Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Machine Learning on Encrypted Data Without Decrypting It

juliacomputing.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Machine Learning on Encrypted Data Without Decrypting It

#101

Post by k__ »

StefanKarpinski wrote: post #100

Since there seems to be a lot of confusion throughout this thread, perhaps I can attempt to clarify what's going on at a very high level. The setting is that the user sends their data to a service and wants the service to do useful work on their data without knowing what their data is. In this case, the work that the service does is apply a pre-trained, non-secret ML vision model to the secret, encrypted data. The re…

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Re: Machine Learning on Encrypted Data Without Decrypting It

#102

Post by mikedilger »

"True homomorphic encryption isn't possible, and my guess is that it will never be feasible for most applications. But limited application tricks like this have been around for decades, and sometimes they're useful" - Bruce Schneier https://www.schneier.com/blog/archives/2019/07/google_releas...

Re: Machine Learning on Encrypted Data Without Decrypting It

#103

Post by karpierz »

personjerry wrote: post #89
sthatipamala wrote: post #87

Earlier quoted context omitted.

If I don't even know what data type my input is, what meaningful output can the system give? I wouldn't consider that cheating. Also, you can do feature engineering on a training set that you collect, as long as that is similar to the distribution of end user inputs. That's a pretty standard ML workflow.

The entire point of encrypted data is you don't know what's in there. What they're claiming is they've worked around this problem, but they haven't, because they're subtly incorporating outside information: specifically that they know what the data looks like already. From a true third-party looking at encrypted data, you would have no idea. What does your statement about feature engineering have to do with encrypted…

You seem to be misunderstanding the value proposition. Suppose that I have some of my personal medical data, and I'd like to use it to try and detect early symptoms of HIV. But because there's a stigma against HIV and I don't trust medical providers to handle my data correctly, I refuse to hand over my data to a third party service unencrypted. Without homomorphic encryption, I'd be out of luck; I couldn't use a third-party service to analyze my data and return a prediction.

With homomorphic encryption: - I encrypt my data locally - Send the encrypted bits over to the third-party - The third-party uses their ML algorithm to compute a prediction - They send back an encrypted prediction - I decrypt the prediction locally and get my results.

At no point in this process can anyone, aside from me, see either the input data or the output.

Re: Machine Learning on Encrypted Data Without Decrypting It

#104

Post by StefanKarpinski »

k__ wrote: post #101
StefanKarpinski wrote: post #100

Since there seems to be a lot of confusion throughout this thread, perhaps I can attempt to clarify what's going on at a very high level. The setting is that the user sends their data to a service and wants the service to do useful work on their data without knowing what their data is. In this case, the work that the service does is apply a pre-trained, non-secret ML vision model to the secret, encrypted data. The re…

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently.

It is also possible for the model to be provided by the user and encrypted along with the data rather than being fixed and public. That way the service can apply a model that it doesn't know to data that it also doesn't know. This allows a fairly general service in theory, but it remains a challenge to express more than fairly simple models in a way that can be computed efficiently.

Re: Machine Learning on Encrypted Data Without Decrypting It

#105

Post by StefanKarpinski »

mikedilger wrote: post #102

"True homomorphic encryption isn't possible, and my guess is that it will never be feasible for most applications. But limited application tricks like this have been around for decades, and sometimes they're useful" - Bruce Schneier https://www.schneier.com/blog/archives/2019/07/google_releas...

I don't understand what Bruce Schneier means by this quote. Several fully homomorphic encryption schemes have been proposed and implemented. "True" doesn't have a technical meaning in this context, so it's unclear what's he means by that phrase. Perhaps that he believes it will never be fast enough for general computations? Or perhaps he's referring to the fact that schemes don’t allow conditionals?

Re: Machine Learning on Encrypted Data Without Decrypting It

#107

Post by kortex »

garganzol wrote: post #63
Dylan16807 wrote: post #46

Earlier quoted context omitted.

The software can only do arithmetic in a fixed pattern, no "if" statements or while loops or anything. Any conditionals have to be faked with arithmetic. So, since the arithmetic is secure (otherwise it wouldn't be HE), and the entire runtime pattern is fixed up front and made of nothing but arithmetic, there's no way to leak anything.

This gives a whole new look to lambda calculus and Lisp concepts that promote to represent everything as a (preferably pure) function. If the whole logic can be expressed as a pure function without conditionals then it would fully fit into HE. But what if we want conditionals? Comparison operators like (a b), etc go out of the question immediately as they would allow to guess the values by a simple binary search. Equ…

Have you looked at reversible computing? The ideas are only vague in my mind at the moment, but the fragments are there. Disclaimer: out of my wheelhouse. Any conditional statement will throw some information away, "knowing" a==b means provably you have less complexity. Not a good look for encryption.

But instead let's say you have some register which gets rotated/xor'd in some way based on the relationship of a to b.

I don't think you can do branching logic though.

Re: Machine Learning on Encrypted Data Without Decrypting It

#109

Post by ummonk »

xvector wrote: post #96
ummonk wrote: post #91

Earlier quoted context omitted.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

You might want to clarify that “C-1” is actually C^-1 because otherwise I was wondering where subtraction comes into play.

Whoops, too late to edit; thanks for posting the clarification.

Re: Machine Learning on Encrypted Data Without Decrypting It

#110

Post by mikorym »

ummonk wrote: post #91
mikorym wrote: post #73

Earlier quoted context omitted.

It would be good to see a proof why the homomorphism property is sufficient for doing ML (or a specific type of ML) on encrypted data. Intuitively it may or may not make sense to people, but a proof would also clarify whether there are any caveats, limitations or other particuliarities.

It is really straightforward. The currently top voted comment basically explains it. If you take data x and encrypt it with encryption function C to get C(x), and then apply your machine learning model f to that to get f(C(x)), homomorphism means that f(C(x)) = C(f(x)) (because f and C commute), so the client can then apply the decryption to the result to get C-1(f(C(x)) = C-1(C(f(x)) = f(x).

But are you saying that a ML model is just a function? The function C is clear, but what is f?

What is the domain and what is the codomain? If f and C commute, then x in X is just your "data" and both the domain and codomain.

Edit:

> the top voted comment

Ah, I see that the top comment says that you use a pre-trained model. Intuitively that I think makes sense. Bot how about training the model itself?

Post reply on HN