Privacy-Preserving Robustness Verification for Neural Networks

Source: arXiv:2607.05251 · Published 2026-07-06 · By Nianyun Song, Xiaokun Luan, Yu Guo, Rongfang Bie, Meng Sun, Xiyue Zhang

TL;DR

The paper addresses the fundamental conflict between neural network robustness verification and privacy requirements. Traditional robustness verification methods assume full access to both the model parameters and input data, a scenario often infeasible due to intellectual property concerns and data privacy regulations like GDPR. The authors present SecureCROWN, the first privacy-preserving framework for certified robustness verification of neural networks, which allows a model owner and a data owner to jointly compute certified robustness bounds without revealing the model or inputs beyond the final verification result. They build on secure two-party computation (2PC) protocols and solve key technical challenges, including eliminating data-dependent branching incompatible with 2PC via a branch-free ReLU-based arithmetic formulation, and improving numerical precision via Newton–Raphson refinement. Extensive experiments on MNIST and CIFAR-10 fully connected ReLU networks demonstrate SecureCROWN matches plaintext verification results exactly while incurring practical runtimes (0.1–200 seconds) under various network conditions. This work pioneers a practical approach to robustness verification under strict privacy constraints.

Key findings

• SecureCROWN achieves numerical robustness verification results that strictly match plaintext verifiers with mean relative errors as low as 10^-7 on MNIST models of varying sizes (Table 1).
• Verification outcomes (Robust/Unknown) are 100% consistent with plaintext results under all tested perturbation magnitudes and network architectures.
• The branch-free ReLU arithmetic reformulation eliminates data-dependent branching, enabling efficient batching and vectorized secure computation of slopes and intercepts in linear bound propagation.
• A single Newton–Raphson iteration doubles fixed-point precision for secure reciprocal computations, significantly enhancing numerical stability during deep backward recursion.
• Online runtime ranges from 0.1s for small 2-layer MNIST networks to 200s for larger 10-layer CIFAR-10 models under WAN settings, showing moderate cryptographic overhead (Fig. 1).
• Communication volume scales up with network size, e.g., 0.77 MB for 2x[20] MNIST to 604 MB for 10x[200] CIFAR-10 models (Table 2).
• The protocol is secure under the semi-honest adversary model with formal simulation-based proofs, assuming a trusted preprocessing dealer.
• The unified arithmetic expression for slope computation encapsulates all ReLU activation states (inactive, active, unstable) without branching (Eq. 12).

Threat model

The adversaries are semi-honest, meaning both the model owner and data owner follow the protocol honestly but may attempt to infer private inputs from protocol messages. The parties do not collude and a trusted dealer provides correlated preprocessing randomness. The adversary cannot deviate from the protocol, inject malformed inputs, or collude with the dealer. Under this model, the protocol ensures no information about model parameters or input data beyond the certified robustness margin is revealed.

Methodology — deep read

The authors formulate the problem as a two-party secure computation (2PC) between a model owner (P0) and a data owner (P1). The model owner holds a proprietary fully connected ReLU network, and the data owner has private input data x0, perturbation radius epsilon, and class labels encoded as a difference vector to avoid array indexing overhead. The goal is to compute the certified local robustness margin f_{y,j} without revealing inputs or model parameters beyond the final bound.

Their threat model assumes semi-honest adversaries who follow the protocol but may try to learn additional information. Preprocessing is done by a trusted dealer distributing Beaver triples and function secret sharing (FSS) keys. No collusion is assumed.

Data includes fixed network architectures from MNIST and CIFAR-10 benchmarks with varied layer sizes and widths. Model parameters and inputs are secret-shared additively. Perturbations are measured under the l_infinity norm.

The core algorithm builds on Linear Bound Propagation (LBP) adapted for secure computation. LBP computes symbolic linear bounds on neuron activation intervals via backward propagation of linear relaxations and conditional logic on ReLU states. SecureCROWN eliminates costly data-dependent branching in LBP by representing slope computations and intercept calculations as continuous arithmetic functions using ReLU, which securely select correct terms without conditionals.

Secure arithmetic is implemented via Beaver triple-based protocols for multiplication and matrix multiplication, DCF-based secure comparisons for ReLU and absolute value, and a Newton-Raphson iterative method for secure reciprocal to refine divisions (crucial in slope computation). These operations maintain fixed-point encoding with 64-bit integers and 26 fractional bits.

