EzPC Secure-Computing Framework

• EzPC is a secure-computation framework that bridges high-level ML programming with low-level cryptographic primitives, enabling privacy-preserving operations.
• It compiles C-like code into secure 2PC protocols using SecFloat, supporting both modular neural network training and inference tasks.
• Empirical comparisons show EzPC’s fast garbled-circuit evaluation for CNN inference while highlighting efficiency and privacy challenges in MARL.

Searching arXiv for papers on EzPC to ground the article and verify relevant citations. EzPC is a secure-computation framework used as both a programming environment and an empirical baseline in privacy-preserving machine learning. In the MARL setting, it is described as “a user-friendly, high-level C-like language that allows developers to express functions to be computed using 2PC (2 Party Computation) without requiring the developer to have any cryptographic knowledge,” and its compiler “generates a secure computation protocol for the entire function based on SecFloat” (Mukherjee et al., 2023). In privacy-preserving outsourced CNN inference, EzPC appears as a prior secure-inference system and benchmark: it is treated as strong in practice because it has “fast garbled-circuit compilation/evaluation,” yet it is also positioned as leaving room for improvement in both model privacy and efficiency for CNN workloads (Li et al., 2020).

1. Conceptual role and system position

EzPC occupies a middle layer between application-level secure machine-learning logic and lower-level secure-computation primitives. The 2023 MARL work presents it explicitly as a developer-facing language for expressing secure 2PC computations, while SecFloat supplies secure 32-bit single-precision floating-point operations and mathematical functions such as comparison, addition, multiplication, division, and transcendental functions (Mukherjee et al., 2023). In that framing, EzPC is not merely a cryptographic primitive; it is the implementation substrate through which composite secure functions are written and compiled.

In the outsourced CNN literature, EzPC is used differently: not as the central contribution of the paper, but as a baseline system in the same family of privacy-preserving neural-network inference schemes. The 2020 CNN paper compares its own two-server design against SecureML, MiniONN, and EzPC, and characterizes EzPC as protecting the query and intermediate data, but not the model privacy in the same way the new scheme does (Li et al., 2020). This distinction is central to how EzPC is situated in that paper: it is both practically relevant and a target for improvement.

A useful way to interpret these two roles is that EzPC functions as a programmable secure-computation layer in one paper and as an efficiency-and-privacy reference point in another. This suggests that EzPC is best understood as infrastructure for secure ML rather than as a single task-specific protocol.

2. Programming model and secure-computation backend

The most explicit description of EzPC’s programming model appears in the secure MARL work. There, the authors argue that directly implementing the primitive arithmetic used by MADDPG through secure 2PC operations is “programmatically intractable” because training requires repeated forward and backward passes with many primitive operations (Mukherjee et al., 2023). EzPC is needed precisely because it allows those operations to be expressed at a higher level and then compiled into secure protocols using SecFloat.

Within this arrangement, the paper defines three reusable secure gadgets:

• a secure forward-pass gadget $F$,
• a secure backpropagation gadget $B$,
• a secure loss-gradient variant $BL$.

These gadgets are built from SecFloat-supported primitives including matrix multiplication $(\otimes)$, matrix addition $(\oplus)$, ReLU and its derivative $\mathbb{RELU}, \mathbb{RELU}'$, and bias-gradient aggregation $GetBiasDer$ (Mukherjee et al., 2023). The secure forward-pass gadget is written as

$F(\Tilde{X_0},\Tilde{X_1},\mathcal{W})=\Bigl[\mathbb{RELU}\Bigl(\bigl[\mathbb{RELU}\bigl((\Tilde{X_0}\oplus\Tilde{X_1})\otimes W_1^T\oplus b_1\bigr)\bigr]\otimes W_2^T\oplus b_2\Bigr)\Bigr]\otimes W_3^T\oplus b_3$

for a 3-layer fully connected network with ReLU, ReLU, and identity activations in the forward-pass theorem (Mukherjee et al., 2023). The backward pass is similarly rewritten into matrix multiplications, Hadamard products, and bias-gradient sums, with

$$GetBiasDer(M^{B\times n})=\Bigl[\sum_{i=1}^BM_{i1},\:...,\:\sum_{i=1}^BM_{ij},\:...,\:\sum_{i=1}^BM_{in}\Bigr]^{1\times n}.$$

This decomposition is the operative meaning of “EzPC as substrate”: the secure computation is organized compositionally at the level of neural-network passes rather than as manually managed cryptographic operations.

