Thank you very much for having me.
So, to start a little bit about myself, I'm passionate about research and teaching.
So, this is me trying to explain to my eight-month daughter super-singular isogeny key exchange with bubbles and flowers.
Currently, I'm a security researcher at Orange Services, and I'm focusing on applied cryptography and especially privacy-preserving machine learning.
So, this presentation has two goals.
The first goal is to show you that we can.
We can have privacy and security simultaneously.
And the second goal of the presentation is to show you how to design and implement privacy-preserving anomaly detection.
So, we'll begin with why anomaly detection.
Then we'll start to define what is privacy.
And then we'll see two coding examples.
We'll implement k-means with homomorphic encryption and auto-encoders with differential privacy.
So, why anomaly detection?
Well, anomaly detection is almost everywhere in cybersecurity.
From user behavior analytics to network traffic analysis or endpoint security, we find anomaly detection almost everywhere.
Because we want to find anomalies.
Anomalies represent attacks.
And that's why we try to focus on anomaly detection.
There are two main algorithms that implement anomaly detection.
The first one is k-means.
K-means is a clustering algorithm.
It's what we call a classical machine learning algorithm.
And it requires two things.
The data, the input data, and the number of clusters.
And we detect anomalies by k-means by computing the distance from the nearest clusters and then checking if that distance is below a certain threshold.
The second option to implement anomaly detection is using auto-encoders.
Unlike k-means, auto-encoders are neural networks that requires only the data.
So nothing else but the data.
They are neural networks that try to compress and reconstruct the input.
So it's a neural network.
You use the input and the output are the same.
And we use auto-encoders to detect anomaly detection by computing what we call the reconstruction error and checking if that error is below a certain threshold.
You'll see details in a moment.
So there are two philosophies regarding privacy.
The first one is the philosophy of the input privacy.
And the second one is the philosophy of the output privacy.
Homomorphic encryption helps with input privacy, but differential privacy helps with the output privacy.
And to better illustrate my ideas, we need the help of two main figures in cryptography.
So we are talking here about Alice, you all know Alice, and Bob.
So we have here Alice, and here Bob.
All right, I switch the screen.
I commute to another desktop and...
So...
I don't know.
All right, we get...
Yeah, a little bit of technical issues here, but that's all right.
Okay, so...
I was talking about Alice, you all know Alice from cryptography, and Bob.
Two main figures in cryptography.
So I want to illustrate better my ideas about the input and the output privacy.
So Alice has some data, a lot of data.
And Bob has, well, a lot of servers.
Alice wants to train a neural network, but she doesn't have the hardware, Bob has the hardware.
And at the same time, Alice doesn't want to give her pressure data to Bob.
So Alice will first encrypt her data using a homomorphic encryption scheme, and send the ciphertext back to Bob.
So encrypt using FHE, and send the encrypted data back to Bob.
Now, Bob will train the neural networks on his precious hardware, but he will train the network directly over encrypted data.
And of course, he will get an encrypted neural network that he will send back to Alice.
So here, Bob sent back the encrypted network to Alice.
So Bob doesn't see data at any moment, because the data are encrypted using homomorphic encryption.
Now, Alice decrypts the results, and well, she has now a nice neural network.
But now, I call a third figure, main figure in cryptography, namely Eve.
And Eve comes to Alice and says, well, Alice, can I use your cool neural network?
And Alice, you know, it's a nice person in cryptography, and says, yes, here is an API, you can make any number of requests as you want.
So, the question is, are Alice's data private anymore?
And keep in mind that when the neural network was trained, Bob didn't saw the data at any time.
Bob only see encrypted data.
And Alice now encrypts exposed neural networks, pre-trained neural networks.
So the question is, if Eve got access to Alice's neural networks, are the initial data private?
And the answer is no.
And to put it in a nutshell, we have what we call membership inference attacks on neural networks.
And to give you an example, well, neural networks tends to be more confident on training data than on test data.
So, here is an example.
Suppose that these neural networks classify handwritten digits.
Just to give you a simple and quick example to use the same idea.
And now Eve uses these neural networks and submits to Alice the digit seven, D7, to be classified.
And the neural network will get back with a result saying that, you know, this is a seven with a probability of 51%.
It's all right, it's a seven.
But then Eve makes another call to the neural networks.
And this time he submits D7.
