Confidential Inference in Decision Trees

In confidential computing, arithmetic algorithms operate on encrypted inputs to produce encrypted outputs. Specifically, in confidential inference, Alice has the parameters of the machine-learning model but does not want to reveal them to Bob, who has the data. Bob wants to use Alice’s model for inference, but does not want to reveal his data. Alice and Bob agree to use confidential computing to run the inference engine without revealing either the model or the data. However, they find that fully homomorphic and order-preserving encryptions are very time-consuming and very challenging to accelerate on hardware. When the machine learning model is a decision tree, these encryptions can be made computationally efficient and can even be readily accelerated on hardware. In this paper, we reveal how Alice and Bob run the inference engine of a decision tree in full confidence and show FPGA implementations of additively homomorphic, order-preserving, and post-quantum order-preserving encryption on constrained hardware platforms. We further evaluate the resources needed to implement the ciphertext decision tree and compare them with those of a plaintext decision tree. Confidential inference tests are run on the encrypted FPGA design using the MNIST data set.