CryptInfer: Enabling Encrypted Inference on Skin Lesion Images for Melanoma Detection

ABSTRACT

Deep learning models such as Convolutional Neural Networks (CNNs) have shown the potential to classify medical images for accurate diagnosis. These techniques will face regulatory compliance challenges related to privacy of user data, especially when they are deployed as a service on a cloud platform. Fully Homomorphic Encryption (FHE) can enable CNN inference on encrypted data and help mitigate such concerns. However, encrypted CNN inference faces the fundamental challenge of optimizing the computations to achieve an acceptable trade-off between accuracy and practical computational feasibility. Current approaches for encrypted CNN inference demonstrate feasibility typically on smaller images (e.g., MNIST and CIFAR-10 datasets) and shallow neural networks. This work is the first to show encrypted inference results on a real-world dataset for melanoma detection with large-sized images of skin lesions based on the Cheon-Kim-Kim-Song (CKKS) encryption scheme available in the open-source HElib library. The practical challenges related to encrypted inference are first analyzed and inference experiments are conducted on encrypted MNIST images to evaluate different optimization strategies and their role in determining the throughput and latency of the inference process. Using these insights, a modified LeNet-like architecture is designed and implemented to achieve the end goal of enabling encrypted inference on melanoma dataset. The results demonstrate that 80% classification accuracy can be achieved on encrypted skin lesion images (security of 106 bits) with a latency of 51 seconds for single image inference and a throughput of 18,000 images per hour for batched inference, which shows that privacy-preserving machine learning as a service (MLaaS) based on encrypted data is indeed practically feasible.

References

1. Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Mauro Conti. 2018. A Survey on Homomorphic Encryption Schemes: Theory and Implementation. Comput. Surveys 51, 4 (September 2018).
2. Zvika Brakerski. 2012. Fully homomorphic encryption without modulus switching from classical GapSVP. In Annual Cryptology Conference. Springer, 868–886.
3. Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. 2014. (Leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory (TOCT) 6, 3 (2014), 1–36.
4. Titus Josef Brinker, Achim Hekler, Jochen Sven Utikal, Niels Grabe, Dirk Schadendorf, Joachim Klode, Carola Berking, Theresa Steeb, Alexander H Enk, and Christof von Kalle. 2018. Skin Cancer Classification Using Convolutional Neural Networks: Systematic Review. J Med Internet Res 20, 10 (17 Oct 2018), e11936. https://doi.org/10.2196/11936
5. Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. 2019. Low latency privacy preserving inference. In International Conference on Machine Learning. 812–821.
6. Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homomorphic encryption for arithmetic of approximate numbers. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 409–437.
7. Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène. 2020. TFHE: fast fully homomorphic encryption over the torus. Journal of Cryptology 33, 1 (2020), 34–91.
8. Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei. 2018. Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference. CoRR abs/1811.09953(2018). arxiv:1811.09953http://arxiv.org/abs/1811.09953
9. Marta Cullell-Dalmau, Sergio Noé, Marta Otero-Viñas, Ivan Meić, and Carlo Manzo. 2021. Convolutional Neural Network for Skin Lesion Classification: Understanding the Fundamentals Through Hands-On Learning. Frontiers in Medicine 8(2021), 213. https://doi.org/10.3389/fmed.2021.644327
10. Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madan Musuvathi, and Todd Mytkowicz. 2019. CHET: An Optimizing Compiler for Fully-Homomorphic Neural-Network Inferencing. In PLDI 2019. ACM, 142–156. https://www.microsoft.com/en-us/research/publication/chet-an-optimizing-compiler-for-fully-homomorphic-neural-network-inferencing/
11. Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning. 201–210.
12. Junfeng Fan and Frederik Vercauteren. 2012. Somewhat Practical Fully Homomorphic Encryption. Cryptology ePrint Archive, Report 2012/144. https://eprint.iacr.org/2012/144.
13. Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing. 169–178.
14. Zahra Ghodsi, Akshaj Veldanda, Brandon Reagen, and Siddharth Garg. 2021. CryptoNAS: Private Inference on a ReLU Budget. arxiv:2006.08733 [cs.LG] https://arxiv.org/abs/2006.08733
15. Vikas Gottemukkula. 2020. Polynomial Activation Functions. ICLR 2020 Open Review. https://openreview.net/attachment?id=rkxsgkHKvH&name=original_pdf.
16. David A. Gutman, Noel C. F. Codella, M. Emre Celebi, Brian Helba, Michael A. Marchetti, Nabin K. Mishra, and Allan Halpern. 2016. Skin Lesion Analysis toward Melanoma Detection: A Challenge at the International Symposium on Biomedical Imaging (ISBI) 2016, hosted by the International Skin Imaging Collaboration (ISIC). CoRR abs/1605.01397(2016). arXiv:1605.01397http://arxiv.org/abs/1605.01397
17. S. Halevi and V. Shoup. 2020. HElib - An Implementation of homomorphic encryption. https://github.com/homenc/HElib (accessed August 25, 2021).
18. Nayna Jain, Karthik Nandakumar, Nalini Ratha, Sharath Pankanti, and Uttam Kumar. 2021. Efficient CNN Building Blocks for Encrypted Data. arxiv:2102.00319 [cs.CR] Presented in The Second AAAI Workshop on Privacy-Preserving Artificial Intelligence (PPAI-21), arXiv:2102.00319.
19. Nandan Kumar Jha, Zahra Ghodsi, Siddharth Garg, and Brandon Reagen. 2021. DeepReDuce: ReLU Reduction for Fast Private Inference. arxiv:2103.01396 [cs.LG] https://arxiv.org/abs/2103.01396
20. Chao Jin, Ahmad Al Badawi, Balagopal Unnikrishnan, Jie Lin, Chan Fook Mun, James M Brown, J Peter Campbell, Michael Chiang, Jayashree Kalpathy-Cramer, Vijay Ramaseshan Chandrasekhar, Pavitra Krishnaswamy, and Khin Mi Mi Aung. 2019. CareNets: Efficient homomorphic CNN for high resolution images. In NeurIPS Workshop on Privacy in Machine Learning (PriML).
21. Guillermo Lloret-Talavera, Marc Jorda, Harald Servat, Fabian Boemer, Chetan Chauhan, Shigeki Tomishima, Nilesh N. Shah, and Antonio J Pena. 2021. Enabling Homomorphically Encrypted Inference for Large DNN Models. IEEE Trans. Comput. (2021), 1–1. https://doi.org/10.1109/tc.2021.3076123
22. Qian Lou and Lei Jiang. 2019. SHE: A Fast and Accurate Deep Neural Network for Encrypted Data. In Advances in Neural Information Processing Systems. 10035–10043.
23. Payman Mohassel and Yupeng Zhang. 2017. SecureML: A System for Scalable Privacy-Preserving Machine Learning. 19–38. https://doi.org/10.1109/SP.2017.12