{"type":"ScholarlyArticle","title":"Learning Model with Error -- Exposing the Hidden Model of BAYHENN","authors":[{"name":"Harry W. H. Wong","slug":"harry-w-h-wong","given":"Harry W. H.","family":"Wong","affiliation":"Department of Information Engineering , The Chinese University of Hong Kong , Hong Kong"},{"name":"Jack P. K. Ma","slug":"jack-p-k-ma","given":"Jack P. K.","family":"Ma","affiliation":"Department of Information Engineering , The Chinese University of Hong Kong , Hong Kong"},{"name":"Donald P. H. Wong","slug":"donald-p-h-wong","given":"Donald P. H.","family":"Wong","affiliation":"Department of Information Engineering , The Chinese University of Hong Kong , Hong Kong"},{"name":"Lucien K. L. Ng","slug":"lucien-k-l-ng","given":"Lucien K. L.","family":"Ng","affiliation":"Department of Information Engineering , The Chinese University of Hong Kong , Hong Kong"},{"name":"Sherman S. M. Chow","slug":"sherman-s-m-chow","given":"Sherman S. M.","family":"Chow","affiliation":"Department of Information Engineering , The Chinese University of Hong Kong , Hong Kong"}],"abstract":"Privacy-preserving deep neural network (DNN) inference remains an intriguing problem even after the rapid developments of different communities. One challenge is that cryptographic techniques such as homomorphic encryption (HE) do not natively support non-linear computations (e.g., sigmoid). A recent work, BAYHENN (Xie et al., IJCAI'19), considers HE over the Bayesian neural network (BNN). The novelty lies in \"meta-prediction\" over a few noisy DNNs. The claim was that the clients can get intermediate outputs (to apply non-linear function) but are still prevented from learning the exact model parameters, which was justified via the widely-used learning-with-error (LWE) assumption (with Gaussian noises as the error). This paper refutes the security claim of BAYHENN via both theoretical and empirical analyses. We formally define a security game with different oracle queries capturing two realistic threat models. Our attack assuming a semi-honest adversary reveals all the parameters of single-layer BAYHENN, which generalizes to recovering the whole model that is \"as good as\" the BNN approximation of the original DNN, either under the malicious adversary model or with an increased number of oracle queries. \r\nThis shows the need for rigorous security analysis (\"the noise introduced by BNN can obfuscate the model\" fails -- it is beyond what LWE guarantees) and calls for the collaboration between cryptographers and machine-learning experts to devise practical yet provably-secure solutions.","doi":"10.24963/ijcai.2020/488","url":"https://ijcai.org/proceedings/2020/488","pdf":"https://ijcai.org/proceedings/2020/0488.pdf","markdown":"https://ijcai.org/proceedings/2020/488.md","bibtex":"https://ijcai.org/proceedings/2020/bibtex/488","volume":{"slug":"2020","title":"Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2020","url":"https://ijcai.org/proceedings/2020/","year":2020,"location":"Yokohama","dates":"January 2021 (postponed from 11-17 July 2020)","editors":"Christian Bessiere","isbn":"978-0-9992411-6-5","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2020"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":488,"pages":{"first":3529,"last":3535},"keywords":["Machine Learning: Deep Learning","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[{"label":"Video","url":"https://videos.ijcai20.org/25418/file_25418.m3u8","length_sec":277,"provider":"hls"}],"references":[{"position":1,"raw":"[Blundell et al., 2015] Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncer- tainty in neural network. In ICML, pages 1613-1622, 2015.","title":"Weight uncertainty in neural network","authors":"Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, Daan Wierstra","year":"2015","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Boemer et al., 2019] Fabian Boemer, Anamaria Costache, Rosario Cammarota, and Casimir Wierzynski. nGraph- HE2: A high-throughput framework for neural network inference on encrypted data. In Encrypted Computing & Applied Homomorphic Cryptography (WAHC), co-located with CCS, pages 45-56, 2019.","title":"nGraph-HE2: A high-throughput framework for neural network inference on encrypted data","authors":"Fabian Boemer, Anamaria Costache, Rosario Cammarota, Casimir Wierzynski","year":"2019","venue":"Encrypted Computing & Applied Homomorphic Cryptography (WAHC), co-located with CCS","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bost