Volley Revolver: A Novel Matrix-Encoding Method for Privacy-Preserving Neural Networks (Inference)

TL;DR

This paper introduces a new matrix-encoding technique for homomorphic encryption that enables efficient privacy-preserving neural network inference, demonstrated on handwritten digit classification with promising performance.

Contribution

The authors propose a novel matrix-encoding method tailored for homomorphic encryption, facilitating efficient privacy-preserving neural network inference.

Findings

Homomorphic matrix multiplication is efficiently achieved using the proposed encoding.

The CNN implementation on MNIST encryptions takes approximately 287 seconds for 10 likelihoods.

Only one ciphertext of 19.8 MB is needed to upload 32 images for inference.

Abstract

In this work, we present a novel matrix-encoding method that is particularly convenient for neural networks to make predictions in a privacy-preserving manner using homomorphic encryption. Based on this encoding method, we implement a convolutional neural network for handwritten image classification over encryption. For two matrices $A$ and $B$ to perform homomorphic multiplication, the main idea behind it, in a simple version, is to encrypt matrix $A$ and the transpose of matrix $B$ into two ciphertexts respectively. With additional operations, the homomorphic matrix multiplication can be calculated over encrypted matrices efficiently. For the convolution operation, we in advance span each convolution kernel to a matrix space of the same size as the input image so as to generate several ciphertexts, each of which is later used together with the ciphertext encrypting input images for calculating some of the final convolution results. We accumulate all these intermediate results and thus complete the convolution operation. In a public cloud with 40 vCPUs, our convolutional neural network implementation on the MNIST testing dataset takes $\sim$ 287 seconds to compute ten likelihoods of 32 encrypted images of size $28 \times 28$ simultaneously. The data owner only needs to upload one ciphertext ($\sim 19.8$ MB) encrypting these 32 images to the public cloud.