METHOD AND SYSTEM FOR THE CONFIDENTIAL CLASSIFICATION OF DATA

Description

TECHNICAL FIELD

[0001] The present invention relates to the field of artificial intelligence and more particularly to that of deep learning using artificial neural networks. It is applicable to the field of confidential data classification, in particular to facial recognition and speaker recognition. PREVIOUS STATE OF THE ART

[0002] Machine learning ( machine learning Machine Learning as a Service (MLAS) is currently under rapid development. Generally, in such a context, an artificial intelligence program hosted by a platform is trained on a dataset (in a supervised or unsupervised manner) during a learning phase. In an operational phase, a user can then provide data to the computing platform for classification or prediction purposes.

[0003] An example of a cloud-based data classification service is the FaceNet facial recognition system. It accepts the pixels of a photograph as input and outputs either the identifier of a known face or a probability vector indicating, for each face in a set of known faces, the probability that the input photograph corresponds to that face. The FaceNet system uses a particularly complex deep convolutional neural network, the training of which requires significant expertise and computational time.

[0004] A description of the FaceNet facial recognition system can be found in the article by F. Schroff et al. entitled "FaceNet a unified embedding for face recognition and clustering" published in Proc. of IEEE CVPR, pp. 815-823, 2015.

[0005] During its operational phase, the FaceNet system may need to recognize faces that were not present in the training database. For obvious reasons of system maintainability, it is not possible to have the system perform a complete retraining when one or more new faces need to be recognized. To overcome this difficulty, the FaceNet system comprises two cascaded modules: a first generic module for analyzing face photos, independent of the faces to be recognized, and a second classification module, specific to the faces to be recognized, much simpler than the first and adapted to recognize a face based on the analysis results provided by the first module. The analysis module consists of a deep neural network trained on a large database of human faces.It allows us to reduce the dimensionality of the input vector by projecting it onto a lower dimension space (. embedding The first module consists of facial features and defines a similarity metric. The second module performs the actual classification of the face to be recognized using a nearest neighbor or k-nearest neighbors algorithm based on this metric. The identifier of the class into which the face photo is classified allows the user to recognize it.

[0006] However, the FaceNet system does not guarantee the confidentiality of the faces searched for by users, nor that of the search result.

[0007] Several solutions have been proposed in the state of the art to ensure this confidentiality. For example, a user can use noise-making techniques on the reference data they transmit to the platform. However, this noise-making can lead to a degradation in facial recognition performance.

[0008] Even when the input data is not confidential, it frequently happens that the result of the classification must remain confidential, or even that the entire set of classes used for this classification must itself remain confidential.

[0009] In the article by F. Bourse et al. entitled "Fast homomorphic evaluation of deep discretized neural networks," published in the journal CRYPTO (3) 2018, pp. 483-512, a confidential evaluation system using a deep neural network based on homomorphic encryption was proposed. Data is provided to the classifier in encrypted form, and the classifier performs classification within the homomorphic domain. The classification result is obtained within the homomorphic domain. However, such a neural network is computationally very complex. It is also not suitable for simply classifying non-confidential data.

[0010] The object of the present invention is therefore to propose a method for confidentially classifying non-confidential data into a set of confidential classes. DESCRIPTION OF THE INVENTION

[0011] The present invention is defined by the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Other features and advantages of the invention will become apparent upon reading a preferred embodiment of the invention, described with reference to the accompanying figures, among which: There Fig. 1 schematically represents a confidential data classification system according to a first embodiment of the invention; The Fig. 2 represents the flowchart of a confidential data classification method according to a first embodiment of the invention; The Fig. 3 schematically represents a confidential data classification system according to a second embodiment of the invention; The Fig. 4 represents the flowchart of a confidential data classification method according to a second embodiment of the invention. DETAILED DESCRIPTION OF SPECIFIC METHODS OF IMPLEMENTATION

[0013] We will now consider a confidential data classification system. Without sacrificing generality, we will refer to a facial recognition application operating on image data. However, those skilled in the art will understand that this system can be applied to the confidential classification of other types of data, such as speech data for speaker recognition or even traffic measurements in a computer network for the detection of a type of cyberattack or anomaly.

[0014] There Fig. 1 schematically represents a confidential data classification system according to a first embodiment of the invention.

