Neural network obfuscation Neural networks are trained to minimize some error function over the weights of the neural connections. In some applications, these weights could be considered intellectual property. Is there a way to encrypt these weights and still have an operational neural network?
Some context: I'm trying to scale a neural network algorithm, but right now we're doing all the computations on a centralized server and it's getting bogged down. We can shift the computation to the client side, but we don't want someone to unpack the executable and obtain the weights of the network. Is there some way to distribute an &quot;encrypted neural network&quot; such that our IP is protected?
To clarify: I am not talking about &quot;oblivious&quot; neural networks that operate on encrypted data, I am talking about the weights of the neural network themselves.
I'm fine with alternative obfuscation techniques.
Edit: I found this paper, but it states

Great attention
is paid to avoid any unnecessary disclosure of information,
so that at the end of the protocol the user only knows
the final NN output, whereas all internal computations are
kept secret. In this way, the possibility for a malevolent user
to provide a set of fake inputs properly selected to disclose
the network secrets is prevented. A solution is also sketched
that permits to obfuscate the network topology, however, a
deeper investigation in this direction is left for future research.

indicating that this paper is on a related concept, but I'm looking for a resource where the topology is obfuscated.
No.  What you want is probably not achievable in practice, because the approach you are considering obfuscates only the weights but does not obfuscate the inputs and outputs to the network.  In any reasonable ischeme I can imagine, the input $x$ to the obfuscated network will be known and under the attacker's control, and the output $y$ from the obfuscated network will be known to the attacker.  In particular, the attacker can pick any $x$ of his choice, and observe the output $y$.

If that is true, your goose is cooked.  The attacker can use the ability to invoke your neural network to learn his own neural network that is just as good as yours.  In particular, the attacker can assemble an arbitrarily large training set by picking many potential inputs $x$ and for each one computing the corresponding $y$ by running your obfuscated network on $x$, then putting the pair $(x,y)$ in the training set.  This doesn't require labelled examples; it only requires the adversary to be able to put together a large set of unlabelled instances (and then use your obfuscated network to label those instances).  Typically, it's not too hard for someone to create a large set of unlabelled instances.

Finally, once the adversary has assembled this training set, the adversary can train their own neural network using standard techniques.  It's likely that the resulting neural network will be approximately as good as yours -- i.e., have approximately the same accuracy.  (This is what seems to happen in practice.)

As a result, no obfuscation scheme for obfuscating the weights is likely to be terribly effective, because that doesn't hide the inputs and outputs to the network.  The most you can hope for is a scheme that acts as a "speed bump" that slightly increases the cost of de-obfuscation or that raises the bar a little bit, but nothing you do will provide strong security against a knowledgeable adversary.  So, don't spend too much time or energy or money on trying to make this work.  Instead, you might be better off looking for other ways to deal with this issue.



P.S. Even if you could hide the outputs and reveal only the ultimate classification (i.e., hide the continuous probability values from the softmax and just reveal the highest-probability class), that's probably still not enough.  Revealing the class is still enough for an adversary to label a bunch of instances, create a training set, and then train their own network.