WO2025159697A1

WO2025159697A1 - Method and system for secure training of neural network

Info

Publication number: WO2025159697A1
Application number: PCT/SG2025/050055
Authority: WO
Inventors: Kwok Yan Lam; Huaxiong WANG; Xianhui LU; Linru ZHANG; Xiangning Wang
Original assignee: Nanyang Technological University
Current assignee: Nanyang Technological University
Priority date: 2024-01-23
Filing date: 2025-01-23
Publication date: 2025-07-31
Anticipated expiration: 2026-07-23

Abstract

Method and System for Secure Training of Neural Network The present invention relates to a computer-implemented method for secure training of a neural network, comprising receiving a label and an encrypted input from a client, performing homomorphic computations on the encrypted input using the neural network to obtain an encrypted intermediate ciphertext, providing the encrypted intermediate ciphertext to the client, receiving a non- sensitive decrypted input from the client, wherein the non-sensitive decrypted input corresponds to a decryption of the encrypted intermediate ciphertext, performing computations on the non-sensitive decrypted input using the neural network to obtain a decrypted output, and updating weights of the neural network based on the decrypted output.

Description

Method and System for Secure Training of Neural Network

Technical Field

The present invention relates, in general terms, to a method and system for secure training of a neural network. In particular, the present invention provides a system and method for performing neural network evaluations on encrypted data while preserving data privacy.

Background

This background is provided for generally presenting the context of the disclosure. The reference in this specification to any prior publication (or information derived from it), or to any matter which is known, is not, and should not be taken as an acknowledgment or admission or any form of suggestion that that prior publication (or information derived from it) or known matter forms part of the prior art base or common general knowledge in the field of endeavour to which this specification relates.

Machine learning as a service has shown numerous potential applications in the real world. Implementation of machine learning services typically involves training and inference phases performed on a machine learning model, often a neural network. Neural network training and inferences are usually considered computationally expensive, yet many users do not have sufficiently powerful computing resources to make training convenient or time and cost effective. Therefore, commercial machine learning service providers prefer to put neural network training into the cloud.

Issues arise when training a neural network in the cloud, particularly that data privacy is often compromised. Traditional neural networks train and infer on raw, unencrypted data. For some data types, such as medical records, it is not permissible to send raw data and thus such traditional training methods cannot be used. More recently, privacy-preserving neural networks have been utilised to address privacy issues in 'artificial intelligence (Al) as a service' products. With such networks, a user will encrypt data before sending it to the cloud server. The cloud server then performs neural network evaluations on encrypted data and outputs an encrypted prediction result.

While inference may be privacy preserving, the training phase still typically employs an optimization algorithm for network parameter optimization, that uses a training data comprising users' raw, unencrypted data.

It is desirable therefore that there be provided a system and method for neural network training and inference, that is computationally efficient while preserving privacy.

Summary

In view of the abovementioned privacy issues, proposed herein is a practical privacy-preserving training scheme, that enables fast and accurate training over encrypted data. The training scheme employs homomorphic encryption, and a combination of encryption and decryption of user data, based on the sensitivity of that data. The present training scheme significantly reduces training latency while protecting privacy of sensitive data.

Disclosed herein is a computer implemented method for secure training of a neural network. The method involves receiving a label and an encrypted input from a client. Thus, privacy in the first instance is preserved over the entire input. Homomorphic computations are then performed on the encrypted input using the neural network to obtain an encrypted intermediate ciphertext. The encrypted intermediate ciphertext is returned to the client. The client then supplies a non-sensitive decrypted input corresponding to a decryption of the encrypted intermediate ciphertext. This provides non-sensitive raw data that can be used to update network parameters, while sensitive data remains encrypted. Computations are then performed on the non-sensitive decrypted input using the neural network to obtain a decrypted output, and the weights of the neural network are updated based on the decrypted output. As used herein, the term "homomorphic computations" refers to inference (i.e., operation on an input) by a neural network layer or layers on a homomorphically encrypted input. Similarly, the term "computations" refers to inference by a neural network layer or layers on a plaintext or decrypted input.

Also disclosed herein is a computer-implemented method for secure training of a neural network. Being performed on a computer, steps of the method are thus implemented in software, firmware or hardware, or a combination thereof. To that end, the computer-implemented method involves generating, at a client terminal, an encrypted input from a decrypted input. The encrypted input and a corresponding label are then transmitted to a server. Homomorphic computations are then performed, at the server, on the encrypted input using the neural network to obtain an encrypted intermediate ciphertext. The client is provided the encrypted intermediate ciphertext and generates a non-sensitive decrypted input corresponding to a decryption of the encrypted intermediate ciphertext. The client then transmits the non-sensitive decrypted input to the server that then performs computations on the non-sensitive decrypted input using the neural network to obtain a decrypted output. Weights of the neural network are then updated based on the decrypted output.

The non-sensitive decrypted input may be a decryption of encrypted gradients derived from the encrypted intermediate ciphertext. To that end, the client derives encrypted gradients from the encrypted intermediate ciphertext, and generates decrypted gradients from the encrypted gradients. The non-sensitive decrypted input comprises the decrypted gradients.

Homomorphic computations may be performed on the encrypted input by applying a first linear function to the encrypted input to produce the encrypted intermediate ciphertext. In such embodiments, the non-sensitive decrypted input may be an output of an activation function applied to a decryption of the encrypted intermediate ciphertext. Thus, the client decrypts the encrypted intermediate ciphertext to produce a decrypted intermediated ciphertext, and applies the activation function to the decrypted intermediated ciphertext to produce an output. The non-sensitive decrypted input comprises the output. The activation function may include multiple sign functions or multiple step functions.

Weights of the neural network can be updated based on the decrypted output by evaluating, at the server, a loss function based on the decrypted output and the label. This can involve, for example, evaluating gradients of the loss function and weights of the neural network at both the server and client, and updating the weights based on the evaluation.

Also disclosed herein is a system for secure training of a neural network, comprising: a processor; a memory storing a plurality of modules, the modules comprising: a pre-processing module configured to receive a label and an encrypted input from a client; a homomorphic module configured to perform homomorphic computations on the encrypted input using the neural network to obtain an encrypted intermediate ciphertext and provide the encrypted intermediate ciphertext to the client; a client level computation module configured to receive a nonsensitive decrypted input from the client, wherein the nonsensitive decrypted input corresponds to a decryption of the encrypted intermediate ciphertext and perform computations on the non-sensitive decrypted input using the neural network to obtain a decrypted output; and an output module configured to update weights of the neural network based on the decrypted output.

