MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models

MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models

Speakers: Qi Pang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=IfcbkvaQT4k

Overview

Secure Multi-Party Computation (MPC) has emerged as a foundational technology for privacy-preserving machine learning, enabling multiple entities to collaboratively execute computations on sensitive data and pre-trained models without compromising private information. Major industry players like Meta, Microsoft, and Alibaba have invested heavily in developing sophisticated MPC frameworks built upon popular deep learning libraries such as TensorFlow and PyTorch. While these frameworks streamline the integration of complex deep neural network (DNN) operators with MPC primitives, a critical gap has remained: a principled and systematic methodology for understanding and ensuring the correctness and quality of these MPC implementations.

Preliminary studies revealed that MPC-hardened deep learning models can produce outputs that deviate significantly from their plaintext counterparts, even when processing identical inputs. This discrepancy is a serious concern, as MPC protocol design is inherently intricate and prone to subtle errors. Modern MPC frameworks often rely on various optimization and approximation schemes—such as fixed-point value representation and Newton-Raphson approximation—to convert standard computations into their MPC-compatible forms. These approximations, while reducing integration complexity, are a primary source of these subtle, yet critical, bugs.

This article delves into MPCDIFF, a pioneering testing and repairing tool specifically engineered to address this crucial challenge. MPCDIFF's core mission is to effectively uncover inputs that trigger deviant outputs in MPC-hardened models compared to their plaintext versions. Beyond detection, MPCDIFF develops sophisticated techniques to pinpoint the exact error-causing computation units within these models and automatically implement repairs. Evaluated against three leading MPC frameworks—CrypTen (Meta), TF-Encrypted (Alibaba Group and Cape Privacy), and PySyft (OpenMined)—and prominent deep learning models like Convolutional Neural Networks (CNNs) and Multilayer Perceptrons (MLPs), MPCDIFF generated 135,000 mutated inputs over 10 days of testing. This rigorous evaluation successfully detected 1,055 inputs leading to significantly deviant outputs, where prediction labels were inconsistent. Crucially, these deviation-triggering inputs are visually meaningful, suggesting potential confusion in real-world use or even overlooked attack vectors. By localizing and repairing these defects, MPCDIFF demonstrated that the robustness of MPC-hardened models can be substantially enhanced without sacrificing accuracy and with a negligible overhead of approximately 0.02%.

Background

▶ Watch: Introduction to MPCDIFF and core problem statement (0:00)

The foundation of MPCDIFF lies in understanding Secure Multi-Party Computation (MPC) and its application to deep learning. At its essence, MPC relies on secret sharing, a cryptographic primitive where a secret value is distributed among several parties, each receiving a "share." The original secret can only be reconstructed by combining a predetermined number of these shares, and individual shares reveal no information about the secret. MPCDIFF's focus is on efficient secret sharing-based MPC protocols, particularly arithmetic and binary additive secret sharing. Arithmetic sharing represents a scalar l-bit value x as shares xp for each party p, such that their sum modulo 2^l reconstructs x. Binary sharing operates within the binary field Z2. A key feature of these shares is their homomorphic property, which allows certain mathematical operations to be performed directly on the encrypted (shared) data.

For secure computation, simple operations like private addition are straightforward, as each party can locally sum their shares. However, private multiplication of two secret shared values, x and y, is more complex and typically employs random Beaver triples. This technique is pivotal for efficiency, as it shifts the majority of communication and computation costs to an offline preprocessing phase, thereby making online computation significantly more efficient. These primitives facilitate the implementation of linear functions common in DNNs, such as dot products, matrix multiplications, and convolutions.

