---
title: "SecureCROWN：首个隐私保护神经网络鲁棒性验证框架"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05251v1"
permalink: "https://feed.astralor.com/items/itm_98183cad7c73680104f70d53"
published: "2026-07-06T15:59:17.000Z"
score: 79
channel: "tech"
tags: ["SecureCROWN","安全两方计算","线性界传播","隐私保护","鲁棒性验证"]
---

# SecureCROWN：首个隐私保护神经网络鲁棒性验证框架

## AI 点评

> 这篇论文真正让人兴奋的点在于它用密码学+形式化验证的交叉思路，解决了实际中‘又想验，又怕看’的尴尬。对于医疗AI或金融风控团队而言，SecureCROWN意味着不需要交出模型权重或脱敏数据就能完成合规审计，这将是合规落地的关键踏板。顺便说一句，把条件分支改成连续算术运算这个trick非常巧妙，值得关注。

## 速览

神经网络验证与数据隐私存在固有矛盾。SecureCROWN基于安全两方计算（2PC），允许模型所有者和数据所有者联合计算认证鲁棒性边界，仅输出最终结果，同时保护双方隐私。通过将条件逻辑转化为连续算术运算，消除线性界传播中的分支，并引入牛顿-拉夫森精化方法提升数值稳定性。实验表明，SecureCROWN严格匹配明文验证结果，在0.1-200秒内完成不同规模模型验证，验证了隐私保护神经网络验证的可行性。

## 关键点

- 首次提出隐私保护神经网络鲁棒性验证框架SecureCROWN，解决验证需求与数据隐私冲突
- 基于安全两方计算（2PC）设计，仅公开最终验证结果，保护模型参数和输入数据
- 通过将条件逻辑转化为连续算术运算消除分支，避免标准安全计算协议的不兼容
- 引入牛顿-拉夫森精化方法提升数值稳定性，实验验证结果严格匹配明文验证

## 全文

Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_98183cad7c73680104f70d53