Privacy-Preserving Offloading Framework

• Privacy-preserving offloading frameworks are architectures that securely transfer compute-intensive tasks to external resources while protecting sensitive inputs, model parameters, and execution patterns.
• They employ diverse techniques such as SGX enclaves, additive masking, homomorphic encryption, and differential privacy to mitigate risks in untrusted environments.
• Empirical evaluations show significant latency reductions and speed-ups, though the benefits often come with trade-offs like increased overhead from encryption, masking, and verification.

A privacy-preserving offloading framework is a computational architecture that transfers latency- or compute-intensive work to an external device, cloud service, edge server, accelerator, or cooperative worker while constraining what the offloading party, the transport path, and other observers can learn about sensitive inputs, model parameters, intermediate states, outputs, service choices, or execution patterns. Across the literature, this objective appears in encrypted photo search for mobile devices, trusted-execution deployment of unmodified PyTorch workloads in untrusted clouds, enclave-mediated GPU offloading for robust federated learning, additive-masking schemes for IoT inference, split computing for generative models, and domain-specific partitioning for VR avatar reconstruction (Zhang et al., 2014, Lee et al., 2020, Hashemi et al., 2021, Zhang et al., 2024, Ohta et al., 2023, Tong et al., 19 Apr 2026).

1. Architectural forms and deployment patterns

Privacy-preserving offloading does not denote a single system shape. The surveyed frameworks instantiate several recurring topologies. In the SGX-based cloud design of "Privacy-Preserving Machine Learning in Untrusted Clouds Made Simple" (Lee et al., 2020), the system splits into four logical domains: Client / Key Server, Untrusted Cloud Host, Graphene Library OS, and Intel SGX Enclave. In VeriSplit, the main roles are the Offloading Device, Worker(s), and an optional Trusted Pre-Processor (Zhang et al., 2024). In $\Lambda$-Split, the model is divided into three sub-models, with the input-side and output-side sub-models on the local device and the intermediate sub-model on the cloud server (Ohta et al., 2023). In the distributed ViT framework for SAM, a trusted Edge Orchestrator partitions input images and dispatches sub-images to multiple independent cloud servers before merging embeddings locally (Ding et al., 10 Dec 2025).

Other frameworks place the privacy boundary around a different object. OPE for photo sharing and search separates Mobile Clients, a Sharing Cloud, a Search Cloud, and a Trusted Authority, so that public bags, private bags, and search bags are distributed across different services (Zhang et al., 2014). DarKnight places a TEE between a client and multiple untrusted GPU workers, with the TEE handling decryption, encoding, decoding, and non-linear DNN operations while GPUs perform linear operations (Hashemi et al., 2022). Privatar offloads avatar reconstruction from a headset to untrusted devices within the same local network, but only after frequency-domain decomposition and selective offloading of low-energy components (Tong et al., 19 Apr 2026).

A compact way to view the design space is to distinguish the object being protected and the place where trust is concentrated.

Framework	Offloaded target	Primary protection locus
SGX + Graphene (Lee et al., 2020)	Unmodified PyTorch inference	SGX enclave
FedML TEE offloading (Hashemi et al., 2021)	Pairwise-distance computation for Multi-Krum	TEE + encoded GPU offload
VeriSplit (Zhang et al., 2024)	IoT inference layers	Additive masks + commitments
$\Lambda$-Split (Ohta et al., 2023)	Generative model middle layers	Hidden representations
Privatar (Tong et al., 19 Apr 2026)	Avatar reconstruction tail components	Frequency partition + noise

Taken together, these systems suggest that privacy-preserving offloading is best understood as a family of decomposition strategies rather than as one protocol template. Some frameworks protect raw data by never transmitting it; some protect it by encryption; some protect only masked or transformed representations; and some additionally anonymize the computational fingerprint itself (Azad et al., 2023).

