The DOI matches its Crossref record; 79 of the 85 references it cites were found in a registry or an index.
CrypTFlow: Secure TensorFlow Inference
Open accessAbstract
We present CrypTFlow, a first of its kind system that converts TensorFlow inference code into Secure Multi-party Computation (MPC) protocols at the push of a button. To do this, we build three components. Our first component, Athos, is an end-to-end compiler from TensorFlow to a variety of semihonest MPC protocols. The second component, Porthos, is an improved semi-honest 3-party protocol that provides significant speedups for TensorFlow like applications. Finally, to provide malicious secure MPC protocols, our third component, Aramis, is a novel technique that uses hardware with integrity guarantees to convert any semi-honest MPC protocol into an MPC protocol that provides malicious security. The malicious security of the protocols output by Aramis relies on integrity of the hardware and semi-honest security of MPC. Moreover, our system matches the inference accuracy of plaintext TensorFlow.We experimentally demonstrate the power of our system by showing the secure inference of real-world neural networks such as ResNet50 and DenseNet121 over the ImageNet dataset with running times of about 30 seconds for semi-honest security and under two minutes for malicious security. Prior work in the area of secure inference has been limited to semi-honest security of small networks over tiny datasets such as MNIST or CIFAR. Even on MNIST/CIFAR, CrypTFlow outperforms prior work.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“computational considerations are a concern beyond small algorithm sizes, with efficient SMPC implementations of state-of-the-art neural network algorithms currently under active development 78 .”
From Secure, privacy-preserving and federated machine learning in medical imaging (2020) · cites this paper as [78]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805
Densely Connected Convolutional Networks
Huang, G., Liu, Z., Van Der Maaten, L., & Weinberger, K. Q. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.243 · Cited by 48,566
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
Ioffe, S., & Szegedy, C. (2015) · arXiv · doi:10.48550/arxiv.1502.03167 · Cited by 27,818
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273
Identity mappings in deep residual networks
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-46493-0_38 · Cited by 10,741
TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems
Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G. S., Davis, A., Dean, J., Devin, M., et al. (2016) · arXiv · doi:10.48550/arxiv.1603.04467 · Cited by 9,408
Gulshan, V., Peng, L., Coram, M., Stumpe, M. C., Wu, D., Narayanaswamy, A., Venugopalan, S., Widner, K., Madams, T., Cuadros, J., et al. (2016) · JAMA · doi:10.1001/jama.2016.17216 · Cited by 7,697
SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size
Iandola, F. N., Han, S., Moskewicz, M. W., Ashraf, K., Dally, W. J., & Keutzer, K. (2016) · arXiv · doi:10.48550/arxiv.1602.07360 · Cited by 6,201
Flagged first, then by citations
6 of the 85 references couldn’t be matched to a known paper.
Research works printed but not linked: 5
- goldreich, 1987, How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority, 19th Annual ACM Symposium on Theory of Computing 1987, 218
- msv, 2017, Google’s Research In Artificial Intelligence Helps In Preventing Blindness Caused by Diabetes, Forbes
- 10.1145/3338466.3358922 · DOI
- yao, 1986, How to Generate and Exchange Secrets (Extended Abstract), 27th Annual Symposium on Foundations of Computer Science, 162
- aho, 2006, Compilers Principles Techniques and Tools
Cited by
Sorted by citations
Items 201–243 of 243
Improving Heterogeneous Model Reuse by Density Estimation
Tang, A., Luo, Y., Hu, H., He, F., Su, K., Du, B., Chen, Y., & Tao, D. (2023) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2023/472
A Study on Quantized Parameters for Protection of a Model and Its Inference Input
Kitai, H., Yanai, N., Iwahana, K., Tatsumi, M., & Cruz, J. P. (2023) · Journal of Information Processing · doi:10.2197/ipsjjip.31.667
SecMath: An Efficient 2-Party Cryptographic Framework for Math Functions
Hu, J. W., Li, H., Chen, H., Hao, M., & Zhang, X. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10278842
Dong, Z., Ge, X., Huang, Y., Dong, J., & Jiang, X. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.049233
