Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Machine Learning on Encrypted Data Without Decrypting It

juliacomputing.com

Post reply on HN
Print view View original

91–100 of 122 posts

Re: Machine Learning on Encrypted Data Without Decrypting It

#91

Post by ummonk »

mikorym wrote: post #73
KenoFischer wrote: post #4

Earlier quoted context omitted.

Just to clarify, homomorphic encryption does not expose patterns. At every point in the computation the ciphertexts are computationally indistinguishable from random. The result of evaluating the ML model will be an encrypted prediction that you then need to send back to whoever encrypted the data (or more precisely whoever has the key - doesn't need to be the same person) so they can decrypt and use the prediction.

It would be good to see a proof why the homomorphism property is sufficient for doing ML (or a specific type of ML) on encrypted data. Intuitively it may or may not make sense to people, but a proof would also clarify whether there are any caveats, limitations or other particuliarities.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

Re: Machine Learning on Encrypted Data Without Decrypting It

#92

Post by rhindi »

jrockway wrote: post #77
jeltz wrote: post #59

Earlier quoted context omitted.

What about side effects? Does eg timing of the computations leak data?

I would expect that all data processing by default leaks information via computation time. Some algorithms are intentionally designed to resist this; people that have gone to this effort will mention them. (A similar thing: assume something is not thread-safe unless the documentation mentions it's thread-safe.)

Actually homomorphic encryption always ends up running as slow as the worse case, so you can’t do a sidechannel attack by looking at the computation time.

Re: Machine Learning on Encrypted Data Without Decrypting It

#93

Post by ct520 »

ummonk wrote: post #91
mikorym wrote: post #73

Earlier quoted context omitted.

It would be good to see a proof why the homomorphism property is sufficient for doing ML (or a specific type of ML) on encrypted data. Intuitively it may or may not make sense to people, but a proof would also clarify whether there are any caveats, limitations or other particuliarities.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

more like really straight forward over my head. I appreciate you taking the time to explain it - still can't grasp the concept. Back to framework connecting.

Re: Machine Learning on Encrypted Data Without Decrypting It

#94

Post by thekyle »

personjerry wrote: post #84

This technique is deeply flawed. You can't do this effectively without outside knowledge they should not have. They are in fact using outside knowledge, specifically that the encrypted data is in the form of images. Without that knowledge, you wouldn't know which ML techniques to use! Additionally, remember that feature engineering is a big part of what makes ML effective at all, and that certainly cannot be done on…

I disagree that knowing the type of data being encrypted makes the technique flawed. Let's say you wanted to build a Speech-to-Text API that takes some encrypted audio, transcribes it, and returns the transcriptions encrypted.

Sure, you know that any files sent to you are going to be encrypted audio files, but you don't know what is being said in them which is the point of this technique.

Re: Machine Learning on Encrypted Data Without Decrypting It

#95

Post by garganzol »

personjerry wrote: post #84

This technique is deeply flawed. You can't do this effectively without outside knowledge they should not have. They are in fact using outside knowledge, specifically that the encrypted data is in the form of images. Without that knowledge, you wouldn't know which ML techniques to use! Additionally, remember that feature engineering is a big part of what makes ML effective at all, and that certainly cannot be done on…

The ML example blog provides is amusing.

It tends to make some people think that neural network can somehow "see" the patterns in encrypted data. Plain wrong.

What happens in reality is this: the neural network is encrypted and can only work on encrypted data producing only the encrypted results.

The data can only be decrypted by the data owner who would not share his private key with anybody. That's it.

In this way, the whole algorithm works in a so called encrypted domain. When used in this role, homomorphic encryption (HE) engine resembles a custom CPU. That CPU is not Turing-complete because it lacks conditional branching, but it is almost there providing two basic operations: addition and multiplication. This is enough for a lot of tasks.

Does a CPU know a type of data or something special about them? Not at all. It executes primitive instructions of a program, one by one producing the output result from a set of inputs.

The program P that HE "CPU" executes can be any program suitable for the given instruction set. Not only ML. It can be any other program!

That's why homomorphic encryption is a very important technique in the area of cryptographic obfuscation. It allows to hide the data processed by a program P. And if that program P is a virtual machine (sometimes called Universal Circuit or UC) by itself, it would allow to hide the code as well, reaching the state of indistinguishability obfuscation. There are some practical problems along the way, but we are moving there.

Yep, that sounds like magic, but it's based on a pure "boring" math with a few bright ideas here and there. What was thought as an impossible feat in the past, gradually becomes a reality.

Isn't that the reason why Nobel is a no go for mathematicians? Otherwise, they would get plenty of Nobels (almost all of them, for sure).

Re: Machine Learning on Encrypted Data Without Decrypting It

#96

Post by xvector »

ummonk wrote: post #91
mikorym wrote: post #73

Earlier quoted context omitted.

It would be good to see a proof why the homomorphism property is sufficient for doing ML (or a specific type of ML) on encrypted data. Intuitively it may or may not make sense to people, but a proof would also clarify whether there are any caveats, limitations or other particuliarities.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

You might want to clarify that “C-1” is actually C^-1 because otherwise I was wondering where subtraction comes into play.

Re: Machine Learning on Encrypted Data Without Decrypting It

#97

Post by [deleted] »

ct520 wrote: post #93
ummonk wrote: post #91

Earlier quoted context omitted.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

more like really straight forward over my head. I appreciate you taking the time to explain it - still can't grasp the concept. Back to framework connecting.

[deleted]

Re: Machine Learning on Encrypted Data Without Decrypting It

#99

Post by garganzol »

EGreg wrote: post #79

You know what’s interesting? Aren’t hashes etc. done by some nonlinear functions? Doesn’t ML kind of try to fit your model using linear functions all the way down? Or not only linear? Point being — can ML techniques be used to reverse hashes or find collissions? Immovable object vs irresistible force? Anyone got actual INFO on how this plays out?

> Point being — can ML techniques be used to reverse hashes or find collissions? Immovable object vs irresistible force?

That's actually a good philosophical observation. And there is an answer for that.

If you try to use ML on an encrypted data set then it will blow up and won't converge. The encrypted data contain a lot of randomness while the ML would assume the presence of a not insignificant amount of continuity, linearity and correlation.

Trying to train a network on encrypted data would blow it up as it would not be able to find a convergence point in any observable time. The effort would be equivalent to trying to bruteforce the encryption.

But if you have a few million years, a few PBs of storage and some extravagant network training algorithm based on mutations, who knows.

Re: Machine Learning on Encrypted Data Without Decrypting It

#100

Post by StefanKarpinski »

Since there seems to be a lot of confusion throughout this thread, perhaps I can attempt to clarify what's going on at a very high level. The setting is that the user sends their data to a service and wants the service to do useful work on their data without knowing what their data is. In this case, the work that the service does is apply a pre-trained, non-secret ML vision model to the secret, encrypted data. The result is an encrypted answer that is sent back to the user, who can decrypt it and get a useful result. The service is none the wiser about what the user's data was, nor what the answer was.

Does this seem like impossible magic? Yes. Everyone was pretty surprised when the first theoretical fully homomorphic encryption schemes were found. For a while people believed that it might never be efficient enough to be practical. But now it's actually feasible to do limited but real useful computations on behalf of a user without the service learning anything about what it is computing for the user. There is ongoing work to expand what kinds of computations can be done efficiently.

Post reply on HN