Pith. sign in

REVIEW 2 major objections 3 minor 1 cited by

SONNI: Secure Oblivious Neural Network Inference

T0 review · 2 major / 3 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper identifies an undetectable model-stealing attack on multikey encrypted neural network inference, the Silver Platter attack, and proves a results-checking protocol, SONNI, bounds its success by…

desk verdict The Silver Platter attack is a valid and useful observation, but SONNI's verification step leaks the decoy-slot positions, so the central collusion-resistance theorem doesn't hold. read the letter →

arxiv 2504.18974 v1 pith:PD2QOR2S submitted 2025-04-26 cs.CR

Luke Sperling , Sandeep S. Kulkarni This is my paper · ORCID
classification cs.CR
keywords fullyhomomorphicencryptionmultikeyobliviousneuralnetworkinferencemodelstealingSilverPlatterattackresultscheckingmachinelearningasaserviceclientprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the standard outsourced setting for homomorphic encrypted neural network inference has a silent hole: a malicious server can pass the provider's encrypted model parameters directly to the client in place of the inference result, and the provider will never detect it. The authors call this the Silver Platter attack, and show it defeats multikey encryption, which only stops simple collusion. To close the hole, they propose SONNI, a results-checking protocol in which the provider hides random verification values in some ciphertext slots, computes a companion function on them, and checks a masked hash of the result before helping the client decrypt. If the check passes, the provider can be confident the server computed honestly, and the paper proves the probability of successfully stealing $k$ model parameters is at most $(\frac{d}{d+m})^k+\varepsilon_1+\varepsilon_2$, with $\varepsilon_1,\varepsilon_2$ negligible encryption and hash failure terms.

What carries the argument

The load-bearing mechanism is the verification-slot construction: the provider secretly permutes the concatenation of the client's $d$ data slots and $m$ provider-chosen random values $y$, then defines a random function $g$ of the same form as $f$ so that both $f(x)$ and $g(y)$ are evaluated together by the server. The check itself is a masked, quantized hash comparison: the provider multiplies the result by a random vector, sends a partial decryption to the client, and compares $h(q(g'(y)))$ from both sides, so the provider is convinced the computation was correct without ever seeing $f(x)$. This mechanism converts an undetectable attack into a detectable one and trades a small number of ciphertext slots for an exponentially small success probability.

What would settle it

Concretely, attempt the attack with a colluding client that has received the step-9 partial decryption and the step-10 mask, and check whether the client can determine the $y$-slot positions from its view; if it can, the $(\frac{d}{d+m})^k$ bound no longer holds and a client-server pair can steal parameters while passing the hash check.

Watch

Extended reading notes

Core claim

SONNI's central claim is that provider privacy in outsourced inference can be protected even when the server and client collude, by making the provider's final decryption help conditional on a verifiable dummy computation. The provider appends random values $y$ to the client's data, secretly permutes the combined vector, and defines a random function $g$ of the same algebraic form as the model $f$. The server computes both $f(x)$ and $g(y)$ in the same ciphertext; the provider then masks the whole result with a random vector and asks the client to return a hash of the masked $g(y)$ values after partial decryption. If the hash matches the provider's plaintext computation, the provider releases the mask needed to recover $f(x)$. A server that wants to leak parameters must guess which slots are unverified, giving the theorem's $(\frac{d}{d+m})^k$ bound; under the same scheme, a provider-server collusion cannot learn $x$ or $f(x)$ without breaking the encryption or the hash.

Load-bearing premise

The protocol's security rests on the client and server never learning which ciphertext slots hold the verification values; if the client can identify those slots from the mask it is sent during results checking, the probability bound collapses.

