---
title: Connectionist Symbolic Pseudo-Secret Scheme
url: https://www.emergentmind.com/topics/connectionist-symbolic-pseudo-secret-scheme
type: topic
---

# Connectionist Symbolic Pseudo-Secret Scheme

Connectionist Symbolic Pseudo-Secret Scheme (CSPS) is a heuristic obfuscation protocol for neural network inference when deploying on untrusted computational resources, such as cloud or edge devices. CSPS leverages Holographic Reduced Representations (HRRs) and U-Net backbone architectures to pseudo-encrypt both input data and feature maps, aiming to conceal both inputs and outputs from an honest-but-curious adversary with access to all intermediate computations but not to per-sample secret keys. While not offering provable cryptographic security, CSPS achieves significant practical robustness to a wide range of attacks at a fraction of the computational and communication overhead required by traditional secure computation protocols [2206.05893].

## 1. Security Threat Model and Requirements

The CSPS threat model assumes an adversary capable of observing pseudo-encrypted inputs, all intermediate feature maps, and the pseudo-encrypted outputs from the main neural network (backbone). The adversary is "honest-but-curious," may perform arbitrary computations including white-box attacks, and may know the training data and labels. However, the adversary does not have access to the per-sample secret key vectors $\{s_i\}$ or the unbinding operation.

Key security assumptions:
- Each secret $s_i$ is sampled independently for every input (both training and inference) and never reused.
- The untrusted host never learns the value of $s_i$ nor the details of the unbinding operation.
- The adversary may issue chosen-plaintext queries but cannot access the secret keys.

CSPS is not formally cryptographically secure; rather, it provides empirical robustness to chosen-plaintext and white-box attacks. This tradeoff enables significant efficiency over methods based on homomorphic encryption (HE) or secure multiparty computation (SMC) [2206.05893].

## 2. Pseudo-Secret Encoding via 2D Holographic Reduced Representations

CSPS employs a binding mechanism based on 2D Holographic Reduced Representations (2D HRRs). Each image or feature map $x \in \mathbb{R}^{W \times H \times D}$ and a random secret $s \in \mathbb{R}^{W \times H \times D}$ are bound through a 2D circular convolution (denoted by $\circledast$), where:

$$
B = x \circledast s = \mathcal{F}^{-1}\left( \mathcal{F}(x) \odot \mathcal{F}(s) \right)
$$

$\mathcal{F}$ and $\mathcal{F}^{-1}$ denote the 2D discrete Fourier transform (DFT) and its inverse, applied channel-wise; $\odot$ is complex element-wise multiplication.

Unbinding is performed using a point-wise inverse $s^\dagger$ in Fourier space:

$$
x \approx B \circledast s^\dagger,\quad \text{where}\quad \mathcal{F}(s^\dagger) = 1 / \mathcal{F}(s)
$$

Construction of per-sample secret keys $s_i$:
1. For each input, sample $\tilde{s} \sim \mathcal{N}(0, 1/(WH\!D))^{W \times H \times D}$.
2. Project in the frequency domain to unit magnitude: $s = \mathcal{F}^{-1} \left( \mathcal{F}(\tilde{s}) / |\mathcal{F}(\tilde{s})| \right)$, ensuring $|\mathcal{F}(s)| = 1$ everywhere. This choice ensures $s^\dagger = \mathcal{F}^{-1}( \text{conj}(\mathcal{F}(s)) )$.

Without the correct $s$, the bound result is indistinguishable from noise; with $s$, unbinding perfectly recovers the input (modulo numerical precision).

## 3. Neural Network Architecture and Training Workflow

CSPS modifies standard neural network deployment with a tripartite architecture:

- **Backbone $f_W$**: A U-Net CNN whose input and output dimensions match those of the image. Operates entirely on the untrusted host, was selected for its performance in preserving encoded feature integrity.
- **Local Prediction Net $f_P$**: A small CNN/MLP on the trusted client that first unbinds the backbone output $r$ via $r \circledast s^\dagger$ before class probability prediction.
- **Local Adversarial Net $f_A$**: An identical network to $f_P$, operating on $r$ without knowledge of $s^\dagger$. Gradient reversal [Ganin & Lempitsky 2016] is used so $f_W$ is penalized for producing features informative to an attacker lacking $s$.

