{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T15:21:47Z","timestamp":1793114507969,"version":"4.5.0"},"reference-count":41,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"3","license":[{"start":{"date-parts":[[2019,7,1]],"date-time":"2019-07-01T00:00:00Z","timestamp":1561939200000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/3.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019,7,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Neural Networks (NN) provide a powerful method for machine learning training and inference. To effectively train, it is desirable for multiple parties to combine their data \u2013 however, doing so conflicts with data privacy. In this work, we provide novel three-party secure computation protocols for various NN building blocks such as matrix multiplication, convolutions, Rectified Linear Units, Maxpool, normalization and so on. This enables us to construct three-party secure protocols for training and inference of several NN architectures such that no single party learns any information about the data. Experimentally, we implement our system over Amazon EC2 servers in different settings. Our work advances the state-of-the-art of secure computation for neural networks in three ways:<\/jats:p>\n               <jats:p>1. Scalability: We are the first work to provide neural network training on Convolutional Neural Networks (CNNs) that have an accuracy of &gt; 99% on the MNIST dataset;<\/jats:p>\n               <jats:p>2. Performance: For secure inference, our system outperforms prior 2 and 3-server works (SecureML, MiniONN, Chameleon, Gazelle) by 6\u00d7-113\u00d7 (with larger gains obtained in more complex networks). Our total execution times are 2 \u2212 4\u00d7 faster than even just the online times of these works. For secure training, compared to the only prior work (SecureML) that considered a much smaller fully connected network, our protocols are 79\u00d7 and 7\u00d7 faster than their 2 and 3-server protocols. In the WAN setting, these improvements are more dramatic and we obtain an improvement of 553\u00d7!<\/jats:p>\n               <jats:p>3. Security: Our protocols provide two kinds of security: full security (privacy and correctness) against one semi-honest corruption and the notion of privacy against one malicious corruption [Araki <jats:italic>et al<\/jats:italic>. CCS\u201916]. All prior works only provide semi-honest security and ours is the first system to provide any security against malicious adversaries for the secure computation of complex algorithms such as neural network inference and training.<\/jats:p>\n               <jats:p>Our gains come from a significant improvement in communication through the elimination of expensive garbled circuits and oblivious transfer protocols.<\/jats:p>","DOI":"10.2478\/popets-2019-0035","type":"journal-article","created":{"date-parts":[[2019,7,20]],"date-time":"2019-07-20T09:31:05Z","timestamp":1563615065000},"page":"26-49","source":"Crossref","is-referenced-by-count":340,"title":["SecureNN: 3-Party Secure Computation for Neural Network Training"],"prefix":"10.56553","volume":"2019","author":[{"given":"Sameer","family":"Wagh","sequence":"first","affiliation":[{"name":"Princeton University, Work done primarily at Microsoft Research , India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Divya","family":"Gupta","sequence":"additional","affiliation":[{"name":"Microsoft Research , India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nishanth","family":"Chandran","sequence":"additional","affiliation":[{"name":"Microsoft Research , India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"35752","published-online":{"date-parts":[[2019,7,12]]},"reference":[{"key":"2022050317455127571_j_popets-2019-0035_ref_001_w2aab3b7b3b1b6b1ab1ab1Aa","unstructured":"[1] Eigen Library. http:\/\/eigen.tuxfamily.org\/. Version: 3.3.3."