Also disclosed herein is a system for secure training of a neural network, comprising: a processor; a memory storing a plurality of modules, the modules comprising: a client level pre-processing module configured to generate an encrypted input from a decrypted input at a client terminal and to transmit the encrypted input and a corresponding label to a server; a homomorphic module configured to perform homomorphic computations on the encrypted input at the server using the neural network to obtain an encrypted intermediate ciphertext, and providing the encrypted intermediate ciphertext to the client; a client level computation module configured to generate a nonsensitive decrypted input corresponding to a decryption of the encrypted intermediate ciphertext, and transmitting the nonsensitive decrypted input to the server; performing, at the server, computations on the non-sensitive decrypted input using the neural network to obtain a decrypted output; and an output module configured to update weights of the neural network based on the decrypted output.

Advantageously, embodiments of the invention provide a hybrid training protocol, whereby encrypted sensitive and non-sensitive information and decrypted, non-sensitive information, are used for training a cloud-based neural network with low latency while preserving privacy of sensitive information.

Brief description of the drawings

Some embodiments of the present invention will now be described, by way of non-limiting example, with reference to the drawings in which :

Figure 1 is a flowchart of a method for secure training of neural network, according to an embodiment of the present invention;

Figure 2 depicts a schematic block diagram of a system for secure training of neural network, according to an embodiment of the present invention;

Figures 3a to 3d depict schematic diagrams of a system for secure training of neural network, according to an embodiment of the present invention;

Figure 4 is a bar chart illustrating number of useful equations after activation function in an experiment, according to an embodiment of the present invention; Figures 5a and 5b are line graphs illustrating examples of a 3-step function and a 5-step function, according to an embodiment of the present invention;

Figure 6 illustrates the ten classes in CIFAR-10 dataset and random images from each class, as used in an embodiment of the present invention;

Figure 7 illustrates a convolutional neural network with 3 convolution layers, according to an embodiment of the present invention; and

Figure 8 illustrates how transfer learning is applied in privacy-preserving facial recognition network training.

Detailed description

Disclosed herein are methods for training a neural network, using homomorphic encryption. When adopting homomorphic encryption (HE) is applied in the field of neural network training, efficiency is a significant concern. Homomorphic computations over encrypted data are much slower than computations on nonencrypted data. For this reason, traditional training methods over large datasets have been primarily conducted using raw (unencrypted) data.

With current HE techniques, if the whole network is trained in ciphertext, which means that an encrypted input is uploaded to the cloud server at the outset, and the server performs both forward propagation and backward propagation on the encrypted data without decryption, training is too slow to be practical.

The methods disclosed herein employ a hybrid HE-based training model. Deep neural network training is split between a ciphertext training phase (encrypted input) and a plaintext training phase (unencrypted or decrypted input). In this model, when the cloud server receives the encrypted sensitive input, it first performs some expensive homomorphic computations on the encrypted input and obtains an encrypted non-sensitive intermediate result. The cloud server asks the client to decrypt the intermediate result, and the remaining training is performed in non-sensitive plaintext. The hybrid-HE method combines the privacy preservation of homomorphic encryption and training, with the speed of training on unencrypted data. Figure 1 provides the workflow of an example training method 100 for secure training of a neural network. As with all neural network training methods, method 100 is necessarily computer-implemented.

According to step 102 of the method 100, a client terminal generates an encrypted input from a decrypted input. The client terminal may also obtain or generate a label for the decrypted input - the label is also necessarily true for the encrypted input. The label specifies the ground truth. For example, in a training dataset for a neural network being trained to categorise or label images based on objects in those images, the label corresponding to an input image (decrypted input) may identify the object shown in that image.

The client then transmits the encrypted input and a corresponding label to a server, per step 104, the server then applying the neural network to the encrypted input, per step 106. The neural network applies homomorphic computations on the encrypted data, to obtain an encrypted intermediate ciphertext. Since the computations are homomorphic, the intermediate ciphertext is an encryption of the output of the same computations when applied to the corresponding plaintext - i.e., the input prior to encryption.

The client receives the encrypted intermediate ciphertext per step 108 and generates a non-sensitive decrypted input at step 110. The non-sensitive, decrypted input is, or corresponds to, a decryption of the encrypted intermediate ciphertext. The non-sensitive decrypted input is then transmitted to the server per step 112.

Per step 114, the server performs computations on the non-sensitive, decrypted input (i.e., non-sensitive plaintext input) to obtain a decrypted output. The decrypted output is then used to update weights of the neural network, per step 116.

In general, a single party will operate the server and interact with multiple clients. To that end, from the perspective of the server, the method 100 involves the server receiving a label and an encrypted input from a client (per step 104) and performing homomorphic computations on the encrypted input using the neural network to obtain the encrypted intermediate ciphertext (per step 106). The server then provides the encrypted intermediate ciphertext to the client (per step 108) and receives the non-sensitive decrypted input from the client (per step 112). The server subsequently performs computations per step 114, to obtain the decrypted output and the weights of the neural network are updated per step 116.

The training algorithm corresponding to method 100 is set out and discussed in greater detail, below (see Algorithm 1). The training procedure for one sample (or one batch) is divided into two parts (Si(-), S>(-)).

In Algorithm 1 Enc(data) and Dec(data) refer to encryption and decryption of "data", respectively, x is the raw training data, x_t is the intermediate result, and Si and S2 are functions for evaluating the homomorphically encrypted input and plaintext input, respectively.

In this training model, the client knows no information of the neural network. This helps to preserve the privacy of the cloud server. Conversely, the cloud server only knows the non-sensitive intermediate resultxi at any stage during training. The server never knows the sensitive raw training data x. This helps to preserve the privacy of the client's data. Because the training is in the cloud server, using plaintext computations after the intermediate result means that the cloud server is able to learn some information about the training dataset. Therefore, in this model, careful design of the system and analysis of privacy leakage can be useful to ensure protection of the client's input.

Further, the hybrid HE-based training model is able to train deeper models. While existing works are able to train shallow networks if the data is encrypted, this model can apply training to deeper models in a much shorter time period. This is due to the first function Si being applied to the homomorphically encrypted input, and all other functions (only S₂ is mentioned above, though similar functions for subsequent neural network layers can be used) operate on decrypted plaintext or the result of processing of decrypted plaintext. Thus, all but the first function train in a standard manner, per traditional neural network training on unencrypted data.

A neural network can be considered as population of artificial neurons arranged in layers. Each layer receives the data generated by its previous layer and outputs the processed data for the next layer. Such a structure allows higher- level, abstract features to be represented as lower-level features through nonlinear function computation at each layer.

The raw data is encoded properly and fed into the input layer of a neural network Then these features from the input data are gradually mapped to higher-level abstractions via iterative update (forward propagation and backward propagation) in the hidden layers until the convergence condition is achieved. These mapping abstractions, also known as learned neural network model or neural weights, can be used to perform inference tasks.