And she sends D7 back to the neural networks and the neural network responds with, oh yes, this is a seven with a probability of 99.99%.
Now, you can see that on the second example, the neural network is more confident.
And this is why neural networks tend to be prone to this type of attack, membership inference attacks.
Because now Eve can deduce with high probability that the second sample was part of the training dataset.
Of that dataset that Alice wants to be private, of this dataset.
So, in order to mitigate this attack, Bob has to train the neural network using differential privacy.
Differential privacy, to put it short, is a way in which you can train neural networks in such a way to mitigate membership inference attacks or data poisoning attacks or any type of attacks on the privacy of the output.
So, back to the presentation.
All right, so I said that we have two main philosophies.
That means that we have two main libraries that implement those philosophies.
OpenFHE, which is a library for fully homomorphic encryption.
It supports encryption schemes like CKKS, BGV, BFV, and other three letters encryption schemes.
And TensorFlow.
Yes, TensorFlow, which is a library, it's a well-known library, does support training neural networks with differential privacy.
And we'll see an example.
Now, regarding k-means, like I said, it's a clustering algorithm.
The purpose of k-means is, given the input data and the number of clusters, the point of the algorithm is to partition the data into k different clusters, like you see in this image.
And here is a short description of the algorithm.
The algorithm is actually very simple.
We compute, for each point, we compute the shortest, we compute the nearest center point, and then for each center point, we update the distances.
We'll see more about it in a minute in code.
And we'll try to implement these algorithms using OpenFHE directly over encrypted data.
So, we saw about k-means, now let's talk about fully homomorphic encryption, or level homomorphic encryption.
Well, it's an encryption scheme that supports computing directly over encrypted data.
So, when we, for example, add two ciphertexts, we'll obtain a ciphertext that encrypts the sum of the two original plaintexts.
And when we multiply, for example, two ciphertexts, we'll get a ciphertext that encrypts the products of the initial plaintext.
In this example that you'll see, we'll use the well-known scheme of CKKS.
It's a level homomorphic encryption that means that we have to specify in advance the number of consecutive multiplication because in cryptography, and especially in this area of homomorphic encryption, we don't have a problem with addition.
We can add as many as we want, but we have a problem with multiplication because multiplication are costly.
And this type of schemes, level homomorphic encryption, are efficient, can compute multiplication efficiently, but we need to specify in advance the depth of the circuit, what we call the depth of the circuit, which is the number of consecutive multiplications.
So if you, for example, want to compute X to the power third, for example, over encrypted data, so with an encrypted X, we have to specify that the depth of the circuit is three.
It's a scheme suitable for machine learning tasks because it encrypts directly real numbers, and we'll get back approximate result.
So this is a high-level overview of the scheme.
The idea here is to see that these type of schemes are not really like RSA in which you have M to the power E, C to the power D, and so on, classical mathematical operation from high school.
Those type of schemes are a little bit more complicating, and this is good for us because none of us will try to implement the scheme in-house, but we'll use a well-known and verified library, like OpenFHE, so that's one advantage of fully homomorphic encryption.
Now, I promised you some code, so let's see some simulation.
So again, this is a simulation.
I'm not such a good programmer, so I don't have a real server, but I want to give you an example how we can use OpenFHE.
So here we have the data, our data.
Yeah, a little bit of technical problems.
You can see that this never happens before, but yes.
All right, so we have a simple example with four points, two clusters, and we'll try to implement k-means with this input, but we'll run over encrypted data.
And here is our simulation.
So in this part, this part is very simple.
This part is performed by Alice.
Alice reads the points and encrypts them, and basically she sends the encrypted points back to Bob, back to the server, together with the number of clusters, because like I said, k-means requires the number of clusters.
So here we encrypt the points and send to Bob, to the server.
And here is where the magic happens in this function, encrypted k-means.
As you can see, we send the arguments, the encrypted points, and the number of clusters.
And let's take a deeper look in this example.
All right, so like you've seen in that short algorithmic description, the algorithm k-means has two steps.
In the first step, we assign centroids, and in the second step, we update the centroids.
In this first step, in assign centroids, like you can see, we send as arguments the encrypted points and the encrypted centroids, because in the first step of the algorithm, we randomly initialize some centroids.
But we are working over encrypted data, so we initialize with random encrypted centroids.
So we have encrypted points and encrypted centroids.
Now, we have to determine, the first step is to determine the distance between each point and each clusters.
