Decision Tree-Based Inference on Homomorphically Encrypted Data

Abstract

A method, apparatus, and computer program product for homomorphic inference on decision tree (DT) models. Instead of HE-based inference on the decision tree, inference is performed on a neural network (NN) that acts as a surrogate. To this end, the neural network is trained to learn the DT decision boundaries, preferably without using the original DT model data training points. During training, a random data set is applied to the DT, and the expected output is recorded. This random data set and expected output are then used to train the neural network, so that the neural network's output matches the expected output from applying the original data set to the DT. Preferably, the neural network has a low depth of only a few layers. HE-based inference on the decision tree is performed using HE inference on a shallow neural network. The latter is computationally efficient and can be performed without the need for bootstrapping.

Description

[Technical field]

[0001] The present invention relates to the use of fully homomorphic encryption operations to facilitate inference on encrypted data. [Background technology]

[0002] "Decision trees" are a common decision support model for many application areas. A decision tree (DT) is a flow-chart-like structure of nodes where each internal node represents a test on attributes, each branch represents the result of the test, and each leaf node represents a class label (the decision after computing all attributes). The paths from the root to the leaves represent the classification rules. A decision tree can be trained on a data set and the corresponding regression output is obtained.

[0003] There are many scenarios where the data required to train this type of decision tree regression model is confidential, such as when the model belongs to some organization but cannot be shared externally. For example, credit card transaction information is available to credit card companies but not to regular users. Similarly, healthcare data about patients is available within hospitals but not available to researchers to find patterns in the data to understand cancer progression. Furthermore, privacy issues (such as the new European data privacy regulation GDPR) can limit the availability of data. A similar situation arises when competitors want to pull each other's data to build accurate models (such as when different banks have data about transactions and want to build a fraud detection model). Limiting the availability of data can prevent the use of models that would otherwise be useful or reduce their performance.

[0004] To address these privacy concerns, it is known in the prior art to provide machine learning-as-a-service (MLaaS) solutions, where trained models of this type are hosted on cloud servers, and the hosting cloud servers as a service allow users to perform inference queries on the models. This concept is sometimes referred to as privacy-preserving inference, and its goal is to provide a secure manner for users to maintain the privacy of the scoring point data returned by the models, while also allowing the cloud provider to protect the privacy of the models, e.g., for proprietary, regulatory, or other reasons. Exemplary use cases include hospitals that want to train models (e.g., to predict the likelihood of disease) and provide a scoring service with strict privacy restrictions due to data confidentiality, and financial credit scoring firms that train credit risk models and provide a scoring service with strict privacy restrictions, also due to legal or regulatory requirements. To this end, these types of solutions implement an advanced cryptographic technique known as Fully Homomorphic Encryption (FHE), which enables secure computations on client data without the need to decrypt it in the model, while at the same time providing a way to keep the model itself secret.

[0005] Although homomorphic encryption offers significant benefits, decision tree-based models are not suitable for efficient processing using FHE techniques. The basic operation performed in a model node is the comparison of two values, and this comparison (when performed using FHE) is a linear function (e.g., a sigmoidal function f(x)=1 / (1+e -xThis issue arises (in the context of FHE) because the branching computation is a nonlinear operation (using scalars). As a result, the comparison is ambiguous and, moreover, difficult to scale since the scaling factor is not uniform. Therefore, it is not practical to implement such branching computations in a fully homomorphic encryption scheme, and thus there remains a challenge in realizing FHE-based inference on decision trees. Summary of the Invention

[0006] Embodiments of the present invention address this problem. Instead of performing homomorphic inference on the DT model itself, the techniques herein use a specially trained low-depth neural network (NN) in place of the DT model, and homomorphic inference is then performed on the neural network. In this way, the neural network is a surrogate or proxy for the DT model, and untenable branch computations that would normally be required by inferring against the DT model are avoided.

[0007] To this end, according to an embodiment of the present invention, a neural network is trained to learn the decision boundaries of the DT tree. This operation is performed in the clear (in plain text) by the DT model owner, and preferably the neural network training is performed without using the original data training points used for the DT model itself. In this training phase, a random data set is applied to the DT and its expected output (from applying the tree) is obtained. The distribution properties of the random data set (e.g., minimum and maximum values, feature-wise mean and variance, etc.) match the distribution properties of the original data set. This random data set and the expected output are then used to train the neural network, so that the output of the neural network matches the expected output from applying the original data set to the DT. Preferably, the neural network has a low depth (e.g., less than about three layers) and may therefore be referred to herein as "shallow". Once trained, inference is performed on the shallow neural network instead of inferring directly on the DT. In other words, HE-based inference for decision trees is performed using HE inference for shallow neural networks, the latter being computationally efficient and performed without the need for bootstrapping.

[0008] The above outlines some of the more pertinent features of the subject matter. These features should be construed as merely exemplary. Many other beneficial results can be attained by applying the disclosed subject matter in a different manner or by modifying the subject matter as described.

