Falcon: Honest-Majority Maliciously Secure Framework for Private Deep Learning

Abstract

We propose Falcon, an end-to-end 3-party protocol for efficient private training and inference of large machine learning models. Falcon presents four main advantages – (i) It is highly expressive with support for high capacity networks such as VGG16 (ii) it supports batch normalization which is important for training complex networks such as AlexNet (iii) Falcon guarantees security with abort against malicious adversaries, assuming an honest majority (iv) Lastly, Falcon presents new theoretical insights for protocol design that make it highly efficient and allow it to outperform existing secure deep learning solutions. Compared to prior art for private inference, we are about 8× faster than SecureNN (PETS’19) on average and comparable to ABY3 (CCS’18). We are about 16 − 200× more communication efficient than either of these. For private training, we are about 6× faster than SecureNN, 4.4× faster than ABY3 and about 2−60× more communication efficient. Our experiments in the WAN setting show that over large networks and datasets, compute operations dominate the overall latency of MPC, as opposed to the communication.

AriaNN: Low-Interaction Privacy-Preserving Deep Learning via Function Secret Sharing

“…MiniONN [44], DeepSecure [52] and XONN [50] use optimized garbled circuits [63] that allow very few communication rounds, but they do not support training and alter the neural network structure to speed up execution. Other frameworks such as ShareMind [10], SecureML [46], SecureNN [59], QUOTIENT [2] or more recently FALCON [60] rely on additive secret sharing and allow secure model evaluation and training. They use simpler and more efficient primitives, but require a large number of rounds of communication, such as 11 in [59] or 5 + log 2 (n) in [60] (typically 10 with n = 32) for ReLU.…”

“…Other frameworks such as ShareMind [10], SecureML [46], SecureNN [59], QUOTIENT [2] or more recently FALCON [60] rely on additive secret sharing and allow secure model evaluation and training. They use simpler and more efficient primitives, but require a large number of rounds of communication, such as 11 in [59] or 5 + log 2 (n) in [60] (typically 10 with n = 32) for ReLU. ABY [23], Chameleon [51] and more recently ABY 3 [45], CrypT-Flow [41] and [21] mix garbled circuits, additive or binary secret sharing based on what is most efficient for the operations considered.…”

Not All Features Are Equal: Discovering Essential Features for Preserving Prediction Privacy

“…Privacy on offloaded computation can also be provided by the means of cryptographic tools such as homomorphic encryption and/or Secure Multiparty Computation (SMC) [9,18,23,30,45,48,54,85]. However, these approaches suffer from a prohibitive computational cost (Table 1), on both the cloud and user side, exacerbating the complexity and compute-intensity of neural networks especially on resource-constrained edge devices.…”

PDS2: A user-centered decentralized marketplace for privacy preserving data processing

“…Slalom [10] reaches high performance using Intel SGX-based TEEs. Falcon [14], which instead relies on SMC with secret sharing, leverages an untrusted third party to speed-up the computation and is currently the most computationally efficient framework [15]. However, it relies on the assumption that at least 2 out of 3 parties behave honestly.…”