CoChat
Sign Up
PreprintCited by 257Cryptography and Data SecurityPrivacy-Preserving Technologies in DataCloud Data Security Solutions

CrypTen: Secure Multi-Party Computation Meets Machine Learning

Open access
Knott, Brian, Venkataraman, Shobha, Hannun, Awni, Sengupta, Shubho, Ibrahim, Mark, van der Maaten, Laurens·2021·arXiv
DOI 10.48550/arxiv.2109.00984arXiv 2109.00984
Open this paper in CoChat — free accountOpen PDF

Abstract

Secure multi-party computation (MPC) allows parties to perform computations on data while keeping that data private. This capability has great potential for machine-learning applications: it facilitates training of machine-learning models on private data sets owned by different parties, evaluation of one party's private model using another party's private data, etc. Although a range of studies implement machine-learning models via secure MPC, such implementations are not yet mainstream. Adoption of secure MPC is hampered by the absence of flexible software frameworks that "speak the language" of machine-learning researchers and engineers. To foster adoption of secure MPC in machine learning, we present CrypTen: a software framework that exposes popular secure MPC primitives via abstractions that are common in modern machine-learning frameworks, such as tensor computations, automatic differentiation, and modular neural networks. This paper describes the design of CrypTen and measure its performance on state-of-the-art models for text classification, speech recognition, and image classification. Our benchmarks show that CrypTen's GPU support and high-performance communication between (an arbitrary number of) parties allows it to perform efficient private evaluation of modern machine-learning models under a semi-honest threat model. For example, two parties using CrypTen can securely predict phonemes in speech recordings using Wav2Letter faster than real-time. We hope that CrypTen will spur adoption of secure MPC in the machine-learning community.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2109.00984

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Cryptographic frameworks such as SecureML, CrypTen, and secure multi-party computation enable collaborative training without exposing raw data.

    “Cryptographic frameworks such as SecureML (Mohassel & Zhang, 2017), CrypTen (Knott et al., 2021),and secure multi-party computation (Yao, 1982a), enable collaborative training without exposing raw data.”

