloud Convergence

###### Abstract

We propose a privacy-preserving ensemble infused enhanced Deep Neural Network (DNN) based learning framework in this paper for Internet-of-Things (IoT), edge, and cloud convergence in the context of healthcare. In the convergence, edge server is used for both storing IoT produced bioimage and hosting DNN algorithm for local model training. The cloud is used for ensembling local models. The DNN-based training process of a model with a local dataset suffers from low accuracy, which can be improved by the aforementioned convergence and Ensemble Learning. The ensemble learning allows multiple participants to outsource their local model for producing a generalized final model with high accuracy. Nevertheless, Ensemble Learning elevates the risk of leaking sensitive private data from the final model. The proposed framework presents a Differential Privacy-based privacy-preserving DNN with Transfer Learning for a local model generation to ensure minimal loss and higher efficiency at edge server. We conduct several experiments to evaluate the performance of our proposed framework.

 Edge cloud convergence, deep learning, ensemble learning, transfer learning, privacy preserving deep learning, differential privacy, ensemble infused deep learning

## I Introduction

The massive improvement in Internet-of-Things (IoT) technology has enabled rapid data collection in different applications, including healthcare. For example, Alexapath has developed an IoT-enabled microscope for instant collection of microscopic images, which can be shared with specialists working remotely [1]. Giving another example, an IoT device can capture lung images by passing a small amount of current on cross areas of human lung1. The captured data can later be used for diagnosis and research work by the health practitioners by leveraging Artificial Intelligence (AI) techniques such as Deep Learning (DL)[2]. Nevertheless, IoT devices are resource-constrained and cannot offer data storage and DL tasks alone due to the computational power requirements of AI tasks.

Footnote 1: [https://buildforcovid19.io/lung-imaging-iot-for-remote-monitoring-in-isolation/](https://buildforcovid19.io/lung-imaging-iot-for-remote-monitoring-in-isolation/)

Cloud is a popular platform for traditional IoT data storage and DL-based machine learning in both industry and academia. However, the cloud is not suitable for realtime data analysis services due to the high bandwidth requirement and network latency [3]. Edge computing technology is getting attention from machine learning practitioners and researchers due to several reasons. _First_, edge devices can be integrated with IoT devices for rapid data collection and to store data in private edge data servers. _Second_, a part of cloud DL tasks can be offloaded in the edge servers and executed with private data to reduce bandwidth requirements. _Third_, edge devices enable the convergence of IoT, edge, cloud, and AI to solve machine learning tasks at the close proximity of data source and offer realtime services. By leveraging the aforementioned convergence, a healthcare service provider (e.g., hospital) can deploy several IoT devices and edge devices to collect bioimages and store them, respectively. In addition, hospitals can deploy edge devices to host DL algorithms to train models for data analysis based on the collected bioimages.

The accuracy of the DL approach is a necessary requirement that depends on the variety of used models. A hospital may apply a model which may not be enough to achieve high prediction accuracy during data analysis. Hence, the hospital may need to collaborate with other hospitals to improve the accuracy of prediction. Moreover, a dataset of a single hospital may be homogeneous, which leads to model overfitting and causes significant utility loss in a DL model [4]. Hence, collaborating datasets with other hospitals should increase the dataset volume and help improve the DL model accuracy. This large-scale dataset is often obtained from multi-institutional or multi-national data accumulation, and voluntary data sharing [4].

Nevertheless, collaborating datasets with other hospitals introduces a privacy risk as the dataset contains sensitive information about the patient. In a centralized deep learning model training process, it is common for medical institutions to anonymize or pseudonymize patients' data before sending it to public analysis and model training sites. However, it is proven that anonymization is insufficient to protect against re-identification attack [5]. Moreover, once the anonymized medical data are transmitted to a public site, the data cannot be easily revoked or augmented [6].

An ensemble learning method is a collective machine learning approach to obtain better prediction performance by strategically combining multiple learning models. The ensemble learning approach gives high accuracy without sufficient data representation [7]. The training process of DNN is training a loss function to find out a set of weights that are considered suitable for a given problem. The loss surface in a complex network is more chaotic with many local optimal solutions [8]. Ensemble learning effectively utilizes these multiple local optimal solutions to improve the accuracy of the prediction significantly [9]. Therefore, ensemble learning is a suitable mechanism for convergence IoT, edge, cloud, and AI.
### _Problem Statement_

Although ensemble learning improves the model accuracy, this approach alone is not sufficient to provide users privacy [10]. To describe the problem in ensemble learning-based collaborative deep learning model, we choose a healthcare scenario as shown in Fig. 1. We assume that several hospitals, called participants, collect patient lung images via IoT devices and store them in private edge data servers. Hospitals also own private edge servers that host DL algorithms. A private edge server of a hospital learns from local data to generate a local training model. All private edge servers outsource local models to a centralized public cloud server that hosts the ensemble algorithm. The public cloud server aggregates received models using an ensemble method to generate a final model shared with all hospitals for their data analysis.