[0009] For a more complete understanding of the present invention, and the advantages thereof, reference is now made to the following descriptions taken in conjunction with the accompanying drawings, in which: [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 illustrates an exemplary block diagram of a distributed data processing environment in which exemplary aspects of the illustrative embodiments may be implemented. [Diagram 2] 1 is an exemplary block diagram of a data processing system in which exemplary aspects of the illustrative embodiments may be implemented; [Diagram 3] FIG. 1 illustrates an example cloud computing architecture in which the disclosed subject matter may be implemented. [Figure 4] 1 is a representative machine learning-as-a-service (MLaaS) operating environment in which the techniques of the present disclosure may be implemented. [Diagram 5] FIG. 1 illustrates a technique of the present disclosure in which a low-depth neural network is trained to learn the decision boundaries of a decision tree of interest, thereby allowing the NN to be used as a proxy for HE inference against the decision tree. [Figure 6] A block diagram illustrating a set of high-level functions that comprise a system for privacy-preserving HE-based inferencing on decision trees in accordance with the present disclosure. [Figure 7] FIG. 13 illustrates how the techniques disclosed herein can be extended to facilitate privacy-preserving homomorphic inference over a collection of decision trees. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011]

[0023] Referring now to the drawings, and in particular to Figures 1-2, exemplary diagrams of data processing environments are provided in which exemplary embodiments of the present disclosure may be implemented. It should be understood that Figures 1-2 are merely exemplary and are not intended to assert or imply any limitation with respect to the environments in which aspects or embodiments of the disclosed subject matter may be implemented. Many modifications to the depicted environments may be made without departing from the scope of the present invention.

[0012] Client-Server Technology Referring now to the drawings, Figure 1 illustrates a pictorial representation of an exemplary distributed data processing system in which aspects of the exemplary embodiments may be implemented. Distributed data processing system 100 may include a network of computers in which aspects of the exemplary embodiments may be implemented. Distributed data processing system 100 includes at least one network 102, which is the medium used to provide communications links between the various devices and computers connected to each other within distributed data processing system 100. Network 102 may include connections such as wires, wireless communications links, fiber optic cables, and the like.

[0013] In the depicted example, server 104 and server 106 are connected to network 102 along with storage unit 108. Additionally, clients 110, 112, and 114 are also connected to network 102. Such clients 110, 112, and 114 may be, for example, personal computers, network computers, etc. In the depicted example, server 104 provides data to clients 110, 112, and 114, such as boot files, operating system images, applications, etc. Clients 110, 112, and 114 are clients to server 104 in the depicted example. Distributed data processing system 100 may include additional servers, clients, and other devices not shown.

[0014] In the depicted example, distributed data processing system 100 is the Internet, where network 102 represents a worldwide collection of networks and gateways that use the Transmission Control Protocol / Internet Protocol (TCP / IP) suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers consisting of thousands of commercial, government, educational, and other computer systems that route data and messages. Of course, distributed data processing system 100 may also be implemented to include a number of different types of networks, such as, for example, an intranet, a local area network (LAN), a wide area network (WAN), etc. As previously mentioned, FIG. 1 is intended as an example, and not an architectural limitation for various embodiments of the disclosed subject matter, and thus the specific elements illustrated in FIG. 1 should not be considered as limitations with respect to the environments in which an exemplary embodiment of the invention may be implemented.

[0015]

[0023] Referring now to Figure 2, a block diagram of an exemplary data processing system in which aspects of the exemplary embodiments may be implemented is shown. Data processing system 200 is an example of a computer, such as client 110 of Figure 1, in which computer usable code or instructions implementing the processes for the exemplary embodiments of the present disclosure may be located.

[0016] 2, a block diagram of a data processing system in which an exemplary embodiment may be implemented is shown. Data processing system 200 is an example of a computer, such as server 104 or client 110 of FIG. 1, in which computer usable program code or instructions implementing processes for the exemplary embodiments may be located. In this illustrative example, data processing system 200 includes a communications fabric 202 that provides communications between a processor unit 204, a memory 206, persistent storage 208, a communications unit 210, an input / output (I / O) unit 212, and a display 214.

[0017] Processor unit 204 serves to execute instructions for software that may be loaded into memory 206. Processor unit 204 may be a set of one or more processors or may be a multi-processor core, depending on the particular implementation. Additionally, processor unit 204 may be implemented using one or more heterogeneous processor systems in which a main processor resides with secondary processors on a single chip. As another illustrative example, processor unit 204 may be a symmetric multi-processor (SMP) system that includes multiple processors of the same type.

[0018] Memory 206 and persistent storage 208 are examples of storage devices. A storage device is any piece of hardware that can store information on a temporary and / or persistent basis. In these examples, memory 206 may be, for example, a random access memory, or any other suitable volatile or non-volatile storage device. Persistent storage 208 may take various forms depending on the particular implementation. For example, persistent storage 208 may include one or more components or devices. For example, persistent storage 208 may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage 208 may also be removable. For example, a removable hard drive may be used for persistent storage 208.

[0019] In such an example, the communication unit 210 provides communication with other data processing systems or devices. In such an example, the communication unit 210 is a network interface card. The communication unit 210 may provide communication through the use of physical and / or wireless communication links.