[0015] The confidential classification system, 100, also called the confidential classification platform, includes first of all an artificial neural network, 110, designed to learn, in a learning phase, discriminating features from input data.

[0016] The input data may, where applicable, have been preprocessed in a preprocessing module (not shown) before being fed to the artificial neural network. Examples of such preprocessing include a spatial or temporal Fourier transform as appropriate, a wavelet transform, and decomposition in an orthogonal basis. ad hoc etc.

[0017] In any case, we will assume that the input data, whether raw or pre-processed, forms a vector x in a space of dimension n , x ∈ ¡ n< For example, in the case of image data, ncan be a number of pixels or a number of spectral components.

[0018] The artificial neural network is adapted to provide a compressed representation of input data in the form of discriminating features, y ∈ ¡ m< , belonging to a small-dimensional space m < n. The artificial neural network could be an autoencoder comprising one or more hidden layers. This autoencoder is trained unsupervised on a training dataset, which, in the case of a facial recognition system, is an image database. In the case of an image database, the artificial neural network could be a convolutional neural network.

[0019] The compression (or projection) function, f input data on the space of discriminating features is such that if two input data vectors, x 1,x 2 are close in the sense of a certain relationship of proximity in ¡ n< , the corresponding vectors of discriminating characteristics, f ( x 1), f ( x 2) are also close in the sense of a standard in ¡ m< In other words, if two images in the training database 150 are similar, their compressed representations in feature space will be "close" in the sense of a certain metric derived from a standard of ¡ m< .

[0020] Once the artificial neural network has been trained on the vectors x train of the training database, in other words once it is initialized, the network is defined by a matrix of synaptic weights (Python numpy file for example).

[0021] The user imports the synaptic weight matrix from the platform and builds a local neural network, 110', with the same synaptic weights as the one trained on the platform.

[0022] The user then provides reference data to the local neural network. This reference data is data that will later be recognized. For example, the reference data could be images of individuals that will then be identified. It is important to note that this reference data is generally not present in the training database. Reference data vectors will be denoted as such in the following sections. x 1 ref , … , x N ref .

[0023] The user thus obtains, as output from the local neural network, vectors of discriminating features corresponding to these reference data vectors. y 1 ref = f x 1 ref , … , y N ref = f x N ref These vectors will be referred to in the following as reference characteristic vectors.

[0024] Now suppose that the user wants to classify an unknown image represented by an input data vector, x. This vector is evaluated by the local neural network 110', which provides a vector of discriminating features y = f ( x ). The distances separating the vector y thus obtained and the reference characteristic vectors, y i ref , i = 1,..., N allow the input data vector to be classified, x.

[0025] According to one variant, the classification can be performed by searching for the nearest neighbor, that is, the reference feature vector with the smallest distance to the discriminating feature vector. y : i 0 = arg min i = 1 , .. , N y − y i ref 2 = F y In other words, the reference data vector x i 0 ref is recognized in the input data vector x.

[0026] Alternatively, the classifier can calculate the probabilities that each reference data vector is recognized in the input data vector: p i = y − y i ref ∑ k = 1 N y − y k ref

[0027] According to a second variant, several reference data vectors, x i , 1 ref , … , x i , M ref can be associated with the same identifier i This will be the case in particular when M different images of the same individual's face are evaluated by the artificial neural network and the M Corresponding reference feature vectors are available. A k-nearest neighbors classification can then be performed to determine the identifier.

[0028] The goal of the invention, namely confidential classification on a confidential set of classes, is achieved by the classifier 130 of the platform operating in the homomorphic domain. More specifically, the discriminant feature vectors are encrypted using homomorphic encryption, and the nearest neighbor search is performed in the homomorphic domain.

[0029] It is assumed that the user has a homomorphic cryptosystem, consisting of a private key, HE.sk, and a public key, HE.pk.

[0030] Reference characteristic vectors y i ref , i =1,..., N, obtained using the local neural network, are encrypted by the user using their public key, then transmitted to platform 100, which stores them in the reference database, 120. Note Enc y i ref , HE . pk , i = 1 ,...,N the reference characteristic vectors thus quantified. More precisely, Enc y i ref , HE . pk = Enc y i , 1 ref , HE . pk , … , Enc y i , 1 ref , HE . pk is the vector whose components are the numerical values ​​of the components of y i ref Similarly, the user encrypts the standards of these vectors using their public key. Enc y i ref 2 , HE . pk , i =1,..., N and transmits them to the platform which stores them in relation to the encrypted reference characteristic vectors, Enc y i ref , HE . pk , i = 1, ..., N.

