Skip to main content Skip to main navigation


CryptoSPN: Privacy-Preserving Sum-Product Network Inference

Amos Treiber; Alejandro Molina; Christian Weinert; Thomas Schneider; Kristian Kersting
In: Giuseppe De Giacomo; Alejandro Catalá; Bistra Dilkina; Michela Milano; Senén Barro; Alberto Bugarín; Jérôme Lang (Hrsg.). 24th European Conference on Artificial Intelligence. European Conference on Artificial Intelligence (ECAI-2020), August 29 - September 8, Santiago de Compostela, Spain, Pages 1946-1953, Frontiers in Artificial Intelligence and Applications, Vol. 325, IOS Press, 2020.


AI algorithms, and machine learning (ML) techniques in particular, are increasingly important to individuals' lives, but have caused a range of privacy concerns addressed by, e.g., the European GDPR. Using cryptographic techniques, it is possible to perform inference tasks remotely on sensitive client data in a privacy-preserving way: the server learns nothing about the input data and the model predictions, while the client learns nothing about the ML model (which is often considered intellectual property and might contain traces of sensitive data). While such privacy-preserving solutions are relatively efficient, they are mostly targeted at neural networks, can degrade the predictive accuracy, and usually reveal the network's topology. Furthermore, existing solutions are not readily accessible to ML experts, as prototype implementations are not well-integrated into ML frameworks and require extensive cryptographic knowledge. In this paper, we present CryptoSPN, a framework for privacy-preserving inference of sum-product networks (SPNs). SPNs are a tractable probabilistic graphical model that allows a range of exact inference queries in linear time. Specifically, we show how to efficiently perform SPN inference via secure multi-party computation (SMPC) without accuracy degradation while hiding sensitive client and training information with provable security guarantees. Next to foundations, CryptoSPN encompasses tools to easily transform existing SPNs into privacy-preserving executables. Our empirical results demonstrate that CryptoSPN achieves highly efficient and accurate inference in the order of seconds for medium-sized SPNs.

Weitere Links