An Efficient Homomorphic Argmax Approximation for Privacy-Preserving Neural Networks

Round 1

Reviewer 1 Report

The authors are proposing a privacy layer for Neural Networks. The approach is essentially an improvement over a previous work named ArgmaxHE. However this improvement is mainly related to the inference latency not security or accuracy (although the authors mention about accuracy improvement, i found it marginal and not statistically significant).

More specifically, the paper's main contribution is the latency reduction of the previous ArgmaxHE. As a matter of fact this reduction is 39% which is significant. However, the authors experiment with only one dataset and only for image classification. Another ambiguous result is that the previous ArgmaxHE seems to be very efficient as in the tested results the time to execute was 273 and 427 ms. As such it is not very clear what was the initial motivation of this work. Besides it is not really clear what do the authors mean by the 'Time' parameter, which is so broad.

No comments

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

This paper proposes an important extension to existing homo-morphic encryption. It comparatively presents the novelty of the study and delivers clear ideas that could work in practical cases.

The evaluation is not thorough, but I think it is okay, considering the importance and novelty of the topic. 

Author Response

Please see the attachment

Author Response File: Author Response.pdf

Reviewer 3 Report

-------------------------------------------------------------------------

Comments Related to Writing

------------------------------------------------------------------------

Abstract

---------------------

"faces huge challenges in implement non-linear functions" --> "faces huge challenges implementing non-linear functions"

"non-linear functions in neural networks includes" --> "Among non-linear functions in neural networks, one may refer to"

The following sentence is too long. Consider rewriting.

"By employing tree-structure comparison to determine the position of the maximum value, we propose an efficient homomorphic argmax approximation algorithm, including four phases: rotation accumulation, tree-structure comparison, normalization, and finalization."

And in the beginning of the following sentence is neither formal, nor needed.

"And then, the proposed" --> "The proposed"

Before introducing the proposed method in the abstract, the authors need to discuss a shortcoming in previous approaches to motivate their own approach.

After the following sentence:

"function, argmax function, and maximum pooling.'

I recommend two sentences. First: "In this paper, we focus on argmax function." and second: a sentence to define argmax function.

Introduction

-------------------------

" neural networks" has been unnecessarily repeated in the following sentence.

"In neural networks, non-linear operations, such as activation functions, maximum 36

pooling, argmax, play a vital and irreplaceable role within neural networks."

It's not common to start a formal  sentence with "And".

"And then, chabanne et al"

"And then, chabanne et al. [2] and Cryptodl [3]" : One paper is referred to by the name of the authors "chabanne et al." and the other one is referreed to by the approach "Cryptodl". Please consider rewriting.

"In term of model security": May be you mean "In terms of model security".

I searched to find the definition of "argmax" and did not manage to. Have you mentioned any definition for argmax, which is the center of your paper? Is there anything I am missing?

Related works

---------------------

I do not think "In terms of" is being used correctly in the following sentence.

"In terms of safeguarding model security, Lee et al. [7] highlighted a vulnerability in 110

traditional PPNN"

Preliminaries

---------------------

I am not sure if "in the context of" has been used correctly in the following sentence.

"In the context of this study, the notation"

Section 4

------------------------

"Let’s give an example" --> "Let us give an example"

"As the limit of the pages," --> Due to limitations on the number of pages,"

-----------------------------------------------------------

Other Comments

----------------------------------------------------------

Subsection 4.1

------------------------

The authors are just mentioning an algorithm without any theoretical proof of correctness. This is the main weak point in this paper.

Subsection 5.1

----------------------

The authors are explaining their experimental set up and the achieved results (later in 5.3). They compare their work with works proposed in some other papers. But they do not explain the experimental set up in those papers. This makes the comparisons invalid.

Subsection 5.2

---------------------

The problem mentioned above is true with the experimental methodology (explained in 5.2) as well.

Page 6, Line 218

"As the limit of the pages, we skip the third round. Last, in Phase IV, a one-hot logit y with the only 1 at the position of the maximum is obtained.

You cannot skip part of your algorithm like this. Find a way to explain it, even briefly.

It needs a serious review on the writing and the English

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors did not answer to my comment or try to improve the dataset issue. 

I cannot evaluate the paper as the authors did not try to improve the paper.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 3 Report

Thank you for applying my comments.

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Round 3

Reviewer 1 Report

The authors have now corrected the identified issue, and they have used at least two datasets instead of only one.

This renders the obtained results more plausible and sound.