CryptoSPN: Privacy-preserving Sum-Product Network Inference

Abstract

AI algorithms, and machine learning (ML) techniques in particular, are increasingly important to individuals' lives, but have caused a range of privacy concerns addressed by, e.g., the European GDPR. Using cryptographic techniques, it is possible to perform inference tasks remotely on sensitive client data in a privacy-preserving way: the server learns nothing about the input data and the model predictions, while the client learns nothing about the ML model (which is often considered intellectual property and might contain traces of sensitive data). While such privacy-preserving solutions are relatively efficient, they are mostly targeted at neural networks, can degrade the predictive accuracy, and usually reveal the network's topology. Furthermore, existing solutions are not readily accessible to ML experts, as prototype implementations are not well-integrated into ML frameworks and require extensive cryptographic knowledge. In this paper, we present CryptoSPN, a framework for privacy-preserving inference of sum-product networks (SPNs). SPNs are a tractable probabilistic graphical model that allows a range of exact inference queries in linear time. Specifically, we show how to efficiently perform SPN inference via secure multi-party computation (SMPC) without accuracy degradation while hiding sensitive client and training information with provable security guarantees. Next to foundations, CryptoSPN encompasses tools to easily transform existing SPNs into privacy-preserving executables. Our empirical results demonstrate that CryptoSPN achieves highly efficient and accurate inference in the order of seconds for medium-sized SPNs.

Accepted for publication at ECAI'20. Please cite the conference version of this paper

References in corpus (9)

• European Union regulations on algorithmic decision-making and a "right to explanation"
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Sum-Product Networks: A New Deep Architecture
• SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution
• Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications
• Private Machine Learning in TensorFlow using Secure Computation
• TensorSCONE: A Secure TensorFlow Framework using Intel SGX
• SPFlow: An Easy and Extensible Library for Deep Probabilistic Learning using Sum-Product Networks
• nGraph-HE2: A High-Throughput Framework for Neural Network Inference on Encrypted Data

Cited by in corpus (3)

• Trustworthy AI Inference Systems: An Industry Research View
• Privacy-Enhanced Database Synthesis for Benchmark Publishing (Technical Report)
• Fast Private Parameter Learning and Inference for Sum-Product Networks