[0031] If the reference database needs to be subsequently supplemented by the user, for example if a new face needs to be added to those to be identified, the image of that face is provided to the local neural network. The user encrypts the resulting reference feature vector, as well as its norm, using their public key. HE.pk as explained previously. It transmits the encrypted vector and standard to the platform which stores them in the reference database.

[0032] According to an advantageous embodiment, the homomorphic cryptosystem is simply additive, that is to say, it satisfies the following relations: Enc a , HE . pk ⊕ Enc b , HE . pk = Enc a + b , HE . pk And Enc a , HE . pk ⊗ k = Enc ka , HE . pk where ⊕ is an addition operation between ciphertexts in the homomorphic domain and ⊗ is an external multiplication operation between a ciphertext and a plaintext.

[0033] We consider here the scenario in which a user wishes to classify (or identify) an input data vector x, for example the image of an individual.

[0034] The input data vector x is provided directly to the platform. The input data can, for example, come from a video stream transmitted directly to the platform without passing through the user. In this case, the neural network 110 performs the compression y = f ( x ) then provides the vector y to classifier 130.

[0035] Alternatively (variant represented by the dotted arrows in Fig. 1 The user has access to the input data vector in plain text and provides it to the local neural network 110'. The network then transforms it into a vector of discriminating features, also in plain text. y = f ( x ) then transmits the vector y to classifier 130.

[0036] In any case, the classifier can calculate, in the homomorphic domain, using operations (3-1) and (3-2), the Euclidean distances between the vector y (in plain English) and the reference characteristic vectors y i ref (numbers) : Enc y − y i ref 2 , HE . pk = Enc y 2 , HE . pk ⊕ Enc y i ref 2 , HE . pk ⊕ ⊕ m = 1 , … , M Enc y i , m ref , HE . pk ⊗ y m ⊗ − 2 Or y =( y 1,..., y M ) And y i ref = y i , 1 ref , … , y i , M ref .

[0037] The first term is the homomorphic numerical norm of the discriminant feature vector. This numerical norm can be provided by the user. Alternatively, it can be easily calculated by the classifier if it has the vector y in plain text and the public key HE.pk (or even numerical components) Enc ( ym, HE.pk ), the numerical norm then being obtained by ⊕ m = 1 , … , M Enc y m , HE . pk ⊗ y m ..

[0038] The second term is the numerical norm in homomorphic form of the reference feature vector of index i, Enc y i ref 2 , HE . pk : this term is read from the reference base where it is stored in relation to the ciphertext of the reference feature vector i, Enc y i ref , HE . pk .

[0039] The third term is calculated by the classifier in the homomorphic domain after retrieving the encrypted components from the reference basis. Enc y i , m ref , HE . pk stored in relation to the cipher of the index reference feature vector i , Enc y i ref , HE . pk It will be understood that the part in parentheses of the third term is none other than the numerical value of the dot product. Enc ∑ i = 1 M y i , m ref y m ; HE . pk .

[0040] Finally, the sum of the three terms is obtained by the classifier in the homomorphic domain.

[0041] Distance comparison can be performed in the homomorphic domain using Boolean circuits for the ">" (greater than) operator on the binary representations of the encrypted data, as described in the article by J. Garay et al. entitled "Practical and secure solutions for integer comparison", published in T. Okamoto and X. Wang editors, Public Key Cryptography - PKC 2007, volume 4450 of Lecture Notes in Computer Science, pages 330-342. Springer Berlin, Heidelberg, 2007.

[0042] Finally, the index i0 of the reference characteristic vector achieving the minimum distance to the vector y , i 0 = arg min i = 1 , … , N y − y i ref 2 The result is transmitted to the user. Since the platform does not have access to the clear reference feature vectors, the classification result remains confidential from the platform.

