Back

CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy

Nathan DowlinRan Gilad-BachrachKim LaineKristin LauterMichael NaehrigJohn Wernsing

article2016ICML1,988 citations

Develops a practical method to run neural network inference directly on homomorphically encrypted data, achieving 99% accuracy on MNIST with a throughput of nearly 59,000 private predictions per hour on a single PC.

Listen

Cloud-based machine learning offers substantial benefits for predictive analytics, yet strict legal, ethical, and privacy requirements prevent many organizations in fields like healthcare and finance from adopting these services. Transmitting sensitive raw data to third-party cloud providers creates significant compliance and confidentiality risks.

The article demonstrates the feasibility of CryptoNets, a system that adapts artificial neural networks to execute inferences directly on homomorphically encrypted data without decrypting it at any point in the cloud.

The authors implemented a leveled homomorphic encryption framework (specifically the YASHE' scheme via the Simple Encrypted Arithmetic Library) and paired it with a modified feed-forward neural network. Because homomorphic encryption natively supports only addition and multiplication, standard non-polynomial network components were altered: traditional activation functions (such as sigmoid and rectified linear units) were replaced with low-degree polynomial square activations, and max pooling was replaced with scaled mean pooling. The framework was evaluated on the benchmark MNIST dataset, training on 50,000 handwritten digit images and testing on 10,000 images using a single desktop PC (Intel Xeon 3.5 GHz CPU with 16GB RAM).

The evaluation yielded several key findings:

  1. The system attained 99% classification accuracy on the MNIST test set (misclassifying only 105 out of 10,000 images), demonstrating that polynomial approximations preserve model precision.
  2. By leveraging Single Instruction Multiple Data (SIMD) parallel processing through the Chinese Remainder Theorem, the system processed batches of 4,096 instances simultaneously, yielding an average throughput of roughly 58,982 predictions per hour on a single PC.
  3. The end-to-end processing latency for a full batch was 250 seconds, while client-side encryption required 44.5 seconds (plus 0.138 seconds per instance) and decryption required 3 seconds (plus 0.012 seconds per instance).
  4. Encrypted data expanded the message footprint significantly, requiring 367.5 MB for an encoded batch of 4,096 images (91.875 KB per instance), which is one to three orders of magnitude larger than unencrypted raw representations.

These findings prove that privacy-preserving cloud inference is technically viable and capable of high throughput, directly addressing data security and compliance barriers in sensitive industries. Unlike multi-party computation methods that require constant client interaction during model evaluation, CryptoNets allows clients to send encrypted batches asynchronously while keeping intermediate values and proprietary model weights secure. However, organizations must account for the latency overhead per batch and substantial network bandwidth demands resulting from ciphertext size expansion.

For practical adoption, organizations should evaluate whether their use cases fit a batch-oriented workflow where high throughput compensates for latency. Further implementation efforts should explore hardware acceleration (such as GPUs or FPGAs) and more efficient encoding schemes to lower latency, reduce parameter sizes, and minimize message volume.

The results provide high confidence for inference tasks of moderate architectural depth. However, key limitations remain: the article specifically addresses model inference, not training, because training on encrypted data remains computationally prohibitive. Additionally, square activation functions have unbounded derivatives, which can lead to training instability or overfitting in deeper neural networks (e.g., 10 to 20 layers) without specialized design techniques.

MicrosoftPrinceton Universityciphertextsdecryptiondecryption keyshomomorphic encryptionneural networkspolynomial activation functions
microsoft/CryptoNetsDowlin et al (2016).pdf
  • Paper: Gradient-based learning applied to document recognition, Yann LeCun et al. (1998). This seminal work establishes convolutional neural networks and the benchmark MNIST dataset, providing the foundational architecture and evaluation standard adapted by CryptoNets.
  • Paper: An Introduction to Convolutional Neural Networks, Keiron O'Shea et al. (2015). It provides a clear primer on the essential building blocks of convolutional layers, parameter sharing, and pooling needed to understand how neural network operations are transformed for encrypted evaluation.
  • Paper: Network In Network, Min Lin et al. (2014). It introduces architectural techniques like global average pooling and localized processing that inform design adaptations when restructuring networks for non-standard, low-degree polynomial computation.
  • Paper: Deep Compression: Compressing Deep Neural Network with Pruning, Trained Quantization and Huffman Coding, Song Han et al. (2015). It demonstrates network quantization and transformation techniques crucial for understanding how continuous neural network operations are adapted to discrete and constrained arithmetic domains.
Cover for CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy

