Towards Practical Differentially Private Machine Learning under FHE

Abstract: As machine learning is increasingly deployed in sensitive domains such as finance and healthcare, privacy risks can arise from multiple directions, for example, (1) end users who have access to the final trained model, and (2) semi-honest servers that train models on behalf of clients who outsource their training. To address these challenges, we combine two powerful cryptographic tools: Fully Homomorphic Encryption (FHE) and Differential Privacy (DP), providing end-to-end privacy protection. FHE protects sensitive data during training on the server, while DP limits the information that can be inferred from the final trained model. However, because the computational complexity of FHE is highly dependent on circuit depth, directly applying standard DP training can be prohibitively expensive. We therefore modify the training objective to enable scalable DP training under FHE, achieving a 5× reduction in computational cost, formal privacy guarantees, and comparable model utility. Together, these techniques advance the feasibility of efficient, private, and secure machine learning on sensitive data.

Joint work: Ivan Brugere, Dana Dachman-Soled, Danial Dervovic, Yue Guo, Mingyu Liang, Antigoni Polychroniadou, Min Wu, Yvonne Zhou.

Suggested readings

• Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures (doi:10.1145/2810103.2813677)
• Efficient Logistic Regression on Large Encrypted Data (ia.cr/2018/662)
• Combining homomorphic encryption and differential privacy in federated learning (arxiv:2610.01650)