[0043] In one variant, the classifier can transmit the Euclidean distances in encrypted form to the user. The user then decrypts the distance values ​​using their private key. HE.sk and can either search for the index of the vector that has the smallest distance to the vector y (cf. expression (1)) i.e., to estimate the probabilities that the vector y falls into one of the N classes of the classifier (cf. expression (2)).

[0044] We have assumed up to this point that classification is based on finding the nearest neighbor. However, other classification functions exist. F For example, a classification function in the form of a linear or polynomial function of the data to be classified can be considered. The classification function associates a class with each input data vector. This class can be defined by a representative, for example, a reference data vector or, equivalently, the reference feature vector obtained by transforming the previous one using the artificial neural network.

[0045] As an example of a linear function, we can cite a hyperplane classifier, and as an example of polynomial (quadratic) classification, we can cite a Gaussian classifier. We will then preferably use, not an additive homomorphic cryptosystem in the previous sense, but an almost homomorphic cryptosystem or SHE ( Somewhat Homomorphic Encryption ) or even a fully homomorphic cryptosystem or FHE ( Full Homomorphic Encryption ) .

[0046] Advantageously, SHE or FHE encryption will be used, allowing batch operations to be performed ( batching ) . For example, a description of such an encryption method can be found in the article by JS. Coron et al. entitled "Batch fully homomorphic encryption of the integers" published in Advances in Cryptology - EUROCRYPT 2013, Lecture Notes in Computer Science, vol 7881. Springer, Berlin, Heidelberg.

[0047] The principle of batch processing is to multiplex several plaintexts to form a composite plaintext in order to obtain a single ciphertext. Thus, instead of encrypting the plaintexts independently of each other, a composite plaintext message constructed from the plaintexts in question is encrypted.

[0048] Batch processing allows the same operation to be parallelized on a plurality of ciphertexts in the homomorphic domain. More precisely, if we note α 1, ..., α L a plurality of first clear and ( α 1,..., α L ) a first composite plaintext message constructed by batching from these first plaintexts and if we note β 1,..., β L a similar plurality of clear seconds and ( β 1,..., β L ) a second composite message in plaintext, constructed by batching from these second plaintext messages, and if we encrypt the first and second composite messages in question: Enc α 1 , … α L ; HE . pk = α ¯ Enc β 1 , … , β L ; HE . pk = β ¯ We can then perform an addition or multiplication operation in parallel on the ciphers in the homomorphic domain by calculating respectively α ⊕ β And α e β (the notation e denotes the internal multiplication law), given that: Dec α ¯ ⊕ β ¯ ; HE . sk = α 1 + β 1 , … , α L + β L Dec α ¯ e β ¯ ; HE . sk = α 1 × β 1 , … , α L × β L

[0049] Similarly, one can perform an external multiplication on digits in parallel by calculating k ⊗ α given that: Dec k ⊗ α ¯ ; HE . sk = kα 1 , … , kα L

[0050] Furthermore, some homomorphic encryption methods, such as BGV, allow for the accumulation of the constituent plaintexts of the composite plaintext, as described in the original article by Z. Brakerski et al. entitled "Fully homomorphic encryption without bootstrapping," published in Cryptology ePrint Archive, Report 2011 / 277. More precisely, a second ciphertext can be obtained. α 'from the cipher αwhose deciphering yields: Dec α ¯ ′ ; HE . sk = ∑ 1 = 1 L α 1 , … , ∑ 1 = 1 L α 1

[0051] In other words, after decryption, we obtain a second composite message whose constituent elements are all equal to the sum of the plaintexts composing the original composite message.

[0052] The aforementioned batch processing properties allow Euclidean distances to be calculated in a small number of operations in the homomorphic domain. Indeed, in this case, a single homomorphic cipher represents all the components of a reference characteristic vector. y i ref = y i , 1 ref , … , y i , M ref The third term of expression (4) can then be calculated using only two homomorphic operations, regardless of the dimension. M of the characteristic space. Two further additions in the homomorphic domain allow the calculation of a Euclidean distance to be completed within the homomorphic domain. The calculation of Euclidean distances is then particularly efficient.

[0053] Alternatively, batch processing can be performed component by component on all reference feature vectors. More precisely, each number then represents the set of components of the same rank from the different reference feature vectors. This batch processing is suitable for cases where the classification function is more complex than a nearest neighbor search, particularly when it is expressed as a polynomial function of the data to be classified.

