PaperlayerView exact revision on arXiv

Source-linked AI summary

XONN: XNOR-based Oblivious Deep Neural Network Inference

M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, Farinaz Koushanfar

arXiv:1902.07342v2cs.CR

TL;DR

Oblivious inference must protect client data and results while preserving the provider’s deep-learning model. XONN combines binary neural networks with Yao’s Garbled Circuits to replace multiplications with GC-free XNOR operations. It reports lower latency than prior frameworks, constant interaction rounds, and inference on networks with up to 21 layers.

  • Problem

    Oblivious inference seeks to run a deep-learning model on client input without disclosing the input or result to the server.

  • Method

    XONN uses Yao’s Garbled Circuits with binarized deep-learning models, replacing costly matrix multiplications with XNOR operations and optimizing the network for GC.

  • Results

    XONN achieves 7× lower latency than Gazelle, constant interaction rounds regardless of model depth, and oblivious inference on networks with up to 21 layers.

  • Takeaways & Limitations

    XONN provides a framework for privacy-preserving DNN inference with constant round complexity and scalable adaptation to deep networks.

  • Takeaways & Limitations

    The security analysis considers the Honest-but-Curious adversary model, in which both parties are assumed to follow the protocol.

Abstract

from arXiv · show

Advancements in deep learning enable cloud servers to provide inference-as-a-service for clients. In this scenario, clients send their raw data to the server to run the deep learning model and send back the results. One standing challenge in this setting is to ensure the privacy of the clients' sensitive data. Oblivious inference is the task of running the neural network on the client's input without disclosing the input or the result to the server. This paper introduces XONN, a novel end-to-end framework based on Yao's Garbled Circuits (GC) protocol, that provides a paradigm shift in the conceptual and practical realization of oblivious inference. In XONN, the costly matrix-multiplication operations of the deep learning model are replaced with XNOR operations that are essentially free in GC. We further provide a novel algorithm that customizes the neural network such that the runtime of the GC protocol is minimized without sacrificing the inference accuracy. We design a user-friendly high-level API for XONN, allowing expression of the deep learning model architecture in an unprecedented level of abstraction. Extensive proof-of-concept evaluation on various neural network architectures demonstrates that XONN outperforms prior art such as Gazelle (USENIX Security'18) by up to 7x, MiniONN (ACM CCS'17) by 93x, and SecureML (IEEE S&P'17) by 37x. State-of-the-art frameworks require one round of interaction between the client and the server for each layer of the neural network, whereas, XONN requires a constant round of interactions for any number of layers in the model. XONN is first to perform oblivious inference on Fitnet architectures with up to 21 layers, suggesting a new level of scalability compared with state-of-the-art. Moreover, we evaluate XONN on four datasets to perform privacy-preserving medical diagnosis.

1 Introduction

XONN addresses privacy-preserving deep-neural-network inference by combining binary neural networks with Yao’s Garbled Circuits. It reduces costly computation and interaction while supporting scalable evaluations.

  • Oblivious inference runs a deep-learning model on client input without disclosing the input or result to the server.
  • XONN binarizes weights and activations so costly multiplications become XNOR operations that are free in the GC protocol.
  • 21× average reduction in GC gate count results from training networks with many bit-level operations and no inference-phase multiplications.
  • 7× and 93× lower inference latency are achieved than Gazelle and MiniONN, respectively, with a constant number of client-server interaction rounds.XONN also supports high-level model descriptions, Keras compilation, and networks with as many as 21 layers.
  • A conditional addition protocol optimizes the input layer, while network trimming removes neurons that minimally contribute to inference accuracy.

2 Preliminaries

The preliminaries describe neural-network layer computation, secret sharing, oblivious transfer, and Yao’s Garbled Circuits as foundations for XONN’s secure inference design.

  • A deep neural network passes raw data through computational layers, with the final layer producing the inference prediction.
  • Linear Layers: Fully connected and convolutional layers use repeated vector dot products to generate outputs.
  • Activations and Batch Normalization: Binary activation maps each hidden-layer input to its sign, +1 or −1, while batch normalization normalizes linear-layer outputs.
  • Secret Sharing: Additive secret sharing splits a secret into two shares that individually reveal no information and reconstruct modulo 2^b.
  • Oblivious Transfer: Oblivious transfer lets a receiver obtain one selected message without learning the other messages and supports both OCA and GC.
  • Garbled Circuits: Yao’s Garbled Circuits compute an arbitrary two-party function without revealing either party’s input by encoding it as a Boolean circuit.

