Person A wants highly personalised recommendations on their Netflix and Amazon. Person B doesn't want Netflix or Amazon to see their preferences.

In today's digital age, we enjoy the convenience of personalized recommendations from services like Amazon and Netflix, tailored precisely to our tastes. Yet, there's a growing unease about these very platforms prying into our private lives. We desire the benefits of customization without sacrificing our privacy. Previously, this seemed like a paradox: how could we achieve personalization without sharing extensive personal data with cloud-based AI systems. Fully Homomorphic Encryption (FHE) offers a solution, making it possible to enjoy the best of both worlds.

AI-as-a-Service (AIaaS)

Artificial Intelligence (AI) now plays a pivotal role in addressing complex challenges across various domains, including computer vision, natural language processing (NLP), and recommendation systems. However, the development of these AI models poses significant challenges for the average user:

Data Volume: Crafting accurate models often necessitates enormous datasets, sometimes escalating to petabyte scales.
Computational Power: Sophisticated models, such as transformers, require the robust power of dozens of GPUs, often operating continuously for weeks.
Domain Expertise: The fine-tuning of these models requires deep, specialized knowledge.

These hurdles make it impractical for most users to develop powerful ML models independently.

Enter AI-as-a-Service (AIaaS), which surmounts these obstacles by offering access to state-of-the-art neural network models through cloud services managed by major tech giants, including those within FAANG. Users simply upload their raw data to these platforms, where it is processed to produce insightful inferences. AIaaS effectively democratizes high-quality ML model access, opening up advanced AI tools to a wider audience, but unfortunately, today's AIaaS offer these benefits at the cost of our privacy.

Data Privacy in AI-as-a-Service (AIaaS)

Currently, data is only encrypted while the data flows from client to server. The server has access to both the input data and the predictions from the data.

During the AI-as-a-service process, the server has access to both the input and output data. This situation complicates the sharing of sensitive information, such as healthcare and financial data, for the average user. Regulations like GDPR and CCPA intensify these concerns, as they require users to give explicit consent before their data is shared and guarantee rights to transparency about how their data is utilized. GDPR further mandates the encryption and protection of data during transmission. These regulations impose stringent standards to ensure the privacy and rights of users, advocating for clear transparency and control over personal information. Given these requirements, it's imperative that we develop robust privacy mechanisms within AI-as-a-Service (AIaaS) pipelines to maintain trust and compliance.

FHE Solves This Problem!

By encrypting a and b, we can make sure that the input data remains private.

Fully Homomorphic Encryption (FHE) offers a solution to the data privacy issues associated with cloud computing. FHE schemes support operations like ciphertext addition and multiplication. The concept is straightforward: the sum of two encrypted values is equal to the encrypted sum of the two values, and the same applies to multiplication.

Here's how it works in practice: a user performs an addition operation on plaintext values 𝑎 and 𝑏 locally. The user then encrypts 𝑎 and 𝑏, sending the ciphertexts to the cloud server. The server can then perform the addition operation on the encrypted values (homomorphically) and return the result. The decrypted result from the server will match the local plaintext addition result of 𝑎 and 𝑏. This ensures data privacy while allowing computations to be performed in the cloud.

Deep Neural Network (DNN) Based on Fully Homomorphic Encryption (FHE)

Beyond basic operations like addition and multiplication, there have been significant advancements in utilising Fully Homomorphic Encryption (FHE) for neural networks within AI-as-a-service pipelines. In this context, users can encrypt their raw input data into ciphertext and transmit only this encrypted data to the cloud server. The server then performs computations homomorphically on these ciphertexts, generating an encrypted output, which it returns to the user. Importantly, only the user possesses the secret key, enabling them to decrypt and access the results. This establishes an end-to-end FHE-encrypted data flow, safeguarding user data privacy throughout the process.

An FHE-based neural network in AI-as-a-service provides significant flexibility for users. Once the ciphertext is sent to the server, the user can go offline as no frequent communication is required between the client and server. This characteristic is particularly beneficial for IoT devices, which often operate under constraints that make frequent communication impractical.

However, it is important to note the limitations of FHE. The computational overhead is substantial; FHE schemes are inherently time-consuming, complex, and resource-intensive. Furthermore, FHE currently struggles to support non-linear operations effectively, which poses a challenge for neural network implementations. This limitation can impact the accuracy of neural networks built on FHE, as non-linear operations are crucial for the performance of such models.

