{"id":"5ae5ebd6-e339-4fc0-9e11-709b9f61b601","arxiv_id":"2412.16449","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A three-party framework that customizes binarized neural networks with distillation and separable convolutions to speed up privacy-preserving inference.","lead":"CBNN is a three-party secure computation framework for running binarized neural networks on private data. It uses knowledge distillation and separable convolutions to make BNNs faster to evaluate securely, reporting lower inference times than prior frameworks on MNIST and CIFAR-10.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 3's MSB extraction multiplies the secret by an arbitrary random r before comparing to 2^{l−1}; over Z_{2^l} this does not preserve the sign bit, so secure Sign and ReLU are unsound as printed.","rationale":"The reader's weakest_assumption identifies exactly the load-bearing flaw: Algorithm 3's MSB extraction is never proved and, as printed, is algebraically invalid because multiplication by a random element of Z_{2^{l−1}} modulo 2^l does not preserve the most significant bit. I verified this independently with a small-ring counterexample, and the failure propagates to Secure Sign and Secure ReLU, which are the only non-linear activations used in CBNN. Without these activations the entire secure inference pipeline cannot be correct. The paper provides no correctness theorem, no security proof, and no bound on the inputs that could rescue the multiplicative blinding argument. A second concern, that the experimental comparisons use different network architectures and thus confound protocol efficiency with model size, is real but secondary; it would weaken the efficiency claim even if the cryptographic core were sound. Because the invalid MSB extraction alone invalidates the central claim, I agree with the reader's REJECT verdict and do not recommend changing it.","tokens_in":13358,"tokens_out":7785,"duration_ms":73111,"concrete_test":"Implement Algorithm 3 standalone in a small ring (e.g., l=8 or l=16) with the exact step 9–10 operations, enumerating or sampling x in {-2^{l−1}, ..., 2^{l−1}−1} and r in Z_{2^{l−1}}, and count how often β'⊕β differs from the true MSB of x. If any deviation occurs, the algorithm is not correct as written. A minimal hand-check is l=8, x=254, r=127, which already yields the wrong MSB.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that CBNN performs correct secure BNN inference rests on Algorithm 3, which is used by Secure Sign (Algorithm 4) and Secure ReLU (Algorithm 5). In step 9 the parties compute [u] = [(-1)^β · x · r] over Z_{2^l}, reveal u, and in step 10 set β' = 1 iff u > 2^{l−1}, returning β' ⊕ β. But over a power-of-two ring, multiplication by a random r ∈ Z_{2^{l−1}} is not sign-preserving. A concrete counterexample at l=8: x = -2 (encoded as 254) and r = 127. For β=0, u = 254·127 mod 256 = 2, so β'=0 and the output is 0, while the true MSB of -2 is 1. For β=1, u = 2·127 = 254, β'=1, and the output is again 0. Thus the extracted MSB is wrong. No correctness proof, no bound on x or r, and no overflow analysis is supplied for steps 9–10, and both non-linear activations depend on this primitive. Consequently the reported accuracy and runtime numbers in Tables 1–3 cannot be attributed to a correct protocol, and the paper's headline contribution is unsupported as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents CBNN, a three-party semi-honest framework for secure inference of binarized neural networks. The framework customizes a standard BNN into an \"MPC-friendly\" network via knowledge distillation and separable convolutions, then evaluates it using replicated secret sharing for linear layers and OT-based protocols for Sign/ReLU activations, with adaptive fusion of batch normalization and max pooling. Experiments on MNIST and CIFAR-10 report inference times and communication volumes that are competitive with or better than SecureBiNN and Falcon at comparable accuracy.","tokens_in":13607,"tokens_out":10288,"duration_ms":87126,"significance":"The design goals are relevant: using RSS plus OT to avoid bit-decomposition, combining knowledge distillation with separable convolutions, and fusing BN/max-pooling are sensible engineering directions. The paper also provides a concrete set of experiments against several baselines. However, the central correctness of the framework rests on the MSB extraction of Algorithm 3, which is flawed as printed, and the reported experiments do not include a plaintext-versus-secure correctness check. The paper contains no machine-checked proofs or code, so the practical claims are not independently verifiable. The significance of the contribution depends entirely on replacing the current MSB extraction with a correct protocol and re-evaluating.","major_comments":[{"comment":"Algorithm 3, Steps 9–10, is not a correct MSB extraction for x in Z_{2^l}. Multiplying x by a random r in Z_{2^{l-1}} does not preserve the most significant bit under multiplication modulo 2^l. Concretely, for l=8, take x=-2 (encoded as 254) and r=127. For beta=0, u = 254*127 mod 256 = 2, so u > 2^{l-1} is