approximate homomorphic encryption and privacy preserving ...ย ยท โข idea1: restriction of domain...
Post on 09-Jul-2020
14 Views
Preview:
TRANSCRIPT
Jung Hee Cheon (SNU, CryptoLab)
Approximate Homomorphic Encryption and Privacy Preserving Machine Learning
Thanks to YongSoo Song, Kiwoo Lee, Andrey KIM
1. Homomorphic Encryption2. HEAAN3. Bootstrapping of HEAAN4. Toolkit for Homomorphic Computation
Outline
Integer-based HE scheme
- RAD PH[1]
โข (Secret Key, Operation Key) = (a large prime ๐, ๐ = ๐๐0)โข Encryption: ๐ธ๐๐ ๐ = ๐ + ๐๐ ๐๐๐ ๐โข Decryption: ๐ธ๐๐ ๐ ๐๐๐ ๐ = ๐โข ๐ธ๐๐ ๐1 + ๐ธ๐๐ ๐2 = ๐1 + ๐๐1 + ๐2 + ๐๐2
= ๐1 +๐2 + ๐ ๐1 + ๐2= ๐ธ๐๐ ๐1 +๐2
- DGHV HE scheme (on โค2)[2]
โข ๐ธ๐๐(๐ โ ๐2100) = ๐ + 2100๐ + ๐๐โข SECURE against quantum computingโข Use a polynomial ring ๐ ๐ = โค๐[๐ฅ]/(๐ฅ๐ + 1)
Homomorphic Encryption
But, INSECURE!
2100๐1 ๐1
2100๐2 ๐2
2200๐1๐2 + 2100 ๐1๐2 +๐2๐1 + ๐1๐2
X
- On Polynomials (RingLWE)โข [Gen09] ideal latticeโข NTRU: LTV12โข Ring-LWE: BV11b, GHS13, BLLN13, HEAAN etc
- On Integers (AGCD)โข [DGHV10] FHE over the Integers. Eurocrypt 2010โข CMNT11, CNT12, CCKLLTY13, CLT14, etc
- On Matrices (LWE)โข [BV11a] Efficient FHE from (Standard) LWE. FOCS11โข Bra12, BGV12, GSW13
Fully Homomorphic Encryption
1. 2009~2012: Plausibility and Scalable for Large Circuitsโข [GH11] A single bit bootstrapping takes 30 minutesโข [GHS12b] 120 blocks of AES-128 (30K gates) in 36 hours
2. 2012~2015: Depth-Linear Constructionโข [BGV12] Modulus/Key Switchingโข [Bra12] Scale Invariant Schemeโข [HS14] IBM's open-source library Helib: AES evaluation in 4 minutes
3. 2015~Today: Usabilityโข Various schemes with different advantages (HEAAN, TFHE)โข Real-world tasks: Big data analysis, Machine learningโข Competitions for Private Genome Computation (iDash, 2014~)โข HE Standardization meetings (2017~)
Continued on next page
Summary of Progress in HE
Standardization: HomomorphicEncryption.org
1st Workshop (2017.7.13-14) 2nd Workshop (2018.3.15-16) 3rd Workshop (2018.10.20)
Jul 2017 in Microsoft, Redmond
Mar 2018 in MIT
Oct 2018 in Toronto
Best Performing HE Schemes
Type Classical HE Fast Bootstrapping Approximate Computation
Scheme[BGV12] BGV
[Bra12, FV12] B/FV[DM15] FHEW[CGGI16] TFHE
[CKKS17] HEAAN
PlaintextFinite Field
PackingBinary string
Real/Complex numbers
Packing
Operation Addition, Multiplication Look-up table & bootstrapping Fixed-point Arithmetic
LibraryHElib (IBM)
SEAL (Microsoft Research)
Palisade (Duality inc.)
TFHE(Inpher, Gemalto, etc.)
