Fully homomorphic encryption (FHE) is a powerful cryptographic technique that enables computation on encrypted data without needing to decrypt it. It has broad applications in scenarios where sensitive data needs to be processed in the cloud or in other untrusted environments. FHE applications are both compute- and memory-intensive, owing to expensive operations on large data. While prior works address the challenges of efficient compute using dedicated hardware, expensive memory transfers still remain a major limiting factor. In this work, we propose a hierarchical near-DRAM processing (NDP) solution for FHE applications, called FHENDI, that harnesses the massive DRAM bank bandwidth. We observe various data access patterns in FHE that reveal distinct levels of parallelism: element-wise, limb-wise, coefficient-wise, and ciphertext-wise. FHENDI exploits these levels of parallelism to map FHE operations and data onto different hierarchies of our design, while addressing three major challenges with NDP for FHE: (i) the lack of bank-to-bank communication support, (ii) limited die-to-die bandwidth, and (iii) large memory access latencies. We resolve the first problem through a novel, conflict-free mapping algorithm built atop localized permutation networks that enables efficient element-wise and butterfly operations in FHE. The second problem is addressed by pipelining the execution of parallel bootstrap operations observed in compiled FHE workloads. Finally, we hide the memory access latency behind computation latency by exploiting a dual-banking scheme and subarray-level parallelism (SLP) of the DRAM banks. We evaluate FHENDI using representative workloads in the domains of privacy-preserving machine learning inference on CNNs and Transformers, database range query, and sorting, that are obtained using a compiler framework called HElayers. We compare FHENDI with a server-class CPU and GPU running the state-of-the-art HEaaN library, and an FHE accelerator ASIC, and report mean speedups of $2145.8 \times, 118.29 \times$, and $2.45 \times$, respectively.

Privacy-Preserving Machine Learning (PPML) provides protocols for learning and statistical analysis of data that may be distributed amongst multiple data owners (e.g., hospitals that own proprietary healthcare data), while preserving data privacy. The PPML literature includes protocols for various learning methods, including ridge regression. Ridge regression controls the L2 norm of the model, but does not aim to strictly reduce the number of non-zero coefficients, namely the L0 norm of the model. Reducing the number of non-zero coefficients (a form of feature selection) is important for avoiding overfitting, and for reducing the cost of using learnt models in practice. In this work, we develop a first privacy-preserving protocol for sparse linear regression under L0 constraints. The protocol addresses data contributed by several data owners (e.g., hospitals). Our protocol outsources the bulk of the computation to two non-colluding servers, using homomorphic encryption as a central tool. We provide a rigorous security proof for our protocol, where security is against semi-honest adversaries controlling any number of data owners and at most one server. We implemented our protocol, and evaluated performance with nearly a million samples and up to 40 features.

Range searching is the problem of preprocessing a set of points P, such that given a query range gamma we can efficiently compute some function f(P cap gamma). For example, in a 1 dimensional range counting query, P is a set of numbers, gamma is a segment and we need to count how many numbers of P are in gamma. In higher dimensions, P is a set of d dimensional points and the query range is some volume in R^d. In general, we want to compute more than just counting, for example, the average of P cap gamma. Range searching has applications in databases where some SELECT queries can be translated to range queries. It had received a lot of attention in computational geometry where a data structure called partition tree was shown to solve range queries in time sub-linear in |P| using space only linear in |P|. In this paper we consider partition trees under FHE where we answer range queries without learning the value of the points or the parameters of the range. We show how partition trees can be securely traversed with O(t n^{1-1/d+epsilon} + n^{1+epsilon}) operations, where n=|P|, t is the number of operations needed to compare to gamma and epsilon>0 is a parameter. When the ranges are axis-parallel hyper-boxes the running time is O(t n^epsilon + n log^{d-1} n). As far as we know, this is the first non-trivial bound on range searching under FHE and it improves over the naive solution that needs O(t n) operations. Our algorithms are independent of the encryption scheme but as an example we implemented them using the CKKS FHE scheme. Our experiments show that for databases of sizes 2^{23} and 2^{25}, our algorithms run x2.8 and x4.7 (respectively) faster than the naive algorithm. The improvement of our algorithm comes from a method we call copy-and-recurse. With it we efficiently traverse a r-ary tree (where each inner node has r children) that also has the property that at most xi of them need to be recursed into when traversing the tree. We believe this method is interesting in its own and can be used to improve traversals in other tree-like structures.

Computation delegation to untrusted third-party while maintaining data confidentiality is possible with homomorphic encryption (HE). However, in many cases, the data was encrypted using another cryptographic scheme such as AES-GCM. Hybrid encryption (a.k.a Transciphering) is a technique that allows moving between cryptosystems, which currently has two main drawbacks: 1) lack of standardization or bad performance of symmetric decryption under FHE; 2) lack of input data integrity.

