Pith. sign in

REVIEW 2 major objections 5 minor 41 references

CryptGNN: Enabling Secure Inference for Graph Neural Networks

T0 review · 2 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CryptGNN claims to be the first system that enables secure inference for graph neural networks in the cloud, protecting the client's graph structure and node features and the model owner's parameters even if P-1 of P cloud parties collude.

desk verdict Clever protocol engineering but the load-bearing graph-structure privacy bound is unproven and likely wrong; the batching leaks too much. read the letter →

arxiv 2509.09107 v1 pith:X2G7KLM7 submitted 2025-09-11 cs.CR cs.LG

Pritam Sen , Yao Ma , Cristian Borcea This is my paper · ORCID
classification cs.CRcs.LG
keywords Securemulti-partycomputationGraphneuralnetworksPrivacy-preservinginferenceMachinelearningasaserviceSecretsharingBeavertriplesMessagepassingstructureprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CryptGNN is a new SMPC-based inference system for graph neural networks offered as MLaaS. It allows a client to upload encrypted graph data and a model owner to upload encrypted model parameters, and lets a set of cloud parties compute the GNN forward pass without learning the graph structure, node features, intermediate results, or model weights. The paper claims this is the first approach to achieve strong privacy (P-1 colluding parties, no trusted server) while remaining practical for medium and large graphs. The two key protocols are CryptMPL for secure message passing and CryptMUL for secure feature transformations.

What carries the argument

The core mechanism is the combination of additive secret sharing (A-SS) and multiplicative secret sharing (M-SS) with a client-side noise masking step. For message passing, CryptMPL uses a batched relative-index encoding: the client uploads the first index of each batch in secret-shared form and the relative offsets for the other edges in plaintext, while the parties rotate matrices by random amounts and add noise so that neither source nor destination indices are revealed. For feature transformations, CryptMUL reuses a per-client initial Beaver triple by applying pseudorandom linear combinations to the rows of the A and C matrices for each inference request, and generates fresh Beaver tripl

What would settle it

Construct a 3-party simulation of CryptMPL for a graph known to the adversary except for the edge list, collect the plaintext relative indices S_r and D_r for all batches, and attempt to recover the true edge list by using the public first-index shares and the node degrees inferred from the aggregation pattern. If the success probability exceeds N^(-2R) for the claimed N and R, or if the adversary can recover any edge with certainty after observing all batches for one inference request, then Theorem 2 is false.

Watch

Extended reading notes

Core claim

The paper introduces CryptGNN, a privacy-preserving GNN inference system built from two protocols. CryptMPL securely performs message passing by having the client precompute and share a noise matrix, then having the parties rotate, shift, and mask secret-shared feature matrices and indices so that read and write operations on edges reveal neither the features nor the graph structure. CryptMUL enables secure matrix and element-wise multiplications for feature transformation layers by reusing a per-client initial Beaver triple through random row combinations for linear layers, and by generating fresh Beaver triples via an additive-to-multiplicative share conversion for non-linear layers. The s

Load-bearing premise

The security of the graph structure relies on the claim that an adversary who observes the plaintext relative source and destination indices for each batch, along with the encrypted first indices, cannot reconstruct the graph with probability higher than N^(-2R); if this bound fails, the whole graph-privacy guarantee collapses.

