Input Privacy Research Articles

Privacy-preserving fair outsourcing polynomial computation without FHE and FPR

With the development of cloud computing, verifiable outsourcing computation (VC) has received much more attention. The polynomial is a fundamental mathematical function with widespread applications. Plenty of VC schemes for polynomials have been proposed recently. However, most previous schemes focus on ensuring that the client can get a valid result returned by the cloud service provide (CSP) before payment, while often ignoring the CSP’s interest. To the best of our knowledge, Guan et al. (2021) proposed a pioneering framework for building fair outsourcing polynomial computation, which serves as the state of the art. However, it discloses the privacy of outsourced polynomials, inputs, and outputs. Furthermore, it suffers from a false positive rate (FPR) in the verification phase due to the sampling technique. As a result, it breaks the fairness between the client and the CSP.To solve these problems, we propose a privacy-preserving fair outsourcing polynomial computation without FPR. To avoid expensive Fully Homomorphic Encryption (FHE), we utilize Paillier encryption and blind technique to ensure privacy. Our proposed scheme can guarantee fairness with an overwhelming probability by applying the SGX technique. The comprehensive performance evaluation and extensive simulations show that our protocol is more practical in cloud computing.

Privacy-Preserving Membership Queries for Federated Anomaly Detection

In this work, we propose a new privacy-preserving membership query protocol that lets a centralized entity privately query datasets held by one or more other parties to check if they contain a given element. This protocol, based on elliptic curve-based ElGamal and oblivious key-value stores, ensures that those 'data-augmenting' parties only have to send their encrypted data to the centralized entity once, making the protocol particularly efficient when the centralized entity repeatedly queries the same sets of data. We apply this protocol to detect anomalies in cross-silo federations. Data anomalies across such cross-silo federations are challenging to detect because (1) the centralized entities have little knowledge of the actual users, (2) the data-augmenting entities do not have a global view of the system, and (3) privacy concerns and regulations prevent pooling all the data. Our protocol allows for anomaly detection even in strongly separated distributed systems while protecting users' privacy. Specifically, we propose a cross-silo federated architecture in which a centralized entity (the backbone) has labeled data to train a machine learning model for detecting anomalous instances. The other entities in the federation are data-augmenting clients (the user-facing entities) who collaborate with the centralized entity to extract feature values to improve the utility of the model. These feature values are computed using our privacy-preserving membership query protocol. The model can be trained with an off-the-shelf machine learning algorithm that provides differential privacy to prevent it from memorizing instances from the training data, thereby providing output privacy. However, it is not straightforward to also efficiently provide input privacy, which ensures that none of the entities in the federation ever see the data of other entities in an unencrypted form. We demonstrate the effectiveness of our approach in the financial domain, motivated by the PETs Prize Challenge, which is a collaborative effort between the US and UK governments to combat international fraudulent transactions. We show that the private queries significantly increase the precision and recall of the otherwise centralized system and argue that this improvement translates to other use cases as well.

Secure and Verifiable Data Collaboration with Low-Cost Zero-Knowledge Proofs

Federated Learning (FL) emerges as a viable solution to facilitate data collaboration, enabling multiple clients to collaboratively train a machine learning (ML) model under the supervision of a central server while ensuring the confidentiality of their raw data. However, existing studies have unveiled two main risks: (i) the potential for the server to infer sensitive information from the client's uploaded updates (i.e., model gradients), compromising client input privacy, and (ii) the risk of malicious clients uploading malformed updates to poison the FL model, compromising input integrity. Recent works utilize secure aggregation with zero-knowledge proofs (ZKP) to guarantee input privacy and integrity in FL. Nevertheless, they suffer from extremely low efficiency and, thus, are impractical for real deployment. In this paper, we propose a novel and highly efficient approach RiseFL for secure and verifiable data collaboration, ensuring input privacy and integrity simultaneously. Firstly, we devise a probabilistic integrity check method that transforms strict checks into a hypothesis test problem, offering great optimization opportunities. Secondly, we introduce a hybrid commitment scheme to satisfy Byzantine robustness with improved performance. Thirdly, we present an optimized ZKP generation and verification technique that significantly reduces the ZKP cost based on probabilistic integrity checks. Furthermore, we theoretically prove the security guarantee of RiseFL and provide a cost analysis compared to state-of-the-art baselines. Extensive experiments on synthetic and real-world datasets suggest that our approach is effective and highly efficient in both client computation and communication. For instance, RiseFL is up to 28x, 53x, and 164x faster than baselines ACORN, RoFL, and EIFFeL for the client computation.