Abstract

Applying machine learning to a problem which involves medical, financial, or other types of sensitive data, not only requires accurate predictions but also careful attention to maintaining data privacy and security. Legal and ethical requirements may prevent the use of cloud-based machine learning solutions for such tasks. In this work, we will present a method to convert learned neural networks to CryptoNets, neural networks that can be applied to encrypted data. This allows a data owner to send their data in an encrypted form to a cloud service that hosts the network. The encryption ensures that the data remains confidential since the cloud does not have access to the keys needed to decrypt it. Nevertheless, we will show that the cloud service is capable of applying the neural network to the encrypted data to make encrypted predictions, and also return them in encrypted form. These encrypted predictions can be sent back to the owner of the secret key who can decrypt them. Therefore, the cloud service does not gain any information about the raw data nor about the prediction it made. We demonstrate CryptoNets on the MNIST optical character recognition tasks. CryptoNets achieve 99% accuracy and can make around 59000 predictions per hour on a single PC. Therefore, they allow high throughput, accurate, and private predictions.

Topics

ciphertextsdecryptiondecryption keysencrypted datanetwork architecturerecurrent neural networks

Keywords

homomorphic encryptionneural networkspolynomial activation functionsarithmetic circuitMNIST datasetmultiparty computationideal lattices

Table of Contents

  • 1. Introduction
  • 2. Neural Networks
  • 3. Homomorphic Encryption
  • 3.1. Description of the method
  • 3.2. Practical considerations
  • 3.2.1. PLAIN OPERATIONS
  • 3.2.2. ENCODING
  • 3.2.3. ENCODING LARGE NUMBERS
  • 3.2.4. PARALLEL COMPUTATION
  • 3.2.5. PARAMETER SELECTION
  • 4. Empirical Results
  • 4.1. Timing analysis
  • 4.2. Description of the Network
  • 4.3. Message sizes
  • 5. Discussion and Conclusions
  • References

Knowls

  1. Knowl 1 — Encrypted inference protocol

    model/method

    CryptoNets is a protocol for private neural-network inference, not private model training. A data owner uses the public key of a leveled homomorphic-encryption scheme to encrypt an input record and sends the ciphertext to a cloud service that already holds a trained neural network. The cloud evaluates the network directly on the ciphertext and returns an encrypted prediction. Only the data owner, who possesses the secret key, decrypts the result. Under this protocol, the cloud does not obtain the raw input or the prediction it computed, and the data owner need not remain online while inference is performed.

  2. Knowl 2 — Conversion of neural networks to low-degree encrypted circuits

    model/method

    CryptoNets converts a neural network into a low-degree polynomial circuit because the employed homomorphic encryption supports additions and multiplications but not general nonlinear functions. Weighted sums and biases are retained because they require only multiplication and addition; multiplication by known weights and addition of known biases use more efficient plaintext operations rather than encrypting the constants. Max pooling is replaced by scaled mean pooling, implemented as a sum over the pooling window so that division is avoided. Sigmoid and rectified-linear activations are replaced by the square activation

    sqr⁡(z)=z2,\operatorname{sqr}(z)=z^2,

    where zz is an encoded real-valued node input. Consecutive linear layers, including weighted sums and scaled pooling, can be composed into one linear transformation to reduce the multiplicative depth of the encrypted circuit.

