As artificial intelligence becomes increasingly integrated into sectors such as healthcare, finance and government, organizations face a critical challenge: how to use powerful machine learning tools without compromising confidential data.
At the University of Maryland, fifth-year computer science doctoral student Yvonne Zhou is developing a new framework designed to bridge the gap between privacy-preserving theory and practical, real-world performance. Her work focuses on protecting sensitive information throughout the machine learning pipeline—from the moment data is sent to a cloud server through deployment of the final model.
“Many organizations don’t have the computational resources to train large models themselves and therefore need to outsource training to cloud providers,” Zhou said. “The challenge is how to take advantage of external computing power without exposing private data.”
Zhou’s research addresses what experts consider a major bottleneck in privacy-preserving AI. Existing cryptographic techniques such as fully homomorphic encryption (FHE) allow cloud servers to train models using encrypted data, enabling computation without revealing the underlying information. But the process is notoriously slow and computationally expensive, and it protects data only during training. Once a model is decrypted and deployed, it can still leak sensitive information.
To address this limitation, Zhou developed a framework that combines the rigorous theoretical guarantees of FHE with a customized differential privacy algorithm, which introduces carefully calibrated random noise to help prevent sensitive information from being exposed.
“Together, FHE protects data during outsourced training, while differential privacy protects against information leakage after deployment,” Zhou explained. “In other words, our framework provides end-to-end privacy guarantees.”
A key breakthrough was overcoming the enormous computational cost of combining these two techniques. By developing a new training algorithm that eliminates a particularly expensive computational step, Zhou’s framework achieved up to a 15-fold reduction in training time while maintaining accuracy comparable to significantly slower approaches.
The findings are described in a paper recently presented at the International Conference on Machine Learning (ICML) in South Korea. The work is part of an ongoing collaboration supported by a J.P. Morgan Chase Faculty Research Award and reflects the university’s commitment to working with industry to solve pressing real-world challenges.
“Their research team has a strong interest in privacy-preserving machine learning, so the collaboration brings together academic and industry perspectives on these challenges,” Zhou said. “Although encrypted machine learning is still significantly more expensive than conventional training, improving its efficiency is an important step toward making these technologies practical for applications where trust and confidentiality are essential.”
Zhou's research is co-advised by Dana Dachman-Soled, an associate professor of electrical and computer engineering and a core member of the Maryland Cybersecurity Center, and Min Wu, a professor of electrical and computer engineering. Both hold appointments in the University of Maryland Institute for Advanced Computer Studies (UMIACS).
Dachman-Soled said Zhou quickly mastered entirely new areas while working on the project. Despite having no previous background in fully homomorphic encryption or C++, she was implementing complex encrypted training pipelines within months.
"Beyond her technical abilities, she has consistently demonstrated exceptional initiative and persistence, making her an outstanding researcher and an invaluable member of the team," Dachman-Soled said.
Wu said Zhou's work tackles one of the central challenges in trustworthy AI: balancing strong privacy guarantees with practical performance.
"By combining rigorous theory with algorithmic innovation, she has developed an approach that makes secure machine learning substantially more practical while maintaining strong privacy protections," Wu said.
While the current paper focuses on foundational models that establish rigorous mathematical guarantees, Zhou sees it as an important first step. The team’s next challenge is extending these methods to the deep neural networks that power today’s most advanced AI systems.
“I’m excited to continue exploring how we can make privacy-preserving machine learning both theoretically well-founded and practically useful for the large-scale AI systems that people rely on every day,” Zhou said.
—Story by Diya Sharma, UMIACS communications group