Challenges Of Using Homomorphic Encryption In Machine Learning Soumia Zohra El Mestari SnT, University of Luxembourg Introduction Homomorphic Encryption (HE) is a form of public key encryption that allows evaluating a function on encrypted data without the need to decrypt [3, 1]. The adoption of HE in Machine Learning (ML) contexts faces many challenges, namely: • Non support for non linear functions • Noise growth • Secret key recovery attacks Non support for non linear functions Fully Homomorphic Encryption (FHE) schemes so far only support addition and multiplication hence machine learning activation functions are then not supported for direct FHE evaluation. There are three commonly used methods to support non-linear functions: • use a polynomial substitution • pre-compute function for discrete values and store these values in look-up tables • use low-degree polynomials to approximate the non-linear functions All these methods are approximations so they cause a precision loss in the case of inference and additional convergence time if we train on homomorphically encrypted data. Noise growth Approximate FHE schemes like CKKS [1] decrypt to an approximated value of the original message. Figure: Approximate Homomorphic encryption evaluation The sources of noise are caused by the encoding and the noise growth after each operation with the multiplication having the most noise growth scale. The bootstrapping operation despite being one of the solutions to reduce the noise in ciphers is computationally expensive and hence the homomorphic evaluation of deep neural networks for example can face large computation overheads. Secret key discovery attacks When using approximate numbers schemes like CKKS [1], a passive attacker having access to ciphers and their decrypted versions can recover the secret key by analysing the noise growth in ciphers; in fact, the results are approximated, and the IND-CPA security does not oﬀer suﬃcient protection. Figure: Secret key recovery attack on CKKs [1] Such a devastating attack can be mitigated by injecting an additional Gaussian noise during the decryption which will make the precision decrease. Conclusion The adoption of HE in ML systems is promising, multiple attempts ( such as CryptoNets [2] ) started emerging HE inference as attempts to oﬀer conﬁdentiality level of privacy to machine learning tools. References [1] J. H. Cheon, A. Kim, M. Kim, and Y. Song. Homomorphic encryption for arithmetic of approximate numbers. In International Conference on the Theory and Application of Cryptology and Information Security, pages 409–437. Springer, 2017. [2] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pages 201–210. PMLR, 2016. [3] P. Martins, L. Sousa, and A. Mariano. A survey on fully homomorphic encryption: An engineering perspective. ACM Computing Surveys (CSUR), 50(6):1–33, 2017. Acknowledgements This work has been funded by the European Union’s Horizon 2020 Innovative Training Networks, Legality Attentive Data Scientists (LEADS) under Grant Agreement ID 956562 Contact information • Email: soumia.elmestari@uni.lu 1/1