Fusion: Efficient and Secure Inference Resilient to Malicious Servers

Being one of the important types of deep learning, convolutional neural network (CNN) inference computations mainly contain four components, i.e., convolutions, which extract different features from a dataset, pooling layer, which mainly attempts to reduce the dimensionality, activation function, which is used as a feature transformation method to increase the expression ability, and fully connected layer, which takes the outputs of other components and produces the final outputs. All those components are connected, and ultimately form a multi-layer network structure, where the outputs of one layer can be the inputs of other layers. CNN inference usually contains a lot of computationally expensive linear and non-linear computations. For example, convolutions usually contain multiple linear matrix multiplications; activation functions such as rectified linear unit (ReLU) [48] are nonlinear transformations. Pooling functions (e.g., max pooling functions) usually are nonlinear operations as well.

In MLaaS without considering privacy preservation, the client’s inputs are directly sent to the server who produces the inference results, and the highly sensitive inputs (e.g., raw medical test results) can be leaked to the server. As such, the privacy-preserving neural network inference is introduced, which generates the outputs without leaking sensitive inputs to the server. At a high level, the client and the server adopt cryptographic techniques to perform inference computations for protecting their own inputs. Among all the privacy-preserving inference frameworks, semi-honest privacy-preserving inference gained popularity due to its practical efficiency.

An intuitive way to implement privacy-preserving inference is through two-party computation (2PC). 2PC is a sub-problem of secure multi-party computation (MPC), which allows two parties to jointly compute a function without sacrificing their input privacy. However, due to the complexity of operation types (e.g., nonlinear comparison operations, matrix multiplication) and plenty of conversions between these operations in neural networks, directly using general 2PC schemes faces efficiency challenges.

Having seen the efficiency challenges, researchers proposed hybrid 2PC-based privacy-preserving inference protocols [43, 30, 46, 21], which improve the overall efficiency by using appropriate cryptographic techniques for different kinds of computation or designing new efficient subprotocols. In the following, we would like to introduce a few popular hybrid 2PC-based privacy-preserving inference frameworks:

• •

  ABY [13] is a semi-honest mixed-protocol framework that combines Arithmetic (A) sharing, Boolean (B) sharing, and Yao’s (Y) garbled circuits, and designs efficient conversions between every pair of the three. It also adopts a set of existing state-of-the-art optimizations in a novel fashion and provides instantiations.

• •

  DELPHI [46] combines the additive homomorphic encryption with garbled circuits (HE is used to perform linear matrix multiplication while GC is used to perform non-linear operations) and connects them by additive secret sharing (e.g., the output of the linear layer are additive secret shares of computation results that are ultimately fed into the GC for non-linear operations). Besides, it allows users to automatically generate neural networks that mix these two methods and navigate the trade-off between accuracy and performance.

• •

  CrypTFlow2 [59] is also a hybrid inference protocol that shares some similarity with DELPHI. To improve efficiency, it proposes a more efficient millionaires protocol $\Pi_{\text{MILL}}^{l,m}$ for securely computing the Yao’s millionaires’ problem (which is used for non-linear operations such as DReLU and Maxpool). CrypTFlow2 also provides two options, i.e., $\text{SCI}_{\text{OT}}$ and $\text{SCI}_{\text{HE}}$ that use oblivious transfer and homomorphic encryption techniques to perform computationally costly linear operations such as matrix multiplication or convolution.

• •

  Cheetah [21] is also a hybrid secure inference scheme that utilizes two lattice-based homomorphic encryptions [8] (i.e., learning with errors (LWE) and its ring variant (ring-LWE)) to perform secure linear layers (e.g., matrix multiplications in convolution), and makes some optimizations on the millionaire protocol [59] for non-linear layer (e.g., activation function). They achieve performance optimizations based on the insightful observation that matrix multiplication results can be represented as the coefficients in specific positions of polynomial multiplication, which can be efficiently performed using ring-LWE. For the non-linear layers, they optimize the millionaire protocol by adopting VOLE-style OT and customizing truncation protocols.

