CBNN: 3-Party Secure Framework for Customized Binary Neural Networks Inference

Benchang Dong; Huifa Li; Jie Fu; Shiwen Wei; Xin Chen; Zhili Chen

REVIEW 4 major objections 5 minor 36 references

CBNN: 3-Party Secure Framework for Customized Binary Neural Networks Inference

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CBNN converts any standard binary neural network into a form that runs secure three-party inference faster than prior schemes without sacrificing accuracy.

desk verdict The customization recipe is sensible, but the unsound MSB protocol in Algorithm 3 and confounded comparisons sink the current version. read the letter →

arxiv 2412.16449 v1 pith:MWX5GKBQ submitted 2024-12-21 cs.LG cs.CR

Benchang Dong , Zhili Chen , Xin Chen , Shiwen Wei , Jie Fu , Huifa Li This is my paper · ORCID

classification cs.LGcs.CR

keywords securemultipartycomputationbinaryneuralnetworksinferenceknowledgedistillationreplicatedsecretsharingoblivioustransferprivacy-preservingmachinelearningMSBextraction

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CBNN claims that any standard binarized neural network can be turned into an 'MPC-friendly' version—using knowledge distillation to preserve accuracy and separable convolutions to shrink parameters—and then run securely under three-party replicated secret sharing without the accuracy loss that plagued earlier BNN-based private inference. The framework introduces a most-significant-bit (MSB) extraction protocol that implements Sign and ReLU activations with fewer communication rounds than previous comparison-based approaches. On CIFAR-10, CBNN reports secure inference in 0.311 s (LAN) and 0.871 s (WAN) with 8.291 MB of communication at 81.53% accuracy, both faster and cheaper than SecureBiNN and Falcon. The paper's broader point is that architecture-level customization, not just protocol optimization, is what makes private BNN inference practical.

What carries the argument

The core mechanism is the MSB-extraction protocol (Algorithm 3), which takes arithmetic shares of $x \in \mathbb{Z}_{2^l}$ and returns binary shares of its most significant bit by masking $x$ with a random sign bit $\beta$ and a random multiplier $r$, revealing $u = (-1)^\beta x r$, comparing $u$ with $2^{l-1}$, and returning the XOR of the comparison bit with $\beta$. This protocol removes bit decomposition and reduces communication rounds for both Sign and ReLU activations. Supporting it are three optimizations: adaptive batch-normalization fusion into adjacent linear layers, a maxpooling protocol that adds the four shares in a window and subtracts 1 rather than running secure comparisons, and MPC-friendly separable convolutions that cut parameters by roughly 82% on CifarNet2.

What would settle it

Run Algorithm 3 with ring size $l=8$ on shares of the positive value $x=100$ using multiplier $r=4$; the masked product is $400 \bmod 256 = 144 > 2^{7}$, so the protocol returns an MSB of 1 for a positive number, indicating the extraction is wrong for that input.

Watch

Extended reading notes

Core claim

The paper's central claim is that a standard BNN can be redesigned for MPC by keeping full-precision weights, binarizing activations with Sign (and occasionally ReLU), replacing standard convolutions with depthwise-plus-pointwise separable convolutions, and distilling a full-precision teacher into the compact student. On the protocol side, the authors introduce an MSB-extraction procedure that obtains the sign bit of a secret-shared value without bit decomposition, using a three-party oblivious transfer and random masking; this single primitive powers both secure Sign and secure ReLU. They additionally fuse batch-normalization parameters into adjacent linear layers and replace maxpooling's secure comparisons with a local-sum trick when the previous activation is Sign. The demonstrated consequence is that a customized BNN can be evaluated securely with less runtime and communication than SecureBiNN and Falcon while staying within about two percentage points of the uncompressed model's accuracy.

Load-bearing premise

The framework assumes that the MSB-extraction protocol (Algorithm 3) recovers the true most-significant bit of any secret-shared value, a property the paper states but does not prove.