et al., 2015] Raphael Bost, Raluca Ada Popa, Stephen Tu, and Shafi Goldwasser. Machine learning classification over encrypted data. In NDSS, 2015.","title":"Machine learning classification over encrypted data","authors":"Raphael Bost, Ada Raluca, Stephen Popa, Shafi Tu, Goldwasser","year":"2015","venue":"NDSS","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bourse et al., 2018] Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. Fast homomorphic evaluation of deep discretized neural networks. In Crypto, Part III, pages 483-512, 2018.","title":"Fast homomorphic evaluation of deep discretized neural networks","authors":"Florian Bourse, Michele Minelli, Matthias Minihold, Pascal Paillier","year":"2018","venue":"Crypto, Part III","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chow, 2019] Sherman S. M. Chow. Can we securely out- source big data analytics with lightweight cryptography? In Security in Cloud Computing (SCC), co-located with AsiaCCS, page 1, 2019.","title":"Can we securely outsource big data analytics with lightweight cryptography","authors":"S M Sherman, Chow","year":"2019","venue":"Security in Cloud Computing (SCC), co-located with AsiaCCS","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Fredrikson et al., 2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, pages 1322-1333, 2015.","title":"Model inversion attacks that exploit confidence information and basic countermeasures","authors":"Matt Fredrikson, Somesh Jha, Thomas Ristenpart","year":"2015","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Gilad-Bachrach et al., 2016] Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin E. Lauter, Michael Naehrig, and John Wernsing. CryptoNets: Applying neural net- works to encrypted data with high throughput and accu- racy. In ICML, pages 201-210, 2016.","title":"CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy","authors":"Gilad-Bachrach","year":"2016","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Juvekar et al., 2018] Chiraag Juvekar, Vinod Vaikun- tanathan, and Anantha Chandrakasan. GAZELLE: A low latency framework for secure neural network inference. In Usenix Security, pages 1651-1669, 2018.","title":"GAZELLE: A low latency framework for secure neural network inference","authors":"Juvekar","year":"2018","venue":"Usenix Security","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Tai et al., 2017] Raymond K. H. Tai, Jack P. K. Ma, Yongjun Zhao, and Sherman S. M. Chow. Privacy- preserving decision trees evaluation via linear functions. In ESORICS (Part II), pages 494-512, 2017.","title":"Privacypreserving decision trees evaluation via linear functions","authors":"K H Raymond, Tai, P K Jack, Yongjun Ma, Sherman S M Zhao, Chow","year":"2017","venue":"ESORICS (Part II)","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Tramèr and Boneh, 2019] Florian Tramèr and Dan Boneh. Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. In ICLR, 2019.","title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware","authors":"Boneh Tramèr, Florian Tramèr, Dan Boneh","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Wagh et al., 2019] Sameer Wagh, Divya Gupta, and Nis- hanth Chandran. SecureNN: 3-party secure computation for neural network training. PoPETs, (3):26-49, 2019.","title":"SecureNN: 3-party secure computation for neural network training","authors":"Sameer Wagh, Divya Gupta, Nishanth Chandran","year":"2019","venue":"PoPETs","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Xie et al., 2019] Peichen Xie, Bingzhe Wu, and Guangyu Sun. BAYHENN: combining bayesian deep learning and homomorphic encryption for secure DNN inference. In IJCAI, pages 4831-4837, 2019.","title":"BAYHENN: combining bayesian deep learning and homomorphic encryption for secure DNN inference","authors":"Xie","year":"2019","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2019/671"},{"position":13,"raw":"[Zhang et al., 2018] Qiao Zhang, Cong Wang, Hongyi Wu, Chunsheng Xin, and Tran V. Phuong. GELU-Net: A glob- ally encrypted, locally unencrypted deep neural network for privacy-preserved learning. In IJCAI-EJCAI, pages 3933-3939, 2018.","title":"GELU-Net: A globally encrypted, locally unencrypted deep neural network for privacy-preserved learning","authors":"Qiao Zhang, Cong Wang, Hongyi Wu, Chunsheng Xin, Tran V Phuong","year":"2018","venue":"IJCAI-EJCAI","doi":null,"url":null,"internal_url":"/proceedings/2018/547"}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}