cache_updater, params = tfe.cache(params)
# get prediction input from client
x = tfe.define_private_input(prediction_client.player_name,
prediction_client.provide_input,
masked=True) # pylint: disable=E0632
# compute prediction
w0, b0, w1, b1 = params
layer0 = tfe.matmul(x, w0) + b0
layer1 = tfe.sigmoid(layer0 *
0.1) # input normalized to avoid large values
logits = tfe.matmul(layer1, w1) + b1
# send prediction output back to client
prediction_op = tfe.define_output(prediction_client.player_name, logits,
prediction_client.receive_output)
with tfe.Session(target=session_target) as sess:
sess.run(tf.global_variables_initializer(), tag='init')
print("Training")
sess.run(cache_updater, tag='training')
for _ in range(10):
print("Predicting")
sess.run(prediction_op, tag='prediction')
end = time.time()
print("Elapsed time: ", end - start)
y = int100.tensor(np.array([1, 2, 3]))
z = x + y
print(z)
z = x - y
print(z)
z = x * y
print(z)
c = int100.constant(np.array([4, 4, 4]))
v = int100.variable(np.array([1, 1, 1]))
p = int100.placeholder((3, ))
with tfe.Session() as sess:
print("Constant")
print(sess.run(c))
print("Variable")
sess.run(v.initializer)
print(sess.run(v))
print("Placeholder")
print(sess.run(p, feed_dict=p.feed(np.array([5, 5, 5]))))
print("Assignment")
w = c - p
sess.run(v.assign_from_same(w), feed_dict=p.feed(np.array([5, 5, 5])))
print(sess.run(v))
tfe.set_config(config)
tfe.set_protocol(tfe.protocol.SecureNN())
tfe_model = tfe.keras.models.clone_model(model)
for player_name in players.keys():
print("python -m tf_encrypted.player --config /tmp/tfe.config {}".format(
player_name))
q_input_shape = (1, 224, 224, 3)
q_output_shape = (1, 10)
server = tfe.serving.QueueServer(input_shape=q_input_shape,
output_shape=q_output_shape,
computation_fn=tfe_model)
import tf_encrypted.keras.backend as KE
sess = tfe.Session(config=config)
#sess = KE.get_session()
request_ix = 1
def step_fn():
global request_ix
print("Served encrypted prediction {i} to client.".format(i=request_ix))
request_ix += 1
server.run(sess, num_steps=1, step_fn=step_fn)
'server0', 'server1', 'crypto-producer', 'prediction-client',
'weights-provider'
])
def provide_input() -> tf.Tensor:
return tf.constant(np.random.normal(size=(1, 1, 28, 28)), tf.float32)
def receive_output(tensor: tf.Tensor) -> tf.Tensor:
tf.print(tensor, [tensor])
return tensor
with tfe.protocol.Pond(
*config.get_players('server0, server1, crypto-producer')) as prot:
c = convert.Converter(config, prot, config.get_player('weights-provider'))
x = c.convert(graph_def, registry(),
config.get_player('prediction-client'), provide_input)
prediction_op = prot.define_output(config.get_player('prediction-client'),
x, receive_output)
with tfe.Session(config=config) as sess:
sess.run(tfe.global_variables_initializer(), tag='init')
sess.run(prediction_op, tag='prediction')
os.remove(model_filename)
def test_channels_last(self) -> None:
"""
Test batch norm layer with NHWC (channels last) format
"""
channels_first = False
batch_size, img_height, img_width, channels_in = (32, 28, 28, 3)
input_shape = [batch_size, img_height, img_width, channels_in]
input_batchnorm = np.random.normal(size=input_shape).astype(np.float32)
# I reshaped the input because tf.nn.batch_normalization doesn't reshape it
# automatically However tf encrypted will reshape automatically the input
mean = (
np.array([2.0, 1.5, 20.8])
.reshape((1, 1, 1, channels_in))
.astype(np.float32)
)
variance = (
np.array([0.5, 0.3, 0.1]).reshape((1, 1, 1, channels_in)).astype(np.float32)
)
scale = (
np.array([0.3, 0.5, 0.8]).reshape((1, 1, 1, channels_in)).astype(np.float32)
)
offset = (
np.array([1.5, 1.2, 1.4]).reshape((1, 1, 1, channels_in)).astype(np.float32)
)
variance_epsilon = 1e-8
with tfe.protocol.Pond() as prot:
batchnorm_input = prot.define_private_variable(input_batchnorm)
batchnorm_layer = Batchnorm(
input_shape,
mean,
variance,
scale,