[0020] Input / output unit 212 allows for the input and output of data to and from other devices that may be connected to data processing system 200. For example, input / output unit 212 may provide a connection for user input through a keyboard and mouse. Additionally, input / output unit 212 may send output to a printer. Display 214 provides a mechanism for displaying information to a user.

[0021] Instructions for the operating system and applications or programs are located on persistent storage 208. Such instructions may be loaded into memory 206 for execution by processor unit 204. The processes of the various embodiments may be performed by processor unit 204 using computer-implemented instructions, which may be located in a memory, such as memory 206. Such instructions are referred to as program code, computer usable program code, or computer readable program code, which may be read and executed by a processor in processor unit 204. The program code in the various embodiments may be embodied on different physical or tangible computer readable media, such as memory 206 or persistent storage 208.

[0022] The program code 216 may be disposed in a functional form on a computer readable medium 218, which may be selectively removable, and loaded onto or transferred to the data processing system 200 for execution by the processor unit 204. The program code 216 and the computer readable medium 218 form a computer program product 220 in such an example. As an example, the computer readable medium 218 may be in a tangible form, such as, for example, an optical or magnetic disk, that is inserted or placed into a drive or other device that is part of the persistent storage 208 for transfer onto a storage device, such as a hard drive that is part of the persistent storage 208. In a tangible form, the computer readable medium 218 may also take the form of persistent storage, such as a hard drive, thumb drive, flash memory, etc., that is connected to the data processing system 200. The tangible form of the computer readable medium 218 may also be referred to as a computer recordable storage medium. In some cases, the computer recordable medium 218 may not be removable.

[0023] Alternatively, program code 216 may be transferred to data processing system 200 from computer readable medium 218 through a communications link to communication unit 210 and / or a connection to input / output unit 212. The communications link and / or connection may be physical or wireless in illustrative examples. The computer readable medium may also take the form of intangible media, such as a communications link or wireless transmission containing the program code. The various components illustrated for data processing system 200 are not meant to provide architectural limitations to the manner in which various illustrative embodiments may be implemented. Various illustrative embodiments may be implemented in data processing systems including components in addition to or instead of those illustrated for data processing system 200. Other components illustrated in FIG. 2 may differ from the illustrated illustrative example. As an example, a storage device in data processing system 200 is any hardware apparatus that may store data. Memory 206, persistent storage 208, and computer readable medium 218 are examples of storage devices in a tangible form.

[0024] In another example, a bus system may be used to implement communications fabric 202 and may be comprised of one or more buses, such as a system bus or an input / output bus. Of course, the bus system may be implemented using any suitable type of architecture that provides for a transfer of data between different components or devices attached to the bus system. Further, a communications unit may include one or more devices used for transmitting and receiving data, such as a modem or a network adapter. Further, a memory may be, for example, memory 206 or a cache such as found in interfaces and memory controller hubs that may be present in communications fabric 202.

[0025] Computer program code for carrying out the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java(R)(TM), Smalltalk(R), C++, C#, Objective-C, and traditional procedural programming languages. The program code may run entirely on the user's computer, as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or a connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider).

[0026] Those skilled in the art will appreciate that the hardware in Figures 1-2 may vary depending on the implementation. Other internal hardware or peripheral devices, such as flash memory, equivalent non-volatile memory, optical disk drives, etc., may be used in addition to or in place of the hardware depicted in Figures 1-2. Additionally, the processes of the illustrative embodiments may be applied to multiprocessor data processing systems other than the SMP systems discussed above without departing from the scope of the disclosed subject matter.

[0027] As will be appreciated, the techniques described herein may operate with a standard client-server paradigm as shown in FIG. 1, where a client machine communicates with an Internet-accessible web-based portal running on a set of one or more machines. End users operate Internet-enabled devices (e.g., desktop computers, notebook computers, Internet-enabled mobile devices, etc.) that can access and interact with the portal. Typically, each client or server machine is a data processing system as shown in FIG. 2, including hardware and software, and such entities communicate with each other over a network, such as the Internet, an intranet, an extranet, a private network, or any other communications medium or link. A data processing system typically includes one or more processors, an operating system, one or more applications, and one or more utilities. Applications on the data processing system provide native support for web services, including, but not limited to, support for HTTP, SOAP, XML, WSDL, UDDI, and WSFL, among others. Information about SOAP, WSDL, UDDI, and WSFL is available from the World Wide Web Consortium (W3C), which develops and maintains these standards, and more information about HTTP and XML is available from the Internet Engineering Task Force (IETF). Familiarity with these standards is assumed.

[0028] Cloud Computing Model An emerging information technology (IT) delivery model is cloud computing, whereby shared resources, software, and information are provided on demand to computers and other devices over the Internet. Cloud computing can significantly reduce IT costs and complexity while improving workload optimization and service delivery. Using this approach, application instances can be hosted and made available from Internet-based resources that are accessible through a conventional web browser over HTTP. An exemplary application can be one that provides a common set of messaging capabilities such as email, calendar, contact management, and instant messaging. Users would then access the service directly over the Internet. Using this service, enterprises would place their corporate email, calendar, or collaborative infrastructure in the cloud, and end users would use an appropriate client to access their email or perform calendar operations.

