{"type":"ScholarlyArticle","title":"BAYHENN: Combining Bayesian Deep Learning and Homomorphic Encryption for Secure DNN Inference","authors":[{"name":"Peichen Xie","slug":"peichen-xie","given":"Peichen","family":"Xie","affiliation":"Center for Energy-efficient Computing and Applications , Peking University; Advanced Institute of Information Technology , Peking University"},{"name":"Bingzhe Wu","slug":"bingzhe-wu","given":"Bingzhe","family":"Wu","affiliation":"Center for Energy-efficient Computing and Applications , Peking University; Ant Financial Services Group"},{"name":"Guangyu Sun","slug":"guangyu-sun","given":"Guangyu","family":"Sun","affiliation":"Center for Energy-efficient Computing and Applications , Peking University; Advanced Institute of Information Technology , Peking University"}],"abstract":"Recently, deep learning as a service (DLaaS) has emerged as a promising way to facilitate the employment of deep neural networks (DNNs) for various purposes. However, using DLaaS also causes potential privacy leakage from both clients and cloud servers. This privacy issue has fueled the research interests on the privacy-preserving inference of DNN models in the cloud service. \r\n\r\nIn this paper, we present a practical solution named BAYHENN for secure DNN inference. It can protect both the client's privacy and server's privacy at the same time. The key strategy of our solution is to combine homomorphic encryption and Bayesian neural networks. Specifically, we use homomorphic encryption to protect a client's raw data and use Bayesian neural networks to protect the DNN weights in a cloud server. To verify the effectiveness of our solution, we conduct experiments on MNIST and a real-life clinical dataset. Our solution achieves consistent latency decreases on both tasks. In particular, our method can outperform the best existing method (GAZELLE) by about 5x, in terms of end-to-end latency.","doi":"10.24963/ijcai.2019/671","url":"https://ijcai.org/proceedings/2019/671","pdf":"https://ijcai.org/proceedings/2019/0671.pdf","markdown":"https://ijcai.org/proceedings/2019/671.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/671","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":671,"pages":{"first":4831,"last":4837},"keywords":["Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning: Deep Learning"],"videos":[],"references":[{"position":1,"raw":"[Acar et al., 2018] Abbas Acar, Hidayet Aksu, et al. A sur- vey on homomorphic encryption schemes: Theory and implementation. ACM Computing Surveys, 51(4):79:1- 79:35, 2018.","title":"A survey on homomorphic encryption schemes: Theory and implementation","authors":"Acar","year":"2018","venue":"ACM Computing Surveys","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bhattacharjee et al., 2017] Bishwaranjan Bhattacharjee, Scott Boag, et al. IBM deep learning service. IBM Journal of Research and Development, 61(4):10, 2017.","title":"Bishwaranjan Bhattacharjee","authors":"Bhattacharjee","year":"2017","venue":"IBM Journal of Research and Development","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Blundell et al., 2015] Charles Blundell, Julien Cornebise, et al. Weight uncertainty in neural networks. In Pro- ceedings of the 32nd International Conference on Machine Learning, volume 37, pages 1613-1622. JMLR.org, 2015.","title":"Weight uncertainty in neural networks","authors":"Charles Blundell, Julien Cornebise","year":"2015","venue":"Proceedings of the 32nd International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bourse et al., 2018] Florian Bourse, Michele Minelli, et al. Fast homomorphic evaluation of deep discretized neural networks. In Advances in Cryptology -CRYPTO 2018, volume 10993, pages 483-512. Springer, 2018.","title":"Fast homomorphic evaluation of deep discretized neural networks","authors":"Florian Bourse, Michele Minelli","year":"2018","venue":"Advances in Cryptology -CRYPTO 2018","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chaudhuri and Monteleoni, 2008] Kamalika Chaudhuri and Claire Monteleoni. Privacy-preserving logistic regression. In Advances in Neural Information Processing Systems 21, Proceedings of the Twenty-Second Annual Conference on Neural Information Processing Systems, pages 289-296.","title":"Privacy-preserving logistic regression","authors":"Kamalika Chaudhuri, Claire Monteleoni","year":null,"venue":"Advances