High-Throughput and Scalable Secure Inference Protocols for Deep Learning with Packed Secret Sharing

TL;DR

This work tackles the scalability bottlenecks of MPC-based secure neural network inference by introducing Packed Shamir Secret Sharing (PSS) and a VM-RandTuple mechanism to enable parallel linear, convolutional, and non-linear computations under an honest-majority, semi-honest model. It designs a suite of efficient protocols for vector-matrix multiplication, parallel convolutions, and non-linear operations (ReLU, DReLU, MaxPool) that leverage packing to reduce communication and rounds, while supporting fixed-point arithmetic. Empirical results in WAN/LAN show substantial improvements over prior scalable approaches, with up to $5.85\times$, $11.17\times$, and $6.83\times$ reductions in offline, online, and total communication, and up to $2.61\times$ online speedups on deeper networks like VGG16, demonstrating improved memory scalability for large party counts. The framework advances practical secure inference for deep learning by enabling efficient parallelism across many servers, paving the way for real-world deployment in privacy-preserving AI workloads.

Abstract

Most existing secure neural network inference protocols based on secure multi-party computation (MPC) typically support at most four participants, demonstrating severely limited scalability. Liu et al. (USENIX Security'24) presented the first relatively practical approach by utilizing Shamir secret sharing with Mersenne prime fields. However, when processing deeper neural networks such as VGG16, their protocols incur substantial communication overhead, resulting in particularly significant latency in wide-area network (WAN) environments. In this paper, we propose a high-throughput and scalable MPC protocol for neural network inference against semi-honest adversaries in the honest-majority setting. The core of our approach lies in leveraging packed Shamir secret sharing (PSS) to enable parallel computation and reduce communication complexity. The main contributions are three-fold: i) We present a communication-efficient protocol for vector-matrix multiplication, based on our newly defined notion of vector-matrix multiplication-friendly random share tuples. ii) We design the filter packing approach that enables parallel convolution. iii) We further extend all non-linear protocols based on Shamir secret sharing to the PSS-based protocols for achieving parallel non-linear operations. Extensive experiments across various datasets and neural networks demonstrate the superiority of our approach in WAN. Compared to Liu et al. (USENIX Security'24), our scheme reduces the communication upto 5.85x, 11.17x, and 6.83x in offline, online and total communication overhead, respectively. In addition, our scheme is upto 1.59x, 2.61x, and 1.75x faster in offline, online and total running time, respectively.

Figures (6)

• Figure 1: A toy example. Boxes with the same color represent a packed secret sharing, in which $k$ values are packed.
• Figure 2: Convolution process.
• Figure 3: A toy example. Boxes with the same color represent a packed secret sharing, in which $k$ values are packed and located at positions $(\boldsymbol{s}_0,\cdots,\boldsymbol{s}_{k-1})$; blank boxes indicate plaintext values. ① and ② correspond to general vector-matrix multiplication. ① and ③ correspond to fixed-point vector-matrix multiplication.
• Figure 4: A sample example. $\boldsymbol{q}_i/2^{\ell_x}=\boldsymbol{r}'_i,i\in[3],\boldsymbol{q}_0=(\boldsymbol{r}_0+\boldsymbol{r}_1+\boldsymbol{r}_2),\boldsymbol{q}_1=(\boldsymbol{r}_3+\boldsymbol{r}_4+\boldsymbol{r}_5),\boldsymbol{q}_2=(\boldsymbol{r}_6+\boldsymbol{r}_7+\boldsymbol{r}_8).$
• Figure 5: A toy example where $k=3$. Each pixel of the input tensor needs to be multiplied by each filter. $\boldsymbol{y}_1,\boldsymbol{y}_2,\boldsymbol{y}_3$ are packed into a single packed secret share. Three copies of $\boldsymbol{x}_1$ are packed into a single packed secret share. If the next layer is still a Conv operation, the result $\llbracket \boldsymbol{z}\rrbracket_{d}$ needs to be converted to $\llbracket \boldsymbol{z}^i\rrbracket_{d},i\in\{1,2,3\},\boldsymbol{z}=(\boldsymbol{z}_1,\boldsymbol{z}_2,\boldsymbol{z}_3),\boldsymbol{z}^1=(\boldsymbol{z}_1,\boldsymbol{z}_1,\boldsymbol{z}_1),\boldsymbol{z}^2=(\boldsymbol{z}_2,\boldsymbol{z}_2,\boldsymbol{z}_2),\boldsymbol{z}^3=(\boldsymbol{z}_3,\boldsymbol{z}_3,\boldsymbol{z}_3)$ by pack transformation protocol. If the next layer is an FC operation, the result $\llbracket \boldsymbol{z}\rrbracket_{d}$ can become a flattened vector seamlessly and the weight matrix can be packed according to the index of each element of the flattened vector.

Theorems & Definitions (29)

• Theorem 1
• proof
• Theorem 2
• proof
• Theorem 3
• proof
• Theorem 4
• proof
• Theorem 5
• proof