Editorial extensions

If this is right

  • If CryptGNN is correct, MLaaS providers can offer pretrained GNN models to clients without exposing proprietary model weights or learning the client's graph data, including the existence of edges between nodes.
  • CryptGNN eliminates the trusted third party required by prior SMPC-based GNN approaches such as SecGNN, and works with any number of parties, tolerating all but one colluding.
  • The batched edge processing reduces communication and computation overhead compared to adjacency-matrix-based secure message passing, especially for sparse large graphs.
  • CryptMUL's reuse of Beaver triples through random row combinations enables low online latency for linear layers, making repeated inference requests from the same client practical.
  • The security model covers collusion with the model owner or a fake data owner, going beyond the standard honest-but-curious party collusion assumption.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The claim that graph structure privacy scales as N^(-2R) rests on the assumption that the plaintext relative indices in each batch are independent and reveal nothing across batches; if an adversary can collect multiple batches for the same graph, they may correlate relative offsets to eliminate candidate shifts and recover the graph with far less work, which would invalidate the security bound.
  • A concrete testable extension is to implement an attack that observes the relative indices and the order of edge processing across multiple batches and attempts to reconstruct the source-destination pairs; the success probability versus N and R would directly confirm or refute Theorem 2.
  • CryptGNN's security is stated for the honest-but-curious model; extending it to active adversaries would require MACs or zero-knowledge proofs, as the paper acknowledges, and the current protocols would likely fail under malicious behavior.
  • The client-side noise computation assumes the client knows the exact graph structure and noise effect; if the client is computationally weak or the graph changes frequently, the preprocessing cost may negate the efficiency gains claimed for large graphs.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper presents CryptGNN, a secure multi-party computation (SMPC) system for GNN inference in an MLaaS setting. The system has two main components: CryptMPL, which performs secure message passing over secret-shared edge lists using client-side noise masking and batched processing, and CryptMUL, which implements secure matrix and element-wise multiplications using Beaver triples with a claimed preprocessing optimization. The paper claims correctness, security against collusion of up to P-1 out of P parties, and efficiency, and reports experiments on GIN models over several graph datasets showing lower latency than CrypTen and SecGNN baselines. The central security claim is that both node features and graph structure are protected, with the graph-structure reconstruction probability bounded by N^{-2R}.

Significance. If the security guarantees were sound, this would be a useful contribution: it targets a realistic threat model without a trusted third party, supports an arbitrary number of SMPC parties, and provides an end-to-end implementation with performance numbers. The empirical comparison and the system design are valuable. However, the paper's central graph-structure privacy claim is not established and, as argued below, is contradicted by the protocol's own design: the batching optimization uploads relative source/destination offsets in plaintext. Since the abstract and introduction rest the contribution on 'provably secure' protection of graph structure, this is a load-bearing flaw. The paper also provides no security experiments, only accuracy and runtime measurements.

major comments (2)
  1. [§4.4, §6.1, Theorem 2] The claimed N^{-2R} bound on graph reconstruction is unsupported and appears false. In the batching protocol, the relative index vectors S_r and D_r are uploaded in plaintext; only the first indices of each batch, JS_fK and JD_fK, are secret-shared. The proof of Theorem 2 says 'Processing multiple edges in CryptMPL does not reveal additional information,' but this is exactly the claim to be proved. The adversary's joint view across batches is never analyzed. Because a node can appear in multiple edges in different batches, the public offsets impose linear constraints on the anchor indices; the number of anchor assignments consistent with the public offsets is generally far smaller than N^{2R}, so a uniform guess among consistent assignments succeeds with probability much larger than N^{-2R}. The theorem analyzes one batch in isolation and does not account for cross-batch correlations. Th
  2. [§5.1, §6.1 (Theorem 3)] The proof that F_MatMul preserves privacy is incomplete. In the online phase, U = X - A' is revealed, where A' is not a freshly sampled random matrix but a public random row-combination of the same initial Beaver matrix A. Lemma 1 only shows that a linear combination of secret-shared values does not reveal the shares; it does not establish that the revealed U is indistinguishable from a value simulated without knowledge of X. If A does not have full column rank (e.g., when the number of nodes N is smaller than the feature dimension K, which can occur for small graphs with wide hidden layers), then A' is supported on a proper subspace of R^{N×K}, and U's distribution depends on X through the coset X - span(A'). The proof must either use genuinely fresh independent A' for every request or prove that row-combining A preserves uniformity over the full matrix space; neither is done. This affe
minor comments (5)
  1. [§6.1] Axiom 1 is not an axiom; it is a standard information-theoretic property of additive secret sharing and should be stated as a lemma with a proof or a citation.
  2. [§6.1, Theorem 2] The probability notation is confusing: the proof starts with per-edge probability 1/(N(N-1)), but the theorem states N^{-2R}. These are not consistent unless the batch size and number of edges are specified. The probability should be defined with respect to the adversary's random coins and the client's random choices.
  3. [References] References [1] and [2] are duplicates of the same Beaver paper; one should be removed and citations updated.
  4. [§7] The text says 'the batch size is set to group all edges in 20 batches'; this should be stated as the number of batches R=20, not 'batch size', which is ambiguous.
  5. [§4.4] The example 'a batch of 3 nodes' is unclear: the batch contains edges, not nodes. The relative-index encoding should be explained more carefully in terms of source and destination arrays.

Circularity Check

1 steps flagged · score 5.0 of 10

Graph-structure security bound for batched processing is assumed, not derived: Theorem 2's proof invokes the very claim it must prove.

