Privacy-Preserving Machine Learning With Fully Homomorphic Encryption for Deep Neural Network

Abstract

Fully homomorphic encryption (FHE) is one of the prospective tools for privacy-preserving machine learning (PPML), and several PPML models have been proposed based on various FHE schemes and approaches. Although the FHE schemes are known as suitable tools to implement PPML models, previous PPML models on FHE such as CryptoNet, SEALion, and CryptoDL are limited to only simple and non-standard types of machine learning models. These non-standard machine learning models are not proven efficient and accurate with more practical and advanced datasets. Previous PPML schemes replace non-arithmetic activation functions with simple arithmetic functions instead of adopting approximation methods and do not use bootstrapping, which enables continuous homomorphic evaluations. Thus, they could not use standard activation functions and could not employ a large number of layers. In this work, we firstly implement the standard ResNet-20 model with the RNS-CKKS FHE with bootstrapping and verify the implemented model with the CIFAR-10 dataset and the plaintext model parameters. Instead of replacing the non-arithmetic functions with the simple arithmetic function, we use state-of-the-art approximation methods to evaluate these non-arithmetic functions, such as the ReLU and softmax, with sufficient precision. Further, for the first time, we use the bootstrapping technique of the RNS-CKKS scheme in the proposed model, which enables us to evaluate an arbitrary deep learning model on the encrypted data. We numerically verify that the proposed model with the CIFAR-10 dataset shows 98.43% identical results to the original ResNet-20 model with non-encrypted data. The classification accuracy of the proposed model is 92.43%±2.65%, which is quite close to that of the original ResNet-20 CNN model, 91.89%. It takes about 3 hours for inference on a dual Intel Xeon Platinum 8280 CPU (112 cores) with 172 GB memory. We think that it opens the possibility of applying the FHE to the advanced deep PPML model.

ARK: Fully Homomorphic Encryption Accelerator with Runtime Data Generation and Inter-Operation Key Reuse

“…We measured the performance of HELR for 30 iterations. We also performed CNN inference using Lee et al [53]'s implementation of the ResNet-20 model for the CIFAR-10 [52] dataset. The model shows 92.43% accuracy.…”

“…We additionally used the channel packing method of [47], which packs multiple channels of a feature map in a single message to fully utilize the slots. When using the channel packing method, homomorphic evaluation of convolution layers in the model involves a series of HRots and PMults with weight plaintexts, so we applied both multi- [36], [53].…”

“…ARK drastically reduces the execution time for complex workloads: ResNet-20 [53] and sorting [36] (Table VI). We used the reported performance of multi-threaded CPU implementation in each work as the baseline.…”

“…However, the parameters used in these designs were not large enough to effectively support CKKS bootstrapping. Bootstrapping is an expensive op, dominating the execution time of complex FHE workloads [45], [53]. Moreover, FHE schemes supporting bootstrapping must use large parameters [13], [21], which correspondingly increase the data size.…”

BTS

“…Noise accumulates as we apply a sequence of computations on cts. This limits the number of computations that can be performed and hinders the applicability of HE for practical purposes, such as in deep-learning models with high accuracy [59]. To overcome this limitation, fully HE (FHE) [37] was proposed, featuring an operation (op) called bootstrapping, that łrefreshesž the ct and hence permits an unlimited number of computations on the ct.…”