CRS: A Privacy-Preserving Two-Layered Distributed Machine Learning Framework for IoV

Nowadays, vehicles can provide many valuable data (such as the videos recorded by dashcams) for analytical model building. Integrating vehicular ad-hoc networks with Internet of Things (IoT), Internet of Vehicles (IoV) has a promising future. In IoV, vehicles maintain their own communication, computing, and learning capabilities. Thus, instead of sending the data to a central server for model training, which leads to a high communication overhead, vehicles can train the data locally. However, it is still a challenge to preserve the privacy while keeping both the communication and computation overheads of vehicles acceptable. In this paper, we present a distributed machine learning framework with a two-layered architecture. The architecture uniquely involves vehicle clusters, road-side units, and a central server, which provides a basic guarantee to the vehicle privacy and also limits the overhead. By carefully adopting cryptographic tools and techniques, the framework has the following properties: 1) it preserves the privacy of the local inputs and model weight vectors to all parties; 2) it protects the identities and trajectories of vehicles; 3) packet loss is handled in the application layer; 4) the evaluation shows that it is lightweight for vehicles. Compared with other existing works, the proposed framework is more suitable for IoV.

Lightweight Privacy-Preserving Distributed Recommender System Using Tag-Based Multikey Fully Homomorphic Data Encapsulation

Recommender systems facilitate personalized service provision through the statistical analysis and model training of user historical data (e.g. user profile based on keyword searches, browsing behavior, travel history, etc). To address the underpinning privacy implications associated with such systems, a number of privacy-preserving recommendation approaches have been presented in the literature. There are, however, limitations in many of these approaches. For example, approaches that apply public key (fully) homomorphic encryption (FHE) on different users' historical rating records under a unique public key (i.e. the public key of a predefined target user requesting recommendation) incur significant computational overheads on resource-constrained local users and may not be scalable. On the other hand, approaches without utilizing public key FHE can neither resist chosen ciphertext attack (CCA), nor be straightforwardly applied to the setting of distributed servers. In this paper, a lightweight privacy-preserving distributed recommender system is proposed. Specifically, we present a new cryptographic primitive (i.e. tag-based multikey fully homomorphic data encapsulation mechanism; TMFH-DEM) designed to achieve CCA security for both input privacy and result privacy. TMFH-DEM enables a set of distributed servers to collaboratively execute efficient privacy-preserving outsourced computation on multiple inputs encrypted under different secret keys from different data owners, without using public key FHE. The authorized receiver can successfully decrypt the plaintext of the function evaluation result. Building on TMFH-DEM, we propose a lightweight privacy-preserving distributed recommender system, which flexibly returns all the recommended items with certain predicted ratings for all target users. Formal security proof shows that our proposal achieves both user historical rating data privacy and recommendation result privacy. Findings from our evaluations demonstrate its practicability in terms of scalability, recommendation accuracy, computational and communication efficiency.

A Secure and Efficient Framework for Outsourcing Large-scale Matrix Determinant and Linear Equations

Large-scale matrix determinants and linear equations are two basic computational tools in science and engineering fields. However, it is difficult for a resource-constrained client to solve large-scale computational tasks. Cloud computing service provides additional computing resources for resource-constrained clients. To solve the problem of large-scale computation, in this article, a secure and efficient framework is proposed to outsource large-scale matrix determinants and linear equations to a cloud. Specifically, the proposed framework contains two protocols, which solve large-scale matrix determinant and linear equations, respectively. In the outsourcing protocols of large-scale matrix determinants and linear equations, the task matrix is encrypted and sent to the cloud by the client. The encrypted task matrix is directly computed by using LU factorization in the cloud. The computed result is returned and verified by the cloud and the client, respectively. The computed result is decrypted if it passes the verification. Otherwise, it is returned to the cloud for recalculation. The framework can protect the input privacy and output privacy of the client. The framework also can guarantee the correctness of the result and reduce the local computational complexity. Furthermore, the experimental results show that the framework can save more than 70% of computing resources after outsourcing computing. Thus, this article provides a secure and efficient alternative for solving large-scale computational tasks.