The true challenge within MPC-hardened DNNs arises with non-linear functions, which are ubiquitous in deep learning models (e.g., Sigmoid, Tanh, GELU, Softmax, Batch Normalization). Since these functions cannot be directly computed homomorphically, they must be approximated using a series of private additions and multiplications. Common approximation strategies include Newton-Raphson iterations, Householder iterations, or Chebyshev polynomial approximations. The accuracy of these approximations is governed by a hyper-parameter, referred to as "term." A larger "term" generally leads to more accurate results but incurs significantly higher computation costs, which is particularly undesirable in multi-layer DNNs where these operations are repeated extensively.

Regarding security guarantees, current MPC-DL frameworks primarily assume semi-honest parties. This means parties adhere to the protocol specifications but may attempt to glean plaintext information from the shares they possess. These frameworks typically provide security against a passive static adversary capable of corrupting up to P-1 of the P participating parties. In the private-preserving model inference scenario, the typical setup involves two parties: Alice, the model provider with a pre-trained plaintext model, and Bob, the data provider with private data. The workflow entails Alice training her model, designing an MPC computation paradigm, and then sending secret shares of model parameters to data providers. Data providers, in turn, send secret shares of their test inputs. The joint computation is then performed via MPC, and the inference results are securely reconstructed. This setup is vital for privacy-sensitive sectors such as credit scoring, insurance, and healthcare, fostering the adoption of deep learning in regulated environments. MPCDIFF specifically operates at the stage where Alice designs the MPC computation paradigm, focusing on the inference stage due to the computational expense of MPC-hardened model training.

A preliminary vulnerability exploration underscored the problem MPCDIFF addresses: while MPC protects privacy, it does not inherently enhance robustness against adversarial examples (AEs). The study observed distinct decision boundaries between plaintext DNN models and their MPC-hardened versions. For instance, a LeNet model on the MNIST dataset exhibited 98.65% accuracy in its plaintext form but only 97.25% in its MPC-hardened version, coupled with less confident predictions. This boundary shift creates a subtle vulnerability that malicious data providers could exploit to generate AEs. The research successfully generated 100 AEs, with 57% specifically exploiting the MPC-hardened model without misclassifying the plaintext version, highlighting overlooked attack vectors. MPCDIFF's design goal is precisely to expose these hidden defects, identify error-triggering inputs that are visually meaningful, localize their root causes, and provide repair mechanisms to enhance robustness without compromising privacy.

The inaccuracies in MPC-hardened models, which MPCDIFF targets, stem from two primary root causes:

• RC1: Fixed-Point Value Representation and Multiplication Truncation. MPC frameworks typically operate on integers. To represent a floating-point number x ∈ ℝ, it is encoded as a fixed-point integer x' = floor(x 2^m*) ∈ ℤ, where m is the precision bit number. During decoding, x' is divided by 2^m to recover the approximate floating-point value. This encoding/decoding process inherently introduces error (x' / 2^m - x). The choice of m is critical: an excessively large m can lead to overflow, compromising accuracy, while a too small m undermines precision by truncating fractional parts. For example, with m=12, inputs x in the range [0, 1/2^12) exhibit 100% relative error due to complete truncation. This issue is compounded by multiplication truncation: when two fixed-point values are multiplied, the result's bit length doubles, necessitating truncation back to m-bit precision, which inevitably adds further inaccuracies. While increasing m reduces truncation error, it simultaneously increases the likelihood of overflow. MPC frameworks often use a fixed total bit length l (e.g., l=64 in CrypTen and TF-Encrypted), meaning tuning m within this fixed l does not incur extra communication or computation costs.
• RC2: Non-linear Function Approximation. As previously discussed, non-linear functions (Sigmoid, Tanh, GELU) are approximated. These approximations are inherently imperfect and introduce errors. The accuracy of these approximations is determined by a hyper-parameter, "term," which configures the approximation method. A larger "term" typically yields more accurate results but comes with a significant computational overhead, making it less desirable for multi-layer DNNs. For instance, CrypTen's default Sigmoid approximation (reciprocal of 1 + e^-x) exhibits errors greater than 1e-3 for inputs in the range [-5, 5]. In multi-layer DNNs, these initial errors can propagate and compound, ultimately leading to incorrect predictions.