    From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Knott et al., 2021

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 53

  1. [2][2] M. Abadi, A. Chu, I. Goodfellow, H. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In Proceedings of the CCS , pages 308-318, 2016. -
  2. [3][3] A. Agrawal, A. N. Modi, A. Passos, A. Lavoie, A. Agarwal, A. Shankar, I. Ganichev, J. Levenberg, M. Hong, R. Monga, and S. Cai. TensorFlow Eager: A multi-stage, python-embedded dsl for machine learning. In arXiv:1903.01855 , 2019. - · arXiv
  3. [4][4] T. Araki, J. Furukawa, Y. Lindell, A. Nof, and K. Ohara. High throughput semi-honest secure three-party computation with an honest majority. In ACM CCS , pages 805-817, 2016. -
  4. [5][5] D. W. Archer, D. Bogdanov, L. Kamm, Y. Lindell, K. Nielsen, J. I. Pagter, N. P. Smart, and R. N. Wright. From keys to databases - real-world applications of secure multi-party computation. Computer Journal , 61(12):1749-1771, 2018. -
  5. [6][6] B. Balle and Y.-X. Wang. Improving the Gaussian mechanism for differential privacy. In Proceedings of International Conference on Machine Learning , 2018. -
  6. [7][7] D. Beaver. Efficient multiparty protocols using circuit randomization. In Annual International Cryptology Conference , pages 420-432. Springer, 1991. -
  7. [8][8] B. Biggio, B. Nelson, and P. Laskov. Poisoning attacks against support vector machines. In International Conference on Machine Learning (ICML) , pages 1467-1474, 2012. -
  8. [9][9] D. Bogdanov, S. Laur, and J. Willemson. Sharemind: A framework for fast privacy-preserving computations. In S. Jajodia and J. Lopez, editors, Computer Security - ESORICS 2008 , pages 192-206. Springer Berlin Heidelberg, 2008. -
  9. [11][11] M. Byali, H. Chaudhari, A. Patra, and A. Suresh. FLASH: Fast and robust framework for privacy-preserving machine learning. In Privacy Enhancing Technologies Symposium , 2020. -
  10. [12][12] R. Canetti. Universally composable security: A new paradigm for cryptographic protocols. In Proceedings of the Annual Symposium on Foundations of Computer Science , pages 136-145, 2001. -
  11. [13][13] C. Canonne, G. Kamath, and T. Steinke. The discrete Gaussian for differential privacy. In arXiv 2004.00010 , 2020. - · arXiv
  12. [15][15] O. Catrina and S. De Hoogh. Improved primitives for secure multiparty integer computation. In International Conference on Security and Cryptography for Networks , pages 182-199. Springer, 2010. -
  13. [16][16] N. Chandran, D. Gupta, A. Rastogi, R. Sharma, and S. Tripathi. EzPC: Programmable, efficient, and scalable secure two-party computation for machine learning. In IEEE European Symposium on Security and Privacy , 2019. -
  14. [17][17] H. Chaudhari, A. Choudhury, A. Patra, and A. Suresh. Astra: High throughput 3pc over rings with application to secure prediction. In ACM SIGSAC Conference on Cloud Computing Security Workshop , 2019. -
  15. [18][18] R. Collobert, C. Puhrsch, and G. Synnaeve. Wav2letter: An end-to-end convnet-based speech recognition system. In arXiv:1609.03193 , 2016. - · arXiv
  16. [19][19] R. Cramer, I. Damgård, and Y. Ishai. Share conversion, pseudorandom secret-sharing and applications to secure computation. In Lecture Notes in Computer Science , volume 3378, pages 342-362, 2005. -
  17. [24][24] I. Damgård, D. Escudero, T. Frederiksen, M. Keller, P. Scholl, and N. Volgushev. New primitives for actively-secure mpc over rings with applications to private machine learning. In Proceedings of the IEEE Symposium on Security and Privacy , 2019. -
  18. [25][25] D. Demmler, T. Schneider, and M. Zohner. ABY - A framework for efficient mixed-protocol secure two-party computation. In NDSS , 2015. -
  19. [27][27] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR , 2021. -
  20. [28][28] T. Dugan and X. Zou. A survey of secure multiparty computation protocols for privacy preserving genetic tests. In Proceedings of the International Symposium on Biomedical Imaging , 2016. -
  21. [29][29] C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9(3-4):211-407, 2014. -
  22. [30][30] C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference , pages 265-284. Springer, 2006. -
  23. [33][33] O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game or a completeness theorem for protocols with honest majority. In STOC , pages 218-229, 1987. -
  24. [34][34] C. Guo, A. Hannun, B. Knott, L. van der Maaten, M. Tygert, and R. Zhu. Secure multiparty computations in floating-point arithmetic. In arXiv:2001.03192 , 2020. - · arXiv
  25. [35][35] V. Haralampieva, D. Rueckert, and J. Passerat-Palmbach. A systematic comparison of encrypted machine learning solutions for image classification. In Proceedings of the Workshop on PrivacyPreserving Machine Learning in Practice , pages 55-59, 2020. -
  26. [36][36] M. Hastings, B. Hemenway, D. Noble, and S. Zdancewic. SoK: general-purpose compilers for secure multi-party computation. In 2019 IEEE Symposium on Security and Privacy (SP) , 2019. -
  27. [40][40] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan. Gazelle: A low latency framework for secure neural network inference. In arXiv 1801.05507 , 2018. - · arXiv
  28. [41][41] M. Keller, E. Orsini, and P. Scholl. MASCOT: Faster malicious arithmetic secure computation with oblivious transfer. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security , pages 830-842, 2016. -
