MLQE NABLER: Enabling Secure Machine Learning Queries over Encrypted Database in Cloud Computing
arXiv:2607.08197v1 [cs.CR] 9 Jul 2026
Xu Zhou, Haoyang Chen, Xinyu Lei Department of Computer Science, Michigan Technological University, Houghton, MI, USA E-mail: {xzhou4, haoyangc, xinyulei}@mtu.edu
Abstract—In cloud computing, the public cloud service providers (CSPs) can provide cloud storage as the primary service while providing additional machine learning (ML)-based services by using the clients’ data in storage. This business model extends the border of cloud computing services and brings in new business growth possibilities. Although it is promising, the model also brings in security concerns since the public commercial cloud cannot be fully trusted. For example, the public commercial clouds may sell clients’ sensitive data to the government or other companies. To address the security concerns, an immediate solution is to require clients to encrypt their datasets before outsourcing to the cloud. However, if a database is formally encrypted, then the database contains only pseudorandom numbers, making it impossible to enable ML over it. In this project, we propose MLQE NABLER (ML Queries Enabler) scheme to enable secure ML queries over encrypted database in cloud storage. MLQE NABLER employs an index-aid approach to achieve security and ML capability simultaneously. Our initial experiments show that MLQE NABLER achieves an acceptable security level while incurring only a slight ML performance degradation.
I. I NTRODUCTION Background and Motivation. In many real-world business models, clients’ data is accessible by their service providers. Multiple clients can enjoy the services provided by the centralized service providers. Meanwhile, the service providers can exploit the merged data from multiple clients to deliver some extra machine learning (ML)-based services. For example, when clients use Amazon to search and purchase products, Amazon can collect clients’ historical search/purchase data to build its ML-based recommendation system. We call the above business model as Primary Service with Machine Learningbased Service (PS-MLS) model. In the above example, the primary service is the online shipping provided by Amazon, the ML-based service is the product recommendation. PS-MLS model is quite common in practice as evidenced by the fact that most newly installed apps would pop up a window to ask for the permission to access some users’ private data. Once permitted, the app-collected data can be used to provide MLbased services. As an instance of PS-MLS model, in cloud computing, the cloud storage service (CSS) can be treated as the primary service while the cloud service provider (CSP) can also offer extra ML-based services by leveraging the massive datasets stored in the cloud. For brevity, this business model is named CSS-MLS model in this paper. Compared with local data storage, CSS has lower costs, better performance, and higher flexibility. As a result, CSS is increasingly prevalent and the
cloud-host data volumes grow exponentially. According to ComputerWeekly [1], the volume of data on earth will increase to 175 ZB (1 ZB=1012 GB) by 2025 and half of data on earth will be stored in public clouds. Due to the huge volume, even a small portions of cloud-host data is sufficient to train good ML models. Therefore, enabling ML services in CSS is a natural and pressing demand. CSS-MLS model captures the spirit of the data sharing economy in the big data era and is expected to continue to expand in the future. Promising as it is, CSS-MLS model also raises security threats towards clients’ outsourced data because the public cloud cannot be fully trusted. First, there are financial incentives for CSPs to sell clients’ personal data to the government or other companies. In addition, some corrupted cloud employees with administrator privileges may directly peek at and steal clients’ data. Moreover, cloud server may also be vulnerable to various hacking attacks (e.g., Capital One data breach [20]). To address the security concerns rooted in cloud storage, clients are usually required to encrypt their datasets before outsourcing to a public cloud. In European Union (EU), such a requirement has been enforced by the General Data Protection Regulation (GDPR) since 2018 [27]. However, if the clients encrypt their data before sending to the cloud, then it is difficult to offer ML service over encrypted data (i.e., the data utility is harmed). If tens of ZB cloud-host data cannot be used, it would lead to huge economic losses for the cloud storage industry. Thus, it is highly needed to devise a solution to maintain the ML capability over the cloud-host encrypted data while still providing data privacy protection against the untrusted cloud. Limitations of Prior Art. To address the above problem, three types of prior techniques can be used. The three techniques suffer from some limitations as analyzed below. The first one is full homomorphic encryption (FHE) [7, 3]. FHE allows direct computation over the encrypted data. However, the current FHE schemes are still inefficient for neural networks training, especially for deep neural networks. For example, an FHE-based solution take several hours to train a 4-layer neural network model on a normal PC and deeper neural network training cannot be handled [11]. The second technique is differential privacy (DP) [5, 6]. DP-based schemes rely on incorporating random noise into the original data or ML models. DP-based schemes achieve a coarse-level noise addition. If a large noise is added to the data, then the trained ML suffers from a low prediction accuracy. Whereas if a small noise is added, then the data security strength is low.