And we make this with this for loop.
In this for loop, we iterate over all the encrypted points, and for all encrypted points, we compute the distance from that point to each centroids.
In this for loop, we iterate over the centroids.
And as you can see, this is the function encrypted distance.
We compute the square Euclidean distance between two encrypted points.
And let's take a look inside this function.
So here is a classical example of working with OpenFHE.
So we first subtract the first point from the second point, with that function, eval sub, and then we square the result.
And again, we make all these operations directly over encrypted data.
So we'll get an encrypted sum.
All right, so we are here.
We're keeping this vector, the encrypted distance between each point and each clusters.
Now, we have to determine, for that certain point, what is the index of the nearest centroids.
So we have to determine for center points, what is the nearest centroids.
And for that, we have to compute the minimum between the distances that we just computed.
And the magic happens here in this encrypted select.
Like you can see, this is a classical for loop that computes a minimum.
Basically, here we initialize the minimum distance and the minimum index with the zero, but not with the plain text zero, but with the encryption of zero.
And here, we iterate over the centroids.
So you have a point, and now we iterate over the centroids to determine what centroids is the closest to our point.
And the magic happens here in encrypted select.
Like you can see, the encrypted select receives as arguments two ciphertexts, ciphertext one and ciphertext two, and it returns two things.
The minimum between the two ciphertexts and the index of the ciphertext.
So, if ciphertext one, for example, encrypts a number that is lower than the number encrypted by ciphertext two, we'll get as a result of this function, ciphertext one, together with the encryption of zero.
And to compare things, to compare ciphertext using OpenFHE, we can use this function if I compare scheme switching, which is a function that was introduced in OpenFHE, I think, two months ago, so it's pretty new.
Because this is the strange things with homomorphic encryption, we can, in theory, we can compute anything over encrypted data using Open, using FHE.
But in practice, it's quite hard to compare two encrypted numbers.
And I mean, by comparing two encrypted numbers, I mean, I need a function that receives as arguments two ciphertexts and return, as a result, the encrypted sign of the difference between the two ciphertexts.
But this function is now implemented in OpenFHE.
It's quite complex.
All right, so here we determine the sign of the ciphertext two minus ciphertext one.
So basically, here we determine which ciphertext includes the lower number.
And based on that, we return the minimum between the two ciphertexts.
Here, and the encrypted, and the index of the minimum.
So if ciphertext one is less than ciphertext two, we return the encryption of zero.
Otherwise, the encryption of one.
So, putting it all together in this function of size centroids, like I said, we first compute the distance between each point and each clusters over encrypted points.
And then we compute the minimum distance over that encrypted, over that encrypted array.
So, now we have this vector, encrypted cluster indices, which points the minimum index of the nearest centroids.
So for each point in that array, we have the encrypted index of the nearest centroids.
So for example, if the nearest centroids for point P1, for example, is cluster zero, we will get the encryption of zero.
And keep in mind that we are working over encrypted data.
So, now that we have this vector, we can easily update the centroids in this function by computing the arithmetic mean of, between the points assigned to a certain centroids.
So we know that, for each centroids we know what points were assigned to it.
And now, for each centroids we compute the arithmetic mean between the points that were assigned to that centroids.
And this can be easily implemented in OpenFH.
You can easily implement an arithmetic mean because it's basically addition and a final division.
Like we can see here in the code.
So here we have the addition part, in which we add the points assigned to that centroids.
And here we keep in mind the cluster size, the number of points that were assigned to that centroids.
But again, this is also encrypted.
So here we, for example, here when we increase the cluster size, we don't know whether we actually increase it or not.
Because, like I said again, we are working over encrypted data.
So this is an encrypted, like the variable points, this is the encrypted cluster size.
So the server doesn't have access.
This is the main idea, the server doesn't have access.
Neither to the points, nor to the centroids, or to each cluster size, because they're all encrypted.
And here is how we implemented k-means over encrypted data using OpenFH.
And one more thing, when we run this algorithm, for example, and decrypt, of course, we will see that these centroids are an approximation of the original centroids.
Which are here and here.
All right.
So now we are going to our second topic about differential privacy and autoencoders.
Just a quick overview of autoencoders.
Like I said, they are neural networks that receive as output, in which the output is the same as the input.
And in the middle we have what we call a bottleneck.
The purpose of the network is to reconstruct the input, basically.
