The SecureCROWN framework is built upon secure two-party computation (2PC), and enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model.
Abstract
Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties'private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.
FHEON is presented, an open-source configurable framework for developing privacy-preserving neural network models for inference using the CKKS scheme of HE, and outperform all state-of-the-art HE inference works in both latency and memory utilization.
Nges Brian Njungle, Eric Jahns, Michel A. Kinsy· Proceedings on Privacy Enhan...· 1 citation
PANDA is a scalable system that uses zero-knowledge proofs to prove the robustness and fairness properties of a model without revealing its private parameters, and can generate proofs of local robustness for neural networks with more than 2.9M parameters in 5 minutes, and can verify them in 10 seconds.
Youwei Zhong, Ben Merbaum, Timos Antonopoulos et al.· 0 citations
A privacy model for searchable symmetric encryption protocols that makes adversarial power a central parameter and induces four privacy levels giving rise to a privacy lattice is proposed, enabling reasoning about how privacy guarantees change under different adversarial capabilities.
Manuela Horduna· Proceedings of the 23rd Inte...· 0 citations
A federated deep learning framework that systematically integrates adaptive privacy noise mechanisms and trust-weighted aggregation within a distributed architecture that ensures the protection of sensitive data during collaborative analysis through precise differential privacy control and advanced neural network models is presented.
Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.
A systematic literature review of 50 studies published between 2018 and 2026 that combine machine-learningbased anomaly detection with privacy-enhancing technologies finds that FL combined with the lightweight Isolation Forest is the approach most frequently associated with a favourable trade-off between detection quality, privacy protection and computational cost.
Mahnoor Fatima, Ahmad Ijaz, Aoun E. Muhammad et al.· ICACNC 2026 Proceedings· 0 citations