  3. Knowl 3 — YASHE-based leveled homomorphic computation

    model/method

    CryptoNets uses the YASHE ring-based leveled homomorphic-encryption scheme. For polynomial degree nn, plaintext modulus tt, and coefficient modulus qq, the plaintext and ciphertext rings are

    Rtn=Zt[x]/(xn+1),Rqn=Zq[x]/(xn+1).R_t^n=\mathbb{Z}_t[x]/(x^n+1),\qquad R_q^n=\mathbb{Z}_q[x]/(x^n+1).

    The scheme samples random polynomials f0,g∈Rqnf_0,g\in R_q^n, sets the secret key to f=tf0+1f=tf_0+1, and sets the public key to h=tgf−1h=tg f^{-1} in RqnR_q^n, repeating key generation until ff is invertible. A plaintext polynomial m∈Rtnm\in R_t^n is encrypted as

    c=[⌊qt⌋m+e+hs]q,c=\left[\left\lfloor\frac{q}{t}\right\rfloor m+e+hs\right]_q,

    where e,s∈Rqne,s\in R_q^n are random small-noise polynomials and [⋅]q[\cdot]_q denotes coefficient reduction modulo qq into a symmetric representative interval. Decryption computes

    m=[⌊tqfc⌉]t,m=\left[\left\lfloor\frac{t}{q}fc\right\rceil\right]_t,

    where coefficientwise rounding to the nearest integer is performed before reduction modulo tt. Ciphertext addition evaluates plaintext addition, and ciphertext multiplication evaluates plaintext multiplication after relinearization returns the product to a ciphertext decryptable with the original secret key. Correctness requires the accumulated noise to remain below the decryption tolerance; multiplication increases noise much more than addition, so the neural network must have a sufficiently small multiplicative level.

  4. Knowl 4 — Fixed-precision encoding, CRT expansion, and SIMD batching

    model/method

    Because the encryption scheme operates on polynomial coefficients modulo a plaintext modulus rather than floating-point reals, CryptoNets converts real inputs and weights to fixed-precision integers. The experiments used 5–10 bits of precision for inputs and weights, and selected parameters so that all intermediate values remained below 2802^{80} and did not wrap modulo the plaintext modulus. Chinese-remainder-theorem encoding is used in two complementary ways: one large coefficient can be represented by residues modulo several plaintext moduli, allowing the representable range to grow approximately with their product, while a single polynomial can also encode many independent values for single-instruction multiple-data computation. The implementation uses polynomial degree n=4096n=4096, so one ciphertext can process 4096 instances in parallel at no additional network-evaluation cost. Five plaintext-modulus/coefficient-modulus pairs were used:

    • (q1,t1)=(2191−2589751,40961)(q_1,t_1)=(2^{191}-2589751,40961);
    • (q2,t2)=(2191−491527,65537)(q_2,t_2)=(2^{191}-491527,65537);
    • (q3,t3)=(2191−2232751,114689)(q_3,t_3)=(2^{191}-2232751,114689);
    • (q4,t4)=(2191−2309565,147457)(q_4,t_4)=(2^{191}-2309565,147457);
    • (q5,t5)=(2191−15131401,188417)(q_5,t_5)=(2^{191}-15131401,188417).

    The plaintext moduli have product greater than 2802^{80} and are chosen so that x4096+1x^{4096}+1 splits into linear factors modulo each plaintext modulus, enabling the 4096-way SIMD representation. Plain multiplication by a known scalar is especially efficient: for a ciphertext polynomial of degree at most n−1n-1, it can be performed in linear time in that degree.

