Gazelle: A Low Latency Framework for Secure Neural Network Inference

By Chiraag Shashikant Juvekar, Vinod Vaikuntanathan, Anantha P. Chandrakasan. 2018

1,108 citations recorded by the source corpus.

The growing popularity of cloud-based machine learning raises a natural question about the privacy guarantees that can be provided in such a setting. Our work tackles this problem in the context where a client wishes to classify private images using a convolutional neural network (CNN) trained by a server. Our goal is to build efficient protocols whereby the client can acquire the classification result without revealing their input to the server, while guaranteeing the privacy of the server's neural network. To this end, we design Gazelle, a scalable and low-latency system for secure neural network inference, using an intricate combination of homomorphic encryption and traditional two-party computation techniques (such as garbled circuits). Gazelle makes three contributions. First, we design the Gazelle homomorphic encryption library which provides fast algorithms for basic homomorphic operations such as SIMD (single instruction multiple data) addition, SIMD multiplication and ciphertext permutation. Second, we implement the Gazelle homomorphic linear algebra kernels which map neural network layers to optimized homomorphic matrix-vector multiplication and convolution routines. Third, we design optimized encryption switching protocols which seamlessly convert between homomorphic and garbled circuit encodings to enable implementation of complete neural network inference. We evaluate our protocols on benchmark neural networks trained on the MNIST and CIFAR-10 datasets and show that Gazelle outperforms the best existing systems such as MiniONN (ACM CCS 2017) by 20 times and Chameleon (Crypto Eprint 2017/1164) by 30 times in online runtime. Similarly when compared with fully homomorphic approaches like CryptoNets (ICML 2016) we demonstrate three orders of magnitude faster online run-time.

Subfields: Artificial Intelligence, ML Systems & Hardware, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In ML Systems & Hardware

In Privacy & Security

Citations in the corpus

DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks (2020, methodology): “Secondly, cryptographic methods for training deep networks [20, 21, 22] are computationally very expensive operations which makes deploying models on the server infeasible when working with sensitive data.”
Privacy in Deep Learning: A Survey (2020, methodology): “Liu et al. propose MiniONN [116], which uses additively homomorphic encryption (AHE) in a preprocessing step, unlike GAZELLE which uses AHE to speed up linear algebra directly.”
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, methodology): “SafetyNets does not hide the model from either party, while Gazelle leaks some architectural details to the client.”
Machine Unlearning (2019, background): “Additionally, such schemes [33]–[35] have a large computational overhead ( G6 ) and are often used only for inference and not training.”
A Study of Face Obfuscation in ImageNet (2021, background): “Machine learning service providers can run their models on users’ private data encrypted using homomorphic encryption (Gilad-Bachrach et al., 2016; Brutzkus et al., 2019; Juvekar et al., 2018; Bian et al., 2020; Yonetani et al., 2017).”
Blind Justice: Fairness with Encrypted Sensitive Attributes (2018, background): “…regression (Nikolaenko et al., 2013b; Gasc´on et al., 2017; Mohassel & Zhang, 2017), neural network training (Mohassel & Zhang, 2017) and evaluation (Juvekar et al., 2018; Liu et al., 2017), matrix factorization (Nikolaenko et al., 2013a), and principal component analysis (Al-Rubaie et al., 2017).”
Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment (2019, methodology): “[32] propose Gazelle framework for secure neural network inference using cryptographic tools.”
EPIC: Efficient Private Image Classification (or: Learning from the Masters) (2019, methodology): “While the field of private image classification is shifting towards the deployment of NN-based approaches [26, 34, 43], we show that this is not necessary,”
Secure Byzantine-Robust Machine Learning (2020, background): “[14, 33, 15, 22, 26, 33, 10, 16, 32] falls into a general category of 2-party computation (2PC).”
PrivEdge: From Local to Distributed Private Training and Prediction (2020, methodology): “To classify X, s1 and s2 compute the reconstruction dissimilarity (see Figure 2), di, between X and X̄i (for each i = 1, ..., N ) and assign the image X to the class corresponding to the minimum reconstruction dissimilarity (or none of them if the smallest di is above a predefined secretshared thres”
Towards Deep Neural Network Training on Encrypted Data (2019, methodology): “Many more interactive protocols for the inference phase were suggested recently, including SecureML of Mohassel and Zhang [23], MiniONN of Liu et al. [22], Chameleon of Riazi et al. [26], and GAZEELE of Juvekar et al. [28].”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “[52] [53] [59] [60] [61, 62, 63] [65] [71, 72]”
ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation (2020, methodology): “Mixed 2PC protocols that combine GC-based and SS-based approaches benefit from their respective advantages and were used in many privacypreserving applications such as face recognition [49], fingerprint recognition [24], biometric matching [39], and machine learning [57, 73, 75, 91].”
A Principled Approach to Learning Stochastic Representations for Privacy in Deep Neural Inference (2020, neutral): “GAZELLE [11] 2018 ResNet-32 CIFAR-100 82.”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, background): “Homomorphic encryption techniques encrypt input data and then perform inference directly on encrypted data, albeit with significant performance penalty [19, 20, 21, 22].”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “Inference Shredder CryptoNets [19], GAZELLE [75] MiniONN [21] Arden [60], DPFE [42, 61]”
Private Machine Learning in TensorFlow using Secure Computation (2018, methodology): “The works of Mohassel and Zhang [2017], Juvekar et al. [2018], Wagh et al. [2018], Mohassel and Rindal [2018] focus on adapting secure computation protocols to private machine learning, in some cases using similar optimizations as the protocol presented in Section 2.”