Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Machine Learning on Encrypted Data Without Decrypting It

juliacomputing.com

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Machine Learning on Encrypted Data Without Decrypting It

#71

Post by mikorym »

ChrisRackauckas wrote: post #20

This blog post reminds me of the "Machine Learning Systems are Stuck in a Rut" paper [1], where they mentioned: > It is hard to experiment with front end features like named dimensions, because it is painful to match them to back ends that expect calls to monolithic kernels with fixed layout. On the other hand, there is little incentive to build high quality back ends that support other features, because all the fron…

> fully homeomorphic encryption

I think you mean fully homomorphic encryption, that is, f(x.y)=f(x).f(y).

A homeomorphism is a isomorphism of topological spaces. If you do mean the latter then it would be something new (and I am curious to hear about it).

Re: Machine Learning on Encrypted Data Without Decrypting It

#72

Post by falcolas »

KenoFischer wrote: post #68
falcolas wrote: post #65

Earlier quoted context omitted.

So, you're training a statistical model - teaching it to recognize certain patterns - on data that is somehow wholly without patterns? Even with a certain amount of noise in the individual data points, if you're given enough data to train a statistical model to identify traits in the ciphertext you also probably have enough data to break the encryption. Also, something can be statistically random and still have patte…

> Once the model is trained, I can run this on any data encrypted with key X and find out if the data contains a cat (with some degree of accuracy). I have no way of telling information outside the tags provided on the training data, but it still gives me, a person without the encryption key, the ability to identify any feature that's tagged in the training set on any un-tagged production set. I think you're missing…

Predictions are a tag, and a separate confidence value. A fairly finite set. Cat. Not a Cat.

Large quantities of small finite sets are anathema to encryption.

Re: Machine Learning on Encrypted Data Without Decrypting It

#73

Post by mikorym »

KenoFischer wrote: post #4
falcolas wrote: post #2

Before reading: "I bet they're using homomorphic encryption to expose patterns in the encrypted data" After reading: Yup. It makes sense, so long as your resulting model is run against similarly encrypted data, the same patterns will be there for the ML to identify. Which is, of course, one of the issues with homomorphic encryption.

Just to clarify, homomorphic encryption does not expose patterns. At every point in the computation the ciphertexts are computationally indistinguishable from random. The result of evaluating the ML model will be an encrypted prediction that you then need to send back to whoever encrypted the data (or more precisely whoever has the key - doesn't need to be the same person) so they can decrypt and use the prediction.

It would be good to see a proof why the homomorphism property is sufficient for doing ML (or a specific type of ML) on encrypted data.

Intuitively it may or may not make sense to people, but a proof would also clarify whether there are any caveats, limitations or other particuliarities.

Re: Machine Learning on Encrypted Data Without Decrypting It

#74

Post by KenoFischer »

falcolas wrote: post #72
KenoFischer wrote: post #68

Earlier quoted context omitted.

> Once the model is trained, I can run this on any data encrypted with key X and find out if the data contains a cat (with some degree of accuracy). I have no way of telling information outside the tags provided on the training data, but it still gives me, a person without the encryption key, the ability to identify any feature that's tagged in the training set on any un-tagged production set. I think you're missing…

Predictions are a tag, and a separate confidence value. A fairly finite set. Cat. Not a Cat. Large quantities of small finite sets are anathema to encryption.

I'm still only guessing at the objection, but if it helps, the encryptions are randomized, so two different encryptions of the same value do not have the same ciphertext.

Re: Machine Learning on Encrypted Data Without Decrypting It

#75

Post by ChrisRackauckas »

mikorym wrote: post #71
ChrisRackauckas wrote: post #20

This blog post reminds me of the "Machine Learning Systems are Stuck in a Rut" paper [1], where they mentioned: > It is hard to experiment with front end features like named dimensions, because it is painful to match them to back ends that expect calls to monolithic kernels with fixed layout. On the other hand, there is little incentive to build high quality back ends that support other features, because all the fron…

> fully homeomorphic encryption I think you mean fully homomorphic encryption, that is, f(x.y)=f(x).f(y). A homeomorphism is a isomorphism of topological spaces. If you do mean the latter then it would be something new (and I am curious to hear about it).

Oops :)

Re: Machine Learning on Encrypted Data Without Decrypting It

#76

Post by rehasu »

Think about what encryption should do. Think about what Machine Learning should do. The only thing you can do with ML on encrypted data is show where encryption needs to be improved. Or maybe there is a way to create ML models that produces output which only someone with the correct (private) key can understand.

Re: Machine Learning on Encrypted Data Without Decrypting It

#77

Post by jrockway »

jeltz wrote: post #59
throwawaymath wrote: post #16

Earlier quoted context omitted.

Read Craig Gentry's PhD thesis, which was the first working fully homomorphic encryption scheme. It's no longer state of the art, but it contains a lot of accessible background on the core problem (which was then open) and why it's important. The person you're responding to is correct. It's an explicit design goal that a fully homomorphic encryption system would not expose any distinguishable oracle about the underly…

What about side effects? Does eg timing of the computations leak data?

I would expect that all data processing by default leaks information via computation time. Some algorithms are intentionally designed to resist this; people that have gone to this effort will mention them. (A similar thing: assume something is not thread-safe unless the documentation mentions it's thread-safe.)

Re: Machine Learning on Encrypted Data Without Decrypting It

#78

Post by KenoFischer »

rehasu wrote: post #76

Think about what encryption should do. Think about what Machine Learning should do. The only thing you can do with ML on encrypted data is show where encryption needs to be improved. Or maybe there is a way to create ML models that produces output which only someone with the correct (private) key can understand.

> Or maybe there is a way to create ML models that produces output which only someone with the correct (private) key can understand.

Yes, that's what the blog post describes how to do.

Re: Machine Learning on Encrypted Data Without Decrypting It

#79

Post by EGreg »

You know what’s interesting?

Aren’t hashes etc. done by some nonlinear functions?

Doesn’t ML kind of try to fit your model using linear functions all the way down? Or not only linear?

Point being — can ML techniques be used to reverse hashes or find collissions? Immovable object vs irresistible force?

Anyone got actual INFO on how this plays out?

Re: Machine Learning on Encrypted Data Without Decrypting It

#80

Post by yati »

rehasu wrote: post #76

Think about what encryption should do. Think about what Machine Learning should do. The only thing you can do with ML on encrypted data is show where encryption needs to be improved. Or maybe there is a way to create ML models that produces output which only someone with the correct (private) key can understand.

> Nowhere was the user data decrypted and in particular the cloud provider does not have access to either the orignal image nor is it able to decrypt the prediction it computed.

That's from the post. Is that what you meant by creating a model whose results only the owner of the data can understand?

Post reply on HN