Search papers, labs, and topics across Lattice.
This paper introduces Gecko, a novel framework for private inference that offloads a public encoder while ensuring the security of a compact encrypted predictor. By utilizing a frozen backbone for hierarchical feature extraction, fixed Fastfood projections for compression, and private feature gating for prediction preparation, Gecko achieves efficient inference times of 0.4-2.2 seconds with minimal communication overhead. Importantly, the design mitigates the risk of feature-space shortcuts that could facilitate model extraction, demonstrating comparable accuracy to transfer-learning baselines without giving adversaries a significant advantage.
Gecko achieves private inference in just 0.4-2.2 seconds while maintaining robust security against model extraction attacks.
Private inference protects both user inputs and server models during neural network inference, but existing solutions remain too slow for practical deployment. This motivates recent efforts to run a public encoder, such as a pretrained backbone, outside the protection boundary and evaluate only a small private predictor cryptographically. While appealing for efficiency, this design is not inherently secure: naively offloading a public encoder may create a feature-space shortcut: an extraction adversary may learn the remaining private predictor's feature-to-output mapping more easily than the original model's input-to-output behavior. We present Gecko, designed to limit this additional risk while retaining a compact encrypted predictor. We leverage a frozen backbone that contributes hierarchical features, fixed Fastfood projections that compress them, and private feature gating that prepares them for prediction. We formalize ideal independence and information-preservation conditions as design guidance, then separately evaluate component-reuse extraction attacks. Across image and audio tasks, Gecko achieves 0.4-2.2 second inference with at most 10.8 MB communication and accuracy comparable to transfer-learning baselines. Under the evaluated attacks, reusing the offloaded public encoder provides no significant advantage to model-extraction adversaries. Source code and a demo are available at https://github.com/CassiniHuy/gecko-infer.