3 The XONN Framework

XONN customizes binary neural networks for efficient oblivious inference by replacing costly multiplications with XNOR-based operations and trimming low-contribution neurons. Its protocols and security design target low GC complexity while preserving accuracy and constant-round interaction.

  • Binary Neural Networks: XNOR gates replace costly multiplication operations in GC, where multiplication has quadratic computation and communication cost in operand bit-length.The resulting XNOR operations are essentially free in GC.
  • Binary Neural Networks: Binary Neural Networks restrict weights and activations to +1 or −1, enabling linear operations to use simplified arithmetic and Boolean circuits.This binarization supports XNOR-based computation instead of conventional multiplication.
  • Customized Network Binarization: XONN customizes BNNs by scaling layer widths before training and trimming redundant channels or neurons afterward to reduce GC cost while maintaining inference accuracy.Trimming ranks features, prunes low-importance ones, fine-tunes the network, and stops when accuracy falls below a predefined threshold.
  • Oblivious Inference: Binary vector dot products encode ±1 values as bits, compute element-wise XNOR, count set bits, and output 2p−n.This implements the equivalence between the binary dot product and XnorPopcount.
  • Oblivious Conditional Addition Protocol: Oblivious Conditional Addition removes GC computation for XONN’s first layer but adds OT overhead and GC costs for a new addition layer.OCA is used only once, so it preserves XONN’s constant-round interaction complexity.
  • Security of XONN: XONN assumes honest-but-curious parties, while cut-and-choose techniques can adapt its GC-based protocol to malicious security with increased overhead.The paper contrasts this adaptability with mixed-protocol frameworks that lack a practical malicious-security extension.

4 The XONN Implementation

XONN implements oblivious inference with a modular, pipelined garbling engine designed to reduce memory use and scale to large neural networks. Its high-level API and compiler automate network description and parameter preparation.

  • Implementation Optimizations: The implementation incorporates GC optimizations including fixed-key AES encryption and row reduction to reduce computation and communication complexity.XONN uses Intel AES-NI instructions and reduces garbled tables from four to three with row reduction.
  • Modular Circuit Synthesis and Garbling: XONN’s modular design represents each neural-network layer as repeated base circuits, reducing memory by storing only those circuits.VDP, OR, and comparison circuits represent linear, MaxPool, and BA/BN layers, respectively.
  • Modular Circuit Synthesis and Garbling: XONN synthesizes each base circuit separately, shifting the bottleneck from synthesis-tool gate limits to system memory.This modular approach supports neural networks whose complete Boolean circuits would contain millions to billions of gates.
  • Pipelined GC Engine: Computation and communication are pipelined across successive circuit invocations, allowing garbling and evaluation of adjacent layers to proceed concurrently.The garbler sends completed garbled tables while the evaluator processes outputs from the preceding layer.
  • Dynamic Memory Management: Dynamic memory management releases labels when they are no longer needed, reducing peak allocation from 10.41GB to at most 2GB for the BC1 example.The framework uses less than 0.5GB for most of the execution described.
  • User Interface and Compilation: XONN provides a high-level API and Keras compiler that automate circuit invocation, interconnection, parameter formatting, and parameter adjustments.Users describe the network architecture and input structure, while the compiler emits the required .xonn representation and HEX-formatted parameters.

5 Related Work

Prior oblivious-inference frameworks combine homomorphic encryption, garbled circuits, GMW, secret sharing, or mixed protocols, each with distinct tradeoffs. XONN co-designs the deep-learning model and secure computation to provide constant-round inference without a secondary server and with broader security support.

  • Existing Frameworks: Prior frameworks use HE, GC, GMW, secret sharing, or mixed protocols for privacy-preserving inference.Mixed-protocol systems combine techniques for different operations but require secure conversion between protocols.
  • System Assumptions: ABY3 and SecureNN rely on three or four parties, whereas XONN does not require an additional computation server.
  • XONN Comparison: XONN co-designs deep learning and secure computation, avoiding DeepSecure’s preprocessing leakage about network parameters and data structure.
  • XONN Comparison: XONN provides constant round complexity regardless of neural-network depth and supports arbitrary functionality through its GC-based design.Round complexity matters particularly when network latency is high.
  • Comparison Criteria: Table 2 compares frameworks by constant rounds, deep-learning/secure-computation co-design, secondary-server independence, malicious-security upgradeability, and nonlinear-layer support.

6 Circuit Privacy

The paper examines circuit privacy in Gazelle’s BFV-based homomorphic-encryption component. Providing circuit privacy requires extra protocol measures that increase communication, interaction rounds, or computational cost, so the reported baseline timings must be adjusted.