As shown in Fig. 1, an adversary can perform several attacks on shared local models and the final models to leak sensitive information. Authors in [11] exhibit a successful model inversion attack that utilizes shared local model parameters on collaborative learning setting to reconstruct most of the data used for training. [12] developed a membership inference attack that can determine whether a record was used as part of the machine learning model's training. Hence, existing studies have tried to combine the distributed learning models with some privacy-preserving methods such as Secure Multi-party Computation (SMPC) [13, 14], Differential Privacy (DP) [15, 16] and Homomorphic Encryption (HE) [17] to enhance the system's privacy. However, the integration of the privacy preservation method and distributed DL system introduces another issue. For example, in distributed learning using DP, adding too much noise yield poor performance of the resulting model. On the other hand, in HE and SMPC integrated distributed DL systems, massive computation and communication overhead are their profound issues. Furthermore, in most distributed DL systems, as shown in Figure 1, additional communication overhead is usually found due to constant local model exchange with the server to enhance the performance of the public model.

### _Contributions_

In this paper, we propose a privacy-preserving ensemble infused enhanced Deep Neural Network (DNN) based learning framework for IoT, edge and cloud convergence. Initially, we propose a privacy-preserving architecture for the edge and cloud-based ensemble-assisted DNN framework. In the proposed architecture, multiple participants train their own models individually at their private edge servers based on the local dataset. Next, the local training model generation process is made privacy-preserving with Differential Privacy to prevent privacy leakage. We use Stochastic Gradient Descent (SGD) based mechanism in Differential Privacy to add noise to the training model parameters. As applying Differential Privacy results in a significant loss in the model, we apply Transfer Learning[18] to mitigate the loss. We assume that a trusted third party generates an initial model using a Convolutional Neural Network (CNN) with a public dataset before beginning the local model generation. An edge server gets the initial model from the trusted third party and transfers the knowledge to repair the loss. Applying transfer learning also improves efficiency and reduces the computational load of the edge server. Finally, an ensemble-based collective mechanism is developed to generate a final model. The ensemble process is performed and the final model is distributed by the cloud.

Our contributions are summarized as follows:

* A framework is proposed for Deep Neural Network (DNN) based learning to ensure high learning accuracy in IoT, edge, and cloud convergence.
* Our framework leverages ensemble learning concept to generate a generalized final model which is robust and ensures good accuracy in the context of IoT, edge, and cloud convergence.
* Differential Privacy-based privacy-preserving technique is used with Transfer Learning during local model generation to protect from privacy attacks with higher efficiency and reduced computational load at edge servers.

### _Organization_

The remainder of this paper is organized as follows. Section II discusses some of the closely relevant works. Some preliminary topics are presented in Section III. The system architecture of the proposed framework is presented in Section IV. The methodology used in the proposed framework is described in Section V. Experimental results and performance evaluation are shown in Section VI. Finally, Section VII concludes this paper.

## II Related Work

To preserve privacy in collaborative learning scheme, recent studies tried to integrate it with other privacy-preserving methodologies, such as Multi-Party Computation (MPC), Homomorphic Encryption (HE), and Differential Privacy (DP).

[19] proposed a privacy-preserving deep learning system via weight transmission. In preserving the model privacy, participants share symmetric keys to keep the model secret from the server. The server acts as a transfer station for the local model to be distributed and trained. The fact that the training model needs to be updated and trained in a sequence is not efficient.

Fig. 1: Centralized collaborative learning without privacy-preservation method
A method proposed by [20] takes advantage of a centralized and distributed training scheme to achieve efficiency and reduce computational cost. The proposed model employs differential privacy, blinding, and HE techniques to ensure the model's ability to resist collusion attacks, model attacks, and data attacks.

Another DP based privacy-preserving collaborative learning introduced by [21]. To minimize information leakage from the shared model, they only selected some gradients over a certain threshold to be transmitted. However, the proposed method is claimed to provide moderate privacy as a subset of the parameters is shared with other participants for each training iteration [13].

In tackling the issue, [13] proposed a collaborative deep learning scheme, whose privacy preservation method is based on secure MPC. The proposed model shows that the scheme is able to protect the local dataset and learning model from the cloud server. [22] also proposed a secure MPC based collaborative learning model which is resistant to generative adversarial network based attack by ensuring that participants are isolated from the model parameters. However, due to its high cost in calculating complex functions, its application in a privacy-preserving deep learning environment may not be suitable. Focusing on reducing computational cost, [14] proposed partial model encryption using MPC in the distributed deep learning system. Although the computational cost is significantly reduced, the underlying high communication cost problem of MPC can still be found where synchronous updates are required through all participants for each training iteration.