},{"key":"2022050317455127571_j_popets-2019-0035_ref_002_w2aab3b7b3b1b6b1ab1ab2Aa","unstructured":"[2] Fixed-point data type. http:\/\/dec64.com. Last Updted: 2018-01-20."},{"key":"2022050317455127571_j_popets-2019-0035_ref_003_w2aab3b7b3b1b6b1ab1ab3Aa","unstructured":"[3] MNIST database. http:\/\/yann.lecun.com\/exdb\/mnist\/. Accessed: 2017-09-24."},{"key":"2022050317455127571_j_popets-2019-0035_ref_004_w2aab3b7b3b1b6b1ab1ab4Aa","unstructured":"[4] Stanford CS231n: Convolutional Neural Networks for Visual Recognition. http:\/\/cs231n.github.io\/convolutionalnetworks\/."},{"key":"2022050317455127571_j_popets-2019-0035_ref_005_w2aab3b7b3b1b6b1ab1ab5Aa","unstructured":"[5] Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (GDPR). Official Journal of the European Union, L119, May 2016."},{"key":"2022050317455127571_j_popets-2019-0035_ref_006_w2aab3b7b3b1b6b1ab1ab6Aa","doi-asserted-by":"crossref","unstructured":"[6] Toshinori Araki, Jun Furukawa, Yehuda Lindell, Ariel Nof, and Kazuma Ohara. High-throughput semi-honest secure three-party computation with an honest majority. In ACM CCS, 2016.10.1145\/2976749.2978331","DOI":"10.1145\/2976749.2978331"},{"key":"2022050317455127571_j_popets-2019-0035_ref_007_w2aab3b7b3b1b6b1ab1ab7Aa","doi-asserted-by":"crossref","unstructured":"[7] Donald Beaver. Efficient multiparty protocols using circuit randomization. In Annual International Cryptology Conference, pages 420\u2013432. Springer, 1991.10.1007\/3-540-46766-1_34","DOI":"10.1007\/3-540-46766-1_34"},{"key":"2022050317455127571_j_popets-2019-0035_ref_008_w2aab3b7b3b1b6b1ab1ab8Aa","doi-asserted-by":"crossref","unstructured":"[8] Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson. Completeness theorems for non-cryptographic fault-tolerant distributed computation (extended abstract). In ACM STOC, 1988.10.1145\/62212.62213","DOI":"10.1145\/62212.62213"},{"key":"2022050317455127571_j_popets-2019-0035_ref_009_w2aab3b7b3b1b6b1ab1ab9Aa","doi-asserted-by":"crossref","unstructured":"[9] Dan Bogdanov, Sven Laur, and Jan Willemson. Sharemind: A framework for fast privacy-preserving computations. In ESORICS, pages 192\u2013206, 2008.10.1007\/978-3-540-88313-5_13","DOI":"10.1007\/978-3-540-88313-5_13"},{"key":"2022050317455127571_j_popets-2019-0035_ref_010_w2aab3b7b3b1b6b1ab1ac10Aa","doi-asserted-by":"crossref","unstructured":"[10] Dan Bogdanov, Margus Niitsoo, Tomas Toft, and Jan Willemson. High-performance secure multi-party computation for data mining applications. International Journal of Information Security, 11(6):403\u2013418, 2012.10.1007\/s10207-012-0177-2","DOI":"10.1007\/s10207-012-0177-2"},{"key":"2022050317455127571_j_popets-2019-0035_ref_011_w2aab3b7b3b1b6b1ab1ac11Aa","doi-asserted-by":"crossref","unstructured":"[11] Raphael Bost, Raluca Ada Popa, Stephen Tu, and Shafi Goldwasser. Machine learning classification over encrypted data. In NDSS, 