The propagation of these errors is formally bounded by Theorem 1. If an error e_i is induced in layer L_i, and L_i+1 is a linear layer (e.g., fully connected or convolutional) with weights W_i+1, the error e_i+1 in L_i+1 is bounded by σe_i ||W_i+1|| ||e_i||, where σ is the minimum singular value of W_i+1. For a non-linear activation layer L_i+1 with Lipschitz constant L_c, the error is bounded by L_c ||e_i||. This implies that errors stemming from RC1 or RC2 will not simply vanish, particularly in the presence of non-trivial matrix multiplications. Errors propagate through model layers, potentially accumulating and causing mis-predictions. While negligible initial errors might have limited impact, larger errors, especially with reduced precision (smaller m) or fewer "terms" in resource-constrained environments (e.g., mobile devices), can significantly impact accuracy. These defects are often subtle and may not manifest during typical usage. However, in reliability-sensitive applications like credit prediction, even a single mis-prediction is unacceptable. MPCDIFF is designed to uncover these subtle errors by intelligently mutating model inputs to maximize output deviations.

Key Findings

▶ Watch: Background on MPC: secret sharing and secure computation (2:00)

MPCDIFF's comprehensive evaluation yielded several significant findings across its three stages: differential testing, localization, and repair.

Discovery of Deviation-Triggering Inputs:

MPCDIFF successfully detected a substantial number of deviation-triggering inputs across various models and MPC frameworks. Over 10 days of testing, generating 135,000 mutated inputs, MPCDIFF identified 1,055 inputs that caused inconsistent prediction labels between the MPC-hardened models and their plaintext versions.

• For instance, CrypTen's LeNet model on MNIST yielded 32 such inputs, TF-Encrypted's LeNet found 41, and PySyft's LeNet detected 18.
• For simpler MLP models on tabular datasets (Credit and Bank), while the absolute numbers were lower, MPCDIFF still found 2 to 17 times more deviation-triggering inputs than the initial seed set. For example, CrypTen's MLP-Sigmoid found 2 inputs, and TF-Encrypted's MLP-Sigmoid found 12.
• The quality of these inputs was high: they were visually meaningful and perceptually indistinguishable from normal inputs, with an average L2 distance of only around 0.002 per pixel for MNIST. Crucially, the plaintext models consistently produced correct predictions for these inputs, highlighting that the deviations were specific to the MPC hardening, not general model misclassifications. This indicates that these inputs represent practical, yet overlooked, attack vectors that could cause significant confusion or malicious manipulation.

Effectiveness of Error-Causing Neuron Localization:

MPCDIFF's defect localization mechanism proved effective in identifying neurons primarily contributing to output deviations.

• By comparing MPCDIFF-marked neurons with those identified by eXplainable AI (XAI) techniques (specifically, a second-order derivative method), a significant overlap was observed. The overlap ratio ranged from 30.12% (CrypTen, MLP-GELU) to 69.93% (CrypTen, LeNet).
• The overlap was generally higher for more complex models like LeNet, possibly due to the presence of batch normalization layers that aid activation functions and mitigate vanishing gradients. This substantial agreement, despite XAI and MPCDIFF having distinct objectives, validates MPCDIFF's ability to accurately pinpoint critical neurons contributing to MPC-specific deviations.

Success of Repair Mechanisms:

MPCDIFF's repair strategies demonstrated significant improvements in model robustness with minimal impact on accuracy or overhead.

