IEEE Computational Intelligence Magazine - August 2022 - 21

enc_prod = mul_ciphertexts(enc_m1, enc_m2)
print( " Product ciphertext: " + enc_prod)
------------------------------------------Product
ciphertext: 4616X**15 + 69851X**14 +
... + 70424X**2 + 108145X + 97186, 41476X
**15 + 15425X**14 + ... + 13366X**2 +
108332X + 94209, 77259X**15 + 32461X**14 +
... + 49450X**2 + 5811X + 35650
Decryption can now be used as follows:
decrypted = decrypt_poly(enc_prod, ks, theta)
decoded = decode_binary(decrypted)
print( " Decrypted encoded result: " +
decrypted)
print( " Decoded result: " + decoded))
------------------------------------------Decrypted
encoded result: X**3 + X**2 + X
Decoded result: 14
In this case, the homomorphic multiplication between the two
ciphertexts also produces a correct result. This ends the first
part of this study, which was the introduction to HE with
examples. In the next section, HE will be used for designing
privacy-preserving CNNs.
III. Designing Privacy-Preserving CNNs With
Homomorphic Encryption: A Methodology
The aim of this section is to detail the methodology for designing
privacy-preserving CNNs using HE, which is the second
of the two main contributions of this study. Designing privacypreserving
deep learning solutions based on HE requires one
to rethink and redesign deep learning solutions that consider
the constraints on the type and number of operations that
characterize the BFV scheme. Among the wide range of deep
learning solutions, the present paper focuses on CNNs [11],
which are the state-of-the-art solution in several application
scenarios, such as object detection and sound recognition [23].
layers hpl
A CNN (·)F is a deep neural network with L processing
() ,l
each of which is characterized by the parameters p l
with lL1 f= ,, . In a privacy-preserving CNN based on HE,
the processing layers must comprise only addition and multiplication,
and the length L of the processing pipeline must guarantee
that the NB is not exhausted during processing.
Figure 2 presents an overview of the proposed methodology
for the design of privacy-preserving CNNs based on HE.
Let (·)F be the CNN to be encoded with HE. The goal of the
methodology is to design a privacy-preserving version
{ (·)H
F (·) as well as to identify the configuration of the encryption
parameters H which will guarantee that the NB does not reach
0 during processing. To achieve these goals, the methodology
has three different steps: model approximation, model encoding,
and model validation. These three steps are detailed in the
following sections.
A. Model Approximation
The aim of the model approximation is to replace the processing
layers of (·)F that do not comply with the BFV scheme
with those that rely only on additions and multiplications.
Doing so is crucial in a deep learning scenario where processing
layers typically comprise division, square root as well
as nonlinear activation functions. The output of this step is an
approximated model (·){ that comprises processing layers
that are HE-compliant.
In more detail, the model approximation step receives as
input a CNN (·)F and provides the corresponding approximated
model (·){ as output. In such a model each processing layer
()l
l
hpt comprises only additions and multiplications, and hence, is
compatible with the BFV scheme. After this approximation
phase, the approximated CNN model must be retrained.
A summary of the possible approximations is presented in
Fig. 3 and detailed in the following paragraphs.
1) Pooling Layers
Maximum pooling layers use the comparison operator, which is
not available in the BFV scheme. To address this problem, various
pooling algorithms can be used to replace the maximum pooling.
The present authors suggest replacing it with the average
pooling available in the BFV scheme since it only requires multiplication
between the sum of ciphertexts and a fixed value,
which is known a priori (i.e.,
1 kk ,wh
# with kw, kh being the
width and height of the pooling kernel, respectively).
F(.)
Model
Approximation
Modify the Architecture
of F(.)
ϕ(.)
Model
Encoding
Change Layer
Approximations
ϕΘ(.)
Model
Validation
Are NB
and Accuracy
Sufficient?
No
Modify Θ
FIGURE 2 A methodology for the design of privacy-preserving CNNs based on HE.
= Encoded Values
= Approximated Layers
Yes Optimal
ϕΘ(.)
of
AUGUST 2022 | IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE 21
IEEE Computational Intelligence Magazine - August 2022

Table of Contents for the Digital Edition of IEEE Computational Intelligence Magazine - August 2022