Editorial extensions

If this is right

Secure BNN inference can be built entirely on replicated secret sharing and oblivious transfer, skipping garbled circuits for non-linear layers.
Customizing models with knowledge distillation and separable convolutions yields an MPC-compatible BNN whose accuracy nearly matches the original (81.53% vs 83.52% on CIFAR-10) while cutting parameters by 82.3%.
The MSB-extraction-based activations cut communication rounds enough to give large speedups in high-latency WAN settings (0.871 s vs 3.447 s for SecureBiNN).
The adaptive BN-fusion and maxpooling-sum protocols remove secure comparisons from the common case, lowering both time and communication.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the MSB-extraction correctness gap is closed with a provably correct comparison, the reported round-count savings should survive, because the gains come from avoiding bit decomposition rather than from the particular masking step.
The same recipe—knowledge distillation plus separable convolutions plus fused activations—could plausibly transfer to ternary or low-bit quantized networks, extending the speedups beyond binarized models.
A natural extension is to test CBNN on ImageNet-scale BNNs; the paper's argument that MPC-friendly convolutions dominate in larger networks suggests the relative gains would grow with depth.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the paper packages a sensible training-side recipe (KD + separable convolutions for MPC-friendly BNNs) with 3-party protocols, and reports plausible gains. But the core non-linear primitive appears mathematically broken, and the evaluation conflates architecture changes with protocol gains. I'd want to see a corrected and proved version before trusting any number.

What's new/creditable: the idea of co-designing a BNN's architecture and training with downstream 3PC is worth something; KD for BNNs is known, but integrating it with depthwise/pointwise splits as an MPC-friendly move is a concrete trick. The protocol for linear layers (Algorithm 2) is a clean RSS matrix-mult with one reshare, and fusing BN into linear layers is standard but good practice. The experiments cover a range of models and network settings, and the reported communication reductions on CIFAR-10 (8.3 MB vs 16.6 MB) are consistent with the design.

Soft spots: 1. Algorithm 3. The MSB extraction multiplies x by a random r over Z_{2^l} and then thresholds at 2^{l-1}. Over a power-of-two ring, that operation does not preserve the sign bit—multiplication by an even or odd r can wrap and flip MSB arbitrarily. The provided counterexample works (l=8, x=254, r=127 gives u=2). There's no correctness proof, no bound on r, no overflow analysis. Since both Sign and ReLU rest on this, every secure activation in the framework is suspect. This is a load-bearing flaw, not a nit. 2. Evaluation confound. Table 3 compares against prior frameworks that use different network architectures (MiniONN's net vs CifarNet2). The runtime and communication gains may come from the compressed model, not the protocols. The MNIST tables show CBNN actually slower than SecureBiNN in some rows. 3. No proofs for any protocol; security is asserted, not argued. For a security paper, that's a gap.

Proportion: the training/customization side is plausible, and the linear-layer and BN/B-maxpooling protocols are standard enough that they likely work. But until Algorithm 3 is corrected and proved, I can't trust the accuracy or timing results.

Who it's for: readers working on private inference for binarized nets might find the customization recipe and the communication numbers useful as a signpost, not as a benchmark. I'd cite it only after a fixed version appears.

Recommendation: if I were the editor, I would desk-reject the current version—the central primitive is unsound—but I'd encourage a revision: fix the MSB protocol, add proofs or at least a rigorous argument, and rerun the comparison with matched architectures. It's close to a workshop-grade idea but not ready for a top venue.

Referee Report

4 major / 5 minor

Summary. The paper presents CBNN, a three-party semi-honest framework for secure inference of binarized neural networks. The framework customizes a standard BNN into an "MPC-friendly" network via knowledge distillation and separable convolutions, then evaluates it using replicated secret sharing for linear layers and OT-based protocols for Sign/ReLU activations, with adaptive fusion of batch normalization and max pooling. Experiments on MNIST and CIFAR-10 report inference times and communication volumes that are competitive with or better than SecureBiNN and Falcon at comparable accuracy.