  5. Knowl 5 — Nine-layer training network and five-layer inference network

    model/method

    The MNIST model is trained as a nine-layer neural network. Its layers are: (1) a convolution from a 28×2828\times28 image using 5×55\times5 kernels, stride (2,2)(2,2), and 5 maps, producing 5×13×135\times13\times13 outputs; (2) pointwise square activation; (3) scaled mean pooling with 1×3×31\times3\times3 windows, retaining the 5×13×135\times13\times13 representation; (4) a convolution with kernel size 1×5×51\times5\times5, stride (1,2,2)(1,2,2), and 10 maps, producing 50×5×550\times5\times5 outputs; (5) another 1×3×31\times3\times3 scaled mean-pooling layer; (6) a fully connected map from 50⋅5⋅5=125050\cdot5\cdot5=1250 inputs to 100 nodes; (7) pointwise square activation; (8) a fully connected map from 100 nodes to 10 outputs; and (9) pointwise sigmoid activation.

    For encrypted inference, the sigmoid is removed because the predicted digit is the index of the largest output coordinate and the sigmoid is monotonically increasing, so it does not change that index. The consecutive linear layers between the first square activation and the second square activation are collapsed into one matrix multiplication. The resulting inference circuit has five layers: convolution, square activation, one combined linear layer, square activation, and a 10-output linear layer.

  6. Knowl 6 — MNIST evaluation and classification accuracy

    experimental setup

    CryptoNets was evaluated on MNIST, which contains 60,000 handwritten-digit images represented as 28×2828\times28 arrays with pixel values from 0 to 255. The experiment trained on 50,000 images and tested on the remaining 10,000 images. The trained network correctly classified 9,895 test images and misclassified 105, corresponding to the reported 99% accuracy.

  7. Knowl 7 — End-to-end latency and throughput

    data/table

    The performance table reported on page 7 measures the three stages of encrypted MNIST inference on a single PC with an Intel Xeon E5-1620 CPU at 3.5 GHz, 16 GB of RAM, and Windows 10. The network uses batches of 4096 instances through SIMD encoding. The 250-second network latency applies to one such batch, so the cloud can sustain approximately 4096×3600/250≈589824096\times3600/250\approx58982 predictions per hour.

    Could not parse LaTeX table

    Thus, encrypted network evaluation is the bottleneck in this implementation, while the batched computation provides high aggregate throughput despite the long latency of an individual batch.

  8. Knowl 8 — Encrypted-network layer timing

    data/table

    The layer-timing table on page 7 decomposes the approximately 250-second MNIST network evaluation for the simplified five-layer inference circuit. The largest costs are the first square activation and the combined linear pooling layer, showing where homomorphic multiplication and ciphertext processing dominate.

    Could not parse LaTeX table

  9. Knowl 9 — Encrypted message-size overhead

    data/table

    The message-size measurements reported on page 7 quantify the communication cost of packing 4096 MNIST instances. Each 28×2828\times28 image is represented using five polynomials per pixel, and each polynomial coefficient occupies 24 bytes. SIMD batching makes the per-instance cost much smaller than the total ciphertext size, although encrypted inputs remain substantially larger than raw images.

    Could not parse LaTeX table

    The encrypted input is approximately 15.3 times larger than a representation using double-precision pixels, 120 times larger than a one-byte-per-pixel representation, and 570 times larger than the dataset's average compressed representation of 165 bytes per image. The paper therefore characterizes the encrypted data as one to three orders of magnitude larger than natural unencrypted representations, depending on the comparison format.

  10. Knowl 10 — Scope and remaining limitations

    limitation

    CryptoNets protects the inference stage under the assumption that the cloud already possesses a trained model; it does not provide a practical method for training the model on encrypted data. Encrypted training would require polynomial activation and loss functions, and back-propagation would accumulate a multiplicative level proportional to the number of training steps, making leveled homomorphic encryption impractical for the authors' setting. The square activation also has an unbounded derivative, which can cause gradient-descent instability, overfitting, or blow-up in deeper networks; the authors note that additional techniques would be needed for networks roughly 10–20 layers deep. The implementation has high latency and communication overhead, and the paper identifies GPU/FPGA acceleration and more efficient encodings that permit smaller encryption parameters as directions for improvement.

Coverage note — No substantial contributed material was omitted; detailed background and related-work comparisons were excluded because they do not constitute the paper's own contribution.

