International Journal of Machine Learning and Cybernetics

https://doi.org/10.1007/s13042-019-01054-w

ORIGINAL ARTICLE

Homo‑ELM: fully homomorphic extreme learning machine

Weiru Wang1   · Yanfen Gan2 · Chi‑Man Vong1 · Chuangquan Chen1

Received: 29 December 2018 / Accepted: 12 December 2019

© Springer-Verlag GmbH Germany, part of Springer Nature 2020

Abstract
Extreme learning machine (ELM) as a machine learning method has been successfully applied to many classification prob-
lems. However, when applying ELM to classification tasks on the encrypted data in cloud, the classification performance is
extremely low. Due to the data encryption, ELM is hard to extract informative features from the encrypted data for correct
classification. Moreover, the trained neural network is un-protected on the cloud environments, that makes cloud service
highly risky to the attackers. In this paper, we propose a novel fully homomorphic ELM (Homo-ELM), which makes cloud
searching tasks under a fully protected environment without compromising the privacy of users. To demonstrate the effec-
tiveness of our approach, we conduct a comprehensive experiment on both cloud and local environments. The experiment
results show that Homo-ELM can achieve high accuracy on the local environments as well as cloud environments than other
machine learning methods.

Keywords  Encrypted machine learning · Fully homomorphic encryption · Privacy preservation · Extreme learning
machine · Encrypted image classification

1 Introduction Many research [4, 5] focus on the searchable encryption

Cloud computing has become the paradigm to enable on-
demand network access to the configurable computing and
storage resources on the large-scale infrastructure [1]. For
example, public cloud storage services such as iCloud,
Google Drive, and Dropbox let users easily to store their
data on the cloud and access them from anywhere at any
time on multiple platforms such as mobile devices and per-
sonal computers in a secure and efficient manner. To pre-
serve privacy, data must be encrypted before outsourcing,
i.e, the data are encrypted on local before uploading to the
cloud, the cloud providers cannot retrieve any information
from the encrypted data without the permission of users [2,
3]. This high-security requirements make its effective utili-
zation as a challenge, especially for indexing and searching
the outsourced encrypted data on the public cloud.
* Chi‑Man Vong
cmvong@umac.mo
1
Computer and Information Science, Faculty of Science
and Technology, University of Macau, Macau, China
2
South China Business College Guangdong University
of Foreign Studies, Guangzhou, China
that allows searching over encrypted data in the cloud based
on the given keywords. Searchable encryption not only
protects the privacy of the data but also keywords. It is a
very effective solution but it has several non-trivial defects:
(a) additional tags must be attached to the encrypted data
for keywords matching before uploading to the cloud. It is
inconvenient and an extra cost for the customer. Moreover,
the data cannot be flexibly updated because the searching
index is related to the tags. (b) Searching accuracy highly
depends on the given keywords and existed tags, it will be
a failure when the tags and keywords are syntactical mis-
matchings. Although the fuzzy searching algorithm [6] can
increase the accuracy, it still useless in the practice when
the users can not pick up the correct tags for their data. (c)
Tags only contain the limited syntax informati on that makes
keyword-based algorithms hard to achieve high accuracy.
Deep learning [7, 8] as a promising technique has been
widely applied to many fields of science, business, and
government. It beats many other methods when holding a
large dataset on a target problem and powerful computing
resources such as GPU and TPU. We investigated many
deep learning methods as well as the traditional machine
learning on the searching tasks of cloud, and then pro-
posed an encrypted image classification framework based