Significance. The design goals are relevant: using RSS plus OT to avoid bit-decomposition, combining knowledge distillation with separable convolutions, and fusing BN/max-pooling are sensible engineering directions. The paper also provides a concrete set of experiments against several baselines. However, the central correctness of the framework rests on the MSB extraction of Algorithm 3, which is flawed as printed, and the reported experiments do not include a plaintext-versus-secure correctness check. The paper contains no machine-checked proofs or code, so the practical claims are not independently verifiable. The significance of the contribution depends entirely on replacing the current MSB extraction with a correct protocol and re-evaluating.

major comments (4)

[3.4 (Algorithm 3)] Algorithm 3, Steps 9–10, is not a correct MSB extraction for x in Z_{2^l}. Multiplying x by a random r in Z_{2^{l-1}} does not preserve the most significant bit under multiplication modulo 2^l. Concretely, for l=8, take x=-2 (encoded as 254) and r=127. For beta=0, u = 254*127 mod 256 = 2, so u > 2^{l-1} is false, beta'=0, and the protocol returns 0, while the true MSB of -2 is 1; for beta=1, u = (-254)*127 mod 256 = 254, so beta'=1 and the returned value is 1 XOR 1 = 0, again wrong. No restriction on x or r, and no overflow analysis, is provided. Because Algorithms 4 and 5 consume the output of Algorithm 3, every secure activation in the framework is incorrect as written.
[3.3–3.4] The paper claims security against semi-honest adversaries (Sections 1 and 4) but gives no formal statement, simulation proof, or even correctness proof for Algorithms 2–5. For a protocol paper, the absence of any security analysis is a substantial gap: the reader cannot verify that the described protocols do not leak more than the output, and the claimed efficiency numbers cannot be assessed against protocols whose correctness is unproven.
[4 (Tables 1 and 3)] The experimental comparisons are confounded by heterogeneous network architectures. Table 3 lists CBNN's results for CifarNet2 while the prior frameworks (MiniONN, Chameleon, Gazelle, XONN, Falcon, SecureBiNN) use their own network topologies; similarly Table 1 compares MnistNet1–3 against prior works on different MNIST architectures and, for Falcon, a different security setting (malicious versus semi-honest). Runtime and communication differences therefore conflate protocol efficiency with model size and security model. A fair comparison would fix the architecture across frameworks or report per-layer protocol costs.
[4 (Tables 1–3)] No experiment verifies that the secure inference path produces the same outputs as plaintext inference. The reported accuracy values appear to be the model's classification accuracy; if Algorithm 3 were the one actually executed, the activations would compute wrong MSBs and the end-to-end accuracy would not match the reported numbers. The authors should report an explicit plaintext-versus-secure correctness comparison (and, ideally, release code) to establish that the experimental results correspond to the described protocol.

minor comments (5)

[3.2 (Algorithm 3)] Algorithm 3, line 1 uses 'r in Zl-1 2', which should be typeset as r in Z_{2^{l-1}}; throughout, the type of r and the fact that multiplication is modulo 2^l need to be stated precisely.
[3.4 (Algorithm 3)] Algorithm 3, Step 6 lists P2 as inputting beta^B_0; this should presumably be beta^B_2.
[3.3 (Algorithm 2)] The text mentions the truncation protocol Pi_trunc1 from [21], but Algorithm 2 does not show where truncation is applied; clarify the placement and round cost.
[B (Related Work)] Beaver's Triplet is cited as [15], but reference [15] is the Hsu and Kao COCOON paper; this appears to be a citation error, and the correct reference is likely [4].
[4 (Experiments)] No link to source code or an artifact is provided, and the experimental section does not specify the secure protocol's implementation details, making the reported LAN/WAN numbers hard to reproduce.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: CBNN's secure-inference claims rest on external benchmarks and independent protocol components; Algorithm 3's missing proof is a soundness concern, not circular reasoning.

full rationale

I walked the derivation chain from customization to secure inference to experiments. The customization stage (binarization, separable convolutions, knowledge distillation) is an empirical training procedure evaluated against OriNets and prior frameworks; no quantity is defined in terms of the result it is later used to derive. The linear-layer protocol uses replicated secret sharing from Araki et al. and the standard ABY3 truncation protocol; these are external building blocks. The MSB extraction, Sign, ReLU, BN-fusion, and max-pooling protocols are presented as new constructions and then benchmarked against MiniONN, Chameleon, EzPC, Gazelle, XONN, Falcon, and SecureBiNN, so the central empirical claims are self-contained against external systems. The KD temperature and weighting factor are training hyperparameters selected on validation data; they are not fitted parameters relabeled as predictions. I found no self-citations by the authors: SecureBiNN and Falcon are prior external works, and the RSS/OT/truncation citations are standard references, so the self-citation patterns do not apply. The one in-scope flagged issue is that Algorithm 3 (MSB extraction) is presented without a correctness proof and appears unsound as printed because step 9 multiplies the secret x by a random r before the public comparison with 2^{l-1}; over Z_{2^l}, multiplication by r does not preserve the most significant bit. However, that is a soundness/correctness defect, not a circularity of the kind the pass targets: there is no quoted equation that reduces to its own input and no renamed fitted value. Since the hard rule requires exhibiting a specific reduction or a fitted parameter renamed as a prediction, and no such step can be quoted, the circularity score is 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central empirical numbers depend on hyperparameters (lambda, temperature, architectures) fitted to validation data. The protocols inherit standard MPC assumptions; the only truly paper-specific axiom is the unproven correctness of MSB extraction. No new entities are postulated.