Similar to previous efforts (e.g., [16, 64, 38]), in this paper, we consider the server is malicious that may not follow the protocol while the client is honest. In particular, given there are two roles (i.e., the server and the client), we make the following assumptions for each of them respectively:

• •

  Server: We assume that the server may trick the clients by using a low-quality model (in terms of accuracy) as input. Meanwhile, the server may deviate from the protocol specification. However, the server still aims to convince the client that the inference results are correctly computed from the client’s query samples using a high-quality model (e.g., high accuracy).

• •

  Client: The client honestly follows the protocol but may attempt to obtain additional information (i.e., semi-honest). The client also holds a set of samples to be queried. We additionally assume that the client has access to a subset of public samples whose type is the same as its query samples. This is reasonable since there are plenty of public datasets with different categories (e.g., images, audio, and healthcare data) that can be used for various purposes (e.g., face recognition and medical diagnosis). In particular, we can even find publicly available datasets that are as sensitive as medical records on some large national databases (e.g., TGGA [22] and NCBI [49]) or institutes (e.g., AIMI [6]), as data sharing can help accelerate disease research and improve diagnostic methods. Examples of those medical records datasets include genomic data [50, 23], gene expression profiles [66, 51], COVID-19-Data [45, 63], and medical image data [6, 39]. As such, it is practical for clients to obtain a number of public samples for use.

While the semi-honest assumptions (by assuming the server and the client will honestly follow the protocol without cheating and other misbehavior) are practical and widely adopted by a lot of previous efforts, there is no reason to believe that such an assumption will result in expected outputs. For example, the server may be malicious, which feeds the protocol low-quality model to trick the clients as discussed in §III-A. As such, this paper considers a much stronger threat model, which attempts to meet at least the following security goals: (1) we should not leak the input privacy of both the server and the client; (2) we should ensure the computation correctness of the outputs; and (3) we should ensure the accuracy of the inference results (e.g., the server uses high-quality models as inputs).

• •

  R1. Model Accuracy. The accuracy (e.g., $\eta$) of the model that the server uses as input should meet the requirement (e.g., $\delta$). Assume that the model accuracy $\eta$ is calculated. If $\eta\geq\delta$, the verification of model accuracy passes.
  

• •

  R2. Computation Correctness. In an execution of $\Pi_{\textit{Fusion}}$, the probability that the client’s output on every input vector $\mathrm{x}_{i}$ is not the correct inference result $\mathrm{M}(\mathrm{x}_{i})$ is negligible in security parameter $\lambda$.
  

• •

  R3. Privacy. The server and the client both feed their private inputs to $\Pi_{\textit{Fusion}}$. As such, from the perspective of privacy preservation, the client and the server is said to securely execute $\Pi_{\textit{Fusion}}$ against a malicious server and semi-honest client if the following properties are satisfied:

  • –

    Malicious Server Security. The view of the server during a real execution of protocol $\Pi_{\textit{Fusion}}$ is denoted by $\textsf{View}_{\mathcal{S}}^{\Pi_{\textit{Fusion}}}$. For any server $\mathcal{S}$, there exists a probabilistic polynomial-time simulator $\textsf{Sim}_{\mathcal{S}}$ such that for any input $\mathrm{M}$ of the server and $\mathrm{x}_{i}$ of the client, we have:
    

    $\textsf{View}_{\mathcal{S}}^{\Pi_{\textit{Fusion}}}\approx_{c}\textsf{Sim}_{\mathcal{S}}(\mathrm{M})$

    That is, $\textsf{Sim}_{\mathcal{S}}$ can simulate a computationally indistinguishable view of the malicious server without knowing the client’s private inputs and inference results.

  • –

    Semi-honest Client Security. The view of the client during a real execution of protocol $\Pi_{\textit{Fusion}}$ is denoted by $\textsf{View}_{\mathcal{C}}^{\Pi_{\textit{Fusion}}}$. For any client $\mathcal{C}$, there exists a probabilistic polynomial-time simulator $\textsf{Sim}_{\mathcal{C}}$ such that for any input $\mathrm{M}$ of the server and $\mathrm{x}_{i}$ of the client, we have:
    

    $\textsf{View}_{\mathcal{C}}^{\Pi_{\textit{Fusion}}}\approx_{c}\textsf{Sim}_{\mathcal{C}}(\mathrm{x}_{i},\mathrm{M}(\mathrm{x}_{i}))$

    That is, $\textsf{Sim}_{\mathcal{C}}$ can simulate a computationally indistinguishable view of the semi-honest client without knowing the server’s model.