Editorial extensions

If this is right

  • The multikey oblivious inference protocol that SONNI builds on, if used without a results-checking step, permits a malicious server to leak the entire model to the client with probability 1, and the provider cannot observe the leak.
  • With SONNI's checking in place, a server that steals one parameter per inference over the 32,768-parameter benchmark model has success probability $1.51\times10^{-28}$ when only two slots are used for verification, and batching capability drops by just 0.2%.
  • Increasing the number of verification slots makes the bound decay quickly: with $m=32$ verification slots in a 1024-slot vector, stealing 512 parameters succeeds with probability about $7.07\times10^{-11}$.
  • The client's data and result remain hidden from a provider-server collusion: the only avenues for leakage are breaking the underlying homomorphic encryption or the hash function, both assumed negligible.
  • When a check fails, the protocol aborts but does not reveal whether the server or the client caused the failure, which the paper leaves as an open problem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The theorem's $(\frac{d}{d+m})^k$ bound depends on the verification-slot indices staying secret from both the client and the server; the protocol's own result-checking step gives the client a mask and a partial decryption, and if those reveal which slots hold $g(y)$, a colluding client could instruct the server to replace only $f$-slots, bypassing the check entirely. In particular, Section 4.3.1 s
  • The quantitative claims assume a single-round attack steals all $k$ parameters at once; a patient adversary stealing one parameter per query pays per-query costs, so the practical security level depends on the provider's pricing and query limits, not just on the probability bound.
  • The same slot-verification idea should extend to any outsourced FHE computation that evaluates a vector-valued arithmetic circuit, not only neural networks, by replacing $f$ and $g$ with any same-form pair of functions.
  • An implementation measuring actual wall-clock time, communication, and ciphertext expansion would be needed to see whether the 0.2% batching reduction translates into acceptable latency at realistic security parameters.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 3 minor

Summary. The paper identifies a model-stealing attack, called the Silver Platter attack, against multikey FHE-based oblivious neural network inference, in which a malicious server returns encryptions of model parameters to the client instead of the computed result, and proposes SONNI, a mitigation that dedicates some ciphertext slots to a provider-chosen verification function g(y). The paper's central claim is Theorem 1, which bounds the probability of successfully stealing k model parameters by (d/(d+m))^k + ε1 + ε2, and it further claims security even when the client and server collude. The protocol's result-checking mechanism relies on the client and provider comparing hashes of a masked verification value g'(y), with a promised but unspecified zero-knowledge step to prevent a malicious provider from choosing incorrect slots.

Significance. The Silver Platter attack is a genuinely interesting and valid observation about the baseline protocol of Chen et al., and the paper correctly identifies that provider privacy in outsourced MLaaS deserves more attention. The idea of adding verification slots is intuitive and could be a useful building block. However, the central security proof is unsound: the results-checking step as specified either cannot be executed by an honest client or leaks the y-slot positions to the client, and the promised zero-knowledge mechanism that would address the acknowledged provider-attack is never supplied. Because Theorem 1 is the load-bearing claim of the paper, the manuscript does not establish its main stated contribution. The attack description and the quantitative discussion of verification-slot tradeoffs remain useful, but the proposed protocol would require a substantially different results-checking mechanism to support the paper's claims.

major comments (2)
  1. [Section 4.3 / Section 4.4] The security of SONNI is stated in Section 4.3.1 to rely on the client and server not knowing the indices of the y values. However, the protocol as written cannot be executed honestly without revealing those indices: in Algorithm 1, Step 9, the client receives a partial decryption of the full masked result vector perm(f'(x),g'(y)), and Step 10 requires the client to compute q(g'(y)) in order to send hash1 in Step 11. Since the decrypted vector contains both permuted x-values and permuted y-values, an honest client cannot isolate the g'(y) entries unless the provider supplies a mask or index set identifying the y slots. Section 4.3.2's statement that the client 'uses the mask provided by the provider' confirms that such a mask is intended. Once supplied, the mask reveals the y-slot positions to the client and hence to a colluding server. The server can then overwrite one or more x slots with model parameters while leaving all y slots correct, so the provider's hash comparison in Steps 11–14 passes with probability 1 (up to ε1 and ε2), contradicting the (d/(d+m))^k bound in Theorem 1. The 'zero-knowledge approach' promised in Section 4.3 is never specified, and the hash comparison described in Section 4.3.2 does not compensate for this position leak.
  2. [Section 4.3 / Section 4.4] The paper itself acknowledges that a malicious provider could specify incorrect indices so that the client computes and hashes f'(x) instead of g'(y), and it states that this is prevented by 'a zero-knowledge approach discussed later in this section.' No such zero-knowledge protocol appears anywhere in the manuscript. The only mechanism actually described is a hash comparison in Steps 11–14, which does not prove that the client used the correct slot selection. Consequently, Theorem 2's claim that a provider colluding with the server can learn x or f(x) only by breaking the encryption or the hash is not established by the protocol as written. This is a second load-bearing gap in the security analysis.
minor comments (3)
  1. [Algorithm 1, Step 7] The notation 'rand = [-1,1]^{d+m}' is ambiguous: Section 4.3.2 says rand is a vector of random nonzero real values, while the algorithm notation suggests entries chosen from the interval or set {-1,1}. Please specify the exact distribution and how it interacts with the quantization step.
  2. [Section 4.3.2] The phrase 'f′(y) = f (y) × rand' appears to be a typo; earlier in the same paragraph the notation is defined as f′(x) = f(x) × rand.
  3. [Section 4.4] The text says 'In Figure 3, we analyze Theorem 1 quantitatively,' but no Figure 3 appears in the manuscript; the authors should either include the figure or remove the reference.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 1 is a direct slot-counting calculation from protocol parameters, not an input-output equivalence.

