Preserving privacy of machine learning models