As discussed in §III-B, there are three goals that need to be fulfilled in the presence of a malicious server, i.e., model accuracy, computation correctness, and privacy. To our best knowledge, there is no existing work that satisfies all three goals mentioned above in neural network inference. The latter two requirements (R2 and R3) can be achieved by directly adopting general maliciously secure protocols (e.g., popular SPDZ-style protocols [12, 31]), though they are not efficient enough for performing neural network inference. In addition, maliciously secure protocols do not provide guarantees for the model accuracy (e.g., those protocols cannot force the server to use a high-quality model as input). Even though there are some additional techniques that could potentially be used to verify model accuracy, they usually involved heavy cryptographic techniques (e.g., using ZK proofs and commitments [64] to convert publicly committed data into privately authenticated values). As such, it is challenging to achieve all three goals in neural network inference efficiently.

Our goal is to achieve all three security requirements without using heavy cryptographic techniques such as ZK proofs. Generally, the privacy requirement (R3) can be achieved by adopting efficient 2PC protocols to perform the neural network inference. We now discuss how to fulfill model accuracy (R1) and model correctness (R2) at the same time. Our idea is that if we can know the outputs of specific inputs in advance, we can use such knowledge to ensure the computation correctness and model accuracy. This is because if the server causes wrong results (violating R2) or uses low-quality inputs (violating R1), the client can notice that by comparing the expected outputs (which are known in advance) with the actual outputs (which are obtained at real time), thereby forcing the server to behave honestly. Particularly, knowing the outputs in advance is possible, since there are samples (e.g., TGGA [22] and NCBI [49] databases) where both the inputs and outputs (labels) are publicly available, as discussed in §III-A. The key question now becomes how we can find a way to appropriately utilize these public samples, and feed them into the server to achieve R1 and R2.

The first solution that comes to our mind is cut-and-choose technique [42], a leading technique used to convert Yao’s garbled circuit [69] to be maliciously secure: in our scenarios, we need a method to pinpoint the server’s malicious behavior, while the insight behind the cut-and-choose technique is that if a malicious generator (which takes responsible for constructing garbled circuits for computing a function, such as a server) constructs incorrect garbled circuits, the evaluator (which evaluates the garbled circuits to obtain outputs, such as a client) would detect the malicious behavior with high probability. We now provide more details of batched cut-and-choose (that can amortize the cost across many executions of the same protocol): the generator first constructs many garbled circuits and sends them to the evaluator, then the evaluator asks the generator to open some of the garbled circuits (e.g., revealing the decryption keys corresponding the chosen garbled circuits) for checking the correctness of these garbled circuits (meaning that the circuit indeed computes the expected function). If all opened circuits are correctly constructed, the remaining circuits are randomly grouped into various buckets of a specific size, and all garbled circuits in the same bucket are evaluated with the same inputs from two parties. As a result, the evaluator would identify the malicious behavior (by checking the construction correctness of opened circuits and the result consistency of all copies in the same bucket) with high probability if the generator constructs incorrect garbled circuits.

However, the cut-and-choose strategy cannot be directly applied to compile the hybrid 2PC-based inference protocol (which typically utilizes additive secret sharing to connect two different cryptographic protocols such as HE and GC) to a maliciously secure one. The reasons for that are multiple: First, the cut-and-choose technique for GC only ensures the correctness (meaning that the garbled circuit is correctly constructed for computing the expected function). However, in our case, we need to verify the server’s inputs (not the produced garbled circuits) which the cut-and-choose technique itself cannot achieve. Second, the cut-and-choose technique directly opens the generated circuits for checking correctness because the garbled circuits themselves do not relate to specific inputs (if they are never used for evaluation), and therefore can be opened publicly without sacrificing the privacy of both parties’ inputs. However, in our scenarios, we customize the mix-and-check method to convert semi-honest inference protocols into maliciously secure counterparts, while the underlying hybrid 2PC-based inference protocols generally do not have the structure that can be directly opened for checking correctness without sacrificing input privacy.