2015.10.14722\/ndss.2015.23241","DOI":"10.14722\/ndss.2015.23241"},{"key":"2022050317455127571_j_popets-2019-0035_ref_012_w2aab3b7b3b1b6b1ab1ac12Aa","doi-asserted-by":"crossref","unstructured":"[12] R. Canetti. Universally composable security: A new paradigm for cryptographic protocols. In Proceedings of the 42Nd IEEE Symposium on Foundations of Computer Science, FOCS \u201901, pages 136\u2013, 2001.10.1109\/SFCS.2001.959888","DOI":"10.1109\/SFCS.2001.959888"},{"key":"2022050317455127571_j_popets-2019-0035_ref_013_w2aab3b7b3b1b6b1ab1ac13Aa","doi-asserted-by":"crossref","unstructured":"[13] Ran Canetti. Security and composition of multiparty cryptographic protocols. Journal of CRYPTOLOGY, 13(1):143\u2013202, 2000.10.1007\/s001459910006","DOI":"10.1007\/s001459910006"},{"key":"2022050317455127571_j_popets-2019-0035_ref_014_w2aab3b7b3b1b6b1ab1ac14Aa","doi-asserted-by":"crossref","unstructured":"[14] Octavian Catrina and Sebastiaan de Hoogh. Improved primitives for secure multiparty integer computation. In Security and Cryptography for Networks, 7th International Conference, SCN 2010, Amalfi, Italy, September 13\u201315, 2010. Proceedings, pages 182\u2013199, 2010.10.1007\/978-3-642-15317-4_13","DOI":"10.1007\/978-3-642-15317-4_13"},{"key":"2022050317455127571_j_popets-2019-0035_ref_015_w2aab3b7b3b1b6b1ab1ac15Aa","unstructured":"[15] Centers for Medicare & Medicaid Services. The Health Insurance Portability and Accountability Act of 1996 (HIPAA). Online at http:\/\/www.cms.hhs.gov\/hipaa\/, 1996."},{"key":"2022050317455127571_j_popets-2019-0035_ref_016_w2aab3b7b3b1b6b1ab1ac16Aa","unstructured":"[16] Herv\u00e9 Chabanne, Amaury de Wargny, Jonathan Milgram, Constance Morel, and Emmanuel Prouff. Privacy-preserving classification on deep neural network. Cryptology ePrint Archive, Report 2017\/035, 2017. https:\/\/eprint.iacr.org\/2017\/035."},{"key":"2022050317455127571_j_popets-2019-0035_ref_017_w2aab3b7b3b1b6b1ab1ac17Aa","doi-asserted-by":"crossref","unstructured":"[17] David Chaum, Claude Cr\u00e9peau, and Ivan Damg\u00e5rd. Multiparty unconditionally secure protocols (extended abstract). In ACM STOC, 1988.10.1145\/62212.62214","DOI":"10.1145\/62212.62214"},{"key":"2022050317455127571_j_popets-2019-0035_ref_018_w2aab3b7b3b1b6b1ab1ac18Aa","doi-asserted-by":"crossref","unstructured":"[18] Koji Chida, Daniel Genkin, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Yehuda Lindell, and Ariel Nof. Fast large-scale honest-majority mpc for malicious adversaries. In Crypto, pages 34\u201364, 2018.10.1007\/978-3-319-96878-0_2","DOI":"10.1007\/978-3-319-96878-0_2"},{"key":"2022050317455127571_j_popets-2019-0035_ref_019_w2aab3b7b3b1b6b1ab1ac19Aa","doi-asserted-by":"crossref","unstructured":"[19] Benny Chor and Eyal Kushilevitz. A zero-one law for boolean privacy. SIAM J. Discrete Math., 4(1), 1991.10.1137\/0404004","DOI":"10.1137\/0404004"},{"key":"2022050317455127571_j_popets-2019-0035_ref_020_w2aab3b7b3b1b6b1ab1ac20Aa","doi-asserted-by":"crossref","unstructured":"[20] Ivan Damg\u00e5rd, Martin Geisler, and Mikkel Kr\u00f8igaard. Homomorphic encryption and secure comparison. In IJACT, 2008.10.1504\/IJACT.2008.017048","DOI":"10.1504\/IJACT.2008.017048"},{"key":"2022050317455127571_j_popets-2019-0035_ref_021_w2aab3b7b3b1b6b1ab1ac21Aa","doi-asserted-by":"crossref","unstructured":"[21] Daniel Demmler, Thomas Schneider, and Michael Zohner. ABY \u2013 A framework for efficient mixed-protocol secure twoparty computation. In NDSS, 2015.10.14722\/ndss.2015.23113","DOI":"10.14722\/ndss.2015.23113"},{"key":"2022050317455127571_j_popets-2019-0035_ref_022_w2aab3b7b3b1b6b1ab1ac22Aa","doi-asserted-by":"crossref","unstructured":"[22] Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. 