Fully Encrypted Neural Network Training & Inference

To address the SCO’s need for secure computing with neural networks, Intellisense Systems, Inc. (ISI) proposes to develop a new Fully Encrypted Neural Network Training & Inference (FENNTI) framework. It is based on a novel use of homomorphic encryption (HE) for both neural network inference and training. The method works by first modifying existing arbitrary neural network architectures to be compatible with the polynomial operations required in the adopted Fan-Vercauteren HE scheme. The networks can then be trained on potentially untrusted remote computing platforms (i.e., the cloud) without ever revealing unencrypted data. As model weights are encrypted, FENNTI is secure against white-box attacks even if an adversary gains access to the model. As all I/O data is encrypted, black box attacks gain nothing from repeated interaction with the model. Furthermore, FENNTI is robust to leakage of training data as any leaked data would be in the encrypted domain. In Phase I, ISI will demonstrate proof-of-concept of FENNTI by training deep image detection/classification neural networks on untrusted remote computing platforms. In Phase II, ISI plans to continue improving FENNTI based on lessons learned in Phase I and to fully characterize FENNTI’s performance with respect to different use cases and attack vectors.