C2PI: An Efficient Crypto-Clear Two-Party Neural Network Private
  Inference
Recently, private inference (PI) has addressed the rising concern over data
and model privacy in machine learning inference as a service. However, existing
PI frameworks suffer from high computational and communication costs due to the
expensive multi-party computation (MPC) protocols. Existing literature has
developed lighter MPC protocols to yield more efficient PI schemes. We, in
contrast, propose to lighten them by introducing an empirically-defined privacy
evaluation. To that end, we reformulate the threat model of PI and use
inference data privacy attacks (IDPAs) to evaluate data privacy. We then
present an enhanced IDPA, named distillation-based inverse-network attack
(DINA), for improved privacy evaluation. Finally, we leverage the findings from
DINA and propose C2PI, a two-party PI framework presenting an efficient
partitioning of the neural network model and requiring only the initial few
layers to be performed with MPC protocols. Based on our experimental
evaluations, relaxing the formal data privacy guarantees C2PI can speed up
existing PI frameworks, including Delphi [1] and Cheetah [2], up to 2.89x and
3.88x under LAN and WAN settings, respectively, and save up to 2.75x
communication costs.
Yuke Zhang, Dake Chen, Souvik Kundu, Haomei Liu, Ruiheng Peng, Peter A. Beerel
# C\({}^{2}\)PI: An Efficient Crypto-Clear Two-Party Neural Network Private Inference

###### Abstract

Recently, private inference (PI) has addressed the rising concern over data and model privacy in machine learning inference as a service. However, existing PI frameworks suffer from high computational and communication costs due to the expensive multi-party computation (MPC) protocols. Existing literature has developed lighter MPC protocols to yield more efficient PI schemes. We, in contrast, propose to lighten them by introducing an empirically-defined privacy evaluation. To that end, we reformulate the threat model of PI and use inference data privacy attacks (IDPAs) to evaluate data privacy. We then present an enhanced IMPA, named distillation-based inverse-network attack (DINA), for improved privacy evaluation. Finally, we leverage the findings from DINA and propose \(\mathbb{C}^{2}\)PI, a two-party PI framework presenting an efficient partitioning of the neural network model and requiring only the initial few layers to be performed with MPC protocols. Based on our experimental evaluations, relaxing the formal data privacy guarantees \(\mathbb{C}^{2}\)PI can speed up existing PI frameworks, including Delphi [1] and Cheetah [2], up to \(2.89\times\) and \(3.88\times\) under LAN and WAN settings, respectively, and save up to \(2.75\times\) communication costs.

## I Introduction

With the increasing complexity of deep neural network (DNN) models and their incredible training cost, machine learning inference as a service (MLaaS) has become an inevitable solution saving significant time, cost, and effort in democratizing ML services, even for non-experts [3]. However, increasing privacy concerns challenge the inference procedure when a client and a server hold the inference input and network separately and do not want to reveal their private properties to each other. The client could be a patient with sensitive medical data or a homeowner with private images, and the server could be a hospital system or a commercial company holding proprietary trained DNN models.

Private inference (PI) has appeared to address the privacy issue in MLaaS. Existing PI frameworks [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13] leverage secret sharing (SS) and multiparty computation (MPC) protocols to enable the participants to jointly perform inference without revealing their input and model parameters to each other. Different from prior PI frameworks [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13] where data privacy is formally preserved through cryptographic guarantees, we adopt an empirically-defined client data privacy model [14, 15, 16] to relax PI. In particular, the client's data privacy is defined based on the potential success of inference data privacy attacks (IDPAs) [14, 15]. Specifically, if IDPAs **cannot** recover the client's input data, the client's data privacy is deemed preserved. IDPAs are typically evaluated through the structural similarity index (SSIM) [17] that measures the human perceptual similarity of two images by considering the luminance, contrast, and structure of two images. Users can set an SSIM value (usually \(0.3\)[15]) as IDPA's failure threshold, namely, an SSIM below the threshold indicating a failed recovery. The introduction of IDPA-based privacy enables a finer-grained means of quantifying client's data privacy than the Boolean characterization associated with cryptographic protocols.

The inability to recover the client's input with accessible layer outputs implies that the neural network unintentionally preserves the client's input privacy, intuitively due to the irreversibility of the network. To investigate the potential for revealing the input from only later layers' activations, we first propose an improved IDPA, i.e., a distillation-based inverse-network attack (DINA) for an improved evaluation as opposed to the baseline IDPAs [14, 15].

Our attack results indicate that the server indeed often cannot disclose the client's input even if it obtains later layers' outputs. Based on this observation, we propose a novel two-party PI framework, namely, crypto-clear private inference (\(\mathbb{C}^{2}\)PI), and relax the computational burden of existing PI methods from a new perspective. Specifically, \(\mathbb{C}^{2}\)PI searches for a _boundary layer_ in a model, after which the two parties no longer need the cryptographic primitives to preserve the client's SSIM-based data privacy. This allows the server to independently operate on the remaining layers with significantly lower computation and latency. We name the layers before and after the boundary layer as _crypto layers_ and _clear layers_, respectively, with the boundary layer as the last crypto layer. Furthermore, we leverage a noise-adding mechanism to further thwart the IDPAs and enhance clients' data privacy.

The benefit of our \(\mathbb{C}^{2}\)PI is three-folded: _(a) It helps to reduce computational complexity of existing PI schemes. (b) It protects the architecture of the clear layers while existing PI frameworks leak the whole network architecture to the client [1, 2, 5, 8]._ It is worth mentioning that the carefully designed network architectures are typically considered as intellectual property of network owners [18]. _(c) The introduced fine-grained privacy quantification enables users to trade-off PI complexity with the guaranteed level of client's data privacy by tuning the IDPA's failure threshold._ Existing