PaperlayerView exact revision on arXiv

Source-linked AI summary

Secure Evaluation of Quantized Neural Networks

Anders Dalskov, Daniel Escudero, Marcel Keller

arXiv:1910.12435v2cs.CRcs.LG

TL;DR

Secure inference has been difficult to integrate with standard machine-learning frameworks and general-purpose MPC because prior approaches often require specialized representations, activations, or threat-model-specific protocols. This paper evaluates framework-supported quantization with general-purpose MPC and finds that large, unmodified networks can be securely evaluated while exposing trade-offs across security settings. The authors also develop optimized truncation protocols, whose accuracy impact is not experimentally verified.

  • Problem

    Secure inference must bridge standard machine-learning development and flexible MPC, whereas prior approaches often depend on specialized model representations, activations, or protocols.

  • Method

    The paper evaluates TensorFlow-compatible quantization with general-purpose MPC, including optimized probabilistic truncation protocols for secure neural-network evaluation.

  • Results

    Large, unmodified ImageNet networks trained with standard frameworks can be securely evaluated using general-purpose MPC, with benchmarks exposing security-setting efficiency trade-offs.

  • Takeaways & Limitations

    Standard machine-learning frameworks need not be abandoned, and general-purpose MPC broadens the available threat models for secure inference.

  • Takeaways & Limitations

    The authors do not experimentally verify that probabilistic truncation leaves model accuracy substantially unaffected.

Abstract

from arXiv · show

We investigate two questions in this paper: First, we ask to what extent "MPC friendly" models are already supported by major Machine Learning frameworks such as TensorFlow or PyTorch. Prior works provide protocols that only work on fixed-point integers and specialized activation functions, two aspects that are not supported by popular Machine Learning frameworks, and the need for these specialized model representations means that it is hard, and often impossible, to use e.g., TensorFlow to design, train and test models that later have to be evaluated securely. Second, we ask to what extent the functionality for evaluating Neural Networks already exists in general-purpose MPC frameworks. These frameworks have received more scrutiny, are better documented and supported on more platforms. Furthermore, they are typically flexible in terms of the threat model they support. In contrast, most secure evaluation protocols in the literature are targeted to a specific threat model and their implementations are only a "proof-of-concept", making it very hard for their adoption in practice. We answer both of the above questions in a positive way: We observe that the quantization techniques supported by both TensorFlow, PyTorch and MXNet can provide models in a representation that can be evaluated securely; and moreover, that this evaluation can be performed by a general purpose MPC framework. We perform extensive benchmarks to understand the exact trade-offs between different corruption models, network sizes and efficiency. These experiments provide an interesting insight into cost between active and passive security, as well as honest and dishonest majority. Our work shows then that the separating line between existing ML frameworks and existing MPC protocols may be narrower than implicitly suggested by previous works.

1 Introduction

Secure inference must protect sensitive inputs and sometimes models while remaining compatible with practical machine-learning development. This paper examines whether standard frameworks and general-purpose MPC can support secure evaluation without specialized models or protocols.

  • Sensitive applications motivate secure inference that keeps inputs private from model owners and models private from input owners.
  • The resulting framework supports large realistic networks and lets practitioners retain widely used machine-learning frameworks while choosing among broader MPC threat models.
  • Existing secure-inference systems often require specialized activation functions or training processes that disrupt standard machine-learning workflows.
  • The paper asks whether standard frameworks can produce unmodified models for secure evaluation and whether general-purpose MPC frameworks can evaluate them.
  • The authors identify quantization used by TensorFlow, PyTorch, and MXNet as suitable for MPC because convolution outputs become dot-products followed by truncation.
  • The approach uses arithmetic black-box compatibility, optimized truncation over Z2^k, and benchmarks spanning corruption models, network sizes, and efficiency.

2 Deep Learning and Quantization

Quantization represents neural-network weights and activations with low-bit integers while preserving accuracy, and the Jacob et al. scheme supports secure inference through integer-friendly tensor operations. The section describes its per-tensor parameters, batch-normalization folding, and fixed-point dot-product computation.