**Training loop for each sample $(x_i, y_i)$:**
- Sample fresh key $s_i$.
- Bind input: $\hat{x}_i = x_i \circledast s_i$; send $\hat{x}_i$ to the untrusted host.
- The host returns $r_i = f_W(\hat{x}_i)$.
- Compute predictions: $\hat{y}_P = f_P(r_i \circledast s_i^\dagger)$, $\hat{y}_A = \text{ReverseGrad}(f_A(r_i))$.
- Joint loss: $\ell(\hat{y}_P, y_i) + \ell(\hat{y}_A, y_i)$. All parameters are updated.

This adversarial logic forces the intermediate representation $r$ to be informative only when unbound with $s_i^\dagger$ and uninformative otherwise.

## 4. Adversarial Robustness and Security Properties

No formal cryptographic assumptions underpin CSPS; instead, empirical evidence demonstrates strong robustness to powerful attack scenarios:

- **Cluster Recovery**: Clustering encoded outputs to recover labels yields an Adjusted Rand Index $\lesssim 0.2\%$, which is at chance.
- **Adversarial Network Accuracy**: An $f_A$ trained on $(r_i, y_i)$ without key achieves only 10–20% accuracy for 10-class benchmarks (random baseline: 10%) and 2–5% for 100-class tasks (random: 1%).
- **Model Inversion**: Attacks optimizing Fréchet Inception Distance (FID) to reconstruct $x$ from $\hat{x}$ fail to produce recognizable images.
- **Theoretical Linear Analysis**: Training a linear classifier $w^\top(x \circledast s)$ without access to $s$ yields Rademacher complexity $O(n)$, indicating no statistically meaningful generalization (Theorem 1).

Security, while not provable, empirically holds even under white-box adversaries with complete model and data access except for per-sample secret keys [2206.05893].

## 5. Computational Overheads and Accuracy Impact

CSPS achieves substantial efficiency and accuracy preservation:

- **Computation & Communication**: Binding and unbinding operations are implemented as FFTs or 1×1 convolutions—efficiently supported in deep learning frameworks. About 65–75% of FLOPs are offloaded to the untrusted host; 25–35% remain local.
- **Runtime Comparison**: Against leading HE/OT hybrid protocols, CSPS is ~5,000× faster and sends ~18,000× less data per prediction.
- **Test Set Inference Latency**: For MNIST, 4.6 s vs. ~2 h 46 m (HE). For CIFAR-10, 7.6 s vs. ~21 h 20 m. Mini-ImageNet inference completes in 28 s (HE does not finish in 24 h).
  
**Table: Representative CSPS Tradeoffs**

| Dataset      | Base Top-1 | CSPS Single-Shot | CSPS (Avg $k\!\leq\!10$) |
|:------------:|:----------:|:----------------:|:------------------------:|
| CIFAR-10     | 83.6%      | 78.2%            | 82.8%                    |
| MNIST        | [see Table 1 in 2206.05893]  | [see Table 1]            | [see Table 1]             |
| Mini-ImageNet| [see Table 1] | [see Table 1]  | [see Table 1]            |

Averaging $k \leq 10$ predictions (independent keys) recovers approximately 99% of original accuracy.

Ablation experiments confirm that both the U-Net backbone and 2D HRR are critical. Replacement with 1D HRR, VTB, ResNet-50, or Hilbert-curve + 1D HRR yield $\leq$60% accuracy on CIFAR-10.

## 6. Experimental Highlights and Empirical Observations

Key empirical results:

- **Obfuscation Integrity**: UMAP visualizations (Figs. 5–7) demonstrate that encoded features are class-indistinguishable, while unbound features accurately recover class clusters.
- **Adversarial Performance**: White-box adversarial network performance remains $\lesssim4.7\times$ the random baseline (see Table 4).
- **Cluster Robustness**: Clustering ARI remains $\lesssim$1.5% for all clusterers and datasets (Table 5).
- **Failure of Inversion Attacks**: FID-based and autoencoder-based inversion attacks are unable to reconstruct the original data.
- **Compute/Locality**: Table 3 in [2206.05893] details proportion of computation offloaded versus local.
- **Accuracy-Throughput Scalability**: Fig. 3 shows that nearly full accuracy is recovered by averaging over $k\approx10$ random keys.

CSPS provides a practical "pseudo-encryption" mechanism: a fast, lightweight protocol that empirically obfuscates user data against attackers beyond the intended threat model, while retaining nearly full neural network accuracy with minimal system and latency overhead [2206.05893].

Source: https://www.emergentmind.com/topics/connectionist-symbolic-pseudo-secret-scheme