However,untrusted data sources leavethe services vulnerable to poisoning attacks [5, 28], where adversaries can inject malicious training data to degrade model accuracy.

Wetransform our bound into adifferentiable training objective. Our bound is especially useful in cases where the severity of different mis-classifications may change overtime; existing PAC-Bayes bounds canonly bound aparticular pre-decided weighting oftheerror types.

IntheHE-based MLaaSsetting,aclientencrypts thesensitive data, and uploads the encrypted data to the server that directly processes the encrypted data without decryption, and returns the encrypted result to the client. The client'S data privacy is preserved since only the client has the private key. Existing HE-enabled Neural Networks (HENNs), however, suffer from heavy computational overheads.