💻 computer science

PrivDNN: A Secure Multi-Party Computation Framework for Deep Learning using Partial DNN Encryption

PrivDNN is a secure multi-party computation framework that enhances the efficiency of privacy-preserving deep learning inference by offloading computation to the user side through partial model encryption and core neuron selection, achieving up to 97% reduction in time and memory requirements while maintaining model accuracy and privacy.

Original authors: Liangqin Ren, Zeyan Liu, Fengjun Li, Kaitai Liang, Zhu Li, Bo Luo

Published 2026-07-27

📖 8 min read🧠 Deep dive

CC BY 4.0

Original authors: Liangqin Ren, Zeyan Liu, Fengjun Li, Kaitai Liang, Zhu Li, Bo Luo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where the smartest computers in the room are like giant, magical libraries. These libraries hold the secrets to recognizing faces, diagnosing diseases, or spotting a stop sign for a self-driving car. But here's the catch: the librarians (the companies that built these libraries) are terrified of someone stealing their books, while the people visiting (the users) are terrified of the librarians reading their private journals. This is the heart of a problem in the field of Secure Multi-Party Computation. It's a branch of cryptography that asks: "How can two strangers work together on a secret task without either of them having to reveal their private information?"

To solve this, scientists use a special tool called Homomorphic Encryption. Think of this like a magical glove box. You can put a piece of paper inside, and while it's locked in the box, you can still fold it, tear it, or write on it. The paper changes, but it never leaves the box, so no one can see the original words. In the past, researchers tried to put the entire library inside this glove box so the user could do the work. But the box was so heavy and slow that it took forever to finish even a simple task. It was like trying to run a marathon while wearing a suit made of lead bricks.

This is where a new paper called PrivDNN comes in. The researchers realized they didn't need to lock up the whole library to keep it safe. They discovered that deep learning models (the "brains" behind the AI) are like a team of workers where only a few are the "bosses." If you lock up just the bosses, the whole team stops working properly. The paper proposes a clever trick: instead of encrypting the entire model, they only encrypt a tiny, critical subset of the "boss" neurons. They call this Partial DNN Encryption. The result is a system where the heavy lifting is mostly done in the open (fast and easy), but the most valuable secrets are locked in the magical glove box. The authors show that this approach can make the process nearly 30 times faster than previous methods while keeping the model's secrets safe and the user's data private.

The Problem: The "Too Big to Share" Dilemma

Deep learning models are incredibly powerful, but they are also expensive and valuable. Big companies spend millions of dollars and years of time training these models on massive amounts of data. They don't want to give the model away because it's their secret sauce. On the other hand, small hospitals or local schools want to use these models to analyze sensitive data, like patient records or student grades, but they can't afford to build their own models. They also can't send their private data to the big company because of privacy laws and trust issues.

Traditionally, there were two bad options:

Send the data: The user sends their private data to the company. The company runs the model and sends back the answer. This is fast, but the user loses their privacy.
Send the model: The company sends the model to the user. The user runs it on their own data. This protects the user's data, but the company loses their model's privacy.

A third option existed using Fully Homomorphic Encryption (FHE). This is the "magic glove box" method where the user encrypts their data, sends it to the company, and the company does the math on the encrypted data without ever seeing the real numbers. The problem? It was agonizingly slow. For example, a previous system called CryptoNets took 250 seconds to process a small batch of simple images. That's like waiting four minutes just to identify a cat in a photo.

The PrivDNN Solution: The "Partial Lock"

The authors of PrivDNN asked a simple question: "Do we really need to lock up every single part of the model?"

They found that deep neural networks are made of layers of "neurons" (think of them as tiny decision-makers). Not all neurons are equally important. Some are like the main engine of a car, while others are just the cup holders. If you remove the cup holders, the car still drives. If you remove the engine, it doesn't.

PrivDNN introduces a strategy to identify and protect only the "engine" neurons. Here is how it works:

The Setup: The model owner (the company) trains a model and then uses a special algorithm to pick out a small group of "core neurons" that are absolutely essential for the model to work well.
The Lock: They encrypt only these core neurons using the heavy, slow Homomorphic Encryption. The rest of the model (the "cup holders" and most of the other neurons) is left in plain text.
The Handoff: The company sends this "partially encrypted" model to the user. The user's computer can easily run the plain-text parts. When the data hits the encrypted "core" neurons, the user's computer has to do the slow, magical math.
The Handshake: The encrypted result from the core neurons is sent back to the company to be unlocked (decrypted), and then the final answer is sent back to the user.

