Crypto-Nets: Neural Networks over Encrypted Data

By Pengtao Xie, Mikhail Bilenko, Tom Finley, Ran Gilad-Bachrach, Kristin E. Lauter, Michael Naehrig. 2014

160 citations recorded by the source corpus.

The problem we address is the following: how can a user employ a predictive model that is held by a third party, without compromising private information. For example, a hospital may wish to use a cloud service to predict the readmission risk of a patient. However, due to regulations, the patient's medical files cannot be revealed. The goal is to make an inference using the model, without jeopardizing the accuracy of the prediction or the privacy of the data. To achieve high accuracy, we use neural networks, which have been shown to outperform other learning models for many tasks. To achieve the privacy requirements, we use homomorphic encryption in the following protocol: the data owner encrypts the data and sends the ciphertexts to the third party to obtain a prediction from a trained model. The model operates on these ciphertexts and sends back the encrypted prediction. In this protocol, not only the data remains private, even the values predicted are available only to the data owner. Using homomorphic encryption and modifications to the activation functions and training algorithms of neural networks, we show that it is protocol is possible and may be feasible. This method paves the way to build a secure cloud-based neural network prediction services without invading users' privacy.

Subfields: Artificial Intelligence, Model Architectures, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Model Architectures

In Privacy & Security

Citations in the corpus

Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning (2017, methodology): “Microsoft developed CryptoNets [19] to perform deep learning on encrypted data and provide encrypted outputs to the users [84].”
Secure Multilayer Perceptron Based On Homomorphic Encryption (2018, background): “To the best of our knowledge, the NN training phase with homomorphically encrypted data has only been theoretically studied in [23].”
Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference (2018, methodology): “We follow the procedure set by previous work [29], [68] and employ homomorphic encryption (HE) to convert a trained machine learning model into a HE-enabled model.”
Oblivious Multi-Party Machine Learning on Trusted Processors (2016, methodology): “Solutions based on fully-homomorphic encryption have been proposed for training several ML algorithms [27, 69] and for classifying decision trees [68].”
Privacy-Preserving Classification on Deep Neural Network (2017, background): “al [48], [20] simply propose to replace the activation function by the squared function which has multiplicative depth 1.”
A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples (2016, background): “Recent studies have proposed various strategies (Xie et al., 2014; Bojarski et al., 2014; Stoddard et al., 2014; Li & Zhou, 2015; Rajkumar & Agarwal, 2012; Dwork, 2011; Nock et al., 2015) to preserve the privacy of data such as differential privacy.”
CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy (2016, unknown): “The solution of Xie et al. (2014) was to approximate these functions with low-degree polynomials, but we take a different approach here.”
Membership Inference Attacks Against Machine Learning Models (2016, methodology): “This also holds for the models trained by computing on encrypted data [4], [6], [35].”
Learning to Protect Communications with Adversarial Neural Cryptography (2016, background): “In particular, homomorphic encryption enables inference on encrypted data (Xie et al., 2014; Gilad-Bachrach et al., 2016).”
Privacy-preserving deep learning (2015, background): “Techniques that protect privacy of the model include privacypreserving probabilistic inference [38], privacy-preserving speaker identification [36], and computing on encrypted data [3, 6, 55].”