Training of a neural network includes forward propagation and backward propagation. In forward propagation, the input data goes through all layers consecutively in the forward direction. At each neuron layer I, the processing happens in two steps: • Linear function: It is a weighted sum of inputs, which can be described as γ_l =

• Activation function: The calculated weighted sum is passed to the activation function. An activation function is a mathematical function which adds nonlinearity to the network. There are some commonly used activation functions: Sigmoid, ReLu and Softmax. It can be described as x_l

W] is the edge weight matrix connecting layer I - 1 and l, β _l is the bias vector of layer I. Let x_l be the output vector of layer I, and let f₁ be the activation function in layer I. The input layer is set to be layer 0 and let . Let x₀ be the input to the neural network.

The process of moving from output layer to the input layer is called backward propagation. Backward propagation is the preferable method to adjusting or correcting the weights to minimize the loss function - i.e., the function describing the distance or error between the output of the neural network and the true value that the neural network is trying to achieve. This is a non-linear optimization problem, which is typically solved using variants of gradient descent. The processing happens in two steps:

• Derivative computation. It computes the partial derivatives of the loss function L at each layer matrix W_l, which can be described as and for simplicity notation is defined. Similarly, is defined.

• Parameters update. It updates the weights according to the derivatives and learning rate a, which can be described as _f where is the updated weights for layer I. Similarly, bias vector is updated by

Framework

In this section, three schemes are proposed according to various embodiments of the present invention, each offering varying levels of efficiency and privacy preservation. The proposed scheme can be applied to neural networks of any depth, including convolutional neural networks, as the evaluation of convolutional layers consists of linear computations that can be represented as linear transformations.

For the sake of clarity, the schemes are illustrated using a fully connected neural network with one hidden layer, consisting of an input layer, a hidden layer, and an output layer. The input layer is composed of L nodes, the hidden layer contains H hidden nodes, and the output layer consists of c nodes. The weight matrices and bias vectors in this neural network are (W_1,W₂, β₂) . The activation function in hidden nodes is f₁(-), e.g., ReLU(.). The activation function in output nodes is f₂( .) e.g., sigmoid (•). Let L(•-•) be the loss function of the neural network. It takes the output of neural network and the true label as input. Its input includes the neural network output vector and the goal vector.

For simplicity of notations, encrypted ciphertext are underlined in these schemes. Their decrypted counterparts use the same notation but without the underline: for example, where x refers to encrypted data, x refers to the decrypted version of that data. In the schemes, all training samples are labelled and stored in set X = {(x^(t),y^(t))}. Training samples are encrypted, therefore in the model the user holds {(x^(t),y^(t))} and the server holds {(x^(t)y^(t))} or {(x^(t\y^(t))} depending on different schemes.

Scheme 1 : Decrypt after evaluating gradients

To compare the present hybrid training model with other models, set out below are three schemes, each with different efficiency and privacy-preserving level. In Scheme 1 (Algorithm 2), the server homomorphically performs the forward propagation, and evaluates the loss function. After homomorphically computing gradients, the server will return the ciphertexts to the user. User decrypts the gradients and returns them to the server. Finally, the server updates the neural network parameters. 3. for t = 1, ... , m do

4. Set

5. The server homomorphically evaluates

6. The server homomorphically evaluates activation function

7. The server homomorphically evaluates

8. The server homomorphically evaluates activation function

For n-layer neural networks, repeating steps 7 and 8 with input W ₃, .... W_n. β₃, . .. , β_n and f₃' ...,f_n.

9. The server homomorphically evaluates loss function

10. The server homomorphically evaluates gradients:

11. end for

12. Server sends to user.

13. User decrypts and returns to server.

14. Server updates neural network parameters and returns

In this scheme, the user does not know the training methods, such as choice of loss function, activation function and learning rate. The server does not know the output of each layer and the true label of input data. However, there are lots of homomorphic non-linear function computations and ciphertext x ciphertext computations, both of which are expensive and inefficient. Therefore, this scheme is good at privacy-preserving but it is inefficient. Scheme 2: Decrypt after evaluating the first linear function.

In Scheme 2, the server homomorphically evaluates the first linear function y_l = lftx₀ + ft in the forward propagation. Then the server sends y₁ to the user, and user decrypts it, then returns y_l to the server. Finally, the server performs subsequent steps on plaintext input.

I. Input: Current neural network parameters (W₁, W₂ , β₁, β₂), activation functions loss function , batch size m, m encry pted input and their labels , learning rate α.

2 Output: Updated neural networks parameters

3. for t = 1, ... , m do

4. Set

5. The server homomorphically evaluate

6. Tire server sends to tire user.

7. The user decrypts and sends y₁ to the server.

8. The server evaluates activation function x₁ =

9. The server evaluates y₁ = W₃x₁ + β₂.

10. The server evaluates activation function x₂ = f₂(y₂).

For n-layer neural networks, repeating steps 8 and 9 with input W₃, ..., W_n, β₃, ..., β_n and A' -’fn-

I I . The server evaluates loss function

12. The server evaluates gradients:

Unlike in Scheme 1, here the evaluation of needs to know while server only knows its encryption , server computes the other parts first and asks user's help to get . 13. end for

14. Server sends to user.

15. User computes and returns to server.

16. Server updates neural network parameters and returns

In this scheme, the user does not know the training methods, such as the choice of loss function, activation function and learning rate. The server will know the output of the first inner-product layer and the true label of input data. Homomorphic evaluations only include linear computation, which is much cheaper than non-linear evaluations. Therefore, this scheme is efficient but not very good at privacy preserving.

Scheme 3: User evaluate first activation function

Scheme 3 is an example of an embodiment of the present invention. In Scheme 3 (Algorithm 4), the server homomorphically evaluates the first linear function in the forward propagation process (step 106). Then, the server sends to the client (step 108), and client decrypts it, then returns f₁(γ₁) to the server (as per steps 110 and 112). Scheme 3 is very similar to Scheme 2, except that the client returns f₁(γ₁) instead of Yi to the server. In this scheme, the user knows the activation function f₁(. ). 8. The server evaluates y₂ = W₂x₁ + β₂.

9. The server evaluates activation function x₂ = f₂(y₂).

For n-layer neural networks, repeating steps 8 and 9 with input W₃, W_n, β₃, ... , β_n and

The server evaluates loss function

The server evaluates gradients:

Unlike in Scheme 1, here the evaluation of needs to know while server only knows its encryption So, server computes the other parts first and asks user's help to get

12. end for

13. Server sends to user.

14. User computes and returns t° server.

15. Server updates neural network parameters and returns

As shown in Scheme 3 (Algorithm 4), the server receives encrypted input and their lab els from a client as per step 104 of method 100.