References

  1. 1.Agrawal, Rakesh and Srikant, Ramakrishnan. Privacy-preserving data mining. In ACM Sigmod Record, pp. 439–450. ACM, 2000.
  2. 2.Aslett, Louis JM, Esperança, Pedro M, and Holmes, Chris C. Encrypted statistical machine learning: new privacy preserving methods. arXiv preprint arXiv:1508.06845, 2015a.
  3. 3.Aslett, Louis JM, Esperança, Pedro M, and Holmes, Chris C. A review of homomorphic encryption and software tools for encrypted statistical machine learning. arXiv preprint arXiv:1508.06574, 2015b.
  4. 4.Barni, Mauro, Orlandi, Claudio, and Piva, Alessandro. A privacy-preserving protocol for neural-network-based computation. In Proceedings of the 8th workshop on Multimedia and security, pp. 146–151. ACM, 2006.
  5. 5.Bos, Joppe W, Lauter, Kristin, Loftus, Jake, and Naehrig, Michael. Improved security for a ring-based fully homomorphic encryption scheme. In Cryptography and Coding, pp. 45–64. Springer, 2013.
  6. 6.Brakerski, Zvika and Vaikuntanathan, Vinod. Efficient fully homomorphic encryption from (standard. In LWE, FOCS 2011, IEEE 52nd Annual Symposium on Foundations of Computer Science, IEEE. Citeseer, 2011.
  7. 7.Chen, Tingting and Zhong, Sheng. Privacy-preserving backpropagation neural network learning. Neural Networks, IEEE Transactions on, 20(10):1554–1564, 2009.
  8. 8.Dahl, George E, Yu, Dong, Deng, Li, and Acero, Alex. Context-dependent pre-trained deep neural networks for large-vocabulary speech recognition. Audio, Speech, and Language Processing, IEEE Transactions on, 20(1):30–42, 2012.
  9. 9.Dowlin, Nathan, Gilad-Bachrach, Ran, Laine, Kim, Lauter, Kristin, Naehrig, Michael, and Wernsing, John. Manual for using homomorphic encryption for bioinformatics. Technical report, Microsoft Research, 2015. http://research.microsoft.com/apps/pubs/default.aspx?id=258435.
  10. 10.Dwork, Cynthia. Differential privacy. In Encyclopedia of Cryptography and Security, pp. 338–340. Springer, 2011.
  11. 11.Gentry, Craig. Fully homomorphic encryption using ideal lattices. In STOC, volume 9, pp. 169–178, 2009.
  12. 12.Gentry, Craig, Halevi, Shai, and Smart, Nigel P. Fully homomorphic encryption with polylog overhead. In Advances in Cryptology–EUROCRYPT 2012, pp. 465–482. Springer, 2012a.
  13. 13.Gentry, Craig, Halevi, Shai, and Smart, Nigel P. Homomorphic evaluation of the aes circuit. In Advances in Cryptology–CRYPTO 2012, pp. 850–867. Springer, 2012b.
  14. 14.Goldreich, Oded. Secure multi-party computation. Manuscript. Preliminary version, 1998.
  15. 15.Graepel, Thore, Lauter, Kristin, and Naehrig, Michael. Ml confidential: Machine learning on encrypted data. In Information Security and Cryptology–ICISC 2012, pp. 1–21. Springer, 2013.
  16. 16.Krizhevsky, Alex, Sutskever, Ilya, and Hinton, Geoffrey E. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems, pp. 1097–1105, 2012.
  17. 17.LeCun, Yan, Cortes, Corinna, and Burges, Christopher J.C. The mnist database of handwritten digits. http://yann.lecun.com/exdb/mnist/, 1998.
  18. 18.Livni, Roi, Shalev-Shwartz, Shai, and Shamir, Ohad. On the computational efficiency of training neural networks. In Advances in Neural Information Processing Systems, pp. 855–863, 2014.
  19. 19.Lopez-Alt, Adriana, Tromer, Eran, and Vaikuntanathan, Vinod. On-the-fly multiparty computation on the cloud via multikey fully homomorphic encryption. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing, pp. 1219–1234. ACM, 2012.
  20. 20.Naehrig, Michael, Lauter, Kristin, and Vaikuntanathan, Vinod. Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop, pp. 113–124. ACM, 2011.
  21. 21.Orlandi, Claudio, Piva, Alessandro, and Barni, Mauro. Oblivious neural network computing via homomorphic encryption. EURASIP Journal on Information Security, 2007:18, 2007.
  22. 22.Piva, Alessandro, Orlandi, Claudio, Caini, M, Bianchi, Tiziano, and Barni, Mauro. Enhancing privacy in remote data classification. In Proceedings of The Ifip Tc 11 23rd International Information Security Conference, pp. 33–46. Springer, 2008.
  23. 23.Qi, Yinian and Atallah, Mikhail J. Efficient privacy-preserving k-nearest neighbor search. In Distributed Computing Systems, 2008. ICDCS’08. The 28th International Conference on, pp. 311–319. IEEE, 2008.
  24. 24.Rivest, Ronald L, Adleman, Len, and Dertouzοs, Michael L. On data banks and privacy homomorphisms. Foundations of secure computation, 4(11):169–180, 1978.
  25. 25.Stehlé, Damien and Steinfeld, Ron. Making ntru as secure as worst-case problems over ideal lattices. In Advances in Cryptology–EUROCRYPT 2011, pp. 27–47. Springer, 2011.
  26. 26.Xie, Pengtao, Bilenko, Misha, Finley, Tom, Gilad-Bachrach, Ran, Lauter, Kristin, and Naehrig, Michael. Crypto-nets: Neural networks over encrypted data. arXiv preprint arXiv:1412.6181, 2014.
  27. 27.Zhan, Justin Zhijun, Chang, LiWu, and Matwin, Stan. Privacy preserving k-nearest neighbor classification. IJ Network Security, 1(1):46–51, 2005.

