[Paper Review] Outsourcing Private Machine Learning via Lightweight Secure Arithmetic Computation

Siddharth Garg, Zahra Ghodsi+4 more|arXiv (Cornell University)|Dec 4, 2018

Cryptography and Data Security39 references4 citations

TL;DR

This paper presents an actively secure protocol for outsourcing private machine learning computations using lightweight secure arithmetic computation, enabling collaborative inference on private data with strong security guarantees even under active (malicious) server corruption. The protocol achieves efficient, scalable secure inference for neural networks with quadratic activations, demonstrating practicality through real-world disease prediction workloads with minimal communication and computation overhead beyond standard secure two-party computation.

ABSTRACT

In several settings of practical interest, two parties seek to collaboratively perform inference on their private data using a public machine learning model. For instance, several hospitals might wish to share patient medical records for enhanced diagnostics and disease prediction, but may not be able to share data in the clear because of privacy concerns. In this work, we propose an actively secure protocol for outsourcing secure and private machine learning computations. Recent works on the problem have mainly focused on passively secure protocols, whose security holds against passive (`semi-honest') parties but may completely break down in the presence of active (`malicious') parties who can deviate from the protocol. Secure neural networks based classification algorithms can be seen as an instantiation of an arithmetic computation over integers. We showcase the efficiency of our protocol by applying it to real-world instances of arithmetized neural network computations, including a network trained to perform collaborative disease prediction.

Motivation & Objective

• To address the gap in secure machine learning outsourcing by providing active security against malicious cloud servers, which can deviate from the protocol.
• To enable collaborative inference on private data—such as medical records across hospitals—without exposing inputs or model weights.
• To overcome limitations of prior passively secure protocols, which fail under active attacks like adversarial perturbations that manipulate predictions.
• To design an efficient, practical protocol for secure neural network inference using arithmetic circuits with quadratic activations and minimal reliance on expensive cryptographic primitives.
• To ensure correctness even when all servers are corrupted, while maintaining privacy as long as at least one server is honest.

Proposed method

• The protocol uses a two-party computation (2PC) framework with secret sharing, where clients split their inputs and distribute shares to cloud servers.
• It employs a compiler that transforms a passive-secure 2PC protocol into an actively secure one using OLE (oblivious linear evaluation) and commitment primitives.
• The protocol includes a watchlist mechanism where each client monitors specific servers, enabling consistency checks on transmitted messages to detect manipulation.
• Coin tossing is emulated via a commitment-based protocol to generate shared randomness, replacing reliance on a trusted oracle.
• A degree test and permutation/equality checks are used to detect malicious behavior during multiplication and communication phases.
• The system uses a GMW-style multiplication protocol with two OLE calls to securely compute products from shared inputs.

Experimental results

Research questions

• RQ1 Can we design a secure machine learning outsourcing protocol that remains correct and private even when all cloud servers are actively malicious?
• RQ2 How can we efficiently enforce correctness and input consistency in a multi-server setting without relying on trusted hardware or expensive primitives?
• RQ3 What is the communication and computation overhead of achieving active security in secure neural network inference compared to passive security?
• RQ4 Can we achieve practical efficiency for real-world neural network workloads, such as disease prediction, using only lightweight cryptographic techniques?
• RQ5 How does the protocol’s security degrade under increasing numbers of corrupted servers, and what thresholds ensure robustness?

Key findings

• The protocol achieves statistical security with error bounds of (e+2)/|F|^σ + (1−e/n)^t + ((3e+2w+2t)/n)^t, ensuring strong security guarantees under active corruption.
• Communication complexity is dominated by OLE invocations and output transmission, with total cost of O(n·d·CC_ρ + n·d·log|F|), where d is the network depth and CC_ρ is the OLE cost.
• The protocol supports secure inference for real-world neural networks with quadratic activations, including a collaborative disease prediction model, demonstrating practical feasibility.
• The use of watchlists and consistency checks enables detection of malicious behavior, including adversarial perturbations that could alter predictions.
• The protocol maintains correctness even when all servers are corrupted, while preserving privacy as long as at least one server is honest.
• The system is efficient enough for deployment in privacy-sensitive applications such as medical diagnostics, with minimal overhead beyond standard secure computation.