HEAAN (SNU)
Homomorphic Encryption
Exact Multiplication
1.23
4.56
0.78
0.91
5.6088
0.7098
3.98112624
2.34
5.67
8.91
0.23
13.2678
2.0493
27.18970254
108.2456382397886496
- The plaintext size is doubled after a multiplication.2 4
8
16
Approximate Multiplication
HEAAN [CKKS17]โข Rescale after a multiplicationโข Tracing # of significandsโข Most data is processed approximately in Data analysis or ML
1.23
4.56
0.78
0.91
5.6188
0.7198
3.98112624
2.34
5.67
8.91
0.23
13.2778
2.0593
27.19970254
108.2556382397886496
2 2
2
2
HEAAN = ๆ ง็ผ = Insightful Minds
[CKKS, AC17] Homomorphic Encryption for Arithmetic of Approximate Numbershttps://eprint.iacr.org/2016/421.pdf
Numerical Representation
- Encode ๐ into an integer ๐ โ ๐๐ฅ for a scaling factor ๐ : 2 โฆ 1412 โ 2 โ 103
- FixedโPoint Multiplicationโข Compute ๐ = ๐1๐2 and extract its significant digits ๐โฒ โ ๐โ1 โ ๐
: 1.234 ร 5.678 = 1234 โ 10โ3 ร 5678 โ 10โ3 = 7006652 โ 10โ6 โฆ 7007 โ 10โ3 = 7.007
Previous HE on LWE problem (Regev, 2005)
โข ct = Encsk ๐ , ct, sk =๐
๐ก๐ + ๐ mod ๐
โข Modulo ๐ก plaintext vs Rounding operation
Approximate Computation
๐
๐/๐ก
๐
๐ก
A New Message Encodingโข ct = Encsk ๐ , ct, sk = ๐๐ + ๐ mod ๐
โข Consider ๐ as part of approximation error
Homomorphic Operations
Support for the (approximate) fixed-point arithmetic
- Leveled HE : ๐ = ๐๐ฟ
HEAAN
Input ๐1 โ ๐๐1, ๐2 โ ๐๐2
Addition ๐1 + ๐2 โ ๐ โ (๐1 +๐2)
Multiplication ๐ = ๐1๐2 โ ๐2 โ ๐1๐2
Rounding ๐โฒ โ ๐โ1 โ ๐ โ ๐ โ ๐1๐2
๐1 = ๐๐1 + ๐1
๐๐2 = ๐๐2 + ๐2
๐ = ๐2๐1๐2 + ๐
๐โฒ = ๐ โ ๐1๐2 + ๐โฒ
๐/๐
Construction over the ringโข A single ctx can encrypt a vector of plaintext values ๐ง = (๐ง1, ๐ง2, โฆ , ๐งโ)โข Parallel computation in a SIMD manner ๐ง โ๐ค = (๐ง1๐ค1, ๐ง2๐ค2, โฆ , ๐งโ๐คโ)
HEAAN Packed Ciphertext
Continued on next page
Let ๐ = โค ๐ ๐๐ + 1 and ๐ ๐ = ๐ mod ๐ = โค๐ ๐ ๐๐ + 1
โข A ciphertext can encrypt a polynomial ๐ ๐ โ ๐ โข Note (m0+m1X+ โฆ ) (m0โ+m1โX+ โฆ )= m0m0โ+(m0m1โ +m0โm1)X+โฆ
โข Decoding/Encoding function๐ = โค ๐ ๐๐ + 1 โ โ ๐ ๐๐ + 1 โ โ๐/2
where ๐๐ + 1 = ๐ โ ๐1 ๐ โ ๐1โ1 ๐ โ ๐2 ๐ โ ๐2
โ1 โฏ ๐ โ ๐ ๐ 2 ๐ โ ๐ ๐ 2โ1
โข Example: ๐ = 4, ๐1 = ๐๐ฅ๐(๐๐/4), ๐2 = ๐๐ฅ๐(5๐๐/4)
โข ๐ง = 1 โ 2๐, 3 + 4๐ โฆ ๐ ๐ = 2 โ 2 2 ๐ + ๐2 โ 2 ๐3
โข โฆ ๐ ๐ = 2000 โ 2828๐ + 1000๐2 โ 1414 ๐3
โข ๐ ๐1 โ 1000.15 โ 1999.55 ๐, ๐ ๐2 โ 2999.85 + 3999.55 ๐
RLWE-based HEAAN
๐ ๐ โฆ ๐ง = ๐ง1, โฆ , ๐ง๐โ2 , ๐ง๐ = ๐ ๐๐ ,
Bootstrapping
Decryption๐ธ๐๐๐(๐พ)
๐ธ๐๐(๐)
c = ๐ธ๐๐๐(๐; ๐)
๐พ
๐
๐ธ๐๐๐ ๐; ๐โฒ , ๐โฒ: small
Safe Box
[1] Cheon-Han-Kim-Kim-Song: Bootstrapping for Approximate Homomorphic Encryption. EUROCRYPT 2018
โข Old Ciphertext with large noise
โข Encrypted Secret Key
โข New ciphertext with small noise
โข Evaluate Decrypt circuit
Input
Output
Process
โข Ciphertexts of a leveled HE have a limited lifespanโข Refresh a ciphertext ct = Encsk ๐
by evaluating the decryption circuit homomorphically: Decsk ct = ๐ โบ ๐นct sk = ๐ where ๐นct โ = Decโ ct
โข Bootstrapping key BK = Encsk(sk): ๐นct BK = ๐นct Encsk sk = Encsk ๐นct sk = Encsk(๐)
โข Homomorphic operations introduce errors Fine: ๐นct BK = ๐นct Encsk sk = Encsk ๐นct sk + ๐ = Encsk(๐ + ๐)
โข How to evaluate the decryption circuit (efficiently)?: Decsk ct = ct, sk (mod ๐)
Bootstrapping
๐ท๐๐๐ ๐ ๐๐ก โฆ ๐ก = ๐๐ก, ๐ ๐ โฆ ๐ก ๐ = ๐,
๐ก = ๐๐ผ + ๐ for some ๐ผ < ๐พ