Aside from MPC, a recent study in privacy-preserving collaborative deep learning using HE is also proven to provide privacy guarantees against honest-but-curious servers and parameter leakage. For example, [23] introduces a privacy-preserving deep learning model using an additive HE scheme. The proposed scheme encrypts local model's gradients before being sent to the server. The model is proven to be secure against curious servers at the cost of increased communication between the learning participants and the cloud server.

The aforementioned method above tries to collaboratively enhance public model performance by updating model parameters in a privacy-preserving manner. On the other hand, one of the state-of-the-art approaches, Private Aggregation of Teacher Ensembles (PATE) proposed by [24], is a DP based method that allows us to predict an unlabeled public data in a privacy-preserving manner to train another learning model. One method that is closely related to our work is proposed by [18], which is a transfer learning based PATE ensemble learning method. This method tries to transfer the knowledge of existing public data to each of the ensemble learning teacher models. This allows the proposed method to increase the performance of their model in predicting unlabeled data. However, when a different participant owns a teacher model in a collaborative learning scheme, the proposed method may cause a privacy leak. This is because each teacher model is made visible to other participants. Hence, the model parameters can be used to do a membership inference attack or model inversion attack on a specific participant.

From the discussed methods above, we note that each privacy preservation method has trade-offs between accuracy, computation cost, and communication cost. HE and MPC based method provides better accuracy and privacy at the cost of increased communication and computational cost. On the other hand, DP based methods are more efficient in terms of their communication and computational cost in return for their performance loss. In addition to that, most of the privacy-preserving distributed learning methods mentioned above consider periodical local model updates from the local devices and then send the aggregated model back to all devices. This results in substantial communication overhead [25]. While considering both aspects, we propose a high-performing ensemble distributed learning system with knowledge transfer based on differential privacy, which does not require a continuous local model update.

## III Preliminaries

In this section, we present the background of DL, ensemble learning, distributed learning, and DP that serve as the fundamentals in this article.

### _Deep Learning_

DL is a branch of machine learning that allows us to gain a high level of abstractions on a set of data. Essentially, DL neural network is composed of more than three layers. These layers are proposed to imitate the human brain. This allows DL to learn from a large amount of data, hence its success on complex tasks such as computer vision, image classification, and language processing. Typical process in deep learning usually involves forward propagation and backpropagation. Forward propagation allows us to retrieve output value from the given input data, while backpropagation updates the parameter of the neural network model. To update the weight parameters, backpropagation has an optimizer which role is to calculate loss and update the model parameters to reduce the loss. Generally, a loss function can be denoted as \(l(y,\hat{y})\), where \(y\) is the true label and \(\hat{y}\) is the prediction. In Stochastic Gradient Decent (SGD), we can compute the updated parameter as follows.

\[\Theta_{k+1}=\Theta_{k}-\eta\cdot\frac{1}{N}\sum_{i=1}^{N}\nabla_{\Theta_{k}}l (f(x_{i}),y_{i})\]

Here \(\Theta_{k}\) is the parameter of the current step \(k\), \(\eta\) is the learning rate, \(N\) is the number of samples within a batch, \(\nabla\) is used to refer to the derivative with respect to every parameter, and \(l(f(x_{i}),y_{i})\) is our loss function, which takes prediction of an input data \(x_{i}\) from a prediction function \(f()\) and a true label of the input data \(y_{i}\) as the inputs.

### _Ensemble Learning_

Ensemble learning is introduced as a method that combines multiple learning models, whose primary goal is to improve the capability of its base models \(\mathcal{M}\). Ensemble learning can be classified into three classes. They are bagging, boosting, and stacking. In this particular paper, we focus on the use of the ensemble averaging method, which is a Bootstrap Aggregation
or bagging based ensemble learning introduced in [26]. In Deep Neural Network (DNN), only one model is usually kept for training and predicting a dataset. However, in ensemble averaging, several neural network models are kept, and the prediction obtained by each learning model are aggregated to reduce the base model bias and variance error. Generally, ensemble averaging can be calculated using Equation 1.

\[\tilde{P}(x,\alpha)=\sum_{i=1}^{k}\alpha_{i}P_{i}(x) \tag{1}\]

Here, \(\tilde{P}()\) represents the predictions of the ensemble model, \(x\) is input data, \(\alpha\) is a list of weights, where \(\alpha_{i}\in\alpha\) is a weight assigned to a particular base model \(\mathcal{M}_{i}\in\mathcal{M}\), \(k\) is the number of participants, and \(P_{i}(x)\) is the resulting prediction probabilities of input data \(x\) from base model \(\mathcal{M}_{i}\). A raw average in ensemble averaging can be achieved by replacing the value of \(\alpha_{i}\in\alpha\) with the value of one over the total number of \(\mathcal{M}\).

### _Transfer Learning_

Transfer learning can be seen as a mechanism that allows a system to utilize a learned knowledge from one task to another task [27]. This can help address limitations in medical fields where healthcare image data can hardly be shared for DL model training.