full rationale

The central security claim, Theorem 1 in Section 4.4, upper-bounds the success probability of the Silver Platter attack by (d/(d+m))^k + eps1 + eps2. This is a combinatorial calculation: the server must guess which of the d+m ciphertext slots are unchecked x slots rather than checked y slots, and each of the k stolen scalars is placed in one of the d unchecked slots; nothing is fitted to the claimed bound, and no result by the authors is invoked to force it. The eps1 and eps2 terms are standard reductions to the FHE and hash primitives, stated as assumptions. The only self-citation, (Sperling et al., 2022), provides the 32768-parameter benchmark model size used in the numerical example; it is external, falsifiable information and is not load-bearing for the security proof. The review's main concern, that Algorithm 1 steps 9-10 may reveal the y-slot positions to the client, contradicting Section 4.3.1's statement that 'The security of our proposed protocol relies on the client and server not knowing the indices of the y values,' is a potential soundness or executability gap in the protocol as written, not a circular reduction. Similarly, Section 4.3's promised 'zero-knowledge approach discussed later in this section' is never specified, and Section 6 admits that 'it is not clear if it is the server or the client who is dishonest when the results checking step fails.' These are limitations or omitted proofs, not cases where the derivation reduces to its own inputs. For that reason the circularity score is 0.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The protocol rests on standard FHE security and hash assumptions, plus a load-bearing assumption that the client cannot determine which slots hold verification values. The paper's own mask step appears to violate that assumption. No new entities are introduced.

free parameters (1)
  • m, number of verification slots
    m is a user-chosen security parameter. The claimed security probability (d/(d+m))^k depends on it. The paper analyzes m=2, 32, 512 but gives no systematic method for choosing it for a given model size and risk tolerance.
assumptions (4)
  • domain assumption CKKS-based multikey FHE is semantically secure and ciphertexts are indistinguishable, so the server cannot distinguish permutations of encrypted slots.
    Used in Section 4.4, Theorem 1 proof, to argue the server must guess which slots are verification slots.
  • ad hoc to paper The client does not learn the positions of the y (verification) slots from the protocol.
    Stated in Section 4.3.1 as essential for security, but the protocol's mask step appears to reveal those positions, so this assumption is load-bearing and unsupported.
  • standard math The hash function h is collision-resistant and one-way.
    Standard cryptographic assumption used in the results-checking step and in Theorem 1 and Theorem 2.
  • domain assumption Quantization intervals are large enough that FHE noise never flips a quantized value.
    Implicit in Section 4.3.2; the paper does not analyze noise growth or choose concrete quantization parameters.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SONNI: Secure Oblivious Neural Network Inference." pith.science (2026). https://pith.science/paper/PD2QOR2S

@misc{pith2026250418974,
  author       = {Pith},
  title        = {Pith review of: SONNI: Secure Oblivious Neural Network Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PD2QOR2S}},
  note         = {Machine review of arXiv:2504.18974}
}
read the original abstract

In the standard privacy-preserving Machine learning as-a-service (MLaaS) model, the client encrypts data using homomorphic encryption and uploads it to a server for computation. The result is then sent back to the client for decryption. It has become more and more common for the computation to be outsourced to third-party servers. In this paper we identify a weakness in this protocol that enables a completely undetectable novel model-stealing attack that we call the Silver Platter attack. This attack works even under multikey encryption that prevents a simple collusion attack to steal model parameters. We also propose a mitigation that protects privacy even in the presence of a malicious server and malicious client or model provider (majority dishonest). When compared to a state-of-the-art but small encrypted model with 32k parameters, we preserve privacy with a failure chance of 1.51 x 10^-28 while batching capability is reduced by 0.2%. Our approach uses a novel results-checking protocol that ensures the computation was performed correctly without violating honest clients' data privacy. Even with collusion between the client and the server, they are unable to steal model parameters. Additionally, the model provider cannot learn any client data if maliciously working with the server.

Figures

Figures reproduced from arXiv: 2504.18974 by the authors.