PowerGAN: A Machine Learning Approach for Power Side‐Channel Attack on Compute‐in‐Memory Accelerators

Analog compute‐in‐memory (CIM) systems are promising candidates for deep neural network (DNN) inference acceleration. However, as the use of DNNs expands, protecting user input privacy has become increasingly important. Herein, a potential security vulnerability is identified wherein an adversary can reconstruct the user's private input data from a power side‐channel attack even without knowledge of the stored DNN model. An attack approach using a generative adversarial network is developed to achieve high‐quality data reconstruction from power leakage measurements. The analyses show that the attack methodology is effective in reconstructing user input data from power leakage of the analog CIM accelerator, even at large noise levels and after countermeasures. To demonstrate the efficacy of the proposed approach, an example of CIM inference of U‐Net for brain tumor detection is attacked, and the original magnetic resonance imaging medical images can be successfully reconstructed even at a noise level of 20% standard deviation of the maximum power signal value. This study highlights a potential security vulnerability in emerging analog CIM accelerators and raises awareness of needed safety features to protect user privacy in such systems.

Protecting Function Privacy and Input Privacy in the Publicly Verifiable Outsourcing Computation of Polynomial Functions

With the prevalence of cloud computing, the outsourcing of computation has gained significant attention. Clients with limited computing power often outsource complex computing tasks to the cloud to save on computing resources and costs. In outsourcing the computation of functions, a function owner delegates a cloud server to perform the function’s computation on the input received from the user. There are three primary security concerns associated with this process: protecting function privacy for the function owner, protecting input privacy for the user and guaranteeing that the cloud server performs the computation correctly. Existing works have only addressed privately verifiable outsourcing computation with privacy or publicly verifiable outsourcing computation without input privacy or function privacy. By using the technologies of homomorphic encryption, proxy re-encryption and verifiable computation, we propose the first publicly verifiable outsourcing computation scheme that achieves both input privacy and function privacy for matrix functions, which can be extended to arbitrary multivariate polynomial functions. We additionally provide a faster privately verifiable method. Moreover, the function owner retains control over the function.

Secure Aggregation is Insecure: Category Inference Attack on Federated Learning

Federated learning allows a large number of resource-constrained clients to train a globally-shared model together without sharing local data. These clients usually have only a few classes (categories) of data for training, where the data distribution is non-iid (not independent identically distributed). In this article, we put forward the concept of <i>category privacy</i> for the first time to indicate <i>which classes of data a client has</i> , which is an important but ignored privacy goal in the federated learning with non-iid data. Although secure aggregation protocols are designed for federated learning to protect the input privacy of clients, we perform the first systematic study on <i>category inference attack</i> and demonstrate that these protocols cannot fully protect category privacy. We design a differential selection strategy and two de-noising approaches to achieve the attack goal successfully. In our evaluation, we apply the attack to non-iid federated learning settings with various datasets. On MNIST, CIFAR-10, AG_news, and DBPedia dataset, our attack achieves <inline-formula><tex-math notation="LaTeX">$&gt;90\%$</tex-math></inline-formula> accuracy measured in F1-score in most cases. We further consider a possible detection method and propose two strategies to make the attack more inconspicuous.