  1. self definitional [Section 4.4 (batching) and Section 6.1, Theorem 2 proof]
    "Using the relative order of the indices in each batch, the parties may infer the graph structure. The analysis in Section 6 shows that the probability of correct reconstruction of the graph structure is N^{-2R}. ... Processing multiple edges in CryptMPL does not reveal additional information. ... Thus, to process all edges in R batches in CryptMPL, the probability of correct reconstruction of graph structure is N^{-2R}."

    The N^{-2R} bound is introduced in Section 4.4 by a forward reference to Section 6. The proof of Theorem 2 in Section 6.1 never analyzes the plaintext relative offsets Sr/Dr that the batching protocol uploads. Instead, it states 'Processing multiple edges in CryptMPL does not reveal additional information' and then uses that statement as the premise to conclude the R-batch probability N^{-2R}. That statement is exactly the graph-structure privacy property under test. No equation or adversary argument connects the public relative indices to the claimed bound; the proof assumes the conclusion, making the central graph-structure security guarantee circular for the batched case.

full rationale

Most of CryptGNN's derivation is self-contained: CryptMPL's read/write correctness is verified by explicit rotation accounting (Appendix C), and CryptMUL relies on standard Beaver triples with external proofs [20,35,36]; there are no self-citations or fitted parameters renamed as predictions. The only load-bearing circular step is the graph-structure security bound for batched processing. Section 4.4 introduces plaintext relative indices Sr/Dr and promises a proof in Section 6; Theorem 2's proof, however, never analyzes Sr/Dr. It asserts that batching 'does not reveal additional information' and then multiplies per-edge probabilities to obtain N^{-2R}. That assertion is the very property to be proved, so the bound is an assumption rather than a derived result. Because the abstract and Section 1 rest the 'provably secure' claim for graph structure on this bound, the circularity is material. The empirical efficiency results and the correctness of the underlying SMPC operations are independent and not affected.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The central construction rests on standard secret-sharing axioms, the honest-but-curious P-1 collusion threat model, and two paper-specific assumptions that lack rigorous support: the row-combination reuse of Beaver triples and the N^{-2R} bound for batched relative-index leakage.

free parameters (3)
  • Fixed-point scaling factor B = 2^f
    Chosen to encode real values as integers in A-SS; precision f is set by hand in Section 2.1 and not fitted to data.
  • Ring size L = 64
    Implementation choice for the share space (Section 7); affects overflow behavior, not a data-fitted parameter.
  • Number of batches R = 20 in the main experiments
    Configurable trade-off between communication rounds and graph-structure privacy; the claimed security bound depends inversely on R (Section 4.4).
assumptions (6)
  • standard math A value x is information-theoretically secure in A-SS format even if P-1 out of P parties collude.
    Invoked as Axiom 1 in Section 6.1 to ground the security analysis; this is a standard property of additive secret sharing.
  • domain assumption At most P-1 of P parties collude and all parties are honest-but-curious.
    The threat model in Section 3; the protocol offers no protection if all parties collude or behave maliciously.
  • domain assumption The GNN model architecture, including number and type of layers, is public.
    Stated in Section 3; required so parties know which secure sub-protocols to invoke.
  • domain assumption The client can exactly simulate the servers' PRF-derived noise and rotations from shared seeds.
    Necessary for the client-side preprocessing in Section 4.4 to compute the noise correction; if PRFs or seeds differ, the output is wrong.
  • ad hoc to paper Reusing a single underlying Beaver triple A across inference requests with public random row combinations does not leak model parameters or features.
    Introduced in Section 5.1 to avoid a trusted server; the paper provides no composition security argument for multi-request reuse.
  • ad hoc to paper The relative indices of batched edges reveal graph structure only with probability N^{-2R}.
    Introduced in Section 4.4 and used in Theorem 2; it is both unproven and likely false for graph families with repeated nodes, such as stars.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CryptGNN: Enabling Secure Inference for Graph Neural Networks." pith.science (2026). https://pith.science/paper/X2G7KLM7

@misc{pith2026250909107,
  author       = {Pith},
  title        = {Pith review of: CryptGNN: Enabling Secure Inference for Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X2G7KLM7}},
  note         = {Machine review of arXiv:2509.09107}
}
read the original abstract

We present CryptGNN, a secure and effective inference solution for third-party graph neural network (GNN) models in the cloud, which are accessed by clients as ML as a service (MLaaS). The main novelty of CryptGNN is its secure message passing and feature transformation layers using distributed secure multi-party computation (SMPC) techniques. CryptGNN protects the client's input data and graph structure from the cloud provider and the third-party model owner, and it protects the model parameters from the cloud provider and the clients. CryptGNN works with any number of SMPC parties, does not require a trusted server, and is provably secure even if P-1 out of P parties in the cloud collude. Theoretical analysis and empirical experiments demonstrate the security and efficiency of CryptGNN.