  • Quantization can represent weights and activations with as few as 8 bits, while modern quantized networks can retain essentially the accuracy of full-precision models.
  • Neural-network operations: During inference, batch-normalization parameters can be folded into weights and biases, allowing the normalized computation to use modified W′ and b′.
  • The Jacob et al. scheme is selected because TFLite implements it, enabling models trained in TensorFlow to be securely evaluated and providing pretrained ImageNet reference models.
  • Secure inference: The scheme simplifies activations and arithmetic for MPC, but its model-size reduction does not carry over because secure arithmetic still uses 32- or 64-bit modular computation.
  • Quantization: Each tensor uses a scale m and zero-point z, chosen from observed value ranges to map real values into an 8-bit discrete interval.
  • Dot products: Quantized dot products use integer-only accumulation, then approximate the real multiplier with a normalized fixed-point representation and rounding-to-nearest.The fixed-point approximation uses a 32-bit integer and provides at least 30 bits of relative accuracy.

3 Quantized CNNs in MPC

The paper formulates secure CNN inference in a client-server setting using quantized models and general-purpose MPC primitives. It covers multiple security and arithmetic settings, develops truncation methods, and combines these components to evaluate quantized CNNs securely.

  • System and threat model: Model and input owners secret-share their inputs with two or three servers, which execute the secure inference and return shares of the output.The number of servers depends on the underlying MPC protocol and majority setting.
  • General-purpose MPC: The framework supports general-purpose MPC protocols over Z2^k or Fp using secret sharing, local addition, and secure multiplication.These protocols operate in the arithmetic black-box model.
  • Security settings: The paper instantiates eight protocols spanning active or passive security, honest or dishonest majority, and arithmetic modulo a prime or a power of two.The protocol combinations are summarized in Table 1; three parties instantiate honest majority and two parties instantiate dishonest majority.
  • Truncation: The proposed probabilistic truncation is expected to preserve neural-network accuracy while improving performance, but the accuracy effect is not experimentally verified.Its performance advantage comes from avoiding expensive binary adders and similar circuits required by deterministic truncation.
  • Truncation: Division by 2^m is unavailable as a local multiplication over Z2^k, motivating a constant-round truncation method with a one-bit share overhead.Alternative methods require either a non-constant number of rounds or a large gap between shares and secrets.
  • Truncation: Probabilistic truncation over Z2^k uses shares only one bit larger than the secrets and a constant number of rounds, with error at most 1 biased toward the nearest integer.The protocol assumes access to random shared bits.
  • Truncation: Secret truncation is necessary because layer-specific quantization parameters are adaptively chosen and therefore constitute private model information.Earlier truncation protocols assume that the number of bits truncated is public.
  • CNN evaluation: Secure evaluation of quantized CNNs mainly reduces to dot-product computation followed by truncation and clamping.The model owner and data owner can also run the protocol directly as two servers, while shared outputs can be pipelined into later MPC computations.

4 Implementation and Benchmarking

The paper benchmarks secure inference on pretrained MobileNet models using general-purpose MPC protocols across corruption models, algebraic structures, and truncation methods. Results expose substantial trade-offs: corruption thresholds dominate runtime, while active security and protocol choices impose smaller or context-dependent overheads.

  • Model preparation: TensorFlow supports quantization-aware training and post-quantization for models that can be evaluated without external conversion.The authors stress that the approach is not limited to MobileNet networks.
  • Micro-benchmarks: Dot-products are essentially free in some evaluated protocols, but communication-dependent protocols slow as the number of terms grows.For quadrupling the number of terms, active security modulo p increases runtime by roughly ×2.4, compared with ×1.3 for passive modulo 2^k.
  • Benchmark setup: Benchmarks evaluate 16 pretrained V1 MobileNet models across honest versus dishonest majority, passive versus active security, ring versus field protocols, and probabilistic versus exact truncation.The models have 28 layers and 1000 output classes; full end-to-end timings include preprocessing.
  • Full model evaluation: Corruption threshold is the most influential runtime factor, with dishonest-majority evaluation reaching up to 200 times the honest-majority overhead in some configurations.The paper attributes this difference to expensive preprocessing required for dishonest-majority protocols.
  • Full model evaluation: Moving from passive to active security increases inference time by a factor of between 3 and 30, whereas field-versus-ring performance depends on the security setting.Ring protocols mostly outperform fields for passive security, while the reverse is true for active security under the evaluated implementations.
  • Special truncation: Special truncation consistently improves over CrypTFlow, while results without it are sometimes considerably worse.The proposed truncation avoids CrypTFlow’s restriction that the most significant s bits of the secret be zero for statistical security parameter s.

