Package: tf-encrypted
TF Encrypted is a framework for encrypted machine learning in TensorFlow. It looks and feels like TensorFlow, taking advantage of the ease-of-use of the Keras API while enabling training and prediction over encrypted data via secure multi-party computation and homomorphic encryption. TF Encrypted aims to make privacy-preserving machine learning readily available, without requiring expertise in cryptography, distributed systems, or high performance computing.See below for morebackground material, explore theexamples, or visit thedocumentationto learn more about how to use the library.Now, TF Encrypted is based on tensorflow 2 !TF1 execute computation by building a graph first, then run this graph in a session.
This is hard to use for a lot of developers, especially for researchers not major in computer science.
Therefore, TF1 has very few users and is not maintained any more.
Since TF Encrypted based on TF1, it face the same problem that TF1 has encountered.
So we update TF Encrypted, to rely on TF2 to support eager execution which makes development on TF Encrypted more easier.
At the same time, it also supports building graph implicitly bytfe.functionto realize nearly the same performance as TF Encrypted based on TF1.
Unfortunately, after updated, TF1 features like session and placeholder are not supported by TFE any more.
For those developers who want to use TF1 like TFE, we suggest them to useversion 0.8.0.InstallationTF Encrypted is available as a package onPyPIsupporting Python 3.8+ and TensorFlow 2.9.1+:pipinstalltf-encryptedCreating a conda environment to run TF Encrypted code can be done using:conda create -n tfe python=3.8
conda activate tfe
conda install tensorflow notebook
pip install tf-encryptedAlternatively, installing from source can be done using:gitclonehttps://github.com/tf-encrypted/tf-encrypted.gitcdtf-encrypted
pipinstall-e.
makebuildThis latter is useful on platforms for which the pip package has not yet been compiled but is also needed fordevelopment.
Note that this will get you a working basic installation, yet a few more steps are required to match the performance and security of the version shipped in the pip package, see theinstallation instructions.UsageThe following is an example of simple matmul on encrypted data using TF Encrypted based on TF2,
you could execute matmul in eager mode or building a graph by@tfe.function.importtensorflowastfimporttf_encryptedastfe@tfe.local_computation('input-provider')defprovide_input():# normal TensorFlow operations can be run locally# as part of defining a private input, in this# case on the machine of the input providerreturntf.ones(shape=(5,10))# provide inputsw=tfe.define_private_variable(tf.ones(shape=(10,10)))x=provide_input()# eager executiony=tfe.matmul(x,w)res=y.reveal().to_native()# build graph and run graph@tfe.functiondefmatmul_func(x,w)y=tfe.matmul(x,w)returny.reveal().to_native()res=matmul_func(x,w)For more information, check out thedocumentationor theexamples.PerformanceAll tests are performed by using the ABY3 protocol among 3 machines, each with 4 cores (Intel Xeon Platinum 8369B CPU @ 2.70GHz), Ubuntu 18.04 (64bit), TensorFlow 2.9.1, Python 3.8.13 and pip 21.1.2. The LAN environment has a bandwidth of 40 Gbps and a RTT of 0.02 ms, and the WAN environment has a bandwidth of 352 Mbps and a RTT of 40 ms.You can find source code of the following benchmarks in./examples/benchmark/and corresponding guidelines of how to reproduce them.Benchmark 1: Sort and MaxGraph building is a one-time cost, while LAN or WAN timings are average running time across multiple runs.
For example, it takes 152.5 seconds to build the graph for Resnet50 model, and afterwards, it only takes 19.1 seconds to predict each image.Build graph(seconds)LAN(seconds)WAN(seconds)Sort/Max (2^10)15.260.1410.37Sort/Max (2^16)114.067.3741.97Max (2^10 $\times$ 4)25.630.010.55Max (2^16 $\times$ 4)25.810.291.141Maxis implemented by using a sorting network, hence its performance is essentially the same asSort. Sorting network can be efficiently constructed as a TF graph. The traditional way of computingMaxby using a binary comparison tree does not work well in a TF graph, because the graph becomes huge when the number of elements is large.2This means 2^10 (respectively, 2^16) invocations ofmaxon 4 elements, which is essentially aMaxPoolwith pool size of2 x 2.Benchmark 2: Neural Network InferenceWe show the strength of TFE by loading big TF models (e.g. RESNET50) and run private inference on top of it.Build graphLANWANVGG19 inference time (seconds)105.1849.63139.63RESNET50 inference time (seconds)150.4719.07184.29DENSENET121 inference time (seconds)344.5533.53151.431This is currently one of the fastest implementation of secure RESNET50 inference (three-party). Comparable withCryptGPU,SecureQ8, and faster thanCryptFLOW.Benchmark 3: Neural Network TrainingWe benchmark the performance of training several neural network models on the MNIST dataset (60k training images, 10k test images, and batch size is 128).
