4

I recently read about "functional encryption" which seems interesting, although I didn't understand yet how it works ... but is it possible to combine it or adapt it with homomorphic encryption in the context of neural networks particularly.

Suppose you have a neural network that you run over some data encrypted homomorphically (say paillier for example) .. linear computations will be performed without any problem .. but the only issue will be with activation functions which are non linear, and thus require to decrypt the intermediate results (weighted sums) in order to apply the activation functions ...

in case we don't want to disclose the private key, can we use something like functional encryption in order to allow the application of activation functions only, something like a special private key that allows only a specific activation function to be performed, and do not allow to decrypt any other information ?!

witdev
  • 75
  • 5

3 Answers3

2

The main difference between FE and HE is that: In HE, for the decryption you need to interact with the owner of the secret-key, but in FE everybody who has access to the ciphertext and functional key can decrypt the message. While HE can efficiently support different kinds of computation over encrypted data, FE supports limited class of functionality (in theory it still can support general functionality). This limited class includes: inner-product (which might be what you called weighted sum) and quadratic functionality. Recently, there has been a European Project called FENTEC, they are trying to implement the existing FE schemes.

Sayam Sethi
  • 3
  • 2
A.Solei
  • 415
  • 2
  • 11
2

In theory, you appear to be right. A combination of HE and FE for that particular use case, where FE computes the non-linear operations, might be useful.
However, you need an appropriate FE scheme that can operate correctly on HE-encrypted data, or a protocol to switch between HE and FE-compatible scheme. Nowadays such scheme doesn't exist - and currently there are only linear and quadratic FE schemes. (e.g. https://github.com/fentec-project/CiFEr).
Rather than that, once you have a practical FE scheme for any desired function - you can use FE only.
You can implement kind-of FE over secure hardware, e.g. IRON: Functional encryption using SGX, Boneh et al. , but of course in this case the security level is limited to the secure HW implementation.

rkellerm
  • 123
  • 4
0

Functional encryption is more general than homomorphic encryption and can emulate one.

In homomorphic encryption you have the operation circuit that takes some encrypted data, decrypts them internally, performs an operation and encrypts again.

In functional encryption you have a similar circuit that takes encrypted data, decrypts them internally, performs an operation and returns the cleartext result.

You want to emulate HE with FE? No problem, just append the encryption circuit at the end of your operation circuit. Now it doesn't mean this scheme would be practical. Using the dedicated HE algorithm would probably be more efficient.

FE gives you ability to selectively decrypt certain data. In HE it's all or nothing, you have the decryption key or not. With FE you can share a public key that decrypts only the data you want.

haael
  • 305
  • 1
  • 9