Prior to that, the client had generated the encrypted input at client terminal or at client level as per step 102. Then, as per step 106, the server performs homomorphic computations on the encrypted input using the neural network in its forward propagation step. This step obtains an encrypted intermediate ciphertext which is the weighted sum of inputs, and can be described as Performing homomorphic computations on the encrypted input comprises applying a first linear function to the encrypted input to produce the encrypted intermediate ciphertext . Moreover, the neural network of the present embodiment comprises two trainable layers. Other embodiments include a greater number of layers. The homomorphic computations are performed using a first set of layers of the neural network - in general, the first set of layers will be a single, first trainable layer (i.e., a layer with trainable weights) of the neural network.

The server then provides the encrypted intermediate ciphertext to the client as per step 108. Then, as per step 110, the client decrypts the ciphertext and generates a non-sensitive decrypted input The non-sensitive decrypted input is produced by applying an activation function to the non-sensitive decrypted, described by x₁ In some embodiments, the output of the activation function, non-sensitive decrypted input x_lf comprises a decryption of encrypted gradients derived from the encrypted intermediate ciphertext

The client then sends the non-sensitive decrypted input x₁ to the server as per step 112. As per step 114, the server computes a decrypted output from the non-sensitive decrypted input x₁ by evaluating y₂ = w₂x₁ + β₂ and evaluates the output of the activation function of the second layer, x₂ = f₂(y₂ ) For n- layer neural networks, the server repeatedly evaluates inputs y₃, y_n and the outputs of the activation functions, x₃, x_n . In other words, the neural network includes the first set of layers followed by (i.e., sequentially, where no layer of one set is included in the other set) the second set of layers, such that the homomorphic computations occur first (during training and, later, during normal runtime on new data), in the first set of layers, and the computations on decrypted data occur thereafter, in the second set of layers. In some embodiments, the neural network includes more than two sets of layers, or more than two layers where each set includes a single layer only. In such embodiments, each further set of layers receives the output of the second set of layers or a further set of layers that is earlier in the sequence. To illustrate, where there is one layer per set of layers, the first layer operates on encrypted data, the second layer operates on decrypted data, the first further layer operates on the output of the second layer and, if there are any additional further layers, they each operate in sequence on the output of the immediately preceding further layer. Thus, all layers but for the first layer operate on decrypted data or the result of one or more operations on decrypted data. The server then proceeds to evaluate loss function, gradients, and updating weights of the neural network based on the decrypted output (step 116).

In an embodiment of the present invention, as disclosed in scheme 3, the server will know the output of first layer and the true labels of input data. During the training phase, true labels are not considered to be a big privacy problem, since in the training dataset the input is usually uniformly distributed over all classes. So, knowledge of the ground truth does not generally give away much, or any, information about the input. Similar to scheme 2, scheme 3 is very efficient since all ciphertext evaluations are linear, and training on all but one layer of the neural network is conducted over plaintext. Moreover, the activation function in Scheme 3 helps protect the information in the input data. Therefore, Scheme 3 can achieve better privacy-preservation than scheme 2, while having high efficiency.

The flow of the 3 schemes is summarised in Table 1 below. Parameters in handwriting number recognition on MNIST dataset as an example. Size of training dataset is 60000. Length of input is 784. Number of hidden nodes is 30. Number of classes is 10. Number of training epochs is 5.

Table 1 : Flow comparison of 3 schemes

In many practical cases, clients do not have very powerful computing resources.

Therefore, computations at client level should be minimised. The computations in Scheme 3 are slightly more than Scheme 2 but the extra computations are performed on plaintext, which makes the extra computations economical.

Table 2: Performance comparison of 3 schemes

Figure 2 depicts a schematic block diagram of a system 200 for secure training of a neural network according to an embodiment of the present invention, corresponding to the above-mentioned method 100. The system 200 comprises: at least one memory 202; and at least one processor 204 communicatively coupled to the at least one memory 202 and configured to perform the method 100.

It will be appreciated by a person skilled in the art that the at least one processor 204 may be configured to perform various functions or operations through set(s) of instructions (e.g., software modules) executable by the at least one processor 204 to perform various functions or operations. Accordingly, as shown in Figure 2, the system 200 comprises a memory 202 for storing a plurality of modules, the modules comprising: a pre-processing module 206 configured to receive a label and an encrypted input from a client; a homomorphic module 208 configured to perform homomorphic computations on the encrypted input using the neural network to obtain an encrypted intermediate ciphertext and provide the encrypted intermediate ciphertext to the client; a client level computation module 210 configured to receive a non-sensitive decrypted input from the client, wherein the non-sensitive decrypted input corresponds to a decryption of the encrypted intermediate ciphertext and perform computations on the non-sensitive decrypted input using the neural network to obtain a decrypted output; and an output module 210 configured to update weights of the neural network based on the decrypted output.

It will be appreciated by a person skilled in the art that the above-mentioned modules are not necessarily separate modules, and two or more modules may be realized by or implemented as one functional module (e.g., a circuit or a software program) as desired or as appropriate without deviating from the scope of the present invention. For example, two or more of the pre-processing module 206, the homomorphic module 208, the client level computation module 210, and the output module 212, may be realized (e.g., compiled together) as one executable software program (e.g., software application), which for example may be stored in the at least one memory 202 and executable by the at least one processor 204 to perform the corresponding functions or operations as described herein according to various embodiments.

Various embodiments described herein in context of methods (e.g., the method 100 of secure training of neural network) are analogously valid for the corresponding systems or devices (e.g., the system 200 for secure training of neural network), and vice versa. For example, in various embodiments, the at least one memory 202 may have stored therein the pre-processing module 206, the homomorphic module 208, the client level computation module 210, and the output module 212, which respectively perform the various operations, functions or steps of the method 100 described above, under operation of the processor.

Figure 3a to 3d depict schematic diagrams of a system for secure training of neural network, according to an embodiment of the present invention. According to step 102 of the method 100, a client terminal generates an encrypted input 302 from a decrypted input. The client terminal may also obtain or generate a label for the decrypted input - the label is also necessarily true for the encrypted input. The label specifies the ground truth. For example, in a training dataset for a neural network being trained to categorise or label images based on objects in those images, the label corresponding to an input image (decrypted input) may identify the object shown in that image.

As shown in Figure 3b, the client then transmits the encrypted input 302 and a corresponding label to a server, per step 104, the server then applying the neural network to the encrypted input, per step 106. The neural network applies homomorphic computations on the encrypted data, to obtain an encrypted intermediate ciphertext 304. Since the computations are homomorphic, the intermediate ciphertext is an encryption of the output of the same computations when applied to the corresponding plaintext - i.e., the input prior to encryption. The client receives the encrypted intermediate ciphertext per step 108 and generates a non-sensitive decrypted input (306) at step 110. The non-sensitive, decrypted input is, or corresponds to, a decryption of the encrypted intermediate ciphertext. The non-sensitive decrypted input is then transmitted to the server per step 112.

Per step 114, as shown in Figure 3d, the server performs computations on the non-sensitive, decrypted input (i.e., non-sensitive plaintext input) to obtain a decrypted output 308. The decrypted output 308 is then used to update weights of the neural network, per step 116.