• Initial Repairing (m=12, α=40): An initial repair scheme, keeping the precision bit number m=12 and tuning the terms of the 40 most influential non-linear neurons (α=40), showed promising results:
• Accuracy on Test Data: Models retained high accuracy, with only minimal changes (e.g., CrypTen LeNet's accuracy slightly decreased from 97.25% to 97.10%; TF-Encrypted MLP-Sigmoid increased from 80.10% to 80.20%). This confirms that the repair process does not compromise performance on normal inputs.
• Robustness on Deviation-Triggering Inputs: Robustness dramatically improved. For CrypTen LeNet, the percentage of mitigated deviation-triggering inputs surged from 0% to 49.45%. For PySyft MLP-GELU, it jumped from 0% to 96.77%.
• Overhead: The average extra computational cost incurred was negligible, approximately 0.003%.

• **Fixing RC1 by Tuning Precision Bit Number m:**
• Varying m revealed an optimal range for robustness and accuracy. For CrypTen and PySyft, accuracy on deviation-triggering inputs was highest when m was between 15 and 17. TF-Encrypted's accuracy stabilized in the range m ∈ [14, 17], likely due to its base-3 encoding.
• Crucially, accuracy on test datasets decreased significantly when m ≥ 18 due to overflow, confirming the importance of a properly chosen m (around 15-17). Tuning m does not affect communication or computation cost when the underlying arithmetic secret sharing uses a fixed total bit length l.

• **Fixing RC2 by Tuning Approximation Terms α:**
• Evaluating robustness by tuning α (the number of repaired neurons) while setting m=16 showed that increasing α linearly improved the robustness of all models.
• The cost increased linearly with α, but remained manageable. For example, increasing α from 0 to 150 for CrypTen LeNet resulted in only a 0.01% relative cost increase, while significantly boosting robustness. Test dataset accuracy remained stable within 1%.

• Enhanced Robustness Against Adversarial Examples (AEs):
• Re-launching black-box AE generation on a repaired CrypTen LeNet (α=250, m=16) demonstrated significantly enhanced robustness. Only 19 AEs were generated (compared to 100 before repair), and only 3 of these were not misclassified by the plaintext model (compared to 57 before).
• Visual analysis confirmed that the decision boundaries of the repaired model were much closer to the original plaintext model than those of the pre-repair MPC-hardened model.
• Finally, re-testing the repaired models with MPCDIFF itself showed a significant reduction in the number of newly found deviation-triggering inputs. For CrypTen MLP-GELU, increasing α to 250 reduced deviation-triggering inputs by 64.7%.

In summary, MPCDIFF effectively detects subtle, yet critical, deviations in MPC-hardened models, accurately localizes their root causes, and provides robust repair mechanisms that significantly improve model reliability without compromising performance.

Technical Deep Dive

▶ Watch: Challenge: Approximating non-linear functions in DNNs (2:45)

MPCDIFF is structured as a sophisticated three-stage pipeline: 1) Differential Testing to uncover error-triggering inputs, 2) Root Cause Localization to identify problematic computation units, and 3) Repair to fix the identified defects. This architecture is designed for in-house quality benchmarking by model owners and developers, allowing them to assess and augment the robustness of their MPC-protected models prior to deployment. It focuses specifically on robustness, aiming to align the decision boundaries of MPC-hardened models with their plaintext counterparts, rather than solely improving accuracy. It is not intended for use against active adversaries or for detecting backdoors.

A key distinction of MPCDIFF's findings from conventional Adversarial Examples (AEs) is crucial. While both manipulate predictions, MPCDIFF's error-triggering inputs cause deviant outputs between the MPC-hardened model and its plaintext version, where the plaintext model retains correct predictions. Conventional AEs, in contrast, aim to change the plaintext model's predictions. The root causes (RC1 and RC2) targeted by MPCDIFF are specific to MPC implementations, unlike AE causes which often relate to inadequate model training or inherent model vulnerabilities. MPCDIFF employs a black-box testing approach, relying solely on model outputs to guide input mutation. This sidesteps the computationally intensive process of obtaining gradients in MPC-protected models and facilitates testing remote APIs. It functions as a testing tool, akin to fuzzers providing defect-triggering inputs for debugging, rather than a formal verifier proving the absence of errors.