Figures

Figures reproduced from arXiv: 2509.09107 by the authors.

Figure 1
Figure 1. (a) A computational flow showing input graph fea [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. (a) CryptMPL protocol stack (b) An example sce [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Flow of a share of a matrix for read (a) and write (b) in CryptMPL with [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: (a) Secure Matrix Multiplication Protocol (b) Secure [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Execution time ratio of CrypTen over CryptGNN [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Comparison of CryptMPL with existing techniques: [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Effect of (a) number of parties and (b) batch size on [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Execution time ratio of a linear layer between [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 10
Figure 10. Figure 10: CryptMPL: Client side preprocessing step [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 11
Figure 11. Figure 11: CryptMPL flow at the computing parties 0 + T1111 0 + T1112 2 + T1121 3 + T1122 0 + T1131 0 + T1132 0 + T1141 0 + T1142 0 + T2211 0 + T2212 10 + T2221 2 + T2222 0 + T2231 0 + T2232 0 + T2241 0 + T2242 0 + T3311 0 + T3312 1 + T3321 1 + T3322 0 + T3331 0 + T3332 0 + T334…
Figure 12
Figure 12. Figure 12: CryptMPL - removal of noise to get the output [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]
Figure 13
Figure 13. Figure 13: GIN architecture The network comprises 3 message-passing layers stacked one after another. The outputs of the 3 layers are concatenated and passed through a linear layer with the ReLU activation function. Finally, another linear layer with the Softmax activation funct…
Figure 14
Figure 14. Figure 14: Effect of different parameters of graph data (Y-axis is log-scaled) [PITH_FULL_IMAGE:figures/full_fig_p021_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 5 canonical work pages

  1. [1]

    Donald Beaver. 1991. Efficient Multiparty Protocols Using Circuit Randomization. InAdvances in Cryptology - CRYPTO ’91, 11th Annual International Cryptology Conference, Santa Barbara, California, USA, August 11-15, 1991, Proceedings (Lec- ture Notes in Computer Science, Vol. 576). Springer, 420–432. doi:10.1007/3-540- 46766-1_34

    doi:10.1007/3-540- 1991

  2. [2]

    Donald Beaver. 1992. Efficient multiparty protocols using circuit randomization. InAdvances in Cryptology—CRYPTO’91: Proceedings 11. Springer, 420–432

    1992

  3. [3]

    Marina Blanton, Ahreum Kang, and Chen Yuan. 2020. Improved Building Blocks for Secure Multi-Party Computation Based on Secret Sharing with Honest Major- ity. InApplied Cryptography and Network Security: 18th International Conference, ACNS 2020, Rome, Italy, October 19–22, 2020, Proceedings, Part I. Springer-Verlag, Berlin, Heidelberg, 377–397. doi:10.1007...

    work page doi:10.1007/978-3-030-57808-4_19 2020

  4. [4]

    Federica Bogo, Javier Romero, Matthew Loper, and Michael J Black. 2014. FAUST: Dataset and evaluation for 3D mesh registration. InProceedings of the IEEE conference on computer vision and pattern recognition. 3794–3801

    2014

  5. [5]

    Octavian Catrina and Sebastiaan Hoogh. 2010. Improved primitives for secure multiparty integer computation. InSecurity and Cryptography for Networks: 7th International Conference, SCN 2010, Amalfi, Italy, September 13-15, 2010. Proceed- ings 7. Springer, 182–199

    2010

  6. [6]

    Hao Chen, Miran Kim, Ilya Razenshteyn, Dragos Rotaru, Yongsoo Song, and Sameer Wagh. 2020. Maliciously Secure Matrix Multiplication with Applications to Private Deep Learning. Cryptology ePrint Archive, Paper 2020/451. https: //eprint.iacr.org/2020/451 https://eprint.iacr.org/2020/451

    2020

  7. [7]

    Hao Chen and Han Kyoohyung. 2018. Homomorphic Lower Digits Removal and Improved FHE Bootstrapping. 315–337. doi:10.1007/978-3-319-78381-9_12

    work page doi:10.1007/978-3-319-78381-9_12 2018

  8. [8]