Roger: A Round Optimized GPU-Friendly Secure Inference Framework
Chen, X., Chen, X., Dong, Y., Jing, W., Fan, T., & Zhang, Q. (2024) · International Conference on Communications · doi:10.1109/icc51166.2024.10622609
On the Security of Privacy-Preserving Machine Learning Against Model Stealing Attacks
Chaturvedi, B., Chakraborty, A., Chatterjee, A., & Mukhopadhyay, D. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-8016-7_5
Slalom at the Carnival: Privacy-preserving Inference with Masks from Public Knowledge
Bruhns, I., Berndt, S., Sander, J., & Eisenbarth, T. (2024) · IACR Communications in Cryptology · doi:10.62056/akp-49qgxq
PrivQuant: Communication-Efficient Private Inference with Quantized Network/Protocol Co-Optimization
Xu, T., Zhong, S., Zeng, W., Wang, R., & Li, M. (2024) · doi:10.1145/3676536.3676661 · Cited by 1
SecBNN: Efficient Secure Inference on Binary Neural Networks
Chen, H., Li, H., Hao, M., Hu, J. W., Xu, G., Zhang, X., & Zhang, T. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3484936
FHEDGE: Encrypted Inference on Lightweight Edge Devices
Sinha, S., Saha, S., Chatterjee, A., & Mukhopadhyay, D. (2024) · IEEE Asia Pacific Conference on Circuits and Systems (APCCAS) · doi:10.1109/apccas62602.2024.10808548
Mompe: Multiparty Oblivious Multivariate Polynomial Evaluation
Lyu, D., Zhang, H., Zhao, Z., & Wang, J. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858571
A GPU-Based Privacy-Preserving Machine Learning Acceleration Scheme
Hou, J., Huang, Z., Zhang, Z., Zhang, W., & Ju, L. (2024) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom63139.2024.00130
Preventing collusion in secure computation with preprocessing via function secret sharing
Heydari, G., Mahdavi, M., & Mala, H. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.128285
Privacy-Preserving Machine Learning: Cryptographic Techniques and Development Frontiers
Zhang, D., Wei, X., Wang, Y., Yu, M., & Wang, G. (2025) · International Symposium on Computer Applications and Information Systems (ISCAIS) · doi:10.1109/iscait64916.2025.11010413
Privacy-Preserving Training of Support Vector Machines via Secure Multiparty Computation
Jaramillo, D. C., Madrigal, H. D. V., Escudero, D. E., & Morales, F. A. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3749373
$\mathtt {Antelope}$: Fast and Secure Neural Network Inference
Liu, X., Li, H., Xu, G., Xu, S., Huang, X., Zhang, T., Lin, Y., & Zhou, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3596652 · Cited by 1
Efficient Two-Party Exponentiation from Quotient Transfer
Lu, Y., Hara, K., Ohara, K., Schuldt, J. C. N., & Tanaka, K. (2025) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2024icp0008
Akhtar, Z. B. (2025) · International Journal of Advanced Network Monitoring and Controls · doi:10.2478/ijanmc-2025-0023
Sun, L., Li, H., Luo, Q., Peng, Y., & Cui, J. (2025) · Information Processing & Management · doi:10.1016/j.ipm.2025.104443
Privacy-Preserving Machine Learning on Web Browsing for Public Opinion
Buxbaum, S., Tassis, L. M., Boschelli, L., Comarela, G., Varia, M., Crovella, M. E., & Christenson, D. P. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-10759-6_10
FucoPVA: An Efficient Video Analytics Framework with Full-Content Privacy Preservation
Zhou, T. F., Gao, L., Han, B., Zhu, C., & Li, M. (2025) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet67572.2025.11288147
PrivGNN: High-Performance Secure Inference for Cryptographic Graph Neural Networks
Wang, F., Chen, Z., Fan, M., Zhou, J., Pan, L., & Zhang, L. Y. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-07035-7_21
Octopus: Fast Homomorphic Convolution for Secure Neural Network Inference
Tong, Y., Fu, Y., Xu, T., Hong, C., Li, M., Wang, W., Feng, D., & Lin, J. (2025) · Annual Computer Security Applications Conference · doi:10.1109/acsac67867.2025.00074
Dong, Y., Chen, X., Song, X., Yang, Y., Zhang, T., & Dong, J.-S. (2025) · Annual Computer Security Applications Conference · doi:10.1109/acsac67867.2025.00076
Trustworthy Federated Learning With Authenticated ZKPs in Mobile Edge Intelligence
Li, Z., Chen, X., Sun, Q., Lu, Y., Li, D., Zhang, J., & Ai, B. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3670154
Privacy-Preserving Continuous Authentication of Smartphone Users via Secret Sharing
Hu, M., Wang, D., Han, D., Guo, J., & Tu, B. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3680150
