MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models
Qi Pang, Yuanyuan Yuan, Shuai Wang · 2024
Secure multi-party computation (MPC) has recently become prominent as a concept to enable multiple parties to perform privacy-preserving machine learning without leaking sensitive data or details of pre-trained models to the other parties.Industry and the community have been actively developing and promoting high-quality MPC frameworks (e.g., based on TensorFlow and PyTorch) to enable the usage of MPC-hardened models, greatly easing the development cycle of integrating deep learning models with MPC primitives.Despite the prosperous development and adoption of MPC frameworks, a principled and systematic understanding toward the correctness of those MPC frameworks does not yet exist.To fill this critical gap, this paper introduces MPCDIFF, a differential testing framework to effectively uncover inputs that cause deviant outputs of MPC-hardened models and their plaintext versions.We further develop techniques to localize error-causing computation units in MPC-hardened models and automatically repair those defects.We evaluate MPCDIFF using real-world popular MPC frameworks for deep learning developed by Meta (Facebook), Alibaba Group, Cape Privacy, and OpenMined.MPCDIFF successfully detected over one thousand inputs that result in largely deviant outputs.These deviation-triggering inputs are (visually) meaningful in comparison to regular inputs, indicating that our findings may cause great confusion in the daily usage of MPC frameworks.After localizing and repairing error-causing computation units, the robustness of MPC-hardened models can be notably enhanced without sacrificing accuracy and with negligible overhead.