Source-linked AI summary
TenSEAL: A Library for Encrypted Tensor Operations Using Homomorphic Encryption
Ayoub Benaissa, Bilal Retiat, Bogdan Cebere, Alaa Eddine Belfedhal
TL;DR
Privacy-preserving machine learning needs inference methods that protect sensitive user data without exposing it to service providers, while existing homomorphic-encryption tools present usability and cost barriers. TenSEAL provides an open-source encrypted-tensor library integrated with machine-learning frameworks and evaluates it on MNIST. The paper reports encrypted convolutional-neural-network evaluation in less than a second with less than half a megabyte of communication.
Problem
Homomorphic-encryption adoption in machine learning is slowed by privacy and intellectual-property concerns, difficult data-scientist interfaces, and communication and computation costs.
Method
TenSEAL bridges machine-learning frameworks to homomorphic encryption through encrypted tensor operations, including CKKSVector-based encoding, dot products, and convolutions.
Results
Less than a second and less than half a megabyte of communication were reported for encrypted convolutional-neural-network inference on MNIST.
Takeaways & Limitations
TenSEAL offers a practical encrypted-tensor workflow with flexible tensor operations and a smooth transition from traditional machine-learning frameworks.
Takeaways & Limitations
CKKS is leveled, so parameter selection limits encrypted multiplications and therefore constrains the depth of machine-learning models that can be used.
Abstract
from arXiv · showhide
Machine learning algorithms have achieved remarkable results and are widely applied in a variety of domains. These algorithms often rely on sensitive and private data such as medical and financial records. Therefore, it is vital to draw further attention regarding privacy threats and corresponding defensive techniques applied to machine learning models. In this paper, we present TenSEAL, an open-source library for Privacy-Preserving Machine Learning using Homomorphic Encryption that can be easily integrated within popular machine learning frameworks. We benchmark our implementation using MNIST and show that an encrypted convolutional neural network can be evaluated in less than a second, using less than half a megabyte of communication.
1 INTRODUCTION
TenSEAL addresses privacy and intellectual-property concerns in machine-learning services by enabling encrypted inference, while targeting the usability and cost barriers that slow homomorphic-encryption adoption.
- Motivation: MLaaS typically requires users to send inputs to a provider, which executes algorithms and returns results.
- Motivation: Homomorphic encryption keeps users’ inputs and outputs hidden from the service provider while allowing evaluation on encrypted data.This preserves the client-server inference workflow without exposing the data or result to the provider.
- Challenges: Available homomorphic-encryption libraries can be difficult for data scientists to use despite providing strong APIs for cryptographers.
- Contribution: TenSEAL is a flexible open-source library for encrypted tensor computation that can convert tensors from popular machine-learning frameworks to encrypted versions.
- Contribution: The paper evaluates an encrypted convolutional neural network in less than a second with less than half a megabyte of communication during inference.
2 ARCHITECTURE
TenSEAL bridges classical machine-learning frameworks and homomorphic encryption through plain and encrypted tensor abstractions, with a central context managing keys and computation settings.
- Architecture: TenSEAL bridges classical machine-learning frameworks to homomorphic-encryption capabilities through plain and encrypted tensors.Clients can use supported C++ or Python frontends, while client-server messages use Protocol buffers.
- TenSEAL Context: The context generates and stores secret, public, Galois, and relinearization keys required for encrypted computation.It also handles parallel execution and can automate ciphertext relinearization and rescaling.
- PlainTensor: PlainTensor connects unencrypted tensors to the library’s encrypted implementations.The appendix describes the tensor-conversion process.
- Encrypted Tensors: EncryptedTensor provides the interface required by every tensor exposed by the library and depends on a TenSEALContext for homomorphic operations.Derived classes expose different encrypted tensor formats.
- Encrypted Tensors: CKKSVector encrypts a vector of real values into one ciphertext, whereas CKKSTensor represents an N-dimensional tensor with batching across ciphertext slots.
- Encrypted Tensors: The MNIST evaluation focuses on CKKSVector as the encrypted tensor type used for inference.
3 METHOD
The method encodes tensors to reduce ciphertext count and computation depth, then implements encrypted dot products and convolutions using rotations, element-wise operations, and accumulation.
- Tensor Encoding: TenSEAL seeks tensor encodings that minimize ciphertext count and runtime while maximizing available computation depth.Encoding choices determine which operations are possible and their complexity.
- Tensor Encoding: A single ciphertext can encode an input image after client-side conversion into convolution windows, followed by flattening into a vector.CKKSVector stores N/2 real values when N is the polynomial modulus degree.
- Dot Product: The dot-product method replicates the input vector across ciphertext slots and uses only left rotations during computation.It supports vector sizes that are not powers of two or that do not fill all ciphertext slots.
