Paper 2021/783

Privacy-Preserving Machine Learning with Fully Homomorphic Encryption for Deep Neural Network

Joon-Woo Lee, HyungChul Kang, Yongwoo Lee, Woosuk Choi, Jieun Eom, Maxim Deryabin, Eunsang Lee, Junghyun Lee, Donghoon Yoo, Young-Sik Kim, and Jong-Seon No


Fully homomorphic encryption (FHE) is one of the prospective tools for privacy-preserving machine learning (PPML), and several PPML models have been proposed based on various FHE schemes and approaches. Although the FHE schemes are known as suitable tools to implement PPML models, previous PPML models on FHE such as CryptoNet, SEALion, and CryptoDL are limited to only simple and non-standard types of machine learning models. These non-standard machine learning models are not proven efficient and accurate with more practical and advanced datasets. Previous PPML schemes replace non-arithmetic activation functions with simple arithmetic functions instead of adopting approximation methods and do not use bootstrapping, which enables continuous homomorphic evaluations. Thus, they could not use standard activation functions and could not employ a large number of layers. In this work, we firstly implement the standard ResNet-20 model with the RNS-CKKS FHE with bootstrapping and verify the implemented model with the CIFAR-10 dataset and the plaintext model parameters. Instead of replacing the non-arithmetic functions with the simple arithmetic function, we use state-of-the-art approximation methods to evaluate these non-arithmetic functions, such as the ReLU and softmax, with sufficient precision. Further, for the first time, we use the bootstrapping technique of the RNS-CKKS scheme in the proposed model, which enables us to evaluate an arbitrary deep learning model on the encrypted data. We numerically verify that the proposed model with the CIFAR-10 dataset shows 98.43% identical results to the original ResNet-20 model with non-encrypted data. The classification accuracy of the proposed model is 92.43%±2.65%, which is pretty close to that of the original ResNet-20 CNN model, 91.89%. It takes about 3 hours for inference on a dual Intel Xeon Platinum 8280 CPU (112 cores) with 172 GB memory. We think that it opens the possibility of applying the FHE to the advanced deep PPML model.

Available format(s)
Publication info
Preprint. MINOR revision.
Contact author(s)
joonwoo3511 @ ccl snu ac kr
hc1803 kang @ samsung com
yw0803 lee @ samsung com
woosuk0 choi @ samsung com
jieun eom @ samsung com
max deriabin @ samsung com
eslee3209 @ ccl snu ac kr
jhlee @ ccl snu ac kr
say yoo @ samsung com
iamyskim @ chosun ac kr
jsno @ snu ac kr
2021-10-24: revised
2021-06-10: received
See all versions
Short URL
Creative Commons Attribution


      author = {Joon-Woo Lee and HyungChul Kang and Yongwoo Lee and Woosuk Choi and Jieun Eom and Maxim Deryabin and Eunsang Lee and Junghyun Lee and Donghoon Yoo and Young-Sik Kim and Jong-Seon No},
      title = {Privacy-Preserving Machine Learning with Fully Homomorphic Encryption for Deep Neural Network},
      howpublished = {Cryptology ePrint Archive, Paper 2021/783},
      year = {2021},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.