โข Naรฏve solution: polynomial interpolation on [โ๐พ๐, ๐พ๐]โข Huge depth, complexity & inaccurate result
Approximate Decryption
๐ท๐๐๐ ๐ ๐๐ก โฆ ๐ก = ๐๐ก, ๐ ๐ โฆ ๐ก ๐ = ๐,
๐ก = ๐๐ผ + ๐ for some ๐ผ < ๐พ
โข Idea1: Restriction of domain ๐ โช ๐
Approximate Decryption
โข Idea1: Restriction of domain ๐ โช ๐
โข Idea 2: Sine approximation ๐ โ๐
2๐sin ๐ for ๐ =
2๐
๐๐ก (period:๐ , slope at 0=1)
๐
1
๐ท๐๐๐ ๐ ๐๐ก โฆ ๐ก = ๐๐ก, ๐ ๐ โฆ ๐ก ๐ = ๐,
๐ก = ๐๐ผ + ๐ for some ๐ผ < ๐พ
Approximate Decryption
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
0
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
1
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
2
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
3
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
4
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
5
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
6
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formula
โข ๐ถ๐+1 ๐ = ๐ถ๐2 ๐ โ ๐๐
2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
7
Bootstrapping of HEAAN
Sine Evaluation
- Direct Taylor approximationโข Huge depth & complexity
- Idea 1: Low-degree approx. near 0
โข ๐ถ0 ๐ = ๐=0๐ โ1 ๐
2๐ ! ๐ 2๐ 2๐ โ cos ๐ 2๐
โข ๐0 ๐ = ๐=0๐ โ1 ๐
2๐+1 ! ๐ 2๐ 2๐+1 โ sin( ๐ 2๐)
- Idea 2: Iterate by double-angle formulaโข ๐ถ๐+1 ๐ = ๐ถ๐
2 ๐ โ ๐๐2 ๐ , ๐๐+1 ๐ = 2๐๐ ๐ โ ๐ถ๐ ๐
โข Numerically stable & Linear complexity๐๐ ๐ โ sin ๐
8
Bootstrapping of HEAAN
Iteration vs Direct Computation
- ๐๐(๐) is obtained from ๐0(๐) and ๐ถ0(๐) by ๐ iterationsโข One computation of Doubleโangle formula: 2 squarings + 1 additionโข ๐ iterations take 2๐ squarings + ๐ additionsโข Degree of ๐๐(๐) โ 2๐
- Direct Taylor Approximationโข 2๐ multiplications to get 2๐ degree approximation ๐2๐ of sine function
Bootstrapping of HEAAN
Slot-Coefficient Switching
- Ringโbased HEAANโข Homomorphic operations on plaintext slots, not on coefficientsโข We need to perform the modulo reduction on coefficients
- Pre/post computation before/after sine evaluationโข Depth consumption: Sine evaluationโข Complexity: Slot-Coefficient switchings (# of slots)
- Performance of Bootstrapping
- Experimental Resultsโข 127 + 12 = 139 s / 128 slotsร12 bitsโข 456 + 68 = 524 s / 128 slotsร24 bits
Coefficient Plaintext Slots
โ ๐ ๐๐ + 1 โ ๐ 2
๐ก ๐ = ๐ โ ๐ผ ๐ + ๐(๐)
(๐ก0, ๐ก1, โฆ ๐ก๐โ1)
(๐0, ๐1, โฆ , ๐๐โ1)
๐ ๐ = ๐0 +โฏ+ ๐๐โ1๐๐โ1
โ coeff to slotโก sine eval
โข slot to coeff
Bootstrapping of HEAAN
Speed of FHE
2011 2013 2014 2015 2016 2018
1-bit Amortized
1bit, 1800s
1bit, 0.7s
1bit, 0.052s
*120s, 250K bit
172s, 531bit 320s, 16K bit
1800s โ 0.05s (1bit) 1800s โ 0.00046s (Amortized)
: 30K~300K times
*[CHH18]Faster Homomorphic Discrete Fourier Transforms and Improved FHE Bootstrapping, eprint, 1073, 2018/ Intel Xeon CPU E5-2620 2.10GHz, 64RAM
[GH11] Implementing Gentryโs Fully-Homomorphic Encryption Scheme, Eurocrypt 2011.[CCK+13] Batch Fully Homomorphic Encryption over the Integers, Eurocrypt 2013.[CLT14] Scale-Invariant Fully Homomorphic Encryption over the Integers, PKC 2014.[HS15] Bootstrapping for Helib, Eurocrypt 2015[DM15] FHEW: Boostrapping Homomorpic Encryption in Less Than a Second, Eurocrypt 2015.[CGGI16] Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds, Asiacrypt 2016.
