Connectionist Symbolic Pseudo-Secret Scheme

• CSPS is a heuristic obfuscation protocol that binds inputs and feature maps using 2D HRRs to protect data from honest-but-curious adversaries.
• It leverages a U-Net backbone and per-sample secret keys to efficiently enable decryption on trusted clients while maintaining data privacy.
• Experiments demonstrate that CSPS achieves significant speed improvements and robustness, with up to 5,000× faster performance and minimal accuracy loss against advanced attacks.

Connectionist Symbolic Pseudo-Secret Scheme (CSPS) is a heuristic obfuscation protocol for neural network inference when deploying on untrusted computational resources, such as cloud or edge devices. CSPS leverages Holographic Reduced Representations (HRRs) and U-Net backbone architectures to pseudo-encrypt both input data and feature maps, aiming to conceal both inputs and outputs from an honest-but-curious adversary with access to all intermediate computations but not to per-sample secret keys. While not offering provable cryptographic security, CSPS achieves significant practical robustness to a wide range of attacks at a fraction of the computational and communication overhead required by traditional secure computation protocols (Alam et al., 2022).

1. Security Threat Model and Requirements

The CSPS threat model assumes an adversary capable of observing pseudo-encrypted inputs, all intermediate feature maps, and the pseudo-encrypted outputs from the main neural network (backbone). The adversary is "honest-but-curious," may perform arbitrary computations including white-box attacks, and may know the training data and labels. However, the adversary does not have access to the per-sample secret key vectors $\{s_i\}$ or the unbinding operation.

Key security assumptions:

• Each secret $s_i$ is sampled independently for every input (both training and inference) and never reused.
• The untrusted host never learns the value of $s_i$ nor the details of the unbinding operation.
• The adversary may issue chosen-plaintext queries but cannot access the secret keys.

CSPS is not formally cryptographically secure; rather, it provides empirical robustness to chosen-plaintext and white-box attacks. This tradeoff enables significant efficiency over methods based on homomorphic encryption (HE) or secure multiparty computation (SMC) (Alam et al., 2022).

2. Pseudo-Secret Encoding via 2D Holographic Reduced Representations

CSPS employs a binding mechanism based on 2D Holographic Reduced Representations (2D HRRs). Each image or feature map $x \in \mathbb{R}^{W \times H \times D}$ and a random secret $s \in \mathbb{R}^{W \times H \times D}$ are bound through a 2D circular convolution (denoted by $\circledast$), where:

$$B = x \circledast s = \mathcal{F}^{-1}\left( \mathcal{F}(x) \odot \mathcal{F}(s) \right)$$

$\mathcal{F}$ and $\mathcal{F}^{-1}$ denote the 2D discrete Fourier transform (DFT) and its inverse, applied channel-wise; $\odot$ is complex element-wise multiplication.

Unbinding is performed using a point-wise inverse $s_i$0 in Fourier space:

$s_i$1

Construction of per-sample secret keys $s_i$2:

1. For each input, sample $s_i$3.
2. Project in the frequency domain to unit magnitude: $s_i$4, ensuring $s_i$5 everywhere. This choice ensures $s_i$6.

Without the correct $s_i$7, the bound result is indistinguishable from noise; with $s_i$8, unbinding perfectly recovers the input (modulo numerical precision).

3. Neural Network Architecture and Training Workflow

CSPS modifies standard neural network deployment with a tripartite architecture:

• Backbone $s_i$9: A U-Net CNN whose input and output dimensions match those of the image. Operates entirely on the untrusted host, was selected for its performance in preserving encoded feature integrity.
• Local Prediction Net $s_i$0: A small CNN/MLP on the trusted client that first unbinds the backbone output $s_i$1 via $s_i$2 before class probability prediction.
• Local Adversarial Net $s_i$3: An identical network to $s_i$4, operating on $s_i$5 without knowledge of $s_i$6. Gradient reversal [Ganin & Lempitsky 2016] is used so $s_i$7 is penalized for producing features informative to an attacker lacking $s_i$8.

Training loop for each sample $s_i$9:

• Sample fresh key $x \in \mathbb{R}^{W \times H \times D}$0.
• Bind input: $x \in \mathbb{R}^{W \times H \times D}$1; send $x \in \mathbb{R}^{W \times H \times D}$2 to the untrusted host.
• The host returns $x \in \mathbb{R}^{W \times H \times D}$3.
• Compute predictions: $x \in \mathbb{R}^{W \times H \times D}$4, $x \in \mathbb{R}^{W \times H \times D}$5.
• Joint loss: $x \in \mathbb{R}^{W \times H \times D}$6. All parameters are updated.