[0054] There Fig. 2 represents the flowchart of a confidential data classification method according to an embodiment of the invention.

[0055] This method implements a cascaded artificial neural network with a classifier from a classification platform as shown in Fig. 1 .

[0056] In a first phase, called the learning phase, the artificial neural network, advantageously an autoencoder, is trained on a training database. Thus, the autoencoder can be trained unsupervised on images stored in this database. At the end of this learning phase, the artificial neural network is able to represent the input data vectors (an image) in a lower-dimensional characteristic space ( embedding ) .

[0057] The user then downloads the file of synaptic coefficients of the neural network thus trained to build in 220 a local neural network, NN', identical to that of the platform.

[0058] An operational phase follows this learning phase. This includes an initialization phase of the homomorphic classifier followed by a classification phase.

[0059] In the initialization phase, the user provides the platform with a plurality of reference data vectors (e.g., a set of face images to be recognized), encrypted in the homomorphic domain.

[0060] These reference data vectors are transformed in step 230 by the local neural network into reference feature vectors. In step 240, the reference feature vectors are homomorphically encrypted by the user using their public key HE.pk. Similarly, the norms of these reference feature vectors are encrypted homomorphically. In step 250, the user transmits the encrypted vectors and their corresponding norms to the platform for storage in the reference database. It is important to note that the platform is agnostic, as it does not have access to the plaintext reference data (for example, the faces to be recognized).

[0061] In the classification phase itself, the user can have the platform classify an input data vector (for example, images). This input data vector is first transformed by the platform's neural network into a vector of discriminating features, which is then provided to the classifier. Alternatively, as seen above, the input data vector can be transformed by the user's local neural network and then transmitted by the user to the platform.

[0062] In all cases, the classifier evaluates the classification function in 270 F In the homomorphic domain, it uses the discriminating feature vector and the reference feature vectors stored in encrypted form in the reference database. Finally, it transmits the evaluation result to the user in 280.

[0063] The result of the evaluation can be the index of the reference feature vector (and therefore the index of the corresponding reference data vector) achieving the smallest distance from the discriminating feature vector, y Alternatively, Euclidean distances encrypted in homomorphic form, Enc y − y i ref 2 , HE . pk , i = 1,.., N can be transmitted to the user who decrypts them using their secret key HE.pk and can determine, by means of expression (2), the respective probabilities that the input data vector corresponds to the different reference data vectors.

[0064] There Fig. 3 schematically represents a confidential data classification system according to a second embodiment of the invention.

[0065] As in the first embodiment, the classification platform includes an artificial neural network, 310, cascaded with a classifier 330, adapted to operate in the homomorphic domain.

[0066] The artificial neural network is trained on data vectors x train read from the learning database 350. Furthermore, the platform builds the equivalent neural network in the homomorphic domain, 315, hereinafter referred to as NNH

[0067] Unlike the first embodiment, the reference data vectors, x 1 ref , … , x N ref The data is encrypted by the user in the homomorphic domain and transmitted to the platform, 300, to be fed into the NNH neural network. More specifically, the NNH neural network performs the equivalent of compression f in the homomorphic domain, in other words, it provides as output the homomorphic cipher of the reference characteristic vector, Enc y i ref , HE . pk from the homomorphic cipher of the reference data vector, Enc x i ref , HE . pk This compression operation in the homomorphic domain is performed once and for all on the set of reference data vectors. x 1 ref , … , x N ref . The homomorphic ciphers of the reference characteristic vectors, Enc y i ref , HE . pk , i = 1,..., N, are stored in the reference database, 320, the homomorphic cipher Enc y i ref , HE . pk being represented by a vector of numerical components Enc y i , m ref , HE . pk , m = 1,.., M. The norm of each vector y i ref , i = 1 , … , N is deduced in the homomorphic domain, that is Enc y i ref 2 , HE . pk and is stored in the 320 reference base in relation to the vector Enc y i ref , HE . pk .

[0068] We are again considering a scenario where the user wants to classify an input data vector. x(For example, an image from a video stream for facial recognition). This vector is usually provided directly to the platform without passing through the user. In some cases, however, the user may provide the input data vector.

