Converting Transformers to Polynomial Form for Secure Inference Over Homomorphic Encryption

TL;DR

This paper introduces the first polynomial transformer architecture enabling secure inference over homomorphic encryption, demonstrating its effectiveness on language and image classification tasks with comparable performance to traditional models.

Contribution

The paper presents a novel polynomial transformer design and a method to convert transformer operators into polynomial form, facilitating privacy-preserving inference with homomorphic encryption.

Findings

Achieved secure inference on language and image datasets

Models perform comparably to traditional transformers

Conducted ablations to analyze component contributions

Abstract

Designing privacy-preserving deep learning models is a major challenge within the deep learning community. Homomorphic Encryption (HE) has emerged as one of the most promising approaches in this realm, enabling the decoupling of knowledge between the model owner and the data owner. Despite extensive research and application of this technology, primarily in convolutional neural networks, incorporating HE into transformer models has been challenging because of the difficulties in converting these models into a polynomial form. We break new ground by introducing the first polynomial transformer, providing the first demonstration of secure inference over HE with transformers. This includes a transformer architecture tailored for HE, alongside a novel method for converting operators to their polynomial equivalent. This innovation enables us to perform secure inference on LMs with WikiText-103. It also allows us to perform image classification with CIFAR-100 and Tiny-ImageNet. Our models yield results comparable to traditional methods, bridging the performance gap with transformers of similar scale and underscoring the viability of HE for state-of-the-art applications. Finally, we assess the stability of our models and conduct a series of ablations to quantify the contribution of each model component.