The problem we address is the following: how can a user employ a predictive model that is held by a third party, without compromising private information. For example, a hospital may wish to use a cloud service to predict the readmission risk of a patient. However, due to regulations, the patient's medical files cannot be revealed. The goal is to make an inference using the model, without jeopardizing the accuracy of the prediction or the privacy of the data. To achieve high accuracy, we use neural networks, which have been shown to outperform other learning models for many tasks. To achieve the privacy requirements, we use homomorphic encryption in the following protocol: the data owner encrypts the data and sends the ciphertexts to the third party to obtain a prediction from a trained model. The model operates on these ciphertexts and sends back the encrypted prediction. In this protocol, not only the data remains private, even the values predicted are available only to the data owner. Using homomorphic encryption and modifications to the activation functions and training algorithms of neural networks, we show that it is protocol is possible and may be feasible. This method paves the way to build a secure cloud-based neural network prediction services without invading users' privacy.
@cite_1 suggested a scheme for using homomorphic encryption with neural networks. They suggest solving the problem of non-linear activation functions by creating an interactive protocol between the data owner and the model owner. In a nut-shell, every non-linear transformation is computed by the data-owner: the model sends the input to the non-linear transformation in encrypted form to the data owner who decrypts the message, applies the transformation, encrypts the result and sends it back. Unfortunately, this interaction requires large latencies and increases the complexity on the data owner side, effectively making it impractical. Moreover, it leaks information about the model. Therefore, @cite_1 had to introduce safety mechanisms, such as random order of execution, to mitigate this issue. In comparison, the procedure we introduce does not require complicated communication schemes: the data owner encrypts the data and sends it. The model does its computation and sends back the (encrypted) prediction. Therefore, it allows for asynchronous communication and it does not leak unnecessary information about the model.
@cite_1
1973124816
The problem of secure data processing by means of a neural network (NN) is addressed. Secure processing refers to the possibility that the NN owner does not get any knowledge about the processed data since they are provided to him in encrypted format. At the same time, the NN itself is protected, given that its owner may not be willing to disclose the knowledge embedded within it. The considered level of protection ensures that the data provided to the network and the network weights and activation functions are kept secret. Particular attention is given to prevent any disclosure of information that could bring a malevolent user to get access to the NN secrets by properly inputting fake data to any point of the proposed protocol. With respect to previous works in this field, the interaction between the user and the NN owner is kept to a minimum with no resort to multiparty computation protocols.