XONN: XNOR-based Oblivious Deep Neural Network Inference

M.  Sadegh Riazi; Mohammad Samragh; Hao Chen; Kim Laine; Kristin Lauter; Farinaz Koushanfar

Paper 2019/171

XONN: XNOR-based Oblivious Deep Neural Network Inference

M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, and Farinaz Koushanfar

Abstract

Advancements in deep learning enable cloud servers to provide inference-as-a-service for clients. In this scenario, clients send their raw data to the server to run the deep learning model and send back the results. One standing challenge in this setting is to ensure the privacy of the clients' sensitive data. Oblivious inference is the task of running the neural network on the client's input without disclosing the input or the result to the server. This paper introduces XONN, a novel end-to-end framework based on Yao's Garbled Circuits (GC) protocol, that provides a paradigm shift in the conceptual and practical realization of oblivious inference. In XONN, the costly matrix-multiplication operations of the deep learning model are replaced with XNOR operations that are essentially free in GC. We further provide a novel algorithm that customizes the neural network such that the runtime of the GC protocol is minimized without sacrificing the inference accuracy. We design a user-friendly high-level API for XONN, allowing expression of the deep learning model architecture in an unprecedented level of abstraction. We further provide a compiler to translate the model description from high-level Python (i.e., Keras) to that of XONN. Extensive proof-of-concept evaluation on various neural network architectures demonstrates that XONN outperforms prior art such as Gazelle (USENIX Security'18) by up to 7×, MiniONN (ACM CCS'17) by 93×, and SecureML (IEEE S&P'17) by 37×. State-of-the-art frameworks require one round of interaction between the client and the server for each layer of the neural network, whereas, XONN requires a constant round of interactions for any number of layers in the model. XONN is first to perform oblivious inference on Fitnet architectures with up to 21 layers, suggesting a new level of scalability compared with state-of-the-art. Moreover, we evaluate XONN on four datasets to perform privacy-preserving medical diagnosis. The datasets include breast cancer, diabetes, liver disease, and Malaria.

Note: To appear in USENIX Security 2019.

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Preprint. MINOR revision.
Keywords: Privacy-Preserving Machine Learning Deep Learning Oblivious Inference Garbled Circuits Privacy-Preserving Medical Diagnosis
Contact author(s): sadeghriazi @ gmail com
History: 2019-09-13: revised; 2019-02-21: received; See all versions
Short URL: https://ia.cr/2019/171
License: CC BY

BibTeX

@misc{cryptoeprint:2019/171,
      author = {M.  Sadegh Riazi and Mohammad Samragh and Hao Chen and Kim Laine and Kristin Lauter and Farinaz Koushanfar},
      title = {{XONN}: {XNOR}-based Oblivious Deep Neural Network Inference},
      howpublished = {Cryptology {ePrint} Archive, Paper 2019/171},
      year = {2019},
      url = {https://eprint.iacr.org/2019/171}
}