offset,
channels_first=channels_first,
)
batchnorm_layer.initialize()
batchnorm_out_pond = batchnorm_layer.forward(batchnorm_input)
with tfe.Session() as sess:
sess.run(tf.global_variables_initializer())
out_pond = sess.run(batchnorm_out_pond.reveal())
# reset graph
tf.reset_default_graph()
with tf.Session() as sess:
x = tf.Variable(input_batchnorm, dtype=tf.float32)
batchnorm_out_tf = tf.nn.batch_normalization(
x, mean, variance, offset, scale, variance_epsilon,
)
sess.run(tf.global_variables_initializer())
out_tensorflow = sess.run(batchnorm_out_tf)
np.testing.assert_array_almost_equal(
out_pond, out_tensorflow, decimal=1
)
model = tfe.keras.Sequential()
model.add(tfe.keras.layers.Dense(512, batch_input_shape=batch_input_shape))
model.add(tfe.keras.layers.Activation('relu'))
model.add(tfe.keras.layers.Dense(10, activation=None))
# get prediction input from client
x = tfe.define_private_input(prediction_client.player_name,
prediction_client.provide_input)
logits = model(x)
# send prediction output back to client
prediction_op = tfe.define_output(prediction_client.player_name,
logits,
prediction_client.receive_output)
sess = tfe.Session(target=session_target)
sess.run(tf.global_variables_initializer(), tag='init')
print("Training")
sess.run(cache_updater, tag='training')
print("Set trained weights")
model.set_weights(params, sess)
for _ in range(5):
print("Predicting")
sess.run(prediction_op, tag='prediction')
sess.close()
def _core_test(self, tensor_factory):
prot = tfe.protocol.SecureNN(tensor_factory=tensor_factory)
bit_dtype = prot.prime_factory
val_dtype = prot.tensor_factory
x = np.array([
21,
21,
21,
21,
21,
21,
21,
21
], dtype=np.int32).reshape(2, 2, 2)
r = np.array([
36,
20,
21,
22,
36,
20,
21,
22
], dtype=np.int32).reshape(2, 2, 2)
beta = np.array([
0,
0,
0,
0,
1,
1,
1,
1
], dtype=np.int32).reshape(2, 2, 2)
expected = np.bitwise_xor(x > r, beta.astype(bool)).astype(np.int32)
x_native = tf.convert_to_tensor(x, dtype=val_dtype.native_type)
x_bits_preshare = val_dtype.tensor(x_native).bits(bit_dtype)
x_bits = prot._share(x_bits_preshare) # pylint: disable=protected-access
r_native = tf.convert_to_tensor(r, dtype=val_dtype.native_type)
r0 = r1 = val_dtype.tensor(r_native)
beta_native = tf.convert_to_tensor(beta, dtype=bit_dtype.native_type)
beta0 = beta1 = bit_dtype.tensor(beta_native)
res = _private_compare(
prot,
x_bits=PondPrivateTensor(prot, *x_bits, False),
r=PondPublicTensor(prot, r0, r1, False),
beta=PondPublicTensor(prot, beta0, beta1, False)
)
with tfe.Session() as sess:
actual = sess.run(res.reveal().value_on_0.to_native())
np.testing.assert_array_equal(actual, expected)
def test_private(self):
prot = tfe.protocol.SecureNN()
bit_dtype = prot.prime_factory
val_dtype = prot.tensor_factory
x = np.array([
21,
21,
21,
21,
21,
21,
21,
21
], dtype=np.int32).reshape(2, 2, 2)
r = np.array([
36,
20,
21,
22,
36,
20,
21,
22
], dtype=np.int32).reshape(2, 2, 2)
beta = np.array([
0,
0,
0,
0,
1,
1,
1,
1
], dtype=np.int32).reshape(2, 2, 2)
expected = np.bitwise_xor(x > r, beta.astype(bool)).astype(np.int32)
res = _private_compare(
prot,
x_bits=PondPrivateTensor(
prot,
*prot._share(val_dtype.tensor(tf.convert_to_tensor(x, dtype=val_dtype.native_type)).to_bits(bit_dtype)),
False),
r=PondPublicTensor(
prot,
val_dtype.tensor(tf.convert_to_tensor(r, dtype=val_dtype.native_type)),
val_dtype.tensor(tf.convert_to_tensor(r, dtype=val_dtype.native_type)),
False),
beta=PondPublicTensor(
prot,
bit_dtype.tensor(tf.convert_to_tensor(beta, dtype=bit_dtype.native_type)),
bit_dtype.tensor(tf.convert_to_tensor(beta, dtype=bit_dtype.native_type)),
False)
)
with tfe.Session() as sess:
actual = sess.run(res.reveal().value_on_0.to_native())
np.testing.assert_array_equal(actual, expected)
def test_input(self):
x = Input(shape=(2, ), batch_size=1)
fd = x.feed(np.random.normal(size=(1, 2)))
with tfe.Session() as sess:
sess.run(x.reveal(), feed_dict=fd)