Random data items
Hence, the accuracy-precision tradeoff using DP technique is not very satisfactory. The third technique is federated learning (FL) [21, 28, 13]. It enables to train an ML model with the help of a central cloud server while keeping training data distributed over multiple clients. The major problem of FL is: it cannot provide query privacy and model privacy. For example, the trained ML model is directly leaked to the adversary. The trained ML model represents the intellectual property (IP) of the data owners and the IP leakage may lead to IP infringement. For example, the adversary may use the well-trained ML model to gain improper commercial benefits. Thus, protecting model privacy against the untrusted cloud is also desirable. Our Approach. At first glance, it is a non-trivial task to devise the solution because there is a dilemma between achieving ML capability and preserving data security. On the one hand, if clients’ data is formally encrypted (e.g., using AES or 3DES [25])), then the ciphertext are pseudorandom numbers, making it is impossible to be used for ML purposes. On the other hand, if clients’ data is not encrypted, then data security is breached. In this paper, we propose MLQE NABLER (ML Queries Enabler) scheme to enable ML queries over encrypted databases in cloud computing. At a high level, MLQE NABLER employs an index-aid approach. In MLQE NABLER, each data item (i.e., a training example) in a dataset is formally encrypted (e.g., using AES/DES) to achieve strong ciphertext privacy. For each data item, MLQE NABLER generates a secure index item. The generated index items can support ML over them. By this approach, MLQE NABLER can achieve strong ciphertext privacy and ML capability simultaneously. Technical Challenges and Proposed Solutions. In MLQE N ABLER , two major technical challenges need to be further addressed. Challenge 1: it is challenging to achieve index privacy in MLQE NABLER. Since MLQE NABLER introduces extra index items, it should be ensured that the adversary is hard to learn useful information from the generated index items (i.e., it is hard to achieve index privacy). To achieve index privacy, we use a generative adversarial network (GAN) to train a generator G to be used for secure index items generation. As shown in Fig. 1, on input an original data item, the generator G learns to generate an index item that is indistinguishable from a randomly generated data item. Based on cryptography theory [14], if the generated index item is indistinguishable from a random one, then such index generation method can achieve ciphertext-only security. This is because an adversary cannot learn useful information by viewing only the index items consisting of random numbers. In MLQE NABLER, the welltrained generator G is used for secure index items generation to protect index privacy. Challenge 2: it is challenging to preserve the ML capability over the secure index items. To address this challenge, we additionally develop a reconstructor R (as shown in Fig. 1), which aims to reconstruct the original data item from the secure index item. To train R, MLQE NABLER introduces a
Original data items
Generator G
Index items
Discriminator D
Real/ Fake
Reconstructor R
Fig. 1: How to generate secure index items by using EncGAN.
reconstruction loss, which is defined as the difference between the reconstructed data item and the original data item. After training, it holds that R(G(x)) ≈ x. It is believed that ML models can be trained over G-generated secure index items. In this paper, the secure index generation framework shown in Fig. 1 is called Encryption GAN (EncGAN). TABLE I: Comparison between MLQE NABLER and other techniques ( : supported, #: not supported, # G: partial). FHE
Ciphertext privacy Index privacy Query privacy Model privacy
N/A #
DP # G N/A # G # G
FL
Ours
N/A # #
Comparison. Table I shows the comparison between MLQE NABLER and other techniques. It can be found that MLQE NABLER can achieve four privacy-preserving goals simultaneously, thereby outperforming prior techniques in privacy protection. Our Contributions. This paper makes the following key contributions. • We identify and formulate the CSS-MLS model, where a cloud service provider aims to support ML-based services over clients’ outsourced data while preserving data privacy against an untrusted cloud. • We propose MLQE NABLER , an index-aided framework that encrypts each data item with standard encryption while generating secure index items to support ML queries. • We design a GAN-based index generation method that makes the generated index items indistinguishable from random data, thereby protecting index privacy under ciphertext-only attacks. • We introduce a reconstructor with a reconstruction loss to preserve the ML utility of the secure index items, enabling ML models to be trained over protected outsourced data. II. P ROBLEM F ORMULATION A. System Model As depicted in Figure 2, the proposed MLQE NABLER system model involves four different entities, i.e., multiple storage clients, multiple non-storage clients, a cloud server, and a key generation server (KGS). Each storage client owns
2
Cloud ML model training
Query evaluator
Trained model
Database Secure index item
Secure index generation
Key generation server
Data encryption
Request Secret key
Encrypted data item
Secure index item
Encrypted data item
Dataset 1 Storage client 1
index … Secure generation
…
Data encryption
Data download query Encrypted data items
Dataset V Storage client V
Model download query
ML query token
Non-storage clients
Secure token
Query results
ML model
Token encryption
Fig. 2: MLQE NABLER system model.