[0029] Cloud computing resources are typically housed within large server farms that run one or more network applications, usually using a virtualization architecture, where the applications run inside virtual servers, or so-called "virtual machines" (VMs), that are mapped onto physical servers in a data center facility. Virtual machines typically run on top of a hypervisor, a control program that allocates physical resources to virtual machines.

[0030] Cloud Computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models, all as more specifically described and defined in "Draft NIST Working Definition of Cloud Computing" by Peter Mell and Tim Grance, October 7, 2009.

[0031] Specifically, the following are typical characteristics:

[0032] On-Demand Self-Service: Cloud consumers may unilaterally provision computing capacity, such as server time or network storage, automatically as needed, without the need for human interaction with the provider of the service.

[0033] Pervasive Network Access: Functionality is available over the network and is accessed through standard mechanisms that facilitate use by heterogeneous thin- or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0034] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. There is some location independence in that consumers generally have no control or knowledge of the exact location of the resources provided, but may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0035] Rapid Elasticity: Capabilities can be rapidly and elastically provisioned, in some cases automatically, to scale out quickly, release quickly and scale in quickly. To the consumer, the capabilities available for provisioning often appear to be unlimited, with any amount available to be purchased at any time.

[0036] Metering Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0037] The service model is typically as follows:

[0038] Software as a Service (SaaS): The functionality provided to the consumer is the use of the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0039] Platform as a Service (PaaS): The functionality offered to the consumer is the deployment of applications created or acquired by the consumer, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the applications deployed and, in some cases, the application hosting environment configuration.

[0040] Infrastructure as a Service (IaaS): The functionality provided to the consumer is the provisioning of processing, storage, network, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, applications being deployed, and possibly limited control over selected networking components (e.g., host firewalls).

[0041] The deployment model is typically as follows:

[0042] Private Cloud: The cloud infrastructure is operated solely for the organization. The cloud infrastructure can be managed by the organization or a third party and can exist on-premise or off-premise.

[0043] Community Cloud: The cloud infrastructure is shared by several organizations to support a particular community with shared concerns (e.g., mission, security requirements, policy, and compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may exist on-premise or off-premise.

[0044] Public Cloud: The cloud infrastructure is made available to the general public or large industry groups and is owned by an organization that sells cloud services.

[0045] Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are tied together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0046] A cloud computing environment is a service oriented approach that focuses on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes. A representative cloud computing node is shown in FIG. 2 above. Specifically, in a cloud computing node, there is a computer system / server that is operable with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with a computer system / server include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices. A computer system / server may be described in the general context of computer system executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. A computer system / server may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0047] Referring now to Figure 3, by way of additional background, a set of functional abstraction layers provided by a cloud computing environment is illustrated. It should be understood in advance that the components, layers, and functions illustrated in Figure 3 are merely exemplary, and embodiments of the present invention are not limited thereto. As illustrated, the following layers and corresponding functions are provided:

[0048] The hardware and software layer 300 includes hardware components and software components. Examples of hardware components include mainframes, such as IBM® zSeries® systems, RISC (reduced instruction set computer) architecture-based servers, such as IBM pSeries® systems, IBM xSeries® systems, and IBM BladeCenter® systems, storage devices, networks, and networking components. Examples of software components include network application server software, such as IBM WebSphere® application server software, and database software, such as IBM DB2® database software (IBM zSeries, pSeries, xSeries, BladeCenter, WebSphere, and DB2 are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide).

[0049] The virtualization layer 302 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers, virtual storage, virtual networks including virtual private networks, virtual applications and operating systems, and virtual clients.

[0050] As an example, the management layer 304 may provide the functionality described below: Resource provisioning provides dynamic procurement of computing and other resources utilized to perform tasks within the cloud computing environment. Metering and pricing provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of such resources. As an example, such resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides cloud computing resource allocation and management such that required service levels are met. Service level agreement (SLA) planning and fulfillment provides proactive coordination and procurement of cloud computing resources in anticipation of future needs in accordance with SLAs.

[0051] The workload layer 306 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation, software development and lifecycle management, virtual classroom education delivery, data analytics processing, transaction processing, enterprise-specific functions in a private cloud, and, according to this disclosure, techniques for privacy-preserving homomorphic inference on homomorphically encrypted data 308.

[0052] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the disclosed technology can be implemented in conjunction with any other type of computing environment now known or later developed. These include standalone computing environments (e.g., on-premise desktop machines), client-server based architectures, and the like.

[0053] Thus, a representative cloud computing environment has a set of high-level functional components including a front-end identity manager, a business support services (BSS) functional component, an operational support services (OSS) functional component, and a computational cloud component. The identity manager is responsible for interfacing with requesting clients to provide identity management, and this component may be implemented with one or more well-known systems, such as Tivoli Federated Identity Manager (TFIM) available from IBM Corporation, Armonk, NY. In an appropriate environment, TFIM may be used to provide federated single sign-on (F-SSO) to other cloud components. The business support services component provides some administrative functions, such as billing support. The operational support services component is used to provide provisioning and management of other cloud components, such as virtual machine (VM) instances. The cloud components represent the main computational resources, which are typically multiple virtual machine instances used to run target applications that are made available for access via the cloud. One or more databases are used to store directories, logs, and other working data. Although all of these components (including the front-end identity manager) are located "in" the cloud, this is not a requirement. In alternative embodiments, the identity manager may operate outside the cloud. The service provider may also operate outside the cloud.