Based on our newly proposed mix-and-check method, we design a new maliciously secure inference protocol, Fusion. We assume that before the server and client run Fusion, the server trains a model and uses it to provide the inference services. As shown in Figure 2, Fusion works as follows:

1. 1.

   Mixed Dataset Preparation. The client locally prepares a mixed dataset (with public samples, and the samples to be queried) and utilizes the mixed dataset as input for the privacy-preserving inference computations.

2. 2.

   Privacy-Preserving Inference Execution. The server and the client jointly perform the semi-honest privacy-preserving inference protocols, and the inference results are only revealed to the clients.

3. 3.

   Model Accuracy and Computation Correctness Verification. The client verifies the model accuracy on public samples, and computation correctness through the consistency check of inference results for all copies of every query sample. The client accepts the inference results if the above two checks pass.

We summarize the maliciously secure inference protocol $\Pi_{\textit{Fusion}}$ in Figure 3 and describe the process in detail as follows.

The random shuffle of the query samples and public samples is easy to design and implement, and therefore, in the following, we would like to discuss how to select optimal $B$ and $T$. Particularly, we have two requirements. First, the server should not successfully trick the client into believing that the incorrect or low-quality results are correctly produced by a high-quality model. The statistical security parameter is denoted by $\lambda$. The security requirement is to guarantee that the server succeeds in cheating with a probability (which depends on specific $R$, $B$, and $T$) at most $2^{-\lambda}$. We denote this requirement as security requirement. Second, in order to achieve the best efficiency, the goal of this phase is to pick the concrete numbers of $B$ and $T$ (given a specific $R$) that minimize the cost per query sample while satisfying the security requirement. We denote this requirement as the cost requirement. Specifically, computation and communication costs per query sample is proportional to the number of public samples $T$ and the number of copies $B$ for each query sample. As such, we have to solve a parameter optimization problem that satisfies the security requirement meanwhile meeting the cost requirement.

We are now starting with the security requirement. The server can succeed in cheating the client when (1) the server passes the accuracy check of public samples: accuracy is calculated based on the $T$ public samples; and (2) the server also passes the consistency check of query samples: the inference results of all copies for every query sample are consistent and the inference results of some query samples are incorrect (produced by a low-quality model or incorrect inference computations). Without loss of generality, we further define those two types of passes mathematically:

• •

  Accuracy Check of Public Samples: To simplify the problem, we assume that the server knows $T$ and $B$. Assume that the server attempts to corrupt $i$ query samples by providing $iB$ incorrect-but-consistent inference results for all copies of every query sample. If the server attempts to pass the check of model accuracy (accuracy check of public samples), it should use the high-quality model as input for the $T$ public samples. Let $E_{T}$ denote the event in which the server uses a high-quality model to correctly perform the inference computations on all $T$ public samples. As such, we have the probability Pr[$E_{T}$] that event $E_{T}$ happens:

  	$\displaystyle\text{Pr}[E_{T}]$	$\displaystyle=\frac{\dbinom{RB+T-iB}{T}}{\dbinom{RB+T}{T}}$		(1)
  		$\displaystyle=\frac{(RB+T-iB)!(RB)!}{(RB-iB)!(RB+T)!}.$

• •

  Consistency Check of Query Samples: Let $E_{B}$ denote the event in which the $iB$ incorrect inference results chosen by the server are exactly the incorrect-but-consistent results for $i$ query samples. There are $(RB)!$ ways to permute the $RB$ query samples. Again, if the server attempts to cheat the client successfully, it should provide incorrect-but-consistent inference results for $iB$ copies of the $i$ query samples, and use the high-quality model to perform correct inference computations for the remaining samples. Similarly, the probability $\text{Pr}[E_{B}]$ that event $E_{B}$ happens is as follows:

  $$\text{Pr}[E_{B}]=\frac{\dbinom{R}{i}(iB)!(RB-iB)!}{(RB)!}.$$

  (2)

Given that the server can succeed in cheating when it can pass both accuracy check of public samples and consistency check of query samples at the same time, combining Equation 1 and Equation 2, the probability $\text{Pr}_{success}$ that the server succeeds in cheating is as follows:

As long as $T\geq B$, we have the following equation (which is proved in §V):

The security requirement states that $\text{Pr}_{success}$ should be no more than $2^{-\lambda}$ for every choice of $i$ by the server and of $R$, $B$, and $T$ by the client.