  • Circuit Privacy: Gazelle’s vanilla BFV scheme does not provide circuit privacy, which is required to prevent ciphertext leakage about private inputs.Gazelle proposes secure decryption or noise flooding, but neither method is included in its implementation.
  • Circuit-Privacy Methods: Secure decryption adds communication and interaction rounds, while noise flooding adds enough noise to hide extra ciphertext information without changing the plaintext.
  • Noise-Flooding Overhead: Noise flooding requires increasing Gazelle’s modulus q from 60 to 180 bits and ring dimension n from 2048 to 8192.
  • Noise-Flooding Overhead: 3–3.6× slow down is estimated for Gazelle’s HE component after noise flooding.For MNIST-D, total time is estimated to rise from 0.81s to 1.16–1.27s; for CIFAR-10, from 12.9s to 15.48–16.25s.
  • Measurement Basis: The percentage estimates for homomorphic-encryption time were obtained through private communication with Gazelle’s authors.

7 Experimental Results

XONN’s evaluations cover MNIST, CIFAR-10, and healthcare datasets, testing binary-network scaling, communication optimization, pruning, and comparisons with prior frameworks. Across benchmarks, tuned and trimmed networks achieve substantially lower latency, while scaling trades higher accuracy for higher runtime and communication.

  • Evaluation Scope: XONN’s evaluations use MNIST and CIFAR-10 benchmarks plus four healthcare datasets, reporting validation accuracy, inference time, and message size for medical benchmarks.The evaluated binary architectures include MNIST networks, CIFAR-10 BC1–BC6, Fitnet variants, and VGG16.
  • Network Scaling: Increasing the scaling factor raises classification accuracy but also increases runtime and communication cost.For MNIST, runtime grows almost quadratically because Popcount operations increase quadratically; BM1 and BM2 are dominated by roughly 70 ms of OT initialization.
  • Communication Cost: OCA drastically reduces BM1 and BM2 message size because their first layers account for a large share of computation.
  • Runtime Boundary: At least approximately 0.07 seconds of OT initialization makes XONN slightly slower than prior work on very small BM1 architectures.For higher-complexity BM3, the paper reports a more prominent advantage over prior art.
  • CIFAR-10 Results: 2.7×, 45.8×, 9.1×, and 93.1× lower latency than Gazelle, EzPC, Chameleon, and MiniONN, respectively, are achieved on CIFAR-10 BC2.BC2 is scaled by s = 3 and then pruned using Algorithm 2.

8 Conclusion

XONN trains and executes binarized neural networks with Yao’s Garbled Circuits, replacing costly matrix multiplications with GC-free XNOR operations. It reports lower latency than prior frameworks, constant interaction rounds, stronger malicious-security support, and a high-level API plus Keras compiler.

  • Conclusion: XONN automatically trains and uses deep neural networks for oblivious inference.
  • Conclusion: Binarization translates costly matrix multiplications into XNOR operations that are free in the GC protocol.
  • Conclusion: 7× lower latency than Gazelle and constant interaction rounds regardless of network depth are reported for XONN.
  • Conclusion: XONN can provide stronger security against malicious adversaries using standard cut-and-choose protocols.
  • Conclusion: XONN provides a high-level API and a compiler translating Keras network descriptions into XONN representations.

A.1 Network Trimming Examples

This section identifies the trimming procedures used for the MNIST and CIFAR-10 benchmark architectures.

  • MNIST trimming steps are summarized in Table 9.
  • CIFAR-10 trimming steps are summarized in Table 10 for the BC2 network.

A.2 Accuracy, Runtime, and Communication

This section reports accuracy, communication, and latency for MNIST and CIFAR-10, alongside the evaluated network architectures. Communication entries above 40GB are estimated using numerical runtime models.

  • Accuracy, communication, and latency are reported for the MNIST dataset in Table 11.
  • Accuracy, communication, and latency are reported for the CIFAR-10 dataset in Table 12.
  • The corresponding evaluated neural network architectures are provided in Table 13.
  • Communication entries exceeding 40GB are estimated using numerical runtime models.

B Attacks on Deep Neural Networks

The paper reviews attacks in which clients use inference results to learn information about a server-held model or its training data. It also describes output modifications intended to reduce such leakage.

  • Adversarial clients can submit many inputs and analyze inference results to infer network parameters or training data.
  • Model Inversion Attack: Model inversion attacks iteratively maximize a target class’s confidence score to learn information about a prototypical class sample.
  • Rounding confidence values omits one or more least significant bits from last-layer numbers, which is free in GC.
  • Reporting only the class label computes argmax on the last-layer output rather than exposing the full confidence vector.
Loading 1902.07342v2…