K.-Y. Lam, X. Lu, L. Zhang, X. Wang, H. Wang, and S. Q. Goh, "Efficient FHE-based Privacy-Enhanced Neural Network for AI-as-a-Service," presented at the Nanyang Technological University, Singapore, and Chinese Academy of Sciences, China.

(Lam et al. 2024) describe a protocol for privacy-enhanced neural network for AI-as-a-service. The protocol begins by defining the parameters for the input layer using Learning With Errors (LWE). LWE is a cryptographic primitive used to secure data through encryption, making it possible to perform computations on encrypted data without needing to decrypt it first. For the hidden output layer, parameters are defined using Ring-LWE (RLWE) and Ring-GSW (RGSW), which are advanced cryptographic techniques that extend LWE for more efficient encryption operations.

Public parameters include decomposition bases $$B$$ and $$B_{KS}$$. Given an input vector $$x$$ of length $$N$$, a set of $$N$$ LWE ciphertexts $$(a_i, b_i)$$ is generated for each element $$x[i]$$ using the LWE secret key $$s$$. Evaluation keys with respect to $$s$$ are generated for indices where $$x[i] > 0$$ and $$x[i] < 0$$. Additionally, a set of LWE switching keys with respect to $$B$$ is generated. These keys allow for efficient switching between different encryption schemes.

The input layer is designated as Layer 0, and the output layer is Layer $$L$$. For each layer $$l$$ from 1 to $$L$$, the number of neurons $$H_l$$ in layer $$l$$ is determined. The weight matrix $$W_l$$ and bias vector $$\beta_l$$ from layer $$l-1$$ to layer $$l$$ are defined. For each neuron $$h$$ from 0 to $$H_{l-1} - 1$$, the LWE ciphertexts from Layer $$l-1$$ are homomorphically evaluated. This means the computations are performed on encrypted data to compute the linear function in the $$h$$-th neuron of Layer $$l$$, incorporating the weight matrix and bias vector. The look-up table (LUT) is then evaluated in the $$h$$-th neuron, and a switch from $$n'$$ to smaller $$n$$ is performed, followed by rounding and rescaling the result. The result is included in the set of LWE ciphertexts for Layer $$l$$.

Finally, the protocol returns the LWE ciphertexts to the user. The user can then decrypt all the ciphertexts with the secret key $$s$$ to find the inference result.

This protocol efficiently enables privacy-preserving neural network inference by leveraging Fully Homomorphic Encryption (FHE) techniques. FHE allows computations to be performed on encrypted data without revealing the data itself to the processing server, ensuring data privacy while providing the benefits of AI-as-a-Service.

Applications of FHE for AI

FHE enables secure computations on encrypted data, opening up a wide array of new use cases while preserving data privacy and security.

Consumer Privacy in Advertising: (Armknecht et al., 2013) introduced an innovative recommender system leveraging FHE. This system can deliver personalized recommendations to users while keeping the content of these recommendations completely hidden from the system itself. This ensures that user preferences remain private, addressing significant privacy concerns in targeted advertising.

Medical Applications: (Naehrig et al., 2011) propose a compelling scenario for the healthcare industry. They suggest continuously uploading a patient's medical data to a service provider in encrypted form using FHE. This ensures that sensitive medical information remains confidential throughout its lifecycle, enhancing patient privacy while enabling seamless data processing and analysis by healthcare providers.

Data Mining: Mining large datasets can yield substantial insights, yet it often comes at the cost of user privacy. (Yang, Zhong, and Wright, 2006) tackled this issue by applying functional encryption within the context of FHE. This approach allows the extraction of valuable information from vast datasets without compromising the privacy of the individuals whose data is being mined.

Financial Privacy: Consider a scenario where a corporation possesses sensitive data and proprietary algorithms that they must keep confidential. (Naehrig et al., 2011) recommend using homomorphic encryption to address this. By applying FHE, corporations can perform necessary computations on their encrypted data without exposing either the data or the algorithms, thus ensuring financial privacy and intellectual property protection.

Forensic Image Recognition: (Bosch et al., 2014) describe a method to outsource forensic image recognition using FHE. This technique is particularly beneficial for law enforcement agencies. By applying FHE, police and other agencies can detect illegal images on hard drives without exposing the image contents, thereby preserving the integrity and confidentiality of the data under investigation.

