Efficient Secure Neural Network Prediction Protocol Reducing Accuracy Degradation

• NISHIDA Naohisa

  Panasonic Corporation

• OBA Tatsumi

  Panasonic Corporation

• UNAGAMI Yuji

  Panasonic Corporation

• PAUL CRUZ Jason

  Osaka University

• YANAI Naoto

  Osaka University

• TERUYA Tadanori

  National Institute of Advanced Industrial Science and Technology

• ATTRAPADUNG Nuttapong

  National Institute of Advanced Industrial Science and Technology

• MATSUDA Takahiro

  National Institute of Advanced Industrial Science and Technology

• HANAOKA Goichiro

  National Institute of Advanced Industrial Science and Technology

抄録

Machine learning models inherently memorize significant amounts of information, and thus hiding not only prediction processes but also trained models, i.e., model obliviousness, is desirable in the cloud setting. Several works achieved model obliviousness with the MNIST dataset, but datasets that include complicated samples, e.g., CIFAR-10 and CIFAR-100, are also used in actual applications, such as face recognition. Secret sharing-based secure prediction for CIFAR-10 is difficult to achieve. When a deep layer architecture such as CNN is used, the calculation error when performing secret calculation becomes large and the accuracy deteriorates. In addition, if detailed calculations are performed to improve accuracy, a large amount of calculation is required. Therefore, even if the conventional method is applied to CNN as it is, good results as described in the paper cannot be obtained. In this paper, we propose two approaches to solve this problem. Firstly, we propose a new protocol named Batch-normalizedActivation that combines BatchNormalization and Activation. Since BatchNormalization includes real number operations, when performing secret calculation, parameters must be converted into integers, which causes a calculation error and decrease accuracy. By using our protocol, calculation errors can be eliminated, and accuracy degradation can be eliminated. Further, the processing is simplified, and the amount of calculation is reduced. Secondly, we explore a secret computation friendly and high accuracy architecture. Related works use a low-accuracy, simple architecture, but in reality, a high accuracy architecture should be used. Therefore, we also explored a high accuracy architecture for the CIFAR10 dataset. Our proposed protocol can compute prediction of CIFAR-10 within 15.05 seconds with 87.36% accuracy while providing model obliviousness.

収録刊行物

• IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences

  IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E103.A (12), 1367-1380, 2020-12-01

  一般社団法人 電子情報通信学会

キーワード

• secure computation
• secret sharing
• machine learning
• binarized neural networks

詳細情報

• CRID: 1390286426511803136
• NII論文ID: 130007948301
• DOI: 10.1587/transfun.2020tap0011
• ISSN: 17451337
• ISSN: 09168508
• Web Site: https://www.jstage.jst.go.jp/article/transfun/E103.A/12/E103.A_2020TAP0011/_pdf
• 本文言語コード: en
• データソース種別:
  • JaLC
  • Crossref
  • CiNii Articles
  • KAKEN
• 抄録ライセンスフラグ: 使用不可