Private Inference for Deep Neural Networks: A Secure, Adaptive, and Efficient Realization

Abstract

The advances in deep neural networks (DNNs) have driven many companies to offer their carefully-trained DNNs as inference services for clients’ private data. The privacy concerns have increasingly motivated the need for private inference (PI), where DNN inferences are performed directly on encrypted data without revealing the client's private inputs to the server or revealing the server's proprietary DNN weights to the client. However, existing cryptographic protocols for PI suffer from impractically high latency, stemming mostly from non-linear operators like ReLU activations. In this paper, we propose PAPI, a Practical and Adaptive Private Inference framework. First, we develop an accuracy-adaptive neural architecture search (NAS) approach to generate DNN models tailored for high-efficiency ciphertext computation. Specifically, our NAS automatically generates the DNNs with fewer ReLUs while keeping the accuracy above a user-defined target. Second, we propose secure online/offline protocols for ReLU activation and its approximation variants (i.e., polynomial activations), which purely rely on the lightweight secret sharing techniques in the online execution and can well cope with our optimized DNNs in the ciphertext domain. Experimental results show that PAPI reduces online inference latency on the CIFAR-10/100 and ImageNet datasets by 2.7 <inline-formula><tex-math notation="LaTeX">${\times}$</tex-math></inline-formula> <inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 7.8 <inline-formula><tex-math notation="LaTeX">${\times}$</tex-math></inline-formula> over the state-of-the-art.