Research map / Federated learning and privacy / Privacy attacks and secure learning
United We Stand: Accelerating Privacy-Preserving Neural Inference by Conjunctive Optimization with Interleaved Nexus
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes COIN, a conjunctive optimization for privacy-preserving neural inference that jointly computes consecutive ReLU and convolution/FC blocks with interleaved offline share pregeneration, removing HE rotations and making online crypto cost independent of filter size.
Problem
Computation efficiency of mixed-primitive privacy-preserving MLaaS (HE for linear layers, MPC for nonlinear layers) is limited by expensive HE rotations, which function-wise optimization cannot remove.
Approach
Instead of optimizing each function separately, jointly compute a composite ReLU-then-linear function by unfolding terms into client/server pregenerated shares, eliminating rotations and making online cost independent of filter size; also adapt network structure (MaxPool/MeanPool/BN reordering) to expose more such composite blocks.
Key results
- COIN achieves 11.2x to 29.6x speedup on composite fcfr function microbenchmarks versus CrypTFlow2 across tested dimensions.
- End-to-end online speedups of 6.4x (VGG-19) and 7x (ResNet-34) on CIFAR10, and 12x (VGG-19) and 8.6x (ResNet-34) on ImageNet versus CrypTFlow2.
- COIN eliminates all HE rotations in the composite function and makes online crypto complexity independent of filter size.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace function-wise computation with COIN conjunctive optimization | fcfr at 14×14@512, kernel 1×3@512 · modern-network function benchmark | online time: 39.2 -> 1.32 s | Helped |
| replace function-wise computation with COIN conjunctive optimization | fcfr at 28×28@128, kernel 1×3@128 · modern-network function benchmark | online time: 11.27 -> 1 s | Helped |
| replace function-wise computation with COIN conjunctive optimization | fcfr at 8×8@128, kernel 2×3@256 · modern-network function benchmark | online time: 6.75 -> 0.27 s | Helped |
| use COIN instead of CrypTFlow2 | VGG-19 · CIFAR10 | online inference time: 80.8 -> 12.5 s; 6.4× | Helped |
| use COIN instead of CrypTFlow2 | VGG-19 · CIFAR10 | communication: 0.36 -> 0.89 GB | Hurt |
| use COIN instead of CrypTFlow2 | ResNet-34 · CIFAR10 | online inference time: 116.6 -> 16.4 s; 7× | Helped |
| use COIN instead of CrypTFlow2 | ResNet-34 · CIFAR10 | communication: 0.27 -> 0.26 GB | No clear effect |
| use COIN instead of CrypTFlow2 | VGG-19 · ImageNet | online inference time: 2848.6 -> 235.8 s; 12× | Helped |
| use COIN instead of CrypTFlow2 | VGG-19 · ImageNet | communication: 17.3 -> 15.5 GB | Helped |
| use COIN instead of CrypTFlow2 | ResNet-34 · ImageNet | online inference time: 670.5 -> 77.4 s; 8.6× | Helped |
| use COIN instead of CrypTFlow2 | ResNet-34 · ImageNet | communication: 5 -> 5.2 GB | Hurt |
Surprising findings
- Communication cost increases over VGG-19 on CIFAR10 (0.89 GB vs 0.36 GB for CrypTFlow2) because MaxPool forces offline work into the online phase.
Limitations
- MaxPool outputs are not pregenerable, so offline work spills into online phase and raises communication for some networks such as VGG-19 on CIFAR10.
- Currently restricted to ReLU followed by convolution/FC; extension to leaky ReLU, piecewise linear functions and transformer blocks is untested.
- Security is only semi-honest.
Experimental setup
Datasets: CIFAR10 ImageNet
Benchmarks: CIFAR10 ImageNet
Metrics: online running time speedup communication cost (MB/GB) offline/online breakdown
Baselines: CrypTFlow2 Cheetah GAZELLE DELPHI
Builds on: CrypTFlow2 Cheetah DELPHI GAZELLE
Closest papers by meaning
- CipherPrune: Efficient and Scalable Private Transformer Inference (ICLR 2025 · similarity 0.86)
- PrivDNFIS: Privacy-preserving and Efficient Deep Neuro-Fuzzy Inference System (AAAI 2025 · similarity 0.86)
- DCT-CryptoNets: Scaling Private Inference in the Frequency Domain (ICLR 2025 · similarity 0.86)
- Encryption-Friendly LLM Architecture (ICLR 2025 · similarity 0.85)
- Practical Privacy-Preserving MLaaS: When Compressive Sensing Meets Generative Networks (AAAI 2024 · similarity 0.85)
- Certification for Differentially Private Prediction in Gradient-Based Training (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.