PriRepVGG: Privacy-Preserving 3-Party Inference Framework for Image-Based Defect Detection

Image classification is widely used in industrial defect detection, medical diagnosis, social welfare, and other fields, in which privacy and security of models and data must be involved. For example, in diamond synthesis, the diamond substrate image annotation data and the defect detection model are of value for conservation. Based on ensuring inference efficiency and the security of these private data intellectual property, the 3-party secure inference based on secure multi-party computation (MPC) can be adopted. MPC allows parties to use neural networks while preserving their input privacy for collaborative computing, but it will lead to huge communication and memory consumption. This paper propose PriRepVGG, a lightweight privacy-preserving image-based defect detection framework for 3-party. In this work, firstly, This work optimized the division and added an AdaptiveAvgpool layer in MPC framework FALCON; then, This work ported the inference architecture of the RegVGG network into FALCON creatively. Our work applied PriRepVGG to the secure inference of the diamond substrates defect detection under the data server, model server, and compute server settings, which can be carried out in batches with a low misjudgment rate and verify the feasibility of image-based secure inference with a lightweight network in an industrial case under MPC.

A Verifiable Privacy-Preserving Machine Learning Prediction Scheme for Edge-Enhanced HCPSs

As a highly integrated industrial system, human cyber-physical systems (HCPSs) provide accurate and high-quality services for Industry 5.0. In HCPSs, machine learning (ML) prediction provides reliable prediction results for users based on matured models, while security and privacy protection are considerable issues. In this article, based on the modified Okamoto–Uchiyama homomorphic encryption, we propose a verifiable privacy-preserving machine learning prediction scheme for the edge-enhanced HCPSs, which outputs the verifiable prediction results for users without privacy leakage. Specifically, a batch of prediction results can be verified at one time, which improves the efficiency of verification. Security analysis shows that our scheme protects the privacy of inputs, ML model, and prediction results. The experiment results demonstrate that the edge computing architecture remarkably alleviates the computational burden of the cloud server. Furthermore, compared with other related schemes, our scheme shows the best execution efficiency, and batch verification optimizes the performance by about 15% compared with single verification on the same scale.

An Improved Outsourcing Algorithm to Solve Quadratic Congruence Equations in Internet of Things

Solving quadratic congruence equations is an expensive operation widely employed in cryptographic constructions for secure IoT applications. Recently, two outsourcing algorithms were proposed by Zhang et al. to solve quadratic congruence equations by employing Cippolla’s algorithm. It was claimed that all the inputs and outputs can be obscured in these two algorithms. However, we present two passive attacks in this paper to show that all the inputs and outputs can be recovered efficiently by just a curious server, which implies the two outsourcing algorithms are insecure. To fix them, we further propose an improved outsourcing algorithm to solve quadratic congruence equations, which is more efficient and the privacy of actual inputs and outputs can be protected very well.

Efficient Privacy-Preserving Outsourced Discrete Wavelet Transform in the Encrypted Domain

Signal processing in the encrypted domain is a potential tool to protect sensitive signals against untrusted cloud servers and malicious users in the delegated computing setting, without affecting the accuracy of signal analyzing and processing. Most existing approaches use Paillier's public key additively homomorphic encryption to encrypt each signal in a large bundle; thus, incurring significant computational costs at local, often resource-constrained, devices while guaranteeing only signal input privacy. To address these limitations, in this paper, an efficient privacy-preserving outsourced discrete wavelet transform scheme (PPDWT), comprising PPDWT-1 and PPDWT-2, without leveraging public key (fully) homomorphic encryption is proposed. Specifically, they are respectively proposed to achieve signal input privacy, coefficient privacy and discrete wavelet transform result privacy against the collusion between honest-but-curious cloud and malicious users. Both constructions leverage the offline execution of any one-way trapdoor permutation only once to encrypt batch signals, and permit signal processing in the encrypted domain. We also discuss the expanding factor, the upper bound and various extensions to privacy-preserving discrete cosine/fourier transform in the encrypted domain. Finally, our proposed PPDWT is formally proved secure under the universal composability (UC) model. We then evaluate the proposed approach using case studies to demonstrate its effectiveness and practicability.