[0054] Some clouds are based on non-traditional IP networks. Thus, for example, a cloud may be based on a two-layer CLOS-based network with special single-layer IP routing that uses a hash of MAC addresses. The techniques described herein may be used in such non-traditional clouds.

[0055] Generalized, a cloud computing infrastructure provides a virtual machine hosting environment that comprises host machines (e.g., servers or similar physical machine computing devices) connected through a network and one or more management servers. Typically, each physical server is adapted to dynamically host one or more virtual machines using virtualization technologies such as VMware ESX / ESXi. Multiple VMs may be deployed within a single host machine and share the host machine's CPU, memory, and other resources, thereby improving utilization of an organization's data center. Among other tasks, the management servers monitor the infrastructure and automatically manipulate VM placement as needed, for example, by moving virtual machines between hosts.

[0056] In a non-limiting implementation, a representative platform technology is, but is not limited to, IBM System x(R) Server with VMware vSphere 4.1 Update 1 and 5.0.

[0057] The aforementioned commercially available implementations are not intended to be limiting, but rather merely representative embodiments of client applications supported within a cloud computing environment that interact with a cognitive service.

[0058] homomorphic encryption Homomorphic encryption (HE) is a form of encryption that allows for performing computations on ciphertext, thus producing an encrypted result that, when decrypted, matches the result of the operation performed on the plaintext. A homomorphic encryption scheme is a cryptosystem that allows for performing computations on data without decrypting the data. Homomorphic encryption allows for the construction of programs for any desired function, which may be executed on encrypted inputs to produce the resulting encryption. Since such programs never need to decrypt their inputs, they may be executed by untrusted parties without revealing their inputs and internal state. Homomorphic encryption may be partially homomorphic, somewhat homomorphic, or fully homomorphic. Partially homomorphic encryption (PHE) schemes are homomorphic with respect to only one type of operation, e.g., addition or multiplication. Somewhat homomorphic encryption (SWHE) supports homomorphic operations with respect to multiple operations, e.g., addition and multiplication, but not with respect to all operations. Fully homomorphic encryption (FHE) supports an unlimited number of homomorphic operations on ciphertext, and is stronger than PHE and SWHE. Toolkits for implementing homomorphic encryption are known. One well-known toolkit is HElib, an open source project that implements stochastic gradient descent (SGD)-based training of neural networks. Current versions of HElib support addition and multiplication operations of any number of binary representations, using encryption of individual bits.

[0059] Exemplary HE protocol implementations may be based on one or more cryptographic protocols, including, but not limited to, unpadded RSA, EL-Gamal, Benaloh, Paillier, and others. As will be explained, the techniques of this disclosure do not require any particular HE implementation.

[0060] Machine learning-as-a-service using homomorphic encryption Referring now to FIG. 4, a basic operating environment for the technology herein is shown. As shown, in a typical ML as a service scenario, a trained model 400 is hosted on a cloud server 402 in a cloud computing infrastructure 404 as described above. The trained model 400 may be exposed as an application programming interface (API) on the cloud 404. In operation, as a service, the hosting cloud server 402 allows users to perform inference queries on the model 400. Typically, a user is associated with a client machine 406, and the client and server are configured to operate according to the client-server model described above. A homomorphic encryption (HE) protocol is implemented across the client-server operating environment, whereby the cloud protects the privacy of the model and the user (client) maintains the privacy of the scoring data points returned by the model. In a typical request-response workflow, the client 406 sends an encrypted query 408 (e.g., data points) to the cloud server 402, which applies the model and then returns a response 410. The response includes the encrypted inference result. In this manner, the privacy-preserving inference problem is evaluated securely.

[0061] While the above techniques work well to preserve the respective privacy concerns of both the requesting user and the cloud provider hosting the model, this type of inference is computationally inefficient for decision tree-based models.

[0062] Decision Tree-Based Inference on Homomorphically Encrypted Data Without Bootstrapping With the above as background, the techniques of this disclosure will now be described. As previously mentioned, HE-based inference is inefficient when the model of interest is a decision tree (or a collection of decision trees). To address this inefficiency, instead of performing homomorphic inference on the DT model itself, the techniques herein use a specially trained neural network (NN) in place of the DT model, and homomorphic inference is then performed on the neural network. In this way, the neural network is a surrogate or proxy for the DT model, and the computational inefficiencies (i.e., non-binding branch computations) typically faced by inferring against a DT model are avoided.