3. EzPC in privacy-preserving outsourced CNN inference

In the outsourced CNN setting, the system model is a classic two-server non-colluding architecture. The model owner secret-shares the CNN model between two servers, the user secret-shares the query image $\mathcal{G}$ between the same two servers, the servers are assumed to be honest-but-curious and do not collude, and the final outputs are returned as secret shares to the user for local reconstruction (Li et al., 2020). The security goal is formulated in the simulation paradigm, where each party’s view can be simulated from only its own input share and output share.

Against that backdrop, EzPC is one of the prior systems used for comparison. In the paper’s comparison table, it is characterized as protecting the query and intermediate data, but not the model privacy in the same way the proposed scheme does (Li et al., 2020). The proposed system is presented as stronger because it protects the query image, model parameters, intermediate results such as $B$0, and final prediction results $B$1.

The paper’s technical improvements over prior systems illuminate the comparison point with EzPC. The proposed scheme combines additive secret sharing, Beaver-style triplets for multiplication, SIMD packing for triplet generation, asynchronous computation, garbled circuits for exact non-polynomial activation functions, and average pooling instead of max pooling (Li et al., 2020). In particular, the use of garbled circuits for the activation function is emphasized as a way to keep the same accuracy as the underlying network instead of approximating it. EzPC is acknowledged as practically strong because of fast garbled-circuit compilation/evaluation, but the new design claims advantages in both privacy scope and efficiency.

The paper also states that average pooling replaces max pooling because average pooling is linear and can be done locally on secret shares without interaction, with the pooling identity

$B$2

A plausible implication is that EzPC’s role in this literature is partly diagnostic: it marks the point at which secure inference is already practical enough to be a meaningful benchmark, while simultaneously revealing bottlenecks in model privacy and communication.

4. EzPC with SecFloat for privacy-preserving MARL

The 2023 supply-chain MARL paper uses EzPC as the implementation environment for a secure MPC realization of MADDPG in a 2-party setting (Mukherjee et al., 2023). The threat model is “Semi-honest i.e., the parties don't deviate from the prescribed protocols but they are keen to tap sensitive information of the other,” while SecFloat provides security against “a static probabilistic polynomial time semi-honest adversary.”

A key feature of this construction is that the computation is carried out in secure 32-bit single-precision floating point rather than fixed point. The paper states that this avoids accuracy loss from converting floating point to fixed point, which is described as important for long-horizon training in MARL (Mukherjee et al., 2023). The stated precision guarantee is that “the ULP (units in last place) errors between floating-point values obtained by elementary SecFloat operations and the corresponding exact real results are less than 1.”

Input handling is based on party-specific splits. For each input batch, each row vector $B$3 is split into two halves,

$B$4

and the corresponding preprocessed matrices satisfy

$B$5

The paper further specifies an output pattern in which Party $B$6 receives the forward-pass prediction $B$7 and the desired gradient for the backward pass, while Party $B$8 receives nothing (Mukherjee et al., 2023).

The secure MADDPG update loop is then expressed through the secure gadgets. The paper rewrites the target, critic gradient, and policy gradient as

$B$9

$BL$0

$BL$1

The operational pseudo-code titled “An iteration of 2PC with MADDPG SecFloat gadgets” includes preprocessing of states, secure action computation, environment interaction, replay-buffer storage, synchronized minibatch sampling, secure next-action computation, secure target and gradient computation, parameter updates, and soft target-network updates (Mukherjee et al., 2023). EzPC’s significance here is not that it changes MADDPG’s mathematical structure; rather, it makes the secure realization of that structure programmable and modular.

5. Performance characteristics and empirical comparisons

The two papers provide very different performance portraits of EzPC because they evaluate different tasks.

In outsourced CNN inference, EzPC appears as a baseline against which a new two-server protocol is measured. On MNIST, the proposed scheme is reported to achieve an average of $BL$2 lower latency than EzPC, and the paper also reports $BL$3 lower computation time compared with EzPC on MNIST networks (Li et al., 2020). For communication on MNIST, the reported improvement is $BL$4 lower communication cost than EzPC on average. On CIFAR-10, the paper reports $BL$5 lower latency and $BL$6 lower communication cost than EzPC.