Transfer learning comprises two concepts: domain \(D\) and learning task \(T\). Formally, a domain can be represented as \(D=\{\mathcal{X},P(X)\}\). Here, \(\mathcal{X}\) represents the feature space, and \(P(X)\) is the marginal probability distribution of sample \(X\) in \(\mathcal{X}\). A task can be denoted as \(T=\{\mathcal{Y},P(Y|X)\}\). Here, \(\mathcal{Y}\) is the label space, and \(P(Y|X)\) is a predictive probability function, which predicts the conditional probability of \(Y\in\mathcal{Y}\) given \(X\in\mathcal{X}\).

Given a target task \(\mathcal{T}_{t}\) and a target domain \(\mathcal{D}_{t}\), we can transfer the knowledge from a source domain \(\mathcal{D}_{s}\) with a source task \(\mathcal{T}_{s}\) to improve the performance of the predictive function in \(\mathcal{T}_{t}\), where \(\mathcal{D}_{t}\neq\mathcal{D}_{s}\) and/or \(\mathcal{T}_{t}\neq\mathcal{T}_{s}\).

A typical transfer learning can be done by transferring the learned parameters of a well-trained DL model on a large dataset (e.g., ImageNet) to the \(\mathcal{D}_{t}\). In this project, we focus on the use of transfer learning in a Deep Neural Network (DNN), where the source and target have the same domain and task.

### _Differential Privacy_

DP is a mechanism that aims to minimize the risk of privacy breaches in a particular database. The definition of differential privacy can be formalized as follows.

**Definition III.1**: _A randomized mechanism (\(M\)) provides (\(\varepsilon\), \(\delta\))-differential privacy if any datasets \(D\) and \(D^{\prime}\) that differ at most one element, and for any subset \(S\subseteq Range(M)\), where \(range(M)\) represent the range of possible outcomes produced by \(M\),_

\[P(M(D)\in S)\leq e^{\varepsilon}\times P(M(D^{\prime})\in S)+\delta \tag{2}\]

As given in Equation 2, the \(\varepsilon\) is privacy metric loss which provides an insight into the loss of privacy in the corresponding differentially private algorithm. Initially, the original differential privacy was proposed by [28] as \(\varepsilon\)-differential privacy. However, to loosen the definition of \(\varepsilon\)-differential privacy, \(\delta\) was introduced. \(\delta\) is defined as the probability of information leakage accident. This \(\delta\) is expected to be smaller than \(\frac{1}{|D|}\) where \(D\) is the data size within the database.

## IV Proposed System architecture

Figure 2 shows the architecture overview of the proposed method. We assume that there are \(n\) hospitals, denoted as a set \(\{H_{1},H_{2},\ldots,H_{n}\}\), in the proposed systems. Each hospital \(H_{i}(1\leq i\leq n)\) comprises of several entities, namely, IoT devices, clients, edge nodes, and cloud. The roles of each component are described below:

* _IoT devices:_ In the proposed framework, IoT devices are owned by a hospital \(H_{i}\). Each IoT device is integrated into a medical device and acts as a data source. IoT devices of \(H_{i}\) capture medical images and store them in a local dataset. For \(n\) hospitals, there are \(n\) local datasets.
* _Edge Data Server:_ An edge data server \(E_{Di}\) is an edge device owned by hospital \(H_{i}\) that stores local dataset generated by IoT devices of \(H_{i}\). Data in \(E_{Di}\) is considered private and cannot be shared with other hospitals to ensure privacy. For the sake of simplicity, we assume that each \(H_{i}\) owns a single edge data server \(E_{Di}\). Users from the same hospital are connected to the same edge data server, while users from different hospitals must be connected to different edge data servers. The data in the edge data server \(E_{Di}\) is used to train a model for the hospital \(H_{i}\) privately.
* _Private Edge Server:_ A private edge server \(E_{Si}\) is an entity that is locally owned by a hospital \(H_{i}\). The private edge server \(E_{Si}\) uses local dataset in \(E_{Di}\) to train an initial model \(M_{I}\) locally. \(E_{Si}\) gets an \(M_{I}\) from a trusted source called _trusted third party_. \(M_{I}\) is distributed among private edge servers \(\{E_{Si},E_{S2},\ldots,E_{Sn}\}\) of all hospitals to create their respective privacy-preserving training models.
* _Trusted Third Party:_ In our proposed framework, the trusted third party (TTP) is a secure cloud. TTP leverages a public dataset to train a model (i.e., \(M_{I}\)) using CNN based deep neural network. We discuss the detailed process later in this section.
* _Cloud:_ The cloud is a public entity that collects all locally trained models from all hospitals. The set \(M\) of locally trained models are represented as set \(\{M_{1},M_{2},\ldots,M_{n}\}\). The locally trained models are ensembled together to generate an aggregated model \(M_{\Sigma}\), which is then sent to all private edge servers for updating their respective local models.