2014.10.1561\/9781601988195","DOI":"10.1561\/9781601988195"},{"key":"2022050317455127571_j_popets-2019-0035_ref_023_w2aab3b7b3b1b6b1ab1ac23Aa","doi-asserted-by":"crossref","unstructured":"[23] Jun Furukawa, Yehuda Lindell, Ariel Nof, and Or Weinstein. High-throughput secure three-party computation for malicious adversaries and an honest majority. In IACR Eurocrypt, 2017.10.1007\/978-3-319-56614-6_8","DOI":"10.1007\/978-3-319-56614-6_8"},{"key":"2022050317455127571_j_popets-2019-0035_ref_024_w2aab3b7b3b1b6b1ab1ac24Aa","unstructured":"[24] Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin E. Lauter, Michael Naehrig, and John Wernsing. CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy. In ICML, 2016."},{"key":"2022050317455127571_j_popets-2019-0035_ref_025_w2aab3b7b3b1b6b1ab1ac25Aa","doi-asserted-by":"crossref","unstructured":"[25] Oded Goldreich, Silvio Micali, and Avi Wigderson. How to play any mental game or a completeness theorem for protocols with honest majority. In ACM STOC, 1987.10.1145\/28395.28420","DOI":"10.1145\/28395.28420"},{"key":"2022050317455127571_j_popets-2019-0035_ref_026_w2aab3b7b3b1b6b1ab1ac26Aa","unstructured":"[26] Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. Gazelle: A low latency framework for secure neural network inference. In Usenix Security, 2018."},{"key":"2022050317455127571_j_popets-2019-0035_ref_027_w2aab3b7b3b1b6b1ab1ac27Aa","doi-asserted-by":"crossref","unstructured":"[27] Yann LeCun, L\u00e9on Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278\u20132324, 1998.10.1109\/5.726791","DOI":"10.1109\/5.726791"},{"key":"2022050317455127571_j_popets-2019-0035_ref_028_w2aab3b7b3b1b6b1ab1ac28Aa","doi-asserted-by":"crossref","unstructured":"[28] Yehuda Lindell and Ariel Nof. A framework for constructing fast MPC over arithmetic circuits with malicious adversaries and an honest-majority. In ACM CCS, 2017.10.1145\/3133956.3133999","DOI":"10.1145\/3133956.3133999"},{"key":"2022050317455127571_j_popets-2019-0035_ref_029_w2aab3b7b3b1b6b1ab1ac29Aa","doi-asserted-by":"crossref","unstructured":"[29] Yehuda Lindell and Benny Pinkas. Privacy preserving data mining. In Annual International Cryptology Conference, pages 36\u201354. Springer, 2000.10.1007\/3-540-44598-6_3","DOI":"10.1007\/3-540-44598-6_3"},{"key":"2022050317455127571_j_popets-2019-0035_ref_030_w2aab3b7b3b1b6b1ab1ac30Aa","doi-asserted-by":"crossref","unstructured":"[30] Jian Liu, Mika Juuti, Yao Lu, and N. Asokan. Oblivious neural network predictions via MiniONN transformations. In ACM CCS, 2017.10.1145\/3133956.3134056","DOI":"10.1145\/3133956.3134056"},{"key":"2022050317455127571_j_popets-2019-0035_ref_031_w2aab3b7b3b1b6b1ab1ac31Aa","unstructured":"[31] Payman Mohassel and Peter Rindal. ABY3: A mixed protocol framework for machine learning. In ACM CCS, 2018."