Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SONNI: Secure Oblivious Neural Network Inference

Luke Sperling, Sandeep S. Kulkarni

TL;DR

SONNI identifies a novel Silver Platter model‑stealing attack in outsourced oblivious neural network inference under multi‑key FHE and introduces a secure results‑checking protocol. By dedicating a subset of ciphertext slots to verify a randomly generated function g(y) and performing a privacy‑preserving result check, SONNI ensures correct computation without revealing the client’s input or the provider’s model parameters, even with majority dishonest participants. The authors prove a near‑zero attack probability for practical parameter choices (e.g., a 32k parameter model yields a failure probability of $1.51 \times 10^{-28}$) and report only a small batching overhead of $0.2\%$, making the approach viable for MLaaS deployments. Overall, SONNI advances privacy in MLaaS by coupling obfuscated computation with verifiable results, addressing both client data privacy and provider model confidentiality.

Abstract

In the standard privacy-preserving Machine learning as-a-service (MLaaS) model, the client encrypts data using homomorphic encryption and uploads it to a server for computation. The result is then sent back to the client for decryption. It has become more and more common for the computation to be outsourced to third-party servers. In this paper we identify a weakness in this protocol that enables a completely undetectable novel model-stealing attack that we call the Silver Platter attack. This attack works even under multikey encryption that prevents a simple collusion attack to steal model parameters. We also propose a mitigation that protects privacy even in the presence of a malicious server and malicious client or model provider (majority dishonest). When compared to a state-of-the-art but small encrypted model with 32k parameters, we preserve privacy with a failure chance of 1.51 x 10^-28 while batching capability is reduced by 0.2%. Our approach uses a novel results-checking protocol that ensures the computation was performed correctly without violating honest clients' data privacy. Even with collusion between the client and the server, they are unable to steal model parameters. Additionally, the model provider cannot learn any client data if maliciously working with the server.

SONNI: Secure Oblivious Neural Network Inference

TL;DR

SONNI identifies a novel Silver Platter model‑stealing attack in outsourced oblivious neural network inference under multi‑key FHE and introduces a secure results‑checking protocol. By dedicating a subset of ciphertext slots to verify a randomly generated function g(y) and performing a privacy‑preserving result check, SONNI ensures correct computation without revealing the client’s input or the provider’s model parameters, even with majority dishonest participants. The authors prove a near‑zero attack probability for practical parameter choices (e.g., a 32k parameter model yields a failure probability of ) and report only a small batching overhead of , making the approach viable for MLaaS deployments. Overall, SONNI advances privacy in MLaaS by coupling obfuscated computation with verifiable results, addressing both client data privacy and provider model confidentiality.

Abstract

In the standard privacy-preserving Machine learning as-a-service (MLaaS) model, the client encrypts data using homomorphic encryption and uploads it to a server for computation. The result is then sent back to the client for decryption. It has become more and more common for the computation to be outsourced to third-party servers. In this paper we identify a weakness in this protocol that enables a completely undetectable novel model-stealing attack that we call the Silver Platter attack. This attack works even under multikey encryption that prevents a simple collusion attack to steal model parameters. We also propose a mitigation that protects privacy even in the presence of a malicious server and malicious client or model provider (majority dishonest). When compared to a state-of-the-art but small encrypted model with 32k parameters, we preserve privacy with a failure chance of 1.51 x 10^-28 while batching capability is reduced by 0.2%. Our approach uses a novel results-checking protocol that ensures the computation was performed correctly without violating honest clients' data privacy. Even with collusion between the client and the server, they are unable to steal model parameters. Additionally, the model provider cannot learn any client data if maliciously working with the server.
Paper Structure (14 sections, 2 theorems, 1 equation, 3 figures, 1 table, 1 algorithm)

This paper contains 14 sections, 2 theorems, 1 equation, 3 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Fully Homomorphic Encryption
  4. Multikey Encryption
  5. Proposed Model Stealing Attack
  6. Attack Mitigation via Oblivious Results Checking
  7. Problem Statement
  8. Mitigation Approach
  9. Protocol Details
  10. Ciphertext Preparation
  11. Result Checking
  12. Security Analysis
  13. Related Work
  14. Conclusion

Key Result

Theorem 1

Let $d$ be the dimensionality of the client's secret data $x$ and $m$ be the number of ciphertext slots dedicated to containing $y$ values. The probability of successfully performing the Silver Platter attack against SONNI to steal $k$ scalar model parameters is upper bounded by ${(\frac{d}{d+m})}^k

Figures (3)

  • Figure 1: Standard Outsourced Oblivious Neural Network Inference Model
  • Figure 2: SONNI sequence diagram.
  • Figure 3: Probability of performing a Silver Platter attack without being detected based on the number of ciphertext slots dedicated to checked values.

Theorems & Definitions (4)

  • Theorem 1
  • proof
  • Theorem 2
  • proof