free parameters (4)

KD weighting factor lambda = 0.1 for MNIST; swept over 0 to 1 for CIFAR (Figure 6a)
Controls the balance between student and teacher loss; tuned on validation accuracy, directly affecting the final model accuracy reported in Tables 1 to 3.
KD temperature T = 10 for the MNIST teacher; not specified for CIFAR
Controls the softness of teacher labels; chosen by the authors and affects distillation quality.
Teacher model choice = MnistNet4 for MNIST; VGG16/ResNet18 for CIFAR (Table 4)
The teacher architecture determines the soft labels and is a design choice that affects student accuracy.
Network architecture (layer widths, separable convolution splits) = Table 4: MnistNet1-3 and CifarNet1-6
Hand-selected architectures affect both plaintext accuracy and MPC cost; no systematic architecture search is reported.

assumptions (5)

standard math Replicated secret sharing (Araki et al.) is secure against semi-honest adversaries with an honest majority.
Used as the underlying MPC primitive in Section 2.3.
standard math Oblivious transfer functionality exists and is secure.
Used in the 3-party OT protocol in Algorithm 1.
ad hoc to paper The MSB extraction protocol (Algorithm 3) correctly recovers the most significant bit.
No proof is given, and the printed description appears mathematically suspect; correctness is an unverified assumption central to Sign and ReLU.
domain assumption Activation outputs are encoded as 0 or 1 for the maxpool fusion.
The maxpool protocol in Section 3.6 relies on Sign outputs being 0 or 1 and on 2x2 windows; other encodings or window sizes would break it.
domain assumption The three parties are semi-honest and non-colluding.
Security is claimed only in this model, as stated in Section 1.

how reviews work

0 comments

Cite this review

Pith. "Pith review of CBNN: 3-Party Secure Framework for Customized Binary Neural Networks Inference." pith.science (2026). https://pith.science/paper/MWX5GKBQ

@misc{pith2026241216449,
  author       = {Pith},
  title        = {Pith review of: CBNN: 3-Party Secure Framework for Customized Binary Neural Networks Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MWX5GKBQ}},
  note         = {Machine review of arXiv:2412.16449}
}

read the original abstract

Binarized Neural Networks (BNN) offer efficient implementations for machine learning tasks and facilitate Privacy-Preserving Machine Learning (PPML) by simplifying operations with binary values. Nevertheless, challenges persist in terms of communication and accuracy in their application scenarios. In this work, we introduce CBNN, a three-party secure computation framework tailored for efficient BNN inference. Leveraging knowledge distillation and separable convolutions, CBNN transforms standard BNNs into MPC-friendly customized BNNs, maintaining high utility. It performs secure inference using optimized protocols for basic operations. Specifically, CBNN enhances linear operations with replicated secret sharing and MPC-friendly convolutions, while introducing a novel secure activation function to optimize non-linear operations. We demonstrate the effectiveness of CBNN by transforming and securely implementing several typical BNN models. Experimental results indicate that CBNN maintains impressive performance even after customized binarization and security measures

Figures

Figures reproduced from arXiv: 2412.16449 by the authors.

