This paper proposes a new approach for privacy-preserving and verifiable convolutional neural network (CNN) testing, enabling a CNN model developer to convince a user of the truthful CNN performance over non-public data from multiple testers, while respecting model privacy. To balance the security and efficiency issues, three new efforts are done by appropriately integrating homomorphic encryption (HE) and zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) primitives with the CNN testing. First, a CNN model to be tested is strategically partitioned into a private part kept locally by the model developer, and a public part outsourced to an outside server. Then, the private part runs over HE-protected test data sent by a tester and transmits its outputs to the public part for accomplishing subsequent computations of the CNN testing. Second, the correctness of the above CNN testing is enforced by generating zk-SNARK based proofs, with an emphasis on optimizing proving overhead for two-dimensional (2-D) convolution operations, since the operations dominate the performance bottleneck during generating proofs. We specifically present a new quadratic matrix programs (QMPs)-based arithmetic circuit with a single multiplication gate for expressing 2-D convolution operations between multiple filters and inputs in a batch manner. Third, we aggregate multiple proofs with respect to a same CNN model but different testers' test data (i.e., different statements) into one proof, and ensure that the validity of the aggregated proof implies the validity of the original multiple proofs. Lastly, our experimental results demonstrate that our QMPs-based zk-SNARK performs nearly 13.9$\times$faster than the existing QAPs-based zk-SNARK in proving time, and 17.6$\times$faster in Setup time, for high-dimension matrix multiplication.

翻译：本文提出了一种用于隐私保护且可验证的卷积神经网络（CNN）测试的新方法，使得CNN模型开发者能够向用户证明CNN对来自多个测试者的非公开数据具有真实的性能，同时保护模型隐私。为了平衡安全性和效率问题，本文通过将同态加密（HE）和零知识简洁非交互式知识论证（zk-SNARK）原语与CNN测试进行适当整合，做出了三项新努力。首先，将待测试的CNN模型策略性地划分为由模型开发者本地保留的私有部分和外包给外部服务器的公共部分。然后，私有部分对测试者发送的经HE保护的数据进行计算，并将其输出传输给公共部分，以完成CNN测试的后续计算。其次，通过生成基于zk-SNARK的证明来强制执行上述CNN测试的正确性，重点优化了二维（2-D）卷积运算的证明开销，因为这些运算在生成证明过程中构成了性能瓶颈。我们专门提出了一种基于二次矩阵程序（QMPs）的算术电路，该电路使用单个乘法门，以批处理方式表示多个滤波器与输入之间的二维卷积运算。第三，我们将针对同一CNN模型但不同测试者测试数据（即不同陈述）的多个证明聚合成一个证明，并确保聚合证明的有效性蕴含原始多个证明的有效性。最后，我们的实验结果表明，在高维矩阵乘法中，基于QMPs的zk-SNARK在证明时间上比现有的基于QAPs的zk-SNARK快约13.9倍，在设置时间上快17.6倍。