Homomorphic encryption scheme

According to an embodiment of the present invention, the method 100 uses learning with error (LWE)-based secret key encryption scheme (Algorithm 5) and related computations (Algorithm 6 and Algorithm 7).

The learning with errors (LWE) problem is a generalization of learning parity with noise. For positive integers n and q > 2, a vector and a probability distribution x = Xⁿ over let be the distribution obtained by choosing a vector a uniformly at random and a noise term , and outputting . The LWE problem is defined as follows.

For an integer q = q(n) and an error distribution , the LWE problem LWE_{n m,q,x} is defined as: Given m independent samples from output s with non-negligible probability.

The decisional version is to distinguish between m samples chosen according to for some uniformly random s and m samples from the uniform distribution over for i = 1, , L do

Parse from ct. a' = a' + c_ia_i, b^! = b^! + c_ib' . end for a' = a' mod q. b' = b' mod q.

Return (a', b ').

Privacy analysis

In the interactive training scheme, it has been discussed that the server aims to recover the input vector x from the information obtained by the server during training. It is assumed that the cloud server is honest-but-curious, and the analysis focuses on the cryptographic aspect.

A fully connected neural network with one hidden layer is again used as an illustrative example: (W_ltW₂, β₂, . The input layer has L nodes, the hidden layer has H nodes and the output layer has C classes (nodes). The problem is considered to be in IK. In Scheme 2 and Algorithm 3, the information obtained by the server is a set of linear equations; while in Scheme 3 and Algorithm 4, the information obtained by the server is a set of equations composed by inner-product and activation /i( ).

In forward propagation, for a fixed input x, the number of equations the server can obtain from one forward propagation is H, i.e., the number of hidden nodes. This is because in each hidden node, an inner product is calculated between a weight vector from Wi and the input x, then the activation function f1( .) Suppose there are a total of E training epochs. Since each input is used only once in one epoch, it is concluded that the total number of equations the server can obtain is T : = Hx E.

Privacy analysis of Scheme 2 In Scheme 2, the T equations the server can obtain from training are all linear equations. For a fixed input , the T equations together is combined to be Ax = b, where

Case 1 : T = H x E > L . In this case, the server is able to solve these linear systems and recover the input x. This is the case not considered by existing prior arts, and this case is not privacy-preserving. Therefore, the total training epochs E and the number of hidden nodes H have to be limited.

Case 2: T = H x E < L. In this case, we know that Ax = b is feasible by referring to linear algebra because the existence of x is clear.

Lemma 1. Let x* e R^L be one of the solutions of Ax = b. Define set Null(A) := {x e R^L | Ax = 0}. Then the solution set of Ax = b is:

Proof of Lemma 1. It has been shown that x' is a solution of Ax = b if and only if x' is in this solution set. Assume x' is a solution of Ax = b. Then A(x' - x*) = 0, which implies x' - x* ∈ Null (A) i.e., Assume Then we have A(x' - x*), i.e., Ax' = Ax* = b.

From Lemma 1 we know that the solution of Ax = b is not unique when T < L, so the server cannot recover the input from linear system Ax = b. Further, we are able to show that, when T < L the solution set in Lemma 1 is large enough that the server is not able to recover any element in x, unless A satisfies a very strong property.

Lemma 2. }, the i-th element x_i ∈ x is fixed if and only if-.

Proof of Lemma 2. By condition x_i ∈ x being fixed, we have ζ_i is fixed. Finally note that 0 e Null(A), it is known that = 0 is fixed. The proof is straightforward according to definition

In a preferred embodiment, Lemma 2 can be extended when the server knows extra information of input x. Particularly, the server knows that x e S for some set . Then the conclusion will vary from case to case. For example, if the input is the feature vector output by Facenet, then i.e., the unit sphere in . Here, is the l₂-norm of a vector. In this case, the result is similar to that of Lemma 2.

Lemma 3. the i-th element x_i e x is fixed if and only if has only one element.

Proof of Lemma 3.

Let . When , the proof is trivial. The case is discussed for when .

Let . It is well-defined because . By definition, has the property that Null(A). Further, implies . First, it is observed that the set . Then . On the other hand, is by the definition of P, noting that . On the other hand, it can be known that Therefore, the i-th element is fixed if an only if: for any

Finally, it is proven that given S. This is because in continues in c. This implies that if and only if

When T = L and rank( P) = L, we have Null(A) = {0}, and Lemma 2 is satisfied. When the assumed dimension of T = L and rank ( A) = L, we have Null(A) = {0}, Lemma 2 is almost impossible to satisfy. On the one hand, all the matrices satisfying this condition form a set with measure 0 in On the other hand, the initial matrix for the training procedure is generated randomly from _/ and thus the probability it will satisfy Lemma 2 during training is negligible.

Privacy analysis of Scheme 3

When compared with Scheme 2, the server operation in Scheme 3 knows equation set f(Ax) = b = (b_lr . .. , b_L)_T, where f(•) is the activation function. When f(x) is strictly increasing in x, the analysis is the same as in the previous section, because given /(•) and f(Ax) = b, the server can recover Ax. An example of such an activation function is the sigmoid function

When /(x) is not strictly increasing in x , e.g., the ReLU function f(x) = max{0,x}, the number of linear equations obtained by the server decreases compared with the case in the previous section. Ax[i] is used to denote the i^th slot of vector Ax. More concretely, when /(•) is the ReLU function, when Ax[i] > 0, Ax[i] can be recovered from b_i, = f(Ax[i]), and when Ax[i] < 0, f(Ax[i]) is always 0 and it is impossible to obtain any information of Ax[i] except that Ax[i] < 0. Then, the server cannot use this to recover the input x.

The number of useful equations relies on the input data, and the neural network weights. Analysis has to be done on case-by-case basis. Figure 4 is a bar chart illustrating the number of useful equations in an experiment on facial recognition neural network, in 10 training epochs. About 1/3 equations are useless and 2/3 equations are useful. This means that the number effective linear equations is E, while in Scheme 2 it is H x E. Less effective linear equations usually mean less knowledge server can learn from training phase.

Activation functions

In some cases, the number of effective linear equations obtained by the server may exceed the input vector dimension n. The server may recover the input vector using these linear equations and causing the model unable to preserve privacy. The present methodology provides a solution to this problem by reducing the number of effective linear equations obtained by the server. In the early years neural networks often used the sign function sgn(x) := l_x>0 as activation function. The sign function can perfectly hide an input, compared with commonly used activation functions like ReLU(x) = max{x, 0}and Sigmoid(x) =

If a sign function is applied as the activation function, the server cannot obtain any of the linear equations, and thus the server is not able to recover the input vector. In some embodiments, for additional privacy preservation, the activation function includes multiple sign functions.