Why This Changes Everything

The paper presents three main findings that make this approach a game-changer:

1. Speed and Efficiency
By only encrypting a small fraction of the model, the system becomes incredibly fast. In their experiments, the authors tested this on five different popular datasets (like MNIST for handwriting and CIFAR-10 for images). They found that PrivDNN reduced the time needed for inference (the act of making a prediction) by up to 97% compared to encrypting the whole model. In one specific test with a LeNet-5 model, the full encryption method took 5,647 seconds to process a batch of images, while PrivDNN did it in just 190 seconds. That is a 29.7 times speedup.

2. Security Without Sacrifice
The authors were worried that leaving most of the model in plain text might make it easy for a hacker to steal the model. They tested this by trying to "recover" the model. They found that if a user tried to use the model without the encrypted core neurons, the accuracy dropped dramatically. For example, on a model trained to recognize traffic signs, the accuracy for an unauthorized user dropped from over 90% down to less than 40% (and even lower with more neurons encrypted). The model became practically useless to anyone who didn't have the key to unlock the core.

3. Memory Savings
Homomorphic encryption is also very hungry for memory. Encrypting a whole large model can require hundreds of gigabytes of RAM, which crashes most standard computers. PrivDNN reduced this memory usage significantly. For a standard model, the memory needed dropped from 151 GB (which is impossible for most PCs) to just 2.5 GB or 5 GB, making it possible to run secure AI on regular desktop computers.

How They Picked the "Boss" Neurons

The paper also details how they decided which neurons to lock up. They tested four different methods:

Random Selection: Just picking neurons at random. (This didn't work well).
Greedy Selection: A step-by-step method that picks the best neuron one by one. This worked very well but took a long time to calculate.
Pruning-based Selection: Using existing techniques that usually remove useless neurons, but in reverse, to find the important ones. This was very fast.
Pruning + Greedy: A hybrid approach that used pruning to narrow down the list and then greedy selection to pick the final winners.

They found that the Pruning + Greedy approach offered the best balance. It was fast enough to be practical but smart enough to pick the right neurons to keep the model secure and accurate.

The Bottom Line

The PrivDNN framework suggests that we don't need to choose between privacy and speed. By being smart about what we encrypt, we can have both. The authors emphasize that this method doesn't rely on any specific type of encryption or model architecture; it's a general idea that can be applied to many different deep learning systems.

While the paper acknowledges that a truly malicious attacker might try to break the encryption or steal the model in other ways, the current results show that for "honest-but-curious" users (who follow the rules but want to peek), this partial encryption is a robust shield. It turns a process that was once too slow and heavy to be practical into something that is fast, efficient, and secure enough for real-world use. The code for this new system is even available for anyone to try, proving that the authors are confident in their results.

Technical Summary: PrivDNN

Problem Statement

The paper addresses the privacy dilemma in Deep Learning as a Service (DLaaS) scenarios involving sensitive data (e.g., medical, financial, or security data) and proprietary models. In a standard client-server setting, protecting both the client's private data and the server's proprietary Deep Neural Network (DNN) model is challenging.

Data Privacy: Clients cannot send raw data to the server without risking exposure.
Model Privacy: Model owners cannot send the full model to clients for local inference without risking theft or replication.

Existing solutions relying on Fully Homomorphic Encryption (FHE) for secure multi-party computation (SMC) face a critical bottleneck: the computational overhead of performing DNN inference entirely in the ciphertext domain is prohibitively high. For instance, prior works like CryptoNets require hundreds of seconds to evaluate small models, making them impractical for large-scale or real-time applications. Furthermore, encrypting the entire model for local execution by the client imposes an excessive computational burden on the client side, negating the benefits of outsourcing.

Methodology: The PrivDNN Framework

The authors propose PrivDNN, a novel framework that utilizes Partial DNN Encryption to balance security, accuracy, and efficiency. The core insight is that not all neurons in a DNN are equally critical to its performance. By encrypting only a strategically selected subset of "core" neurons, the framework ensures that the model is unusable without them, while allowing the majority of the inference to proceed in the plaintext domain.

System Model

The framework operates in a two-party setting (Model Owner $S$ and Data Owner $C$ ) under an honest-but-curious threat model.

