Session: Secure & Privacy Preserving Computations
CCSW’17, November 3, 2017, Dallas, TX, USA
Privacy-preserving Machine Learning in Cloud Ehsan Hesamifard Hassan Takabi Department of Computer Science and Engineering University of North Texas Denton, Texas
[email protected],
[email protected]
Mehdi Ghasemi
Catherine Jones
Department of Mathematics and Statistics University of Saskatchewan Saskatoon, Canada
[email protected]
Computer Science and Mathematics Department Meredith College Raleigh, North Carolina
[email protected]
ABSTRACT
including Microsoft Azure Machine Learning [15], Google Prediction API [7], GraphLab [19], and Ersatz Labs [12]. Machine learning algorithms typically consist of two phases: (i) the training phase during which the algorithm learns a model w from a data set, and (ii) the classification phase that runs a classifier C over a previously unseen feature vector x, using the model w to output a prediction C(x, w). Either of these phases or both could be outsourced to the cloud. In applications that handle sensitive data, it is important that the training data, the feature vector x and the model w remain secret to one or some of the parties involved. Machine learning algorithms based on deep neural networks (NN) have attracted attention as a breakthrough in the advance of artificial intelligence (AI) and are the mainstream in current AI research. These techniques are achieving remarkable results and are extensively used for analyzing big data in a variety of domains such as spam detection, traffic analysis, intrusion detection, medical or genomics predictions, face recognition, and financial predictions [5, 6, 11]. However, training the models require access to the raw data which is often privacy sensitive and can create potential privacy risks. In this paper, we present a solution to apply neural network algorithms to encrypted data and allow the parties to provide/receive the service without having to reveal their sensitive data to the other parties. The main components of our proposed approach are homomorphic encryption and neural networks. We need to adopt neural network algorithms within limitations of homomorphic encryption. However, the computation performed over sensitive data by neural network algorithms is very complex and neural networks cannot simply be translated to encrypted versions without modification. For example, in neural networks the Sigmoid function ( 1+e1 −x ) or the Rectified Linear Unit (ReLU, f (x) = max(x, 0)) are used as an activation function and they should be replaced by a function that only uses addition and multiplication such as polynomials. However, a solution that builds upon homomorphic encryption schemes should be restricted to computing low degree polynomials in order to be practical [20]. Hence, presenting the desired computation as low-degree polynomials is an important task in making practical use of homomorphic encryption schemes for applying neural network algorithms to encrypted data. We design and evaluate privacy-preserving training and classification of neural networks by replacing the activation functions with these polynomial approximations. Our goal is to adopt the neural networks within practical limitations of homomorphic encryption while keeping accuracy as close as possible to the original model.
Machine learning algorithms based on deep neural networks (NN) have achieved remarkable results and are being extensively used in different domains. On the other hand, with increasing growth of cloud services, several Machine Learning as a Service (MLaaS) are offered where training and deploying machine learning models are performed on cloud providers’ infrastructure. However, machine learning algorithms require access to raw data which is often privacy sensitive and can create potential security and privacy risks. To address this issue, we develop new techniques to provide solutions for applying deep neural network algorithms to the encrypted data. In this paper, we show that it is feasible and practical to train neural networks using encrypted data and to make encrypted predictions, and also return the predictions in an encrypted form. We demonstrate applicability of the proposed techniques and evaluate its performance. The empirical results show that it provides accurate privacy-preserving training and classification.
CCS CONCEPTS • Security and privacy → Cryptography; Privacy-preserving protocols;
KEYWORDS Homomorphic Encryption, Machine learning, Privacy Preserving.
