Tabula: Efficiently Computing Nonlinear Activation Functions for Secure Neural Network Inference

TL;DR

The paper tackles secure neural network inference by addressing the high communication and runtime costs of evaluating nonlinear activations with garbled circuits. It proposes Tabula, a two-party protocol that uses offline preprocessing to build secure lookup tables and a lightweight online phase with a single table lookup per activation, achieving a fixed 2B communication per nonlinear call. By aggressively quantizing activations and leveraging secure truncation plus table lookups, Tabula delivers up to 280–560× less online communication and up to 50× end-to-end runtime speedups versus garbled circuits, while maintaining comparable storage and offline preprocessing costs. This approach enables real-time secure inference for larger networks, with significant practical impact for privacy-preserving ML deployments.

Abstract

Multiparty computation approaches to secure neural network inference commonly rely on garbled circuits for securely executing nonlinear activation functions. However, garbled circuits require excessive communication between server and client, impose significant storage overheads, and incur large runtime penalties. To reduce these costs, we propose an alternative to garbled circuits: Tabula, an algorithm based on secure lookup tables. Our approach precomputes lookup tables during an offline phase that contains the result of all possible nonlinear function calls. Because these tables incur exponential storage costs in the number of operands and the precision of the input values, we use quantization to reduce these storage costs to make this approach practical. This enables an online phase where securely computing the result of a nonlinear function requires just a single round of communication, with communication cost equal to twice the number of bits of the input to the nonlinear function. In practice our approach costs 2 bytes of communication per nonlinear function call in the online phase. Compared to garbled circuits with 8-bit quantized inputs, when computing individual nonlinear functions during the online phase, experiments show Tabula with 8-bit activations uses between $280$-$560 \times$ less communication, is over $100\times$ faster, and uses a comparable (within a factor of 2) amount of storage; compared against other state-of-the-art protocols Tabula achieves greater than $40\times$ communication reduction. This leads to significant performance gains over garbled circuits with quantized inputs during the online phase of secure inference of neural networks: Tabula reduces end-to-end inference communication by up to $9 \times$ and achieves an end-to-end inference speedup of up to $50 \times$, while imposing comparable storage and offline preprocessing costs.

Figures (9)

• Figure 1: The Tabula approach to computing nonlinear functions for secure neural network inference. Tabula precomputes lookup tables $[T]_0$, $[T]_1$ stored on client and server respectively, and also initializes shares of the secret $s$ so that the client holds $[s]_0$ and the server holds $[s]_1$. The lookup tables $[T]_i$ contain the result of all possible nonlinear function calls to an activation function and uses quantization to make storing all possible function calls in the table feasible. These lookup tables map secret shares of the quantized inputs to the nonlinear function to secret shares of the output of the activation function. During the online phase, these lookup tables enable extremely efficient nonlinear activation function execution and proceeds by 1) securely truncating the inputs, 2) reconstructing a blinded index and 3) looking up the blinded index in the lookup tables $[T]_i$. Our code is released at https://github.com/tabulainference/tabula.
• Figure 2: Tabula online protocol. Initially, the client and server hold secret shares of the input $[x]$. Both parties begin by executing the secure truncation protocol to obtain shares of $[x_{trunc}]$. Then, the client and server perform the secure table lookup protocol, where they exchange blinded secrets $[x_{trunc}]_i + s_i$ to compute $x_{trunc}+s$. Finally, they use this value as an index into local lookup tables to compute $T_i[x_{trunc}+s]$ which are secret shares of the result of the nonlinear function evaluation.
• Figure 3: Tabula preprocessing protocol. Client and server generate secrets $s_0$, $s_1$ and encode them in an indicator vector (i.e: construct a vector of length equal to the field size, then setting a one to the position of the party's secret index). The parties then secret share this indicator vector with the other party. To obtain the entry for $T_i[x]$, the parties compute an outer product between the shared indicator vectors and a 2-dimensional table containing $F(m+n+x)$ (where $m,n$ span the two dimensions of the table), which obtains $[F(x+s)]$ where $s=s_0+s_1$. This works as the 2-D coordinates formed by where the indicator vectors are set privately select $m,n$ through the dot-product; since this is done via private MPC operations, no information is leaked to either party about their corresponding secrets.
• Figure 4: Tabula communication reduction improvement over garbled circuits (x-axis) vs accuracy, when garbled circuits communication cost for $A_{n}$ bits is compared against Tabula with 8-bit inputs. Tabula with 8-bit inputs achieves accuracy equivalent to $A_{8}$. This plot shows Tabula with 8-bit inputs obtains greater communication reduction over GCs with different precisions on various test architectures, while remaining withing 1% to 2% of the full precision baseline. Because both Tabula and GC see linear scaling of communication cost with the number of activation bits to the input of the nonlinear function, $n$-bit Tabula vs $n$-bit GC would yield a communication reduction factor of 6-8$\times$ for all $n$ on these test architectures. Also the labels denoted $A_{n}$ mark the accuracy achieved by both Tabula and GCs should they use $n$ bit activations, as both compute the same result. Baseline precision shown as the dashed blue line.
• Figure 5: Tabula and garbled circuits storage use for a single ReLU operation.