GALA: Greedy ComputAtion for Linear Algebra in Privacy-Preserved Neural Networks

Abstract

Machine Learning as a Service (MLaaS) is enabling a wide range of smart applications on end devices. However, privacy still remains a fundamental challenge. The schemes that exploit Homomorphic Encryption (HE)-based linear computations and Garbled Circuit (GC)-based nonlinear computations have demonstrated superior performance to enable privacypreserved MLaaS. Nevertheless, there is still a significant gap in the computation speed. Our investigation has found that the HE-based linear computation dominates the total computation time for state-of-the-art deep neural networks. Furthermore, the most time-consuming component of the HE-based linear computation is a series of Permutation (Perm) operations that are imperative for dot product and convolution in privacy-preserved MLaaS. This work focuses on a deep optimization of the HEbased linear computations to minimize the Perm operations, thus substantially reducing the overall computation time. To this end, we propose GALA: Greedy computAtion for Linear Algebra in privacy-preserved neural networks, which views the HE-based linear computation as a series of Homomorphic Add, Mult and Perm operations and chooses the least expensive operation in each linear computation step to reduce the overall cost. GALA makes the following contributions: (1) It introduces a row-wise weight matrix encoding and combines the share generation that is needed for the GC-based nonlinear computation, to reduce the Perm operations for the dot product; (2) It designs a first-Add-second-Perm approach (named kernel grouping) to reduce Perm operations for convolution. As such, GALA efficiently reduces the cost for the HE-based linear computation, which is a critical building block in almost all of the recent frameworks for privacy-preserved neural networks, including GAZELLE (Usenix Security'18), DELPHI (Usenix Security'20), and CrypTFlow2 (CCS'20). With its deep optimization of the HE-based linear computation, GALA can be a plug-and-play module integrated into these systems to further boost their efficiency. Our experiments show that it achieves a significant speedup up to 700× for the dot product and 14× for the convolution computation under different data dimensions. Meanwhile, GALA demonstrates an encouraging runtime boost by 2.5×,

HyPHEN: A Hybrid Packing Method and Optimizations for Homomorphic Encryption-Based Neural Networks

“…There are many variants of the convolution algorithm for HE [11], [13], [15], [16], [24], but most of them resort to SISO. [12] devise a convolution algorithm based on tile tensoring, and not SISO, which can be an efficient alternative to SISO for specific HE parameter settings and image sizes.…”

“…Several prior works has tried to mitigate the overheads [11], [13], but HCNN implementations still stay at a proof-of-concept level and target elementary problems such as MNIST and CIFAR-10. Gazelle [14] proposes a convolution algorithm for homomorphic encryption, which is widely adopted and by the following studies [11], [15], [16]. Gazelle and most prior PI CNN implementations have avoided the high overheads of FHE by restricting the CNN models to shallow ones [8], or mixing use of other cryptographic primitives, such as multiparty computation (MPC) [15], [17], [18]; however, MPC solutions require extra user intervention and the associated data communication overheads.…”

VerifyML: Obliviously Checking Model Fairness Resilient to Malicious Model Holder

“…Since the model holder holds the model parameter in the plaintext, executing the linear layer only involves homomorphic operations between the plaintext and the ciphertext. Such type of computation is compatible with mainstream homomorphic optimization methods including GALA [43] and GAZELLE [19]. However, in VerifyML, the linear layer operation cannot be done in the model holder because it is considered malicious.…”

“…. Note that several efficient parallel homomorphic computation methods[19],[43] with packed ciphertext have been proposed and run on semi-honest or client-malicious models[5],[26],[29] for secure inference. It may be possible to transfer these techniques to our method to speed up triple's generation, but this is certainly non-trivial and we leave it for future work.…”

Robust and Privacy-Preserving Collaborative Learning: A Comprehensive Survey

“…To reduce the cost of homomorphic linear computation, Zhang et al [170] considers homomorphic linear computation as a sequence addition operations of addition, multiplication, and permutation and then greedy chooses the least expensive operation for every computation step. Froelicher et al proposed SPINDLE [172] that preserves data and model confidentiality and enables the execution of a cooperative gradientdescent and the evaluation of the obtained model even when there are colluding participants.…”