3 ms·

This technique is deeply flawed. You can't do this effectively without outside knowledge they should not have. They are in fact using outside knowledge, specif

This technique is deeply flawed. You can't do this effectively without outside knowledge they should not have. They are in fact using outside knowledge, specifically that the encrypted data is in the form of images. Without that knowledge, you wouldn't know which ML techniques to use! Additionally, remember that feature engineering is a big part of what makes ML effective at all, and that certainly cannot be done on encrypted data (the feature engineering you need to do depends on what the data looks like).

sthatipamala 7y ago
If I don't even know what data type my input is, what meaningful output can the system give? I wouldn't consider that cheating. Also, you can do feature engineering on a training set that you collect, as long as that is similar to the distribution of end user inputs. That's a pretty standard ML workflow.
- personjerry 7y ago
  The entire point of encrypted data is you don't know what's in there. What they're claiming is they've worked around this problem, but they haven't, because they're subtly incorporating outside information: specifically that they know what the data looks like already. From a true third-party looking at encrypted data, you would have no idea. What does your statement about feature engineering have to do with encrypted data? Maybe I can clarify with an example: You can't transform a waveform into more usable features with a fourier transform if the waveform is encrypted.
  - karpierz 7y ago
    You seem to be misunderstanding the value proposition. Suppose that I have some of my personal medical data, and I'd like to use it to try and detect early symptoms of HIV. But because there's a stigma against HIV and I don't trust medical providers to handle my data correctly, I refuse to hand over my data to a third party service unencrypted. Without homomorphic encryption, I'd be out of luck; I couldn't use a third-party service to analyze my data and return a prediction. With homomorphic encryption: - I encrypt my data locally - Send the encrypted bits over to the third-party - The third-party uses their ML algorithm to compute a prediction - They send back an encrypted prediction - I decrypt the prediction locally and get my results. At no point in this process can anyone, aside from me, see either the input data or the output.
thekyle 7y ago
I disagree that knowing the type of data being encrypted makes the technique flawed. Let's say you wanted to build a Speech-to-Text API that takes some encrypted audio, transcribes it, and returns the transcriptions encrypted. Sure, you know that any files sent to you are going to be encrypted audio files, but you don't know what is being said in them which is the point of this technique.
garganzol 7y ago
The ML example blog provides is amusing. It tends to make some people think that neural network can somehow "see" the patterns in encrypted data. Plain wrong. What happens in reality is this: the neural network is encrypted and can only work on encrypted data producing only the encrypted results. The data can only be decrypted by the data owner who would not share his private key with anybody. That's it. In this way, the whole algorithm works in a so called encrypted domain. When used in this role, homomorphic encryption (HE) engine resembles a custom CPU. That CPU is not Turing-complete because it lacks conditional branching, but it is almost there providing two basic operations: addition and multiplication. This is enough for a lot of tasks. Does a CPU know a type of data or something special about them? Not at all. It executes primitive instructions of a program, one by one producing the output result from a set of inputs. The program P that HE "CPU" executes can be any program suitable for the given instruction set. Not only ML. It can be any other program! That's why homomorphic encryption is a very important technique in the area of cryptographic obfuscation. It allows to hide the data processed by a program P. And if that program P is a virtual machine (sometimes called Universal Circuit or UC) by itself, it would allow to hide the code as well, reaching the state of indistinguishability obfuscation. There are some practical problems along the way, but we are moving there. Yep, that sounds like magic, but it's based on a pure "boring" math with a few bright ideas here and there. What was thought as an impossible feat in the past, gradually becomes a reality. Isn't that the reason why Nobel is a no go for mathematicians? Otherwise, they would get plenty of Nobels (almost all of them, for sure).

sthatipamala 7y ago

If I don't even know what data type my input is, what meaningful output can the system give? I wouldn't consider that cheating. Also, you can do feature engineering on a training set that you collect, as long as that is similar to the distribution of end user inputs. That's a pretty standard ML workflow.

personjerry 7y ago
The entire point of encrypted data is you don't know what's in there. What they're claiming is they've worked around this problem, but they haven't, because they're subtly incorporating outside information: specifically that they know what the data looks like already. From a true third-party looking at encrypted data, you would have no idea. What does your statement about feature engineering have to do with encrypted data? Maybe I can clarify with an example: You can't transform a waveform into more usable features with a fourier transform if the waveform is encrypted.
- karpierz 7y ago
  You seem to be misunderstanding the value proposition. Suppose that I have some of my personal medical data, and I'd like to use it to try and detect early symptoms of HIV. But because there's a stigma against HIV and I don't trust medical providers to handle my data correctly, I refuse to hand over my data to a third party service unencrypted. Without homomorphic encryption, I'd be out of luck; I couldn't use a third-party service to analyze my data and return a prediction. With homomorphic encryption: - I encrypt my data locally - Send the encrypted bits over to the third-party - The third-party uses their ML algorithm to compute a prediction - They send back an encrypted prediction - I decrypt the prediction locally and get my results. At no point in this process can anyone, aside from me, see either the input data or the output.

thekyle 7y ago

I disagree that knowing the type of data being encrypted makes the technique flawed. Let's say you wanted to build a Speech-to-Text API that takes some encrypted audio, transcribes it, and returns the transcriptions encrypted. Sure, you know that any files sent to you are going to be encrypted audio files, but you don't know what is being said in them which is the point of this technique.

garganzol 7y ago

The ML example blog provides is amusing. It tends to make some people think that neural network can somehow "see" the patterns in encrypted data. Plain wrong. What happens in reality is this: the neural network is encrypted and can only work on encrypted data producing only the encrypted results. The data can only be decrypted by the data owner who would not share his private key with anybody. That's it. In this way, the whole algorithm works in a so called encrypted domain. When used in this role, homomorphic encryption (HE) engine resembles a custom CPU. That CPU is not Turing-complete because it lacks conditional branching, but it is almost there providing two basic operations: addition and multiplication. This is enough for a lot of tasks. Does a CPU know a type of data or something special about them? Not at all. It executes primitive instructions of a program, one by one producing the output result from a set of inputs. The program P that HE "CPU" executes can be any program suitable for the given instruction set. Not only ML. It can be any other program! That's why homomorphic encryption is a very important technique in the area of cryptographic obfuscation. It allows to hide the data processed by a program P. And if that program P is a virtual machine (sometimes called Universal Circuit or UC) by itself, it would allow to hide the code as well, reaching the state of indistinguishability obfuscation. There are some practical problems along the way, but we are moving there. Yep, that sounds like magic, but it's based on a pure "boring" math with a few bright ideas here and there. What was thought as an impossible feat in the past, gradually becomes a reality. Isn't that the reason why Nobel is a no go for mathematicians? Otherwise, they would get plenty of Nobels (almost all of them, for sure).