false, beta'=0, and the protocol returns 0, while the true MSB of -2 is 1; for beta=1, u = (-254)*127 mod 256 = 254, so beta'=1 and the returned value is 1 XOR 1 = 0, again wrong. No restriction on x or r, and no overflow analysis, is provided. Because Algorithms 4 and 5 consume the output of Algorithm 3, every secure activation in the framework is incorrect as written.","section":"3.4 (Algorithm 3)"},{"comment":"The paper claims security against semi-honest adversaries (Sections 1 and 4) but gives no formal statement, simulation proof, or even correctness proof for Algorithms 2–5. For a protocol paper, the absence of any security analysis is a substantial gap: the reader cannot verify that the described protocols do not leak more than the output, and the claimed efficiency numbers cannot be assessed against protocols whose correctness is unproven.","section":"3.3–3.4"},{"comment":"The experimental comparisons are confounded by heterogeneous network architectures. Table 3 lists CBNN's results for CifarNet2 while the prior frameworks (MiniONN, Chameleon, Gazelle, XONN, Falcon, SecureBiNN) use their own network topologies; similarly Table 1 compares MnistNet1–3 against prior works on different MNIST architectures and, for Falcon, a different security setting (malicious versus semi-honest). Runtime and communication differences therefore conflate protocol efficiency with model size and security model. A fair comparison would fix the architecture across frameworks or report per-layer protocol costs.","section":"4 (Tables 1 and 3)"},{"comment":"No experiment verifies that the secure inference path produces the same outputs as plaintext inference. The reported accuracy values appear to be the model's classification accuracy; if Algorithm 3 were the one actually executed, the activations would compute wrong MSBs and the end-to-end accuracy would not match the reported numbers. The authors should report an explicit plaintext-versus-secure correctness comparison (and, ideally, release code) to establish that the experimental results correspond to the described protocol.","section":"4 (Tables 1–3)"}],"minor_comments":[{"comment":"Algorithm 3, line 1 uses 'r in Zl-1 2', which should be typeset as r in Z_{2^{l-1}}; throughout, the type of r and the fact that multiplication is modulo 2^l need to be stated precisely.","section":"3.2 (Algorithm 3)"},{"comment":"Algorithm 3, Step 6 lists P2 as inputting beta^B_0; this should presumably be beta^B_2.","section":"3.4 (Algorithm 3)"},{"comment":"The text mentions the truncation protocol Pi_trunc1 from [21], but Algorithm 2 does not show where truncation is applied; clarify the placement and round cost.","section":"3.3 (Algorithm 2)"},{"comment":"Beaver's Triplet is cited as [15], but reference [15] is the Hsu and Kao COCOON paper; this appears to be a citation error, and the correct reference is likely [4].","section":"B (Related Work)"},{"comment":"No link to source code or an artifact is provided, and the experimental section does not specify the secure protocol's implementation details, making the reported LAN/WAN numbers hard to reproduce.","section":"4 (Experiments)"}],"recommendation":"reject","confidential_remarks":"The main reason for rejection is the incorrect MSB extraction primitive. If the authors can supply a correct protocol (e.g., based on a standard comparison or bit decomposition) and re-run all experiments with that protocol, including a plaintext-versus-secure correctness check, a revised submission could be considered. The current manuscript, however, does not support its central claim as written."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper packages a sensible training-side recipe (KD + separable convolutions for MPC-friendly BNNs) with 3-party protocols, and reports plausible gains. But the core non-linear primitive appears mathematically broken, and the evaluation conflates architecture changes with protocol gains. I'd want to see a corrected and proved version before trusting any number.\n\nWhat's new/creditable: the idea of co-designing a BNN's architecture and training with downstream 3PC is worth something; KD for BNNs is known, but integrating it with depthwise/pointwise splits as an MPC-friendly move is a concrete trick. The protocol for linear layers (Algorithm 2) is a clean RSS matrix-mult with one reshare, and fusing BN into linear layers is standard but good practice. The experiments cover a range of models and network settings, and the reported communication reductions on CIFAR-10 (8.3 MB vs 16.6 MB) are consistent with the design.\n\nSoft spots:\n1. Algorithm 3. The MSB extraction multiplies x by a random r over Z_{2^l} and then thresholds at 2^{l-1}. Over a power-of-two ring, that operation does not preserve the sign bit—multiplication by an even or odd r can wrap and flip MSB arbitrarily. The provided counterexample works (l=8, x=254, r=127 gives u=2). There's no correctness proof, no bound on r, no overflow analysis. Since both Sign and ReLU rest on this, every secure activation in the framework is suspect. This is a load-bearing flaw, not a nit.