L4 · APPLICATIONMEASURED

Encrypted Image Classification

encrypted-image-classification · spec v0.1.0 · 0 implementations · 6 runners

Create implementationSpecification

DESCRIPTION

Assigns a class label to an encrypted image without decrypting it at any point.

The kernel covers the whole pipeline, because that is what a user of it needs: encoding the image into ciphertext, evaluating a model over it, and returning an encrypted label. Splitting the model into layers is an implementation decision, and different realizations split it differently — the cookbook records both a Kolmogorov-Arnold network and a multilayer perceptron reaching the same target.

What makes this an application rather than an operation is how success is measured: not by numeric distance to a reference ciphertext, but by how often the decrypted label is right across a dataset. Latency per image and the accuracy achieved trade against each other, and both belong to the answer.

INTERFACE

encrypted_classify(
  in  ct     : Ciphertext  // the encrypted image
  out ct     : Ciphertext  // the encrypted class label, or scores per class
  ...               // anything else the realization needs — keys, context, encoding — is its own concern
)

PARAMETER SCHEMA

NAMETYPERANGE

image_pixelsinteger1 – 2^24

classesinteger2 – 2^12

target_accuracynumber0.5 – 1

model_publicbooleantrue, false

The schema belongs to the kernel. Each implementation declares which part of it it supports.

CORRECTNESS

01Accuracy is measured over a dataset, not over a single image.

02The evaluation set is fixed and identical for every entry; sampling differences make results incomparable.

03The decrypted output is a label the client can act on without further computation.

A classifier that reaches the target on a hundred sampled images and not on the full set has not reached it. The legacy contest re-tested every qualifying entry on a larger subset for exactly this reason.

SECURITY PROPERTIES

The image and the resulting label stay encrypted end to end. Where the model is private too, its weights must not be recoverable from the answers.

ASSUMPTIONS

The client holds the keys and performs the final decryption. Model training happens in the clear and is outside this kernel.

REFERENCES

repoFHERMA participation guide

paperFHERMA Cookbook — privacy-preserving AI applications