Searching over encrypted model and encrypted data using secure single-and multi-party learning based on encrypted data
ML model(s) are created and trained using training data from user(s) to create corresponding trained ML model(s). The training data is in FHE domains, each FHE domain corresponding to an individual one of the user(s). The trained machine learning model(s) are run to perform inferencing using other data from at least one of the user(s). The running of the ML model(s) determines results. The other data is in a corresponding FHE domain of the at least one user. Using at least the results, it is determined which of the following issues is true: the results comprise objectionable material, or at least one of the trained ML model(s) performs prohibited release of information. One or more actions are taken to take to address the issue determined to be true. Methods, apparatus, and computer program product are disclosed.
1. A method, comprising:
accessing, by a computer system, training data curated to include information prohibited from release;
accessing one or more machine learning models that, when applied to the training data, releases the information that is prohibited, wherein the one or more machine learning models comprise N machine learning models, where N is at least 1, and wherein the method further comprises testing the N machine learning models at least by,
directing, by the computer system, one or more users to encrypt at least the training data, to form encrypted training data, in individual fully homomorphic encryption (FHE) domains corresponding to the one or more users;
running by the computer system the N machine learning models on the encrypted training data, the running determining first encrypted results;
comparing, by the computer system using a metric, the first encrypted results with second encrypted results of a further machine learning model, different from the N machine learning models, run on at least the encrypted training data, wherein the comparing the first encrypted results with the second encrypted results further comprises determining whether the further machine learning model is performing prohibited release of the information; and
taking one or more actions to address the prohibited release of the information based on the determination that the further machine learning model is performing the prohibited release of the information.
2. The method of claim 1 , wherein the prohibited release of information is further addressed with one or both of an auditor or regulator.
3. The method of claim 1 , further comprising, in response to at least one user of the one or more users requesting the further machine learning model be created, performing the creating the further machine learning model.
4. The method of claim 1 , further comprising
directing the at least one user to decrypt the first encrypted results of the N machine learning models into plaintext; and
checking, using the plaintext, that prohibited information has been released for one or more of the N machine learning models.
5. The method of claim 4 , wherein the testing further comprises re-checking the one or more of the N machine learning models that did not release prohibited information, running by the computer system the one or more of the N machine learning models that did not release prohibited information on the encrypted training data and determining corresponding results, directing the at least one user to decrypt the corresponding results of the one or more of the N machine learning models that did not release prohibited information into plaintext, and checking, using the plaintext of the decrypted corresponding results, that prohibited information has been released for the one or more of the N machine learning models that did not release prohibited information.
6. The method of claim 1 , wherein the computer system curates the training data that has been curated to have the information whose release is prohibited.
7. The method of claim 1 , wherein the training data forms at least part of a catalog having a list of what is prohibited from release in a jurisdiction.
8. The method of claim 1 , wherein the training data forms at least part of a catalog having a list of what is illegal if release in a jurisdiction.
9. A computer system, comprising:
a memory comprising program code; and
one or more processors, the one or more processors, in response to retrieval and execution of the program code, causing the computer system to perform operations comprising:
accessing, by a computer system, training data curated to include information prohibited from release;
accessing one or more machine learning models that, when applied to the training data, releases the information that is prohibited, wherein the one or more machine learning models comprise N machine learning models, where N is at least 1, and wherein the method further comprises testing the N machine learning models at least by,
directing, by the computer system, one or more users to encrypt at least the training data, to form encrypted training data, in individual fully homomorphic encryption (FHE) domains corresponding to the one or more users;
running by the computer system the N machine learning models on the encrypted training data, the running determining first encrypted results;
comparing, by the computer system using a metric, the first encrypted results with second encrypted results of a further machine learning model, different from the N machine learning models, run on at least the encrypted training data, wherein the comparing the first encrypted results with the second encrypted results further comprises determining whether the further machine learning model is performing prohibited release of the information; and
taking one or more actions to address the prohibited release of the information based on the determination that the further machine learning model is performing the prohibited release of the information.
10. The computer system of claim 9 , wherein the prohibited release of information is further addressed with one or both of an auditor or regulator.
11. The computer system of claim 9 , wherein the one or more processors, in response to retrieval and execution of the program code, further cause the computer system to perform operations comprising: in response to at least one user of the one or more users requesting the further machine learning model be created, performing the creating the further machine learning model.
12. The computer system of claim 9 ,
directing the at least one user to decrypt the first encrypted results of the N machine learning models into plaintext; and
checking, using the plaintext, that prohibited information has been released for one or more of the N machine learning models.
13. The computer system of claim 12 , wherein the testing further comprises re-checking the one or more of the N machine learning models that did not release prohibited information, running by the computer system the one or more of the N machine learning models that did not release prohibited information on the encrypted training data and determining corresponding results, directing the at least one user to decrypt the corresponding results of the one or more of the N machine learning models that did not release prohibited information into plaintext, and checking, using the plaintext of the decrypted corresponding results, that prohibited information has been released for the one or more of the N machine learning models that did not release prohibited information.
14. The computer system claim 9 , wherein the computer system curates the training data that has been curated to have the information whose release is prohibited.
15. The computer system of claim 9 , wherein the training data forms at least part of a catalog having a list of what is prohibited from release in a jurisdiction.
16. The computer system of claim 9 , wherein the training data forms at least part of a catalog having a list of what is illegal if release in a jurisdiction.
17. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a device to cause the device to perform operations comprising:
accessing, by a computer system, training data curated to include information prohibited from release;
accessing one or more machine learning models that, when applied to the training data, releases the information that is prohibited, wherein the one or more machine learning models comprise N machine learning models, where N is at least 1, and wherein the method further comprises testing the N machine learning models at least by,
directing, by the computer system, one or more users to encrypt at least the training data, to form encrypted training data, in individual fully homomorphic encryption (FHE) domains corresponding to the one or more users;
running by the computer system the N machine learning models on the encrypted training data, the running determining first encrypted results;
comparing, by the computer system using a metric, the first encrypted results with second encrypted results of a further machine learning model, different from the N machine learning models, run on at least the encrypted training data, wherein the comparing the first encrypted results with the second encrypted results further comprises determining whether the further machine learning model is performing prohibited release of the information; and
taking one or more actions to address the prohibited release of the information based on the determination that the further machine learning model is performing the prohibited release of the information.