保护隐私的神经网络鲁棒性验证框架,让模型与数据所有者安全协作。
Privacy-Preserving Robustness Verification for Neural Networks
- 用安全多方计算实现模型与数据方协同验证鲁棒性
- 在0.1到200秒内完成不同规模模型的验证,结果与原始一致
- 适合金融、医疗等隐私敏感领域的模型可信验证
神经网络验证与数据隐私存在根本矛盾:验证需要完全访问模型参数和输入数据,但隐私法规与知识产权限制使这一需求难以满足。本文提出SecureCROWN,首个支持隐私保护的神经网络鲁棒性验证框架。基于安全两方计算(2PC),该框架使模型所有者与数据所有者可联合计算认证鲁棒性边界,在半诚实安全模型下仅暴露最终结果,同时严格保护双方私密数据。核心挑战在于线性边界传播中的条件分支操作与安全计算协议不兼容。我们通过将条件逻辑转化为连续算术运算消除了分支,并引入牛顿-拉夫逊优化方法提升数值稳定性。大量分析与实验表明,SecureCROWN的结果严格匹配明文验证,耗时在0.1至200秒之间,适用于局域网与广域网环境,证明了隐私保护验证的可行性。
原文摘要 · Abstract (English)
Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。