5 Conclusions

The paper shows that standard-framework models can be securely evaluated with general-purpose MPC, while benchmarks expose trade-offs among protocols, threat models, and truncation choices.

  • Standard TensorFlow-trained ImageNet networks can be securely evaluated using more-or-less existing MPC protocols without modification.The supported quantization approach also applies to PyTorch and MXNet models.
  • The scaling results report time and communication per party for a five-party probabilistic-truncation computation.The scaling comparison varies the number of parties and corruption assumptions.
  • The experiments measure time and communication for SecureNN, CIFAR10 SqueezeNet, and ImageNet models including SqueezeNet, ResNet-50, and DenseNet-121.The reported tables cover both smaller benchmark networks and larger ImageNet classifications.
  • Standard MPC broadens the available threat models, while passive honest-majority evaluation remains the most efficient setting.The benchmarks compare honest versus dishonest majority and passive versus active security.
  • Special probabilistic truncation can trade prediction accuracy against evaluation speed.The paper benchmarks this specialized protocol choice against standard approaches.

A Related work on secure inference

Prior secure-inference systems use homomorphic encryption, garbled circuits, secret sharing, or combinations of these techniques, often adapting models or activations for efficient evaluation.

  • Homomorphic-encryption systems require polynomial evaluation and therefore replace ReLU with approximations such as x ↦ x^2.Such approximations can make training difficult for larger networks because the derivative of x^2 is unbounded.
  • Gazelle combines additive homomorphic encryption for convolutions and fully connected layers with garbled circuits for activation functions.Its efficiency is attributed to an efficient switch between the two schemes.
  • MiniONN and Chameleon mix homomorphic encryption or secret sharing for arithmetic operations with garbled circuits for other network components.These systems turn pretrained models into oblivious representations suitable for mixed-protocol evaluation.
  • DeepSecure and XONN pursue pure garbled-circuit evaluation, with XONN exploiting binarized neural networks for efficiency.Other MPC systems improve performance through fixed-point truncation or multiparty protocols.
  • CrypTFlow builds on SecureNN to evaluate very large networks and accepts standard TensorFlow-trained models as input.This framework is notable for supporting networks with more than 100 layers in reasonable time.

B.1 Dishonest Majority

Dishonest-majority protocols use additive secret sharing and authentication mechanisms to support secure computation when the adversary may control a majority of parties.

  • Dishonest-majority protocols are generally harder to develop and more complex than honest-majority protocols.They typically use additive secret sharing and authentication tags for active security.
  • SPDZ2k provides active security over Z2^k using multiplication triples and authentication over an extended ring.The protocol adapts SPDZ-style authentication to ring-based computation.
  • OTSemi2k and OTSemiPrime are cutdown versions that omit authentication tags and sacrifice checks.These variants trade away those verification mechanisms relative to SPDZ2k and MASCOT.

B.2 Honest Majority

Honest-majority protocols use Shamir or replicated secret sharing; for the paper’s small server sets, the focus is on replicated secret-sharing instantiations.

  • Honest-majority protocols are typically developed with Shamir Secret Sharing or Replicated Secret Sharing.The paper focuses on replicated secret sharing because it considers only a small number of servers.
  • Replicated2k and ReplicatedPrime distribute each shared value across three parties using random pairs whose sum reconstructs the value modulo M.The modulus is selected as 2^k or a prime, respectively.

Communication and preprocessing

Table 7 reports the communication required to securely evaluate ImageNet models. Dishonest-majority protocols use substantially more preprocessing material than honest-majority protocols.

  • Table 7 reports protocol communication in Gigabytes for evaluating different ImageNet models.
  • Dishonest-majority protocols require substantial preprocessing material to evaluate a network.
  • The reported communication values differ substantially between dishonest-majority and honest-majority protocols.

WAN Benchmarks

The smallest model was evaluated in a wide-area setting with parties on different continents. Under probabilistic truncation over rings, timings ranged from 110 to 28,000 seconds across security and majority settings.

  • WAN setting: The WAN experiment placed each party on a different continent and used the smallest model.
  • Benchmark metrics: The MobileNets communication table specifies width and resolution multipliers for network variants and defines Top-1 and Top-5 accuracy measures.
  • WAN timings: 110 seconds was the timing for passive honest-majority computation over rings with probabilistic truncation.
  • WAN timings: 28,000 seconds was the timing for active dishonest-majority computation over rings with probabilistic truncation.
Loading 1910.12435v2…