XONN: XNOR-based Oblivious Deep Neural Network Inference

By M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin E. Lauter, Farinaz Koushanfar. 2019

317 citations recorded by the source corpus.

Advancements in deep learning enable cloud servers to provide inference-as-a-service for clients. In this scenario, clients send their raw data to the server to run the deep learning model and send back the results. One standing challenge in this setting is to ensure the privacy of the clients' sensitive data. Oblivious inference is the task of running the neural network on the client's input without disclosing the input or the result to the server. This paper introduces XONN, a novel end-to-end framework based on Yao's Garbled Circuits (GC) protocol, that provides a paradigm shift in the conceptual and practical realization of oblivious inference. In XONN, the costly matrix-multiplication operations of the deep learning model are replaced with XNOR operations that are essentially free in GC. We further provide a novel algorithm that customizes the neural network such that the runtime of the GC protocol is minimized without sacrificing the inference accuracy. We design a user-friendly high-level API for XONN, allowing expression of the deep learning model architecture in an unprecedented level of abstraction. Extensive proof-of-concept evaluation on various neural network architectures demonstrates that XONN outperforms prior art such as Gazelle (USENIX Security'18) by up to 7x, MiniONN (ACM CCS'17) by 93x, and SecureML (IEEE S&P'17) by 37x. State-of-the-art frameworks require one round of interaction between the client and the server for each layer of the neural network, whereas, XONN requires a constant round of interactions for any number of layers in the model. XONN is first to perform oblivious inference on Fitnet architectures with up to 21 layers, suggesting a new level of scalability compared with state-of-the-art. Moreover, we evaluate XONN on four datasets to perform privacy-preserving medical diagnosis.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Privacy in Deep Learning: A Survey (2020, methodology): “Most of the efforts in the field of SMC for deep learning are focused on speeding up the computation, as demonstrated above, and also by [102], [103], [113].”
QUOTIENT: Two-Party Secure Neural Network Training and Prediction (2019, neutral): “[48] have proposed OT-based protocols for secure prediction using DNNs.”
DeepAttest: An End-to-End Attestation Framework for Deep Neural Networks (2019, methodology): “Various techniques have been suggested for privacy-preserving (PP) DNN inference and training [21, 22, 36, 37].”
Secure Byzantine-Robust Machine Learning (2020, background): “[14, 33, 15, 22, 26, 33, 10, 16, 32] falls into a general category of 2-party computation (2PC).”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, methodology): “As a third take on efficient DNNs using GC, XONN [78] attempts to accelerate XNOR-based networks [79] (networks”
HEAX: High-Performance Architecture for Computation on Homomorphically Encrypted Data in the Cloud (2019, background): “Privacy-preserving MLaaS has been studied rigorously in recent years and several protocol-level and algorithmic improvements have been proposed [36, 48, 63, 46, 19, 64, 62, 61, 42].”
Cheetah: Lean and Fast Secure Two-Party Deep Neural Network Inference (2022, methodology): “Cheetah contributes a set of novel cryptographic protocols for the most common linear operations and non-linear operations of DNNs. Cheetah can perform secure inference on large models, e.g. ResNet, and DenseNet [28], with signiﬁcantly smaller computation and communication overheads than the state-o”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “However, these approaches suffer fromaprohibitive computation and communication cost,with over three orders ofmagnitude added latency for CIFAR [22] for instance, exacerbating the already complex and compute-intensive neural network models.”
CrypTen: Secure Multi-Party Computation Meets Machine Learning (2021, background): “XONN [59] also works in the two-party setting but provides malicious security.”
CrypTFlow2: Practical 2-Party Secure Inference (2020, methodology): “Recently, there have been many works that have made rapid strides towards realizing secure inference [4, 6, 13, 17, 19, 22, 31, 43, 48, 49, 51, 56, 58].”
CrypTFlow: Secure TensorFlow Inference (2019, background): “…of ﬁxed-point for secure computations is well-known [51], prior works on secure inference have addressed the ﬂoat-to-ﬁxed problem by either generating a ﬁxed-point model by hand ([45], [42], [38], [44], [61]), or by using non-standard training algorithms that output ﬁxed-point models ([54], [5]).”
A Principled Approach to Learning Stochastic Representations for Privacy in Deep Neural Inference (2020, background): “, 2013) which can increase the execution time of a neural network by three orders of magnitude (Riazi et al., 2019).”
Falcon: Honest-Majority Maliciously Secure Framework for Private Deep Learning (2020, methodology): “We are also 40× more communication efficient than ABY3 [11], 200× more communication efficient than SecureNN [12], and over 760× more communication efficient compared to XONN [9].”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “Secure multiparty computation (SMC) [16, 17] and homomorphic encryption [21, 19, 48] have also been used as attempts to deal with the privacy on offloaded computation on the cloud [19, 67, 68, 67, 48, 21, 52].”