More Efficient Oblivious Transfer Extensions

Asharov, Gilad; Lindell, Yehuda; Schneider, Thomas; Zohner, Michael

doi:10.1007/s00145-016-9236-6

Cited by 40 publications

(42 citation statements)

References 52 publications

(194 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our results show that, we are not only able to provide the first sublinear communication cost for large trees, but also reduce the computation and communication costs for mid-size to large real-world data set compared to the best related work. In future work, we intend to evaluate our scheme with other frameworks such as JustGarble [6], SCAPI [25], SPDZ [21], MASCOT [39] and efficient OT extension protocols [2,3,38,41,56].…”

Section: Resultsmentioning

confidence: 99%

“…In [36] the authors describe a hybrid cryptographic technique to extend a constant number of OTs to polynomially many OTs using symmetric cryptography. Recently, the OT extension protocol was improved by [2,3,38]. There are also number of 1-out-of-n OT protocols (OT 1 n ).…”

Section: Oblivious Transfermentioning

confidence: 99%

“…Moreover, it has other advantages. First, it can be further optimized, e.g., by using the efficient OT extension [2,3,41] and fast garbling (e.g., JustGarble [6]), which are not yet implemented in ObliVM. In [49], it is estimated that combining ObliVM with JustGarble may reduce the time to compare 16384 bit Integers from 26 ms (using the original ObliVM as in our experiments) to 1.96 ms.…”

Section: Performance On Uci Datasetsmentioning

confidence: 99%

“…In [49], it is estimated that combining ObliVM with JustGarble may reduce the time to compare 16384 bit Integers from 26 ms (using the original ObliVM as in our experiments) to 1.96 ms. The scheme of [2,3] significantly reduces the runtime and bandwidth costs of the OT extension protocol to 41% and 50% respectively. OAI with OT can be implemented with the OT 1 n of [41] which improves upon [54] by a factor ≈ 5.39.…”

Section: Performance On Uci Datasetsmentioning

confidence: 99%

See 3 more Smart Citations

Private Evaluation of Decision Trees using Sublinear Cost

Tueno

Kerschbaum

Katzenbeisser

2018

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Decision trees are widespread machine learning models used for data classification and have many applications in areas such as healthcare, remote diagnostics, spam filtering, etc. In this paper, we address the problem of privately evaluating a decision tree on private data. In this scenario, the server holds a private decision tree model and the client wants to classify its private attribute vector using the server’s private model. The goal is to obtain the classification while preserving the privacy of both – the decision tree and the client input. After the computation, only the classification result is revealed to the client, while nothing is revealed to the server. Many existing protocols require a constant number of rounds. However, some of these protocols perform as many comparisons as there are decision nodes in the entire tree and others transform the whole plaintext decision tree into an oblivious program, resulting in higher communication costs. The main idea of our novel solution is to represent the tree as an array. Then we execute only d – the depth of the tree – comparisons. Each comparison is performed using a small garbled circuit, which output secret-shares of the index of the next node. We get the inputs to the comparison by obliviously indexing the tree and the attribute vector. We implement oblivious array indexing using either garbled circuits, Oblivious Transfer or Oblivious RAM (ORAM). Using ORAM, this results in the first protocol with sub-linear cost in the size of the tree. We implemented and evaluated our solution using the different array indexing procedures mentioned above. As a result, we are not only able to provide the first protocol with sublinear cost for large trees, but also reduce the communication cost for the large real-world data set “Spambase” from 18 MB to 1[triangleright]2 MB and the computation time from 17 seconds to less than 1 second in a LAN setting, compared to the best related work.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Oblivious Transfermentioning

confidence: 99%

Section: Performance On Uci Datasetsmentioning

confidence: 99%

Section: Performance On Uci Datasetsmentioning

confidence: 99%

See 2 more Smart Citations

Private Evaluation of Decision Trees using Sublinear Cost

Tueno

Kerschbaum

Katzenbeisser

2018

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…cious client: Since the only messages sent by the client are in the OTs, one can use OT extension with security against malicious clients, e.g., [ALSZ15, KOS15,ALSZ17], which are only slightly less efficient than OT extension with passive security. This adds little overhead, whereas securing the other solutions against malicious clients needs more expensive conditional OTs or zero-knowledge proofs, e.g., as for HHH [TMZC17].…”

Section: Hhh: Sel H + Comp H + Pathmentioning

confidence: 99%

SoK: Modular and Efficient Private Decision Tree Evaluation

Kiss

Naderpour

Liu

et al. 2019

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

Decision trees and random forests are widely used classifiers in machine learning. Service providers often host classification models in a cloud service and provide an interface for clients to use the model remotely. While the model is sensitive information of the server, the input query and prediction results are sensitive information of the client. This motivates the need for private decision tree evaluation, where the service provider does not learn the client’s input and the client does not learn the model except for its size and the result. In this work, we identify the three phases of private decision tree evaluation protocols: feature selection, comparison, and path evaluation. We systematize constant-round protocols for each of these phases to identify the best available instantiations using the two main paradigms for secure computation: garbling techniques and homomorphic encryption. There is a natural tradeoff between runtime and communication considering these two paradigms: garbling techniques use fast symmetric-key operations but require a large amount of communication, while homomorphic encryption is computationally heavy but requires little communication. Our contributions are as follows: Firstly, we systematically review and analyse state-of-the-art protocols for the three phases of private decision tree evaluation. Our methodology allows us to identify novel combinations of these protocols that provide better tradeoffs than existing protocols. Thereafter, we empirically evaluate all combinations of these protocols by providing communication and runtime measures, and provide recommendations based on the identified concrete tradeoffs.

show abstract