Slide Courtesy of Xiaoqian Jiang (โณ = too small iteration โ hard to adapt for other data)
Rank
1
3
โณ
โณ2
X
X
2017 Track 3: Logistic Regression Training on Encrypted Data
2018 Track 2 : Secure Parallel Genome Wide Association Studies using HE
Team Submission Schemes
End to End Performance Evaluation result ( F1- Score ) at different cutoffs
Running
time
(mins)
Peak
Memory (M)
0.01 0.001 0.0001 0.00001
Gold Semi Gold Semi Gold Semi Gold Semi
A*FHE
A*FHE -1 +
HEAAN
922.48 3,777 0.977 0.999 0.986 0.999 0.985 0.999 0.966 0.998
A*FHE -2 1,632.97 4,093 0.882 0.905 0.863 0.877 0.827 0.843 0.792 0.826
ChimeraVersion 1 + TFHE & HEAAN
(Chimera)
201.73 10,375 0.979 0.993 0.987 0.991 0.988 0.989 0.982 0.974
Version 2 215.95 15,166 0.339 0.35 0.305 0.309 0.271 0.276 0.239 0.253
Delft BlueDelft Blue
HEAAN1,844.82 10,814 0.965 0.969 0.956 0.944 0.951 0.935 0.884 0.849
UC San
Diego
Logistic Regr + HEAAN 1.66 14,901 0.983 0.993 0.993 0.987 0.991 0.989 0.995 0.967
Linear Regr 0.42 3,387 0.982 0.989 0.980 0.971 0.982 0.968 0.925 0.89
Duality IncLogistic Regr +
CKKS (Aka HEAAN),
pkg: PALISADE
3.8 10,230 0.982 0.993 0.991 0.993 0.993 0.991 0.990 0.973
Chi2 test 0.09 1,512 0.968 0.983 0.981 0.985 0.980 0.985 0.939 0.962
Seoul
National
University
SNU-1
HEAAN
52.49 15,204 0.975 0.984 0.976 0.973 0.975 0.969 0.932 0.905
SNU-2 52.37 15,177 0.976 0.988 0.979 0.975 0.974 0.969 0.939 0.909
IBMIBM-Complex CKKS
(Aka HEAAN),
pkg: HElIb
23.35 8,651 0.913 0.911 0.169 0.188 0.067 0.077 0.053 0.06
IBM- Real 52.65 15,613 0.542 0.526 0.279 0.28 0.241 0.255 0.218 0.229
Slide Courtesy of Xiaoqian Jiang
Packing Method
- HEAAN supports vector operations- How can we compute matrix operations for ciphertexts?
- Matrix Encoding method
How to Pack
1 2 3 4
5 6 7 8
9 10 11 12
13 14 15 16
Encode
1 2 โฏ 16๐ = ๐ธ๐๐( )
Packing Method
- Matrix addition : trivial- Matrix multiplication : non-trivial (exercise)- Row/column rotation?
