Privacy-Preserving Visual Learning Using Doubly Permuted Homomorphic Encryption

By Ryo Yonetani, Vishnu Naresh Boddeti, Kris M. Kitani, Yoichi Sato. 2017

70 citations recorded by the source corpus.

We propose a privacy-preserving framework for learning visual classifiers by leveraging distributed private image data. This framework is designed to aggregate multiple classifiers updated locally using private data and to ensure that no private information about the data is exposed during and after its learning procedure. We utilize a homomorphic cryptosystem that can aggregate the local classifiers while they are encrypted and thus kept secret. To overcome the high computational cost of homomorphic encryption of high-dimensional classifiers, we (1) impose sparsity constraints on local classifier updates and (2) propose a novel efficient encryption scheme named doublypermuted homomorphic encryption (DPHE) which is tailored to sparse high-dimensional data. DPHE (i) decomposes sparse data into its constituent non-zero values and their corresponding support indices, (ii) applies homomorphic encryption only to the non-zero values, and (iii) employs double permutations on the support indices to make them secret. Our experimental evaluation on several public datasets shows that the proposed approach achieves comparable performance against state-of-the-art visual recognition methods while preserving privacy and significantly outperforms other privacy-preserving methods.

Subfields: Artificial Intelligence, Computational Theory and Mathematics

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computational Theory and Mathematics

Citations in the corpus

NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, methodology): “[44] uses HE for secure aggreagation of classifiers in a distributed learning setting where different entities train models on their local data and share the model weights or model related information that needs to be securely aggregated at a centralized entity.”
Privacy in Deep Learning: A Survey (2020, methodology): “w/ DNN Distributed DP [87] # # eICU, TCGA Classification w/ DNN DP model publishing [88] # # MNIST, CIFAR Image Classification w/ DNN DP federated learning [89] # # MNIST Image Classification w/ DNN ScalarDP, PrivUnit [90] # # MNIST, CIFAR Image Classification w/ DNN DSSGD [21] # # MNIST, SVHN Image”
A Review of Homomorphic Encryption Libraries for Secure Computation (2018, background): “TFHE allows evaluating an arbitrary boolean circuit composed of binary gates, over encrypted Boolean Operations Some homomorphic encryption libraries that are based on Secure Multilayer Perceptron [26] and Doubly Permuted Homomorphic Encryption [27] allow evaluating an arbitrary boolean circuit comp”
A Study of Face Obfuscation in ImageNet (2021, background): “Machine learning service providers can run their models on users’ private data encrypted using homomorphic encryption (Gilad-Bachrach et al., 2016; Brutzkus et al., 2019; Juvekar et al., 2018; Bian et al., 2020; Yonetani et al., 2017).”
Privacy Preserving Image Queries for Camera Localization (2019, background): “Recent works on privacy in vision include anonymization for activity recognition [51,52], learning models on private or encrypted data [4, 22, 76] and localizing objects within indoor scenes using active cameras [81].”
Gradient-Leaks: Understanding and Controlling Deanonymization in Federated Learning (2018, background): “se adding properly-calibrated random noise via differential privacy [17, 18] mechanisms to achieve a reasonable privacy-utility trade-off. Other alternate countermeasures typically involve encryption [9, 23, 26, 78] or secure multiparty communication [8, 77]. In this work, we propose an alternative ”
Privacy Preserving Image-Based Localization (2019, background): “Learning data-driven models from private datasets has also received attention [2, 27, 83].”
Understanding and Controlling User Linkability in Decentralized Learning (2018, methodology): “Upon retrieving the new user-specific model updates, the adversary can recover the IP addresses of the requests (possibly exposing location) or perform reconstruction attacks [30, 78].”
Knockoff Nets: Stealing Functionality of Black-Box Models (2018, background): “ries? 4.What makes for a good knockoff architecture? 2. Related Work Privacy, Security and Computer Vision. Privacy has been largely addressed within the computer vision community by proposing models [28,30,31,42,49,50] which recognize and control privacy-sensitive information in visual content. The”
Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study (2018, background): “A few cryptographic solutions [13,66] were developed to locally encrypt visual information in a homomorphic way, i.”