[0069] The platform's neural network compresses the input data vector to derive the vector of discriminating features. y and then provide it to the 330 classifier. The function of the 330 classifier is identical to that of the 130 classifier. In particular, the 330 classifier calculates, within the homomorphic domain, the respective distances between the vector of discriminating features and the various reference vectors. It returns to the user the index of the reference vector corresponding to the smallest distance, or the distances to these vectors, expressed in the homomorphic domain.

[0070] There Fig. 4represents the flowchart of a confidential data classification method according to a second embodiment of the invention.

[0071] Unlike the first embodiment, the learning phase includes, in addition to a training step, 410, of the NN neural network (identical to step 210 of the Fig. 2 ), a step 425 in which the platform builds an NNH neural network performing the equivalent of compression f in the homomorphic domain.

[0072] This learning phase is followed by an operational phase, comprising an initialization phase 435-450 and a classification phase 460-480.

[0073] In step 435, the user encrypts the reference data vectors, x 1 ref , … , x N ref then transmit them to the platform.

[0074] At step 440, the NNH neural network performs compression of the reference data vectors in the homomorphic domain to obtain the reference feature vectors, encrypted in the homomorphic domain. Enc y i ref , HE . pk , i =1,..., N. The norms of these vectors are also calculated in the homomorphic domain, Enc y i ref 2 , HE . pk , i = 1,..., N.

[0075] At step 450, these vectors (and their norms) are stored in the platform's reference database.

[0076] The classification phase includes steps 460-480 as in the first embodiment. Step 460 may differ from step 260 in that the input data vector x The data to be classified is always provided to the platform to be transformed by the artificial neural network (NN) into a vector of discriminating features. yIn other words, the compression is performed here by the platform's neural network and never by the user's local neural network.

[0077] The following steps 470 and 480 are, however, identical to steps 270 and 280 described in relation to the Fig. 2 .

[0078] At the end of the classification phase, the platform transmits to the user the index of the reference feature vector that has the smallest distance from the discriminating feature vector. y , or Euclidean distances expressed in homomorphic form, Enc y − y i ref 2 , HE . pk .

[0079] The second embodiment, which is not claimed, differs from the first in that the artificial neural network is not shared between the platform and the user. It therefore assumes that the platform performs compression of the reference data vectors in the homomorphic domain, which, as we saw in the introduction, can be highly detrimental in terms of computational load. However, it is essential to note that, unlike in the prior art, the network's operation in the homomorphic domain occurs here only during the initialization phase and not with each classification query.

Claims

1. A confidential data classification platform comprising an artificial neural network (110, 310) cascaded with a classifier (130, 230), the artificial neural network being adapted to be trained during a learning phase on data vectors from a learning database (150, 350) and to transform, in an operational phase, input data vectors into discriminative characteristic vectors, said discriminative characteristic vectors being provided to the classifier and having a size smaller than that of the data vectors, said classification platform comprising a reference base (120, 320) in which are stored, during an initialisation phase of the classifier, reference characteristic vectors, obtained by transforming, by means of the artificial neural network (110, 310) or a copy (110') thereof, reference data vectors, the reference characteristic vectors being stored in encrypted form by a public key of a homomorphic cryptosystem of said user; and after the initialisation phase, and said classification platform being such that, when the user requests the classification platform (100, 300) to classify an input data vector (x), the classifier (130, 330) evaluates a classification function in the homomorphic domain, from the discriminative characteristic vector (y) provided by the artificial neural network (110, 310) or said copy (110') thereof, and from the reference characteristic vectors stored in encrypted form in the reference base Enc y i ref , HE . pk , i = 1,..., N), and transmits the result of said evaluation to the user; that the user downloads from the platform a copy (110') of the artificial neural network at the end of the learning phase, and that said copy of the neural network is configured to provide, during the initialisation phase, the reference characteristic vectors from the reference data vectors, the user having a module for homomorphic encryption (140) by said public key, configured to encrypt said reference characteristic vectors and transmit them to the platform where they are stored in the reference base (120).

2. The confidential data classification platform according to claim 1, characterized in that the artificial neural network is an auto-encoder.

3. The confidential data classification platform according to claim 1, characterized in that the homomorphic system is additive.

4. The confidential data classification platform according to claim 1 or 2, wherein the homomorphic system is a SHE or FHE system.