Practical multi-party private collaborative k-means clustering

k-means clustering is widely used in many fields such as data mining, machine learning, and information retrieval. In many cases, users need to cooperate to perform k-means clustering tasks. How to perform clustering without revealing privacy has become a hot research topic. However, the existing k-means scheme based on secure multi-party computation cannot effectively protect the privacy of the output results. The multi-party k-means scheme based on differential privacy may lead to loss of data availability. In this article, we propose a practical protocol for k-means clustering in a collaborative manner, while protecting the privacy of each data record. Our protocol is the first to combine secure multi-party computing and differential privacy technology to train a privacy-preserving k-means clustering model. We design a novel algorithm, which is suitable for multi-party collaboration to update cluster centers without leaking data privacy. The algorithm guarantees that noise is added only once in each iteration, regardless of the number of participants. The protocol achieve the ”best of both worlds”, which can simultaneously achieves both the input privacy and the output privacy in the k-means clustering scheme. Evaluation of real data sets shows that our scheme has comparable running time compared with the k-means clustering scheme without privacy protection.

Lattice-based weak-key analysis on single-server outsourcing protocols of modular exponentiations and basic countermeasures

We investigate the problem of securely outsourcing the modular exponentiations in cryptography to an untrusted server, and analyze the security and the efficiency of three privacy-preserving outsourcing protocols for exponentiations proposed in Ding et al. (2017) [18]. Based on Coppersmith's lattice-based method, we present heuristic polynomial-time and ciphertext-only weak-key attacks on these protocols, which shows that the recommended size of the secret keys in their protocols can not assure the input privacy of the exponents. Correspondingly, we explicitly estimate the size of the secure secret keys to circumvent our attacks, and analyze the efficiency of the revised protocols with security settings. Our theoretical analysis and experimental results demonstrate that the protocol of single modular exponentiation is unavailable, the protocol of simultaneous modular exponentiations is not so efficient as claimed but still available, and the protocol of multiple modular exponentiations becomes more efficient as the number of exponentiations increases.

Multi-server verifiable delegation of computations: Unconditional security and practical efficiency

Outsourcing computation has gained significant popularity in recent years due to the prevalence of cloud computing. There are two main security concerns in outsourcing computation: how to guarantee the cloud server performs the computation correctly and how to keep the client's data secret. The single-server verifiable computation (SSVC) of Gennaro, Gentry and Parno (Crypto'10) enables a client to delegate the computation of a function f on any input x with both concerns highly relieved, but only results in computationally secure schemes that lack practical efficiency.While the SSVC schemes use a single server, in this paper we develop a multi-server verifiable computation (MSVC) model where the client shares both f and x among multiple servers, each server performs a set of computations on its shares, and finally the client reconstructs f(x) from all servers' results. In this MSVC model we propose a generic construction for outsourcing computations of the form Fx, where F is a matrix and x is a vector. Our generic construction achieves information-theoretic security, input privacy and function privacy. By optimizing the parameters, we obtain both a 3-server scheme, which uses the least number of servers, and a 4-server scheme, which incurs the least workload. By decomposing many polynomial computations as a two-stage computation, where the first-stage has the form Fx and the second-stage is fast, and delegating the first-stage computation, we obtain MSVC schemes for these polynomials. We implement our MSVC schemes and show that they are among the most practical ones to date.

ST-BFL: A Structured Transparency Empowered Cross-Silo Federated Learning on the Blockchain Framework

Federated Learning (FL) relies on on-device training to avoid the migration of devices’ data to a centralized server to address privacy leakage. Moreover, FL is feasible for scenarios (e.g., autonomous cars) where an enormous amount of data is generated every day. Transferring only local model updates in the case of FL is highly communication-efficient compared to transferring all data in the case of centralized machine learning (ML). Although FL offers many advantages, it also has some challenges. A malicious aggregation server can infer device information via local model updates. Another downside of FL is the centralized aggregation server that can malfunction due to an attack or physical damage. To address these issues, we propose a novel Structured Transparency empowered cross-silo Federated Learning on the Blockchain (ST-BFL) framework. In ST-BFL, homomorphic encryption, FL-aggregators, FL-verifiers, and smart contract are employed, which satisfy various structured transparency components, such as input privacy, output privacy, output verification, and flow governance. We present the framework architecture, algorithms, and sequence diagram of our ST-BFL framework to show how different entities interact in ST-BFL for the FL process. We also present a simplified class diagram of ST-BFL’s smart contract for an FL task. Finally, we perform a simulation to analyze our framework from the perspective of aggregation time, accuracy, and storage size. The qualitative and quantitative evaluation shows that ST-BFL has the same accuracy as traditional FL. However, ST-BFL provides input privacy, output privacy, input verification, output verification, and flow governance at the expense of relatively higher computation and communication costs than traditional FL.