[0063] To this end, according to the present disclosure, a neural network is trained to learn the decision boundaries of the DT trees (or the decision boundaries of each such tree is a collection of trees to be modeled). Preferably, this operation is performed in the clear (in plain text) by the DT model owner, and the training is performed without using the original data training points used for the DT model itself. In this training phase, a random data set - but whose distribution characteristics match the original training data (for the trees) - is applied to the DT and its expected output (from applying the tree) is obtained. This random data set and its expected output are then used to train a neural network, so that the output of the neural network matches the expected output from applying the original data set to the DT. Preferably, the neural network has a low depth (e.g., less than about three layers), although it is not a requirement to use a specific number of layers. The concept of a neural network having a low depth is sometimes referred to herein as "shallow". After this type of neural network is trained, inference is performed on the shallow neural network instead of inferring directly on the DT. Thus, in the context of Figure 4, the "trained model" 400 is not a decision tree (or a collection of decision trees), but is in fact a shallow neural network. HE-based inference on NNs is much more computationally efficient and is performed without the need for bootstrapping.

[0064] FIG. 5 illustrates a basic technique of the present disclosure for constructing and training a shallow neural network to be used as a proxy or surrogate for a decision tree (or collection of trees) of interest. As shown, a trained decision tree 500 represents the model of interest. The trained decision tree 500 is trained on a data set, which may be referred to herein as the original data set. More formally, the model is a trained decision tree regression model DT on a data set D. The output is also shown, which is a "shallow" neural network 502 that learns the decision boundary of DT, preferably in the following manner: In a first step, a random training data set D' is computed. The random training set has regions similar to D, e.g., the minimum and maximum feature values ​​for D and D' are close. More generally, the decision tree 500 is annotated with relevant training data statistics (by being pre-trained) along with the original data set D. The training data statistics may vary, but typically may include minimum and maximum values ​​for each feature, mean, variance, etc. The specific nature and type of the training data statistics may vary, and we assume that a data generator (described below) is available to randomly generate a data set D' using the annotated training data statistics. In a second step, the data set D' is applied to the decision tree. Preferably, this decision tree inference on D' is performed in plain text (i.e., in the clear), resulting in a corresponding regression output

number

number

[0065] Thus, according to the described technique, a shallow neural network (NN) is trained to learn the decision boundaries of the tree. Preferably, this training is done by the model owner in the clear and without using the original training data points. In this way, a homomorphic evaluation of the tree is then approximated by performing homomorphic inference on the neural network. This evaluation is very efficient since the network is preferably shallow (e.g., input layer, output layer, and two hidden layers) and can be done without bootstrapping. In this way, the technique avoids the impossible branch calculations that would otherwise be required if HE inference were required on non-linear comparisons within the decision tree itself. As a by-product, the scaling issues associated with inference on the decision tree itself are also overcome since no scaling is required.

[0066] FIG. 6 illustrates a block diagram of an exemplary computing system implementing the aforementioned functionality. In a typical implementation, these components are implemented as computer software running, for example, on one or more processors (whether physical or virtual) in a cloud computing infrastructure. As illustrated, the system 600 includes a data generator 602, a non-private decision tree evaluator 604, a network designer 606, a network trainer 608, a network encryptor 610, and a private evaluator 612. One or more of these components may be combined with each other, and the terms identified above are not intended to be limiting. The data generator 602 has the primary function of randomly generating a random data set D' using annotated training data statistics from an original data set used to pre-train the decision tree. The non-private decision tree evaluator 604 calculates a predicted output for the random data set for the decision tree (or for each decision tree in a collection of such trees). The network designer 606 builds a neural network N for the decision tree (or a NN for each decision tree in the ensemble model). The network trainer 608 trains a network of randomly generated data sets and corresponding expected outputs.

number

[0067] Without intending to be limiting, preferably a shallow neural network is trained in the clear on randomly generated data to learn the decision boundaries of the decision trees in question. HE inference on two hidden layers N is one representative but non-limiting embodiment, as such inference is efficiently performed using HElib, again without the need for bootstrapping. Experimental analysis shows that on a sample regression data set, HE inference error is within 2-3% of its non-private counterpart, and the amortized runtime is in the range of 50-300 milliseconds per point, depending on the number of decision trees in the ensemble and the complexity of the NN used.

[0068] FIG. 7 illustrates an exemplary embodiment of a decision tree-based model in an ensemble of decision trees. The ensemble decision tree-based regressors can be of various well-known types, including but not limited to adaptive boosted regressors, random forest regressors, and gradient boosted regressors. In this embodiment, there is a ensemble of trees 700, each with an associated shallow neural network 702, as previously described. More formally, there is a set of trained trees E dt =(DT 1 ,D.T. 2 ,...,DT k ), using a single tree approach (DT 1 ,D.T. 2 ,...,DT k ) to obtain a set of neural nets with output E nn =(N 1 ,N 2 ,...,N k ), for example for gradient boosting, the inference is given as an aggregation over the individual tree inferences: Enc(E dt )(Enc(x))≒Enc(E nn )(Enc(x))=Σ jは[k]の要素 Enc(N j )(Enc(x)). The above formula is not intended to be a general solution, as different enumeration methods aggregate different properties, e.g., adaptive boosting (median), random forest (mean), etc.