5. The confidential data classification platform according to one of claims 1 to 4, characterised in that the platform further comprises a second artificial neural network (315) configured to perform in the homomorphic domain a transformation operation equivalent to that performed by the artificial neural network in the cleartext domain, the user having a module for homomorphic encryption (340) by said public key configured to encrypt said reference data vectors and transmit them to the platform where they are transformed by the second neural network (315) into reference characteristic vectors encrypted in the homomorphic domain before being stored in the reference base (320).

6. The confidential classification platform according to any of the claims 1 to 5, characterised in that the classifier is configured to compute in the homomorphic domain, the scalar product of the discriminative characteristic vector, y, with the reference characteristic vectors, from the cleartext components (y1,..., yM) of the discriminative characteristic vector, and the encrypted components of the reference characteristic vectors, by means of Enc ∑ i = 1 M y i , m ref y m ; HE . pk = ⊕ m = 1 , .. , M Enc y i , m ref , HE . pk ⊗ y m where ⊕ is the internal addition operation in the homomorphic domain and ⊗ is the external multiplication operation between an element of the homomorphic domain and a cleartext.

7. The confidential classification platform according to claim 6, characterised in that said scalar product is computed by means of batch processing, by clustering the different components of each reference characteristic vector within a first composite cleartext message, said first composite cleartext message being subsequently homomorphically encrypted, to obtain a first composite encrypted message, and by clustering the different components of the discriminative characteristic vector within a second composite cleartext message, said batch processing comprising an external multiplication of the first composite encrypted message with the second composite cleartext message.

8. The confidential data classification platform according to claim 6 or 7, characterised in that the user provides the classifier with the public key HE.pk of his / her homomorphic cryptosystem and the classifier is further configured to compute the ciphertext of the norm of the discriminative characteristic vector, Enc(∥y∥2 , HE.pk).

9. The confidential data classification platform according to claim 8, characterised in that the classifier is further configured to compute, in the homomorphic domain, the Euclidean distances between the discriminative characteristic vector (y) and the reference characteristic vectors ( y i ref , i = 1,.., N), from the encrypted norm of the discriminative characteristic vector, the encrypted norms of the reference characteristic vectors, and the respective scalar products between the discriminative characteristic vector and the reference characteristic vectors.

10. The confidential data classification platform according to claim 9, characterised in that the classifier compares said Euclidean distances in the homomorphic domain and returns to the user the index of the reference characteristic vector corresponding to the lowest Euclidean distance.

11. The confidential data classification platform according to claim 9, characterised in that the classifier returns to the user said Euclidean distances obtained in the homomorphic domain and the user derives therefrom by means of the private key of his / her homomorphic cryptosystem, respective probabilities that the input data vector corresponds to the reference data vectors.

12. A method for confidentially classifying data by means of an artificial neural network (110, 310) and a classifier (130, 330), wherein the artificial neural network is trained during a learning phase on data vectors of a learning base, and the artificial neural network or a copy thereof transforms, in an operational phase, input data vectors into discriminative characteristic vectors, said discriminative characteristic vectors being provided to the classifier (130) and having a size smaller than that of the data vectors, said method comprising: - downloading, by the user of the platform, from the platform a copy (110') of the artificial neural network at the end of the learning phase; - obtaining, by means of said copy of the neural network, during an initialisation phase of the classifier, the reference characteristic vectors from the reference data vectors, the user having a module for homomorphic encryption (140) by said public key, configured to encrypt in homomorphic said reference characteristic vectors; - transmitting said reference characteristic vectors to the platform, - during the initialisation phase of the classifier, storing in a reference base (120, 320) reference characteristic vectors, said reference characteristic vectors obtained by transforming, by means of the artificial neural network or said copy, reference data vectors, the reference characteristic vectors being stored in encrypted form by a public key of a homomorphic cryptosystem of said user; and after this initialisation phase, - when the user requests the classification of an input data vector (x) from the classification platform, a classification function (f) is evaluated by the classifier in the homomorphic domain, from the discriminative characteristic vector (y) provided by the artificial neural network and the reference vectors stored in encrypted form in the reference base ( Enc y i ref , HE . pk , i = 1, ..., N), the result of said evaluation being transmitted to the user.