On the basis of satisfying the security requirement, another goal is to find the optimal $B$ and $T$ that meet the cost requirement (e.g., leading to the lowest amortized cost per query sample). We denote a cost function $\textit{cost}(B,T,R)=\frac{RB+T}{R}$ which denotes the amortized cost per query sample. Specifically, the parameter optimization problem must ensure the security constraint $\text{Pr}_{success}\leq 2^{-\lambda}$, and should try to minimize the cost function. We additionally set a lower bound $\beta$ of the number of public samples for ensuring the reliability of the accuracy check of public samples. Therefore, the parameter optimization problem can be expressed as follows.

subject to

To find the optimal $B$ and $R$ that satisfy the security requirement with minimized amortized cost, we design a search algorithm (shown in Figure 4) based on the probability constraint and cost function. For a given $R$, we search for a pair $(B,T)$ that minimizes the cost function $\textit{cost}(B,T,R)=\frac{RB+T}{R}$ while satisfying the security requirement (e.g., $\text{Pr}_{success}\leq 2^{-\lambda}$). Specifically, for every choice of $B$ ranging from 2 to $\lambda$, we search for $T$ for a given $B$ until we find the smallest $T$ that satisfies the security requirement (the amortized cost decreases as $T$ decreases). We continue to explore and update the optimal pair $(B^{*},T^{*})$ with the current pair $(B,T)$ if the current pair saves more of the amortized cost (according to the cost function) than the optimal pair. Finally, we obtain the optimal $(B,T)$ that minimizes the amortized cost while satisfying the security requirement when the protocol terminates.

The experimental results of communication and runtime between LevioSA and Fusion are shown in Figure 6. Our results show that Fusion has 48.06$\times$ less runtime and uses 30.90$\times$ less communication compared to LevioSA.

The total communication and runtime of Fusion when using different $R$ (resulting in different $B$) in the MNIST and CIFAR-10 datasets are shown in Table II and Table III respectively. It can be observed that Fusion can achieve the best efficiency when using Cheetah [21] as the building block, while when Fusion uses ABY [13] and DELPHI [46], the performance is not as good as that of using others. For example, the Cheetah-based Fusion can save around 10$\times$ communication, and is roughly 2.5$\times$ and 4.8$\times$ faster (in the LAN and WAN respectively) compared with those using CrypTFlow2 on both the MNIST and CIFAR-10 datasets. When comparing the performance of DELPHI-based Fusion, Cheetah-based Fusion uses more than 105$\times$ less communication and is about 22$\times$ faster and 37$\times$ faster (in the LAN and WAN settings respectively) on these two datasets.

In Table IV, we compare the communication and runtime per query sample of Fusion with those of ABY [13], DELPHI [46], and CrypTFlow2 [59]. Note that the amortized cost of Fusion decreases as $B$ decreases, and greater performance improvements will be achieved. The experimental results imply that Fusion is more efficient than ABY, DELPHI, and CrypTFlow2 in terms of communication when $R\geq 2^{5}$, $B\leq 7$, and $T=100$. For instance, when using the MNIST dataset and setting $R=2^{5}$, $B=7$, $T=100$, the communication cost of Fusion is 14.13$\times$, 10.61$\times$, 1.04$\times$ lower than those of ABY, DELPHI, CrypTFlow2, respectively. When $R\geq 2^{5}$ and corresponding $B\leq 7$, Fusion is faster than ABY and DELPHI in both the LAN and WAN settings. For example, when $R=2^{9}$, $B=5$, and $T=100$, Fusion is about 10.52$\times$ and 7.37$\times$ faster than ABY and DELPHI respectively on the CIFAR-10 dataset in the WAN setting. Fusion uses about 2.62$\times$ less communication, and is 1.25$\times$ faster than CrypTFlow2 on MNIST dataset in the WAN setting when $R=2^{13}$ and $B=4$.