**Figure 1.** Knowledge distillation setup involves a teacher network that boasts high precision and a student network that operates as a low-precision binary network [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

**Figure 2.** outlines the architecture of CBNN, encompassing two primary components: BNN customization and Secure Inference. The customization phase strives to develop an accurate and MPC-compatible BNN by leveraging knowledge distillation and MPC-friendly convolutions during training. Secure inference, on the other hand, builds upon the customized BNNs, optimizing secure protocols for crucial operations such as activation fun… view at source ↗

**Figure 3.** depicts the traditional convolution as a two-step process: Depthwise and Pointwise convolutions, with Algorithm 2 executed twice. High network delay increases inference time due to more communication rounds, which cannot be offset by reduced communication cost alone. Falcon [33] has shown that as networks grow, computation dominates runtime. In summary, MPC-friendly convolutions are ideal for complex networks with … view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Example of mixed protocol between the activation layer and maxpooling layer. Within the context of customized binary neural networks, CBNN selects the Sign function as the activation function of the preceding layer, aiming to optimize the Maxpooling operation. When sha…

**Figure 5.** Figure 5: Comparison of validation accuracy and training cost between typical BNNs and customized BNNs on the MNIST dataset. OriNets refer to the typically trained networks utilizing the architectures of MnistNets. Analysis of Customized BNN: To demonstrate the customization’s e…

**Figure 6.** Figure 6: Effect of KD weighting factor λ of knowledge distillation in secure inference accuracy and comparison in validation accuracy for training typical BNNs and customized BNNs over CIFAR-10. Figure6(a) illustrates the inference accuracy achieved with varying KD weighting …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 29 canonical work pages

[1]

In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

Agrawal, N., Shahin Shamsabadi, A., Kusner, M.J., Gascón, A.: Quotient: two- party secure neural network training and prediction. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. pp. 1231– 1247 (2019)

work page 2019
[2]

In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

Araki, T., Furukawa, J., Lindell, Y., Nof, A., Ohara, K.: High-throughput semi- honest secure three-party computation with an honest majority. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 805–817 (2016)

work page 2016
[3]

IACR Cryptol

Barak, A., Escudero, D., Dalskov, A.P., Keller, M.: Secure evaluation of quantized neural networks. IACR Cryptol. ePrint Arch.2019, 131 (2019)

work page 2019
[4]

Beaver,D.:Efficientmultipartyprotocolsusingcircuitrandomization.In:Advances in Cryptology—CRYPTO’91: Proceedings 11. pp. 420–432. Springer (1992) CBNN 19

work page 1992
[5]

Boemer, F., Costache, A., Cammarota, R., Wierzynski, C.: ngraph-he2: A high- throughputframeworkforneuralnetworkinferenceonencrypteddata.In:Proceed- ings of the 7th ACM Workshop on Encrypted Computing & Applied Homomorphic Cryptography. pp. 45–56 (2019)

work page 2019
[6]

In: Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part III 38

Bourse, F., Minelli, M., Minihold, M., Paillier, P.: Fast homomorphic evaluation of deep discretized neural networks. In: Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part III 38. pp. 483–512. Springer (2018)

work page 2018
[7]

ACM Transactions on Computation Theory (TOCT) 6(3), 1–36 (2014)

Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (leveled) fully homomorphic encryp- tion without bootstrapping. ACM Transactions on Computation Theory (TOCT) 6(3), 1–36 (2014)

work page 2014
[8]

SIAM Journal on computing43(2), 831–871 (2014)

Brakerski, Z., Vaikuntanathan, V.: Efficient fully homomorphic encryption from (standard) lwe. SIAM Journal on computing43(2), 831–871 (2014)

work page 2014

Show all 36 references

[9]

In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P)

Chandran, N., Gupta, D., Rastogi, A., Sharma, R., Tripathi, S.: Ezpc: Pro- grammable and efficient secure two-party computation for machine learning. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 496–

2019
[10]

Cheon, J.H., Kim, A., Kim, M., Song, Y.: Homomorphic encryption for arithmetic of approximate numbers. In: Advances in Cryptology–ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Infor- mation Security, Hong Kong, China, December 3...

