[Paper Review] Gazelle: A Low Latency Framework for Secure Neural Network Inference

Chiraag Juvekar, Vinod Vaikuntanathan+1 more|arXiv (Cornell University)|Jan 16, 2018

Cryptography and Data SecurityComputer Science23 references175 citations

TL;DR

Gazelle combines packed additive homomorphic encryption and garbled circuits to enable secure CNN inference with much lower online latency and bandwidth than prior works.

ABSTRACT

The growing popularity of cloud-based machine learning raises a natural question about the privacy guarantees that can be provided in such a setting. Our work tackles this problem in the context where a client wishes to classify private images using a convolutional neural network (CNN) trained by a server. Our goal is to build efficient protocols whereby the client can acquire the classification result without revealing their input to the server, while guaranteeing the privacy of the server's neural network. To this end, we design Gazelle, a scalable and low-latency system for secure neural network inference, using an intricate combination of homomorphic encryption and traditional two-party computation techniques (such as garbled circuits). Gazelle makes three contributions. First, we design the Gazelle homomorphic encryption library which provides fast algorithms for basic homomorphic operations such as SIMD (single instruction multiple data) addition, SIMD multiplication and ciphertext permutation. Second, we implement the Gazelle homomorphic linear algebra kernels which map neural network layers to optimized homomorphic matrix-vector multiplication and convolution routines. Third, we design optimized encryption switching protocols which seamlessly convert between homomorphic and garbled circuit encodings to enable implementation of complete neural network inference. We evaluate our protocols on benchmark neural networks trained on the MNIST and CIFAR-10 datasets and show that Gazelle outperforms the best existing systems such as MiniONN (ACM CCS 2017) by 20 times and Chameleon (Crypto Eprint 2017/1164) by 30 times in online runtime. Similarly when compared with fully homomorphic approaches like CryptoNets (ICML 2016) we demonstrate three orders of magnitude faster online run-time.

Motivation & Objective

• Address the privacy problem of cloud-based CNN inference where clients keep inputs private and servers keep model parameters private.
• Design a scalable system that achieves low online latency for secure CNN inference.
• Leverage a hybrid of homomorphic encryption and garbled circuits to optimize linear and non-linear computation stages.

Proposed method

• Introduce Gazelle as a three-part system: Gazelle Homomorphic Layer for fast SIMD addition, SIMD scalar multiplication, and automorphisms; Gazelle Linear Algebra kernels for fast homomorphic matrix-vector multiplications and convolutions; Gazelle Network Inference that switches between garbled circuits and homomorphic evaluation for full CNN inference.

Experimental results

Research questions

• RQ1 How can one partition CNN inference tasks to exploit the strengths of homomorphic encryption for linear layers and garbled circuits for non-linear layers?
• RQ2 What are the performance trade-offs between (F)HE and garbled circuits in secure CNN inference, and how can they be optimized in practice?
• RQ3 Can a combined PAHE-GC approach achieve lower online latency and bandwidth than existing secure inference systems?

Key findings

• Gazelle achieves 20x faster online runtime than MiniONN (ACM CCS 2017) for CIFAR-10 and 30x faster than Chameleon (Crypto Eprint 2017/1164).
• Gazelle offers three orders of magnitude faster online run-time than CryptoNets (ICML 2016) for end-to-end secure inference.
• Online bandwidth per inference is reduced to about 0.3 GB for CIFAR-10 networks, versus 6.2 GB for MiniONN.
• Gazelle demonstrates end-to-end latency of 3.6 seconds in LAN setting versus 72 seconds for MiniONN on CIFAR-10 networks.
• The system achieves near-plaintext-like performance for linear algebra primitives with 10-20x slowdown relative to plaintext for the Gazelle Homomorphic Layer.