论文标题
射击左轮手枪：一种新颖的矩阵编码方法，用于保护隐私的神经网络（推理）
Volley Revolver: A Novel Matrix-Encoding Method for Privacy-Preserving Neural Networks (Inference)
论文作者
论文摘要
在这项工作中，我们提出了一种新颖的矩阵编码方法，该方法对于神经网络特别方便，使用同构加密以隐私性的方式进行预测。基于这种编码方法，我们实施了一个卷积神经网络，以通过加密进行手写图像分类。对于两个矩阵$ a $和$ b $以执行同型乘法，其背后的主要想法是简单版本，是将矩阵$ a $和矩阵$ b $的转置分别加密到两个密文。通过其他操作，可以有效地通过加密的矩阵来计算同型矩阵乘法。对于卷积操作，我们提前将每个卷积内核范围跨越与输入图像相同的矩阵空间，以生成几个密文，后来将它们与密文加密输入图像一起使用，以计算一些最终卷积结果。我们积累了所有这些中间结果，从而完成了卷积操作。 在具有40 VCPU的公共云中，我们在MNIST测试数据集上的卷积神经网络实现需要$ \ sim $ 287秒，以计算十个可能的32个大小的加密图像$ 28 \ times 28 $同时。数据所有者只需要上传一个Ciphertext（$ \ sim 19.8 $ MB）将这32张图像加密到公共云。
In this work, we present a novel matrix-encoding method that is particularly convenient for neural networks to make predictions in a privacy-preserving manner using homomorphic encryption. Based on this encoding method, we implement a convolutional neural network for handwritten image classification over encryption. For two matrices $A$ and $B$ to perform homomorphic multiplication, the main idea behind it, in a simple version, is to encrypt matrix $A$ and the transpose of matrix $B$ into two ciphertexts respectively. With additional operations, the homomorphic matrix multiplication can be calculated over encrypted matrices efficiently. For the convolution operation, we in advance span each convolution kernel to a matrix space of the same size as the input image so as to generate several ciphertexts, each of which is later used together with the ciphertext encrypting input images for calculating some of the final convolution results. We accumulate all these intermediate results and thus complete the convolution operation. In a public cloud with 40 vCPUs, our convolutional neural network implementation on the MNIST testing dataset takes $\sim$ 287 seconds to compute ten likelihoods of 32 encrypted images of size $28 \times 28$ simultaneously. The data owner only needs to upload one ciphertext ($\sim 19.8$ MB) encrypting these 32 images to the public cloud.