and output the ML results. Last, the ML results are returned to the client.
a large dataset (consisting of many data items) to be stored in the cloud server. The storage clients expect the cloud to additionally provide ML queries processing services. The nonstorage clients do not use the cloud storage service, but they intend to use the ML queries processing services. The cloud server is responsible for rendering data storage services as well as responding to ML queries from clients. The KGS is a server with limited storage resources and is capable of generating secret keys for each client upon request. In MLQE NABLER scheme, each storage client first formally encrypts their data items. Then, all storage clients resort to the KGS to generate a secret key. Next, each storage client uses the secret key to generate secure index items. Subsequently, each storage client outsources both the encrypted data items and the secure index items to the cloud. The secure index items can be used by the cloud for ML models training. Later, any client can send different types of queries to the cloud. Upon receipt of the queries, the cloud can process the queries and returns the corresponding results to the client. Since an increasing volume of data may be stored and accessible by the cloud, the cloud can periodically re-train the ML models to improve their quality (i.e., test accuracy).
C. Threat Model and Assumptions We consider the cloud server as the adversary, which is assumed to be semi-honest (i.e., honest-but-curious). To be more specific, the cloud server is restricted to render data storage service and ML query service as specified in the protocol. However, it also exhibits curiosity about the received data. It may record all information it can access to learn other information that should be kept secret. For example, the cloud server may try to infer clients’ original data items from the encrypted index items. Besides, the KGS is treated as a trusted entity. We assume that storage client’s data items are independent and identically distributed (IID). D. Design Goals MLQE NABLER should satisfy the following design goals. Privacy. There are four sub-goals. 1) Ciphertext privacy: from the encrypted data items, it is hard for the adversary to recover the original data items. 2) Index privacy: from the secure index items, it is hard for the adversary to recover the original data items. 3) Token privacy: from a secure ML query token, it is hard for the adversary to recover the original data item used to generate the query token. 4) Model privacy: from the trained ML model, it is hard for the adversary to reveal the ground truth (i.e., the real ML model trained using all storage clients’ original data items). • Usability. MLQE NABLER should ensure the query results are as accurate as possible. •
B. Data, ML model, and Query Types In this paper, we consider the most frequently used image data and neural network-based ML models. Besides, three types queries are supported in MLQE NABLER. • Data Download Queries. Each storage client can send this query to selectively download data items stored in the cloud. This query is the most fundamental service provided by the cloud. • Model Download Queries. All authorized clients can send this query to the cloud to request the trained ML model. • ML Queries. Consider a client wants to invoke the ML model to predict a data item’s label, the client can first invokes token encryption algorithm to generate a secure ML query. Then, the secure ML query can be sent to the cloud. Next, the cloud can feed the query to the trained ML model
III. MLQE NABLER D ESIGN MLQE NABLER consists of four major procedures: (1) key generation procedure, (2) secure index generation and data encryption procedure, (3) ML training procedure, and (4)
3
queries processing procedure. In this section, we elaborate on each procedure of MLQE NABLER.
B. Secure Index Generation and Data Encryption Procedure After KGS finishes EncGAN training, G serves as the global secret key. Then, KGS distributes the global secret key to each storage client. To achieve index privacy, each storage client feed the original data items to G and output the corresponding encrypted index items. To achieve ciphertext privacy, each storage client is required to generate a local secret key for data encryption. Then, the storage clients use their local secret keys to formally encrypt their local data items using a standard encryption algorithm (e.g, AES or 3DES). Next, storage clients outsource both the secure index items and encrypted data items (attached with its class label information) to the cloud. Note that the class label information is allowed to be disclosed to the cloud.