- 2-D Convolution: TenSEAL converts convolution into matrix multiplication with im2col, then performs encrypted matrix-plain vector multiplication through element-wise multiplication, rotations, and accumulation.The operation uses one multiplication and log2(N) rotations and additions, where N is the matrix row count.
4 RELATED WORK
Prior work established encrypted neural-network inference and optimization techniques, while the cited comparisons evaluate frameworks on MNIST under different hardware configurations.
- Prior Approaches: CryptoNets used YASHE leveled homomorphic encryption for neural-network inference on encrypted data.Its efficient plaintext addition and multiplication supported unencrypted models.
- Prior Approaches: CryptoNets required large batches to achieve good amortized performance, reducing practicality for single-instance evaluation.
- Prior Approaches: Boemer et al. reduced multiplicative depth for batch normalization and average pooling using graph-level optimizations specific to homomorphic encryption.
- Comparative Evaluation: The cited works were benchmarked on MNIST using different hardware configurations, with empirical results summarized in Table 1.
5 EVALUATION
The evaluation uses an encrypted MNIST convolutional neural network and measures accuracy, runtime, communication, and parallel performance across two hardware setups.
- MNIST evaluation: 97.7% plain-test accuracy contrasted with 97.4% encrypted-test accuracy for the evaluated neural network.The network uses a 4-kernel 7x7 convolution with stride 3x3, linear layers of 256→64→10, and square activations except after the final layer.
- MNIST evaluation: The encrypted MNIST evaluation uses Amazon c4.2xlarge and c4.4xlarge setups to assess performance under different parallelism levels.The setups provide 8 versus 16 vCPUs and 15 versus 30 GiB memory, with durations expressed in milliseconds.
- Performance results: 427KB of communication is required to send the encrypted input and receive the encrypted output.The results characterize this communication requirement as highly competitive and report that the library makes heavy use of available parallelism.
6 LIMITATIONS AND CONCLUSION
The paper identifies CKKS depth and activation-function constraints as limitations, while concluding that encrypted tensor operations can be practical with TenSEAL.
- Limitations: CKKS limits the number of encrypted multiplications according to parameter selection, constraining the depth of usable machine learning models.CKKS also requires nonlinear activation functions to be approximated with polynomials.
- Conclusion: Encrypted tensor operations can be practical with the CKKS scheme.TenSEAL supports either advanced tensor operations or more computation-communication-optimized implementations depending on the use case.
- Conclusion: TenSEAL accommodates different tensor-operation needs while providing a smooth transition from traditional machine learning frameworks.The authors also seek to extend the tensor-operation catalog and improve overall performance.
A.1 ENCRYPTED TENSOR CLASSES
The encrypted tensor construction begins with a PlainTensor that wraps a framework tensor representation and feeds it into the EncryptedTensor interface.
- Encrypted tensor classes: PlainTensor wraps tensor representations from popular machine learning frameworks.It is used as the input to the EncryptedTensor interface.
- Encrypted tensor classes: The construction connects framework-level tensor representations to an encrypted tensor interface.
A.2 ENCRYPTED TENSOR OPERATIONS
The encrypted tensor design organizes supported implementations beneath a common EncryptedTensor interface, with operations documented for encrypted tensors.
- Encrypted tensor operations: EncryptedTensor is derived into BFVVector, CKKVector, or CKKSTensor classes.
- Encrypted tensor operations: Table 3 documents the operations supported for encrypted tensors.
A.3 DOT PRODUCT
The paper implements encrypted tensor operations for vector–matrix multiplication and convolution by combining ciphertext encoding, element-wise multiplication, rotations, and accumulations. Convolution is reorganized into matrix multiplication, while encrypted slot reorganization requires preprocessing before encryption.
- Dot product: Encrypted vector–matrix multiplication multiplies an encrypted vector with a plain matrix using the method of Halevi and Shoup.The encrypted vector is represented separately from the plain matrix in the described operation.
- Convolution: Convolution is transformed into a single matrix multiplication by reorganizing input rows into convolution windows and taking dot products with flattened kernels.This is the image-to-column approach used to avoid repeating multiplication over every window.
- Constraint: Reorganizing an encrypted matrix is not trivial because encrypted slot rearrangement is difficult, so preprocessing is required before encryption.The preprocessing prepares the input image for convolution.
- Encrypted convolution: Encrypted matrix–plain vector multiplication uses element-wise multiplication followed by rotations and accumulations to produce the convolution result.The encrypted matrix is encoded before multiplication; rotated output versions are then summed.
- Evaluation: The operation benchmarks average five testing rounds with ten iterations each on an Amazon EC2 c4.2xlarge instance.The benchmark environment uses 8 vCPUs, 15 GiB memory, Ubuntu Server 20.04, and Python 3.8.