},{"key":"2022050317455127571_j_popets-2019-0035_ref_032_w2aab3b7b3b1b6b1ab1ac32Aa","doi-asserted-by":"crossref","unstructured":"[32] Payman Mohassel, Mike Rosulek, and Ye Zhang. Fast and secure three-party computation: The garbled circuit approach. In ACM CCS, 2015.10.1145\/2810103.2813705","DOI":"10.1145\/2810103.2813705"},{"key":"2022050317455127571_j_popets-2019-0035_ref_033_w2aab3b7b3b1b6b1ab1ac33Aa","doi-asserted-by":"crossref","unstructured":"[33] Payman Mohassel and Yupeng Zhang. SecureML: A system for scalable privacy-preserving machine learning. In ieeeoakland, 2017.10.1109\/SP.2017.12","DOI":"10.1109\/SP.2017.12"},{"key":"2022050317455127571_j_popets-2019-0035_ref_034_w2aab3b7b3b1b6b1ab1ac34Aa","doi-asserted-by":"crossref","unstructured":"[34] Valeria Nikolaenko, Stratis Ioannidis, Udi Weinsberg, Marc Joye, Nina Taft, and Dan Boneh. Privacy-preserving matrix factorization. In ACM CCS, pages 801\u2013812, 2013.10.1145\/2508859.2516751","DOI":"10.1145\/2508859.2516751"},{"key":"2022050317455127571_j_popets-2019-0035_ref_035_w2aab3b7b3b1b6b1ab1ac35Aa","unstructured":"[35] Takashi Nishide and Kazuo Ohta. Multiparty computation for interval, equality, and comparison without bitdecomposition protocol. In PKC, 2007."},{"key":"2022050317455127571_j_popets-2019-0035_ref_036_w2aab3b7b3b1b6b1ab1ac36Aa","doi-asserted-by":"crossref","unstructured":"[36] M. Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M. Songhori, Thomas Schneider, and Farinaz Koushanfar. Chameleon: A hybrid secure computation framework for machine learning applications. In AsiaCCS, 2018.10.1145\/3196494.3196522","DOI":"10.1145\/3196494.3196522"},{"key":"2022050317455127571_j_popets-2019-0035_ref_037_w2aab3b7b3b1b6b1ab1ac37Aa","doi-asserted-by":"crossref","unstructured":"[37] Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1310\u20131321. ACM, 2015.10.1145\/2810103.2813687","DOI":"10.1145\/2810103.2813687"},{"key":"2022050317455127571_j_popets-2019-0035_ref_038_w2aab3b7b3b1b6b1ab1ac38Aa","doi-asserted-by":"crossref","unstructured":"[38] Wagh, Sameer and Gupta, Divya and Chandran, Nishanth. SecureNN: 3-Party Secure Computation for Neural Network Training. https:\/\/eprint.iacr.org\/2018\/442.pdf, 2019.","DOI":"10.2478\/popets-2019-0035"},{"key":"2022050317455127571_j_popets-2019-0035_ref_039_w2aab3b7b3b1b6b1ab1ac39Aa","doi-asserted-by":"crossref","unstructured":"[39] David J. Wu, Tony Feng, Michael Naehrig, and Kristin E. Lauter. Privately evaluating decision trees and random forests. PoPETs, 2016, 2016.10.1515\/popets-2016-0043","DOI":"10.1515\/popets-2016-0043"},{"key":"2022050317455127571_j_popets-2019-0035_ref_040_w2aab3b7b3b1b6b1ab1ac40Aa","unstructured":"[40] Andrew Chi-Chih Yao. How to generate and exchange secrets (extended abstract). In IEEE FOCS, 1986."},{"key":"2022050317455127571_j_popets-2019-0035_ref_041_w2aab3b7b3b1b6b1ab1ac41Aa","unstructured":"[41] Xiangxin Zhu, Carl Vondrick, Charless Fowlkes, and Deva Ramanan. Do we need more training data? In International Journal of Computer Vision, 2016."}],"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/content.sciendo.com\/view\/journals\/popets\/2019\/3\/article-p26.xml","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.sciendo.com\/pdf\/10.2478\/popets-2019-0035","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,20]],"date-time":"2022-07-20T16:30:27Z","timestamp":1658334627000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2019\/popets-2019-0035.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,7,1]]},"references-count":41,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2019,7,12]]},"published-print":{"date-parts":[[2019,7,1]]}},"alternative-id":["10.2478\/popets-2019-0035"],"URL":"https:\/\/doi.org\/10.2478\/popets-2019-0035","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,7,1]]}}}