A. Key Generation Procedure The secret key of MLQE NABLER is the generator G of a well-trained EncGAN. To train EncGAN, KGS first collects a dataset from the Interent. The collected dataset is used by KGS to train G, D, and R (as shown in Fig. 1). After training, the generator G serves as the secret key. Adversarial Loss. We adopt the adversarial loss in [8] to ensure that the index items generated by G are indistinguishable from the randomly generated data items, so that the privacy of index items can be protected. Formally, given a set of real data items I ⊆ X (X denotes the data space), G aims to transform each real data item x ∈ I into an index item G(x) that is indistinguishable from a data item z randomly sampled from X , while D aims to distinguish between G(x) and z. Therefore, the adversarial loss is given by Ladv (G, D) = Ez∼Unif(X ) [log D(z)] + Ex∼Unif(I) [log(1 − D(G(x)))].
C. ML Training Procedure Upon receipt of the secure index items and their attached label information from multiple storage clients. The cloud can train different ML models directly over secure index items. The trained ML model is denoted as M ′ .
(1) (2)
D. ML Queries Processing Procedure
Reconstruction Loss. To support ML over G(x), we train G jointly with a reconstructor R, which aims to recover x from G(x). We introduce a reconstruction loss to train G and R. The reconstruction loss is defined as the distance (using the ℓ1 -norm) between the reconstructed data item R(G(x)) and the real one x. It is given by
Full Objective. To sum up, the final loss can be represented as L(G, D, R) = Ladv (G, D) + λrec Lrec (G, R). (4)
Given a data item without an ML result (e.g., without a label), clients can query the cloud for the ML result. First, any clients (including both storage clients and non-storage clients) can request the global secret key G from KGS. Then, the KGS sends the secret key G to the authorized clients. To have an ML query, the client uses G to transform the data item q to generate an encrypted token G(q). Next, the encrypted token G(q) is sent to the cloud. Upon receipt, the cloud feeds G(q) to the trained ML model M ′ to obtain the query result M ′ (G(q)). At last, the query result M ′ (G(q)) is returned to the client.
During the training process, MLQE NABLER aims to solve
IV. MLQE NABLER A NALYSIS
G∗ = arg min max L(G, R, D).
In this section, we analyze MLQE NABLER in terms of security and performance.
Lrec (G, R) = Ex∼Unif(I) [∥R(G(x)) − x∥1 ].
G,R
D
(3)
(5)
The EncGAN training algorithm is shown in Algorithm 1.
A. Security Analysis
Algorithm 1: EncGAN Training Algorithm Input: Generator G; discriminator D; reconstructor R; set of real data items I; data space X ; total number of iterations T ; batch size B. Output: Well-trained G∗ . 1 Randomly initialize G, D, and R; 2 for iteration t = 1 : T do 3 Draw a minibatch of B real data items from I; 4 Draw a minibatch of B random data items from X ; 5 Compute L(G, D, R) according to Eq. (4); 6 Update D by ascending its stochastic gradient; 7 Update G and R by descending its stochastic gradient; ∗ 8 return G = G;
Ciphertext Privacy. In MLQE NABLER, each data item in clients’ private datasets is formally encrypted by standard encryption methods (e.g., AES or 3DES) using clients’ local secret keys. After being outsourced to the cloud server, an adversary is unable to restore the original data from the encrypted data item without the local secret keys. Accordingly, ciphtertext privacy can be achieved by MLQE NABLER. Index Privacy. In MLQE NABLER, secure index items are encrypted by using G. One loss function (i.e., the adversarial loss) in training G is to control output the index items to be hard to be distinguished from pseudorandom ones. Thus, the index privacy is protected to some extent. Note that there is a tradeoff between the index privacy protection strength and the ML result accuracy. Token Privacy. In MLQE NABLER, a client’s token is encrypted by using G, Hence, the token privacy is protected in the same way as the index privacy analyzed above.
4
Model Privacy. In MLQE NABLER, the cloud is responsible for training the ML model M ′ over secure index items. To properly use the ML model trained on the cloud, as shown in Figure 3, a client needs to first send an original data item to G and then send the output to M ′ . Therefore, the real usable ML model is M = G ◦ M ′ (i.e., G has the series connection with M ′ ). Since the cloud only has access to M ′ and the secret key G is kept secret from the cloud, the cloud unable to correctly use the ML model. Thus, the model privacy is protected.
