Towards Anonymous Neural Network Inference

TL;DR

This paper presents funion, a system that enables fully anonymous neural network inference by combining mixnet-inspired protocols with a store-compute-store paradigm, ensuring privacy and unlinkability for users.

Contribution

Funion introduces a novel anonymous inference system that leverages existing cryptographic protocols and a store-compute-store model to achieve strong privacy guarantees in neural network inference.

Findings

Funion provides provable security guarantees similar to Echomix.

The system effectively masks traffic patterns and workload characteristics.

Acceptable overhead is demonstrated for large-scale workloads.

Abstract

We introduce funion, a system providing end-to-end sender-receiver unlinkability for neural network inference. By leveraging the Pigeonhole storage protocol and BACAP (blinding-and-capability) scheme from the Echomix anonymity system, funion inherits the provable security guarantees of modern mixnets. Users can anonymously store input tensors in pseudorandom storage locations, commission compute services to process them via the neural network, and retrieve results with no traceable connection between input and output parties. This store-compute-store paradigm masks both network traffic patterns and computational workload characteristics, while quantizing execution timing into public latency buckets. Our security analysis demonstrates that funion inherits the strong metadata privacy guarantees of Echomix under largely the same trust assumptions, while introducing acceptable overhead for production-scale workloads. Our work paves the way towards an accessible platform where users can submit fully anonymized inference queries to cloud services.