一句话：提出差分测试工具 HEDIFF，系统检测并理解 FHE 加固 ML 模型的偏差输入及其噪声模式。
全同态加密（FHE）支持在加密数据上进行隐私保护机器学习，但社区对其鲁棒性缺乏系统理解。本文研究 FHE 加固 ML 模型的偏差行为：同一输入在 FHE 模型与明文模型中产生不同输出，导致预测完全错误。为在昂贵 FHE 计算约束下有效发现偏差触发输入，作者设计了差分测试工具 HEDIFF，利用明文模型上的 margin 指标引导对 FHE 模型的定向测试。对识别出的偏差输入，进一步分析其是否具有可迁移的通用噪声模式。作者在三种主流 HE-ML 框架、12 种模型与数据集组合上评估 HEDIFF，几乎在所有框架和模型中成功检测到数百个偏差输入，并定量表明这些输入在视觉上具有意义。图示分析还揭示了偏差输入的根因，并支持泛化噪声模式以指导更定向的测试，为实际可用的鲁棒 HE-ML 提供启示。
Fully homomorphic encryption (FHE) is a promising cryptographic primitive that enables secure computation over encrypted data. A primary use of FHE is to support privacypreserving machine learning (ML) on public cloud infrastructures. Despite the rapid development of FHE-based ML (or HE-ML), the community lacks a systematic understanding of their robustness. In this paper, we aim to systematically test and understand the deviation behaviors of HE-ML models, where the same input causes deviant outputs between FHE-hardened models and their plaintext versions, leading to completely incorrect model predictions. To effectively uncover deviation-triggering inputs under the constraints of expensive FHE computations, we design a novel differential testing tool called HEDIFF, which leverages the margin metric on the plaintext model as guidance to drive targeted testing on FHE models. For the identified deviation inputs, we further analyze them to determine whether they exhibit general noise patterns that are transferable. We evaluate HEDIFF using three popular HE-ML frameworks, covering 12 different combinations of models and datasets. HEDIFF successfully detected hundreds of deviation inputs across almost every tested FHE framework and model. We also quantitatively show that the identified deviation inputs are (visually) meaningful in comparison to regular inputs. Further schematic analysis reveals the root cause of these deviant inputs and allows us to generalize their noise patterns for more directed testing. Our work sheds light on enabling robust HE-ML for real-world usage.
DOI 原文 ·
@inproceedings{paperbot8861,
title = {Testing and Understanding Deviation Behaviors in FHE-Hardened Machine Learning Models},
author = {Yiteng Peng and Daoyuan Wu and Zhibo Liu and Dongwei Xiao and Zhenlan Ji and Juergen Rahmel and Shuai Wang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00107}
}