The definitions of these models can be found inexamples/models.Accuracy (epochs)Accuracy (epochs)Seconds per Batch (LAN)Seconds per Batch (LAN)Seconds per Batch (WAN)Seconds per Batch (WAN)MP-SPDZTFEMP-SPDZTFEMP-SPDZTFEA  (SGD)96.7% (5)96.5% (5)0.0980.1679.7244.510A  (AMSgrad)97.8% (5)97.4% (5)0.2280.71721.03815.472A  (Adam )97.4% (5)97.4% (5)0.2210.53550.96315.153B  (SGD)97.5% (5)98.6% (5)0.5715.33260.75518.656B  (AMSgrad)98.6% (5)98.7% (5)0.6805.72271.98321.647B  (Adam)98.8% (5)98.8% (5)0.7725.73398.10821.130C  (SGD)98.5% (5)98.7% (5)1.1758.19891.34127.102C  (AMSgrad)98.9% (5)98.9% (5)1.56810.053119.27166.357C  (Adam)99.0% (5)99.1% (5)2.8259.893195.01365.320D  (SGD)97.6% (5)97.1% (5)0.1340.43915.0835.465D  (AMSgrad)98.4% (5)97.4% (5)0.2280.90026.09914.693D  (Adam)98.2% (5)97.6% (5)0.2930.71054.40414.515We also give the performance of training a logistic regression model in the following table. This model is trained to classify two classes: small digits (0-4) vs large digits (5-9). Dataset can be found inexamples/benchmark/training/lr_mnist_dataset.pyAccuracy (epochs)Seconds per Batch (LAN)Seconds per Batch (WAN)LR (SGD)84.8% (5)0.0100.844LR (AMSgrad)85.0% (5)0.0231.430LR (Adam)85.2% (5)0.0191.296RoadmapHigh-level APIs for combining privacy and machine learning. So far TF Encrypted is focused on its low-level interface but it's time to figure out what it means for interfaces such as Keras when privacy enters the picture.Tighter integration with TensorFlow. This includes aligning with the upcoming TensorFlow 2.0 as well as figuring out how TF Encrypted can work closely together with related projects such asTF PrivacyandTF Federated.Support for third party libraries. While TF Encrypted has its own implementations of secure computation, there are otherexcellent librariesout there for both secure computation and homomorphic encryption. We want to bring these on board and provide a bridge from TensorFlow.Background & Further ReadingBlog posts:Introducing TF Encryptedwalks through a simple example showing two data owners jointly training a logistic regression model using TF Encrypted on a vertically split dataset (by Alibaba Gemini Lab)Federated Learning with Secure Aggregation in TensorFlowdemonstrates using TF Encrypted for secure aggregation of federated learning in pure TensorFlow (by Justin Patriquin at Cape Privacy)Encrypted Deep Learning Training and Predictions with TF Encrypted Kerasintroduces and illustrates first parts of our encrypted Keras interface (by Yann Dupis at Cape Privacy)Growing TF Encryptedoutlines the roadmap and motivates TF Encrypted as a community project (by Morten Dahl)Experimenting with TF Encryptedwalks through a simple example of turning an existing TensorFlow prediction model private (by Morten Dahl and Jason Mancuso at Cape Privacy)Secure Computations as Dataflow Programsdescribes the initial motivation and implementation (by Morten Dahl)Papers:Privacy-Preserving Collaborative Machine Learning on Genomic Data using TensorFlowoutlines theiDASH'19winning solution built on TF Encrypted (by Cheng Hong, et al.)Crypto-Oriented Neural Architecture Designuses TF Encrypted to benchmark ML optimizations made to better support the encrypted domain (by Avital Shafran, Gil Segev, Shmuel Peleg, and Yedid Hoshen)Private Machine Learning in TensorFlow using Secure Computationfurther elaborates on the benefits of the approach, outlines the adaptation of a secure computation protocol, and reports on concrete performance numbers (by Morten Dahl, Jason Mancuso, Yann Dupis, et al.)Presentations:Privacy-Preserving Machine Learning with TensorFlow, TF World 2019 (by Jason Mancuso and Yann Dupis at Cape Privacy); see also theslidesPrivacy-Preserving Machine Learning in TensorFlow with TF Encrypted, O'Reilly AI 2019 (by Morten Dahl at Cape Privacy); see also theslidesOther:Privacy Preserving Deep Learning – PySyft Versus TF Encryptedmakes a quick comparison between PySyft and TF Encrypted, correctly hitting on our goal of being the encryption backend in PySyft for TensorFlow (by Exxact)Bridging Microsoft SEAL into TensorFlowtakes a first step towards integrating the Microsoft SEAL homomorphic encryption library and some of the technical challenges involved (by Justin Patriquin at Cape Privacy)Development and ContributionTF Encrypted is open source community project developed under the Apache 2 license and maintained by a set of core developers. We welcome contributions from all individuals and organizations, with further information available in ourcontribution guide. We invite any organizations interested inpartneringwith us to reach out viaemail.Don't hesitate to send a pull request, open an issue, or ask for help! We useZenHubto plan and track GitHub issues and pull requests.Individual contributionsWe appreciate the efforts ofall contributorsthat have helped make TF Encrypted what it is! Below is a small selection of these, generated bysourcerer.iofrom most recent stats:Organizational contributionsWe are very grateful for the significant contributions made by the following organizations!Project StatusTF Encrypted is experimental software not currently intended for use in production environments. The focus is on building the underlying primitives and techniques, with some practical security issues postponed for a later stage. However, care is taken to ensure that none of these represent fundamental issues that cannot be fixed as needed.Known limitationsElements of TensorFlow's networking subsystem does not appear to be sufficiently hardened against malicious users. Proxies or other means of access filtering may be sufficient to mitigate this.SupportPlease open anissue, or send an email tocontact@tf-encrypted.io.LicenseLicensed under Apache License, Version 2.0 (seeLICENSEorhttp://www.apache.org/licenses/LICENSE-2.0). Copyright as specified inNOTICE.