Center for Data Sciences, International Institute of Information Technology, Bangalore（班加罗尔国际信息技术学院数据科学中心）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；University at Buffalo, SUNY（纽约州立大学布法罗分校）；IBM Systems（IBM系统部）；Microsoft（微软）
Machine learning on encrypted data can address the concerns related to privacy and legality of sharing sensitive data with untrustworthy service providers. Fully Homomorphic Encryption (FHE) is a promising technique to enable machine learning and inferencing while providing strict guarantees against information leakage. Since deep convolutional neural networks (CNNs) have become the machine learning tool of choice in several applications, several attempts have been made to harness CNNs to extract insights from encrypted data. However, existing works focus only on ensuring data security and ignore security of model parameters. They also report high level implementations without providing rigorous analysis of the accuracy, security, and speed trade-offs involved in the FHE implementation of generic primitive operators of a CNN such as convolution, non-linear activation, and pooling. In this work, we consider a Machine Learning as a Service (MLaaS) scenario where both input data and model parameters are secured using FHE. Using the CKKS scheme available in the open-source HElib library, we show that operational parameters of the chosen FHE scheme such as the degree of the cyclotomic polynomial, depth limitations of the underlying leveled HE scheme, and the computational precision parameters have a major impact on the design of the machine learning model (especially, the choice of the activation function and pooling method). Our empirical study shows that choice of aforementioned design parameters result in significant trade-offs between accuracy, security level, and computational time. Encrypted inference experiments on the MNIST dataset indicate that other design choices such as ciphertext packing strategy and parallelization using multithreading are also critical in determining the throughput and latency of the inference process.
When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification
CaRENets: Compact and Resource-Efficient CNN for Homomorphic Inference on Encrypted Medical Images
卷积神经网络（CNN）在医学图像分类任务中实现了显著的性能飞跃。然而，由于数据隐私问题，将神经网络模型转换为临床应用仍然具有挑战性。全同态加密（FHE）有可能解决这一挑战，因为它可以在加密图像上使用CNN。然而，当前的HE技术造成巨大的计算和存储器开销，特别是对于高分辨率图像，例如在临床背景下看到的那些。我们提供CareNet：紧凑且资源高效的CNN，用于在实际应用中对高分辨率加密图像进行高性能和资源高效的推理。在核心，CareNet包括一个新的FHE紧凑包装方案，与CNN功能紧密集成。与标准交错打包方案相比，CaRENets提供了内存效率（由于图像和CNN激活的紧凑打包）和推理速度（由于创建的密文数量和相关数学运算的减少）的双重优势。我们应用CaRENets在两种临床条件下执行具有80位安全级别的同态异常检测-早产儿视网膜病变（ROP）和糖尿病视网膜病变（DR）。ROP数据集包括96 x 96灰度图像，而DR数据集包括256 x 256 RGB图像。我们展示了超过4-5倍的内存效率和4 - 5倍的推理加速比交错包装方案的改善。由于我们的方法能够实现存储器高效的低延迟HE推断而不施加额外的通信负担，因此它对临床成像中的实用和安全的深度学习推断具有影响。
Layer-Parallel Inference Reduces Encrypted Nonlinear Depth in Transformers
MBZUAI IFM（穆罕默德·本·扎耶德人工智能大学智能未来研究院）；Red Hat AI Innovation（红帽人工智能创新实验室）；MIT-IBM Watson AI Lab（麻省理工学院-IBM沃森人工智能实验室）；Core AI, IBM（IBM核心人工智能部门）；University of Texas at Dallas（德克萨斯大学达拉斯分校）
Stealing Reasoning Traces from Proprietary LLM APIs
MATS Research（MATS研究院）；ELLIS Institute Tübingen（图宾根ELLIS研究所）；Max Planck Institute for Intelligent Systems（马克斯·普朗克智能系统研究所）；Tübingen AI Center（图宾根人工智能中心）；University of Tübingen（图宾根大学）
FFConv: Fast Factorized Convolutional Neural Network Inference on Encrypted Data
Singapore Management University（新加坡管理大学）
同态加密（HE）允许对加密数据（密文）进行计算而无需首先对其进行解密，从而为云中的隐私保护应用程序提供安全但速度非常慢的卷积神经网络（CNN）推理。为了减少推理延迟，一种方法是将多个消息打包到单个密文中，以便减少密文的数量并支持密文之间的同态乘法累加（HMA）操作的大规模并行性。尽管HECNN推理速度更快，但主流打包方案密集打包（DensePack）和卷积打包（ConvPack）引入了昂贵的旋转开销，这降低了HECNN用于更深和更宽的CNN架构的推理延迟。在本文中，我们提出了一种低秩分解方法FFConv专用于有效的密文包装，以减少旋转开销和HMA操作。FFConv使用低秩分解卷积来近似d x d卷积层，其中具有较少通道的d x d低秩卷积之后是1 x 1卷积以恢复通道。使用DensePack的d x d低秩卷积显著减少了旋转操作，而使用ConvPack的1 x 1卷积的旋转开销接近于零。据我们所知，FFConv是第一个能够同时减少DensePack和ConvPack所产生的旋转开销的工作，而不会向HECNN推理管道中引入额外的特殊块。与现有技术的LoLa和Falcon相比，我们的方法分别将推理延迟降低了88%和21%，并且在MNIST和CIFAR-10上具有相当的准确性。
FastFHE: Packing-Scalable and Depthwise-Separable CNN Inference Over FHE
Institute of Computing Technology, CAS（中国科学院计算技术研究所）；UCAS（中国科学院大学）；Fordham University（福特汉姆大学）；Dalian University of Technology（大连理工大学）；Beihang University（北京航空航天大学）；Georgia Institute of Technology（佐治亚理工学院）
Efficient Encrypted Computation in Convolutional Spiking Neural Networks with TFHE
School of Cyber Science and Engineering, Huazhong University of Science and Technology（华中科技大学网络空间安全学院）；School of Mathematics and Statistics, Huazhong University of Science and Technology（华中科技大学数学与统计学院）；Center for Mathematical Science, Huazhong University of Science and Technology（华中科技大学数学中心）；Steklov-Wuhan Institute for Mathematical Exploration, Huazhong University of Science and Technology（华中科技大学斯捷克洛夫-武汉数学探索研究所）；Department of Mathematics and Department of Physics, Great Bay University（大湾区大学数学与物理学院）；Guangdong Provincial Key Laboratory of Mathematical and Neural Dynamical Systems（广东省数学与神经动力系统重点实验室）
VeriFuzzy: A Dynamic Verifiable Fuzzy Search Service for Encrypted Cloud Data
Tianjin University（天津大学）；Southern Cross University（南十字星大学）；East China Normal University（华东师范大学）；Griffith University（格里菲斯大学）；City University of Hong Kong（香港城市大学）
