|
|
 |
| |
|
|
|
Conformal Prediction for Privacy-Preserving Machine Learning: Uncertainty Quantification on Encrypted Data |
|
|
|
PP: 1261-1268 |
|
|
doi:10.18576/amis/200511
|
|
|
|
Author(s) |
|
|
|
Alexander D. Balinsky,
Dominik Krzemin ́ski,
Alexander A. Balinsky,
|
|
|
|
Abstract |
|
|
| We study whether Conformal Prediction (CP), a distribution-free framework for quantifying the uncertainty of machine- learning predictions, can be applied directly on encrypted data, without ever decrypting it. The motivation is privacy-preserving learning: ideally a model should produce calibrated, statistically valid prediction sets while the underlying data remains hidden. Our key observation is theoretical: because a fixed-key deterministic cipher is a single, fixed transformation applied identically to every record, it preserves exchangeability, the only assumption CP requires. CP guarantees therefore transfer to the encrypted domain unchanged. We test this on AES-encrypted MNIST and compare the classical p-value conformal predictor against the more recent e-value (BB) predictor of Balinsky and Balinsky. Empirically, a simple feed-forward network trained only on deterministically encrypted images still reaches 33.58% test accuracy, far above the near-chance 11.35% obtained when each image is encrypted with its own key (which destroys the consistent plaintext-to-ciphertext mapping and reduces learning to chance). At a nominal miscoverage of α = 0.4 (a 60% coverage target), the e-value predictor is highly conservative: its guarantee of at least 60% coverage is met with a realized coverage of 97.46% (4873/5000), at the cost of large prediction sets; the p-value predictor produces much smaller sets but realizes only 59.4% coverage. These results demonstrate the feasibility of uncertainty quantification on encrypted data. |
|
|
|
|
|
|
|
