[Paper Review] CryptoDL: Deep Neural Networks over Encrypted Data

Ehsan Hesamifard, Hassan Takabi+1 more|arXiv (Cornell University)|Nov 14, 2017

Cryptography and Data SecurityComputer Science1 references292 citations

TL;DR

The paper proposes privacy-preserving CNN classification over encrypted data by approximating activation functions (ReLU, Sigmoid, Tanh) with low-degree polynomials suitable for leveled homomorphic encryption, and demonstrates competitive MNIST and CIFAR-10 results alongside throughput measurements.

ABSTRACT

Machine learning algorithms based on deep neural networks have achieved remarkable results and are being extensively used in different domains. However, the machine learning algorithms requires access to raw data which is often privacy sensitive. To address this issue, we develop new techniques to provide solutions for running deep neural networks over encrypted data. In this paper, we develop new techniques to adopt deep neural networks within the practical limitation of current homomorphic encryption schemes. More specifically, we focus on classification of the well-known convolutional neural networks (CNN). First, we design methods for approximation of the activation functions commonly used in CNNs (i.e. ReLU, Sigmoid, and Tanh) with low degree polynomials which is essential for efficient homomorphic encryption schemes. Then, we train convolutional neural networks with the approximation polynomials instead of original activation functions and analyze the performance of the models. Finally, we implement convolutional neural networks over encrypted data and measure performance of the models. Our experimental results validate the soundness of our approach with several convolutional neural networks with varying number of layers and structures. When applied to the MNIST optical character recognition tasks, our approach achieves 99.52\% accuracy which significantly outperforms the state-of-the-art solutions and is very close to the accuracy of the best non-private version, 99.77\%. Also, it can make close to 164000 predictions per hour. We also applied our approach to CIFAR-10, which is much more complex compared to MNIST, and were able to achieve 91.5\% accuracy with approximation polynomials used as activation functions. These results show that CryptoDL provides efficient, accurate and scalable privacy-preserving predictions.

Motivation & Objective

• Address privacy concerns in CNN inference by performing computations on encrypted data.
• Develop polynomial activations that are HE-friendly (additions and multiplications only).
• Theoretically justify polynomial approximation quality and degree selection.
• Empirically evaluate CNN performance on MNIST and CIFAR-10 with encrypted inference.
• Assess practicality in terms of accuracy and prediction throughput under HE constraints.

Proposed method

• Provide a theoretical foundation for approximating continuous functions with low-degree polynomials (Stone–Weierstrass framework with 2-norm/error considerations).
• Develop polynomial approximations for activation functions (ReLU, Sigmoid, Tanh) with emphasis on low degree to suit leveled HE schemes.
• Train CNNs using the polynomial activations and compare against original activations in plaintext baselines on MNIST/CIFAR-10.
• Implement CNNs over encrypted data using HE (HELib) and evaluate encrypted inference performance and accuracy.
• Analyze the trade-off between polynomial degree, approximation quality, and computational efficiency.

Experimental results

Research questions

• RQ1 Can activation functions in CNNs be accurately approximated by low-degree polynomials suitable for homomorphic encryption?
• RQ2 What is the impact of polynomial degree on classification accuracy for CNNs trained with HE-friendly activations?
• RQ3 How do HE-based, privacy-preserving CNNs perform on standard benchmarks (MNIST, CIFAR-10) compared to plaintext models?
• RQ4 What is the throughput of encrypted CNN inference and its practicality for real-world use?

Key findings

• On MNIST, CNN with polynomial activations achieves 99.52% accuracy versus 99.56% for the original ReLU model.
• On a deeper CNN, accuracy with polynomial activations reaches 99.32% and closely tracks the plaintext performance as depth increases.
• With degree-2/3 polynomials for ReLU, accuracy remains strong (e.g., 98.52% in one setup, 99.21% with higher degree).
• On CIFAR-10, the approach yields 91.5% accuracy using approximation polynomials.
• Encrypted inference experiments (using HELib) demonstrate practical performance with SIMD batching and measured encryption/classification times (throughput reported as up to ~164,000 predictions per hour for MNIST).
• The results indicate CryptoDL provides efficient, accurate, and scalable privacy-preserving predictions.