Securely and Efficiently Outsourcing Decision Tree Inference

Outsourcing machine learning inference services to the cloud is getting increasingly popular. However, this also entails privacy risks to the provider's proprietary model and the client's sensitive data. Focusing on inference with decision trees, this article proposes a framework for securely and efficiently outsourcing decision tree inference. Targeting both privacy and efficiency, we propose a customized protocol using only lightweight cryptography in the online execution of secure inference. We resort to additive secret sharing and tackle the problems in various components including secure input feature selection, decision node evaluation, and inference result generation. Our protocol requires no interaction from the provider and client during online secure inference, a distinct advantage over prior works for practical deployment as they all operate under the client-provider setting where synchronous and continuous interaction is required. Performance evaluation demonstrates our security design's efficiency, as well as substantial performance benefits for the client (up to four orders of magnitude in computation and 163 times in communication), as opposed to prior art in the non-outsourcing setting. To facilitate the practical usage for meeting more service demands, we also investigate the extensions for secure outsourced inference of random forests and categorical feature-based decision trees.

1 Introduction

The use of machine learning to empower automated data analytics has been gaining growing popularity in various applications domains, such as medical diagnosis [1], [2], [3], credit risk assessment [4], face recognition [5], and more. With a well-trained model in hand, machine learning inference enables automatic prediction for new inputs. With the prevalent adoption of cloud computing, outsourcing such inference services to the cloud is becoming increasingly popular [6], [7], due to the well-understood benefits of cloud computing [8]. Such practice, however, raises critical privacy concerns. First, the provider's model is often proprietary as training an effective model demands a significant investment of datasets, resources, and specialized skills. The provider would be naturally not willing to expose the model in cleartext to the cloud. Second, the client's data as input to the model could also be sensitive, like medical data or financial data. Directly providing the inputs in cleartext may easily violate the client's privacy. Therefore, it is essential to embed security in the inference outsourcing design from the very beginning so that the privacy of the proprietary model and the sensitive client data can be assured.