Initialization Phase:
- $S$ trains an FHE-friendly DNN (using polynomial approximations for activation functions where necessary).
- $S$ identifies a subset of "core" neurons (filters) essential for high model performance.
- $S$ encrypts only these core neurons using an FHE scheme (specifically CKKS).
- $S$ sends the partially encrypted model (containing both plaintext and ciphertext layers) to $C$ .
Evaluation Phase:
- $C$ processes input data through the plaintext layers using standard operations.
- When data reaches the encrypted core layers, $C$ encrypts the intermediate inputs and performs FHE operations.
- The output of the encrypted layers is obfuscated (multiplied by a random value) and sent to $S$ for decryption.
- $S$ decrypts, removes the obfuscation, and returns the result to $C$ .
- $C$ continues inference through the remaining plaintext layers to produce the final label.

Core Neuron Selection Algorithms

To determine which neurons to encrypt, the paper proposes and compares four selection strategies:

Random Selection: A baseline where neurons are chosen randomly.
Greedy Selection: An iterative algorithm that selects neurons layer-by-layer to maximize a "quality score" ( $s$ ). This score balances maintaining high accuracy for authorized users ( $A_s$ ) while minimizing accuracy for unauthorized users ( $A_r$ ).
Pruning-based Selection: Adapts existing DNN pruning algorithms (PFEC, FPGM, HRank, GFS) to identify the most important filters. The "pruned" (least important) filters are left in plaintext, while the "retained" (most important) filters are encrypted.
Pruning+Greedy: A hybrid approach that first uses pruning to reduce the search space and then applies the greedy algorithm to select the optimal core set from the reduced pool. This aims to balance selection efficiency with selection quality.

Security Mechanisms

Model Protection: Without the decrypted core neurons, an unauthorized user cannot reconstruct the model's functionality. The paper demonstrates that even with model recovery attacks (retraining the missing weights with limited data), the recovered model's accuracy remains significantly lower than the original.
Data Protection: The server never sees the raw input data. Intermediate outputs sent for decryption are obfuscated to prevent the server from inferring input features.
Defense against Malicious Parties: To defend against a malicious client attempting to steal the full model by sending encrypted weights back to the server, the authors introduce a server-side obfuscation layer. This polymorphic layer (retrained periodically) prevents the client from reverse-engineering the decrypted weights.

Key Contributions

Novel Framework: The paper articulates the necessity of model encryption approaches and presents PrivDNN, the first practical system to protect DNN models via partial encryption, enabling efficient privacy-preserving evaluation.
Core Neuron Selection: The authors design and compare three distinct schemes (Greedy, Pruning-based, and Pruning+Greedy) for identifying the minimal subset of neurons required to secure the model.
Efficiency and Security Trade-off: The framework demonstrates that encrypting a small fraction of neurons (e.g., 15-25% of the first two convolutional layers) is sufficient to render the model useless to unauthorized users while maintaining near-original accuracy for authorized users.

Experimental Results

The framework was evaluated on five benchmark datasets (MNIST, EMNIST, GTSRB, CIFAR10, Tiny-ImageNet) using various DNN architectures (LeNet-5, AlexNet, VGG16, ResNet18).

Performance: PrivDNN reduces privacy-preserving DNN inference time by up to 29.7x compared to full-network encryption. Specifically, it reduces the cipher computation by 85% to 98%.
Memory: By avoiding full-network encryption, PrivDNN drastically reduces memory requirements (e.g., from 151 GB to ~2.5 GB for LeNet-5 on MNIST), making FHE-based inference feasible on commodity desktop computers.
Accuracy:
- Authorized Accuracy ( $A_s$ ): Remains very close to the original model accuracy ( $A_o$ ), with drops typically less than 1%.
- Unauthorized Accuracy ( $A_r$ ): Drops significantly (e.g., from ~90% to ~20-40% depending on the dataset and encryption ratio), rendering the model practically unusable for attackers.
- Recovery Resistance: Even with model recovery attacks using up to 1,000 labeled samples, the recovered models fail to reach the original accuracy, especially when a higher proportion of neurons are encrypted.

Significance and Claims

The paper claims that PrivDNN offers a practical solution to the long-standing efficiency bottleneck in homomorphic encryption for deep learning. By shifting the paradigm from "encrypt everything" to "encrypt only what is necessary," the authors argue that secure multi-party computation for deep learning can be deployed in real-world scenarios involving resource-constrained clients and valuable proprietary models.

The authors emphasize that their approach is architecture-agnostic and does not rely on specific FHE algorithms or DNN structures, making it a generalizable optimization for any FHE-enabled DNN encryption scheme. They conclude that while the "honest-but-curious" assumption is standard for such explorative work, the proposed obfuscation mechanisms provide a baseline defense against more malicious actors, though they acknowledge that further research is needed to fully relax these assumptions.