How to rotate
1 2 3 4
5 6 7 8
9 10 11 12
13 14 15 16
4 1 2 3
8 5 6 7
12 9 10 11
16 13 14 15
๐๐๐ก ๐, 1 = ๐ธ๐๐( 16 1 โฏ 15 ) =
16 1 2 3
4 5 6 7
18 9 10 11
12 13 14 15
(wrong)
Packing Method
- Solution : using masking vector
How to rotate
16 1 2 3
4 5 6 7
8 9 10 11
12 13 14 15
โ
0 1 1 1
0 1 1 1
0 1 1 1
0 1 1 1
=
0 1 2 3
0 5 6 7
0 9 10 11
0 13 14 15
๐๐๐ก ๐, 1 โ๐๐๐ ๐ =
4 5 6 7
8 9 10 11
12 13 14 15
16 1 2 3
โ
1 0 0 0
1 0 0 0
1 0 0 0
1 0 0 0
=
4 0 0 0
8 0 0 0
12 0 0 0
16 0 0 0
๐๐๐ก ๐, โ3 โ๐๐๐ ๐โฒ =
โด ๐ถ๐๐๐ ๐๐ก (๐) = ๐๐๐ก ๐, 1 โ๐๐๐ ๐ + ๐๐๐ก ๐, โ3 โ๐๐๐ ๐โฒ =
4 1 2 3
8 5 6 7
12 9 10 11
16 13 14 15
Message Space
- Bit-wise HE: โค2={0,1} with logical gatesโข Good at gate operations but slow at arithmetic.
- Word-wise HE: โ or โค๐ with add. & mult.
โข Good at poly evaluation but hard to evaluate non-poly function.
Idea: Use Polynomial Approximation for Non-Poly Functions!- Donโt use naรฏve Taylor Approx. It is local i.e. approx at a point- Minimize errors on an interval- Methods: Least Square, Chevyshev, Minimax โฆ
Polynomial Approximation
Application : Homomorphic Logistic Regression [HHCP]- Need to evaluate sigmoid function : 1/(1+exp(-x))
Real Financial Large Data (Provided by KCB) About 400,000 samples with 200 features. Target value = โcredit scoreโ
Polynomial Approximation
Idea: ๐ถ๐๐๐ ๐, ๐ = lim๐โโ
๐๐
๐๐+๐๐for a,b>0
1. Compute approximately (Take only the msb of the results)
2. Choose k as a power of 2
3. Use iteration algorithms for division
Comparison
Method Scheme(Amortized)Running time
# of pairs Error
Bit-wiseHElib โ 1 ms 1800
0TFHE โ 1 ms -
Ours (Word-wise)
HEAAN 0.73 ms 216 < 2-8
General Max
๐๐๐ฅ ๐1, โฆ , ๐๐ก = lim๐โโ
๐1๐+1+โฏ+๐
๐ก๐+1
๐1๐+โฏ+๐
๐ก๐ for ai>0
2nd ๐๐๐ฅ ๐1, โฆ , ๐๐ก = lim๐โโ
๐1๐+1+โฏ+๐
๐ก๐+1โ๐๐๐ฅ๐+1
๐1๐+โฏ+๐
๐ก๐โ๐๐๐ฅ๐
Applications: k-max, threshold counting, clustering, โฆ
Min/Max
Fast\Merge Sort: O(klogk)
- Comparison-based algorithm doesnโt work on HE- We cannot check min-max condition
Sorting Network: O(klog2k)
- Comparison network that always sort their inputs- Data-independent algorithm
Results
- 64 slots : about 12 min. (previous work : 42 min. [EGN+15])- 32,768 slots : about 10.5 hour (previous work: impractical)
Sorting on Encrypted Data
Basic Tools:
Packing, Matrix Operation, Comparison, Approximate inv/sigmoid,
Decision Tree: Packing, Comparison
Boosting: Comparison and Gradient Decent
Deep Neural Network: Fast matrix operations + Approximate
Convolution Neural Network: + Comparison
Toward Homomorphic Machine Learning
HEAAN natively supports for the (approximate) fixed point arithmetic
Ciphertext modulus log ๐ = ๐ฟ log ๐ grows linearly
Useful when evaluating analytic functions approximately:โข Polynomialโข Multiplicative Inverseโข Trigonometric Functionsโข Exponential Function (Logistic Function, Sigmoid Function)
Packing technique based on DFTโข SIMD (Single Instruction Multiple Data) operationโข Rotation on plaintext slots:
HEAAN: Summary
๐ง = ๐ง1, โฆ , ๐ง ๐ 2 โฆ ๐งโฒ = (๐ง2, โฆ , ๐ง ๐ 2, ๐ง1)
top related