Outsourcing computations over sensitive data to a third-party cloud environment should often rely on dedicated privacy-preserving solutions in order to adhere to privacy regulations such as the GDPR [7]. One solution that gained great attention is fully homomorphic encryption (FHE), a cryptographic method that allows performing different types of computation on encrypted data. Still, writing a non-interactive FHE code that evaluates complex functions is a task that is mostly left to experts. Otherwise, the resulted code may become very slow and even impractical.

With the development of sequencing technologies, viral strain classification - which is critical for many applications, including disease monitoring and control - has become widely deployed. Typically, a lab (client) holds a viral sequence, and requests classification services from a centralized repository of labeled viral sequences (server). However, such “classification as a service” raises privacy concerns. In this paper we propose a privacy-preserving viral strain classification protocol that allows the client to obtain classification services from the server, while maintaining complete privacy of the client's viral strains. The privacy guarantee is against active servers, and the correctness guarantee is against passive ones. We implemented our protocol and performed extensive benchmarks, showing that it obtains almost perfect accuracy (99.8%-100%) and microAUC (0.999), and high efficiency (amortized per-sequence client and server runtimes of 4.95ms and 0.53ms, respectively, and 0.21MB communication). In addition, we present an extension of our protocol that guarantees server privacy against passive clients, and provide an empirical evaluation showing that this extension provides the same high accuracy and microAUC, with amortized per sequences overhead of only a few milliseconds in client and server runtime, and 0.3MB in communication complexity. Along the way, we develop an enhanced packing technique in which two reals are packed in a single complex number, with support for homomorphic inner products of vectors of ciphertexts. We note that while similar packing techniques were used before, they only supported additions and multiplication by constants.

Privacy-preserving solutions enable companies to offload confidential data to third-party services while fulfilling their government regulations. To accomplish this, they leverage various cryptographic techniques such as Homomorphic Encryption (HE), which allows performing computation on encrypted data. Most HE schemes work in a SIMD fashion, and the data packing method can dramatically affect the running time and memory costs. Finding a packing method that leads to an optimal performant implementation is a hard task. We present a simple and intuitive framework that abstracts the packing decision for the user. We explain its underlying data structures and optimizer, and propose a novel algorithm for performing 2D convolution operations. We used this framework to implement an inference operation over an encrypted HE-friendly AlexNet neural network with large inputs, which runs in around five minutes, several orders of magnitude faster than other state-of-the-art non-interactive HE solutions.

Abstract The k-nearest neighbors (kNN) classifier predicts a class of a query, q, by taking the majority class of its k neighbors in an existing (already classified) database, S. In secure kNN, q and S are owned by two different parties and q is classified without sharing data. In this work we present a classifier based on kNN, that is more efficient to implement with homomorphic encryption (HE). The efficiency of our classifier comes from a relaxation we make to consider κ nearest neighbors for κ ≈k with probability that increases as the statistical distance between Gaussian and the distribution of the distances from q to S decreases. We call our classifier k-ish Nearest Neighbors (k-ish NN). For the implementation we introduce double-blinded coin-toss where the bias and output of the toss are encrypted. We use it to approximate the average and variance of the distances from q to S in a scalable circuit whose depth is independent of |S|. We believe these to be of independent interest. We implemented our classifier in an open source library based on HElib and tested it on a breast tumor database. Our classifier has accuracy and running time comparable to current state of the art (non-HE) MPC solution that have better running time but worse communication complexity. It also has communication complexity similar to naive HE implementation that have worse running time.

We consider the secure search problem of retrieving from an unsorted data cost=(x_1,...,xm) an item (i,xi) matching a given lookup value l (for a generic matching criterion either hardcoded or given as part of the query), where both input and output are encrypted by a Fully Homomorphic Encryption (FHE). The secure search problem is central in applications of secure outsourcing to an untrusted party ("the cloud"). Prior secure search algorithms on FHE encrypted data are realized by polynomials of degree Ømega(m), evaluated in Ømega(log m) sequential homomorphic multiplication steps (ie., multiplicative depth) even using an unbounded number of parallel processors. This is too slow with current FHE implementations, especially as the size of the array grows. We present the first secure search algorithm that is realized by a polynomial of logarithmic degree, log3 m, evaluated in O(log log m) sequential homomorphic multiplication steps (ie., multiplicative depth) using m parallel processors. We implemented our algorithm in an open source library based on HElib and ran experiments on Amazon's EC2 cloud with up to 100 processors. Our experiments show that we can securely search in m= millions of entries in less than an hour on a standard EC2 64-cores machine. We achieve our result by: (1) Employing modern data summarization techniques known as sketching for returning as output (the encryption of) a short sketch C from which the matching item (i,xi) can be decoded in time polynomial in log m. (2) Designing for this purpose a novel sketch that returns the first strictly-positive entry in a (not necessarily sparse) array of non-negative integers; this sketch may be of independent interest. (3) Suggesting a multi-ring evaluation of FHE for degree reduction from linear to logarithmic.