EncGAN on DIV2K and evaluate it on CIFAR-10, CIFAR100, Tiny-ImageNet, GTSRB, and CelebA. The datasets are briefly described as follows. • DIV2K: The DIV2K dataset was introduced for examplebased single image super-resolution (SR) and also used for image hiding in [12, 9]. It contains 800 training images and 100 validation images with 2K resolution. • CIFAR-10 [16]: CIFAR-10 is an image classification dataset with ten classes and consists of 50,000 training images and 10,000 testing images with the same image size of 32 × 32. • CIFAR-100 [16]: CIFAR-100 is an image classification dataset with 100 classes and consists of 50,000 training images and 10,000 testing images with the same image size of 32 × 32. • Tiny-ImageNet [17]: The Tiny-ImageNet dataset is a widely used image classification benchmark with 200 distinct classes. It contains a total of 100,000 training images and 10,000 testing images, each with a uniform resolution of 64 × 64 pixels. • GTSRB [26]: The GTSRB dataset comprises 51,800 traffic sign images in 43 categories. The dataset is divided into 39,200 training images and 12,600 testing images. The image size is 32 × 32. • CelebA [19]: The CelebA dataset is a large-scale face attributes dataset with 202,599 colored celebrity images (162,770 for training, 19,867 for validation, and 19,962 for testing). Each image has a size of 218×178 and 40 binary attributes. Following the configuration in [4, 22, 24], we select the top three most balanced attributes (i.e., Heavy Makeup, Mouth Slightly Open, and Smiling) and concatenate them into eight categories. Our experiments only use its training set and testing set for consistency with other datasets. Model Architectures. For the target ML model, we adopt the CNN-based ResNet-18 [10] and the transformer-based SwinV2-T [18]. Parameter Settings. We train EncGAN for 200 epochs on the DIV2K dataset using the Adam [15] optimizer with β1 = 0.5, β2 = 0.999. The batch size is 1 for each iteration. The initial learning rate is set to 2 × 10−4 . It remains constant for the first 100 epochs and then linearly decays to 0 over the subsequent 100 epochs. Data augmentation techniques include random horizontal flipping, random vertical flipping, and random cropping to 224 × 224 pixels without padding. For image classification tasks, we train ResNet-18 for 200 epochs with a batch size of 128 using the SGD optimizer with a momentum of 0.9, a weight decay of 5e-3, and an initial learning rate of 0.01, which is divided by 10 after 100 and 150 epochs. We employ the AdamW [15] optimizer with β1 = 0.9, β2 = 0.95, and a weight decay of 0.1 to train SwinV2-T for 300 epochs with a batch size of 128. The learning rate increases in the first 20 epochs from 0 to 1e3 with a linear warm-up scheduler and then decreases in the remaining 280 epochs to 0 with a cosine decay scheduler. Without loss of generality, all images from the classification datasets are resized to 224 × 224 pixels. We use random
Cloud Original data items
G
Trained ML model
Query results
Real usable ML model: Fig. 3: Why model privacy is protected. Loss-Functions-Controllable Noise Addition. In MLQE N ABLER , the encrypted process by using G can be viewed as a loss functions-controllable (LFC) noise-addition technique. Compared with differential privacy (DP), the proposed LFC noise-addition method is more fine-grained since the noise addition process in MLQE NABLER is directly guided by the designed loss functions via ML, whereas DP’s noise addition is only determined by a pre-specific coarse noise scale parameter (defined in Laplace distribution). The proposed LFC noise addition method can be viewed as a new type privacypreserving technique. It be used in many other applications beyond this paper. B. Performance Analysis Dataset Add/Deletion Handling. Each storage client may dynamically add and delete the data items in its cloud storage. The cloud server can selectively choose the updated dataset to retrain updated ML models. For example, if clients add more data items in cloud storage, the cloud can re-train better ML models by harnessing more training data. Security-Space Tradeoff. In MLQE NABLER, there exists a tradeoff between security and space cost. For each data item to be stored, the client needs to generate a secure index item that is used for ML purposes, so the space cost is doubled in MLQE NABLER. That is, MLQE NABLER sacrifices space for ML purposes. The extra space cost in MLQE NABLER is not a big issue since storage space is a very cheap resource in cloud computing. V. E XPERIMENTS A. Experimental Setup MLQE NABLER is applicable to various types of data. In this paper, we only apply it to image data and leave other data types (e.g., text) for future work. We conduct extensive experiments on the classification task. Datasets. In our experiments, six image datasets are adopted, including DIV2K [2], CIFAR-10 [16], CIFAR-100 [16], TinyImageNet [17], GTSRB [26], and CelebA [19]. We train
5
CIFAR-10
CIFAR-100 Tiny-ImageNet
GTSRB
CelebA
Index
Original
horizontal flipping and random cropping to 224 × 224 pixels after a 28-pixel padding on each side of the resized images for data augmentation on the CIFAR-10, CIFAR-100, TinyImageNet, and CelebA datasets. Implementation. We conduct the experiments on a single NVIDIA GeForce RTX 3090 GPU using the PyTorch [23] framework. B. Evaluation Metrics
Random
Patch Information Entropy (Patch IE). Patch IE measures the average patch-wise information entropy of an image. Given an image of size C × H × W , it can be partitioned into a sequence of N non-overlapping patches {Ipi }N i=1 , each of spatial size P × P , where N = HW/P 2 . Patch IE is defined as N 1 X H(Ipi ), (6) PIEp (x) = N i=1
Fig. 4: Visual comparison of original images, EncGANgenerated index items, and random images. Each column corresponds to one dataset.
