Reliable neural networks (NNs) provide important inference-time reliability guarantees such as fairness and robustness. Complementarily, privacy-preserving NN inference protects the privacy of client data. So far these two emerging areas have been largely disconnected, yet their combination will be increasingly important. In this work, we present the first system which enables privacy-preserving inference on reliable NNs. Our key idea is to design efficient fully homomorphic encryption (FHE) counterparts for the core algorithmic building blocks of randomized smoothing, a state-of-the-art technique for obtaining reliable models. The lack of required control flow in FHE makes this a demanding task, as na\"ive solutions lead to unacceptable runtime. We employ these building blocks to enable privacy-preserving NN inference with robustness and fairness guarantees in a system called Phoenix. Experimentally, we demonstrate that Phoenix achieves its goals without incurring prohibitive latencies. To our knowledge, this is the first work which bridges the areas of client data privacy and reliability guarantees for NNs.
翻译:可靠的神经网络(NNS)提供了重要的推论时间可靠性保障,例如公平和稳健性。此外,隐私保护NN的推论还保护客户数据的隐私。到目前为止,这两个新兴领域基本上互不相干,但它们的组合将越来越重要。在这项工作中,我们提出了第一个能够对可靠的NNP进行隐私保留推论的系统。我们的关键想法是设计高效的完全同质加密(FHE)对等方,以建立随机通畅的核心算法构件,这是一种获取可靠模型的先进技术。FHE缺乏必要的控制流程使得这项任务十分艰巨,因为na\\'ive解决方案会导致无法令人接受的运行时间。我们利用这些构件使称为凤凰的系统能够以稳健和公平保证的方式保护NNE。我们实验性地证明,凤凰在不引起令人望目不及的迟到的情况下实现了它的目标。据我们所知,这是连接客户数据隐私和对NPNP的可靠性保障领域的第一个工作。