Split Neural Network Inference for Data and Model Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing inference systems for neural networks face challenges in balancing data privacy and efficiency, with plaintext methods risking privacy breaches and secure multi-party computation methods being slow and inaccurate.
Innovation Solution
A split learning approach that divides a neural network into client-side and server-side portions, allowing local prediction on private data while maintaining model privacy and using encrypted data for server-side prediction, enabling parallel processing across multiple clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If plaintext inference is used, then processing speed is fast, but data privacy is compromised
Solution Approach 1:
The neural network model is divided into two portions: a first portion that remains on the server and a second portion that is sent to the client device. This segmentation allows the client to process data locally using the second portion while the server retains the first portion, achieving a balance between processing capability and data privacy protection.
Solution Approach 2:
An intermediary mechanism is introduced between the client and server where the client processes data using the second portion of the model locally, and only the processing results (activations) are transmitted to the server for further processing with the first portion. This intermediary approach protects data privacy while maintaining processing efficiency.
2Object-affected harmful factors
If secure multi-party computation is used, then data privacy is protected, but processing speed decreases significantly
Solution Approach 1:
By segmenting the model into server-side and client-side portions, the system avoids the need for slow secure multi-party computation protocols. The client can perform local processing with the second portion using standard, fast computational methods, while only necessary results are transmitted to the server for completion with the first portion.
Solution Approach 2:
The client device performs self-service processing by executing the second portion of the model locally on its own data without requiring secure multi-party computation protocols. This self-service approach enables fast processing while maintaining privacy, as the client independently processes data using its local copy of the model portion.
3Ease of operation
If the entire model is sent to the client, then local processing capability is maximized, but model privacy and security are compromised
Solution Approach 1:
The model is segmented such that only the second portion (client-side layers) is transmitted to the client device, while the first portion (server-side layers) remains on the server. This segmentation enables the client to perform local processing with the necessary model components while the server retains critical model privacy and security.
Solution Approach 2:
The necessary processing capability is extracted from the full model and placed in the second portion that can be sent to the client. This extraction allows the client to perform local processing without receiving the complete model, thereby maintaining model privacy and security on the server side.
Data Source
AI summary
A system and method for dividing a model between a client and server for inference. The method include dividing, at a first computing device, a model into a first portion of the model and a second portion of the model, transmitting the second portion to a second computing device, wherein the second computing device provides private data the second portion, receiving a activation values at the first computing device from the second computing device, applying the activation values to the first portion and transmitting a model output from the first computing device to the second computing device. The model can also be divided into three or more parts.