Differential Testing

The Differential Testing stage, outlined in Algorithm 1, is the core engine for finding deviation-triggering inputs.

The central function, OutputDeviation(Mp, Mm, i', T), calculates the L2 distance δ between the prediction vectors of the plaintext model (Mp) and the MPC-hardened model (Mm) for a given input i'. It returns true if this δ exceeds a pre-defined threshold T, indicating a significant deviation.

The main testing loop, DT(S, Mp, Mm), takes a collection of seed inputs S (typically 1,000 to 2,000 randomly selected inputs from the model's test dataset). It maintains a queue Q for test seeds and a set O to store all identified deviation-triggering inputs. The testing campaign runs for a maximum of 15,000 mutation iterations. In each iteration:

1. An input i is popped from Q.
2. A baseline output deviation T is computed for i.
3. ASSIGNENERGY(i) assigns a fixed "energy" (e.g., 10) to each seed, determining the number of mutations to generate from it.
4. A new variant i' is generated by MUTATE(i). To ensure i' is visually meaningful and representative of real-world inputs, MUTATE adds random noise within the variance of the standard input dataset and applies projection (e.g., image pixels projected to the [0,1] range).
5. Two conditions determine if i' is added to O or Q:

• If Mp(i') != Mm(i') (meaning the prediction label changes between the plaintext and MPC-hardened models), i' is added to O.
• Otherwise, if OutputDeviation(Mp, Mm, i', T) is true (meaning the L2 distance δ between predictions increases beyond the threshold T), i' is added to Q for further mutations and also to O.

The process continues until the iteration limit is reached, returning the set O of all deviation-triggering inputs.

Defect Localization

The second stage, Defect Localization, primarily aims to identify neurons contributing most significantly to output deviations, specifically for repairing RC2 (non-linear function approximation errors).

1. An importance weight w_i is assigned to each neuron n_i in the model, initialized to zero.
2. For each deviation-triggering input o discovered during differential testing, MPCDIFF quantifies the output difference δ_i(o) of neuron n_i between Mp and Mm.
3. If δ_i(o) is greater than an adaptively configured threshold T+, w_i is incremented. If δ_i(o) is smaller than another threshold T-, w_i is decremented. T+ and T- are configured to statistically scope approximately one-third of neurons with high or low influence.
4. This statistical process identifies neurons with large importance weights as "important," providing a ranked list of neurons that are the primary contributors to the observed deviations.

Error Fixing (Repairing)

With the error-causing neurons localized and the root causes identified, MPCDIFF proceeds to the Repair stage, offering two main approaches tailored to each root cause.

• **Fixing RC1: Tuning the Precision Bit Number m.** The precision bit number m in fixed-point representation critically impacts encoding, decoding, and multiplication accuracy, and can lead to overflow. While determining an globally optimal m is complex and model-dependent, MPCDIFF allows users to tune m from a robustness perspective. The objective is to find an m that minimizes the number of error-triggering inputs O found by MPCDIFF, rather than solely focusing on general accuracy. This tuning does not incur extra communication or computation cost when the underlying arithmetic secret sharing uses a fixed total bit length l.

• Fixing RC2: Tuning Approximation Terms for Non-linear Functions. Non-linear functions are approximated using various "terms," and increasing these terms generally improves approximation accuracy but incurs higher computation costs. MPCDIFF leverages the localized importance weights of neurons to selectively tune these terms. It adopts a meta-strategy (detailed in Appendix C of the original paper) to raise the terms for a user-defined number of the most important neurons, denoted by α. The value of α is determined by the user's available computation cost budget (e.g., in evaluations, α ranged from 0 to 250). This selective tuning strategy aims to alleviate mis-predictions with minimal extra overhead, as it focuses computational resources only on the most problematic parts of the network. The meta-strategy provides a unified interface, abstracting away the subtle tactics for tweaking terms in various approximation methods.