And here is an overview of the algorithm itself.
And regarding our main part of anomaly detection...
Sorry.
Regarding our main purpose of anomaly detection, like I said, we compute the reconstruction error for each sample and detect anomaly by comparing the reconstruction error with a certain threshold.
And if the reconstruction error is below a certain threshold that we see that, okay, we don't have an anomaly.
What is reconstruction error?
Just to give you a more precise idea.
This network will never get the same input in the output.
Doctors try to reconstruct the input, but she'll not get it right at every run.
And we'll always have a small difference between the input and the output.
That's the reconstruction error.
The difference between the input and the output.
Now, a little bit about differential privacy.
It was introduced several years ago by Cynthia Work.
And the main idea when we apply differential privacy to machine learning, there are three things to keep in mind.
That the whole idea of differential privacy is noise addition, so we add noise to the data before we train a neural network over that data.
We have the notion of privacy budget, which is very nice because we have actually numbers that reflects how much privacy did we lose one training.
And we have to always keep the trade-off between the privacy and utility.
Because if we add too much noise, we will not get the utility.
And if we add to a lower amount of noise, we'll basically betray the privacy.
All right, this is a rather mathematical definition of differential privacy.
I will illustrate to you here.
And then you'll see a working example, a quick working example.
All right, so we have a data set.
This is differential privacy.
We have a data set composed of many samples, so to say.
And we want to guarantee the privacy of each sample.
The privacy of each individual, so to say.
Because the data set, it's composed, we suppose that each sample is assigned to a certain individual.
So we want to preserve the privacy of each individual.
The idea behind differential privacy is the following.
We have an attacker, Eve, for example.
All right, so Eve will try to attack the privacy of this data set.
When I remove, so this is the core idea, when I remove just one sample of this data set, the attacker will not see any difference in his attack.
So suppose that the attacker tries a brute force attack or has a tool and so on.
Just take this example with the neural network, Eve here.
Eve can probe that neural network as she wants.
He can try to, you know, many samples as input and so on.
The idea behind differential privacy is when Alice removes one sample of this data set and the attacker resumes his attacks, he will not detect that one sample was removed.
And what's a better way to protect privacy than this?
It's like we guarantee to each individual in our data set that, you know, whether you are in my data set or not, it doesn't matter because the attacker will not know how and when I remove you from the data set.
So please be here in my data set because you don't matter.
It's quite challenging, but it works.
And that's the intuition behind this mathematical expression of probabilities.
So keep in mind that differential privacy, it's about the privacy of each individual.
I remove one sample, the attacker doesn't know it.
So I protect the privacy of that sample.
All right.
And why do you need differential privacy?
Well, remember the Netflix competition?
Netflix held a competition several years ago in which they released a huge amount of basically what they call anonymous data set, but some researchers were able to de-anonymize it and get back the details about different individuals.
All right, so let's see a practical example of anomaly detection using auto-encoders.
We will use KDD99, a subset of KDD99 data set to detect buffer overflow attacks over a network.
And what we'll do, we'll use TensorFlow to implement an auto-encoder with differential privacy.
So let's practice again this part.
All right, so here, as you can see, I read a subset of KDD data set.
The data set about networks attacks is a well-known data set about network attacks.
It contains data like the duration of the connection, dimension of sources and destination, and so on.
I will not get into the details, but keep in mind that is a data set on network attacks.
Here I make some preprocessing of the data.
And here is the architecture of my auto-encoder.
As you can see, the first part, the encoder part, is a mirror of the second part, the decoder part, so to say.
So I have a layer of 64 neurons, then 42 neurons, then 60 neurons, and then eight neurons, and then I increase it again.
And the point of these neural networks is to reconstruct its inputs.
And here is the main part of differential privacy.
I mean these parameters, this parameter noise multiplier, because this parameter will indicate how much noise will be added to our data.
And the rest is classical TensorFlow.
Here we set the optimizer, here we compile our auto-encoder, and here we train the neural network.
And this is a picture that showed the intuition between anomaly detection using this one and this one, actually, using auto-encoder.
So as you can see, we have, on training data, for example, we have a lower loss than on validation data, so it's a difference.
And that difference, the reconstruction error, will be used to detect anomalies.
You compare the reconstruction error with a threshold.
All right, so let's...
straight to the end.
So here is the results.
As you can see, we add noise to our data, but the final result indicates that we still have a 94% accuracy of our neural network.
