homomorphic encryption with graph reductions achieving ......optimizing 2-input graphs given a graph...
TRANSCRIPT
![Page 1: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/1.jpg)
Achieving Fast Fully Homomorphic Encryption with Graph Reductions
Walden Yan and Sanath GovindarajanMentor: William Moses
![Page 2: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/2.jpg)
What is fully homomorphic encryption?● Support arbitrary computation on encrypted data
Alice (Sender) Eve (Untrusted Receiver)
Encryptionμ → Enc(μ) Computation
Enc(μ)↓
F′(Enc(μ))DecryptionF′(Enc(μ))
↓Dec(F′(Enc(μ))) = F(μ)
![Page 3: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/3.jpg)
Potential Applications
● We can send tasks off to someone with a more powerful computer or a better algorithm without having to worry about data leaks○ Filtering email and messages○ Processing medical data○ Processing financial data○ National security
![Page 4: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/4.jpg)
But it is slow
FHE Library
NOTANDXOR
XNOR
FHE Function
Enc(μ)↓
F1(Enc(μ))↓
F2(F1(Enc(μ)))↓⋮↓
Func′(Enc(μ))
![Page 5: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/5.jpg)
Our Contribution
![Page 6: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/6.jpg)
FHE PipelineProgram
F(μ)
Encrypted Data CorpusEnc(μ1), Enc(μ2), ...
Encrypted OutputsEnc(F(μ1)), Enc(F(μ2)), ...
Function Graph IR
Optimized Encrypted Program
F′: Enc(μ) → Enc(F(μ))
Reduce Graph
Schedule & Compile
“Library” Function
Optimized Graph
Lower to Scheme
Halide IR
![Page 7: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/7.jpg)
Function Graph IR
![Page 8: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/8.jpg)
INPUT
OUTPUT
● DAG of binary operations
Function Graphs
3-bit addition
![Page 9: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/9.jpg)
Measuring Graph Efficiency
● Benchmark individual binary operations in the FHE scheme
● In the worst case, the time it takes to run the graph is the sum of the time it takes to run each individual operation○ Could be faster due to parallelism or schedule optimizations
● Theoretically, any scheme can be used
Operation NOT AND XOR XNOR
Runtime (relative to NOT) 1 18.75 38.71 35.72
![Page 10: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/10.jpg)
Graph Reductions
3-bit multiplication
3-bit multiplication(reduced)
![Page 11: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/11.jpg)
Eliminating Constants and Double NOTs
● Any binary operation taking a constant as an input can be expressed soley in terms of the other input○ XOR(A, 1) == NOT(A)
● NOT(NOT(A)) = A
![Page 12: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/12.jpg)
Optimizing 2-Input Graphs
● Given a graph with two input nodes and some desired outputs, find the best graph to compute those outputs
● 2 inputs ⇒ 4 possible sets of inputs ⇒ 16 possible functions ⇒ 65536 unique sets of outputs
● Run a DP algorithm to find all the optimal graphs and cache them in a table● Use the table to find the optimal graph for any situation
![Page 13: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/13.jpg)
Generic Graph Reduction
For all pairs of nodes u and v:
● Define the subgraph S as all nodes that can be calculated from only u and v○ Approximate with DFS
● Consider node w in S interesting if w is used outside of S or if w is an output of the original graph
● Run the 2-input graph algorithm with interesting nodes as desired outputs● Replace the S with the ideal subgraph
Repeat until graph cannot be reduced further
![Page 14: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/14.jpg)
1010
10010011
0010
1101
11001100
10100011
0110
1001
0010
1101𝞪 𝞪
Two-Node Reduction on Full Adder
1100
10100011
0110
1001
0010
1101�� ��
![Page 15: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/15.jpg)
Additional Reduction Methods
● Three-node reduction
● Find exact subgraph S by running every possible set of inputs and analyzing patterns in node values
● Flag “important” input nodes (ex. sign bits)○ Try creating separate graphs for when the bit is 0 and when it is 1, then combine with MUX
![Page 16: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/16.jpg)
Scheduling and Compiling
![Page 17: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/17.jpg)
Our FHE Scheme
● GSW 2013: leveled fully homomorphic encryption scheme based on LWE [1]○ Ciphers are matrices, operations are matrix addition & multiplication○ Requirement for leveled FHE: plaintext μ∈{0,1} at all times
● NOT (μ) = 1 - μ● AND (μ1 μ2) = μ1 * u2
● XOR (μ1 μ2) = AND (μ1 (!μ2)) + AND ((!μ1) μ2)● XNOR (μ1 μ2) = AND (μ1 μ2) + AND ((!μ1) (!μ2))