\n2. Evaluation confound. Table 3 compares against prior frameworks that use different network architectures (MiniONN's net vs CifarNet2). The runtime and communication gains may come from the compressed model, not the protocols. The MNIST tables show CBNN actually slower than SecureBiNN in some rows.\n3. No proofs for any protocol; security is asserted, not argued. For a security paper, that's a gap.\n\nProportion: the training/customization side is plausible, and the linear-layer and BN/B-maxpooling protocols are standard enough that they likely work. But until Algorithm 3 is corrected and proved, I can't trust the accuracy or timing results.\n\nWho it's for: readers working on private inference for binarized nets might find the customization recipe and the communication numbers useful as a signpost, not as a benchmark. I'd cite it only after a fixed version appears.\n\nRecommendation: if I were the editor, I would desk-reject the current version—the central primitive is unsound—but I'd encourage a revision: fix the MSB protocol, add proofs or at least a rigorous argument, and rerun the comparison with matched architectures. It's close to a workshop-grade idea but not ready for a top venue.","headline":"The customization recipe is sensible, but the unsound MSB protocol in Algorithm 3 and confounded comparisons sink the current version.","tokens_in":14194,"tokens_out":5062,"would_cite":false,"duration_ms":41889,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CBNN converts any standard binary neural network into a form that runs secure three-party inference faster than prior schemes without sacrificing accuracy.","keywords":["secure multiparty computation","binary neural networks","secure inference","knowledge distillation","replicated secret sharing","oblivious transfer","privacy-preserving machine learning","MSB extraction"],"falsifier":"Run Algorithm 3 with ring size $l=8$ on shares of the positive value $x=100$ using multiplier $r=4$; the masked product is $400 \\bmod 256 = 144 > 2^{7}$, so the protocol returns an MSB of 1 for a positive number, indicating the extraction is wrong for that input.","tokens_in":13107,"feed_emoji":"🔒","tokens_out":12894,"duration_ms":91486,"temperature":0.7,"pith_summary":"CBNN claims that any standard binarized neural network can be turned into an 'MPC-friendly' version—using knowledge distillation to preserve accuracy and separable convolutions to shrink parameters—and then run securely under three-party replicated secret sharing without the accuracy loss that plagued earlier BNN-based private inference. The framework introduces a most-significant-bit (MSB) extraction protocol that implements Sign and ReLU activations with fewer communication rounds than previous comparison-based approaches. On CIFAR-10, CBNN reports secure inference in 0.311 s (LAN) and 0.871 s (WAN) with 8.291 MB of communication at 81.53% accuracy, both faster and cheaper than SecureBiNN and Falcon. The paper's broader point is that architecture-level customization, not just protocol optimization, is what makes private BNN inference practical.","feed_headline":"Secure binary-net inference drops to 0.31 s on CIFAR-10","feed_subtitle":"CBNN's 3-party framework beats Falcon and SecureBiNN with 8.3 MB traffic at 81.5% accuracy.","key_machinery":"The core mechanism is the MSB-extraction protocol (Algorithm 3), which takes arithmetic shares of $x \\in \\mathbb{Z}_{2^l}$ and returns binary shares of its most significant bit by masking $x$ with a random sign bit $\\beta$ and a random multiplier $r$, revealing $u = (-1)^\\beta x r$, comparing $u$ with $2^{l-1}$, and returning the XOR of the comparison bit with $\\beta$. This protocol removes bit decomposition and reduces communication rounds for both Sign and ReLU activations. Supporting it are three optimizations: adaptive batch-normalization fusion into adjacent linear layers, a maxpooling protocol that adds the four shares in a window and subtracts 1 rather than running secure comparisons, and MPC-friendly separable convolutions that cut parameters by roughly 82% on CifarNet2.","core_discovery":"The paper's central claim is that a standard BNN can be redesigned for MPC by keeping full-precision weights, binarizing activations with Sign (and occasionally ReLU), replacing standard convolutions with depthwise-plus-pointwise separable convolutions, and distilling a full-precision teacher into the compact student. On the protocol side, the authors introduce an MSB-extraction procedure that obtains the sign bit of a secret-shared value without bit decomposition, using a three-party oblivious transfer and random masking; this single primitive powers both secure Sign and secure ReLU. They additionally fuse batch-normalization parameters into adjacent linear layers and replace maxpooling's secure comparisons with a local-sum trick when the previous activation is Sign. The demonstrated consequence is that a customized BNN can be evaluated securely with less runtime and communication than SecureBiNN and Falcon while staying within about two percentage points of the uncompressed model's accuracy.","pith_inferences":["If the MSB-extraction correctness gap is closed with a