[0069] The disclosed techniques provide significant advantages. As previously discussed, the techniques herein provide a way to provide privacy-preserving inference on pre-trained decision trees (specifically, ensemble decision tree-based regression models), but in a computationally efficient manner. The techniques leverage the concept of training a shallow neural network that learns the decision boundaries of the trees, and then homomorphic evaluation of the trees is approximated by instead performing homomorphic inference on the neural network. Because HE inference on neural networks is efficient, the techniques herein do not require bootstrapping.

[0070] Preferably, the aforementioned techniques assume the availability of the full training data, but this is not a requirement, since the techniques may also be implemented in use cases where the decision model is already available without the full training data, or where limited training data is available. The decision tree may be pre-existing, available, or accessible from another source. As mentioned before, the training data used to train the original decision tree may not be available (in whole or in part). The task of creating a data set for training a neural network should address these different scenarios. Absolute randomness is counterproductive and inefficient. A large proportion of the resulting labels may be negative (and therefore not useful). To limit this, as mentioned before, the synthetic data set used for NN training should mimic the original data distribution. In general, a first order approximation to the distribution is based on the mean and variance of the original data. Also as mentioned before, similar other statistics (e.g., minimum, maximum) are another minimal descriptor of the original training data to guide the generation of synthetic data at least within the range of the features expected by the decision tree. Without being limited to the above, any other statistical technique that produces meaningful labels in the process may also be used.

[0071] As discussed above, a computing system implementing the technique is typically implemented in software, e.g., as a set of computer program instructions executed by one or more hardware processors. A particular tool or component within the system may include any number of programs, processes, threads of execution, etc., along with appropriate interfaces and databases to support data used or created by the tool or component. A tool or component may be configured or managed via a command line, with a web-based front end, etc. A tool or component may be programmatically implemented or include one or more functions that interoperate with other computing entities or software systems via an application programming interface (API) or any convenient request-response protocol.

[0072] Any reference herein to one or more commercially available products or services is exemplary and should not be understood as limiting the disclosed technology, which may be implemented on any system, device, appliance (or more generally, machine) having the general characteristics and operational capabilities described.

[0073] As noted above, one preferred implementation of the subject matter is as-a-service, although this is not a limitation either. The HE-based inference may be implemented entirely on-premise or in a standalone operating environment. As noted above, without limitation, the subject matter may be implemented in or in connection with a cloud deployment platform system or appliance, or using any other type of deployment system, product, device, program, or process. As noted above, models for building or inferring system functionality may be provided as standalone functionality or may leverage functionality from other products and services.

[0074] Exemplary cloud application platforms with which the technology may be implemented include, but are not limited to, any cloud-supported application framework, product, or service.

[0075] Generalizing, the techniques herein may be implemented as a management solution, service, product, appliance, device, process, program, thread of execution, etc. Typically, the techniques are implemented in software, as one or more computer programs executing on hardware processing elements, in conjunction with data stored in one or more data sources, such as a problem database. Some or all of the described processing steps may be automated and operate autonomously in conjunction with other systems. Automation may be complete or partial, and operation may be (in whole or in part) synchronous or asynchronous, on-demand, or in other manners.

[0076] These aforementioned components are typically each implemented as software, i.e., as a set of computer program instructions executed on one or more hardware processors. Although the components are illustrated as separate, this is not a requirement, as the components may also be integrated in whole or in part with one another. One or more of the components may execute in a dedicated location or remotely from one another. One or more of the components may have subcomponents that execute together to provide functionality. There is no requirement that the specific functionality of the generator service be performed by a specific component as named above, as the functionality herein (or any aspect thereof) may be implemented in other systems.

[0077] The tools and response capabilities may interact or interoperate with security analysis systems or services.

[0078] As mentioned above, the functions described above may be implemented in a stand-alone manner, e.g., as one or more software-based functions executed by one or more hardware processors, or may be available as management services (including web services via a SOAP / XML interface). The specific hardware and software implementation details described herein are for illustration purposes only and are not meant to limit the scope of the described subject matter.

[0079] More generally, each computing device within the context of the disclosed subject matter is a data processing system (as shown in FIG. 2) including hardware and software, and such entities communicate with each other over a network, such as the Internet, an intranet, an extranet, a private network, or any other communication medium or link. Applications on the data processing systems provide native support for web and other well-known services and protocol services, including, but not limited to, support for HTTP, FTP, SMTP, SOAP, XML, WSDL, UDDI, and WSFL, among others. Information about SOAP, WSDL, UDDI, and WSFL is available from the World Wide Web Consortium (W3C), which is responsible for developing and maintaining such standards, and more information about HTTP, FTP, SMTP, and XML is available from the Internet Engineering Task Force (IETF).

[0080] As mentioned above, in addition to cloud-based environments, the techniques described herein may be implemented within or in conjunction with a variety of server-side architectures, including simple n-tier architectures, web portals, federation systems, and the like.

