Garbled Circuits (GC) is a foundational primitive for secure two-party computation (2PC). Garbled Private Information Retrieval (GPIR) is a GC technique for looking up a public array or database (DB) on a private index unknown to either player. GPIR immediately implies GC evaluation of functions implemented as a publicly known look-up table (LUT).

Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) schemes have gained significant adoption in privacy-preserving applications, in decentralized systems (e.g., blockchain), and in verifiable computation due to their efficiency. However, the most efficient zk-SNARKs often rely on a one-time trusted setup to generate public parameters, often known as the ''Powers of Tau'' (PoT) string. The leakage of the secret parameter τ in the string would allow attackers to generate false proofs, compromising the soundness of all zk-SNARK systems built on it.

We studied 53 privacy-preserving neural-network papers in 2016-2022 based on cryptography (without trusted processors or differential privacy), 16 of which only use homomorphic encryption, 19 use secure computation for inference, and 18 use non-colluding servers (among which 12 support training), solving a wide variety of research problems. We dissect their cryptographic techniques and "love-hate relationships" with machine learning alongside a genealogy highlighting noteworthy developments. We also re-evaluate the state of the art under WAN. We hope this can serve as a go-to guide connecting different experts in related fields.

Deep learning unlocks applications with societal impacts, e.g., detecting child exploitation imagery and genomic analysis of rare diseases. Deployment, however, needs compliance with stringent privacy regulations. Training algorithms that preserve the privacy of training data are in pressing need. Purely cryptographic approaches can protect privacy, but they are still costly, even when they rely on two or more non-colluding servers. Seemingly-"trivial" operations in plaintext quickly become prohibitively inefficient when a series of them are "crypto-processed," e.g., (dynamic) quantization for ensuring the intermediate values would not overflow. Slalom, recently proposed by Tramer and Boneh, is the first solution that leverages both GPU (for efficient batch computation) and a trusted execution environment (TEE) (for minimizing the use of cryptography). Roughly, it works by a lot of pre-computation over known and fixed weights, and hence it only supports private inference. Five related problems for private training are left unaddressed. Goten, our privacy-preserving training and prediction framework, tackles all five problems simultaneously via our careful design over the "mismatched" cryptographic and GPU data types (due to the tension between precision and efficiency) and our round-optimal GPU-outsourcing protocol (hence minimizing the communication cost between servers). It 1) stochastically trains a low-bitwidth yet accurate model, 2) supports dynamic quantization (a challenge left by Slalom), 3) minimizes the memory-swapping overhead of the memory-limited TEE and its communication with GPU, 4) crypto-protects the (dynamic) model weight from untrusted GPU, and 5) outperforms a pure-TEE system, even without pre-computation (needed by Slalom). As a baseline, we build CaffeScone that secures Caffe using TEE but not GPU; Goten shows a 6.84x speed-up of the whole VGG-11. Goten also outperforms Falcon proposed by Wagh et al., the latest secure multi-server cryptographic solution, by 132.64x using VGG-11. Lastly, we demonstrate Goten's efficacy in training models for breast cancer diagnosis over sensitive images.

LDSP is a layer-2 cryptocurrency payment system that supports a dynamic and distributed setup with scalability and payer privacy. Different from the statekeeping merchant consortium assumed by a recent layer-2 solution Snappy (NDSS 2020), its core idea is to rely on leaders selected from the merchants to lead a mini-consortium and ensure the fungibility of the LDSP coins. Similar to Snappy, payers can transfer coins off-chain, enjoying low-latency transactions, while the merchants are assured that they will receive the coins. Privacy-wise, Snappy requires all merchants to check the whole customer transaction history, which is not necessary for LDSP.

Zero-error single-channel source coding has been studied extensively over the past decades. Its natural multi-channel generalization is however seldom investigated. While the special case with multiple symmetric-alphabet channels was studied a decade ago, codes in such setting have no advantage over single-channel codes in data compression, making them worthless in most applications. With essentially no development since the last decade, in this paper, we break the stalemate by showing that it is possible to beat single-channel source codes in terms of compression assuming asymmetric-alphabet channels. We present the multi-channel analogs of several classical results in single-channel source coding, e.g., a multi-channel Huffman code is an optimal tree-decodable code. We also show evidences that finding an efficient construction of multi-channel Huffman codes may be hard. Nevertheless, we propose a construction whose redundancy is guaranteed to be no larger than that of an optimal single-channel source code.

Privacy-preserving deep neural network (DNN) inference remains an intriguing problem even after the rapid developments of different communities. One challenge is that cryptographic techniques such as homomorphic encryption (HE) do not natively support non-linear computations (e.g., sigmoid). A recent work, BAYHENN (Xie et al., IJCAI'19), considers HE over the Bayesian neural network (BNN). The novelty lies in "meta-prediction" over a few noisy DNNs. The claim was that the clients can get intermediate outputs (to apply non-linear function) but are still prevented from learning the exact model parameters, which was justified via the widely-used learning-with-error (LWE) assumption (with Gaussian noises as the error). This paper refutes the security claim of BAYHENN via both theoretical and empirical analyses. We formally define a security game with different oracle queries capturing two realistic threat models. Our attack assuming a semi-honest adversary reveals all the parameters of single-layer BAYHENN, which generalizes to recovering the whole model that is "as good as" the BNN approximation of the original DNN, either under the malicious adversary model or with an increased number of oracle queries. This shows the need for rigorous security analysis ("the noise introduced by BNN can obfuscate the model" fails -- it is beyond what LWE guarantees) and calls for the collaboration between cryptographers and machine-learning experts to devise practical yet provably-secure solutions.

Batched network coding is a practical branch of random linear network coding which encodes the input file into small batches of coded packets. Although burst erasures within the batches can reduce the advantage of network coding, it can be alleviated by applying a block interleaver which spreads the burst across multiple batches. On the other hand, the intermediate network nodes are required to perform recoding on the batches unlike the traditional forwarding strategy. The recoding of a batch can be started once all the packets in that batch which are not dropped by the channel are received. This means that the intermediate network nodes have to deinterleave the batches for recoding and reinterleave the batches again for transmission, which gives us a choice to use different interleaver depths at different network nodes. In this paper, we study the memory requirements of the schemes for transmitting batches which apply different interleaver depths. We investigate the periodic structure of buffer sizes and the connection between buffer sizes and the total delay induced by the interleaver. More importantly, we show that there exists a scheme which can achieve the lowest memory requirement and minimum total delay simultaneously.