Privacy-Preserving Machine Learning with Fully Homomorphic Encryption for Deep Neural Network

Abstract

Fully homomorphic encryption (FHE) is one of the prospective tools for privacypreserving machine learning (PPML), and several PPML models have been proposed based on various FHE schemes and approaches. Although the FHE schemes are known as suitable tools to implement PPML models, previous PPML models on FHE encrypted data are limited to only simple and non-standard types of machine learning models. These non-standard machine learning models are not proven efficient and accurate with more practical and advanced datasets. Previous PPML schemes replace non-arithmetic activation functions with simple arithmetic functions instead of adopting approximation methods and do not use bootstrapping, which enables continuous homomorphic evaluations. Thus, they could not use standard activation functions and could not employ a large number of layers. The maximum classification accuracy of the existing PPML model with the FHE for the CIFAR-10 dataset was only 77% until now. In this work, we firstly implement the standard ResNet-20 model with the RNS-CKKS FHE with bootstrapping and verify the implemented model with the CIFAR-10 dataset and the plaintext model parameters. Instead of replacing the non-arithmetic functions with the simple arithmetic function, we use state-of-the-art approximation methods to evaluate these non-arithmetic functions, such as the ReLU, with sufficient precision [1]. Further, for the first time, we use the bootstrapping technique of the RNS-CKKS scheme in the proposed model, which enables us to evaluate a deep learning model on the encrypted data. We numerically verify that the proposed model with the CIFAR-10 dataset shows 98.67% identical results to the original ResNet-20 model with non-encrypted data. The classification accuracy of the proposed model is 90.67%, which is pretty close to that of the original ResNet-20 CNN model. It takes about 4 hours for inference on a dual Intel Xeon Platinum 8280 CPU (112 cores) with 512 GB memory. We think that it opens the possibility of applying the FHE to the advanced deep PPML model.

BTS: An Accelerator for Bootstrappable Fully Homomorphic Encryption

“…The execution time of BTS-2 is 28.4ms, 1,306× and 36.1× better than Lattigo and F1, respectively. ResNet-20: BTS performs up to 5,556× faster over the prior work [51]. Table V shows the execution time of [51] and BTS-x on ResNet-20.…”

“…ResNet-20: BTS performs up to 5,556× faster over the prior work [51]. Table V shows the execution time of [51] and BTS-x on ResNet-20. BTS-1 without channel packing is 311× faster than [51].…”

“…Lee et al [51] developed a CNN model based on ResNet-20 [38] with a 98b-secure CKKS instance, showing 92.43% accuracy on CIFAR-10 classification [50]. They approximated ReLU with a high-degree polynomial function because comparing encrypted data is expensive in HE schemes [21], [53].…”

“…However, there still remains ample room for improvement left on the table when it comes to accelerating FHE. While more than 1,000 bootstrapping ops are necessary per single ResNet-20 inference [51], each bootstrapping op takes dozens of seconds on the state-of-the-art CPU implementation [32]. GPU performs better, but it still takes hundreds of milliseconds to perform a single bootstrapping [42].…”

“…The number of special prime moduli dnum Decomposition number λ Security parameter of a given CKKS instance of logistic regression [36] compared to CPU (by 1,306×) and GPU (by 27×) implementations, and can execute a ResNet-20 inference 5,556× faster than prior CPU implementations [51].…”