1
INTRODUCTION
With increasing growth of cloud services, machine learning algorithms can be run on cloud providers’ infrastructure where training and deploying machine learning models are performed on the cloud servers. Once the models are deployed, users can use these models to make predictions without having to worry about maintaining the models and the service. In a nutshell, this is Machine Learning as a Service (MLaaS), and several such services are currently offered Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from
[email protected]. CCSW’17, November 3, 2017, Dallas, TX, USA © 2017 Association for Computing Machinery. ACM ISBN 978-1-4503-5204-8/17/11. . . $15.00 https://doi.org/10.1145/3140649.3140655
39
Session: Secure & Privacy Preserving Computations
CCSW’17, November 3, 2017, Dallas, TX, USA
3
Our main contributions in this paper are as follows: • To the best of our knowledge, our proposed approach is the first work that provides a solution for training neural network models using homomorphic encryption. • We implement full neural networks over homomorphically encrypted data where the activation functions (Sigmoid and ReLU) are replaced with the polynomial approximations. • We provide comparison with the state-of-the-art approaches based on Homomorphic Encryption (HE) and Secure Multiparty Computation (SMC). The results show that our proposed approach provides accurate and privacy-preserving training and classification and outperforms both HE-based and SMC-based approaches. The rest of this paper is organized as follows: In Section 2, we provide a brief overview about neural networks and challenges while learning from encrypted data. We describe our proposed solution in Section 3. In Section 4, we provide results for building models based on encrypted datasets. In Section 5, we review related work. In Section 6, we conclude the paper and discuss future work.
2
THE PROPOSED SOLUTION
Generally, we can approximate a function like Sigmoid or ReLU with the polynomials from different degrees. The higher degree polynomials provide a more accurate approximation and when replace Sigmoid or ReLU function in a neural network, lead to a better performance in the trained model. However, when operations are performed over encrypted data, a higher degree polynomial results in very slow computations. Therefore, a solution that builds upon homomorphic encryption schemes should be restricted to computing low degree polynomials in order to be practical [20]. We need to find a trade-off between the degree of the polynomial approximation and the performance of the model. In our previous work, we provided theoretical foundation to prove that it is possible to find lowest degree polynomial approximation of a function within a certain error range and provided an approach to generate those approximations [18] and [10]. Building upon that theoretical foundation, in this paper, we aim to find the best approximation polynomial for activation functions used in neural networks and implement the modified neural networks over encrypted data without loosing much accuracy. Polynomial Approximation of Sigmoid: We experiment with polynomial approximations of the Sigmoid function over a symmetric interval [−l, l] using an orthogonal system of polynomials, Chebyshef polynomials [21]. We note that the measure for Chebyshev polynomials mainly concentrates at the end points of the interval which causes interpolation at mostly initial and end points with two singularities at both ends. The approximation interval is chosen based on the feature values. We calculate mean of the feature values in the dataset, call it mean, and approximate the function on the interval [−mean, mean]. Polynomial Approximation of ReLU: The derivative of ReLU function is like a step function. For values less than 0, the derivative value is 0 and for values more than 0, it’s 1, and it is non-continuous in point 0. We aim to approximate this function with a polynomial. If the function is continuous and infinitely derivative, we can approximate it more accurately than a non-continuous or non-infinitely derivative function. We need to choose a function which has the structure of a step function with these two properties. Sigmoid function is a bounded, continuous and infinitely derivative function, it also has a structure like derivative of ReLU function. Our proposed method is based on this idea.
BACKGROUND INFORMATION: NEURAL NETWORKS
At a high level of abstraction, a neural network is a combination of neurons arranged in ordered layers. Each neuron gets an input, operates a function on it and outputs the result of the function. The structure of this function depends on the layer to which the neuron belongs. Besides the first layer (input layer) and the last layer (output layer), there is at least one middle layer, called hidden layer. In fully feed-forward neural networks, each neuron has a weighted connection to all neurons in the next layer. Neurons in different layers are of different types. For example, neurons in the input layer only get one input and output which is the same value. Neurons in hidden layers are more complex; they get inputs, compute the weighted summation of inputs, operate a function on the summation and then output the value of the function. These functions could be the Sigmoid, (f (x) = 1+e1 −x ), the Rectified Linear Unit (ReLU, f (x) = max(x, 0)), etc. and are called activation functions (or transfer functions). There are two methods for feeding to the neural network: online training and batch training. In online training, the weights are updated after feeding one instance to the network whereas in batch training, a batch of instances is fed to the network to update the weights in each step. Since our goal is to adopt a neural network to work within practical homomorphic encryption constraints, we focus on operations performed inside a neural network rather than its structure. Besides activation functions inside neurons (e.g. Sigmoid function), all other operations in a neural network are addition and multiplication, so they can be implemented over encrypted data. Activation functions, on the other hand, cannot be implemented within practical homomorphic encryption schemes. Hence, in order to operate a complete neural network over encrypted data, we replace activation functions with approximations that are compatible with practical HE schemes.
