Secure Multilayer Perceptron Based on Homomorphic Encryption

Abstract

In this work, we propose an outsourced Secure Multilayer Perceptron (SMLP) scheme where privacy and confidentiality of both the data and the model are ensured during the training and the classification phases. More clearly, this SMLP : i) can be trained by a cloud server based on data previously outsourced by a user in an homomorphically encrypted form; ii) its parameters are homomorphically encrypted giving thus no clues to the cloud; and iii) it can also be used for classifying new encrypted data sent by the user returning him the encrypted classification result encrypted. The originality of this scheme is threefold. To the best of our knowledge, it is the first multilayer perceptron (MLP) secured in its training phase over homomorphically encrypted data with no problem of convergence. And It does not require extra-communications between the server and the user. It is based on the Rectified Linear Unit (ReLU) activation function that we secure with no approximation contrarily to actual SMLP solutions. To do so, we take advantage of two semi-honest non-colluding servers. Experimental results carried out on a binary database encrypted with the Paillier cryptosystem demonstrate the overall performance of our scheme and its convergence.

Privacy‐preserving convolutional neural network prediction with low latency and lightweight users

“…The aspects of the comparison revolve around the security (including the ability to counteract hitchhiking wiretapping), whether the activation computing supports accuracy losslessness from the underlying network, whether it supports low latency, whether it supports multiple keys and whether it is lightweight on the user side. Among them, the scheme based on Paillier encryption proposed by Bellafqira et al 8 allows the cloud server to know the user's private key, which can cause data privacy leakage, and the scheme does not support multiple keys. The scheme proposed by Mohassel et al 20 uses a Relu function approximate polynomials approach to calculate the activation function, and thus does not support the activation computation accuracy in line with the underlying network, and the scheme is computationally burdensome to the user, thus it does not support lightweight users.…”

“…After analyzing and studying related literature, we found the following two main issues regarding the prediction on the privacy‐preserving convolutional neural network at present: (1) privacy protection. In some dual‐server models where one of the servers is allowed to have the private key from a user 7,8 or both are given access to the model parameters, 7 which is obviously insecure. While in schemes with secret sharing, the raw data is uploaded directly to the server in a shared format, which can also cause semi‐honest participants to restore information by wiretapping, bring the risk of privacy leakage 9,10 .…”

“…Although the generated approximate polynomials help to compute the Relu function, such an approach would impose large computational overhead on servers when exploiting homomorphic properties and lead to high latency, which is consistent with the activation function computation proposed by Ma et al, 26 Chabanne et al, 18 and Kwabena et al 19 In particular, the Taylor series expansion only at a single point is not well fitted to the whole function and the scheme cannot be in line with the underlying network accuracy. Bellafqira et al 8 constructed a privacy‐preserving multilayer perceptron model based on Paillier cryptosystem, although the activation function computing on the two‐server model is achieved by comparison protocol to ensure the underlying network accuracy, the fact that one of the servers in the model is allowed to know the user's private key will cause privacy threat to raw data. Chen et al 22 utilized the Paillier homomorphic cryptosystem to implement the activation function computing with a comparison protocol, which achieves underlying network accuracy without loss, but the complicated modulo exponential operations will cause high latency.…”

Cryptosystem Conversion, Packing and Matrix Processing of Homomorphically Encrypted Data: Application to IOT Devices

“…As stated in Section III-A, the objective is to allow HMI to securely filter IMD data and threshold the filter output so as to raise or not an alarm to the patient. Several well-known issues have to be considered when filtering data in the homomorphic domain [43]: negative numbers, fractional numbers,... In this section and in order to alleviate the presentation of our proposal, we consider that the IMD data {d i } i=0,...,M −1 , the threshold s and the HMI filter weights {w i } i=0,...,M −1 are integers.…”

“…In this section and in order to alleviate the presentation of our proposal, we consider that the IMD data {d i } i=0,...,M −1 , the threshold s and the HMI filter weights {w i } i=0,...,M −1 are integers. One can refer to [43] for a strategy for managing fractional and real numbers. In that respect, once HMI accesses to D-J encrypted data…”