So although we've added noise to our input data, we still get a high accuracy.
And here is a special function implemented in TensorFlow privacy, which is a branch, actually, of TensorFlow, which indicates that epsilon.
So here, epsilon is 0.144.
That epsilon from that strange mathematical definition is not so strange.
So what that value tell us is that, basically, that value measures how private we are in our computation, how private is our autoencoders.
Because suppose that the autoencoders is attack, probe, I don't know.
The probability of success on that attack is this first probability, this one here.
But when I remove just one sample from my data set and the attacker resumes his attacks, the probability that he'll get another result, the probability that the attacker will know that, all right, some sample was removed, is bounded by this quantity, e to the power epsilon.
And this quantity on our specific example is something very small.
All right, so this is the idea behind differential privacy.
And as you can see, you can just use TensorFlow.
You don't need any other libraries.
All right, so to conclude, actually, we can provide security and privacy simultaneously.
We can use OpenFHE for implementing operation over encrypted data, like you saw.
We can use a classical library for machine learning, namely TensorFlow, to implement training neural networks with differential privacy.
And keep in mind that privacy is a property of both the input and the output.
And basically, the final conclusion is that it's possible.
You saw what algorithms we can use to detect anomalies.
You saw how to implement those algorithms over encrypted data.
You saw practical examples.
So you didn't saw some theory, abstract mathematical formulas, and so on.
You saw code, basically.
So the idea is that it's possible to implement both security and privacy.
So thank you, and if you have any questions.
Thank you so much for that.
And thank you for keeping things so practical, especially when they're this hairy, let's say.
So we're going to go to questions.
We have time for two, three.
Raise your hand if you...
We have one over there.
Hello, thank you for your presentation.
Can you hear me all right?
Yes.
Okay, so you mentioned that if I subtract data from my data set, the attacker will not be able to see that I modified somehow.
So it's a pretty slim chance, a low probability.
Yes.
What about aiding data?
Will he be able to see it or detect?
Yes, the actual result is yes.
Differential privacy only work when we remove just one sample from our data set.
This is...
That was quite hard to understand for me because I had the same question when I started studying differential privacy.
But the idea behind this framework of differential privacy is to guarantee the privacy of each.
And I highlight each individual.
So you are not concerned to protect the privacy of a group of individuals.
We are concerned to protect the privacy of just one individuals.
If you remove, for example, two samples or three samples or five samples, yes, you will affect the privacy.
Okay, so it's something like protection, the privacy protection of subsets of some data, right?
Yes.
Okay, great.
Okay.
Let's go over here.
I suppose that the library that you provide for fully homomorphic...
Sorry ?
I suppose that your library for fully homomorphic encryption is the state of the art at the moment.
What are the performances in this case?
Did you have some tests in the past?
Yes, I performed some tests, even on large scale.
Let's say that a classical home laptop will not be able to run 1 million comparison over encrypted data.
So there is no problem.
You can run tens of millions of encrypted additions and even tens of millions of encrypted multiplication, for example.
But when it comes to simple operation that, you know, it's quite simple operation like comparison, for example, minimum, maximum, and so on, they are quite...
I'm not saying efficient, but you'll need hardware acceleration to compare, for example, 10 millions of encrypted data.
And the library also support hardware acceleration.
And you can compare something like 10 millions encrypted data in under 30 minutes to give precise results.
Okay, thank you for that.
Any other questions?
We have time for one more.
Coming to you.
Hi, thank you for the presentations.
It was kind of interesting for me, at least.
My question is regarding the FHE library.
Is it used by any, let's say, neural network libraries like PyTorch or TensorFlow?
Or do we need to re-implement and...
Re -implement , unfortunately.
But the library has, from, I think, one month ago, they introduced a Python wrapper over the C library.
And at the moment, it's not fully integrated with TensorFlow or PyTorch or any other frameworks.
But that Python wrapper is promising because the next step will be to integrate with one of these libraries, I suppose, to directly encrypt tensors.
So I think in the future, it will be integrated.
Does it let you encrypt tensors and do operations on tensors at this point?
I think all the operations basically are, in the end, additions and multiplication between numbers.
So I think...
Yeah, but like...
That's at the low level, but like...
The library also has an example on their GitHub page in which they show how to train neural networks using OpenFHE in C at the moment.
But it will come an example with Python as well.
Thank you.