In a typical range-emptiness searching (resp., reporting) problem, we are given a set P of n points in $\mathbb{R}^d$, and we wish to preprocess it into a data structure that supports efficient range-emptiness (resp., reporting) queries, in which we specify a range $\sigma$, which, in general, is a semialgebraic set in $\mathbb{R}^d$ of constant description complexity, and we wish to determine whether $P\cap\sigma=\emptyset$, or to report all the points in $P\cap\sigma$. Range-emptiness searching and reporting arise in many applications and have been treated by Matoušek [Comput. Geom. Theory Appl., 2 (1992), pp. 169–186] in the special case where the ranges are half-spaces bounded by hyperplanes. As shown in Matoušek's work, the two problems are closely related, and they have solutions (for the case of half-spaces) with similar performance bounds. In this paper we extend the analysis to general semialgebraic ranges and show how to adapt Matoušek's technique without the need to linearize the ranges into a higher-dimensional space. This yields more efficient solutions to several useful problems, and we demonstrate the new technique in four applications with the following results: (i) An algorithm for ray shooting amid balls in $\mathbb{R}^3$, which uses $O(n)$ storage and $O^*(n)$ preprocessing (we use the notation $O^*(n^\gamma)$ to mean an upper bound of the form $C(\varepsilon)n^{\gamma+\varepsilon}$, which holds for any $\varepsilon>0$, where $C(\varepsilon)$ is a constant that depends on $\varepsilon$) and answers a query in $O^*(n^{2/3})$ time, improving the previous bound of $O^*(n^{3/4})$. (ii) An algorithm that preprocesses, in $O^*(n)$ time, a set P of n points in $\mathbb{R}^3$ into a data structure with $O(n)$ storage, so that, for any query line $\ell$ (or, for that matter, any simply shaped convex set), the point of P farthest from $\ell$ can be computed in $O^*(n^{1/2})$ time. This in turn yields an algorithm that computes the largest-area triangle spanned by P in time $O^*(n^{26/11})$, as well as nontrivial algorithms for computing the largest-perimeter or largest-height triangle spanned by P. (iii) An algorithm that preprocesses, in $O^*(n)$ time, a set P of n points in $\mathbb{R}^2$ into a data structure with $O(n)$ storage, so that, for any query $\alpha$-fat triangle $\Delta$, we can determine, in $O^*(1)$ time, whether $\Delta\cap P$ is empty. Alternatively, we can report, in $O^*(1)+O(k)$ time, the points of $\Delta\cap P$, where $k=|\Delta\cap P|$. (iv) An algorithm that preprocesses, in $O^*(n)$ time, a set P of n points in $\mathbb{R}^2$ into a data structure with $O(n)$ storage, so that, given any query semidisk c, or a circular cap larger than a semidisk, we can determine, in $O^*(1)$ time, whether $c\cap P$ is empty, or report the k points in $c\cap P$ in $O^*(1)+O(k)$ time. Adapting the recent techniques of [B. Aronov and S. Har-Peled, SIAM J. Comput., 38 (2008), pp. 899–921, B. Aronov, S. Har-Peled, and M. Sharir, On approximate halfspace range counting and relative epsilon-approximations, in Proceedings of the 23rd ACM Symposium Comput. Geom., 2007, pp. 327–336, B. Aronov and M. Sharir, SIAM J. Comput., 39 (2010), pp. 2704–2725], we can turn our solutions into efficient algorithms for approximate range counting (with small relative error) for the cases mentioned above. Our technique is closely related to the notions of nearest- or farthest-neighbor generalized Voronoi diagrams and of the union or intersection of geometric objects, where sharper bounds on the combinatorial complexity of (decompositions of complements of) these structures yield faster range-emptiness searching or reporting algorithms.

We present new results concerning the refinement of three-dimensional arrangements by vertical decompositions. First, we describe a new output-sensitive algorithm for computing the vertical decomposition of arrangements of n triangles in O(nlog2 n+Vlog n) time, where V is the complexity of the decomposition. This improves significantly over the best previously known algorithms. Next, we propose an alternative sparser refinement, which we call the partial vertical decomposition and has the advantages that it produces fewer cells and requires lower degree constructors. We adapt the output-sensitive algorithm to efficiently compute the partial decomposition as well. We implemented algorithms that construct the full and the partial decompositions and we compare the two types theoretically and experimentally. The improved output-sensitive construction extends to the case of arrangements of n well-behaved surfaces with the same asymptotic running time. We also extended the implementation to the case of polyhedral surfaces---this can serve as the basis for robust implementation of approximations of arrangements of general surfaces.