in Neural Information Processing Systems 21, Proceedings of the Twenty-Second Annual Conference on Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"Curran Associates, Inc., 2008.","title":null,"authors":"Curran Associates, Inc","year":"2008","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Devlin et al., 2018] Jacob Devlin, Ming-Wei Chang, et al. BERT: Pre-training of deep bidirectional transformers for language understanding. CoRR, abs/1810.04805, 2018.","title":"BERT: Pre-training of deep bidirectional transformers for language understanding","authors":"Jacob Devlin, Ming-Wei Chang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Fortunato et al., 2017] Meire Fortunato, Charles Blundell, and Oriol Vinyals. Bayesian recurrent neural networks. CoRR, abs/1704.02798, 2017.","title":"Bayesian recurrent neural networks","authors":"Meire Fortunato, Charles Blundell, Oriol Vinyals","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Gilad-Bachrach et al., 2016] Ran Gilad-Bachrach, Nathan Dowlin, et al. CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy. In Pro- ceedings of the 33nd International Conference on Machine Learning, volume 48, pages 201-210. JMLR.org, 2016.","title":"CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy","authors":"Gilad-Bachrach","year":"2016","venue":"Proceedings of the 33nd International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Havaei et al., 2017] Mohammad Havaei, Axel Davy, et al. Brain tumor segmentation with deep neural networks. Medical Image Analysis, 35:18-31, 2017.","title":"Brain tumor segmentation with deep neural networks","authors":"Mohammad Havaei, Axel Davy","year":"2017","venue":"Medical Image Analysis","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, et al. Deep residual learning for image recognition. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pat- tern Recognition, pages 770-778. IEEE Computer Society, 2016.","title":"Deep residual learning for image recognition","authors":"He","year":"2016","venue":"Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Juvekar et al., 2018] Chiraag Juvekar, Vinod Vaikun- tanathan, and Anantha Chandrakasan. GAZELLE: A low latency framework for secure neural network inference. In Proceedings of the 27th USENIX Security Symposium, pages 1651-1669. USENIX Association, 2018.","title":"GAZELLE: A low latency framework for secure neural network inference","authors":"Juvekar","year":"2018","venue":"Proceedings of the 27th USENIX Security Symposium","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[LeCun et al., 1998] Yann LeCun, Léon Bottou, et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2324, 1998.","title":"Gradient-based learning applied to document recognition","authors":"Yann Lecun, Léon Bottou","year":"1998","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Litjens et al., 2017] Geert J. S. Litjens, Thijs Kooi, et al. A survey on deep learning in medical image analysis. Medi- cal Image Analysis, 42:60-88, 2017.","title":"A survey on deep learning in medical image analysis","authors":"J S Geert, Thijs Litjens, Kooi","year":"2017","venue":"Medical Image Analysis","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Liu et al., 2017] Jian Liu, Mika Juuti, et al. Oblivious neu- ral network predictions via MiniONN transformations. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 619-631. ACM, 2017.","title":"Oblivious neural network predictions via MiniONN transformations","authors":"Jian Liu, Mika Juuti","year":"2017","venue":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Ma et al., 2019] Xu Ma, Xiaofeng Chen, and Xiaoyu Zhang. Non-interactive privacy-preserving neural network prediction. Information Sciences, 481:507-519, 2019.","title":"Non-interactive privacy-preserving neural network prediction","authors":"Xu Ma, Xiaofeng Chen, Xiaoyu Zhang","year":"2019","venue":"Information Sciences","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Mohassel and Zhang, 2017] Payman Mohassel and Yupeng Zhang. SecureML: A system for scalable privacy- preserving machine learning. In Proceedings of the 2017 IEEE Symposium on Security and Privacy, pages 19-38. IEEE Computer Society, 2017.","title":"SecureML: A system for scalable privacypreserving machine learning","authors":"Payman Mohassel, Yupeng Zhang","year":"2017","venue":"Proceedings of the 2017 IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Phong et al., 2018] Le Trieu Phong, Yoshinori Aono, et al. Privacy-preserving deep learning via additively homomor- phic encryption. IEEE Transactions on Information Foren- sics and Security, 13(5):1333-1345, 2018.","title":"Privacy-preserving deep learning via additively homomorphic encryption","authors":"Le Trieu, Phong, Yoshinori Aono","year":"2018","venue":"IEEE Transactions on Information Forensics and Security","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Regev, 2009] Oded Regev. On lattices, learning with er- rors, random linear codes, and cryptography. Journal of the ACM, 56(6):34:1-34:40, 2009.","title":"On lattices, learning with errors, random linear codes, and cryptography","authors":"Oded Regev","year":"2009","venue":"Journal of the ACM","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Ren et al., 2017] Shaoqing Ren, Kaiming He, et al. Faster R-CNN: Towards real-time object detection with region proposal networks. IEEE Transactions on Pattern Anal- ysis and Machine Intelligence, 39(6):1137-1149, 2017.","title":"Faster R-CNN: Towards real-time object detection with region proposal networks","authors":"Ren","year":"2017","venue":"IEEE Transactions on Pattern Analysis and Machine Intelligence","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Rouhani et al., 2018] Bita Darvish Rouhani, M. Sadegh Ri- azi, and Farinaz Koushanfar. Deepsecure: Scalable provably-secure deep learning. In Proceedings of the 55th Annual Design Automation Conference, pages 2:1-2:6. ACM, 2018.","title":"Deepsecure: Scalable provably-secure deep learning","authors":"M Sadegh Bita Darvish Rouhani, Farinaz Riazi, Koushanfar","year":"2018","venue":"Proceedings of the 55th Annual Design Automation Conference","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Sanyal et al., 2018] Amartya Sanyal, Matt J. Kusner, et al. TAPAS: Tricks to accelerate (encrypted) prediction as a service. In Proceedings of the 35th International Confer- ence on Machine Learning, volume 80, pages 4497-4506. JMLR.org, 2018.","title":"TAPAS: Tricks to accelerate (encrypted) prediction as a service","authors":"Amartya Sanyal, Matt J Kusner","year":"2018","venue":"Proceedings of the 35th International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Shridhar et al., 2018] Kumar Shridhar, Felix Laumann, et al. Bayesian convolutional neural networks with vari- ational inference. CoRR, abs/1806.05978, June 2018.","title":"Bayesian convolutional neural networks with variational inference","authors":"Kumar Shridhar, Felix Laumann","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Tramèr et al., 2016] Florian Tramèr, Fan Zhang, et al. Steal- ing machine learning models via prediction APIs. In Pro- ceedings of the 25th USENIX Security Symposium, pages 601-618. USENIX Association, 2016.","title":"Stealing machine learning models via prediction APIs","authors":"Florian Tramèr, Fan Zhang","year":"2016","venue":"Proceedings of the 25th USENIX Security Symposium","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Vaswani et al., 2017] Ashish Vaswani, Noam Shazeer, et al. Attention is all you need. In Advances in Neural Informa- tion Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, pages 6000-6010, 2017.","title":"Attention is all you need","authors":"Ashish Vaswani, Noam Shazeer","year":"2017","venue":"Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Zhang et al., 2017] Jiaqi Zhang, Kai Zheng, et al. Efficient private ERM for smooth objectives. In Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence, pages 3922-3928. ijcai.org, 2017.","title":"Efficient private ERM for smooth objectives","authors":"Jiaqi Zhang, Kai Zheng","year":"2017","venue":"Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":"/proceedings/2017/548"},{"position":27,"raw":"[Zhang et al., 2018] Qiao Zhang, Cong Wang, et al. GELU- Net: A globally encrypted, locally unencrypted deep neu- ral network for privacy-preserved learning. In Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, pages 3933-3939. ijcai.org, 2018.","title":"GELU-Net: A globally encrypted, locally unencrypted deep neural network for privacy-preserved learning","authors":"Qiao Zhang, Cong Wang","year":"2018","venue":"Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":"/proceedings/2018/547"}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}