2. Threat models, trust assumptions, and security objectives

The literature adopts heterogeneous adversary models. In the SGX-cloud framework, the trusted components are SGX microcode, SGX SDK, Graphene LibOS, and the ML application binary, whereas the cloud OS, hypervisor, storage, network, and any privileged or malicious software on the VM are untrusted; the adversary seeks to steal model parameters or to steal or tamper with inputs and outputs (Lee et al., 2020). In the FedML framework, clients may be Byzantine, the server and GPUs are semi-honest, and the GPUs are assumed not to collude with the server while pairwise-distance computations are offloaded (Hashemi et al., 2021). VeriSplit explicitly assumes that Worker(s) may be honest-but-curious or malicious, and that two different workers do not collude when model confidentiality is enabled (Zhang et al., 2024).

Several systems also broaden the privacy target beyond raw data confidentiality. Camouflage addresses an adversary whose goal is to identify which computation a victim is offloading from observable execution fingerprints such as CPU utilization, memory usage, wall-clock execution time, input and output sizes, and network I/O patterns (Azad et al., 2023). The MEC and satellite-terrestrial DRL frameworks define privacy partly in terms of usage-pattern privacy and location privacy, rather than cryptographic secrecy of content (Nguyen et al., 2019, Lan et al., 2023). SA$^2$FE introduces user anonymity, service-type confidentiality, financial accountability, and fairness among candidate edge servers, with honest-but-curious FA and SP and locally untrusted BS, ES, and users (Wang et al., 28 Apr 2025). SEAL similarly combines privacy with strategy-proofness and fairness in UAV-to-vehicle offloading (Wang et al., 2023).

A common misconception is that privacy-preserving offloading always provides the same guarantee. The papers show the opposite. Some systems claim semantic-security-style confidentiality for ciphertexts and encrypted queries (Zhang et al., 2014); some claim that model parameters, inputs, and outputs are only ever in plaintext inside an enclave (Lee et al., 2020); some rely on non-collusion or semi-honest behavior (Zhang et al., 2024, Ding et al., 10 Dec 2025); and some state explicit limitations, such as the fact that DarKnight does not protect against SGX side-channel attacks (Hashemi et al., 2022). This suggests that any technical reading of a privacy-preserving offloading framework must begin with its trust partition and failure assumptions, not with the mere presence of encryption or masking.

3. Confidentiality mechanisms and leakage control

The confidentiality layer ranges from conventional authenticated encryption to homomorphic encryption, masking, splitting, and representation obfuscation. In the SGX-cloud design, the client encrypts model.bin and input.dat under a symmetric key $k$, uploads ciphertexts to untrusted cloud storage, performs remote attestation with the enclave, and provisions $k$ only after successful attestation. Graphene’s Protected FS then transparently applies AES-GCM decryption and encryption, and all persistent or networked data is AES-GCM–encrypted under $k$ (Lee et al., 2020). The notation is explicit: $c=\mathsf{Enc}_k(m)$, $m=\mathsf{Dec}_k(c)$, and $\tau=\mathsf{Tag}_k(c)$.

FedML uses a different strategy because the offloaded object is not a model input but a client gradient. Each client encrypts its gradient as $c_i=\Enc_{k_i}(\nabla W_i)$ and sends it to the TEE. Inside the enclave, the gradient is decrypted and transformed into two noisy shares, $\Lambda$0 and $\Lambda$1, where the random vectors satisfy $\Lambda$2 for all $\Lambda$3. This preserves the relative ordering of pairwise distances after decoding, so Multi-Krum can operate on GPU-computed partial distances while raw gradients remain confined to the TEE (Hashemi et al., 2021). The same paper gives an information-theoretic leakage bound:

$\Lambda$4

VeriSplit uses one-time additive masks for data privacy and two-party mask splitting for model confidentiality. The input masking rule is

$\Lambda$5

with the IoT device precomputing $\Lambda$6 offline. To hide model parameters from any single worker, it constructs

$\Lambda$7

and similarly splits $\Lambda$8 with $\Lambda$9, then recombines worker outputs on-device (Zhang et al., 2024). The framework also states an $^2$0-masking success bound:

$^2$1

Other frameworks operate on more structured objects. OPE combines CP-ABE, Paillier homomorphic encryption, oblivious transfer, and garbled circuits so that the search cloud computes encrypted distances over outsourced image descriptors while the sharing cloud stores only protected image material (Zhang et al., 2014). In CKKS-enabled IoV federated learning, a vehicle encrypts both the offloaded subset $^2$2 and local model updates, and the centralized server trains and aggregates on ciphertexts using $^2$3, $^2$4, $^2$5, and $^2$6 without decryption (Manh et al., 2024). $^2$7-Split does not encrypt raw inputs at the algorithmic core; instead it transmits only hidden representations $^2$8 and $^2$9, arguing that reconstruction of $k$0 or $k$1 from these hidden layer outputs is difficult because of the black-box nature of deep neural networks (Ohta et al., 2023). Privatar uses frequency-domain decomposition and offloads only low-energy components, then adds Distribution-Aware Minimal Perturbation by solving

$k$2

with anisotropic Gaussian noise calibrated from the covariance of the offloaded latent code (Tong et al., 19 Apr 2026).

These mechanisms imply a broad confidentiality spectrum. At one end are schemes where the server sees only ciphertext. At the other are schemes where the server sees transformed intermediates whose privacy depends on non-invertibility, masking, or low-information partitions. The design choice is typically driven by the target workload and by whether floating-point accelerators, legacy binaries, or interactive latency must be preserved (Zhang et al., 2024, Ohta et al., 2023).

4. Integrity, attestation, verification, and fair exchange

Confidentiality is only one axis. Many frameworks explicitly add integrity or accountability because offloading introduces opportunities for tampering, result forgery, selective omission, and unfair payment. In the SGX-cloud framework, integrity is provided by AES-GCM authenticity tags and by Graphene’s Protected FS, which uses a Merkle tree so any modification to ciphertext or filesystem metadata is detected. Remote attestation ensures that the client provisions $k$3 only after verifying the enclave measurement (MRENCLAVE) and platform certificate (Lee et al., 2020).

FedML ties integrity to attested aggregation logic: the enclave is attested by clients, only verified aggregation code runs inside it, and the two-share encoding preserves the relative ordering of pairwise distances so that Multi-Krum picks the same correct outliers after GPU offloading (Hashemi et al., 2021). DarKnight goes further and states two formal security definitions: perfect data privacy, expressed as $k$4 for any subset of at most $k$5 colluding GPUs, and $k$6-Integrity, meaning that redundant equations allow the TEE to detect mis-computations even if $k$7 GPUs collude or send arbitrary results (Hashemi et al., 2022).

VeriSplit introduces a commitment-based verification protocol centered on a Merkle-tree style commitment over intermediate layer activations. The worker returns $k$8; later, the IoT device selects a random subset of layers or output units, requests the corresponding activations and Merkle proofs, recomputes them locally, and checks consistency with the stored commitment. Its $k$9-partial verification theorem states that if the worker corrupts at least $k$0 outputs each inference, then the probability that $k$1-verification goes undetected in $k$2 independent inferences is

$k$3

(Zhang et al., 2024)

A distinct line of work treats integrity as an economic and protocol-level fairness problem. SEAL uses a strategy-proof reverse combinatorial auction, trusted execution for private bid handling, and a smart-contract-based fair exchange with deposits and hashchain micropayment so that vehicles cannot profit by misreporting and neither side can safely defect during multi-round result/payment exchange (Wang et al., 2023). SA$k$4FE combines rerandomizable puzzles with blind tokens to protect service-type confidentiality, preserve user anonymity, prevent double spending, and ensure usage accountability, and states security under the Universal Composability framework (Wang et al., 28 Apr 2025).

This body of work shows that “privacy-preserving offloading” often subsumes a larger notion of trustworthy delegation. Privacy without verifiability may leave the offloader unable to detect skipped computation, and confidentiality without accountability may still leak strategic behavior through settlement or scheduling metadata.