In MLaaS, a semi-honest client who correctly follows the protocol still has some other approaches to steal the server’s model, and the black-box model extraction attack [62, 53, 5, 25] is one of them. In this type of attack, the client with black-box access keeps querying the model to extract an equivalent ML model. Since this type of attack is getting more attention recently, and the threat model of this attack is consistent with ours (i.e., the client is semi-honest), in this section, we would like to discuss the scalability of Fusion (e.g., how hard or easy to integrate prior defenses into Fusion) in defending against model extraction attacks. As such, the researchers who would like to use our Fusion and also have the requirements of defending against model extraction attacks can benefit from our paper in a timely manner.

While it is true that there are already numerous defense measures that can work against model extraction attacks (e.g., [26, 65, 67]), intuitively, we can directly use any of those off-the-shelf solutions. However, we would like to note there should be at least two criteria that need to be fulfilled. First, Fusion can verify model accuracy (R1), computation correctness (R2), and preserve privacy (R3). The integrated solution should not introduce weaknesses to break those guarantees. Second, Fusion itself is cryptographic-friendly, and as such, we should not introduce heavy cryptographic-based solutions for performance concerns. Fortunately, we adopt a passive defense method [37] that satisfies all those design criteria by perturbing the model’s activation layer to change the output probabilities. As the solution directly makes changes to the neural network, it will not introduce extra overhead on Fusion, and allows Fusion to achieve the three requirements even when the solution is adopted. Consequently, by integrating the solution, Fusion is defense-effective against the model extraction attacks (e.g., the accuracy of the client’s stolen model drops by up to 42.7% compared with when not using defense) meanwhile maintaining the utility (e.g., reducing the model accuracy with no defense by 1.75%). Moreover, the presence of defense only causes low extra costs, accounting for less than 1% of the overall runtime and communication. We have detailed design and evaluation in Appendix §A for readers of interest.

The prominent contribution of Fusion lies in providing a flexible and efficient compiler for secure inference, which achieves verification of model accuracy and computation correctness effectively. As a general compiler, Fusion offers flexibility in selecting semi-honest inference protocols as underlying building blocks to instantiate Fusion. Specifically, these semi-honest inference protocols may utilize various sub-protocols such as secret sharing protocols, HE, GC, OT, etc. As such, the malicious server plays distinct roles within different sub-protocols, e.g., a computing party in HE, a garbler in GC, a receiver in OT, etc. The server may perform various malicious behaviors according to specific sub-protocols and corresponding roles. When the underlying semi-honest inference protocol is very complicated and uses many types of sub-protocols, it becomes more challenging to detect the malicious server’s misbehavior and prevent privacy leakage. When the malicious server possesses stronger ability in some parts of the sub-protocols, it can lead to unforeseen complications. Therefore, a judicious selection of the underlying building blocks is important to mitigate unpredictable privacy issues.

To analyze the selection of underlying semi-honest inference protocols for instantiating Fusion, we roughly classify secure inference protocols into three categories based on the cryptographic techniques utilized: ($i$) secret sharing based protocols that use Arithmetic sharing and Boolean sharing based protocols, e.g., CrypTFlow [34]. ($ii$) hybrid protocols that use HE and GC to perform linear and non-linear layers respectively, e.g., DELPHI [46]. ($iii$) hybrid protocols that use HE and Millionaire protocol to perform linear and non-linear layers respectively, e.g., CrypTFlow2 [59] and Cheetah [21]. CrypTFlow2 and Cheetah can improve the efficiency of non-linear layers by using the Millionaire protocol than using GC to perform non-linear layers like DELPHI. In addition, when using GC in DELPHI, the malicious server can act as a malicious GC garbler or malicious OT receiver, and tries to steal additional information by misbehaving in the protocols. Although these problems may be avoided by assigning the malicious server the role of a GC evaluator or OT sender, we can alternatively choose other types of protocols that do not rely on GC to perform non-linear layers.