This adversarial logic forces the intermediate representation $x \in \mathbb{R}^{W \times H \times D}$7 to be informative only when unbound with $x \in \mathbb{R}^{W \times H \times D}$8 and uninformative otherwise.

4. Adversarial Robustness and Security Properties

No formal cryptographic assumptions underpin CSPS; instead, empirical evidence demonstrates strong robustness to powerful attack scenarios:

• Cluster Recovery: Clustering encoded outputs to recover labels yields an Adjusted Rand Index $x \in \mathbb{R}^{W \times H \times D}$9, which is at chance.
• Adversarial Network Accuracy: An $s \in \mathbb{R}^{W \times H \times D}$0 trained on $s \in \mathbb{R}^{W \times H \times D}$1 without key achieves only 10–20% accuracy for 10-class benchmarks (random baseline: 10%) and 2–5% for 100-class tasks (random: 1%).
• Model Inversion: Attacks optimizing Fréchet Inception Distance (FID) to reconstruct $s \in \mathbb{R}^{W \times H \times D}$2 from $s \in \mathbb{R}^{W \times H \times D}$3 fail to produce recognizable images.
• Theoretical Linear Analysis: Training a linear classifier $s \in \mathbb{R}^{W \times H \times D}$4 without access to $s \in \mathbb{R}^{W \times H \times D}$5 yields Rademacher complexity $s \in \mathbb{R}^{W \times H \times D}$6, indicating no statistically meaningful generalization (Theorem 1).

Security, while not provable, empirically holds even under white-box adversaries with complete model and data access except for per-sample secret keys (Alam et al., 2022).

5. Computational Overheads and Accuracy Impact

CSPS achieves substantial efficiency and accuracy preservation:

• Computation & Communication: Binding and unbinding operations are implemented as FFTs or 1×1 convolutions—efficiently supported in deep learning frameworks. About 65–75% of FLOPs are offloaded to the untrusted host; 25–35% remain local.
• Runtime Comparison: Against leading HE/OT hybrid protocols, CSPS is ~5,000× faster and sends ~18,000× less data per prediction.
• Test Set Inference Latency: For MNIST, 4.6 s vs. ~2 h 46 m (HE). For CIFAR-10, 7.6 s vs. ~21 h 20 m. Mini-ImageNet inference completes in 28 s (HE does not finish in 24 h).

Table: Representative CSPS Tradeoffs

Dataset	Base Top-1	CSPS Single-Shot	CSPS (Avg $s \in \mathbb{R}^{W \times H \times D}$7)
CIFAR-10	83.6%	78.2%	82.8%
MNIST	[see Table 1 in (Alam et al., 2022)]	[see Table 1]	[see Table 1]
Mini-ImageNet	[see Table 1]	[see Table 1]	[see Table 1]

Averaging $s \in \mathbb{R}^{W \times H \times D}$8 predictions (independent keys) recovers approximately 99% of original accuracy.

Ablation experiments confirm that both the U-Net backbone and 2D HRR are critical. Replacement with 1D HRR, VTB, ResNet-50, or Hilbert-curve + 1D HRR yield $s \in \mathbb{R}^{W \times H \times D}$960% accuracy on CIFAR-10.

6. Experimental Highlights and Empirical Observations

Key empirical results:

• Obfuscation Integrity: UMAP visualizations (Figs. 5–7) demonstrate that encoded features are class-indistinguishable, while unbound features accurately recover class clusters.
• Adversarial Performance: White-box adversarial network performance remains $\circledast$0 the random baseline (see Table 4).
• Cluster Robustness: Clustering ARI remains $\circledast$11.5% for all clusterers and datasets (Table 5).
• Failure of Inversion Attacks: FID-based and autoencoder-based inversion attacks are unable to reconstruct the original data.
• Compute/Locality: Table 3 in (Alam et al., 2022) details proportion of computation offloaded versus local.
• Accuracy-Throughput Scalability: Fig. 3 shows that nearly full accuracy is recovered by averaging over $\circledast$2 random keys.

CSPS provides a practical "pseudo-encryption" mechanism: a fast, lightweight protocol that empirically obfuscates user data against attackers beyond the intended threat model, while retaining nearly full neural network accuracy with minimal system and latency overhead (Alam et al., 2022).