provably correct comparison, the reported round-count savings should survive, because the gains come from avoiding bit decomposition rather than from the particular masking step.","The same recipe—knowledge distillation plus separable convolutions plus fused activations—could plausibly transfer to ternary or low-bit quantized networks, extending the speedups beyond binarized models.","A natural extension is to test CBNN on ImageNet-scale BNNs; the paper's argument that MPC-friendly convolutions dominate in larger networks suggests the relative gains would grow with depth."],"forward_implications":["Secure BNN inference can be built entirely on replicated secret sharing and oblivious transfer, skipping garbled circuits for non-linear layers.","Customizing models with knowledge distillation and separable convolutions yields an MPC-compatible BNN whose accuracy nearly matches the original (81.53% vs 83.52% on CIFAR-10) while cutting parameters by 82.3%.","The MSB-extraction-based activations cut communication rounds enough to give large speedups in high-latency WAN settings (0.871 s vs 3.447 s for SecureBiNN).","The adaptive BN-fusion and maxpooling-sum protocols remove secure comparisons from the common case, lowering both time and communication."],"supporting_citations":[{"why":"Supplies the replicated secret-sharing scheme that all arithmetic and binary share operations in CBNN are built on.","marker":"[2]"},{"why":"Provides the standard BNN training algorithm whose networks CBNN customizes.","marker":"[11]"},{"why":"Introduces knowledge distillation, the method used to preserve accuracy in the customized student BNNs.","marker":"[14]"},{"why":"Contributes the ABY3 mixed-protocol framework and the truncation protocol $\\Pi_{trunc1}$ used after fixed-point multiplications.","marker":"[21]"},{"why":"Defines binarized neural networks and the XNOR-style binary operations that motivate CBNN's design.","marker":"[24]"},{"why":"XONN is the prior two-party BNN secure-inference framework that CBNN compares against and seeks to improve.","marker":"[26]"},{"why":"Falcon provides the comparison baseline and Algorithm 1, the prior MSB-extraction approach that CBNN's Algorithm 3 adapts.","marker":"[33]"},{"why":"SecureBiNN is the immediate baseline and codebase on which CBNN is built for secure BNN inference.","marker":"[35]"}],"fun_headline_variants":["CBNN: 3-party secure BNN inference hits 0.31 s on CIFAR-10","Secure sign-bit trick makes 3-party BNN inference 0.31 s","CBNN's MSB trick cuts secure BNN traffic to 8.3 MB","CBNN beats Falcon and SecureBiNN with 8.3 MB traffic","3-party secure BNN achieves 81.5% accuracy with 8.3 MB traffic"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework assumes that the MSB-extraction protocol (Algorithm 3) recovers the true most-significant bit of any secret-shared value, a property the paper states but does not prove.","fun_headline_variants_meta":{"raw":{"variants":["CBNN: 3-party secure BNN inference hits 0.31 s on CIFAR-10","Secure sign-bit trick makes 3-party BNN inference 0.31 s","CBNN's MSB trick cuts secure BNN traffic to 8.3 MB","CBNN beats Falcon and SecureBiNN with 8.3 MB traffic","3-party secure BNN achieves 81.5% accuracy with 8.3 MB traffic"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.002172,"raw_usage":{"total_tokens":8392,"prompt_tokens":895,"completion_tokens":7497,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":511,"completion_tokens_details":{"reasoning_tokens":7379}},"tokens_in":511,"tokens_out":7497,"duration_ms":47652,"temperature":1.0,"reasoning_tokens":7379,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:35:03.518300+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 3 with ring size $l=8$ on shares of the positive value $x=100$ using multiplier $r=4$; the masked product is $400 \\bmod 256 = 144 > 2^{7}$, so the protocol returns an MSB of 1 for a positive number, indicating the extraction is wrong for that input.","supporting_citations":[{"cited_title":"In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","cited_arxiv_id":null,"evidence_quote":"Supplies the replicated secret-sharing scheme that all arithmetic and binary share operations in CBNN are built on."},{"cited_title":"In: Proceedings of the 2018 ACM SIGSAC conference on computer and communi- cations security","cited_arxiv_id":null,"evidence_quote":"Contributes the ABY3 mixed-protocol framework and the truncation protocol $\\Pi_{trunc1}$ used after fixed-point multiplications."},{"cited_title":"In: European conference on computer vision","cited_arxiv_id":null,"evidence_quote":"Defines binarized neural networks and the XNOR-style binary operations that motivate CBNN's design."},{"cited_title":"In: 28th USENIX Security Symposium (USENIX Security 19)","cited_arxiv_id":null,"evidence_quote":"XONN is the prior two-party BNN secure-inference framework that CBNN compares against and seeks to improve."},{"cited_title":"In: European Symposium on Research in Computer Security","cited_arxiv_id":null,"evidence_quote":"SecureBiNN is the immediate baseline and codebase on which CBNN is built for secure BNN inference."}],"review_version":1}