To avoid these possible problems, we suggest choosing a secret sharing based comparison protocol to implement non-linear layers. When using secret sharing based protocols (e.g., CrypTFlow) to achieve both linear and non-linear layers, the intermediate results a malicious server obtains are random secret shares. Additionally, hybrid protocols using the Millionaires protocol to perform non-linear layers have a similar property. For instance, Cheetah and CrypTFlow2 perform non-linear layer by using secret sharing based Millionaire protocol, which involves 1-out-of-n OT and secret sharing based AND operation. If the malicious server acts as the sender, a malicious sender can only cause incorrect results. Else if the server acts as the receiver, even if a malicious receiver can obtain the sender’s all messages, it cannot reveal the sender’s input as the messages are inputs masked by randomly sampled values. By preventing the malicious server from acting as the receiver, we avoid the scenarios where it possesses more power to conduct malicious behaviors and extract information. For other unforeseen cases, careful selection of sub-protocols or suitable roles for the server within the sub-protocols can be explored as potential solutions. Overall, we recommend choosing secret sharing based inference protocols to instantiate Fusion.

In an outsourcing scenario, some servers are responsible for performing the secure inference protocol, and the client does not participate in the inference computations. Typically, the client provides query samples to and receives inference results from the servers such that the servers cannot know both the client’s inputs and inference results. Based on the adopted threat model, the secure inference protocols in the outsourcing scenario can further have two types:

The major difference between Fusion and those schemes is the scenarios: those schemes all work in the outsourcing scenario, while Fusion work in the non-outsourcing scenario. Moreover, our Fusion additionally supports a stronger security level (i.e., malicious security in the dishonest majority). Moreover, our scheme can ensure the computation correctness and verification of model accuracy in the presence of a malicious server.

In the non-outsourcing scenario, the client participates in performing the 2PC-based secure inference protocol by interacting with the server and finally obtains the inference results. Similarly, there are also two types correspondingly:

• •

  ZK Proof-based Protocols: There are some schemes [70, 44, 64] that adopt zero-knowledge proofs to achieve verifiable inference computations. Verifiable inference services based on ZK proofs allow one party with a secret witness to prove some statement (e.g., the inference results are correctly produced by the expected model) without revealing private information. Schemes based on ZK proofs have the advantage of being publicly verifiable. It usually assumes, however, that the client’s input is visible to the server. As a consequence, it is unable to apply to scenarios where both model and client’s inputs are required to be protected, while our scheme preserves the privacy of both the server and client’s inputs.

• •

  TEE-based Protocols: CrypTFlow [34] presents a novel technique, called Aramis, that takes any semi-honest secure MPC protocol for computation and converts it into a malicious secure MPC protocol by using hardware Intel SGX. Our scheme is a purely cryptographic protocol and does not require the trust in hardware.

• •

  MPC-based Protocols: If there exists a malicious party in 2PC computation, it definitely has to achieve malicious security with the dishonest majority (meaning the number of corrupted parties is greater than or equal to half of the total number of parties involved in MPC). Naturally, MPC protocols that consider malicious security in the dishonest majority are relatively complicated problems compared with those achieve malicious security in the honest majority setting or semi-honest security. Since the malicious security in the honest majority setting (a weaker security model) naturally bring dramatic performance improvements and is generally used in an outsourcing scenario, it is unfair to compare them [57, 56, 11, 32] with Fusion which achieves malicious security in the dishonest majority.

As shown in Table VII, our scheme is the only scheme that satisfies all the three requirements (i.e., R1, R2 and R3) that proposed in this paper at the same time, while other works have their own different focuses. In particular, our work considers the verification of the inputs (R1), and currently, only a few works have considered it. When compared with those works that fulfilled R1, our work does not use ZK proofs, which is more computational friendly. We would like to note that the most similar work to ours is LevioSA [18] which achieves maliciously secure 2PC arithmetic computation in the dishonest majority setting and applies it to neural network classification. It proposes a passive-to-active oblivious linear function evaluation (OLE) compiler by following the high-level approach of IPS compiler [24, 41]. Different from their work, our Fusion additionally achieves the verification of model accuracy.