# Secure Evaluation of Quantized Neural Networks

arXiv: https://arxiv.org/abs/1910.12435 · HTML: https://mlsanity.com/paper/1910.12435/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Oct 2019.

## Built on by (most cited first, 22 of 22)

- [CryptGPU: Fast Privacy-Preserving Machine Learning on the GPU](https://mlsanity.com/paper/2104.10949/) (2021)
- [SIRNN: A Math Library for Secure RNN Inference](https://mlsanity.com/paper/2105.04236/) (2021)
- [Secure Quantized Training for Deep Learning](https://mlsanity.com/paper/2107.00501/) (2021)
- [SLIP: Securing LLMs IP Using Weights Decomposition](https://mlsanity.com/paper/2407.10886/) (2024)
- [PrivFairFL: Privacy-Preserving Group Fairness in Federated Learning](https://mlsanity.com/paper/2205.11584/) (2022)
- [Privacy-Preserving Feature Selection with Secure Multiparty Computation](https://mlsanity.com/paper/2102.03517/) (2021)
- [Privacy-Preserving Video Classification with Convolutional Neural Networks](https://mlsanity.com/paper/2102.03513/) (2021)
- [Ditto: Quantization-aware Secure Inference of Transformers upon MPC](https://mlsanity.com/paper/2405.05525/) (2024)
- [SafeNet: The Unreasonable Effectiveness of Ensembles in Private Collaborative Learning](https://mlsanity.com/paper/2205.09986/) (2022)
- [Adam in Private: Secure and Fast Training of Deep Neural Networks with Adaptive Moment Estimation](https://mlsanity.com/paper/2106.02203/) (2021)
- [PrivFair: a Library for Privacy-Preserving Fairness Auditing](https://mlsanity.com/paper/2202.04058/) (2022)
- [Fast Privacy-Preserving Text Classification based on Secure Multiparty Computation](https://mlsanity.com/paper/2101.07365/) (2021)
- [Tabula: Efficiently Computing Nonlinear Activation Functions for Secure Neural Network Inference](https://mlsanity.com/paper/2203.02833/) (2022)
- [Efficient ML Models for Practical Secure Inference](https://mlsanity.com/paper/2209.00411/) (2022)
- [Compact: Approximating Complex Activation Functions for Secure Computation](https://mlsanity.com/paper/2309.04664/) (2023)
- [CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation](https://mlsanity.com/paper/2511.19711/) (2025)
- [Round and Communication Balanced Protocols for Oblivious Evaluation of Finite State Machines](https://mlsanity.com/paper/2103.11240/) (2021)
- [Spin: An Efficient Secure Computation Framework with GPU Acceleration](https://mlsanity.com/paper/2402.02320/) (2024)
- [Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attack](https://mlsanity.com/paper/2403.10558/) (2024)
- [End to End Collaborative Synthetic Data Generation](https://mlsanity.com/paper/2412.03766/) (2024)
- [CBNN: 3-Party Secure Framework for Customized Binary Neural Networks Inference](https://mlsanity.com/paper/2412.16449/) (2024)
- [SecONNds: Secure Outsourced Neural Network Inference on ImageNet](https://mlsanity.com/paper/2506.11586/) (2025)

## Abstract (arXiv)

We investigate two questions in this paper: First, we ask to what extent "MPC friendly" models are already supported by major Machine Learning frameworks such as TensorFlow or PyTorch. Prior works provide protocols that only work on fixed-point integers and specialized activation functions, two aspects that are not supported by popular Machine Learning frameworks, and the need for these specialized model representations means that it is hard, and often impossible, to use e.g., TensorFlow to design, train and test models that later have to be evaluated securely. Second, we ask to what extent the functionality for evaluating Neural Networks already exists in general-purpose MPC frameworks. These frameworks have received more scrutiny, are better documented and supported on more platforms. Furthermore, they are typically flexible in terms of the threat model they support. In contrast, most secure evaluation protocols in the literature are targeted to a specific threat model and their implementations are only a "proof-of-concept", making it very hard for their adoption in practice. We answer both of the above questions in a positive way: We observe that the quantization techniques supported by both TensorFlow, PyTorch and MXNet can provide models in a representation that can be evaluated securely; and moreover, that this evaluation can be performed by a general purpose MPC framework. We perform extensive benchmarks to understand the exact trade-offs between different corruption models, network sizes and efficiency. These experiments provide an interesting insight into cost between active and passive security, as well as honest and dishonest majority. Our work shows then that the separating line between existing ML frameworks and existing MPC protocols may be narrower than implicitly suggested by previous works.