    Long Chen, Zhenfeng Zhang, and Xueqing Wang. 2017. Batched Multi-Hop Multi-Key FHE from Ring-LWE with Compact Ciphertext Extension. InTheory of Cryptography: 15th International Conference, TCC 2017, Baltimore, MD, USA, November 12-15, 2017, Proceedings, Part II. Springer-Verlag, Berlin, Heidelberg, 597–627. doi:10.1007/978-3-319-70503-3_20

    work page doi:10.1007/978-3-319-70503-3_20 2017

Show all 41 references
  1. [9]

    Ivan Damgård, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P. Smart. 2013. Practical Covertly Secure MPC for Dishonest Majority – Or: Breaking the SPDZ Limits. InComputer Security – ESORICS 2013. Springer Berlin Heidelberg, Berlin, Heidelberg, 1–18

    2013

  2. [10]

    Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy. InProceedings of the 33rd International Conference on International Conference on M...

    2016

  3. [11]

    David K Duvenaud, Dougal Maclaurin, Jorge Iparraguirre, Rafael Bombarell, Timothy Hirzel, Alan Aspuru-Guzik, and Ryan P Adams. 2015. Convolutional Networks on Graphs for Learning Molecular Fingerprints. InAdvances in Neural Information Processing Systems, Vol. 28

    2015

  4. [12]

    E.E.A. .com. 2024. Modular Multiplicative Inverse. https://www.extendedeuclid eanalgorithm.com/multiplicative_inverse.php

    2024

  5. [13]

    Hossein Ghodosi, Josef Pieprzyk, and Ron Steinfeld. 2012. Multi-party compu- tation with conversion of secret sharing.Designs, Codes and Cryptography62 (2012), 259–272

    2012

  6. [14]

    Ma Haiyan, Yan Jinyao, Panagiotis Georgopoulos, and Bernhard Plattner. 2016. Towards SDN based queuing delay estimation.China Communications13, 3 (2016), 27–36. doi:10.1109/CC.2016.7445500

    2016

  7. [15]

    Hamilton, Rex Ying, and Jure Leskovec

    William L. Hamilton, Rex Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. InProceedings of the 31st International Conference on Neural Information Processing Systems (NIPS’17). 1025–1035

    2017

  8. [16]

    Hamilton, Zhitao Ying, and Jure Leskovec

    William L. Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive Represen- tation Learning on Large Graphs. InNIPS

    2017

  9. [17]

    Ozkaptan, Attila A

    Thang Hoang, Ceyhun D. Ozkaptan, Attila A. Yavuz, Jorge Guajardo, and Tam Nguyen. 2017. S3ORAM: A Computation-Efficient and Constant Client Band- width Blowup ORAM with Shamir Secret Sharing. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Securi...

    2017

  10. [18]

    Sergei Ivanov, Sergei Sviridov, and Evgeny Burnaev. 2019. Understanding Isomor- phism Bias in Graph Data Sets.CoRRabs/1910.12091 (2019). arXiv:1910.12091 http://arxiv.org/abs/1910.12091

    2019 arXiv

  11. [19]

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. 2018. GAZELLE: A Low Latency Framework for Secure Neural Network Inference. In 27th USENIX Security Symposium (USENIX Security 18). 1651–1669

    2018

  12. [20]

    Marcel Keller, Emmanuela Orsini, and Peter Scholl. 2016. MASCOT: faster mali- cious arithmetic secure computation with oblivious transfer. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 830–842

    2016

  13. [21]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907(2016)

    2016 arXiv

  14. [22]

    Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten. 2021. CrypTen: Secure Multi-Party Com- putation Meets Machine Learning. InAdvances in Neural Information Processing Systems, Vol. 34. 4961–4973

    2021

  15. [23]

    Nishant Kumar, Mayank Rathee, Nishanth Chandran, Divya Gupta, Aseem Ras- togi, and Rahul Sharma. 2020. CrypTFlow: Secure TensorFlow Inference. In2020 IEEE Symposium on Security and Privacy (SP). 336–353. doi:10.1109/SP40000.2020 .00092

    2020

  16. [24]

    Sengamedu

    Linfeng Liu, Hoan Nguyen, George Karypis, and Srinivasan H. Sengamedu. 2021. Universal representation for code. InPAKDD 2021. https://www.amazon.science /publications/universal-representation-for-code