where H(Ipi ) computes the information entropy of the i-th image patch. Authorized Accuracy (AA). AA quantifies how much an obfuscation method preserves data utility for DNN training. It is defined as the accuracy of a model trained on obfuscated data. A higher AA indicates higher training utility. Note that DP and InstaHide evaluate trained models on original testing data, while VIM and our method evaluate on obfuscated testing data. Unauthorized Accuracy (UA). UA evaluates the effectiveness of model intellectual property protection. It is defined as the accuracy of a model trained on obfuscated data when tested directly on the plain (non-obfuscated) testing set. A high UA suggests that the trained model is usable on plain images without authorization, whereas a low UA indicates strong protection against unauthorized deployment.
the original images, although the utility loss varies by dataset and model.
TABLE II: Authorized accuracy (AA) of ResNet-18. Drop is the absolute decrease from Original to Index.
C. Main Results
Dataset
Original
Index ↑
Drop ↓
CIFAR-10 CIFAR-100 Tiny-ImageNet GTSRB CelebA
95.75% 79.35% 63.39% 99.42% 80.67%
94.45% 76.30% 62.91% 99.35% 79.94%
1.30% 3.05% 0.48% 0.07% 0.73%
TABLE III: Authorized accuracy (AA) of SwinV2-T. Drop is the absolute decrease from Original to Index.
Visualization. Fig. 4 compares original images, EncGANgenerated index items, and random images. For each dataset, the figure shows a randomly selected original image, its corresponding index item, and a random image. The index items expose no recognizable content from their source images and visually indistinguishable from the random images. Patch IE. Fig. 5 reports Patch IE for original images, EncGAN-generated index items, and random images over multiple patch sizes. Across all datasets and patch sizes, the Patch IE of the index items closely tracks that of random images and is consistently higher than that of original images. Authorized Accuracy. Tables II and III report AA for ResNet18 and SwinV2-T, respectively. We compute the accuracy drop as AAOriginal −AAIndex . For ResNet-18, the drop ranges from 0.07% to 3.05%, with an average of 1.13%. For SwinV2-T, it ranges from 0.21% to 6.13%, with an average of 2.86%. The largest drop occurs on CIFAR-100 with SwinV2-T, whereas the drop on GTSRB is below 0.25% for both models. Overall, the index items preserve most of the accuracy obtained from
Dataset
Original
Index ↑
Drop ↓
CIFAR-10 CIFAR-100 Tiny-ImageNet GTSRB CelebA
95.11% 75.07% 63.78% 99.44% 80.89%
92.23% 68.94% 60.03% 99.23% 79.57%
2.88% 6.13% 3.75% 0.21% 1.32%
Unauthorized accuracy. Tables IV and V report UA for ResNet-18 and SwinV2-T, respectively. RG denotes the accuracy of uniform random guessing. On CIFAR-10, CIFAR-100, and Tiny-ImageNet, UA is close to RG for both architectures, indicating that a model trained on index items is nearly random guessing when applied directly to original images. The comparatively higher UA observed on GTSRB and CelebA can be attributed to their imbalanced class distributions, which lead to biased model behaviors.
