「We then assess the same model architecture under encryption. When trained on MNIST images encrypted with a fixed key and initialization vector (AES encryption; see Section 3), the model attains an average training accuracy of 39.48% and a test accuracy of 36.88%.」って本当なんだろうか…「In contrast, training the same model on the MNIST dataset with randomized encryption per sample (a unique key per image) results in a test accuracy of 9.56%, indistinguishable from random guessing.」と記載されているということはleakとかではなさそうだが。。。キーとIVが固定とはいえ、結構驚きがある。