Privacy-Preserving ML (PPML) based on Homomorphic Encryption (HE) is a promising foundational privacy technology. Making it more practical requires lowering its computational cost, especially, in handling modern large deep neural networks. Model compression via pruning is highly effective in conventional plaintext ML but cannot be effectively applied to HE-PPML as is. We propose Artemis, a highly effective DNN pruning technique for HE-based inference. We judiciously investigate two HE-aware pruning strategies (positional and diagonal) to reduce the number of Rotation operations, which dominate compute time in HE convolution. We find that Pareto-optimal solutions are based fully on diagonal pruning. Artemis' benefits come from coupling DNN training, driven by a novel group Lasso regularization objective, with pruning to maximize HE-specific cost reduction (dominated by the Rotation operations). We show that Artemis improves on prior HE-oriented pruning and can achieve a 1.2-6x improvement when targeting modern convolutional models (ResNet18 and ResNet18) across three datasets.

翻译：基于同态加密的隐私保护机器学习是一种有前景的基础隐私技术。降低其计算成本（尤其是在处理现代大型深度神经网络时）是其走向实用化的关键。通过剪枝进行模型压缩在传统明文机器学习中非常有效，但无法直接应用于基于同态加密的隐私保护机器学习。我们提出Artemis，一种针对基于同态加密推理的高效深度神经网络剪枝技术。我们审慎研究了两种同态加密感知剪枝策略（位置剪枝和对角剪枝），以减少主导同态加密卷积计算时间的旋转操作次数。我们发现帕累托最优解完全基于对角剪枝。Artemis的优势源于将深度神经网络训练（由新型组套索正则化目标驱动）与剪枝相结合，以最大化针对同态加密的成本降低（主要由旋转操作主导）。我们证明Artemis优于先前的面向同态加密的剪枝方法，并且在针对三个数据集的现代卷积模型（ResNet18和ResNet18）上可以实现1.2-6倍的性能提升。