PRIVACY · COMPUTATION · EDGE INTELLIGENCE
Adaptive Privacy-Preserving
Machine Learning
for Resource-Constrained
Edge Intelligence
Quoc Lap Trieu
Supervisors: A/Prof. Bahman Javadi · Jim Basilakis
Thesis draft snapshot · 6 November 2026
01 / MOTIVATION
Intelligence is moving closer to the data.
But the device, network and computation budget do not disappear.
Personal sensing
Inference inputs may be sensitive.
Distributed edge
Devices share heterogeneous resources.
Real-time decisions
Communication and delay shape usefulness.
The question is not just can we protect inference? but at what cost and under which assumptions?
01 / MOTIVATION
Three constraints pull in different directions.
Training-record privacy, runtime input confidentiality and permitted disclosure are different requirements.
Numerical precision, splitting, and protocol choices can change output quality or exposure.
Compute time, communication, queueing and energy matter on heterogeneous edge hardware.
Protection requirements come first. Then optimise within the valid deployment choices.
02 / THESIS ROADMAP
One thesis. Three research questions.
Evidence → workload-level optimisation → protocol and party-level optimisation
Understand the trade-offs
Compare evaluated DP, FHE and SMC paths in the context of edge requirements.
Empirical foundationReduce execution cost
Numerics, preprocessing, model partitioning and request scheduling.
Time-series workloadsImprove secure interaction
Fused non-linear operators and straggler-aware party selection.
Vision workloads03 / RESEARCH QUESTION 1
Privacy mechanisms protect different assets.
A fair comparison starts with what each mechanism promises.
Differential privacy
Bounds training-record influence when implemented and accounted for appropriately.
Homomorphic encryption
Computes over ciphertext under compatible schemes and operational constraints.
Secure multiparty computation
Computes collectively using protected shares under a specified party and adversary model.
There is no mechanism-independent winner.
03 / RESEARCH QUESTION 1
An empirical foundation for edge decisions.
Measure before selecting.
Evaluate configurations using accuracy, response time and resource demands.
Distinguish physical measurements from trace-driven simulation.
Interpret each result under its mechanism, workload and trust assumptions.
Source: Thesis, RQ1 architecture · Figure source retained from local manuscript
03 / RESEARCH QUESTION 1
The central insight: requirements decide feasibility.
Define the protected asset
Training records, live inputs or permitted representations?
Filter eligible configurations
Trust boundary, supported operations and security parameters.
Measure application cost
Accuracy, latency, payload, energy and hardware fit.
04 / RESEARCH QUESTION 2
Optimise what the secure model does.
RQ2 reduces distinct costs at the data, model and system layers.
Numerical selection
Accuracy-constrained bit width and precision
Preprocessing
Fresh, single-use Beaver triples
Model splitting
Secure prefix and permitted plaintext suffix
Request scheduling
Resource-aware party selection
04 / RESEARCH QUESTION 2
Large savings in specified comparisons.
reduction in the highlighted main-study comparison
reduction reached in the specified simulation comparisons
These are comparison-specific, not guarantees across all models, networks or privacy requirements.
04 / RESEARCH QUESTION 2
Splitting a model also moves the trust boundary.
SMC prefix
Secure multi-party computation
Plaintext suffix
Lower secure-compute cost
Faster does not automatically mean the same information is hidden.
05 / RESEARCH QUESTION 3
Go deeper: optimise secure interaction itself.
Non-linear operators and synchronisation are expensive in multi-party inference.
CONVENTIONAL SECURE EXECUTION
SMCMUX OPTIMISATION
non-linear execution
05 / RESEARCH QUESTION 3
Protocol optimisation produces measured gains.
mean secure-inference latency reduction across 16 reported configurations
maximum reduction within those configurations
The figure illustrates a subset of model and workload cases. Results depend on configuration and baseline.
Source: Thesis, RQ3 performance evaluation · ResNet18 original figure
05 / RESEARCH QUESTION 3
In synchronised SMC, one slow party matters.
Synchronised parties
The slowest required participant can dominate group completion time.
SMCHDP placement
Uses a hierarchical, resource-aware party-selection heuristic in evaluated trace-driven simulations.
Interpret with care
Scheduling gains are separate from reduced per-inference protocol cost.
06 / APPLICATION CASE STUDY
From research components to face detection.
Annotated Faces in the Wild (AFW) images
annotated faces, matched using IoU ≥ 0.5
Paired CPU evaluation. The aggressive split exposes intermediate representations to both parties.
Source: Thesis, Applied Case Study · conceptual diagram
06 / APPLICATION CASE STUDY
The detector gets faster. But look at the baseline.
Mean detector-call time · 205 paired AFW images · WSL CPU
Faster than direct 64-bit SMC
Arithmetic-mean ratio. Still much slower than plaintext inference.
Source: Thesis case study, full 205-image benchmark · Linear relative bar scale; plaintext minimum bar is enlarged for visibility
06 / APPLICATION CASE STUDY
Performance gains have a quality price.
Precision
Fewer false positives
Recall
More missed faces
F1 score
Overall reduction
Lower latency must be weighed against missed detections and exposed features.
Source: Thesis case-study quality table · 468 annotations · one-to-one IoU ≥ 0.5
07 / INTERPRETATION
The strongest result is one that states its limits.
Threat model
SMC guarantees depend on specified parties and semi-honest execution assumptions.
Distinct evaluation boundaries
Physical measurements, trace-driven scheduling and application-level CPU timings are not interchangeable.
Disclosure and accuracy
A secure prefix with opened features does not provide end-to-end hidden representations.
No additive headline speedup
RQ2, RQ3 and the case study use different workloads and baselines.
08 / CONTRIBUTIONS
What this thesis adds.
Evidence before optimisation
A mechanism-aware evaluation foundation that connects protection assumptions with edge resource costs.
SMC workload-level techniques
Accuracy-bounded numerics, fresh preprocessing, authorised model partitioning and adaptive request scheduling.
SMC protocol and placement techniques
Non-linear execution optimisation and straggler-aware party selection, evaluated on vision workloads.
Application-level trade-off evidence
A complete paired AFW face-detection analysis showing both substantial latency gains and measurable quality/disclosure costs.
THANK YOU
Privacy should define
the design.
Efficiency should make
it practical.
Questions & discussion
Quoc Lap Trieu · Western Sydney University