Verifiable Private Inference: Securing Neural Networks with Homomorphic Encryption and VC

TL;DR

This research bridges a critical gap in outsourced AI: Integrity. While Homomorphic Encryption (HE) hides data, it doesn't stop a server from lying about the result. By combining the BFV cryptosystem with a Verifiable Computing (VC) protocol, the authors enable a system where the server processes encrypted data and provides a "proof of correctness" that can be verified in milliseconds.

The Trust Gap in Cloud AI

The standard "Privacy-Preserving Machine Learning" (PPML) story usually focuses on confidentiality—ensuring the cloud provider doesn't see your medical records or private photos. However, in real-world deployment, we face a Malicious Server threat. A server might:

1. Skip complex computations to save energy (Silent failure).
2. Deliberately return a wrong classification (Active attack).

Prior works like CryptoNets focus solely on the "honest-but-curious" model. This paper shifts the paradigm toward Verifiable Machine Learning as a Service (VMLaaS).

Methodology: The Partitioned Architecture

Since full verifiable computation for deep, non-linear networks is computationally prohibitive (due to the "degree-2" limit of practical VC schemes), the authors propose an elegant partitioned model:

1. The Encrypted Whitener (Layer 1)

The client encrypts input $x$ and generates a cryptographic tag. The server evaluates the first layer, which is restricted to a quadratic function. This layer acts as a "whitener" through adversarial training, ensuring that even if the operator decrypts the output of this layer, they cannot reconstruct the sensitive raw input.

2. Verifiable Computing (VC) Integration

The server uses a specialized VC protocol (adapted from Fiore et al.) to generate a tag for the result. This leverages:

• Homomorphic Hash Functions: To compress large BFV ciphertexts into verifiable group elements.
• Pseudo-Random Functions (PRF): For efficient, amortized proof generation.

3. Clear-Domain Completion

The operator (who holds the keys) verifies the server's proof. If the proof is valid, they decrypt the intermediate result and run the remaining (more complex) layers of the neural network in the clear.

Experimental Performance

The framework was tested on the MNIST dataset using the Microsoft SEAL library and HAL (Homomorphic Authentication Library).

The 97.54% accuracy achievement confirms that the quadratic approximation of the first layer does not significantly degrade performance for image recognition tasks.

Deep Insight: Why Quadratic?

The primary bottleneck in modern VC is the algebraic complexity. Proving $y=f(x)$ where $f$ is a high-degree polynomial results in exponential proof growth. By limiting the "Private & Verifiable" segment to a degree-2 function, the authors achieve a "sweet spot": it is mathematically expressive enough to serve as a feature extractor, yet simple enough to keep verification times in the millisecond range.

Critical Analysis & Future Outlook

While this is a significant step, the reliance on a non-collusion assumption between the Server and the Operator is a notable limitation. If the server (computing) and operator (decrypting) conspire, user privacy is lost.

Future Directions:

• Beyond Degree 2: Moving toward GKR protocols or zk-SNARKs that can handle ReLU and MaxPool layers verifiably.
• Batching: Utilizing BFV SIMD slots to process 4096 images simultaneously, which would drastically improve throughput.

Conclusion

This paper provides a robust blueprint for secure AI by proving that Confidentiality + Integrity is possible without sacrificing total accuracy. For industries like healthcare (Medical Use-Case) or corporate security (Mail Filters), this "Proof of Correctness" is the missing link for cloud-based AI adoption.