Privacy-preserving biometric recognition systems with advanced cryptographic techniques
Ibarrondo, A. (2023) · theses.fr (ABES) · doi:10.70675/03346b6bz60fdz4d67z9e34z95b762a878bb
TFMD: General and Fast Secure Neural Network Inference Framework With Threshold FHE
Fu, Y., Tong, Y., Ning, Y., Lin, J., & Feng, D. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3683269
Practical and Robust Privacy-Preserving K-Means Clustering Protocols With GPU Acceleration
Bai, T., Feng, Y., Lu, Z. G., Tang, X., Lu, S., & Cui, Y. (2026) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2026.3682714
zkNAS: Secure and Efficient Outsourced-NAS with Zero-Cost Proxies
Wang, H., Zhang, D., Jiang, T., Wang, D., Guo, F., Wang, J., & Guo, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-0375-8_31
Beyond Latency: A System-Level Characterization of MPC and FHE for PPML
Huang, P., Maeng, K., & Suh, G. E. (2026) · IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS) · doi:10.1109/ispass69572.2026.00039
Efficient Revocable Attribute-Based Encryption with Intel SGX
Zhao, C., Gao, Y., Yang, X., & Zhang, X. (2026) · Chinese Journal of Electronics · doi:10.23919/cje.2025.00.287
PCSP: Patient-Centric Secret-Sharing Protocol for Privacy-Preserving Biomedical Inference
Wang, Z., Xu, Y., Feng, Y., Guo, S., Tang, X., & Lu, S. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-3495-0_7
Scientific Exploration of Extra-Terrestrial Planets and Analysis Using Quantum Computing
Akhtar, Z. B., Musharrat, S., & Ali, M. T. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-25187-9_18
EncFormer: Secure and Efficient Transformer Inference Over Encrypted Data
Zhu, Y., Jin, C., Aung, K. M. M., & Xiao, X. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3714715 · Cited by 4
Covert Attacks on Machine Learning Training in Passively Secure MPC
Jagielski, M., Rachuri, R., Scholl, P., & Escudero, D. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00047 · Cited by 1
New Privacy-Preserving Activation Functions Based on Secure Multiparty Computation
Fang, M., Wang, M., & Duan, M. (2026) · Communications in computer and information science · doi:10.1007/978-981-92-2973-4_6
Zhou, Z., Jia, M., Hu, X., Guo, S., Zhao, Y., Huang, H., Xu, Z., Li, L., Tan, J., Hu, D., et al. (2026) · Engineering · doi:10.1016/j.eng.2026.08.014
An efficient privacy-preserving inference scheme based on transfer learning
Chen, X., Xiong, L. I., Shang, S., Chen, T., Jingwei, L. I., Jiguo, Y. U., & Zhang, X. (2026) · Scientia Sinica Informationis · doi:10.1360/ssi-2025-0317
Secure and Explainable Inference with Neural Networks
Fiedler, V. M., & Mann, Z. Á. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-35899-8_1
Optimization of Visual Processing Pipeline for Secure Multi-Party Computation in Machine Learning
Yu, Z., Chen, J., Ji, L., Chen, J., Shi, R., & Mao, D. (2026) · International Conference on Big Data and Information Analytics (BigDIA) · doi:10.1109/bigdia71496.2026.11684595
Efficient Revocable Identity-Based Inner Product Functional Encryption Based on SM9
Shen, Z., Chen, Z., Xin, W., Li, Z., Zhao, Y., Li, C., & Wu, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-5693-8_36
Trustworthy AI Inference Systems: An Industry Research View
Cammarota, R., Schunter, M., Rajan, A., Boemer, F., Kiss, Á., Treiber, A., Weinert, C., Schneider, T., Stapf, E., Sadeghi, A.-R., et al. (2020) · arXiv · doi:10.48550/arxiv.2008.04449 · Cited by 9
Metadata
- Authors
- Kumar, N., Rathee, M., Chandran, N., Gupta, D., Rastogi, A., & Sharma, R.
- Affiliations
- Microsoft (United States) (US)
- Venue
- 2020 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2020-05
- Volume
- 2019
- Pages
- 336-353
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2974824775
- Semantic Scholar
- 5a2a7bcb24488a4ee938e376cc876d7c2fe115a7
- Cited by
- 245
- References
- 85
- Citations by year
- 2026: 18 · 2025: 41 · 2024: 48 · 2023: 43 · 2022: 33 · 2021: 42 · 2020: 20
- FWCI
- 13.18
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Licence
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- IACR Cryptology ePrint Archive (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- secure multi-party computation, secure inference, TensorFlow, neural network inference, semi-honest security, malicious security, compilers, hardware integrity, secure machine learning, ResNet50, DenseNet121, ImageNet
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