However, the sign function has derivative value 0 almost everywhere, so the common gradient descent algorithm based on backward propagation (BP) cannot be applied directly. In other words, neural network weights cannot be updated unless the training algorithm is modified.

The present methodology provides a technical solution to these issues by applying a binary neural network to privacy-preserving neural network training, to inhibit the server from recovering the input vector using the collected equations because of the sign function's definition.

As discussed above, the common gradient descent algorithm based on backward propagation (BP) cannot be applied. In this section, an algorithm is instead proposed to approximate the partial derivative of the sign function. Again, for the sake of clarity, but without an express intention to limit the scope of the present disclosure, the present algorithm is described with reference to a fully connected neural network with one hidden layer, whose parameters are (W₁, W₂,f₁,f₂~), and with activation functions f₁(-) = sgn .),f₂ . ), and loss function L(- .)■

In the backward propagation, the server has to evaluate which is given by Note that x_r = = sgnfyf), to evaluate the approximated partial derivative of the following is defined: for some integer c. It is one kind of hard sigmoid function. Then is used to approximate This is to define: which together give the approximated partial derivative of In training is used to evaluate the approximated partial derivative of is used to denote it. Similarly, is defined.

Unlike in Scheme 1, here the evaluation of needs to know , while server only know its encryption - So server computes the other parts first and asks user's help to get

13. end for

14. Server sends to user.

15. User computes and returns ^t0 server.

16. Server updates neural network parameters and returns

Although using the sign function as activation function can help to preserve privacy when compared with the ReLU function, there is a loss of accuracy because of the approximation of gradients. In this section, a family of functions is described, called the n-step function, to serve as an activation function. A function f(x) is a n-step function if it is non-decreasing, and is a piecewise constant function having n pieces.

Figure 5a and 5b show the examples of a 3-step function and a 5-step function, though any other suitable number of steps can be used. f(x) = 0 for x < 0 and f(x) = 4 for x > 4. For n-step function, it can be observed that: When n is large, it can have better approximation, but privacy-preservation in the training scheme decreases; when n is small, it is less accurate, but has better privacy-preservation.

For 5-step function is used as shown in Figure 5b, the accuracy loss is below 1% and it is acceptable. The upper bound of the n-step function is not fixed. It can be changed according to the data range. For example, a better choice of the upper bound such as 8 may be chosen during experiments.

Communication overhead

To analyse the communication overhead of the present methodology, for each batch of training, there are two rounds of communications between the server and the user. Let L_input be the input size, L_t be the number of nodes in the i-th layer, and m be the batch size. In the first communication, the server sends m x L₁ LWE ciphertexts to the user. The size of each ciphertext is around 2KB, in experimental settings. So, the communication overhead from server to user is 2mL₁ KB. The user returns mL₁ integers to the server, which are the evaluation results of the activation function applied to the decrypted ciphertexts. The communication overhead from user to server is 4 mL₁ B.

In the second communication, the server sends m x L₂ x L₁ floating numbers to the user. The communication overhead from server to user is 8mL₁L₂ B. The user returns floating numbers to the server, which is the sum of m gradients. The communication overhead from user to server is 8L_inputL₁ B. If the gradient matrix contains lots of 0, i.e., it is a sparse matrix, the non-zero value can be recorded and its position indicated instead of sending the whole matrix out. It could help to reduce the communication overhead.

The parameters of training a BP network are then entered for MNIST dataset into the calculations, where L_input = 784, L₁ = 30, L₂ = 10, m = 50. In the first communication, the size of server-to-user message is 2 x 50 x 30 = 3000 KB = 3 MB. The size of user-to-server message is 4 x 50 x 30 = 6000 B = 6 KB. In the second communication, the size of server-to-user message is 8 x 50 x 30 x 10 = 120000 B = 117 KB. The size of user-to-server message is 8 x 784 x 30 = 188160 B = 184 KB.

Evaluation Results

All schemes are evaluated on an Intel(R) Xeon(R) Platinum 8480+ CPU which has 56 cores. The security level is at least 80 bits.

The experiments include one of the most popular benchmark datasets, MNIST and a facial recognition dataset collected independently. For MNIST dataset, a BP network with one hidden layer and 30 hidden nodes is trained, which is a commonly used network structure in the area of inference on encrypted data. The average time for training one image is 0.006s and the accuracy loss compared to train in plaintext is only 0.5%.

Besides demonstrating that the system is highly efficient on the standard benchmark MNIST dataset, it is also shown that the system can be applied to practical problems, such as facial recognition. As facial recognition is more challenging and requires a deep neural network, transfer learning is applied during the training phase.

A pre-trained FaceNet (Schroff et. al, 2015) is chosen as feature extractor by removing the fully-connected layers. A small dataset of 30 people is independently collected as the training dataset and two fully-connected layers are added behind FaceNet for classification. It takes 0.008s per input and achieves 100 % accuracy.

MNIST

There are 60000 training examples and 10000 test examples in MNIST dataset for handwritten digit recognition. Each example is a 28 x 28 gray-level image, which is represented by a vector with length 784. For each point of the image, the value is set to be 1 if the original value is > o and set it to be 0 otherwise.

The architecture of the neural network is a BP network with one hidden layer and 30 hidden nodes, whose input is 784-dim vector and output has 10 classes. Both the hidden layer and output layer contain a bias. So, the number of parameters to be learned is (784 x 30) + 30 + (30 x 10) + 10 = 23860.

For the choice of activation functions, a 5-step function is used in the hidden layer. The activation function in the output layer is the Sigmoid function and uses the L² norm loss function , where x₂ is the output of Sigmoid function and y is the goal vector indicated by the standard label. The results are presented in Table 3 below: Table 3: Training on MNIST (1 hidden layer, 30 nodes)

CIFAR-10

CIFAR-10 are labelled subsets of the 80 million tiny images dataset collected by Krizhevsky et. al., 2009. The CIFAR-10 dataset consists of 60000 32x32 colour images in 10 classes, with 6000 images per class. There are 50000 training images and 10000 test images. Some samples from CIFAR-10 are included in Figure 6 which illustrates 10 classes in CIFAR-10, as well as random images from each class. A convolutional neural network with three convolution layers, as shown in Figure 7, was chosen for experiments. The input is an RGB image with a size of 32x32. The final output layer consists of 10 classes. For the activation functions, a 5- step function is used in the first convolution layer, while ReLU is used for all other activation functions.

With the hybrid HE-based training model, all parameters are made trainable, even when the training data is encrypted. As a concrete implementation of Algorithm 1, the training procedure for one batch is detailed in Algorithm 10. The convolutional neural network shown in Figure 7 is divided into two parts, . The first convolution layer is included in , while all other components are contained in S₂( .) (5 — step(x₁ )

Table 4: Training on CIFAR-10 (CNN with 3 convolution layers)

In the line Traditional Machine Learning of Table 4, the library Pytorch is used to finish the training experiment. It may be perceived that an accuracy of 72.19% is insufficient. Better accuracy could be obtained by several optimizations of the neural network structure, the training procedure, or pre- process of training data.