From advertising and healthcare to data mining, financial security, and law enforcement, FHE stands to revolutionize the way we handle sensitive information across various sectors. As we continue to develop and refine these technologies, the importance of preserving privacy and security in an increasingly data-driven world cannot be overstated.

Limitations of Fully Homomorphic Encryption (FHE)

Despite its potential, there are critical limitations that we must address

Support for Multiple Users: FHE enables computations on encrypted data, but in scenarios involving multiple users, the complexities multiply. Typically, each user's data would be encrypted under a unique public key. Managing such disparate datasets, especially with FHE's computational demands, becomes impractical in large-scale environments. To address this, researchers such as Lopez-Alt et al., 2013 propose multi-key FHE frameworks that allow simultaneous operations on datasets encrypted with different keys. This approach, while promising, introduces additional layers of complexity and requires sophisticated coordination in key management and system architecture to ensure privacy and efficiency.
Large Computational Overhead: The cornerstone of FHE is its ability to perform calculations on encrypted data. However, this capability comes at a significant cost. The computational overhead for FHE operations is substantially higher compared to traditional, unencrypted computations. The overhead is often polynomial in nature, yet it involves large-degree polynomials that exacerbate the runtimes, making it less feasible for real-time applications. Hardware acceleration for FHE represents a large market opportunity to reduce the computational complexity and increase the execution speed.
Limited Operations: Recent advancements have indeed expanded the horizons of FHE, allowing it to support a wider array of operations. Nevertheless, it remains predominantly effective for linear and polynomial computations. This is a significant constraint, especially for AI applications involving complex, non-linear models like deep neural networks. These AI models require operations that are currently challenging to implement efficiently under the FHE paradigm. Although we are making progress, the gap between the operational capability of FHE and the requirements of advanced AI algorithms continues to be a critical barrier.

FHE in the Context of Crypto x AI

Here are some companies that are working on using FHE for AI in the crypto sector:

Zama offers Concrete ML, an open-source set of tools designed to simplify the use of FHE for data scientists. Concrete ML enables the conversion of machine learning models into their homomorphic equivalents, allowing for secure computations on encrypted data. Zama's approach makes it easier for data scientists to leverage FHE without needing in-depth cryptographic knowledge. This is particularly useful in sectors such as healthcare and finance, where data privacy is critical. Zama's tools facilitate secure data analysis and machine learning while keeping sensitive information encrypted.
Privasea is focused on creating a secure AI computation network. Their platform leverages FHE to allow multiple parties to collaborate without revealing sensitive information. By using FHE, Privasea ensures that user data remains encrypted throughout the AI computation process, protecting privacy and adhering to stringent data protection regulations like GDPR. Their system supports a wide range of AI models, making it a versatile solution for secure data processing.
Octra combines cryptocurrency with AI to enhance digital transaction security and data management. By integrating FHE and machine learning, Octra aims to improve the security and privacy of decentralized cloud storage. Their platform ensures that user data remains encrypted and secure through the use of blockchain, cryptography, and AI. This approach provides a robust framework for secure digital transactions and data privacy in a decentralized economy.
Mind Network integrates Fully Homomorphic Encryption (FHE) with AI to enable secure, encrypted computations for AI processes without decryption. This facilitates a privacy-preserving, decentralized AI environment, merging cryptographic security with AI functionality seamlessly. This approach not only protects the confidentiality of the data but also enables a trustless, decentralized environment where AI operations can be conducted without relying on central authorities or exposing sensitive information, effectively merging the cryptographic strength of FHE with the operational demands of AI systems.

The number of companies operating at the forefront of FHE, AI, and crypto, remains limited. This is primarily due to the significant computational overhead required to implement FHE effectively, necessitating substantial processing power to perform encrypted computations efficiently.

Closing Thoughts

Fully Homomorphic Encryption (FHE) offers a promising approach to enhancing privacy in AI by enabling computations on encrypted data without decryption. This capability is particularly valuable in sensitive sectors like healthcare and finance, where data privacy is critical. However, FHE faces significant challenges, including high computational overhead and limitations in handling non-linear operations essential for deep learning. Despite these hurdles, advancements in FHE algorithms and hardware acceleration are paving the way for more practical applications in AI. Continued development in this area could greatly enhance secure, privacy-preserving AI services, balancing computational efficiency with robust data protection.

Looking Ahead

In future posts, I will cover different parts of the Crypto x AI space as frequently as I can! If you have any questions or any suggestions, please feel free to reach me on X.

#1 FHE for AI - The Holy Grail