5. Optimization, decision-making, and privacy–utility trade-offs

A separate research direction formulates privacy-preserving offloading as an optimization or control problem. In mobile blockchain, offloading and privacy preservation are modeled as a Markov decision process whose reward combines privacy level, computation cost, and mining profit. The privacy metric decomposes into usage-pattern privacy,

$k$5

and location privacy,

$k$6

with combined privacy $k$7 (Nguyen et al., 2019). The integrated satellite-terrestrial work adopts a similar dual privacy notion and uses PPO to choose task order, destination satellite, and padding action under time, energy, reliability, and privacy constraints (Lan et al., 2023).

Differential privacy appears in offloading policy design as well. DP-DQO adds Gaussian noise after the DQN output layer through a Function-output Gaussian process mechanism and calibrates the noise level by

$k$8

so that observed offloading actions reveal less about edge-server queue patterns and user usage patterns (Gan et al., 2023). The 6G vehicular LLM framework applies gradient clipping with threshold $k$9, Gaussian noise with $k$0, and a privacy-aware task-partitioning objective over local-vs-edge split variables $k$1 (Badidi et al., 30 Aug 2025). The location-privacy study based on geo-indistinguishability models obfuscated location reports with the planar Laplace mechanism and quantifies their effect on acceptance ratio, latency, and QoE (Esper et al., 2023).

Camouflage addresses a different optimization surface: the attacker’s ability to classify the computation being offloaded. Remodeling pads inputs and outputs and inserts dummy nodes; Mixing interleaves multiple computation DAGs; Hybrid combines both. The anonymization level $k$2 and batch size $k$3 tune the trade-off between reduced top-1 classification accuracy $k$4 and overheads (Azad et al., 2023). This suggests that privacy-preserving offloading is not limited to content secrecy: pattern privacy and workload indistinguishability are also first-class optimization objectives.

A recurring theme is that stronger privacy almost always consumes another resource. The cost may appear as extra latency, larger communication volume, more local preprocessing, reduced acceptance ratio, lower utility, or stronger hardware assumptions. The frameworks differ mainly in which variable they hold fixed.

6. Empirical performance, limitations, and recurring open issues

Reported empirical results show that privacy-preserving offloading can be practical, but the gains and costs depend strongly on the mechanism. FedML reports that, for CIFAR-10 training with $k$5 clients on an SGX-capable Xeon CPU and two GTX1080Ti GPUs, SGX pairwise-distance time is about $k$6 s per round while each GPU takes about $k$7 s, yielding about $k$8 speed-up for distance computation and about $k$9 speed-up in end-to-end training epoch time from about $c=\mathsf{Enc}_k(m)$0 s/epoch to about $c=\mathsf{Enc}_k(m)$1 s/epoch (Hashemi et al., 2021). VeriSplit reports that, compared to performing computation locally, its secure and private offloading solution can reduce inference latency by $c=\mathsf{Enc}_k(m)$2--$c=\mathsf{Enc}_k(m)$3; the detailed prototype results include ViT-L/16 local latency of $c=\mathsf{Enc}_k(m)$4 s versus $c=\mathsf{Enc}_k(m)$5--$c=\mathsf{Enc}_k(m)$6 s for privacy + confidentiality + integrity, and VGG16 local latency of $c=\mathsf{Enc}_k(m)$7 s versus $c=\mathsf{Enc}_k(m)$8 s for integrity-only offload (Zhang et al., 2024).