The paper attributes its advantage mainly to cheaper triplets due to SIMD packing, asynchronous execution that reduces waiting time, exact ReLU via garbled circuits, and average pooling that removes a costly nonlinear operation (Li et al., 2020). It also reports triplet-generation timings of 79716.524 ms for original triplet generation, 19.635 ms for packed triplet generation, and 16.970 ms for packed plus asynchronous generation, corresponding to a reported $BL$7 speedup for triplet generation.

In secure MARL, by contrast, EzPC with SecFloat is shown to be functionally effective but computationally heavy. The paper reports that one complete iteration takes 545.73 seconds in Secure 2PC versus 0.035 seconds in EDE (Mukherjee et al., 2023). It further gives neural-network operation costs of 1.014 sec and 0.04 GB for action prediction with batch size 1, 79.812 sec and 17.87 GB for actor gradient update with batch size 128, and 66.540 sec and 14.43 GB for critic gradient update with batch size 128.

These results do not contradict one another. They indicate that EzPC can be relatively efficient as a secure-inference benchmark in one setting while still imposing substantial cost in secure training with floating-point operations in another. A plausible implication is that the performance envelope of EzPC depends strongly on workload structure, especially whether the task is inference or iterative training.

6. Security scope, limitations, and recurrent misconceptions

A recurring misconception is to treat EzPC as synonymous with complete model privacy in every application. The CNN paper directly resists that interpretation by reporting that, in its comparison table, EzPC does not provide model privacy in the same way as the proposed outsourced-CNN scheme (Li et al., 2020). At the same time, the paper does not depict EzPC as weak in general; it explicitly notes that EzPC is strong in practice because it has fast garbled-circuit compilation/evaluation.

A second misconception is that a secure-computation compiler automatically makes complex ML training workflows straightforward. The MARL paper states the opposite: although policy-gradient methods such as MADDPG operations are conceptually feasible with SecFloat, direct implementation is “programmatically intractable” (Mukherjee et al., 2023). The main challenge is especially severe in the backward pass, because each primitive computation may require the other party’s secret-shared forward-pass information, the parties’ computation graphs and timing may not align, and a single mismatch can break the whole training process.

To mitigate that problem, the paper advocates a gadget-based design and gives a complexity comparison. With F-SecFloat and B-SecFloat gadgets, the complexity is

$BL$8

whereas with native SecFloat implementation the best case is

$BL$9

and the worst case is

$(\otimes)$0

The authors also use a two-phase training strategy: 9900 epochs in simulation followed by a 20 epochs secure 2PC phase (Mukherjee et al., 2023). This makes clear that programmability through EzPC does not eliminate the cost of secure training; it organizes and contains that cost.

7. Research significance across application domains

The significance of EzPC in the supplied literature lies in its cross-domain utility. In one domain, it is a prior system for privacy-preserving outsourced CNN inference, used as a practical and credible benchmark for latency and communication (Li et al., 2020). In another, it is the core programming environment for secure floating-point MARL in supply chains, where it enables modular forward and backward secure gadgets and preserves the overall equilibrium behavior of MADDPG while keeping private states, actions, rewards, and network computations hidden (Mukherjee et al., 2023).

The MARL paper reports substantive task-level outcomes for the secure 2PC setting relative to no data sharing: on average 68.19% less supply chain wastage and 42.27% better average cumulative revenue for each player (Mukherjee et al., 2023). It also reports very small errors in moving averages and close final weights and biases across all networks, with representative parameter discrepancies such as Actor Player 0 MAE $(\otimes)$1 and RMSE $(\otimes)$2, and Critic Player 1 MAE $(\otimes)$3 and RMSE $(\otimes)$4 (Mukherjee et al., 2023). These results support the narrower claim of faithfulness to the clear-text algorithm, even under heavy computational overhead.

Taken together, the two papers portray EzPC as a general secure-computation framework whose importance lies less in any single benchmark result than in the way it anchors secure ML workflows. It serves both as a comparison target in secure inference and as a programmable compilation layer for secure floating-point training. This suggests a broader research role for EzPC: it is a point of convergence where cryptographic protocol engineering, compiler support, and machine-learning system design meet.