[0081] More generally, the subject matter described herein may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment including both hardware and software elements. In a preferred embodiment, the sensitive data detection service (or any components thereof) is implemented in software, which software includes, but is not limited to, firmware, resident software, microcode, and the like. Furthermore, the download and deletion interface and functionality may take the form of a computer program product accessible from a computer usable or computer readable medium that provides program code for use by or in connection with a computer or any instruction execution system. In this description, a computer usable or computer readable medium may be any apparatus that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The medium may be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device). Examples of computer readable media include semiconductor or solid state memory, magnetic tape, removable computer diskettes, random access memory (RAM), read-only memory (ROM), rigid magnetic disks, and optical disks. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read / write (CD-R / W), and DVD. A computer-readable medium is a tangible, non-transitory item.

[0082] A computer program product may be a product having program instructions (or program code) for implementing one or more of the described functions. Such instructions or code may be stored in a computer readable storage medium in a data processing system after being downloaded over a network from a remote data processing system. Alternatively, such instructions or code may be stored in a computer readable storage medium in a server data processing system and adapted to be downloaded over a network to a remote data processing system for use in the computer readable storage medium in the remote system.

[0083] In an exemplary embodiment, the techniques are implemented in software executed by a dedicated computing platform, preferably one or more processors. The software may be maintained in one or more data stores or memories associated with the one or more processors, and the software may be implemented as one or more computer programs. Collectively, this dedicated hardware and software includes the functionality described above.

[0084] While the above describes particular orders of operations performed by some embodiments of the invention, it should be understood that such orders are exemplary, as alternative embodiments may perform operations in different orders, combine some operations, overlap some operations, etc. Reference herein to a given embodiment may indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes a particular feature, structure, or characteristic.

[0085] Finally, although certain components of the system have been described separately, those skilled in the art will appreciate that some of the functionality may be combined or shared among given instructions, program sequences, code portions, etc.

[0086] Furthermore, FHE is merely an exemplary cryptographic protocol and is not intended to be limiting.

[0087] Additionally, while inference is preferably performed using the HE protocol, the techniques herein that use surrogate neural networks instead of the actual decision trees themselves (for model evaluation) can be leveraged with other multi-party secure computation techniques, as well as with any privacy of test points, models, or both that is desired to be preserved.

[0088] The technology herein provides improvements to other technologies or technical areas, namely HE-based reasoning tools and systems and cloud-based systems that incorporate or expose such technology, as well as improvements to the computational efficiency of HE systems and methods.

[0089] The particular use case or application in which a decision tree is used is not a limitation of this disclosure.

Claims

1. 1. A computer-implemented method for privacy-preserving homomorphic inference for decision tree-based models, comprising: training a neural network model to learn one or more decision boundaries of the decision tree, the neural network model having a depth of less than three layers and trained without requiring access to an original data set used to train the decision tree; performing homomorphic inference on the less than three layer neural network model instead of the decision tree; 23. A computer-implemented method comprising:

2. Training the neural network model includes: applying a random data set to the decision tree, the random data set matching distribution characteristics of the original data set and obtaining a corresponding regression output from applying the random data set; training the neural network model using the random data set and the regression output; 2. The method of claim 1, wherein after training, outputs from a trained neural network model closely match outputs expected from applying the original data set to the decision tree.

3. The method of claim 2 , wherein the distribution characteristics include training statistics.

4. The method of claim 3, wherein the training statistics is one of a minimum and maximum value, and a feature-wise mean and variance.

5. The method of claim 1 , wherein the decision tree-based model is a collection of decision trees.

6. The method of claim 5 , wherein the set is one of adaptive boosting regressors, random forest regressors, and gradient boosting regressors.

7. The homomorphic inference is encrypting the neural network model with a client's public key; hosting the encrypted neural network model in a cloud computing environment; receiving an encrypted inference query from the client; applying an encrypted neural network model to the encrypted inference query without decrypting the encrypted inference query; returning an encryption result to the client; The method of any one of claims 1 to 6, comprising:

8. A device A processor; and a computer memory holding computer program instructions for execution by the processor, the computer program instructions configured to provide privacy-preserving homomorphic inference for decision tree-based models, the computer program instructions comprising: training a neural network model to learn one or more decision boundaries of the decision tree, the neural network model having a depth of less than three layers and trained without requiring access to an original data set used to train the decision tree; performing homomorphic inference on the less than three layer deep neural network model instead of the decision tree; the computer memory configured to An apparatus comprising:

9. A program for causing a processor to execute the method according to any one of claims 1 to 6.

10. A method of machine learning-as-a-service from a cloud computing infrastructure, comprising: providing a neural network, the neural network constructed as a proxy to a decision tree based regression model, the neural network being trained using a dataset along with corresponding predicted outputs generated from applying the dataset to the regression model, the dataset being bounded by one or more distributional characteristics associated with training data; encrypting said neural network with a client's public key; in response to receiving an encrypted inference query, applying the neural network to the encrypted inference query to generate an encrypted response without decrypting the encrypted inference query; returning the encrypted response to the client. The method includes:

11. The method of claim 10 , wherein the decision tree-based regression model is a collection of decision trees.

12. The method of claim 11 , wherein the set is one of adaptive boosting regressors, random forest regressors, and gradient boosting regressors.

13. 11. The method of claim 10, wherein the neural network is a shallow neural network having an input layer, an output layer, and no more than three hidden layers.

Images