• A more complex deep neural network structure such as ResNet50 or inceptionV3 will have an accuracy above 85%. These models usually have millions of parameters to be trained.

• With transfer learning, one can train a deep neural network on a huge dataset (e.g., ImageNet, which has 1.4 million images). Then one can use the smaller dataset (CIFAR-10) to further fine-tune the pre-trained model.

• Pre-process techniques such as data augmentation and data normalization can also help to obtain faster convergence and thus the outcome can have better accuracy.

The above experiments demonstrate that the additional accuracy loss caused by homomorphic encryption computations and approximated gradients is sufficiently small to remain practical (as shown in Table 4, below 2%). The experiment is conducted using a simpler CNN with three convolution layers. Pretraining is not included, and the initial parameters of the neural network are randomly generated. Data preprocessing techniques, such as data augmentation, are also excluded from the experiments. Additionally, it is ensured that the security level of the encryption schemes used in this work is at least 80 bits.

Facial recognition

Besides the commonly used benchmark datasets, it is demonstrated that the system can be applied to solve practical problems with the help of transfer learning. Photos are collected, and a custom training dataset is established, containing 30 individuals and 835 photos. Although many studies have improved the efficiency of homomorphic convolutions, homomorphic computation of a deep convolutional neural network, which is a widely used structure in facial recognition, remains very slow. To reduce the training latency of privacy-preserving deep convolutional neural network training, transfer learning (Pan et aL, 2009) is proposed.

Transfer learning for private neural network training.

Since the first several convolutional layers of a deep CNN are used to extract features, which are independent of the datasets, the parameters of the convolutional layers of a pre-trained FaceNet (trained on VGGFace2) (Schroff et aL, 2015) can be frozen, and the fully-connected layers are re-trained to classify the individuals in the dataset.

Applying transfer learning can:

1) Transfer learning reduces the number of trainable layers, i.e., the weights in convolutional layers are fixed, so the training latency can be reduced.

2) With the help of a pre-trained DNN, we only need a small dataset to train the fully-connected layers.

3) If the pre-trained network is open source, i.e., the parameters are open and fixed, then the Al model solution providers can pass it to client. So the expensive ciphertext convolution computations can be converted to cheaper plaintext computations. 4) Transfer leaning does not hurt the protection of privacy of HE-based neural network training, since the extracted feature will be encrypted before send to the cloud server.

It is shown how transfer learning is applied in privacy-preserving facial recognition network training in Figure 8. The convolutional layers from the pretrained FaceNet, which is trained on an unencrypted public dataset, are reused, and the last fully-connected layers are discarded. During the privacy-preserving network training, only the weights in the last two fully-connected layers are updated. Since FaceNet is an open-source network with publicly available parameters, convolution computations can be performed in clear, which is much faster than homomorphic convolution computations in ciphertext. Before the client submits the feature vector to train the fully-connected layers, the extracted feature is encrypted, ensuring that the server does not have access to the feature vector.

The results are presented in Table 5. For the choice of activation function in AC1, the first two lines correspond to training with the ReLU function, while the last line corresponds to training with the 5-step function. The output of the convolutional layers is a vector of length 512. The first fully-connected layer contains 30 nodes, and the output layer (second fully-connected layer) also contains 30 nodes. Both layers include biases. Therefore, the number of trainable parameters is (512 x 30) + 30 + (30 x 30) + 30 = 16320 . Regarding the evaluation of FaceNet, the advancements in GPU technology allow the photos to be batched and processed very efficiently.

Table 5: Training on facial recognition (Facenet + 2 ful y-connected layers)

The privacy-preserving training scheme as disclosed herein is capable of training a deep neural network (DNN) in a short time, enabling a wide range of applications such as facial verification and object classification. With the assistance of this training scheme, machine learning service providers can offer privacy-preserving machine learning on cloud servers. On one hand, computationally expensive training can be offloaded to the cloud, allowing users without powerful machines to benefit from it. On the other hand, user data can be protected by encrypting it before uploading to the server.

Additionally, it increases the possibility of collaboration between different institutions whose data cannot be shared in clear. Such institutions can encrypt their data locally and send the ciphertexts to a third-party machine learning service provider. With the help of the privacy-preserving training scheme, the machine learning service provider can process encrypted data from various institutions as input and train a neural network without the need for decryption. It will be appreciated that many further modifications and permutations of various aspects of the described embodiments are possible. Accordingly, the described aspects are intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims.

Throughout this specification and the claims which follow, unless the context requires otherwise, the word "comprise", and variations such as "comprises" and "comprising", will be understood to imply the inclusion of a stated integer or step or group of integers or steps but not the exclusion of any other integer or step or group of integers or steps.

Claims

CLAIMS:

1. A computer-implemented method for secure training of a neural network comprising a first set of layers and a second set of layers, the first set of layers and second set of layers being non-overlapping, comprising : receiving a label and an encrypted input from a client; performing homomorphic computations on the encrypted input using the first set of layers to obtain an encrypted intermediate ciphertext; providing the encrypted intermediate ciphertext to the client; receiving a non-sensitive decrypted input from the client, wherein the non-sensitive decrypted input corresponds to an output of an activation function applied to a decryption of the encrypted intermediate ciphertext; performing computations on the non-sensitive decrypted input using the second set of layers to obtain a decrypted output; and updating weights of the neural network based on the decrypted output.

2. The computer-implemented method of claim 1, wherein receiving the non-sensitive decrypted input comprises receiving a decryption of encrypted gradients derived from the encrypted intermediate ciphertext.

3. The computer-implemented method of claim 1 or 2, wherein performing homomorphic computations on the encrypted input comprises applying a first linear function, utilising weights of the first set of layers, to the encrypted input to produce the encrypted intermediate ciphertext.

4. The computer-implemented method of any one of claim 1 to 3, wherein the activation function includes multiple sign functions or multiple step functions.

5. The method of any one of claims 1 to 4, wherein performing computations on the non-sensitive decrypted input comprises applying an activation function, utilising weights of the second set of layers, to the non-sensitive decrypted input.

6. The method of any one of claims 1 to 5, wherein the neural network comprises at least one further set of layers, the first set of layers, second set of layers and each further set of layers being non-overlapping, wherein performing computations on the non-sensitive decrypted input comprises sequentially applying the second set of layers, to the non- sensitive decrypted input, and then each further set of layers to an output of the second set of layers or an output of a previous said further set of layers, the method comprising evaluating a loss function over an output of the neural network and the label.

