Training a neural network in the dark

Most secure-computation work asks: given a fixed computation, how do we run it privately and fast? Piranha asked something harder and more practical — it was the first system to train a neural network end to end under secure computation. Training, unlike inference, is a moving target: much of the real work is finding the right computation, not just running a given one.

Here’s the catch that never shows up in a complexity analysis. When you train privately, you’re flying blind. You can’t inspect activations, gradients, or intermediate values — that’s the entire point of privacy. So when the model doesn’t learn, you’re left with one ambiguous signal: the accuracy is low.

Low accuracy could mean almost anything: a real optimization difficulty, a subtly wrong fixed-point truncation, an overflow in one layer. In cleartext you’d drop in a print and know in minutes. Under MPC every value is a secret share — there is nothing to print.

For secure computation to achieve it’s dream, we will need contributions not just about raw speed but also about robust, trustworthy primitives and sufficiently debuggability. As systems become increasingly capable at exploration, debugging, and hypothesis generation, the primary bottleneck in privacy-sensitive analytics will shift from executing computations to discovering them. Future privacy-preserving systems will therefore optimize not only for confidential execution, but for confidential exploration: enabling humans and AI agents to iteratively search over vast spaces of models, queries, and hypotheses while revealing substantially less raw data than is required today. The long-term equilibrium is neither unrestricted data access nor fully opaque one-shot computation, but a spectrum of interactive discovery mechanisms that provide just enough information to find useful computations without exposing the underlying data itself.

PDF Code Piranha · USENIX Security 2022