2017
[11]

arXiv preprint arXiv:1602.02830 (2016)

Courbariaux,M., Hubara,I., Soudry, D.,El-Yaniv,R., Bengio,Y.: Binarizedneural networks: Training deep neural networks with weights and activations constrained to+ 1 or-1. arXiv preprint arXiv:1602.02830 (2016)

2016 arXiv
[12]

In: International conference on machine learning

Gilad-Bachrach, R., Dowlin, N., Laine, K., Lauter, K., Naehrig, M., Wernsing, J.: Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In: International conference on machine learning. pp. 201–210. PMLR (2016)

2016
[13]

He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

2016
[14]

arXiv preprint arXiv:1503.02531 (2015)

Hinton, G., Vinyals, O., Dean, J.: Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)

2015 arXiv
[15]

Hsu, W.L., Kao, M.Y.: Computing and Combinatorics: 4th Annual International Conference, COCOON’98, Taipei, Taiwan, RoC, August 12–14, 1998, vol. 1449. Springer (2007)

2007
[16]

In: Proceedings of the 2021 ACM Workshop on Informa- tion Hiding and Multimedia Security

Ibarrondo, A., Chabanne, H., Önen, M.: Banners: Binarized neural networks with replicated secret sharing. In: Proceedings of the 2021 ACM Workshop on Informa- tion Hiding and Multimedia Security. pp. 63–74 (2021)

2021
[17]

In: Annual International Cryptology Conference

Ishai, Y., Kilian, J., Nissim, K., Petrank, E.: Extending oblivious transfers effi- ciently. In: Annual International Cryptology Conference. pp. 145–161. Springer (2003)

2003
[18]

In: Proceedings of the IEEE conference on computer vision and pattern recognition

Jacob, B., Kligys, S., Chen, B., Zhu, M., Tang, M., Howard, A., Adam, H., Kalenichenko,D.:Quantizationandtrainingofneuralnetworksforefficientinteger- arithmetic-only inference. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2704–2713 (2018)

2018
[19]

In: 27th USENIX Security Sympo- sium (USENIX Security 18)

Juvekar, C., Vaikuntanathan, V., Chandrakasan, A.:{GAZELLE}: A low latency framework for secure neural network inference. In: 27th USENIX Security Sympo- sium (USENIX Security 18). pp. 1651–1669 (2018) 20 B. Dong et al

2018
[20]

In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security

Liu, J., Juuti, M., Lu, Y., Asokan, N.: Oblivious neural network predictions via minionn transformations. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. pp. 619–631 (2017)

2017
[21]

In: Proceedings of the 2018 ACM SIGSAC conference on computer and communi- cations security

Mohassel, P., Rindal, P.: Aby3: A mixed protocol framework for machine learning. In: Proceedings of the 2018 ACM SIGSAC conference on computer and communi- cations security. pp. 35–52 (2018)

2018
[22]

In: 2017 IEEE symposium on security and privacy (SP)

Mohassel, P., Zhang, Y.: Secureml: A system for scalable privacy-preserving ma- chine learning. In: 2017 IEEE symposium on security and privacy (SP). pp. 19–38. IEEE (2017)

2017
[23]

Cryptology ePrint Archive (2005)

Rabin, M.O.: How to exchange secrets with oblivious transfer. Cryptology ePrint Archive (2005)

2005
[24]

In: European conference on computer vision

Rastegari, M., Ordonez, V., Redmon, J., Farhadi, A.: Xnor-net: Imagenet classi- fication using binary convolutional neural networks. In: European conference on computer vision. pp. 525–542. Springer (2016)

2016
[25]

In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

Rathee,D.,Rathee,M.,Kumar,N.,Chandran,N.,Gupta,D.,Rastogi,A.,Sharma, R.: Cryptflow2: Practical 2-party secure inference. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. pp. 325– 342 (2020)

2020
[26]

In: 28th USENIX Security Symposium (USENIX Security 19)

Riazi, M.S., Samragh, M., Chen, H., Laine, K., Lauter, K., Koushanfar, F.: {XONN}:{XNOR-based} oblivious deep neural network inference. In: 28th USENIX Security Symposium (USENIX Security 19). pp. 1501–1518 (2019)

2019
[27]

In: Proceedings of the 2018 on Asia conference on computer and communications security

Riazi, M.S., Weinert, C., Tkachenko, O., Songhori, E.M., Schneider, T., Koushan- far, F.: Chameleon: A hybrid secure computation framework for machine learning applications. In: Proceedings of the 2018 on Asia conference on computer and communications security. pp. 707–721 (2018)

2018
[28]

arXiv preprint arXiv:1412.6550 (2014)

