DReLU Protocol

DReLU protocols operate on boolean secret shares of the input, where each bit of a value is shared independently. The core task is to securely compute the most significant bit (MSB) of a shared integer, which determines if the value is positive. This is achieved by evaluating a boolean circuit using protocols like Garbled Circuits or Goldreich-Micali-Wigderson (GMW) , where XOR gates are free and AND gates require interaction. The derivative is 1 if the MSB is 0 (positive) and 0 otherwise.

The primary cost of a DReLU protocol is the number of communication rounds and total bandwidth consumed. Naive implementations require a round for every AND gate in the comparison circuit, leading to high latency. Optimized protocols use techniques like precomputed Beaver triples to shift work to an offline phase, enabling a constant number of rounds in the online phase. The communication complexity is typically O(κ) bits, where κ is the computational security parameter, making it independent of the bit-length of the input.

A modern and highly efficient method for DReLU uses Function Secret Sharing (FSS) , specifically Distributed Point Functions (DPFs) . The parties securely evaluate a distributed comparison function that outputs a secret share of 1 if the input is greater than 0. This approach achieves extremely low communication in the online phase, often requiring only a single round and bandwidth proportional to the security parameter, making it ideal for wide-area network (WAN) deployments with high latency.

It is crucial to distinguish the DReLU protocol from a standard ReLU protocol. ReLU(x) = max(0, x) outputs the value itself, requiring a secure multiplexer to select between x and 0. DReLU(x) outputs only a single bit (0 or 1), representing the gradient. In backpropagation, the DReLU output is multiplied by an upstream gradient. This multiplication is a separate, cheap local operation on secret shares, meaning the DReLU protocol itself does not need to perform arithmetic multiplication.

In fixed-point arithmetic used by MPC frameworks, DReLU is tightly coupled with truncation protocols. After a matrix multiplication, the result must be truncated to maintain precision. The DReLU's correctness depends on whether the truncation is performed before or after the activation check. Protocols like SecureML and ABY3 carefully sequence these steps, often using a probabilistic truncation that introduces a tiny error to avoid a full-bit comparison, significantly reducing the cost of the combined linear layer and activation.

Upgrading a DReLU protocol from semi-honest to malicious security introduces significant overhead. In the semi-honest model, parties follow the protocol correctly. Malicious security requires Message Authentication Codes (MACs) on shares, as in the SPDZ family of protocols, to detect cheating. For DReLU, this means every AND gate in the boolean circuit must be verified, or FSS outputs must be authenticated. This can increase computation by an order of magnitude but is essential for truly distrusting multi-party settings.

A foundational cryptographic method where a value is split into random shares distributed among parties. No single share reveals anything about the original value. In DReLU, inputs to the activation function are additively secret-shared across computing parties. Reconstruction is only possible when a qualified subset of parties combines their shares, ensuring data remains private during the entire computation.

Introduced by Andrew Yao, this protocol allows two parties to jointly evaluate a Boolean circuit over private inputs. One party garbles the circuit by encrypting truth tables; the other evaluates it obliviously. DReLU protocols often use garbled circuits for the non-linear comparison step, as ReLU's derivative is a simple threshold check (x > 0) that maps efficiently to Boolean logic.

A fundamental primitive where a sender transmits one of many messages, but remains oblivious to which one was selected. OT is the core communication mechanism within garbled circuit evaluation. In DReLU implementations, OT Extension is critical for performance, efficiently expanding a small number of base OTs into millions using only fast symmetric-key cryptography, dramatically reducing the online phase latency.

Pre-computed, secret-shared multiplication triples (a, b, c) where c = a * b. These are generated in an offline preprocessing phase and consumed during the online phase to perform efficient, non-interactive multiplications on secret-shared values. While DReLU focuses on comparison, the surrounding neural network layers rely heavily on Beaver triples for secure matrix multiplications in the linear layers.

A critical garbled circuit optimization where XOR gates require no cryptographic operations and no associated ciphertexts. The evaluator simply XORs the wire labels. Since DReLU's comparison circuit can be expressed with a mix of AND and XOR gates, Free-XOR dramatically reduces both computation and communication overhead, making private activation evaluation practical for deep networks.

The broader paradigm of running a trained model for prediction on private input data using secure multi-party computation. DReLU is a specific sub-protocol within this stack. In a typical deployment, the model owner and data owner jointly compute the inference: linear layers use secret sharing and Beaver triples, while activation functions like ReLU and its derivative use specialized protocols like DReLU to handle non-linearity efficiently.