## V Methodology

In this section, we discuss our proposed framework for privacy-preserving high-performing ensemble assisted DL with Transfer learning in edge cloud consortium. Our proposed architecture has three major steps. The first step includes generating an initial model from a public dataset. The second step is generating a locally trained model based on a local
dataset while preserving privacy. The final step ensembles all local training models to obtain an aggregated model. Each of the steps are discussed below.

### _Initial Training Model Generation_

The first step of the proposed framework is the generation of _initial model_\(M_{I}\) by a TTP. TTP takes a public dataset \(D_{pub}\) as input and applies Convolutional Neural Network (CNN)[29] to train \(M_{I}\). A typical CNN consists of three types of operation layers: _convolutional layer_ (CONV), _pooling layer_ (POOL), and flattening (FLAT) and fully connected layer (FC). The CONV layer consists of multiple sub-layers that are used for feature extraction. The POOL layer acts as the merging layer. In initial model generation, we use _max pooling_. The FLAT layer formats the extracted features to forward to the FC layer.

An overview of the initial model generation process is illustrated in Fig. 3. The process is summarized in Algorithm 1. In the initial model generation process, we use the Lung Cancer [30] public dataset that contains 15K 2D-images. Initial model training is performed by a trusted third party. TTP creates \(M_{I}\) with random parameter \(\theta\). During this process, TTP initializes the other model training parameters, such as the number of training epochs \(ep\) and batch size \(b\). In each epoch, TTP uses an optimizer to update parameters and a loss function to calculate how well the model is performing. We use the _Categorical Crossentropy_ function [31] as the loss function and the _Stochastic Gradient Decent (SGD)_[32] as the optimizer, which formula can be seen in Equation 3 and Equation 4 respectively.

\[l(y,\hat{y})=-\frac{1}{N}\sum_{i=0}^{N}\sum_{j=0}^{J}y_{j}\cdot log(\hat{y}_{ j})+(1-y_{j})\cdot log(1-\hat{y_{j}}). \tag{3}\]

Here, \(N\) is the number of data, \(j\) is the number of classes, \(y\) is a vector representing true label, and \(\hat{y}\) is a vector representing the probability of class prediction.

\[\theta_{t+1}=\theta_{t}-\eta_{t}\cdot\frac{1}{N}\sum_{i=1}^{N}\nabla_{\theta_ {t}}l(y_{i},\hat{y}_{i}), \tag{4}\]

where, \(t\) is the current step, \(\eta\) is the learning rate, and \(\nabla\) is the derivative with respect to every parameter.

\begin{table}
\begin{tabular}{l l} \hline \(H_{i}\) & Hospitals \\ \(E_{Di}\) & Edge Data Server \\ \(E_{Si}\) & Private Edge Server \\ \(M_{I}\) & Initial Model \\ \(M_{n}\) & Locally Trained Model \\ \(D_{pub}\) & Public Dataset \\ \(ep\) & Epochs \\ \(b\) & Batch Size \\ \(D_{label}\) & A Set of Labeled Data Partitions \\ \(\overline{y}\) & Prediction on Input Data \\ \(\mathcal{L}\) & Computed Loss \\ \(grad\) & Local Computed Gradient \\ \(DB_{Li}\) & Local Dataset owned by \(H_{i}\) \\ \(M_{Pi}\) & Locally Trained Private Model \\ \(mn\) & Noise Multiplier \\ \(nc\) & Clipping threshold \\ \(mb\) & Mini-batch Size \\ \(l\) & Layer Partition \\ \(L\) & Layers within CNN Model \\ \(\epsilon\) & Privacy Budget \\ \(\delta\) & Probability of Information Leakage \\  & Accident \\ \(M_{P}\) & Local Private Models \\ \(M_{E}\) & Ensembled model \\ \hline \end{tabular}
\end{table} TABLE I: Notations

Fig. 2: Overview of the proposed architecture
In the CNN-based training process, we first randomly sample data from \(D_{pub}\) using a function called \(trainLoader()\) according to the batch size \(b\) and results in multiple partition with labeled data \(D_{label}\). An element in \(D_{label}\), represented as \(D_{label}^{j}\), is a pair \(\{input_{j},label_{j}\}\). Here, \(input_{j}\) is an image with \(label_{j}\). Each partition holds \(b\) number of data which is feed into the initial model \(M_{I}\). Next, current prediction \(\overline{y}\) is computed for \(D_{label}^{j}\) using a function \(computePrediction()\). The prediction \(\overline{y}\) is then used to compute the loss \(\mathcal{L}\) of the model along with the true label of the input data using a function \(computeLoss()\). Further, we compute the gradient \(grad\) from the loss \(\mathcal{L}\) using a function \(computeGradient()\). Finally, the SGD parameters of the initial model \(M_{I}\) are updated using the function \(updateSGDParam()\) with the current \(grad\). Once the model is finalized, \(M_{I}\) is ready to be collected by any participants (i.e., hospitals) from TTP.

```
Input: Public dataset, \(D_{pub}\) Output: Initial public model, \(M_{I}\)
1 Initialization:
2 Initial CNN model, \(M_{I}=\emptyset\)
3 number of epochs, \(ep\)
4 Batch size, \(b\)
5 begin
6for each\(i\leq ep\)do
7\(D_{label}\gets trainLoader(D_{pub},b)\)
8for each\(\{D_{label}^{j}\}\in D_{label}\)do
9\(\overline{y}\gets D_{label}^{j}.computePrediction()\)
10\(\mathcal{L}\gets D_{label}^{j}.computeLoss(\overline{y})\)
11\(grad\gets D_{label}^{j}.computeGradient(\mathcal{L})\)
12\(M_{I}.updateSGDParam(grad)\)
13 endfor
14endForEach
15return\(M_{I}\)
16
17 end for
```