Figure 1
Figure 1. Standard Outsourced Oblivious Neural Network Inference Model [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. SONNI sequence diagram. 4.2 Mitigation Approach In this section, we propose our approach for providing privacy to provider as well as the client. Specifically, the approach in (Chen et al., 2019b) already provides privacy for the client data. We ensure that the cor￾responding privacy is preserved while permitting the provider to have control over the data being transmit￾ted to the client so that it can verify that t… view at source ↗
Figure 3
Figure 3. Probability of performing a Silver Platter attack without being detected based on the number of ciphertext slots [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments

    cs.AI 2025-06 conditional novelty 6.0 of 10

    A TEE-based protocol for cryptographically verifiable AI safety benchmark results, demonstrated on Llama-3.1 with AWS Nitro Enclaves.

Reference graph

Works this paper leans on

33 extracted references · 29 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence 'output.state := if if FUNCTION not #0 #1 if FUNCTION and 'skip pop #0 if FUNCTIO...

  2. [2]

    Ananth, P., Jain, A., Jin, Z., and Malavolta, G. (2020). Multi-key fully-homomorphic encryption in the plain model. In Theory of Cryptography: 18th International Conference, TCC 2020, Durham, NC, USA, November 16--19, 2020, Proceedings, Part I 18 , pages 28--57. Springer

    work page 2020

  3. [3]

    Boulemtafes, A., Derhab, A., and Challal, Y. (2020). A review of privacy-preserving techniques for deep learning. Neurocomputing , 384:21--45

    work page 2020

  4. [4]

    D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al

    Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J. D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020). Language models are few-shot learners. Advances in neural information processing systems , 33:1877--1901

    2020

  5. [5]

    Chen, H., Chillotti, I., and Song, Y. (2019a). Multi-key homomorphic encryption from tfhe. In Advances in Cryptology--ASIACRYPT 2019: 25th International Conference on the Theory and Application of Cryptology and Information Security, Kobe, Japan, December 8--12, 2019, Proceedings, Part II 25 , pages 446--472. Springer

    work page 2019

  6. [6]

    Chen, H., Dai, W., Kim, M., and Song, Y. (2019b). Efficient multi-key homomorphic encryption with packed ciphertexts with application to oblivious neural network inference. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , pages 395--412

    work page 2019

  7. [7]

    H., Kim, A., Kim, M., and Song, Y

    Cheon, J. H., Kim, A., Kim, M., and Song, Y. (2017). Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology--ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23 , pages 409--437. Springer

    2017

  8. [8]

    Chowdhury, S., Sinha, S., Singh, A., Mishra, S., Chaudhary, C., Patranabis, S., Mukherjee, P., Chatterjee, A., and Mukhopadhyay, D. (2022). Efficient threshold fhe with application to real-time systems. Cryptology ePrint Archive

    work page 2022

Show all 33 references
  1. [9]

    Cramer, R., Damg rd, I., and Nielsen, J. B. (2001). Multiparty computation from threshold homomorphic encryption. In Advances in Cryptology—EUROCRYPT 2001: International Conference on the Theory and Application of Cryptographic Techniques Innsbruck, Austria, May 6--10, 2001 Pr...

    2001

  2. [10]

    and Nielsen, J

    Damg rd, I. and Nielsen, J. B. (2003). Universally composable efficient multiparty computation from threshold homomorphic encryption. In Annual international cryptology conference , pages 247--264. Springer

    2003

  3. [11]

    Drozdowski, P., Buchmann, N., Rathgeb, C., Margraf, M., and Busch, C. (2019). On the application of homomorphic encryption to face identification. In 2019 international conference of the biometrics special interest group (biosig) , pages 1--5. IEEE

    2019

  4. [12]

    J., Jain, A

    Engelsma, J. J., Jain, A. K., and Boddeti, V. N. (2022). Hers: Homomorphically encrypted representation search. IEEE Transactions on Biometrics, Behavior, and Identity Science , 4(3):349--360

    2022

  5. [13]

    Gentry, C. (2009). Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing , pages 169--178

    2009

  6. [14]

    and Shoup, V

    Halevi, S. and Shoup, V. (2014). Algorithms in helib. In Advances in Cryptology--CRYPTO 2014: 34th Annual Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2014, Proceedings, Part I 34 , pages 554--571. Springer

    2014

  7. [15]

    Hu, X., Liang, L., Deng, L., Li, S., Xie, X., Ji, Y., Ding, Y., Liu, C., Sherwood, T., and Xie, Y. (2019). Neural network model extraction attacks in edge devices by hearing architectural hints. arXiv preprint arXiv:1903.03916

    2019 arXiv

  8. [16]

    M., and Sahai, A

    Jain, A., Rasmussen, P. M., and Sahai, A. (2017). Threshold fully homomorphic encryption. Cryptology ePrint Archive

    2017

  9. [17]

    K., Shaik, I., Vasudha, V., Chalamala, S

    Jindal, A. K., Shaik, I., Vasudha, V., Chalamala, S. R., Ma, R., and Lodha, S. (2020). Secure and privacy preserving method for biometric template protection using fully homomorphic encryption. In 2020 IEEE 19th international conference on trust, security and privacy in comput...