4
EMPIRICAL RESULTS
In this section, we present results of implementing neural networks over encrypted data. We used HELib [9] for implementation and all the computations were run on a virtual machine with 8GB RAM, Core i5 and Ubuntu 14.04. First, we train the models based on encrypted data and measure the running time for the training process. Then, we use the trained model to classify encrypted instances and measure accuracy of the model as well as running time. For generating encryption schemes in HELib, we set the value for security level equal to 80 (k = 80). The parameter L = 20 chosen based on the the trade-off between the running time and the complexity of the algorithm. We report the average running time from different rounds of algorithms and the standard deviation of running times is less than 3.0% in all cases. We should also consider
40
Session: Secure & Privacy Preserving Computations
#Hidden layer(s)
Network Creation(s)
CCSW’17, November 3, 2017, Dallas, TX, USA
Feedforward(s)
Backpropagation(s) # of Interactions Noise Reduction(s) Total Time(s) Crab dataset 1 42.33 59.80 109.81 77 149.03 217.07 2 56.97 130.26 202.12 192 312.27 394.38 3 96.22 289.88 412.85 452 682.82 803.95 4 119.22 383.72 548.42 600 912.07 1056.5 5 125.63 407.64 582.13 640 969.58 1120.70 Fertility dataset 1 55.24s 65.30 121.83 77 160.17 247.89 2 72.42s 138.17 220.69 192 331.60 436.99 3 112.66s 305.51 440.44 452 718.36 864.60 4 131.20s 390.96 562.10 600 926.35 1089.86 5 140.52s 419.80 602.63 640 995.61 1168.47 Climate Dataset 1 92.73 86.69 170.85 77 210.98 357.40 2 11.34 161.42 273.74 192 388.69 553.61 3 112.66 333.65 497.64 452 780.07 989.26 4 165.77 416.37 638.44 600 1011.63 1228.38 5 175.25 430.35 843.84 640 1229.50 1456.7 Table 1: Training Neural Network over Encrypted Data, batch input size of 576 and L = 20 (standard deviation is less than 2.9%).
the growing noise in the ciphertexts during computations. One technique to deal with the noise is bootstrapping which comes with heavy computation cost. To address this problem, we use an alternative approach where the server checks the level of the noise in the ciphertext after each operation. If the noise level is below the threshold (e.g. 2), the server sends the ciphertext to the client, the client decrypts/encrypts it and sends the fresh ciphertext back to the server. The number of operations allowed on the ciphertext depends on the value of L. If we set a small value for L, we need more communications between the client and the server whereas for higher values of L, less communications are required. However, by increasing the value of L, both the size of ciphertexts and the amount of transferred data increase.
4.1
Results of Training Phase
Training phase in neural network is a one time process and requires heavy computation. The process of training is based on two main functions: feed-forward and back-propagation. When the network gets encrypted instances, first it runs the feed-forward and then the back-propagation functions on them. The network goes through all instances and at the end, outputs a model. We implement neural networks over encrypted data with different number of hidden layers (1, 2, 3, 4 and 5). We implement the neural networks in HELib and use three different datasets from UC Irvine Machine Learning Repository [14]: Crab, Fertility and Climate Model with 200, 540 and 100 instances, and 6, 17 and 10 features respectively. The results are shown in Table 1. HELib supports SIMD feature and the running time for one instance is the same as the time for a batch of instances. We also train the neural network with different sizes of batch as an input (282, 576, 1420, 3668 and 6144) and calculate the running time for feed-forward, back-propagation and noise reduction for one, two, and five hidden layers. Figure 1 shows the result for five hidden layers as an
Figure 1: Running time for different batch sizes and five hidden layers.
example. As it can be seen, when we increase the size of the batch by 30 times, the running time only doubles. Our empirical results show that training over the encrypted data is efficient when batch learning is used, and the network performance is acceptable. For example, we reach the training rate of 0.68 second per instance (6 features) for a batch size of 576 and two hidden layers (see Table 1). By increasing the batch size to 6144, the training rate decreases to 0.10 second per instance for a neural network with two hidden layers. It is worth mentioning that although larger batch sizes lead to faster training, they also increase the size of the network. Hence, a trade-off between the memory and running time is needed and we should choose a proper batch size based on the size of the dataset.