    2021

  17. [25]

    Christian Mouchet, Juan Troncoso-Pastoriza, Jean-Philippe Bossuat, and Jean- Pierre Hubaux. 2021. Multiparty homomorphic encryption from ring-learning- with-errors.Proceedings on Privacy Enhancing Technologies2021, CONF (2021), 291–311

    2021

  18. [26]

    Ran Ran, Wei Wang, Quan Gang, Jieming Yin, Nuo Xu, and Wujie Wen. 2022. CryptoGCN: Fast and Scalable Homomorphically Encrypted Graph Convolutional Network Inference. InAdvances in Neural Information Processing Systems, Vol. 35. Curran Associates, Inc., 37676–37689

    2022

  19. [27]

    Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, and Farinaz Koushanfar

    M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, and Farinaz Koushanfar. 2019. XONN: XNOR-based Oblivious Deep Neural Network Inference. In28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1501–1518

    2019

  20. [28]

    Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M

    M. Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M. Songhori, Thomas Schneider, and Farinaz Koushanfar. 2018. Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications. InProceedings of the 2018 on Asia Conference on Computer and Commun...

    2018

  21. [29]

    Mauro Ribeiro, Katarina Grolinger, and Miriam A.M. Capretz. 2015. MLaaS: Machine Learning as a Service. In2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA). 896–902. doi:10.1109/ICMLA.2015.1 52

    2015 doi

  22. [30]

    Adi Shamir. 1979. How to share a secret.Commun. ACM22, 11 (nov 1979), 612–613. doi:10.1145/359168.359176

    1979

  23. [31]

    Hubert Chan, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas

    Emil Stefanov, Marten Van Dijk, Elaine Shi, T.-H. Hubert Chan, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas. 2018. Path ORAM: An Extremely Simple Oblivious RAM Protocol.J. ACM65, 4, Article 18 (apr 2018), 26 pages. doi:10.1145/3177872

    2018 doi

  24. [32]

    Anh-Tu Tran, The-Dung Luong, Jessada Karnjana, and Van-Nam Huynh. 2021. An efficient approach for privacy preserving decentralized deep learning models based on secure multi-party computation.Neurocomputing422 (2021), 245–262. doi:10.1016/j.neucom.2020.10.014

    2021 doi

  25. [33]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. 2018. Graph Attention Networks. InInternational Confer- ence on Learning Representations. https://openreview.net/forum?id=rJXMpikCZ

    2018

  26. [34]

    Songlei Wang, Yifeng Zheng, and Xiaohua Jia. 2023. SecGNN: Privacy-preserving graph neural network training and inference as a cloud service.IEEE Transactions on Services Computing(2023)

    2023

  27. [35]

    Zhihua Xia, Qi Gu, Wenhao Zhou, Lizhi Xiong, Jian Weng, and Naixue Xiong

  28. [36]

    Lizhi Xiong, Wenhao Zhou, Zhihua Xia, Qi Gu, and Jian Weng. 2020. Efficient privacy-preserving computation based on additive secret sharing.arXiv preprint arXiv:2009.05356(2020)

    2020 arXiv

  29. [37]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2019. How Powerful are Graph Neural Networks?. InInternational Conference on Learning Representa- tions. https://openreview.net/forum?id=ryGs6iA5Km

    2019

  30. [38]

    Zhilin Yang, William Cohen, and Ruslan Salakhudinov. 2016. Revisiting semi- supervised learning with graph embeddings. InInternational conference on ma- chine learning. PMLR, 40–48

    2016

  31. [39]

    Chuan Zhao, Shengnan Zhao, Minghao Zhao, Zhenxiang Chen, Chong-Zhi Gao, Hongwei Li, and Yu an Tan. 2019. Secure Multi-Party Computation: Theory, practice and applications.Information Sciences476 (2019), 357–372. doi:10.1016/ j.ins.2018.10.024

    2019

  32. [40]

    Marinka Zitnik and Jure Leskovec. 2017. Predicting multicellular function through multi-layer tissue networks.Bioinformatics33, 14 (2017), i190–i198. Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Pritam Sen, Yao Ma, and Cristian Borcea Appendix This appendix provides...

    2017

  33. [2021]

    Comput.(2021), 1–1

    STR: Secure computation on additive shares using the share-transform- reveal strategy.IEEE Trans. Comput.(2021), 1–1. doi:10.1109/TC.2021.3073171

    2021

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.