Page 268 - 《软件学报》2026年第2期

余欢 等: Antelope: 基于 GPU 的三方隐私保护机器学习框架 747

表 7 模型预测准确率对比 (%)

模型 基准线 明文框架 Antelope
LeNet/MNIST 10 96.2 96.1
AlexNet/CIFAR-10 10 34.3 34.2
VGG-16/CIFAR-10 10 55.8 55.6

5 总 结

本文介绍了 Antelope, 一个三方隐私保护机器学习框架. Antelope 基于秘密分享技术保护数据隐私, 提出了在
GPU 上实现神经网络安全训练和预测的新协议. Antelope 建立在 PyTorch 框架之上, 并提供了相同的接口, 对于没
有密码学基础的使用者更为友好. 同时本文实验结果表明, 我们的线性层更好地利用了 GPU 的并行计算能力, 减
少 GPU 内存消耗. 所提安全比较协议减少了通信轮数, 大大提高了非线性层的计算速度, 进一步缩短了明文机器
学习和隐私保护机器学习之间的性能差距. 此外, 还支持大规模网络 (如 AlexNet 和 VGG-16) 的完整训练, 并能与
明文训练的网络模型保持相近的预测准确性.
此外, Antelope 具有良好的可扩展性, 并可用于联邦学习 (federated learning, FL) 场景. 现有的联邦学习框架 (如
FATE、TF Federated) 主要基于参数服务器架构或安全多方计算 (MPC) 协议进行训练, 而 Antelope 采用三方秘密
共享方法, 在保证数据隐私的同时减少计算和通信开销, 使其能够在 GPU 上高效运行. Antelope 的计算模型可以作
为联邦学习系统的安全计算后端, 以提供更高效的隐私保护计算能力. 未来, 我们计划扩展 Antelope 的适用范围, 支
持跨设备的异构计算, 并探索基于异步更新的高效联邦学习方案, 以进一步降低通信成本并提升系统的训练效率.

References
[1] Esteva A, Kuprel B, Novoa RA, Ko J, Swetter SM, Blau HM, Thrun S. Dermatologist-level classification of skin cancer with deep neural
networks. Nature, 2017, 542(7639): 115–118. [doi: 10.1038/nature21056]
[2] Angelini E, Di Tollo G, Roli A. A neural network approach for credit risk evaluation. The Quarterly Review of Economics and Finance,
2008, 48(4): 733–755. [doi: 10.1016/j.qref.2007.04.001]
[3] Dowlin N, Gilad-Bachrach R, Laine K, Lauter K, Naehrig M, Wernsing J. CryptoNets: Applying neural networks to encrypted data with
high throughput and accuracy. In: Proc. of the 33rd Int’l Conf. on Machine Learning. New York: JMLR.org, 2016. 201–210.
[4] Hesamifard E, Takabi H, Ghasemi M. CryptoDL: Deep neural networks over encrypted data. arXiv:1711.05189, 2017.
[5] Demmler D, Schneider T, Zohner M. ABY—A framework for efficient mixed-protocol secure two-party computation. In: Proc. of the
2015 Network Distributed System Security Symp. San Diego: The Internet Society, 2015. 1–15. [doi: 10.14722/ndss.2015.23113]
[6] Juvekar C, Vaikuntanathan V, Chandrakasan A. GAZELLE: A low latency framework for secure neural network inference. In: Proc. of
the 27th USENIX Security Symp. Baltimore: USENIX Association, 2018. 1651–1668.
[7] Reagen B, Choi WS, Ko Y, Lee VT, Lee HHS, Wei GY, Brooks D. Cheetah: Optimizing and accelerating homomorphic encryption for
private inference. In: Proc. of the 2021 IEEE Int’l Symp. on High-performance Computer Architecture (HPCA). Seoul: IEEE, 2021.
26–39. [doi: 10.1109/HPCA51647.2021.00013]
[8] Sanyal A, Kusner MJ, Gascón A, Kanade V. TAPAS: Tricks to accelerate (encrypted) prediction as a service. In: Proc. of the 35th Int’l
Conf. on Machine Learning. Stockholm: PMLR, 2018. 4490–4499.
3
[9] Mohassel P, Rindal P. ABY : A mixed protocol framework for machine learning. In: Proc. of the 2018 ACM SIGSAC Conf. on Computer
and Communications Security. Toronto: ACM, 2018. 35–52. [doi: 10.1145/3243734.3243760]
[10] Mohassel P, Zhang YP. SecureML: A system for scalable privacy-preserving machine learning. In: Proc. of the 2017 IEEE Symp. on
Security and Privacy (SP). San Jose: IEEE, 2017. 19–38. [doi: 10.1109/SP.2017.12]
[11] Shamir A. How to share a secret. Communications of the ACM, 1979, 22(11): 612–613. [doi: 10.1145/359168.35917]
[12] Wagh S, Gupta D, Chandran N. SecureNN: 3-party secure computation for neural network training. Proc. on Privacy Enhancing
Technologies, 2019(3): 26–49. [doi: 10.2478/popets-2019-0035]
[13] Wagh S, Tople S, Benhamouda F, Kushilevitz E, Mittal P, Rabin T. FALCON: Honest-majority maliciously secure framework for private
deep learning. Proc. on Privacy Enhancing Technologies, 2021(1): 188–208. [doi: 10.2478/popets-2021-0011]
[14] Tan SJ, Knott B, Tian Y, Wu DJ. CryptGPU: Fast privacy-preserving machine learning on the GPU. In: Proc. of the 2021 IEEE Symp. on
Security and Privacy (SP). San Francisco: IEEE, 2021. 1021–1038. [doi: 10.1109/SP40001.2021.00098]
[15] Chaudhari H, Choudhury A, Patra A, Suresh A. ASTRA: High throughput 3PC over rings with application to secure prediction. In: Proc.
of the 2019 ACM SIGSAC Conf. on Cloud Computing Security Workshop. London: ACM, 2019. 81–92. [doi: 10.1145/3338466.