The outcome of this repair phase is a new MPC-hardened model, M_m', which exhibits significantly improved robustness, maintains stable accuracy on normal inputs, and incurs only moderate overhead compared to the original M_m. This enhanced model is then ready for release.

Demo / Proof of Concept

▶ Watch: Preliminary vulnerability findings: distinct decision boundaries (4:00)

While the talk did not feature a live, interactive demonstration of MPCDIFF, the extensive implementation details and evaluation results serve as a comprehensive proof of concept for its capabilities and effectiveness.

MPCDIFF is primarily implemented in Python, comprising approximately 3,000 lines of code. All experiments were conducted on a robust machine equipped with an AMD Ryzen CPU, 256GB RAM, and an Nvidia GeForce RTX 3090 GPU, ensuring sufficient computational power for the demanding testing process.

The tool was integrated and evaluated against three prominent and cutting-edge MPC-hardened deep learning frameworks:

1. CrypTen 4, 57: Developed and maintained by Meta (Facebook), CrypTen is built on PyTorch, offering privacy-preserving deep learning with highly optimized tensor computations and high-speed communication libraries. It primarily utilizes arithmetic and binary secret sharing and supports two-party secure computation, leveraging a trusted third party for Beaver triple generation.
2. TF-Encrypted 3, 6: Tightly integrated with TensorFlow, this framework is a collaborative effort by Cape Privacy, Alibaba Group, and OpenMined. It supports common MPC protocols such as ABY3, SecureNN, and SPDZ. For the evaluation, its modified SPDZ protocol, known as Pond, was used for three-party private inference, where two parties perform computations and one delivers Beaver triples.
3. PySyft 1: Maintained by OpenMined, PySyft is a comprehensive privacy-preserving machine learning framework encompassing federated learning, differential privacy, MPC, and homomorphic encryption. The SecureNN protocol was used for three-party computation, where three parties securely share data and model parameters for inference.

Regarding inference speed, while MPC frameworks inherently introduce overhead, the localhost setup minimized communication latency during testing. The average inference time per input in the experiments ranged from 0.04s to 2.12s, which is acceptable for MPCDIFF's intended purpose of in-house quality benchmarking. This demonstrates the practical usability of the tool for developers.

To demonstrate generality, MPCDIFF was evaluated using a mix of image and tabular datasets:

• MNIST 61: A widely recognized image dataset for classifying handwritten digits, commonly used for benchmarking deep learning models.
• Credit 98: A tabular dataset featuring 23 features, utilized for credit score prediction.
• Bank 74: Another tabular dataset with 20 features, used for predicting term deposit subscriptions.

The authors emphasized that MPCDIFF's technical pipeline is orthogonal to specific data types, making it broadly applicable.

The models used in the evaluation included:

• LeNet 60: A classic five-layer Convolutional Neural Network (CNN) comprising two convolutional and three fully-connected layers, employing Sigmoid activation, batch normalization, and average pooling.
• MLP-Sigmoid: A two-layer Multilayer Perceptron (MLP) specifically for the Credit dataset, utilizing Sigmoid activations.
• MLP-GELU: A two-layer MLP for the Bank dataset, employing GELU activations.

All models were well-trained, and their plaintext and encrypted accuracies were reported as high, confirming that detected deviations were due to MPC-specific issues rather than poorly performing base models. The precision bit number m was initially set to 12 for all models.

