EVALUATING CONVOLUTIONS USING ENCRYPTED DATA

1 . A server, comprising:

an interface configured to communicate with a client device; and

at least one processor configured to:

receive an input ciphertext from the client device including at least encrypted coefficients of an input polynomial, wherein the encrypted coefficients have been encrypted according to a Fully Homomorphic Encryption (FHE) scheme after encoding one or more input datasets of real numbers into a plaintext polynomial with integral coefficients that do not include an imaginary component;

perform a convolution on the input ciphertext using a kernel by at least in part separately multiplying the input polynomial by one or more kernel polynomials to result in one or more corresponding convolved polynomials, wherein the one or more kernel polynomials include kernel coefficients encoded using kernel values for the kernel; and

use at least a plurality of coefficients in each of the one or more convolved polynomials to derive an output ciphertext representing an output of the convolution on the input ciphertext using the kernel.

2 . The server of claim 1 , wherein the one or more convolved polynomials are a plurality of convolved polynomials, and wherein the at least one processor is further configured to:

select a subset of coefficients from each convolved polynomial of the plurality of convolved polynomials based on a scaled geometric sequence with a common ratio of two between each successive term in the geometric sequence; and

use the selected subset of coefficients from each convolved polynomial to form the output ciphertext.

3 . The server of claim 1 , wherein the input polynomial and the one or more kernel polynomials are encoded as polynomials in a ring of polynomials expressed as = [X]/(X N +1) with N being a power of two and [X] denoting integral coefficients of the polynomials in the ring.

4 . The server of claim 3 , wherein N is set as greater than or equal to the larger of Bw 2 and Bk 2 , where B is a total number of input datasets encoded into the plaintext polynomial, w is a row size or a column size of each input dataset, and k is a row size or a column size of each batch kernel of the kernel that is used in the convolution for each input dataset.

5 . The server of claim 1 , wherein the at least one processor is further configured to perform a modified bootstrapping on the output ciphertext, and wherein in performing the modified bootstrapping, the at least one processor is further configured to at least:

convert coefficients of the output ciphertext into a plurality of slots of an input vector according to the FHE scheme;

perform a modular reduction approximated by a scaled sine function on each slot of the plurality of slots to generate a plurality of reduced slots; and

evaluate an activation function for the plurality of reduced slots to generate an output vector.

6 . The server of claim 5 , wherein in performing the modified bootstrapping, the at least one processor is further configured to at least:

extract values from the output vector based on a stride for a first convolutional layer of a Convolutional Neural Network (CNN) including the convolution; and

convert the extracted values into output coefficients of an encrypted result polynomial according to the FHE scheme.

7 . The server of claim 6 , wherein the at least one processor is further configured to set the encrypted result polynomial as a new input polynomial for a second convolutional layer of the CNN including a second convolution performed by at least in part separately multiplying the new input polynomial by one or more second layer kernel polynomials including second layer kernel coefficients encoded using second layer kernel values for a second layer kernel.

8 . A method, comprising:

receiving an input ciphertext from a client device including at least encrypted coefficients of an input polynomial, wherein the encrypted coefficients have been encrypted according to a Fully Homomorphic Encryption (FHE) scheme after encoding one or more input datasets of real numbers into a plaintext polynomial;

encoding a kernel into one or more kernel polynomials using kernel values from the kernel as kernel coefficients in the one or more kernel polynomials;

performing a convolution on the input ciphertext at least in part by separately multiplying the input polynomial by the one or more kernel polynomials to result in one or more corresponding convolved polynomials; and

using at least a plurality of coefficients in each of the one or more convolved polynomials to derive an output ciphertext representing an output of the convolution on the input ciphertext using the kernel.

9 . The method of claim 8 , wherein the one or more convolved polynomials are a plurality of convolved polynomials, and wherein the method further comprises:

selecting a subset of coefficients from each convolved polynomial of the plurality of convolved polynomials based on a scaled geometric sequence with a common ratio of two between each successive term in the geometric sequence; and

using the selected subset of coefficients from each convolved polynomial to form the output ciphertext.

10 . The method of claim 8 , wherein the input polynomial and the one or more kernel polynomials are encoded as polynomials in a ring of polynomials expressed as = [X]/(X N +1) with N being a power of two and [X] denoting integral coefficients of the polynomials in the ring.

11 . The method of claim 10 , wherein N is set as greater than or equal to the larger of Bw 2 and Bk 2 , where B is a total number of input datasets encoded into the plaintext polynomial, w is a row size or a column size of each input dataset, and k is a row size or a column size of each batch kernel of the kernel that is used in the convolution for each input dataset.

