TLDR: PRIVSPIKE is a novel, open-source framework that enables privacy-preserving inference for deep Spiking Neural Networks (SNNs) using the CKKS homomorphic encryption scheme. It introduces two innovative algorithms for the Leaky Integrate-and-Fire (LIF) activation function—polynomial approximation for performance and scheme-switching for precision—along with architectural optimizations. Evaluated on diverse datasets and SNN architectures (LeNet-5, ResNet-19), PRIVSPIKE achieves high encrypted inference accuracies (e.g., 98.10% on MNIST) with significantly reduced latency and efficient memory usage, outperforming prior encrypted SNN solutions and making secure SNN inference practical for real-world applications.
In the rapidly evolving landscape of machine learning, deep learning models have become indispensable across various industries, from medical diagnosis to self-driving cars. However, their reliance on vast datasets often containing sensitive information has brought data privacy to the forefront of concerns. Spiking Neural Networks (SNNs) have emerged as a promising, energy-efficient alternative to traditional deep learning, mimicking the brain’s biological processes. Yet, SNNs also depend on large volumes of data, inheriting the same critical privacy challenges.
Addressing this crucial issue, a new framework called PRIVSPIKE has been introduced. This innovative solution employs homomorphic encryption (HE) to enable computations directly on encrypted data, ensuring that sensitive information remains confidential throughout the entire processing pipeline. This means that even when a cloud server performs complex calculations on your data, it never sees the unencrypted version, maintaining your privacy.
What is PRIVSPIKE?
PRIVSPIKE is a privacy-preserving inference framework specifically designed for SNNs. It utilizes the Cheon-Kim-Kim-Song (CKKS) homomorphic encryption scheme, which is particularly well-suited for approximate arithmetic and parallel data processing, making it ideal for neural network applications. The framework supports SNNs of arbitrary depth and introduces two novel algorithms to handle a critical component of SNNs: the Leaky Integrate-and-Fire (LIF) activation function.
How PRIVSPIKE Works: Overcoming Non-Linearity
One of the main challenges in applying homomorphic encryption to neural networks is efficiently evaluating non-linear functions, which are essential for learning complex patterns. The LIF activation function in SNNs is a prime example. PRIVSPIKE tackles this with two distinct approaches:
- Polynomial Approximation: This algorithm uses Chebyshev polynomials to approximate the non-linear comparison operation within the LIF function. By converting this operation into a series of polynomials, it becomes compatible with the CKKS scheme, allowing for high-performance SNN inference.
- Scheme-Switching Algorithm: This novel approach optimizes precision at a higher computational cost. It combines the strengths of CKKS for efficient linear computations with the Fully Homomorphic Encryption over the Torus (TFHE) scheme for high-precision evaluation of the non-linear spike decision. When a non-linear operation is needed, the encrypted data is temporarily switched to the TFHE scheme, computed with high accuracy, and then switched back to CKKS for further linear processing.
Beyond these algorithms, PRIVSPIKE also incorporates architectural optimizations. These include precomputing and reusing rotation keys for consistent memory usage, evaluating layers iteratively across all time steps to enhance data locality, and strategically applying bootstrapping to maintain ciphertext integrity in deep networks.
Performance and Evaluation
The researchers rigorously evaluated PRIVSPIKE using widely studied datasets like MNIST, CIFAR-10, and their neuromorphic counterparts, Neuromorphic MNIST (N-MNIST) and CIFAR-10 DVS. They tested the framework on SNN models based on the well-known LeNet-5 and ResNet-19 architectures. The results are impressive:
- On the MNIST dataset, a LeNet-5 model using the scheme-switching LIF achieved an encrypted inference accuracy of 98.10%, very close to the plaintext model’s 98.9%.
- For the more complex CIFAR-10 dataset, a ResNet-19 model with scheme-switching reached 79.3% accuracy.
- In terms of speed, a LeNet-5 model on MNIST achieved inference times of 28 seconds on a consumer-grade CPU using the approximation method. Even for the more demanding ResNet-19 models, inference on CIFAR-10 took 784 seconds.
These figures demonstrate that PRIVSPIKE not only maintains high accuracy in the encrypted domain but also offers significantly improved performance compared to previous encrypted SNN solutions. For instance, on the LeNet-5 architecture, PRIVSPIKE’s approximation-based model was approximately 34 times faster than a related work by Farzad et al. and about 50 times faster than FHE-DiCNN, while also showing better accuracies.
Also Read:
- Unlocking Efficient Spiking Neural Network Training with SADP
- Making Advanced Encryption Practical: How AI Optimizes Homomorphic Applications in the Cloud
Bridging Efficiency and Privacy
The development of PRIVSPIKE marks a significant step forward in privacy-preserving machine learning. It effectively bridges the gap between energy-efficient deep neural networks, like SNNs, and the strong cryptographic privacy guarantees offered by homomorphic encryption. This framework is particularly relevant for applications in energy-constrained environments and event-driven data processing scenarios where both efficiency and data confidentiality are paramount.
The open-source nature of PRIVSPIKE, available on GitHub, further encourages its adoption and future development, paving the way for more secure and private AI applications.