○ Graph optimizations take differing costs of operations into account
● Since all encrypted gates are matrix operations, we can use a tensor processing compiler to generate fast code
[1] Gentry, Craig, Sahai, Amit, Waters, Brent 2013
![Page 18: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/18.jpg)
Implementing Fast FHE Operations
● We use Halide, a high-performance image and tensor processing compiler● Algorithms are separated from schedules
○ Implement FHE operator once○ Halide can schedule/compile for many architectures (caching differences,
CPU/GPU, etc)● Easy parallelization by design (no side effects, etc)
![Page 19: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/19.jpg)
Homomorphic AND in Halide
//Simplified for ease
Halide::Func AND(Halide::Func f1, Halide::Func f2, int matSize) {
Halide::Var x, y;
Halide::RDom r(0, matSize);
Halide::Func multiply_temp;
multiply_temp(x, y) = Halide::Expr((int64_t)0);
multiply_temp(x, y) += f1(x, r) * f2(r, y); //modular sum in practice
return Flatten(multiply_temp);
}
![Page 20: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/20.jpg)
How We Generate Pipelines
Input Input Input ImageParam ImageParam ImageParam
Output Output Output Realization
Primitives
Public params (modulus, size)
Halide compiles this to return a callable function pointer
![Page 21: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/21.jpg)
Compiling a function graph
vector<ImageParam> inputPlaceholders(2 * num_bits);
for (int i = 0; i < inputPlaceholders.size(); i++) {
inputPlaceholders[i] = ImageParam(Int(64), 2);
}
Pipeline hpipe = pipelineGen(some_function, inputPlaceholders, N, q); // pipeline
ready to be scheduled
// scheduling here, or use the auto-scheduler
hpipe.compile_jit(); // or compile_to_c or any other supported language
Realization rel = hpipe.realize(N, N, Target(), params); // ready to be decrypted
![Page 22: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/22.jpg)
A “Dynamic” Library
● Given an FHE program, see if we’ve already compiled it, if so return/call it● Otherwise compile a pipeline to compute the operation
○ Moderately slow, but can be reused● Can either JIT or ahead-of-time compile depending on use case
![Page 23: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/23.jpg)
API
![Page 24: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/24.jpg)
Creating Graphs: Building From Scratch
function_graph fg(3); // 3 input bits
int node1 = fg.addNode(fg.getInput(0), fg.getInput(1), AND_OP);
int node2 = fg.addNode(fg.getInput(2), node1, OR_OP);
fg.defineOutput(0, node2);
reduce(fg); // also has optional flags
![Page 25: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/25.jpg)
Creating Graphs: Using Standard Operations
function_graph fg;
var x(fg, 0, 5); // inputs 0...4
var y(fg, 5, 5); // inputs 5...9
var z(fg, 10, 5); // inputs 10...15
var res = (x + y) / z;
function_graph opGraph = res.realize();
![Page 26: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/26.jpg)
Results
![Page 27: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/27.jpg)
FHE Scheme Benchmarking
O((n lg q)3)
![Page 28: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/28.jpg)
Optimization Benchmarking
3.5 x reduction0.27 ms reduction
![Page 29: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/29.jpg)
Optimization Benchmarking
2.8 x reduction3.5 x reduction
![Page 30: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/30.jpg)
Optimization Benchmarking
17.5 x reduction
ReLU: (|x| + x) / 2
![Page 31: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/31.jpg)
Conclusion
● A pipeline that speeds up the running of programs with fully homomorphic encryption○ Internal representation that can be optimized with graph reductions○ Scheduling and compiling homomorphic programs with Halide
● A basic API for easy use of the pipeline● Demonstrated significant speedups compared to using bare fully
homomorphic encryption
![Page 32: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/32.jpg)
Future Work
● Adding heuristics to better handle larger function graphs● Allowing function graphs to incorporate lower level FHE operations● Adding new primitive gates (ex. MUX)● Incorporate RLWE to allow faster arithmetic operations● Improving the API
![Page 33: Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, find the best graph to compute](https://reader036.vdocuments.mx/reader036/viewer/2022081518/611b582f69e3bd79004b8da7/html5/thumbnails/33.jpg)
Acknowledgements
● Our parents
● Our mentor, William Moses
● Dr. Slava Gerovitch
● Professor Srini Devadas