The protocol proceeds in iterations from the input layer up to the output: computing bounds, slopes, intercept accumulations, and finally, the certified margin. Each step uses secure building blocks composed to preserve secret-sharing invariants.

Evaluation runs on a multicore Intel Xeon CPU simulating LAN and WAN network conditions to capture communication overhead. The baseline plaintext verifier is used to confirm numerical fidelity and exactness of verification outcomes. Metrics include mean relative error and verification consistency over 100 random samples per model.

The authors provide detailed algorithms (e.g., ΠBackward, Πα, Πδ, ΠVerify) describing secure matrix operations, conditional-free slope and intercept calculations, and iterative Newton refinement. Formal security proofs are constructed via simulation in the semi-honest model, reducing to the security of underlying primitives like FSS and ASS. Error analyses demonstrate bounded fixed-point numerical errors proportional to network depth and weight norms.

All code is released publicly, enhancing reproducibility. While focused on fully connected ReLU networks, the approach is extendable to other architectures with structural adjustments discussed in the appendix.

Technical innovations

• Unified branch-free arithmetic reformulation of conditional ReLU relaxation logic via continuous ReLU operations, eliminating expensive secure branching in MPC.
• Newton–Raphson iterative refinement to securely compute high-precision reciprocals in fixed-point MPC, halving numerical errors in slope calculations.
• Use of function secret sharing (FSS) primitives, especially distributed comparison functions (DCF), to perform secure comparisons with constant-round communication.
• Encoding classification target pairs as difference vectors to avoid O(K) secure array indexing overhead during margin certification.

Datasets

• MNIST — varying fully connected ReLU networks (2-7 layers, 20-256 neurons per layer) — public benchmark datasets
• CIFAR-10 — varying fully connected ReLU networks (5-10 layers, 100-200 neurons per layer) — public benchmark datasets

Baselines vs proposed

• Plaintext CROWN (Python, single-thread) verification oracle: mean relative error (MRE) = ~10^-7 for SECURECROWN (C++), verification consistency = 100%
• SECURECROWN runtime: 0.1–200s online depending on model size and network (LAN/WAN)
• SECURECROWN communication volume: from 0.77 MB (small MNIST) up to 604 MB (large CIFAR-10)
• Newton-Raphson iteration improves numerical precision approximately doubling correct bits per iteration

Limitations

• Security guarantees hold only under the semi-honest adversary model; malicious adversary robustness is discussed but not fully implemented.
• Only supports fully connected ReLU networks; extensions to convolutional or other architectures are mentioned but not evaluated.
• Fixed-point arithmetic introduces bounded precision errors; while well-analyzed, deep or highly unstable networks may still yield less tight bounds.
• Communication overhead grows quadratically with network depth and cubic with layer width, making scaling to very large networks potentially expensive.
• Trusted dealer for preprocessing is assumed, which may be unrealistic in some deployment scenarios.
• Evaluation limited to MNIST and CIFAR-10 fully connected models; no experiments on larger or industry-scale networks.

Open questions / follow-ons

• How to extend the approach efficiently to convolutional, residual, or transformer architectures common in practical deployments?
• How to upgrade security guarantees to malicious adversary models with reasonable overhead?
• Can the communication and computational costs be further reduced via compression or approximation without sacrificing verification soundness?
• Is it possible to integrate this protocol with privacy-preserving training pipelines for end-to-end certified robust model development?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, SecureCROWN introduces a systematic method to verify neural network robustness without revealing sensitive models or input data. Since bot-defense models may be proprietary and inputs potentially sensitive user data, applying secure robustness verification can enforce safety guarantees under privacy constraints critical when deploying security-critical ML. The branch-free arithmetic techniques and Newton–Raphson refinement may inspire efficient private computations of nonlinear verification steps in adversarial settings. However, current complexity scaling restricts deployment to moderately sized networks, so optimizations would be needed for large-scale real-world CAPTCHAs. Overall, SecureCROWN sets a strong precedent for achieving certified robustness while complying with privacy regulations, a growing concern in bot defense ecosystems.

Cite

@article{arxiv2607_05251,
  title={ Privacy-Preserving Robustness Verification for Neural Networks },
  author={ Nianyun Song and Xiaokun Luan and Yu Guo and Rongfang Bie and Meng Sun and Xiyue Zhang },
  journal={arXiv preprint arXiv:2607.05251},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.05251}
}

Read the full paper

• arXiv:2607.05251 (abstract)
• arXiv:2607.05251 (PDF)