PPNNI: Privacy-Preserving Neural Network Inference against Adversarial Example Attack

Outsourced inference services have greatly promoted the popularization of deep learning, and neural network models can help users customize a series of personalized applications, e.g., face recognition, image classification, etc. However, untrustworthy service providers also bring a variety of security issues, such as data privacy, network model privacy, etc. Meanwhile, the malicious example will result in the output of model incorrectly. For the above concerns, this paper proposes a privacy-reserving neural network inference against adversarial example attack (PPNNI) under two non-colluding cloud servers, where a series of efficient security protocols are designed to realize private prediction based on the additive secret sharing protocol. In the semi-honest model, the servers implement the neural network's private inference in the context of an unknown input and network model. Moreover, in order to prevent malicious examples from affecting the model accuracy, we produce a method of kernel density estimation and uncertainty value in the last layer of the hidden layer to determine whether the input is adversarial examples in the domain of ciphertext. The proposed PPNNI protocol is the first effort to efficiently detect adversarial attack behaviors under the ciphertexts. The theoretical analysis illustrate that the protocol can guarantee the privacy of input data, model parameters and the inference result. The results of the experiments demonstrate that the model accuracy are about 89% and 83% respectively with malicious examples on MNIST and CIFAR10 in the domain of ciphertext and they are nearly same as 91% and 85% in the domain of plaintext, which shows the effectiveness of our protocol.