# Privacy Preserving Machine Learning with Homomorphic Encryption and Federated Learning
## 4 Experiments and Results Analysis
### Comparison of Model Training Time for Different Key Lengths  
Due to the threat of membership inference attacks, transmitting gradient data in plain text may be exploited by a malicious user to train his own shadow models. The privacy related data security of other clients will be violated. Here, we use Paillier homomorphic encryption in PFMLP. In addition, the encryption is operated during the gradient data transmission, and homomorphic operations are performed in the computing server to ensure that the encrypted gradient data will not be leaked, even if the server has security vulnerabilities.  
In Paillier, the key length is an important factor that affects the security level. Generally, the longer the key length, the higher the security level. However, using a long key, the time overhead for generating the ciphertext also increases. For the MNIST and metal fatigue dataset, three comparison experiments are conducted. In addition, the model structure is fixed, and different key lengths are the core factors of time cost of model training. Table 5 shows the details.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Encryption Algorithm** & **Dataset** & **Key Length (Bits)** & **Time (Seconds)** \\ \hline None & & - & 7.92 \\ [PERSON] & MNIST & 128 & 12,033.25 \\ Paillier & & 256 & 45,467.44 \\ Paillier & & 512 & 199,915.70 \\ \hline None & & - & 9.84 \\ Paillier & & 64 & 2567.44 \\ Paillier & & 128 & 4480.02 \\ Paillier & & 256 & 13,428.92 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Impact of different key lengths on total training time.  
Figure 7: Prediction accuracy between MLP and PFMLP.  
From Table 5 in both datasets, the impact of Paillier key length is proportional to the time consumption. Meanwhile, as in Figures 8 and 9, it is a line chart of the training time for each round of learning for PFMLP on two datasets. Since in each round, it requires the encryption and decryption of gradient data, and the encrypted gradient is transmitted to the computing server for further operation, it is reasonable that, as the key length increases, the time overhead of each round of training increases. Thus, we can choose an appropriate key length that is a trade-off between security level and time performance. In addition, in order to upgrade the security level, we can update the key in each round of training. In this way, even if a certain round of keys is cracked, it will not affect the security of the overall training process to achieve the higher level of data security.  
From the above experiment, it shows that, under the same model and the same key length, 4000 pieces of data take 358.14 s per iteration, 8000 data 733.69 s, and 12,000 data 1284.06 s. Thus, it says that the time overhead is positively related to the amount of encrypted data.  
We use the Improved Paillier algorithm to conduct experiments on the MNIST dataset, and compare the time costs of encryption and decryption with the same gradient data in the same round of iterations, as shown in Table 6.  
Figure 8: Per-iterations time spent on the MNIST dataset for different key lengths.  
Figure 9: Per-iterations time spent for different key lengths on the fatigue dataset.  
Therefore, since the algorithm requires encryption for the gradient matrix and more hidden layer units, the time overhead will increase proportionally. In addition, as the number of units in the hidden layer increases, the amount of data to be transmitted in the network also increases. In order to reduce the time overhead of the PFMLP algorithm, under the premise of ensuring the accuracy, the number of hidden layers and each hidden layer units should be reduced as much as possible.