Get started
Work

Enabling Large-Scale Privacy-Preserving Recurrent Neural Networks with Fully Homomorphic Encryption

Year: 2023
Type: dissertation
Abstract: Fully homomorphic encryption (FHE) can be used to secure a variety of neural networks. We show that FHE can be applied to recurrent neural networks (RNNs) and used for image classification and speaker identification. Using the CGGI [25] mathematical foundation of FHE encryption, we develop several methods to aid in converting plaintext RNNs into CGGI-compatible RNNs. A requirement to utilize CGGI is to quantize RNNs into integers, which is a difficult task. One of the contributions in this thesis is a novel quantization procedure for RNNs that successfully quantizes large-scale RNNs greater than 1M parameters into ternarized parameters and binarized activations. In order to mitigate numeric overflow, this thesis proposes a novel regularization method called the Overflow-Aware Activity Regularizer (OAR) that teaches RNN networks to output correct values, regardless of the existence of overflow. Another contribution is the addition of an attention layer to encrypted RNNs. To the best of our knowledge, this is the first work to successfully incorporate attention by proposing a novel ciphertext-ciphertext multiplication method that simultaneously reduces the amount of computation required by half. We develop two ground-breaking, large-scale, privacy-preserving RNNs with multiple RNN layers. The first, with around 2M parameters, achieves 2s latency over the MNIST dataset using two Nvidia A100 GPUs, which is three orders of magnitude better than the state-of-the-art, SHE [78]. By utilizing OAR, nearly all activations between plaintext and encrypted runs are the same. The second, with around 13M parameters and an attention layer, correctly classifies encrypted speech sequences up to 426 timesteps in length, one order of magnitude longer than SHE.
Language: English
Open Access status: green
OpenAlex ID: W7133036352
Cites: 78
Cited by:
Related to: 10