Toward Verifiable and Privacy Preserving Machine Learning Prediction

The ubiquitous needs for extracting insights from data are driving the emergence of service providers to offer predictions given the inputs from customers. During this process, it is important and highly nontrivial for the service providers to generate proofs of honest predictions without leaking the key parameters of their trained models. In addition, the customers are usually unwilling to reveal their sensitive inputs. In this article, we proposed MVP, which enables <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</u> achine learning prediction in a <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">V</u> erifiable and <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">P</u> rivacy preserving fashion. MVP features the properties of polynomial decomposition and prime-order bilinear groups to simultaneously facilitate oblivious evaluation and batch outcome verification while maintaining function privacy and input privacy. We further instantiated MVP with Support Vector Machines (SVMs) and extensively evaluated its performance for the spam detection task on three practical Short Message Service (SMS) datasets. Our analysis and evaluation results reveal that MVP achieves the desired properties while incurring low computation and communication overhead.

Privacy-preserving verifiable delegation of polynomial and matrix functions

AbstractOutsourcing computation has gained significant popularity in recent years due to the development of cloud computing and mobile services. In a basic outsourcing model, a client delegates computation of a function f on an input x to a server. There are two main security requirements in this setting: guaranteeing the server performs the computation correctly, and protecting the client’s input (and hence the function value) from the server. The verifiable computation model of Gennaro, Gentry and Parno achieves the above requirements, but the resulting schemes lack efficiency. This is due to the use of computationally expensive primitives such as fully homomorphic encryption (FHE) and garbled circuits, and the need to represent f as a Boolean circuit. Also, the security model does not allow verification queries, which implies the server cannot learn if the client accepts the computation result. This is a weak security model that does not match many real life scenarios. In this paper, we construct efficient (i.e., without using FHE, garbled circuits and Boolean circuit representations) verifiable computation schemes that provide privacy for the client’s input, and prove their security in a strong model that allows verification queries. We first propose a transformation that provides input privacy for a number of existing schemes for verifiable delegation of multivariate polynomial f over a finite field. Our transformation is based on noisy encoding of x and keeps x semantically secure under the noisy curve reconstruction (CR) assumption. We then propose a construction for verifiable delegation of matrix-vector multiplication, where the delegated function f is a matrix and the input to the function is a vector. The scheme uses PRFs with amortized closed-form efficiency and achieves high efficiency. We outline applications of our results to outsourced two-party protocols.

Protecting Private Inputs: Bounded Distortion Guarantees With Randomised Approximations

Abstract Computing a function of some private inputs while maintaining the confidentiality of those inputs is an important problem, to which Differential Privacy and Secure Multi-party Computation can offer solutions under specific assumptions. Research in randomised algorithms aims at improving the privacy of such inputs by randomising the output of a computation while ensuring that large distortions of outputs occur with low probability. But use cases such as e-voting or auctions will not tolerate large distortions at all. Thus, we develop a framework for randomising the output of a privacypreserving computation, while guaranteeing that output distortions stay within a specified bound. We analyse the privacy gains of our approach and characterise them more precisely for our notion of sparse functions. We build randomisation algorithms, running in linearithmic time in the number of possible input values, for this class of functions and we prove that the computed randomisations maximise the inputs’ privacy. Experimental work demonstrates significant privacy gains when compared with existing approaches that guarantee distortion bounds, also for non-sparse functions.