41
Session: Secure & Privacy Preserving Computations
4.2
CCSW’17, November 3, 2017, Dallas, TX, USA
Results of Classification Phase
The accuracy of the trained model with ReLU as the activation function is 99.15% and the accuracy with Sigmoid as the activation function is 99.02%. When we replace the activation functions with polynomial approximations, the accuracy is 99.10% in case of ReLU and is 99.00% in case of Sigmoid. The accuracy of the similar model in CryptoNets is 98.95% and as we can see, our approach achieves better accuracy whether we use Sigmoid or ReLU as the activation function. As expected, our accuracy improvement is much better when the activation function is ReLU. In terms of throughput, our approach significantly outperforms CryptoNets. When we classify ciphertext with the batch size of 8192 (the same batch size used in CryptoNets), our approach can make 163840 predictions per hour whereas CryptoNets makes only 51739 predictions per hour. State-of-the-art SMC-based Approaches: Our approach doesn’t use bootstrapping due to huge computation cost and instead requires communications between the client and the server. Although our approach requires some communications, it has several advantages over SMC approaches as discussed below. The recent work of Mohassel and Zhang [16] is the state-of-the-art work that considers the neural networks and aims to develop privacy-preserving training and classification of neural networks using SMC techniques. The main advantage of our approach over SMC-based solutions is the number of communications. In SMC protocols, we need a number of interactions between client and server for each operation whereas in our approach, the server does not need to interact with the client unless the amount of noise reaches a threshold. In our solution, the number of communication is independent of the batch size whereas in [16], size of the batch contributes to the number of communications. For the same neural networks with one, two, three, four and five hidden layers, the number of communications for these NNs in the first iteration of training are 77, for the [16], theses numbers are 6042, 7507, 10452, 12778 and 13924 respectively. As can be seen, there is a huge difference in the number of communications in our solution and the proposed solution in [16]. We implemented a neural network similar to the one used in [16] and performed experiment using encrypted MNIST dataset. Note that we didn’t use any parallelization techniques and the performance can be further improved by using parallel implementation. In terms of the accuracy, the model trained by our proposed approach can reach 95.15% using RELU as the activation function over MNIST dataset while the model trained by the protocol in [16] can only reach 93.4% accuracy.
In classification phase, we only run feed-forward function and can perform the computation in parallel for a batch of unseen instances. Note that we implement classification over encrypted data while the model is also encrypted. In this phase, noise growth is not a big challenge and the run-time is more important. The results are shown in Table 2. #Hidden Classification(s) #interactions Noise layer Reduction(s) Crab dataset 1 28.62 0 0 2 61.17 0 0 3 154.20 0 0 4 229.28 10 155.87 5 234.65 21 171.20 Fertility dataset 1 35.94 0 0 2 68.86 0 0 3 160.49 0 0 4 236.72 10 152.34 5 255.70 21 169.84 Climate dataset 1 55.85 0 0 2 61.78 0 0 3 178.25 0 0 4 249.54 10 149.10 5 269.39 21 166.89 Table 2: Classification over Encrypted Data with batch size 576 and L = 20 (standard deviation is less than 3%.)
For the classification with a batch size of 576, we reach 0.04 second per instance for one hidden layer and 0.1 second per instance for two hidden layers. If we choose a batch of size of 6144, we reach 0.014 second per instance for one hidden layer and 0.036 second per instance for two hidden layers. The model is encrypted in all training and classification experiments and also we did not use any parallelization techniques in our implementation.