DarKnight reports large accelerator-mediated gains over enclave-only execution: for training, VGG16 obtains $c=\mathsf{Enc}_k(m)$9 non-pipelined speedup and up to $m=\mathsf{Dec}_k(c)$0 linear-op speedup, with pipelined execution reaching up to $m=\mathsf{Dec}_k(c)$1 linear and about $m=\mathsf{Dec}_k(c)$2 end-to-end speedup; for inference, VGG16 reaches $m=\mathsf{Dec}_k(c)$3 speedup and MobileNetV1 reaches $m=\mathsf{Dec}_k(c)$4 (Hashemi et al., 2022). The distributed SAM framework reports that PED-SAM with $m=\mathsf{Dec}_k(c)$5 offload maintains mIoU $m=\mathsf{Dec}_k(c)$6 versus baseline $m=\mathsf{Dec}_k(c)$7 and reduces Jetson Nano CPU edge encoder latency from $m=\mathsf{Dec}_k(c)$8 ms to $m=\mathsf{Dec}_k(c)$9 ms, while on Jetson AGX GPU the same split increases latency by $\tau=\mathsf{Tag}_k(c)$0 because communication overhead outweighs parallelism gains (Ding et al., 10 Dec 2025). Privatar reports support for $\tau=\mathsf{Tag}_k(c)$1 more concurrent users at $\tau=\mathsf{Tag}_k(c)$2 higher reconstruction loss and $\tau=\mathsf{Tag}_k(c)$3 energy overhead on Meta Quest Pro, while reducing empirical posterior success rate for expression identification to approximately random guess (Tong et al., 19 Apr 2026).

In encrypted or differentially private federated settings, utility losses are often modest but measurable. The CKKS-enabled IoV FL framework reports that the maximum accuracy gap between N-EncFL and EncFL is $\tau=\mathsf{Tag}_k(c)$4, and for most cases under $\tau=\mathsf{Tag}_k(c)$5, with encrypted training time about $\tau=\mathsf{Tag}_k(c)$6 that of the non-encrypted offloading baseline (Manh et al., 2024). The 6G vehicular DP-FL framework reports $\tau=\mathsf{Tag}_k(c)$7 global accuracy, only a $\tau=\mathsf{Tag}_k(c)$8--$\tau=\mathsf{Tag}_k(c)$9 reduction compared to non-private methods, a stable communication overhead of approximately $c_i=\Enc_{k_i}(\nabla W_i)$0 MB upload and $c_i=\Enc_{k_i}(\nabla W_i)$1 MB download per round, and local training comprising over $c_i=\Enc_{k_i}(\nabla W_i)$2 of total round time (Badidi et al., 30 Aug 2025). Camouflage reports that offloader-classification accuracy can be impeded by up to $c_i=\Enc_{k_i}(\nabla W_i)$3, with remodeling latency growing to about $c_i=\Enc_{k_i}(\nabla W_i)$4 the original run at $c_i=\Enc_{k_i}(\nabla W_i)$5 and parallel mixing keeping latency around $c_i=\Enc_{k_i}(\nabla W_i)$6 (Azad et al., 2023).

The limitations are equally consistent. TEE systems inherit enclave memory constraints and side-channel exposure (Lee et al., 2020, Hashemi et al., 2022). Multi-worker schemes often rely on non-collusion assumptions (Zhang et al., 2024, Ding et al., 10 Dec 2025). Differential privacy and masking require careful calibration to avoid destroying utility (Gan et al., 2023, Tong et al., 19 Apr 2026). Some frameworks, such as Camouflage, are explicitly heuristic rather than provably anonymous (Azad et al., 2023). Others, such as the location-obfuscation study, show that stronger privacy can sharply reduce the acceptance ratio, from about $c_i=\Enc_{k_i}(\nabla W_i)$7 at $c_i=\Enc_{k_i}(\nabla W_i)$8 to about $c_i=\Enc_{k_i}(\nabla W_i)$9 at $\Lambda$00 (Esper et al., 2023).

A plausible implication is that the field has converged on no universally dominant primitive. Instead, workload structure determines the feasible privacy mechanism: encrypted arithmetic for outsourced search and FL aggregation, TEEs for legacy binaries and robust aggregation logic, masking and splitting for floating-point accelerator compatibility, commitment protocols for asynchronous verification, and learning-based controllers for privacy–latency–energy trade-offs. The central research problem is therefore not whether offloading can be made private in principle, but which privacy notion, trust assumption, and systems budget can be made to coexist for a given application class.