XONN: XNOR-based Oblivious Deep Neural Network Inference

Abstract

Advancements in deep learning enable cloud servers to provide inference-as-a-service for clients. In this scenario, clients send their raw data to the server to run the deep learning model and send back the results. One standing challenge in this setting is to ensure the privacy of the clients' sensitive data. Oblivious inference is the task of running the neural network on the client's input without disclosing the input or the result to the server. This paper introduces XONN, a novel end-to-end framework based on Yao's Garbled Circuits (GC) protocol, that provides a paradigm shift in the conceptual and practical realization of oblivious inference. In XONN, the costly matrix-multiplication operations of the deep learning model are replaced with XNOR operations that are essentially free in GC. We further provide a novel algorithm that customizes the neural network such that the runtime of the GC protocol is minimized without sacrificing the inference accuracy. We design a user-friendly high-level API for XONN, allowing expression of the deep learning model architecture in an unprecedented level of abstraction. Extensive proof-of-concept evaluation on various neural network architectures demonstrates that XONN outperforms prior art such as Gazelle (USENIX Security'18) by up to 7x, MiniONN (ACM CCS'17) by 93x, and SecureML (IEEE S&P'17) by 37x. State-of-the-art frameworks require one round of interaction between the client and the server for each layer of the neural network, whereas, XONN requires a constant round of interactions for any number of layers in the model. XONN is first to perform oblivious inference on Fitnet architectures with up to 21 layers, suggesting a new level of scalability compared with state-of-the-art. Moreover, we evaluate XONN on four datasets to perform privacy-preserving medical diagnosis.

To appear in USENIX Security 2019

References in corpus (7)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Binarized Neural Networks: Training Deep Neural Networks with Weights and Activations Constrained to +1 or -1
• FitNets: Hints for Thin Deep Nets
• Pruning Convolutional Neural Networks for Resource Efficient Inference
• Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference
• TAPAS: Tricks to Accelerate (encrypted) Prediction As a Service
• Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications

Cited by in corpus (28)

• CrypTFlow2: Practical 2-Party Secure Inference
• Privacy in Deep Learning: A Survey
• Secure Evaluation of Quantized Neural Networks
• CrypTen: Secure Multi-Party Computation Meets Machine Learning
• Secure Byzantine-Robust Machine Learning
• Enabling Homomorphically Encrypted Inference for Large DNN Models
• CryptoNAS: Private Inference on a ReLU Budget
• nGraph-HE2: A High-Throughput Framework for Neural Network Inference on Encrypted Data
• QUOTIENT: Two-Party Secure Neural Network Training and Prediction
• Fusion: Efficient and Secure Inference Resilient to Malicious Servers
• Towards the AlexNet Moment for Homomorphic Encryption: HCNN, theFirst Homomorphic CNN on Encrypted Data with GPUs
• SynFi: Automatic Synthetic Fingerprint Generation
• ScionFL: Efficient and Robust Secure Quantized Aggregation
• Efficient Privacy-Preserving Machine Learning with Lightweight Trusted Hardware
• Shredder: Learning Noise Distributions to Protect Inference Privacy
• Private Speech Classification with Secure Multiparty Computation
• Secure Sum Outperforms Homomorphic Encryption in (Current) Collaborative Deep Learning
• Partially Oblivious Neural Network Inference
• Optimizing Privacy-Preserving Outsourced Convolutional Neural Network Predictions
• Trustworthy AI Inference Systems: An Industry Research View
• Privacy-Preserving Collaborative Deep Learning with Unreliable Participants
• ENSEI: Efficient Secure Inference via Frequency-Domain Homomorphic Convolution for Privacy-Preserving Visual Recognition
• CHEETAH: An Ultra-Fast, Approximation-Free, and Privacy-Preserved Neural Network Framework based on Joint Obscure Linear and Nonlinear Computations
• GALA: Greedy ComputAtion for Linear Algebra in Privacy-Preserved Neural Networks
• PrivQuant: Communication-Efficient Private Inference with Quantized Network/Protocol Co-Optimization
• Round and Communication Balanced Protocols for Oblivious Evaluation of Finite State Machines
• ARM2GC: Succinct Garbled Processor for Secure Computation
• CryptoNite: Revealing the Pitfalls of End-to-End Private Inference at Scale