IEEE Computational Intelligence Magazine - August 2022 - 23

increasing the precision of the processing) but at the expense of
increased NB consumption by the HE operations.
Second, different model approximations could be considered
for the processing layers that are not HE-compliant in (·)F . Here,
a trade-off must be carefully explored. Indeed, to reduce the loss
of accuracy, a coarse-grain layer approximation could be replaced
by a finer one (e.g., by using a higher degree of polynomial
approximation); however, this would be at the expense of an
increased number of operations to be performed for that layer
(hence further reducing the NB). On the other hand, moving
from a fine-grain layer approximation to a coarse-grain one could
reduce NB consumption but possibly increase the loss of accuracy.
Third, if the previous two actions do not succeed in satisfying
the constraints on NB and accuracy, a modified version
F ()$l of (·)F can be designed. The aim is to reduce the number
of operations to be conducted, such as by reducing the number
of processing layers or simplifying the operations to be considered.
Once ()F $l has been redesigned, the model approximation,
encoding, and validation steps are newly activated to
identify
{ (·)H
.
Having detailed the proposed methodology, the next section
will use it for the design of a privacy-preserving version of
the well-known LeNet-1 CNN.
IV. Application to a Real-World CNN:
Privacy-Preserving LeNet-1 With BFV
The aim of this section is to detail the application of the
methodology proposed in this study to the LeNet-1 CNN, as
well as provide numerical results to demonstrate its effectiveness
and efficiency.
LeNet-1 is a simple yet effective CNN that was introduced
by LeCun et al. [11]. Its processing pipeline (·)F is depicted in
Fig. 4(a). LeNet-1 comprises L = 5 different processing layers:
a convolutional layer with four kernels of size 5 × 5 and tanh
activation; an average pooling layer with a kernel of size 2; a
convolutional layer with 16 kernels of size 5 × 5 and tanh activation;
an average pooling layer with a kernel of size 2; and a
fully connected layer of size 192 × 10.
This study applied the methodology
described in the previous section to
LeNet-1 to design a privacy-preserving
version
{ (·)H
compliant with the
BFV scheme. The use of the methodology
and the designed model
{ (·)H
are described in Section IV-A, and
then the performance and accuracy of
{ (·)H
computed on the MNIST [24]
and Fashion-MNIST [25] datasets are
detailed in Section IV-B. Both datasets
are composed of 70,000 28 × 28 grayscale
images (60,000 for training and
10,000 for testing), representing a
10-class classification problem, that is,
10 digits in MNIST and 10 fashion
products in Fashion-MNIST.
Conv.
Layer
tanh
Avg.
Pool.
Conv.
Layer
(a)
The Privacy-Preserving Version of the LeNet-1 Convolutional Neural Network
Approximated LeNet-1 - ϕ(.)
Square
Conv.
Layer
tanh
Avg.
Pool.
FC
Layer
LeNet-1 - F(.)
A. Applying the Methodology to Design
the Privacy-Preserving LeNet-1
This section presents the application of the methodology
from Section III to the design of the privacy-preserving version
{
(·)H
of the LeNet-1 CNN (·)F
. During the model
approximation step, this study replaced the tanh activation
function of LeNet-1 (involving non-polynomial operations)
with the square activation function. Moreover, during the
model validation step, this study determined that the NB
given by n = 4096 was not sufficient for conducting the processing
of the encoded model on encrypted data. As mentioned
in Section III-B, increasing n would have led to a
higher NB but at the expense of a relevant increase in the
computational overhead. Thus, this study explored the action
of redesigning (·)F
this change in (·)F led us to consider ()F $l
version of the LeNet-1 CNN without the second tanh activation.
Interestingly, ()F $l
guaranteed a negligible loss in accuracy
w.r.t. F (·) and led to a more effective definition of { (·)H
through the methodology. This aspect will be elaborated on
in Section IV-B.
The final configuration of the parameters H was as follows:
H = >
n = 4096
p = 953983721
)
.
q = 649033470896967743586364154707968 1033
H.
In particular, the value for p was obtained with the trial-anderror
procedure described in Section III-B, whereas the value
of q was automatically computed by means of the specific
SEAL function mentioned in Section III-B.
In summary, the outcome
{ (·)H
of the methodology representing
the privacy-preserving version of LeNet-1 is depicted in
Fig. 4(b). The processing pipeline of
{ (·)H
comprises five different
layers: a convolutional layer with four kernels of size 5 × 5
and square activation; an average pooling layer with a kernel of
size 2; a convolutional layer with 16 kernels of size 5 × 5; an
The Original LeNet-1 Convolutional Neural Network
by removing the second tanh activation:
, that is, a simplified
Avg.
Pool.
(b)
FIGURE 4 (a) The original LeNet-1 CNN and (b) its privacy-preserving version based on HE.
Conv.
Layer
Avg.
Pool.
FC
Layer
AUGUST 2022 | IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE 23
IEEE Computational Intelligence Magazine - August 2022

Table of Contents for the Digital Edition of IEEE Computational Intelligence Magazine - August 2022
