Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Machine Learning on Encrypted Data Without Decrypting It

juliacomputing.com

Post reply on HN
Print view View original

111–120 of 122 posts

Re: Machine Learning on Encrypted Data Without Decrypting It

#111

Post by ViralBShah »

orbifold wrote: post #41
ChrisRackauckas wrote: post #20

This blog post reminds me of the "Machine Learning Systems are Stuck in a Rut" paper [1], where they mentioned: > It is hard to experiment with front end features like named dimensions, because it is painful to match them to back ends that expect calls to monolithic kernels with fixed layout. On the other hand, there is little incentive to build high quality back ends that support other features, because all the fron…

Julia always seemed great on paper and definitely is a strong candidate for replacing Matlab. But whenever I tried using it, the user experience seemed much more broken than python or c++. It just seems way easier to structure and work on a python + c++ project than it is to structure and work on a Julia project. A moderately sized sane c++ code base compiles and runs faster than whatever gymnastics Julia performs to…

The one thing Julia does not do is install gigabytes of libraries in global directories by default. The default install does not require root, and installs the packages and libraries in ~/.julia.

How did you end up with libraries in global directories?

Also, while we are working on reducing the time to first plot latency (which has to do with compiling large amounts of code - the time to second plot is 0.2sec), it would be good to learn more about the compiler quality issues you mention. We always welcome constructive comments on the Julia discourse.

Re: Machine Learning on Encrypted Data Without Decrypting It

#112

Post by pishpash »

StefanKarpinski wrote: post #104
k__ wrote: post #101

Earlier quoted context omitted.

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

This depends on a very special kind of "encryption".

Re: Machine Learning on Encrypted Data Without Decrypting It

#113

Post by Analog24 »

KenoFischer wrote: post #53
Analog24 wrote: post #49

Earlier quoted context omitted.

As someone who is not a cryptography expert, is there any hope of using similar logic to train on encrypted data? Naively it seems like you could perform the same operations on the back propagation steps (or any other update algorithm you're using for non NN models) to arrive at the encrypted version of the parameter updates, which you could then decrypt to get the updated model. Am I missing something here?

Training is a lot tougher. Just doing one gradient update step isn't all that bad (although you may have to play with the loss function a bit, e.g. logit cross entropy is probably tough to evaluate). However, then you need to go and actually do all the steps and gradient updates, so you probably need some form of bootstrapping to be able to evaluate computations of that depth. Also, the use case is slightly less comp…

There are definitely compelling use-cases and there are people working on it (though not me). Developing tools/systems to handle sensitive data in a secure way is extremely expensive and time consuming. If you can create data collection and model training pipelines that can operate effectively with just encrypted data then you greatly reduce the number of vulnerabilities (e.g. fewer employees need to actually see the sensitive data and fewer points of attack on the system itself).

There are certainly a number of factors to consider besides data security when evaluating the practicality of such an approach but I just wanted to confirm that it was technically possible before getting in to any of that. Thanks for your response and the post, I knew almost nothing about HE before today.

Re: Machine Learning on Encrypted Data Without Decrypting It

#114

Post by de_watcher »

StefanKarpinski wrote: post #104
k__ wrote: post #101

Earlier quoted context omitted.

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

I don't understand why it has to be trained on encrypted data. Isn't it faster to train on the cleartext data (and of course use the same instruction set, the unencrypted counterpart of it)?

Re: Machine Learning on Encrypted Data Without Decrypting It

#115

Post by mikorym »

StefanKarpinski wrote: post #104
k__ wrote: post #101

Earlier quoted context omitted.

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

I would think the pre-trained point is critical.

Is there a way of doing the training (without being provided a trained model) all on the encrypted side?

Re: Machine Learning on Encrypted Data Without Decrypting It

#116

Post by mikorym »

de_watcher wrote: post #114
StefanKarpinski wrote: post #104

Earlier quoted context omitted.

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

I don't understand why it has to be trained on encrypted data. Isn't it faster to train on the cleartext data (and of course use the same instruction set, the unencrypted counterpart of it)?

I think he is saying that you do the training on cleartext data.

Re: Machine Learning on Encrypted Data Without Decrypting It

#117

Post by de_watcher »

mikorym wrote: post #116
de_watcher wrote: post #114

Earlier quoted context omitted.

I don't understand why it has to be trained on encrypted data. Isn't it faster to train on the cleartext data (and of course use the same instruction set, the unencrypted counterpart of it)?

I think he is saying that you do the training on cleartext data.

Ah ok, his first "yes" confused me so much that I saw no value to read further.

Re: Machine Learning on Encrypted Data Without Decrypting It

#118

Post by k__ »

StefanKarpinski wrote: post #104
k__ wrote: post #101

Earlier quoted context omitted.

Sounds strange. Does this mean that the model has to be trained on encrypted data?

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

Does this has something to do with all the operations being linear?

Re: Machine Learning on Encrypted Data Without Decrypting It

#119

Post by garganzol »

mikorym wrote: post #115
StefanKarpinski wrote: post #104

Earlier quoted context omitted.

Yes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also po…

I would think the pre-trained point is critical. Is there a way of doing the training (without being provided a trained model) all on the encrypted side?

Yes, but the data owner will need to provide the feedback in clear text.

Re: Machine Learning on Encrypted Data Without Decrypting It

#120

Post by garganzol »

kortex wrote: post #107
garganzol wrote: post #63

Earlier quoted context omitted.

This gives a whole new look to lambda calculus and Lisp concepts that promote to represent everything as a (preferably pure) function. If the whole logic can be expressed as a pure function without conditionals then it would fully fit into HE. But what if we want conditionals? Comparison operators like (a b), etc go out of the question immediately as they would allow to guess the values by a simple binary search. Equ…

Have you looked at reversible computing? The ideas are only vague in my mind at the moment, but the fragments are there. Disclaimer: out of my wheelhouse. Any conditional statement will throw some information away, "knowing" a==b means provably you have less complexity. Not a good look for encryption. But instead let's say you have some register which gets rotated/xor'd in some way based on the relationship of a to b…

Good suggestions, thank you.

> I don't think you can do branching logic though.

You can. If we would be able to introduce a special equality operator, let's call it SEQ that works like so:

SEQ(a, b) = 1 when a == b; SEQ(a, b) = 0 when a != b

Then we would be able to do conditionals by discarding the result of unmatched branch by multiplying it by 0.

Thanks to the fact that all HE calculations are pure, no observable side effects would be produced.

For example, here is a simple program with a conditional statement:

P(x) = x == 10 ? 42 : sin(x)

This is how it may look in HE domain:

P(x) = SEQ(x, 10) * 42 + (1 - SEQ(x, 10)) * sin(x)

No branching is involved here but the result is equivalent to a program with branching. Eureka!

Once again, thank you for the fruitful suggestions.

EDIT: by the way, it paves the way for implementing > and < operators as well due to the fact that operator result remains in encrypted domain. This is a serious wow moment.

Post reply on HN