12 . The method of claim 8 , further comprising performing a modified bootstrapping on the output ciphertext by at least:

converting coefficients of the output ciphertext into a plurality of slots of an input vector according to the FHE scheme;

performing a modular reduction approximated by a scaled sine function on each slot of the plurality of slots to generate a plurality of reduced slots; and

evaluating an activation function for the plurality of reduced slots to generate an output vector.

13 . The method of claim 12 , further comprising:

extracting values from the output vector based on a stride for a first convolutional layer of a Convolutional Neural Network (CNN) including the convolution; and

converting the extracted values into output coefficients of an encrypted result polynomial according to the FHE scheme.

14 . The method of claim 13 , further comprising setting the encrypted result polynomial as a new input polynomial for a second convolutional layer of the CNN including a second convolution performed by at least in part separately multiplying the new input polynomial by one or more second layer kernel polynomials including second layer kernel coefficients encoded using second layer kernel values for a second layer kernel.

15 . A client device, comprising:

an interface configured to communicate with a server; and

at least one processor configured to:

encode one or more input datasets of real numbers into a plaintext polynomial with integral coefficients that do not include an imaginary component;

generate an input ciphertext by encrypting the plaintext polynomial using a first key according to a Fully Homomorphic Encryption (FHE) scheme, wherein the input ciphertext includes at least encrypted coefficients of an input polynomial; and

send the input ciphertext to the server via the interface for the server to perform at least one convolution on the input polynomial.

16 . The client device of claim 15 , wherein the at least one processor is further configured to:

receive an encrypted result polynomial from the server via the interface;

decrypt the encrypted result polynomial according to the FHE scheme using a secret key to derive a decrypted polynomial; and

determine one or more Convolutional Neural Network (CNN) results for the one or more input datasets by decoding the decrypted polynomial using decrypted coefficients of the decrypted polynomial.

17 . The client device of claim 15 , wherein the at least one processor is further configured to encode the one or more input datasets of real numbers into the plaintext polynomial in a ring of polynomials expressed as = [X]/(X N +1) with N being a power of two and [X] denoting integral coefficients of the polynomials in the ring.

18 . The client device of claim 17 , wherein the at least one processor is further configured to:

determine if a total size of the one or more input datasets is equal to N divided by 2 s , wherein s is a positive integer greater than zero; and

in response to determining that the total size of the one or more input datasets equal to N divided by 2 s , increase degrees of terms in the plaintext polynomial by a factor of 2 s .

19 . The client device of claim 17 , wherein the at least one processor is further configured to:

determine if a total size of a plurality of input datasets is larger than N; and

in response to determining that the total size of the plurality of input datasets is larger than N, set a subset of input datasets from the plurality of input datasets as the one or more input datasets for encoding into the plaintext polynomial.

20 . A method, comprising:

encoding one or more input datasets of real numbers into a plaintext polynomial by:

separately multiplying the real numbers of the one or more input datasets by a scaling factor;

determining coefficients of the plaintext polynomial by rounding each of the corresponding products of the real numbers and the scaling factor to a nearest integer; and

using the determined coefficients as coefficients in the plaintext polynomial, wherein the plaintext polynomial is in a ring of polynomials expressed as = [X]/(X N +1) with N being a power of two and [X] denoting integral coefficients of the polynomials in the ring;

generating an input ciphertext by encrypting the plaintext polynomial using a first key according to a Fully Homomorphic Encryption (FHE) scheme, wherein the input ciphertext includes at least encrypted coefficients of an input polynomial; and

sending the input ciphertext to a server to perform at least one convolution on the input polynomial using at least one kernel.

21 . A system, comprising:

a client device including at least one processor configured to:

encode one or more input datasets of real numbers into a plaintext polynomial with integral coefficients that do not include an imaginary component; and

generate an input ciphertext by encrypting the plaintext polynomial using a first key according to a Fully Homomorphic Encryption (FHE) scheme, wherein the input ciphertext includes at least encrypted coefficients of an input polynomial; and

a server including means for:

receiving the input ciphertext from the client device;

performing a convolution on the input ciphertext using a kernel by at least in part separately multiplying the input polynomial by one or more kernel polynomials to result in one or more corresponding convolved polynomials, wherein the one or more kernel polynomials include kernel coefficients encoded using kernel values for the kernel; and

using at least a plurality of coefficients in each of the one or more convolved polynomials to derive an output ciphertext representing an output of the convolution on the input ciphertext using the kernel.