Citation

MLA
Dowlin, N., et al. “CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy”. International Conference on Machine Learning, 2016, pp. 201–10, http://proceedings.mlr.press/v48/gilad-bachrach16.pdf.
APA
Dowlin, N., Gilad-Bachrach, R., Laine, K., Lauter, K., Naehrig, M., & Wernsing, J. (2016). CryptoNets: applying neural networks to encrypted data with high throughput and accuracy. International Conference on Machine Learning, 201–210. http://proceedings.mlr.press/v48/gilad-bachrach16.pdf
Chicago
Dowlin, N., R. Gilad-Bachrach, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing. 2016. “CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy”. International Conference on Machine Learning, 201–10. http://proceedings.mlr.press/v48/gilad-bachrach16.pdf.
Harvard
Dowlin, N. et al. (2016) “CryptoNets: applying neural networks to encrypted data with high throughput and accuracy”, International Conference on Machine Learning, pp. 201–210. Available at: http://proceedings.mlr.press/v48/gilad-bachrach16.pdf.
Vancouver
1. Dowlin N, Gilad-Bachrach R, Laine K, Lauter K, Naehrig M, Wernsing J (2016) CryptoNets: applying neural networks to encrypted data with high throughput and accuracy. International Conference on Machine Learning 201–210

BibTeX

@article{dowlin2016cryptonets,
  title = {CryptoNets: applying neural networks to encrypted data with high throughput and accuracy},
  author = {Dowlin, Nathan and Gilad-Bachrach, Ran and Laine, Kim and Lauter, Kristin and Naehrig, Michael and Wernsing, John},
  year = {2016},
  journal = {International Conference on Machine Learning},
  pages = {201-210},
  url = {http://proceedings.mlr.press/v48/gilad-bachrach16.pdf}
}
Metadata:DOI registry

Source Code

This paper has an official code repository available. Click below to access the source code.

View Repository

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF
License: Published with permission