Privacy-Preserving Robustness Verification for Neural Networks
2026-07-06 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceMachine LearningLogic in Computer Science
AI summaryⓘ
The authors address a problem where checking how reliable a neural network is usually requires access to private model and data, which is often not allowed due to privacy concerns. They create SecureCROWN, a method that allows two parties to work together to verify network robustness without revealing their private information to each other. To do this, they use secure two-party computation and clever math tricks to avoid data-dependent decisions that are hard to do privately. Their tests show SecureCROWN works just as well as normal methods but keeps data private and runs efficiently.
Neural Network VerificationData PrivacySecure Two-Party ComputationRobustness VerificationLinear Bound PropagationNewton-Raphson MethodSemi-Honest Security ModelPrivacy-Preserving ComputationCertified Robustness Bounds
Authors
Nianyun Song, Xiaokun Luan, Yu Guo, Rongfang Bie, Meng Sun, Xiyue Zhang
Abstract
Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.