IEEE Computational Intelligence Magazine - August 2022 - 22

Designing privacy-preserving deep learning
solutions based on HE requires one to rethink and
redesign deep learning solutions that consider the
constraints on the type and number of operations
that characterize the BFV scheme.
2) Normalization Layers
Normalization layers cannot be considered in the BFV scheme
since it is impossible to compute the mean and standard deviation
of encrypted data. By contrast, batch normalization layers
are available given that they depend on the values of the data
used for training. Such values are computed during the training
and can be used during the processing of ciphertexts.
3) Activation Functions
The activation functions used in CNNs typically comprise
nonlinear functions. The ReLU activation function, for instance,
cannot be computed because it requires the use of the comparison
operator. The same holds for the hyperbolic tangent tanh
which involves division. This study suggests replacing these
nonlinear activation functions with the square activation function
()
fx x2
= Such an approximation can be further refined
.
using Taylor polynomial expansions. However, increasing the
accuracy of the expansion (and thus using a larger number of
polynomials) entails an increase in the number of operations
(and thus an increased NB consumption).
B. Model Encoding
Once the model has been approximated, it can be encoded
through the model encoding step, where an encoded approximated
model (·){H
is obtained, whose weights have been encoded
according to the BFV scheme and the parameters H. Encrypted
data can now be processed by
{ (·)H
will be able to decrypt it. The
to obtain the result of
CNN processing. Notably, this result is still encrypted and only
the owner of the secret key ks
proper setting parameters H in HE processing remains an open
research. Generally, the selection of the value of these parameters
follows a " trial-and-error " approach (see the model validation
step in Section III-C). Nevertheless, some guidelines for
the setting of H are provided as follows.
Maximum
Pooling
F(.)
Layer
Normalization
ReLU/
tanh
Average
Pooling
Batch
Normalization
Square
FIGURE 3 Possible approximations for typical CNN layers.
The most critical encryption parameter is n
as it is a relevant parameter for the setting of
the initial NB and the computational overhead
of the encrypted processing. Generally, values of
n smaller than 4096 are able to guarantee a NB
sufficient only for very simple machine learning
models (typically comprising two or three
processing layers at most). From a methodological
point of view, n is typically initially set to 4096 and then
increased as described in Section III-C.
The parameter p affects NB consumption as well as the precision
of the homomorphic operations (i.e., p affects the possibility
that some coefficients of the decrypted polynomials are
rounded to the incorrect value). Tuning p requires a trial-anderror
process; typically, a value of p between 216 and 218
represents
a good starting point for exploring the parameters
described in Section III-C. The value of q is critical for the security
of the scheme; it is suggested to rely on the helper function
provided by SEAL [19] (see Section VI for details) to set q
according to n and p.
The obtained
obtaining the encoded deep learning model (·){H
C. Model Validation
Once the encoding step is completed, the model validation step
is activated to evaluate the encoded model
{ (·)H
ferent perspectives. First, { (·)H
from two difis
evaluated to check whether
the selected configuration H provides a sufficient NB in the
processing of ciphertexts. Second, the loss in accuracy of (·){H
w.r.t.
F (·) is evaluated. To achieve both goals, a (possibly large)
set of raw messages ms is processed by { (·)H
with the aim of
measuring the NB of the final ciphertexts and evaluating the
discrepancy between the accuracy of the encoded model (·){H
and that of the plain model (·)F
{ (·)H
. Typically, the problems associated
with a loss of NB depend on an incorrect setting of H,
whereas the discrepancies in the output between
and
F (·) could be associated with either the approximations of the
processing layers introduced in the model approximation step
or the fact that p and q are not large enough for the processing
pipeline defined in the encoded approximated model
{ (·)H
.
If the constraint on the NB is satisfied and the loss of accuracy
is below a user-defined threshold (e.g., 1% or 5%), (·){H
becomes the privacy-preserving version of (·)F to be considered.
Conversely, when either the constraint on the NB is not
satisfied (i.e., the NB of the ciphertexts decreases to 0 during
the processing of
{ (·)H
) or the loss in accuracy is larger than
the threshold, the methodology suggests three different actions:
update H, modify how layers in (·)F are approximated, or
change the processing pipeline of (·)F
. These three actions are
described in detail as follows.
First, the NB and loss of accuracy strictly depend on H. In
particular, increasing the parameter n increases the initial NB
but at the expense of a (potentially large) increase in computational
overhead and the memory demand of (·){H
increasing p and q would reduce the loss in accuracy (by
22 IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE | AUGUST 2022
. Conversely,
H = (, ,)np q can be used to encode (·){ , thus
.
IEEE Computational Intelligence Magazine - August 2022

Table of Contents for the Digital Edition of IEEE Computational Intelligence Magazine - August 2022
