SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud

By Zahra Ghodsi, Tianyu Gu, Siddharth Garg. 2017

201 citations recorded by the source corpus.

Inference using deep neural networks is often outsourced to the cloud since it is a computationally demanding task. However, this raises a fundamental issue of trust. How can a client be sure that the cloud has performed inference correctly? A lazy cloud provider might use a simpler but less accurate model to reduce its own computational load, or worse, maliciously modify the inference results sent to the client. We propose SafetyNets, a framework that enables an untrusted server (the cloud) to provide a client with a short mathematical proof of the correctness of inference tasks that they perform on behalf of the client. Specifically, SafetyNets develops and implements a specialized interactive proof (IP) protocol for verifiable execution of a class of deep neural networks, i.e., those that can be represented as arithmetic circuits. Our empirical results on three- and four-layer deep neural networks demonstrate the run-time costs of SafetyNets for both the client and server are low. SafetyNets detects any incorrect computations of the neural network by the untrusted server with high probability, while achieving state-of-the-art accuracy on the MNIST digit recognition (99.4%) and TIMIT speech recognition tasks (75.22%).

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

A generic framework for privacy preserving deep learning (2018, background): “Multiple players are then interested in seeing the execution performing correctly, which is particularly crucial during the inference phase where many factors could lead to corrupted predictions [4].”
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, methodology): “SafetyNets does not hide the model from either party, while Gazelle leaks some architectural details to the client.”
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “For example, one could have assurances that a cloud-based AI service is not skimping on computations by running a less powerful model than advertised, operating on private data in a disallowed fashion, or compromised by malware [107].”
Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference (2018, background): “We note that [27] showed how the gradient of the square function can be large.”
Towards Deep Neural Network Training on Encrypted Data (2019, background): “Some prior work described how to preform training and inference for other types of models on encrypted data, speciﬁcally linear-regression models [24] and even logistic-regression models [29, 15, 19, 18, 10].”
The relationship between trust in AI and trustworthy machine learning technologies (2019, background): “Much of the literature around auditability relates to data provenance research in database and cloud concepts [44] and model provenance approaches [39].”
VerifyNet: Secure and Verifiable Federated Learning (2020, methodology): “To combat that, Several schemes [16], [17] have been successively proposed to alleviate this problem.”
The TellTail of Embeddings: Fingerprinting Retrievers in Black-Box Systems (2026, unknown): “However, fingerprinting may also have benign applications, such as verifying that a provider serves a promised model [31], [36], [37].”