4 ms·
Since there seems to be a lot of confusion throughout this thread, perhaps I can attempt to clarify what's going on at a very high level. The setting is that th
by StefanKarpinski 7y ago
Since there seems to be a lot of confusion throughout this thread, perhaps I can attempt to clarify what's going on at a very high level. The setting is that the user sends their data to a service and wants the service to do useful work on their data without knowing what their data is. In this case, the work that the service does is apply a pre-trained, non-secret ML vision model to the secret, encrypted data. The result is an encrypted answer that is sent back to the user, who can decrypt it and get a useful result. The service is none the wiser about what the user's data was, nor what the answer was.
Does this seem like impossible magic? Yes. Everyone was pretty surprised when the first theoretical fully homomorphic encryption schemes were found. For a while people believed that it might never be efficient enough to be practical. But now it's actually feasible to do limited but real useful computations on behalf of a user without the service learning anything about what it is computing for the user. There is ongoing work to expand what kinds of computations can be done efficiently.
- k__ 7y agoSounds strange. Does this mean that the model has to be trained on encrypted data?
- StefanKarpinski 7y agoYes, it’s rather surprising that it can be done at all. And no, you train the model normally and then express the application of the model in terms of the set of primitive operations that the encryption scheme supports. Broadening the set of operations supported by the encryption scheme is an active area of research since having a better “instruction set” allows more computations to be done efficiently. It is also possible for the model to be provided by the user and encrypted along with the data rather than being fixed and public. That way the service can apply a model that it doesn't know to data that it also doesn't know. This allows a fairly general service in theory, but it remains a challenge to express more than fairly simple models in a way that can be computed efficiently.
- pishpash 7y agoThis depends on a very special kind of "encryption".
- de_watcher 7y agoI don't understand why it has to be trained on encrypted data. Isn't it faster to train on the cleartext data (and of course use the same instruction set, the unencrypted counterpart of it)?
- mikorym 7y agoI think he is saying that you do the training on cleartext data.
- de_watcher 7y agoAh ok, his first "yes" confused me so much that I saw no value to read further.
- mrmonkeyman 7y agoAll those letters, those words. Terribly confusing.
- mikorym 7y agoI would think the pre-trained point is critical. Is there a way of doing the training (without being provided a trained model) all on the encrypted side?
- garganzol 7y agoYes, but the data owner will need to provide the feedback in clear text.
- k__ 7y agoDoes this has something to do with all the operations being linear?