Defensive Implications

▶ Watch: Root causes of inaccuracies: fixed-point values, approximations (5:00)

MPCDIFF provides critical insights and actionable strategies for defenders and developers working with privacy-preserving machine learning. Its findings highlight several key defensive implications:

• Proactive Quality Assurance: Model owners should integrate tools like MPCDIFF into their pre-deployment quality assurance pipelines. It is no longer sufficient to merely verify the accuracy of plaintext models; MPC-hardened versions require dedicated testing to uncover subtle deviations introduced by the secure computation protocols. This proactive benchmarking is essential before releasing models for sensitive applications.
• Robustness Benchmarking beyond Accuracy: Defenders must expand their evaluation criteria beyond traditional accuracy metrics to include robustness against MPC-specific deviations. MPCDIFF demonstrates that even high-accuracy MPC-hardened models can possess shifted decision boundaries, making them vulnerable to inputs that cause mispredictions only in the secure context.
• Systematic Parameter Tuning: The study underscores the critical importance of carefully selecting parameters like the **precision bit number m (for fixed-point representation) and the approximation terms *α*** (for non-linear functions). MPCDIFF offers a systematic, data-driven approach to identify optimal m and α values that maximize robustness without incurring prohibitive computational costs or sacrificing accuracy on normal inputs. This moves parameter selection from heuristic guesswork to an evidence-based process.
• Awareness of MPC-Specific Vulnerabilities: Defenders need to recognize that MPC hardening introduces unique attack surfaces (RC1: fixed-point errors, RC2: non-linear approximation errors) that are distinct from those exploited by conventional adversarial examples. These vulnerabilities demand specialized detection and mitigation strategies, which MPCDIFF provides.
• Implementation of Targeted Mitigation Strategies: The repair mechanisms demonstrated by MPCDIFF (tuning m and selectively increasing approximation terms for critical neurons) offer concrete strategies to mitigate these MPC-specific defects. By applying these repairs, organizations can significantly reduce the attack surface and ensure that the MPC-hardened model's decision boundaries closely align with the trusted plaintext model.
• Continuous Testing and Monitoring: Given the evolving nature of MPC frameworks and potential updates to models, periodic re-testing with MPCDIFF or similar differential testing approaches is advisable. This helps detect regressions, newly introduced vulnerabilities, or shifts in optimal parameters as underlying libraries or model architectures change.
• Importance of Plaintext Baseline: The core of MPCDIFF's effectiveness lies in its differential comparison against a plaintext baseline. Defenders should always maintain and utilize the plaintext version of their models as the ground truth for evaluating the correctness and robustness of their MPC-hardened counterparts.

By adopting these defensive implications, organizations can significantly enhance the reliability and trustworthiness of their privacy-preserving machine learning deployments, ensuring that the benefits of MPC are realized without introducing new, subtle vulnerabilities.

Key Takeaways

• MPC-hardened deep learning models can exhibit significant and subtle deviations from their plaintext versions due to inherent approximations like fixed-point arithmetic (RC1) and non-linear function approximations (RC2).
• MPCDIFF is the first feedback-driven differential testing framework capable of systematically detecting, localizing, and repairing these MPC-specific defects, addressing a critical gap in privacy-preserving machine learning.
• The tool identifies "deviation-triggering inputs" that are visually meaningful and cause inconsistent predictions only in the MPC-hardened model, representing practical yet overlooked attack vectors.
• MPCDIFF's repair mechanisms, involving tuning the precision bit number m and selectively increasing approximation terms α for critical neurons, significantly enhance model robustness against these deviations and even adversarial examples, with negligible overhead (approx. 0.02%).
• MPC-specific vulnerabilities are distinct from traditional adversarial examples and require specialized testing and mitigation approaches, highlighting the need for tools like MPCDIFF in a secure development lifecycle.
• Developers and model owners should integrate MPCDIFF into their quality assurance pipelines for privacy-preserving deep learning models to ensure the reliability and trustworthiness of secure inference before deployment in sensitive applications.

About the Speaker(s)

Qi Pang is a key researcher and presenter of the work on MPCDIFF: Testing and Repairing MPC-Hardened Deep Learning Models. The talk highlights their significant contribution to addressing the critical gap in understanding the correctness and quality of MPC frameworks for deep learning. Their work introduces a novel framework for detecting, localizing, and repairing defects in these complex systems.