4.3
Comparison with state-of-the-art
In this section, we compare our results with the state-of-the-art privacy-preserving neural networks based on homomorphic encryption and SMC-based solutions. State-of-the-art HE-based Approaches: CryptoNets is the closest work to ours where it aims to implement the neural networks classification using HE [6]. However, it assumes that the model is trained based on the plain data and then uses this model for classifying encrypted instances. The MNIST dataset [13] is used for experiments which includes 60000 images where 50000 images are used for training and 10000 images for testing, each image has 28 × 28 pixels. We design a neural network with the same depth (the number of multiplication required) and similar structure. However, we consider two different functions, ReLU and Sigmoid, as the activation function, approximate them with polynomials and use these polynomial approximations in the training phase.
5
RELATED WORK
Graepel et al. use a somewhat homomorphic encryption scheme to train two machine learning classifiers: Linear Mean and Fisher’s Linear Discriminate (FLD) [8]. They propose division-free algorithms to adopt to limitations of homomorphic encryption algorithms. Bost et al. use a combination of three homomorphic systems (Quadratic Residuosity, Piallier, and BGV schemes), and garbled circuits to provide privacy-preserving classification for three different machine learning algorithms, namely Hyperplane Decision, Naive Bayes, and Decision trees [4]. Mohassel and Zhang propose a protocol for privacy-preserving training and classification based on SMC techniques [16]. Yuan et al. in [22] propose a protocol for privacy preserving training and classification based on SMC technique and
42
Session: Secure & Privacy Preserving Computations
CCSW’17, November 3, 2017, Dallas, TX, USA
Table 3: Training Neural Network over Encrypted MNIST Data (batch input size of 192 and L = 20). Feedforward(s) 2884.31
Backpropagation(s) 6301.26
#Interactions 6740
Total Time(s) 10476.29
state-of-the-art approaches based on homomorphic encryption and secure multi-party computation. For future work, we plan to conduct experiments with larger datasets and more complex neural networks. We also plan to study approximation of non-continuous functions used in deep neural network algorithms.
HE schemes for distributed data among clients. Three types of components participate in the protocol: clients, system and cloud. The clients encrypt the data by using the public key of the system and send it to the cloud. As a part of their protocol, they implement scalar product and sum operations by using secret sharing. Xie et al. discuss theoretical aspects of using polynomial approximation for implementing neural network in encrypted domain [20]. Building on this work, Dowlin et al. implement a neural network classifier on encrypted data [6]. They use a leveled homomorphic encryption scheme which supports SIMD. They replace max pooling with scaled mean-pooling for solving the issue of having no division operation available for encrypted values and use function f (z) := z 2 as an activation function. They build the model using plain data and then use this model for classifying encrypted data. Our approach, on the other hand, provides a solution for both training and classifying encrypted instances. Aslett et al. propose methods for implementing statistical machine learning over encrypted data and implement extremely random forests and Naive Bayes classifiers over 20 datasets. [2]. They also analyze current homomorphic encryption tools for use in statistical machine learning [3]. There are also non-cryptography based approaches to privacypreserving deep learning. Shokri and Shmatikov in [17] propose a privacy-preserving approach for learning from distributed data that allows multiple parties to jointly learn a neural network model without sharing their input datasets. Their approach is based on differential privacy where each party builds the model using its own data, and only shares a small part of the model’s parameters with other parties. Abadi et al. in [1] propose a framework for differentially private training of neural networks. It includes a differentially private stochastic gradient descent (SGD) algorithm, the moments accountant, and hyperparameter tuning. They develop new algorithmic techniques, provide an analysis of privacy costs within the framework of differential privacy, and implementation strategies based on the TensorFlow software library for machine learning. Differential privacy based approaches should make a trade-off between privacy and utility which affects accuracy of the trained model. Our threat model is different than differential privacy. In our approach, the server does not learn anything about the model whereas in differential privacy, the server will learn the model. Since the model is encrypted, reverse engineering cannot be used either.
