Privacy-Preserving Robustness Verification for Neural Networks

2026-07-06

AI Summary

This work addresses the challenge of verifying neural network robustness under privacy and intellectual property constraints, where access to model parameters and input data is often restricted. To this end, the authors propose SecureCROWN, the first framework enabling privacy-preserving robustness verification via secure two-party computation (2PC), wherein the model owner and data owner learn only the final verification result. The method innovatively transforms conditional branches into continuous arithmetic operations compatible with 2PC and incorporates the Newton-Raphson method to enhance numerical stability. Experiments demonstrate that SecureCROWN produces verification outcomes identical to those obtained in the clear, with execution times ranging from 0.1 to 200 seconds across LAN and WAN settings, and scales effectively across diverse model sizes, thereby confirming its feasibility and practicality.

Abstract

Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.

Problem

• privacy-preserving
• robustness verification
• neural networks
• secure computation
• data privacy

Innovation

• privacy-preserving verification
• secure two-party computation
• robustness certification
• branching elimination
• numerical stability