Research map / Federated learning and privacy / Privacy attacks and secure learning
On Probabilistic Truncation in Privacy-preserving Machine Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that probabilistic truncation in PPML (SecureML/ABY3-style) causes large errors when precision is close to ring size, and proposes a non-interactive deterministic truncation plus a scaling technique that speeds up ReLU/DReLU in 2PC/3PC MPC.
Problem
Probabilistic truncation protocols used in MPC-based PPML fail with probability about 1/2^(ℓ-ℓx-1), and recommended precision parameters in prior works cause low inference accuracy; secure comparison (DReLU/ReLU) is also costly because it depends on large ring sizes to limit truncation errors.
Approach
Identifies that prior works fixed the random mask (e.g., r=2^26) which hides truncation errors, proves the failure probability via a cut-function analysis, replaces probabilistic truncation with a non-interactive deterministic cut, and scales ReLU inputs to 7 effective bits so DReLU can run on a small ring.
Key results
- The improved ReLU protocol completes in 2 rounds with 704 bits total communication over Z_2^64 with 7-bit precision, a 92% reduction versus original Bicoptor.
- DReLU protocol achieves over 10x speedup and ReLU over 6x speedup versus Piranha-Falcon on GPUs; 3.7x over Bicoptor.
- End-to-end PPML inference is sped up 3-4x; e.g., CIFAR10 AlexNet under LAN1 takes 4.4s versus 16.72s for Piranha.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use random numbers instead of fixed r in ABY3 probabilistic truncation (ablation) | Piranha PPML inference implementations · CIFAR10 AlexNet, P-SecureML | accuracy: 69.63% -> 12.74% | Hurt |
| Use random numbers instead of fixed r in ABY3 probabilistic truncation (ablation) | Piranha PPML inference implementations · Tiny AlexNet, P-SecureML | accuracy: 26.39% -> 0.45% | Hurt |
| Use random numbers instead of fixed r in ABY3 probabilistic truncation (ablation) | Piranha PPML inference implementations · CIFAR10 VGG16, P-SecureML | accuracy: 88.31% -> 10.60% | Hurt |
| Use random numbers instead of fixed r in ABY3 probabilistic truncation (ablation) | Piranha PPML inference implementations · Tiny VGG16, P-SecureML | accuracy: 54.89% -> 0.43% | Hurt |
| Truncate before multiplication instead of multiplying then truncating (ablation) | Piranha PPML inference implementations · CIFAR10 AlexNet, P-SecureML | accuracy: 12.74% -> 69.62% | Helped |
| Truncate before multiplication instead of multiplying then truncating (ablation) | Piranha PPML inference implementations · Tiny AlexNet, P-SecureML | accuracy: 0.45% -> 26.35% | Helped |
| Truncate before multiplication instead of multiplying then truncating (ablation) | Piranha PPML inference implementations · CIFAR10 VGG16, P-SecureML | accuracy: 10.60% -> 88.29% | Helped |
| Truncate before multiplication instead of multiplying then truncating (ablation) | Piranha PPML inference implementations · Tiny VGG16, P-SecureML | accuracy: 0.43% -> 54.92% | Helped |
| Apply the proposed 7-bit input framework to ReLU (ablation) | ReLU protocols · ReLU protocol, ℓ=64 | communication: 8, 768 bits -> 1, 728 bits | Helped |
| Use 7-bit rather than original-width DReLU input (ablation) | ReLU evaluation protocols · Models tested in the performance evaluation | ReLU evaluation time: approximately 5x | Helped |
| Use 7-bit rather than 15-bit DReLU input (ablation) | EdaBits, ABY3, ABY2.0, and Bicoptor · Models tested in the performance evaluation | ReLU running time: over 5× | Helped |
| Use the proposed ReLU protocol rather than P-Falcon | PPML inference · Models under different network environments | inference time: 3-4x | Helped |
Surprising findings
- Recommended precision parameters (ℓfrac=26, ℓ=64) in Piranha works yield near-random accuracy (e.g., 0.45% on Tiny AlexNet) once random masks are used instead of fixed ones.
- Fixed-mask implementations in prior PPML works hide truncation failures, so reported accuracy was misleadingly high.
Limitations
- Accuracy loss of about 0.2% under 7-bit ReLU scaling, requiring post-training calibration of scaling factor.
- Deterministic cut relies on values being within a bounded range; 3PC variant needs an interactive cut.
- Evaluation limited to three CNN models on CIFAR10 and Tiny ImageNet.
Experimental setup
Datasets: CIFAR10 Tiny ImageNet
Benchmarks: CIFAR10 Tiny ImageNet
Metrics: inference accuracy communication bits run-time (ms) throughput (ops) end-to-end inference time (s)
Baselines: Piranha-Falcon Bicoptor EdaBits ABY3 ABY2.0 Orca Falcon
Builds on: SecureML truncation ABY3 truncation Bicoptor Falcon Piranha
Closest papers by meaning
- Leveraging Per-Instance Privacy for Machine Unlearning (ICML 2025 · similarity 0.82)
- DECO-Bench: Unified Benchmark for Decoupled Task-Agnostic Synthetic Data Release (NeurIPS 2024 · similarity 0.81)
- PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization (NeurIPS 2026 · similarity 0.81)
- Certified Machine Unlearning via Noisy Stochastic Gradient Descent (NeurIPS 2024 · similarity 0.81)
- CipherPrune: Efficient and Scalable Private Transformer Inference (ICLR 2025 · similarity 0.81)
- Private Statistical Estimation via Truncation (NeurIPS 2025 · similarity 0.80)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.