6
4 2
0 14 28 56 112 224
Patch Size
6
8
4 2
0 14 28 56 112 224
Patch Size
Original
Tiny-ImageNet
6
8
4 2
0 14 28 56 112 224
Patch Size Random
GTSRB
6
8
Patch IE
6
CIFAR-100
Patch IE
8
Patch IE
CIFAR-10 Patch IE
Patch IE
8
4 2
0 14 28 56 112 224
Patch Size Index
CelebA
6 4 2 0 14 28 56 112 224
Patch Size
Fig. 5: Patch IE of original images, EncGAN-generated index items, and random images across datasets and patch sizes. TABLE IV: Unauthorized accuracy (UA) of ResNet-18 across different datasets. RG denotes the accuracy of uniform random guessing. Dataset
Original
Index ↓
RG
CIFAR-10 CIFAR-100 Tiny-ImageNet GTSRB CelebA
95.75% 79.35% 63.39% 99.42% 80.67%
10.18% 1.66% 0.54% 8.23% 23.32%
10.00% 1.00% 0.50% 2.33% 12.50%
dependent messages. In Annual cryptology conference (Crypto), pages 505–524. Springer, 2011. [4] Qiuyu Duan, Zhongyun Hua, Qing Liao, Yushu Zhang, and Leo Yu Zhang. Conditional backdoor attack via jpeg compression. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 38, pages 19823– 19831, 2024. [5] Cynthia Dwork. Differential privacy. In International Colloquium on Automata, Languages, and Programming (ICALP), pages 1–12. Springer, 2006. [6] Cynthia Dwork. Differential privacy: A survey of results. In International conference on theory and applications of models of computation (TAMC), pages 1–19. Springer, 2008. [7] Craig Gentry. A fully homomorphic encryption scheme. Stanford university, 2009. [8] Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in Neural Information Processing Systems, 27, 2014. [9] Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 45(1):372–390, 2022. [10] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. [11] Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. Deep neural networks classification over encrypted data. In Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy, pages 97–108, 2019. [12] Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 4733– 4742, 2021. [13] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji,
TABLE V: Unauthorized accuracy (UA) of SwinV2-T across different datasets. RG denotes the accuracy of uniform random guessing. Dataset
Original
Index ↓
RG
CIFAR-10 CIFAR-100 Tiny-ImageNet GTSRB CelebA
95.11% 75.07% 63.78% 99.44% 80.89%
10.32% 1.55% 0.60% 7.98% 27.16%
10.00% 1.00% 0.50% 2.33% 12.50%
VI. C ONCLUSION In this paper, we have developed a novel framework to enable Secure machine learning queries over encrypted database in cloud Computing. MLQE NABLER employs an index-aid approach to achieve security and ML capability simultaneously, while incurring only a slight ML performance degradation. ACKNOWLEDGMENT This work is supported by the National Science Foundation under Grant Number CNS-2153393. R EFERENCES [1] Antony Adshead. Data volumes set to hit 175zb with a tectonic shift to the cloud, 2018. [2] Eirikur Agustsson and Radu Timofte. Ntire 2017 challenge on single image super-resolution: Dataset and study. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 126–135, 2017. [3] Zvika Brakerski and Vinod Vaikuntanathan. Fully homomorphic encryption from ring-lwe and security for key
7
Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. arXiv preprint arXiv:1912.04977, 2019. [14] Jonathan Katz and Yehuda Lindell. Introduction to modern cryptography. CRC press, 2020. [15] Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014. [16] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. [17] Ya Le and Xuan S. Yang. Tiny imagenet visual recognition challenge. 2015. [18] Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, et al. Swin transformer v2: Scaling up capacity and resolution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12009–12019, 2022. [19] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 3730–3738, 2015. [20] Jack Lu. Assessing the cost, legal fallout of capital one data breach. Legal Fallout Of Capital One Data Breach, 2019. [21] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communicationefficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273– 1282. PMLR, 2017. [22] Anh Nguyen and Anh Tran. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021. [23] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in Neural Information Processing Systems (NIPS), 32, 2019. [24] Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor attacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 703–718. IEEE, 2022. [25] William Stallings. Cryptography and network security, 4/E. Pearson Education India, 2006. [26] Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks (NN), 32:323–332, 2012. [27] Paul Voigt and Axel Von dem Bussche. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10:3152676, 2017. [28] Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and appli-
cations. ACM Transactions on Intelligent Systems and Technology (TIST), pages 1–19, 2019.
8