[Paper Review] XONN: XNOR-based Oblivious Deep Neural Network Inference

M. Sadegh Riazi, Mohammad Samragh+4 more|arXiv (Cornell University)|Feb 19, 2019

Privacy-Preserving Technologies in Data57 references112 citations

TL;DR

Xonn introduces a binary neural network framework using Garbled Circuits where multiplications are replaced by XNOR operations, enabling constant-round, privacy-preserving DNN inference with substantial speedups over prior GC-based and HE-based approaches.

ABSTRACT

Advancements in deep learning enable cloud servers to provide inference-as-a-service for clients. In this scenario, clients send their raw data to the server to run the deep learning model and send back the results. One standing challenge in this setting is to ensure the privacy of the clients' sensitive data. Oblivious inference is the task of running the neural network on the client's input without disclosing the input or the result to the server. This paper introduces XONN, a novel end-to-end framework based on Yao's Garbled Circuits (GC) protocol, that provides a paradigm shift in the conceptual and practical realization of oblivious inference. In XONN, the costly matrix-multiplication operations of the deep learning model are replaced with XNOR operations that are essentially free in GC. We further provide a novel algorithm that customizes the neural network such that the runtime of the GC protocol is minimized without sacrificing the inference accuracy. We design a user-friendly high-level API for XONN, allowing expression of the deep learning model architecture in an unprecedented level of abstraction. Extensive proof-of-concept evaluation on various neural network architectures demonstrates that XONN outperforms prior art such as Gazelle (USENIX Security'18) by up to 7x, MiniONN (ACM CCS'17) by 93x, and SecureML (IEEE S&P'17) by 37x. State-of-the-art frameworks require one round of interaction between the client and the server for each layer of the neural network, whereas, XONN requires a constant round of interactions for any number of layers in the model. XONN is first to perform oblivious inference on Fitnet architectures with up to 21 layers, suggesting a new level of scalability compared with state-of-the-art. Moreover, we evaluate XONN on four datasets to perform privacy-preserving medical diagnosis.

Motivation & Objective

• Motivate privacy-preserving cloud-based DNN inference where client data and results must remain private.
• Propose a scalable end-to-end framework (Xonn) that replaces costly matrix multiplications with XNOR operations within Garbled Circuits.
• Design a learning and compilation pipeline to tailor DNNs for GC-based inference without sacrificing accuracy.
• Provide a high-level API and a compiler to translate Keras models into Xonn representations.
• Demonstrate scalability to deep networks (up to 21 layers) and evaluate on medical datasets.

Proposed method

• Train neural networks as Binary Neural Networks to replace multiplications with XNOR-based computations in the GC protocol.
• Introduce a network customization workflow (Linear Scaling and Network Trimming) to balance accuracy and GC cost.
• Use an Oblivious Transfer-based Oblivious Conditional Addition (OCA) protocol to efficiently handle non-binary inputs in the first layer.
• Translate high-level models (Keras) to Xonn via a compiler and provide a high-level API for model description.
• Evaluate oblivious inference latency against prior work (Gazelle, MiniONN, SecureML) and demonstrate constant-round interaction across layers.

Experimental results

Research questions

• RQ1 How can DNN inference be made oblivious with reduced interaction rounds independent of network depth?
• RQ2 What training/pruning strategies enable accurate Binary Neural Networks suitable for GC-based inference?
• RQ3 Can first-layer non-binary inputs be efficiently integrated with binary-weighted networks using OT-based protocols?
• RQ4 What are the practical latency gains of Xonn compared to existing GC-based and HE-based privacy-preserving inference frameworks?
• RQ5 Is it scalable to deeper networks (e.g., up to 21 layers) and applicable to medical diagnostic datasets?

Key findings

• Xonn achieves up to 7x lower latency than Gazelle and up to 93x lower latency than MiniONN for oblivious inference.
• Xonn outperforms DeepSecure by 60x and CryptoNets by 1859x in GC/HE-based comparisons.
• The framework maintains inference accuracy with binary weights and activations despite replacing multiplications with XNOR operations.
• Xonn supports a constant-round interaction model regardless of model depth, improving practicality in internet-scale settings.
• This work demonstrates oblivious inference on networks with up to 21 layers and evaluates on medical datasets (breast cancer, diabetes, liver disease, Malaria).