  29. [45][45] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278-2324, 1998. -
  30. [46][46] H. Liu, K. Simonyan, and Y. Yang. DARTS: Differentiable architecture search. In arXiv:1806.09055 , 2018. - · arXiv
  31. [47][47] J. Liu, M. J. Y. Lu, and N. Asokan. Oblivious neural network predictions via MiniONN transformations. In ACM Conference on Computer and Communications Security (CCS) , 2017. -
  32. [48][48] I. Mironov. On significance of the least significant bits for differential privacy. In Proceedings ACM Conference on Computer and Communications Security (CCS) , pages 650-661, 2012. -
  33. [49][49] P. Mishra, R. Lehmkuhl, A. Srinivasan, W. Zheng, and R. Popa. Delphi: A cryptographic inference service for neural networks. In USENIX Security Symposium , 2020. -
  34. [50][50] P. Mohassel and P. Rindal. ABY3: A mixed protocol framework for machine learning. In ACM Conference on Computer and Communications Security (CCS) , 2018. -
  35. [51][51] P. Mohassel and Y. Zhang. SecureML: A system for scalable privacy-preserving machine learning. In IEEE Symposium on Security and Privacy , 2017. -
  36. [52][52] P. Mohassel and Y. Zhang. SecureML: A system for scalable privacy-preserving machine learning. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 19-38. IEEE, 2017. -
  37. [53][53] V. Nair and G. E. Hinton. Rectified linear units improve restricted boltzmann machines. In Proceedings of the International Conference on Machine Learning (ICML) , 2010. -
  38. [58][58] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala. PyTorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems (NeurIPS) , 2019. -
  39. [59][59] A. Patra and A. Suresh. Blaze: Blazing fast privacy preserving machine learning. In Symposium on Network and Distributed System Security (NDSS) , 2020. -
  40. [60][60] R. Rachuri and A. Suresh. Trident: Efficient 4PC framework for privacy preserving machine learning. In Symposium on Network and Distributed System Security , 2019. -
  41. [61][61] I. S. Reed. Information theory and privacy in data banks. In Proceedings of the June 4-8, 1973, National Computer Conference and Exposition , 1973. -
  42. [63][63] M. S. Riazi, M. Samragh, H. Chen, K. Laine, K. Lauter, and F. Koushanfar. Xonn: Xnor-based oblivious deep neural network inference. In USENIX Security , 2019. -
  43. [64][64] T. Ryffel, A. Trask, M. Dahl, B. Wagner, J. Mancuso, D. Rueckert, and J. Passerat-Palmbach. A generic framework for privacy preserving deep learning. In arXiv:1811.04017 , 2018. - · arXiv
  44. [66][66] K. Simonyan and A. Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR , 2015. -
  45. [67][67] S. Tan, B. Knott, Y. Tian, and D. J. Wu. CryptGPU: Fast privacy-preserving machine learning on the GPU. In arXiv 2104.10949 , 2021. - · arXiv
  46. [68][68] I. Tolstikhin, N. Houlsby, A. Kolesnikov, L. Beyer, X. Zhai, T. Unterthiner, J. Yung, A. Steiner, D. Keysers, J. Uszkoreit, M. Lucic, and A. Dosovitskiy. MLP-Mixer: An all-MLP architecture for vision. In arXiv:2105.01601 , 2021. - · arXiv
  47. [69][69] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin. Attention is all you need. In Advances in Neural Information Processing Systems (NeurIPS) , 2017. -
  48. [70][70] A. R. W. A. Khan, M. A. Noor. Higher-order iterative methods by using householders method for solving certain nonlinear equations. In Mathematical Science Letters , pages 107-120. Natural Sciences Publishing, May 2013. -
  49. [72][72] S. Wagh, S. Tople, F. Benhamouda, E. Kushilevitz, P. Mittal, and T. Rabin. FALCON: Honestmajority maliciously secure framework for private deep learning. In Proc. Priv. Enhancing Technol. , 2021. -
  50. [73][73] S. L. Warner. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American Statistical Association , 60(309):63-69, 1965. -
  51. [74][74] A. C.-C. Yao. How to generate and exchange secrets. In FOCS , pages 162-167, 1986. -
  52. [75][75] Yelp. Yelp Review Dataset. URL https://www.yelp.com/dataset . -
  53. [76][76] B. Zoph and Q. V. Le. Neural architecture search with reinforcement learning. In arXiv:1611.01578 , 2016. Table 1: Overview of the MPC primitives used in CRYPTEN, with their round complexity and references to the relevant security proof. Round complexity is defined as the number of sequential round-trips of communication required between parties to implement a given function, using an L -bit ring and |P| parties. † The number of rounds needed for truncation in the two-party setting is zero. · arXiv

Cited by

Sorted by citations

Authors
Knott, B., Venkataraman, S., Hannun, A., Sengupta, S., Ibrahim, M., & van der Maaten, L.
Affiliations
Meta (United Kingdom) (GB)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2021
Volume
34
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2109.00984
arXiv
2109.00984
OpenAlex
W3197217216
Cited by
257
References
6
Citations by year
2026: 14 · 2025: 55 · 2024: 91 · 2023: 60 · 2022: 26 · 2021: 11
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, public-domain)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
Keywords
secure multi-party computation, private machine learning, software framework, tensor computation, automatic differentiation, modular neural networks, GPU support, speech recognition, text classification, image classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review