6
Noise Reduction(s) 8939.40
REFERENCES [1] Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. [n. d.]. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS ’16). ACM, New York, NY, USA, 308–318. [2] Louis J. M. Aslett, Pedro M. Esperança, and Chris C. Holmes. 2015. Encrypted statistical machine learning: new privacy preserving methods. CoRR abs/1508.06845 (2015). [3] L. J. M. Aslett, P. M. Esperança, and C. C. Holmes. 2015. A review of homomorphic encryption and software tools for encrypted statistical machine learning. Technical Report. University of Oxford. [4] Raphael Bost, Raluca Ada Popa, Stephen Tu, and Shafi Goldwasser. 2015. Machine Learning Classification over Encrypted Data. In 22nd Annual Network and Distributed System Security Symposium, NDSS, San Diego, California, USA. [5] Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2015. Manual for Using Homomorphic Encryption for Bioinformatics. Technical Report MSR-TR-2015-87. [6] Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter Michael Naehrig, and John Wernsing. 2016. CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy. Technical Report MSR-TR-2016-3. [7] Google. 2017. Google Prediction API. (2017). https://cloud.google.com/prediction/ [8] Thore Graepel, Kristin Lauter, and Michael Naehrig. 2013. ML Confidential: Machine Learning on Encrypted Data. In Proceedings of the 15th International Conference on Information Security and Cryptology (ICISC’12). Springer-Verlag. [9] Shai Halevi and Victor Shoup. 2014. Algorithms in HElib. In Advances in Cryptology - CRYPTO - 34th Annual Cryptology Conference, Santa Barbara, CA, USA, Proceedings, Part I. 554–571. [10] Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. 2016. CryptoDL: Towards Deep Learning over Encrypted Data. In Annual Computer Security Applications Conference (ACSAC). [11] Naveed Islam, William Puech, Khizar Hayat, and Robert Brouzet. 2011. Application of Homomorphism to Secure Image Sharing. Optics Communications 284, 19 (Sept. 2011), 4412–4429. [12] Ersatz Labs. 2017. Ersatz. (2017). http://www.ersatzlabs.com/ [13] Yann LeCun and Corinna Cortes. 2010. MNIST handwritten digit database. (2010). http://yann.lecun.com/exdb/mnist/ [14] M. Lichman. 2013. UCI Machine Learning Repository. (2013). http://archive.ics. uci.edu/ml [15] Microsft. 2017. Microsoft Azure Machine Learning. (2017). https://azure.microsoft. com/en-us/services/machine-learning/ [16] P. Mohassel and Y. Zhang. 2017. SecureML: A System for Scalable PrivacyPreserving Machine Learning. In 2017 IEEE Symposium on Security and Privacy (SP). 19–38. [17] Reza Shokri and Vitaly Shmatikov. 2015. Privacy-Preserving Deep Learning. In Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security (CCS ’15). 1310–1321. [18] Hassan Takabi, Ehsan Hesamifard, and Mehdi Ghasemi. 2016. Privacy Preserving Multi-party Machine Learning with Homomorphic Encryption. In Private MultiParty Machine Learning, NIPS 2016 Workshop. [19] Turi. 2017. GraphLab. (2017). http://www.select.cs.cmu.edu/code/graphlab/ [20] Pengtao Xie, Misha Bilenko, Tom Finley, Ran Gilad-Bachrach, Kristin E. Lauter, and Michael Naehrig. 2014. Crypto-Nets: Neural Networks over Encrypted Data. CoRR abs/1412.6181 (2014). [21] Yuan Xu. 2001. Orthogonal Polynomials of Several Variables. Encyclopedia of Mathematics and its Applications 81 (2001). [22] J. Yuan and S. Yu. 2013. Privacy Preserving Back-Propagation Learning Made Practical with Cloud Computing. In Security and Privacy in Communication Networks: 8th International ICST Conference, SecureComm 2012, Padua, Italy, September 35, 2012. Revised Selected Papers. Springer Berlin Heidelberg, Berlin, Heidelberg, 292–309.
CONCLUSION AND FUTURE WORK
In this paper, we developed new solutions for running neural network algorithms over encrypted data. In order to implement neural networks within limitations of homomorphic encryption schemes, we introduced new techniques to approximate activation functions with low degree polynomials. Our results show that polynomials, if chosen properly, are suitable replacements for activation functions to adopt neural networks within homomorphic encryption schemes limitations. Our proposed approach provides accurate and privacy-preserving training and classification and outperforms
43
