Bit-length for SqueezeNet inference

[waamm]

In the standard README of MP-SPDZ, it is suggested that SqueezeNet inference for ImageNet can be performed with a series of commands, including one starting with ./compile.py -R 64. When I try to compile and run it over a 64-bit prime field, I get Tape requires prime of bit length 84.

Where is the number 84 coming from?

[mkskeller]

The reason is the statistical masking introduced here: https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=baf1019ec7d406260bd0e358af47962eef6c9a69
It increases the bit length by the security parameter, which is 40 by default, so a bit length of 44 for a cleartext number translates to 84. The bit length of 44 in turn comes from the fact that program uses 12-bit fixed-point precision and 31-bit fixed-point length, the sum of which determines the bit length before truncation (there's an extra bit for safety).

[waamm]

Thanks! I had not seen that 44 figure anywhere.

If test.mpc is given by

a = sint(1)
a.reveal()

and I run ./compile.py test, followed by ./Scripts/shamir.sh -P 31 test, do the parties send 5 = log(31) bit shares to each other? (Data sent doesn't seem to change if I change the prime?) If so, is there a reason why

a = sint(1)
b = sint(2)
c = (a < b)

can't be similarly compiled and executed over a 50 rather than 106 bit prime field?

And if not, what does -P 31 do here?

[mkskeller]

MP-SPDZ operates with 64-bit words, so it sends at least 8 bytes per share even with modulus 31.

You can decrease the field size by decreasing the integer bit length, for example using -F 9 with compilation to fit 50 bits. Alternatively, you can specify a prime during compilation, which switches to protocols that works for smaller primes. However, they are not necessarily more efficient. See also https://mp-spdz.readthedocs.io/en/latest/non-linear.html

[waamm]

Thanks I was not aware that; I just tried with a 201-bit prime and bandwidth did go up indeed. I presume that these words are different for mixed circuits, where some computations are done over (an extension of?) $\mathbb{Z} / 2\mathbb{Z}$?

What was confusing me is that the first protocol allows me to be very flexible with the field size after I run ./compile.py test, whereas the second one is more strict; I suppose the reason for this is the non-linear operation.

[mkskeller]

Thanks I was not aware that; I just tried with a 201-bit prime and bandwidth did go up indeed. I presume that these words are different for mixed circuits, where some computations are done over (an extension of?) Z/2Z?

Yes, binary circuits also use bit packing for storage and communication. I haven't paid much attention to small prime moduli because the application isn't really clear whereas binary circuits have very clear applications.

What was confusing me is that the first protocol allows me to be very flexible with the field size after I run ./compile.py test, whereas the second one is more strict; I suppose the reason for this is the non-linear operation.

Indeed.

[waamm]

Quantised neural networks might be a potential application? If you decide on LSSS-based MPC here then adding 40 bits of statistical slack over a small field should be inefficient.

[mkskeller]

I'm happy to look into if I see some evidence.