**Algorithm 1**Initial model training

### _Generating a Locally Trained Model with Privacy_

In this step, each participant (i.e., hospital) \(H_{i}\) generates a local training model \(M_{Li}\) at the private edge server \(E_{Si}\) from their local dataset \(DB_{Li}\). As \(DB_{Li}\) contains sensitive information, \(E_{Si}\) applies Differential Privacy (DP)-based privacy-preserving mechanism. An \(E_{Si}\) collects an initial model \(M_{I}\) from TTP and applies CNN with Transfer Learning (TL) approach to generate the local model. An overview of the process is illustrated in Fig. 4.

In our proposed training process (see Algorithm 2), we assume that there are \(p\) layers that are denoted as \(\{L_{1},L_{2},\ldots,L_{p-1},L_{p}\}\). Initially, \(E_{Si}\) freezes the last two layers (i.e., \(L_{p-1}\) and \(L_{p}\) ) of the initial model \(M_{I}\) and executes first \(p-2\) steps of CNN. We assume that the local model \(M_{Li}\) has a model parameter \(\theta_{i}\). To minimize the privacy leakage of \(\theta_{i}\), a differentially private SGD is applied which is named as DP-SGD [33] in the CNN layers. The _parameter update_ process in DP-SGD is similar to original SGD. Nevertheless, noise is added with the parameters to ensure the privacy of \(\theta_{i}\). Let, \(X\) is the set of private data such that \(X\subseteq DB_{Li}\). At first, a set \(\overline{X}\) of random data points of size \(m\) is selected from \(X\). The set of data points \(\overline{X}=\{x_{1},x_{2},\ldots,x_{m}\}\). Next, gradients are computed for each \(x_{k}\in\overline{X}(1\leq k\leq m)\) as follows:

\[g_{t}[x_{k}]=\nabla_{\theta_{k}}l(f(x_{k}),y_{k}), \tag{5}\]

where, \(t\) is the current step, \(\theta_{k}\) is the current state of the model parameter, \(\nabla\) is used to refer to the derivative with respect to every parameter, \(f(x_{k})\) is the model prediction with respect to input \(x_{k}\), \(y_{k}\) is the true label of input \(x_{k}\), and \(l()\) is the loss function. Finally, the gradients are used to update the model parameters.

To apply differential privacy during the local model training, DP-SGD uses a few additional steps after the gradient computation. The additional steps includes _gradient norm clipping_ and _noise addition_. The gradient norm clipping limits how each individual training point is sampled in a mini-batch and influences the resulting gradient computation. In DP-SGD, the gradient norm clipping can be calculated as follows:

\[g_{t}[x_{k}]=\frac{g_{t}[x_{k}]}{max[1,||g_{t}[x_{k}]||/nc]}, \tag{6}\]

where \(nc\) is the level 2 (L2) norm clip threshold. This threshold is to ensure \(L_{2}\)-sensitivity since the privacy guarantee in Gaussian mechanism requires that the noise vector standard deviation of each coordinate to scale linearly with the \(L_{2}\)-sensitivity of gradient estimate \(g_{t}[x_{k}]\)[34]. Noise addition step adds a noise to the clipped gradient to provide privacy to the model. DP-SGD uses Gaussian noise mechanism to calculate the noise, which can be shown using the following equation:

\[\xi_{t,i}\sim Norm_{\xi_{t,i}}[0,nm^{2}nc^{2}mb], \tag{7}\]

\[g_{t}[x_{k}]=\frac{1}{L}(\sum g_{t}[x_{k}]+[0,nm^{2}nc^{2}mb]) \tag{8}\]

where \(nm\) is a noise multiplier value, and \(mb\) is mini-batch size.