Romero, A., Ballas, N., Kahou, S.E., Chassang, A., Gatta, C., Bengio, Y.: Fitnets: Hints for thin deep nets. arXiv preprint arXiv:1412.6550 (2014)

2014 arXiv
[29]

In: Proceedings of the 55th annual design automation conference

Rouhani, B.D., Riazi, M.S., Koushanfar, F.: Deepsecure: Scalable provably-secure deep learning. In: Proceedings of the 55th annual design automation conference. pp. 1–6 (2018)

2018
[30]

In: Proceedings of the 59th ACM/IEEE Design Automation Conference

Shen, L., Dong, Y., Fang, B., Shi, J., Wang, X., Pan, S., Shi, R.: Abnn2: secure two- party arbitrary-bitwidth quantized neural network predictions. In: Proceedings of the 59th ACM/IEEE Design Automation Conference. pp. 361–366 (2022)

2022
[31]

arXiv preprint arXiv:1409.1556 (2014)

Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)

2014 arXiv
[32]

Wagh, S., Gupta, D., Chandran, N.: Securenn: 3-party secure computation for neural network training. Proc. Priv. Enhancing Technol.2019(3), 26–49 (2019)

2019
[33]

arXiv preprint arXiv:2004.02229 (2020)

Wagh, S., Tople, S., Benhamouda, F., Kushilevitz, E., Mittal, P., Rabin, T.: Fal- con: Honest-majority maliciously secure framework for private deep learning. arXiv preprint arXiv:2004.02229 (2020)

2020 arXiv
[34]

In: Procedings the 19th Annual ACM Symposium on the Theory of Computing

Wigderson, A., Goldreich, O., Micali, S.: How to play any mental game [c]. In: Procedings the 19th Annual ACM Symposium on the Theory of Computing. pp. 218–229 (1987)

1987
[35]

In: European Symposium on Research in Computer Security

Zhu, W., Wei, M., Li, X., Li, Q.: Securebinn: 3-party secure computation for bina- rized neural network inference. In: European Symposium on Research in Computer Security. pp. 275–294. Springer (2022)

2022
[36]

Zhu, X., Vondrick, C., Fowlkes, C.C., Ramanan, D.: Do we need more training data? International Journal of Computer Vision119(1), 76–92 (2016)

2016

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

Agrawal, N., Shahin Shamsabadi, A., Kusner, M.J., Gascón, A.: Quotient: two- party secure neural network training and prediction. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. pp. 1231– 1247 (2019)

work page 2019

[2] [2]

In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

Araki, T., Furukawa, J., Lindell, Y., Nof, A., Ohara, K.: High-throughput semi- honest secure three-party computation with an honest majority. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 805–817 (2016)

work page 2016

[3] [3]

IACR Cryptol

Barak, A., Escudero, D., Dalskov, A.P., Keller, M.: Secure evaluation of quantized neural networks. IACR Cryptol. ePrint Arch.2019, 131 (2019)

work page 2019

[4] [4]

Beaver,D.:Efficientmultipartyprotocolsusingcircuitrandomization.In:Advances in Cryptology—CRYPTO’91: Proceedings 11. pp. 420–432. Springer (1992) CBNN 19

work page 1992

[5] [5]

Boemer, F., Costache, A., Cammarota, R., Wierzynski, C.: ngraph-he2: A high- throughputframeworkforneuralnetworkinferenceonencrypteddata.In:Proceed- ings of the 7th ACM Workshop on Encrypted Computing & Applied Homomorphic Cryptography. pp. 45–56 (2019)

work page 2019

[6] [6]

In: Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part III 38

Bourse, F., Minelli, M., Minihold, M., Paillier, P.: Fast homomorphic evaluation of deep discretized neural networks. In: Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part III 38. pp. 483–512. Springer (2018)

work page 2018

[7] [7]

ACM Transactions on Computation Theory (TOCT) 6(3), 1–36 (2014)

Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (leveled) fully homomorphic encryp- tion without bootstrapping. ACM Transactions on Computation Theory (TOCT) 6(3), 1–36 (2014)

work page 2014

[8] [8]

SIAM Journal on computing43(2), 831–871 (2014)

Brakerski, Z., Vaikuntanathan, V.: Efficient fully homomorphic encryption from (standard) lwe. SIAM Journal on computing43(2), 831–871 (2014)

work page 2014