    2020

  10. [18]

    L \'o pez-Alt, A., Tromer, E., and Vaikuntanathan, V. (2012). On-the-fly multiparty computation on the cloud via multikey fully homomorphic encryption. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing , pages 1219--1234

    2012

  11. [19]

    and Meek, C

    Lowd, D. and Meek, C. (2005). Adversarial learning. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining , pages 641--647

    2005

  12. [20]

    Ma, J., Naas, S.-A., Sigg, S., and Lyu, X. (2022). Privacy-preserving federated learning based on multi-key homomorphic encryption. International Journal of Intelligent Systems , 37(9):5880--5901

    2022

  13. [21]

    C., and Jain, A

    Mai, G., Cao, K., Yuen, P. C., and Jain, A. K. (2018). On the reconstruction of face images from deep face templates. IEEE transactions on pattern analysis and machine intelligence , 41(5):1188--1202

    2018

  14. [22]

    \'A ., Weinert, C., Chabal, D., and Bos, J

    Mann, Z. \'A ., Weinert, C., Chabal, D., and Bos, J. W. (2023). Towards practical secure neural network inference: the journey so far and the road ahead. ACM Computing Surveys , 56(5):1--37

    2023

  15. [23]

    and Wichs, D

    Mukherjee, P. and Wichs, D. (2016). Two round multiparty computation via multi-key fhe. In Advances in Cryptology--EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Par...

    2016

  16. [24]

    Myers, S., Sergi, M., et al. (2011). Threshold fully homomorphic encryption and secure computation. Cryptology ePrint Archive

    2011

  17. [25]

    J., Schiele, B., and Fritz, M

    Oh, S. J., Schiele, B., and Fritz, M. (2019). Towards reverse-engineering black-box neural networks. Explainable AI: interpreting, explaining and visualizing deep learning , pages 121--144

    2019

  18. [26]

    Oliynyk, D., Mayer, R., and Rauber, A. (2023). I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys , 55(14s):1--41

    2023

  19. [27]

    N., Schneider, T., and Tkachenko, O

    Reith, R. N., Schneider, T., and Tkachenko, O. (2019). Efficiently stealing your machine learning models. In Proceedings of the 18th ACM Workshop on Privacy in the Electronic Society , pages 198--210

    2019

  20. [28]

    S., Samragh, M., Chen, H., Laine, K., Lauter, K., and Koushanfar, F

    Riazi, M. S., Samragh, M., Chen, H., Laine, K., Lauter, K., and Koushanfar, F. (2019). \ XONN \ : \ XNOR-based \ oblivious deep neural network inference. In 28th USENIX Security Symposium (USENIX Security 19) , pages 1501--1518

    2019

  21. [29]

    Sperling, L., Ratha, N., Ross, A., and Boddeti, V. N. (2022). Heft: Homomorphically encrypted fusion of biometric templates. In 2022 IEEE International Joint Conference on Biometrics (IJCB) , pages 1--10. IEEE

    2022

  22. [30]

    Sugizaki, Y., Tsuchida, H., Hayashi, T., Nuida, K., Nakashima, A., Isshiki, T., and Mori, K. (2023). Threshold fully homomorphic encryption over the torus. In European Symposium on Research in Computer Security , pages 45--65. Springer

    2023

  23. [31]

    and Gong, N

    Wang, B. and Gong, N. Z. (2018). Stealing hyperparameters in machine learning. In 2018 IEEE symposium on security and privacy (SP) , pages 36--52. IEEE

    2018

  24. [32]

    W., and Torrellas, J

    Yan, M., Fletcher, C. W., and Torrellas, J. (2020). Cache telepathy: Leveraging shared resource attacks to learn \ DNN \ architectures. In 29th USENIX Security Symposium (USENIX Security 20) , pages 2003--2020

    2020

  25. [33]

    Yang, W., Wang, S., Cui, H., Tang, Z., and Li, Y. (2023). A review of homomorphic encryption for privacy-preserving biometrics. Sensors , 23(7):3566

    2023

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.