The last two layers of the CNN model produced by this training process are then removed to produce a differentially private model \(M_{Pi}\) of the private edge server \(E_{Si}\) for the hospital \(H_{i}\). This allows the output of each private model to be averaged together and produce an ensembled output to be

Fig. 3: Generation process of Initial Model by Trusted-Third Party
fed as an input to the last two layers of the initial model \(M_{I}\). \(E_{Si}\) sends \(M_{Pi}\) to cloud for ensemble.

```
Input: Initial public model \(M_{I}\), Local data \(DB_{Li}\) of \(E_{Si}\) Output: Local private model of \(E_{Si}\), \(M_{Pi}\)
1 Initialization: Noise multiplier, \(nm\)
2 Clipping threshold, \(nc\)
3 Min-batch size, \(mb\)
4 layer partition, \(l\)
5 Number of epochs, \(ep\)
6 Set of layers, \(L=\{L_{1},L_{2},\ldots,L_{p}\}\)
7
8begin
9for each\(e\in ep\)do
10\(\overline{X}\gets trainLoader(DB_{Li},mb)\)
11foreach\(L_{j}>(p-2)\)do
12\(M_{I}.freeze(L_{j})\)
13 endforEach\(x_{i}\in\overline{X}\)do
14\(\overline{y}\gets computePrediction(x_{i})\)
15\(\mathcal{L}\leftarrow l(\overline{y},M_{I}.labels)\)
16\(grad\leftarrow computeGradient(\mathcal{L})\)
17\(M_{Pi}.updateSGDParameter(grad)\)
18 endforEach
19
20 endfor
21return\(M_{Pi}\)
22
23 endfor
```

**Algorithm 2**Generating local private model \(M_{Pi}\)

### _Ensembled Model Generation from Local Private Models_

The ensembled model construction is the final step of the proposed method. This step is performed by a public cloud when all local private models are received. The set of all differentially private models are represented as: \(M_{P}=\{M_{P1},M_{P1},\ldots,M_{Pn}\}\), where \(n\) is the hospital id. To aggregate the model, a Bootstrap Aggregation or BAGGing [35] based ensemble averaging technique is used (see Fig. 5). The averaging function denoted as \(\bar{X}\), takes \((p-2)\)-th layers output of local private models as input. The operation of \(\bar{X}\) can be expressed as:

\[\bar{X}=\frac{1}{n}\sum_{k=1}^{n}z_{ik}, \tag{9}\]

where \(n\) is the number of private models, and \(z_{ik}\) is a specific \(z\) value in the \(i\)th position within an output vector. Next, the results are fed as an input to the last two layers (\(L_{p-1}\) and \(L_{p}\)) of the initial model \(M_{I}\). Finally, we get the ensembled model \(M_{E}\) which is distributed to all private edge servers.

```
Input: Set of local private models, \(M_{P}=\{M_{P1},M_{P1},\ldots,M_{Pn}\}\) Initial model, \(M_{I}\) Output: Ensembled model, \(M_{E}\)
1 Initialization: Ensembled model, \(M_{E}\leftarrow\emptyset\)
2 Vector of \((p-2)\) layer values \(z\leftarrow\emptyset\)
3foreach\(M_{Pi}\in M_{P}\)do
4 z.add(\(M_{Pi}.getValues(L_{p-2})\))
5 endforEach
6\(avg=computeAvg(z)\) using Eq. (9)
7\(M_{E}\gets generateModel(avg)\)
8// Add the last two layers for prediction
9\(M_{E}.addLayer(L_{p-1})\)
10\(M_{E}.addLayer(L_{p})\) return\(M_{E}\)
```

**Algorithm 3**Ensemble model construction

## VI Results and Discussion

In this section, we provide information on the experimental setup used. Then, we perform experiments on MNIST and Lung Cancer datasets to evaluate the model performance of our scheme.

### _Experimental Setup_

#### Vi-A1 Testing Environment

We used AWS Sagemaker for our experiment. We chose AWS g4dn.2xlarge machines, which contain 1 NVIDIA T4 GPU with 16 GB GPU memory and 32 GB RAM. The experiments were carried out using Python version 3.7.

#### Vi-A2 Datasets

For all experiments, we consider five clients participating in the training process. The training datasets and models are defined as follows:

* **MNIST**. MNIST dataset is a 28 \(\times\) 28 multi-class handwritten digits consisting of numbers ranging from 1 to 10. The dataset consists of 70,000 images with training

Fig. 4: Local model transfer and private model training

Fig. 5: Ensemble assisted aggregated model generation
and testing datasets combined. For MNIST dataset experiment, we consider a CNN model as shown in Figure 6.
* **Lung and colon cancer**. Lung and colon cancer dataset retrieved from [30] consists of 768 \(\times\) 768 images from five classes (lung_n, lung_scc, lung_aca, colon_n,colon_aca). Each class consists of 5000 images. In this experiment, we are using three classes out of the five classes, which are lung_n, lung_scc, and lung_aca. The CNN model we use for the Lung Cancer dataset is shown in Figure 7. Data in our experiment is divided into four different parts as shown in Figure 8. We partition our data by assuming a real-world scenario. Validation data is a data partition to represent any unforeseen or future data to be predicted. This partition will be used to test our initial public model and the final ensemble model. Public training data is used to train our initial public model. Its size is set to be smaller than other partitions. Private training data represents the data held by private institutions. This data is used to train our private model. On the other hand, the private test data will be used to test the privately trained model. In order to simplify our experiment, the same data partition sizes will not be changed unless stated otherwise. During our experiments with MNIST dataset, validation data, public data, private training data, and private test data are set to be 28000, 420, 6653, and 1663 respectively. For Lung Cancer dataset, validation data, public data, private train data, and private test data are set to 6000, 90, 1426, and 356, respectively.

