PrivSpike: Employing Homomorphic Encryption for Private Inference of Deep Spiking Neural Networks

2025-10-04

AI Summary

To address the privacy-efficiency-accuracy trade-off in deep Spiking Neural Network (SNN) inference over homomorphically encrypted data, this paper proposes the first end-to-end private inference framework supporting arbitrarily deep SNNs. Methodologically, it introduces two key innovations: (i) a CKKS-based polynomial approximation of activation functions to drastically accelerate computation in the encrypted domain; and (ii) a dynamic scheme-switching mechanism guided by rigorous error analysis to jointly optimize accuracy and computational overhead. Leveraging the Leaky Integrate-and-Fire neuron model, the framework enables fully encrypted inference on LeNet-5 and ResNet-19 architectures. Experiments demonstrate competitive performance: 98.10% and 66.0% test accuracy on MNIST and CIFAR-10, respectively; LeNet-5 inference completes in just 28 seconds on a consumer-grade CPU—over three times faster than baseline approaches—while providing formal privacy guarantees with no leakage of plaintext inputs or model parameters.

Technology Category

• Machine Learning: Privacy
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Search and Optimization: Learning to Search

Application Category

• Security and Privacy: Privacy-enhancing technologies
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Deep learning has become a cornerstone of modern machine learning. It relies heavily on vast datasets and significant computational resources for high performance. This data often contains sensitive information, making privacy a major concern in deep learning. Spiking Neural Networks (SNNs) have emerged as an energy-efficient alternative to conventional deep learning approaches. Nevertheless, SNNs still depend on large volumes of data, inheriting all the privacy challenges of deep learning. Homomorphic encryption addresses this challenge by allowing computations to be performed on encrypted data, ensuring data confidentiality throughout the entire processing pipeline. In this paper, we introduce PRIVSPIKE, a privacy-preserving inference framework for SNNs using the CKKS homomorphic encryption scheme. PRIVSPIKE supports arbitrary depth SNNs and introduces two key algorithms for evaluating the Leaky Integrate-and-Fire activation function: (1) a polynomial approximation algorithm designed for high-performance SNN inference, and (2) a novel scheme-switching algorithm that optimizes precision at a higher computational cost. We evaluate PRIVSPIKE on MNIST, CIFAR-10, Neuromorphic MNIST, and CIFAR-10 DVS using models from LeNet-5 and ResNet-19 architectures, achieving encrypted inference accuracies of 98.10%, 79.3%, 98.1%, and 66.0%, respectively. On a consumer-grade CPU, SNN LeNet-5 models achieved inference times of 28 seconds on MNIST and 212 seconds on Neuromorphic MNIST. For SNN ResNet-19 models, inference took 784 seconds on CIFAR-10 and 1846 seconds on CIFAR-10 DVS. These results establish PRIVSPIKE as a viable and efficient solution for secure SNN inference, bridging the gap between energy-efficient deep neural networks and strong cryptographic privacy guarantees while outperforming prior encrypted SNN solutions.

Problem

• Ensuring privacy in deep Spiking Neural Networks inference
• Addressing data confidentiality challenges using homomorphic encryption
• Optimizing encrypted SNN performance with novel activation algorithms

Innovation

• Uses homomorphic encryption for secure SNN inference
• Introduces polynomial approximation for activation functions
• Implements scheme-switching algorithm for precision optimization