7. The method of any one of claims 1 to 6, wherein each said set of layers comprises a single layer.

8. A computer-implemented method for secure training of a neural network comprising a first set of layers and a second set of layers, the first set of layers and second set of layers being non-overlapping, comprising : generating, at a client terminal, an encrypted input from a decrypted input; transmitting the encrypted input and a corresponding label to a server; performing homomorphic computations, at the server, on the encrypted input using the first set of layers to obtain an encrypted intermediate ciphertext; providing the encrypted intermediate ciphertext to the client; generating, at the client, a non-sensitive decrypted input corresponding to an output of an activation function applied to a decryption of the encrypted intermediate ciphertext, and transmitting the non-sensitive decrypted input to the server; performing, at the server, computations on the non-sensitive decrypted input using the second set of layers to obtain a decrypted output; and updating weights of the neural network based on the decrypted output.

9. The computer-implemented method of claim 8, wherein the client derives encrypted gradients from the encrypted intermediate ciphertext, and generates decrypted gradients from the encrypted gradients, the nonsensitive decrypted input comprising the decrypted gradients.

10. The computer-implemented method of claim 8 or 9, wherein performing the homomorphic computations on the encrypted input comprises applying a first linear function, utilising weights of the first set of layers, to the encrypted input to produce the encrypted intermediate ciphertext.

11. The computer-implemented method of any one of claims 8 to 10, wherein the activation function includes multiple sign functions or multiple step functions.

12. The computer-implemented method of any one of claims 8 to 11, wherein updating weights of the neural network based on the decrypted output comprises evaluating, at the server, a loss function based on the decrypted output and the label.

13. The computer-implemented method of claim 12, wherein updating weights of the neural network based on the decrypted output comprises evaluating gradients of the loss function and weights of the neural network at both the server and client, and updating the weights based on the evaluation.

14. The computer-implemented method of any one of claims 8 to 13, wherein performing computations on the non-sensitive decrypted input comprises applying an activation function, utilising weights of the second set of layers, to the non-sensitive decrypted input.

15. The computer-implemented method of any one of claims 8 to 14, wherein the neural network comprises at least one further set of layers, the first set of layers, second set of layers and each further set of layers being non-overlapping, wherein performing computations on the non-sensitive decrypted input comprises sequentially applying the second set of layers, to the non-sensitive decrypted input, and then each further set of layers to an output of the second set of layers or an output of a previous said further set of layers, the method comprising evaluating a loss function over an output of the neural network and the label.

16. The computer-implemented method of any one of claims 8 to 15, wherein each said set of layers comprises a single layer.

17. A system for secure training of a neural network comprising a first set of layers and a second set of layers, the first set of layers and second set of layers being non-overlapping, comprising: a processor; a memory storing a plurality of modules, the modules comprising: a pre-processing module configured to receive a label and an encrypted input from a client; a homomorphic module configured to perform homomorphic computations on the encrypted input using the first set of layers to obtain an encrypted intermediate ciphertext and provide the encrypted intermediate ciphertext to the client; a server level computation module configured to receive a non- sensitive decrypted input from the client, wherein the non- sensitive decrypted input corresponds to an output of an activation function applied to a decryption of the encrypted intermediate ciphertext and perform computations on the non-sensitive decrypted input using the second set of layers to obtain a decrypted output; and an output module configured to update weights of the neural network based on the decrypted output.

18. The system according to claim 19, wherein receiving a non-sensitive decrypted input comprises receiving a decryption of encrypted gradients derived from the encrypted intermediate ciphertext.

19. The system according to claim 19 or 20, wherein performing homomorphic computations on the encrypted input comprises applying a first linear function, utilising weights of the first set of layers, to the encrypted input to produce the encrypted intermediate ciphertext.

20. The system according to claim 19, wherein the activation function includes multiple sign functions or multiple step functions.

21. The system according to any one of claims 17 to 20, wherein the homomorphic module performs computations on the non-sensitive decrypted input comprises applying an activation function, utilising weights of the second set of layers, to the non-sensitive decrypted input.

22. The system of any one of claims 17 to 21, wherein the neural network comprises at least one further set of layers, the first set of layers, second set of layers and each further set of layers being non-overlapping, wherein server level computation module performs computations on the non-sensitive decrypted input by sequentially applying the second set of layers, to the non-sensitive decrypted input, and then each further set of layers to an output of the second set of layers or an output of a previous said further set of layers, and evaluates a loss function over an output of the neural network and the label.

23. The system of any one of claims 17 to 22, wherein each said set of layers comprises a single layer.

24. A system for secure training of a neural network comprising a first set of layers and a second set of layers, the first set of layers and second set of layers being non-overlapping, comprising: a processor; a memory storing a plurality of modules, the modules comprising: a client level pre-processing module configured to generate an encrypted input from a decrypted input at a client terminal and to transmit the encrypted input and a corresponding label to a server; a homomorphic module configured to perform homomorphic computations on the encrypted input at the server using the first set of layers to obtain an encrypted intermediate ciphertext, and providing the encrypted intermediate ciphertext to the client; a client level computation module configured to generate a nonsensitive decrypted input corresponding to an output of an activation function applied to a decryption of the encrypted intermediate ciphertext, and transmitting the non-sensitive decrypted input to the server; a server level computation module configured to perform computations on the non-sensitive decrypted input using the second set of layers to obtain a decrypted output; and an output module configured to update weights of the neural network based on the decrypted output.

25. The system according to claim 24, wherein the client derives encrypted gradients from the encrypted intermediate ciphertext, and generates decrypted gradients from the encrypted gradients, the non-sensitive decrypted input comprising the decrypted gradients.

26. The system according to claim 24 or 25, wherein performing homomorphic computations on the encrypted input comprises applying a first linear function, utilising weights of the first set of layers, to the encrypted input to produce the encrypted intermediate ciphertext.

27. The system according to claim 26, wherein the activation function includes multiple sign functions or multiple step functions.

28. The system according to any one of claims 25 to 27, wherein updating weights of the neural network based on the decrypted output comprises evaluating, at the server, a loss function based on the decrypted output and the label.

29. The system according to claim 28, wherein updating weights of the neural network based on the decrypted output comprises evaluating gradients of the loss function and weights of the neural network at both the server and client, and updating the weights based on the evaluation.

30. The system of any one of claims 25 to 29, wherein the homomorphic module performs computations on the non-sensitive decrypted input comprises applying an activation function, utilising weights of the second set of layers, to the non-sensitive decrypted input.

31. The system of any one of claims 25 to 30, wherein the neural network comprises at least one further set of layers, the first set of layers, second set of layers and each further set of layers being non-overlapping, wherein the server level computation module performs computations on the non-sensitive decrypted input by sequentially applying the second set of layers, to the non-sensitive decrypted input, and then each further set of layers to an output of the second set of layers or an output of a previous said further set of layers, and evaluates a loss function over an output of the neural network and the label.

32. The system of any one of claims 25 to 31, wherein each said set of layers comprises a single layer.