### _Results Analysis_

For our experiment of results analysis, we first observe the effect of public data size used to train the initial public model towards the private model training accuracy. In Fig. 9 and Fig. 10, we use different number of public data size to train our initial public model.

Figure 9 shows the experiments using the MNIST dataset. we use four settings on the public and private datasets. The size of public and private data used for training is defined as follows: (a): 42 public data and 6713 private data; (b): 210 public data and 6687 private data; (c): 420 public data and 6653 private data; (d): 2100 public data and 6384 private data. For the model training configuration setup, the MNIST dataset is trained in 60 epochs, and the batch size is set to 250. In regards to privacy preservation parameter, we set the clipping threshold value to 1.5

Figure 10 shows the experiments for Lung Cancer dataset. We also used four different settings. The size of public and private data used for training is defined as follows: (a): 9 public data and 1439 private data; (b): 45 public data and 1433 private data; (c): 90 public data and 1426 private data; (d): 450 public data and 1368 private data. For the model training configuration setup, the Lung Cancer dataset is trained in 200 epochs, and the batch size is set to 18. The clipping threshold value used for Lung Cancer dataset experiment is 1.0

As can be seen in both figures, the increase of public data size increases private model accuracy. However, the growth of private model accuracy becomes less significant as the initial public model performance increases.

Next, we tried to observe the effect of the noise multiplier on the private model training from the two datasets. Fig. 11 shows the experiment of using 0.9, 1.1, 1.3, and 1.5 noise multipliers on MNIST dataset. Results show that there is no significant difference between the four cases. We employ the same configuration for its noise multiplier for Lung Cancer dataset. Compared to MNIST dataset, the increase of noise in Lung Cancer dataset results in dispersed accuracy on each private model (see Fig. 12).

We summarise our experiments in Table II and Table III. Table II exhibits a summary of model performance on MNIST

Fig. 6: CNN model for MNIST

Fig. 7: CNN model for Lung Cancer
dataset when the initial model is trained with 0.001 learning rate and private model with 0.15 learning rate. Table III presents the summary of model performance on Lung Cancer dataset when the initial model is trained with 0.001 learning rate and private model with 0.015 learning rate.

From Table II, it can be seen that the final ensemble model accuracy tends to provide accuracy higher than the average of all private models accuracies. However, when the \(\epsilon\) value is 1.9, the ensemble model accuracy remains the same as the average of all private models' accuracy.

While slight improvement can be seen on the final ensembled model in Table II, a more significant accuracy improvement on the final ensemble model can be seen on the Lung Cancer dataset (see Table III), specifically when the value of \(\epsilon\) is 1.7, improvement of final model accuracy reaches up to 1.7, which is 1.7, which is 1.
10 percent from the private model accuracy. However, despite having a significant improvement on final model accuracy, when the noise is big enough, the performance of the private model lies below the initial model accuracy.

Finally, we compare our proposed method's performance with the existing methods, TrPATE [18] and COFEL [36] on MNIST dataset to prove the effectiveness of our strategy. For comparison, we use the same model configurations provided in the paper. The results are summarised in Table IV. As can be seen from the table, our method outperformed the other existing method even for a smaller value of \(\epsilon\).

## VII Conclusion

This paper proposes an ensemble and transfer learning infused framework for privacy-preserving DNN model generation in IoT, edge, and cloud convergence. Differential Privacy is used to add noise in the local model to ensure privacy of the model. As adding noise to the model significantly reduces the model performance, Transfer Learning is used with CNN to reduce the loss and improve the efficiency of the local model. The proposed framework involves multiple participants. Hence, local models from different participants are ensembled at the cloud to generate a collective learning model, called the final model, to ensure higher prediction accuracy. From our experiment, we demonstrated that transferring the knowledge of public data in ensemble learning enhances the accuracy of the final model. The effectiveness of our model has been compared against state-of-the-art methods such as TrPATE and COFEL. Experimental results show that our method outperformed the existing work. In this article, we assume that all participants use the same knowledge domain. Further research should also investigate the performance while transferring knowledge from different domains.

## Acknowledgement

This work is supported by the Australian Research Council Discovery Project (DP210102761).