13
Vol.:(0123456789)

on multilayer extreme learning machine (ML-ELM) and
applied it to the cloud searching task in our previous work
[9]. The ML-ELM unitizes the advantages of both deep
learning and ELM. Deep learning can automatically extract
features from low-level representation. ELM [10–14] can
achieve high accuracy in the extremely fast learning speed.
Moreover, ML-ELM can deal with text data as well as media
data such as images and videos.
The results of our previous work show that ML-ELM
achieves the best classification performance over the
encrypted data than other methods on cloud searching tasks,
but it has the following limitations: (1) ML-ELM can only
achieve high accuracy on binary classification problem.
When applying ML-ELM to cloud searching problem, users
must train multiple ML-ELMs for each searching topic, this
is not a cost-effective way in the practice. (2) The trained
ML-ELM must be uploaded to the cloud before providing
the searching service to users, that means the trained ML-
ELM may be attacked without the permissions of users.
Many attacks of deep learning are reported in recent years
[15, 16]. For example, attackers retrieved the parameters
and structure information from a un-protected neural net-
work and inferred the training data by providing a meticu-
lous designed attacking example. This is flagrant threat for
cloud-based applications.
Many researchers focus on the privacy-preserving
extreme learning machine algorithms in recent years, which
aims to avoid disclosing confidential information to unau-
thorized users. The work [17] presents the privacy-preserv-
ing protocols for the backpropagation and ELM algorithms
when data and weight vectors are horizontally and verti-
cally partitioned among several parties. The papers [18,
19] provide ELM-based privacy-preserving protocols for
implementing aware agents on portable/wearable comput-
ing devices. The work [20] proposes a privacy-preserving
learning scheme over arbitrarily vertically partitioned data
between two or more parties. The paper [21] proposes an
outsourcing learning model over the encrypted data. How-
ever, the related work has following deficiencies: (a) they
require the extra communication costs between the client and
cloud, (b) and need a trust third party to calculate the out-
put weights and decrypt the encrypted data, (c) the trained
models are totally un-encrypted on the cloud.
In this paper, we proposed a novel fully homomorphic
extreme learning machine (Homo-ELM) that can achieve
high accuracy on cloud environments as the same on-
premise environments without compromising the privacy
of users. Homo-ELM eliminates the limitations as men-
tioned in the above paragraph and can achieve high clas-
sification performance on binary classification problem
as well as multiclass classification problems without an
extra third party that means a Homo-ELM network can
support a cloud searching task on many topics. Moreover,
13
International Journal of Machine Learning and Cybernetics
the trained Homo-ELM is fully encrypted and protected
in the cloud, which includes the network structure and
parameters as well as the outputs of Homo-ELM. That
means Homo-ELM can well preserve the user’s privacy
on cloud environments.
The contributions of this paper are summarized as
follows:
• We propose a novel fully homomorphic extreme learn-
ing machine with polynomial activation function that can
achieve the high classification accuracy.
• We solve a privacy breach problem avoiding the deploy-
ment of an un-encrypted neural network to cloud envi-
ronments.
• We improve the classification accuracy that makes
Homo-ELM can deal with multi-class classification
searching problem on cloud environments.
The remaining of the paper is organized as follows: Sect. 2
first introduces the extreme learning machine and fully
homomorphic encryption, then it describes the proposed
Homo-ELM algorithm. Section 3 provides the performance
evaluation of Homo-ELM and the benchmark with other
machine learning methods. Section 4 introduces a case study
to illustrate how to apply Homo-ELM on public cloud stor-
age. Section 5 concludes the paper and plans future work.
2 Homo‑ELM: homomorphic extreme
learning machine
In this section, we first introduce the preliminary of ELM
and fully homomorphic encryption and then present the
details in the construction of Homo-ELM.
2.1 Extreme learning machine
Extreme learning machine (ELM) [10] is an extremely fast
training speed neural network with a single hidden layer.
ELM does not use gradient descent to update the param-
eters, instead it randomly generates the parameters between
input and hidden layers [22–24] and computes the optimal
parameters between hidden and output layers with the least
square algorithm. Many studies [12, 25–27] show that ELM
can achieve high classification performance at extremely fast
learning speed than other machine learning methods espe-
cially when the problem only has a small dataset.
Formally, given a set of N arbitrary distinct samples
(xi , ti ) , where i = 1, 2, … , N and xi is a d dimensional vec-
tor, the output function of ELM with L hidden neurons is
represented by
International Journal of Machine Learning and Cybernetics
L
∑ arbitrary number of operations on the encrypted data after
f (xi ) = 𝛽j h(xi ) = h(xi )𝜷
j=1
where 𝜷 = [𝛽1 , … , 𝛽L ] is the output weight between the hid-
den layer and output layer, h(x | w, b) = g(w ⋅ x + b) is the
hidden layer output with respect to input x , and the parame-
ters of input weight w = [wi , … , wL ] and bias b = [bi , … , bL ]
are both randomly generated without updating, g is the acti-
vation function of hidden layer. Briefly, the matrix form of
ELM can be written as
H𝜷 = T
where T = [t1 , … , tN ]T is t he t arget labels and
H = [h(x1 ), … , h(xL )]T is the outputs of the hidden layer.
The output weight 𝜷 can be calculated by:
𝜷 = H† T
where H† is Moore–Penrose generalized inverse of matrix
H.
To improve generalization classification performance and
make the solution more robust, the output weight 𝜷 can be
calculated with regularization parameters C and I as in the
paper [28]:
( )−1
I als ring that have 0 or 1 coefficient. For an element r ∈ Rq ,
𝜷= + HT H HT T
C [r]q refers to r mod q . n represent the dimension of a vec-
Once we obtain 𝜷  , together with the same weight matrix w
between the input layer and hidden layer, we can predict the
label of a new input x.
2.2 Fully homomorphic encryption
Homomorphic encryption (HE) [29] allows the mathematics
computation such as addition, subtraction, and multiplica-
tion on ciphertexts without affecting the computation results.
That means the computation result on ciphertexts keeps
the same semantics on the plaintexts. For example, when
applying hmomorphic encryption to the number computa-
tion 1 + 2 = 3 , the encrypted e(1) plus the encrypted e(2)
equal to encrypted e(3). Homomorphic encryption makes the
computation privacy-preserved on the encrypted data. That
is suitable for the cloud-based application. However, the
papers [30, 31] show that HE only can support finite-time
computations. Because HE generates an additional noise
after each computing. This noise will be further increased
and explosive when the task contains many computations.
When the noise exceeds a certain threshold, HE decryption
algorithm will fail and, therefore, data will not be retrieved
from the computation result.
Fully homomorphic encryption (FHE) [32, 33] was
proposed to deal with the limitation of HE. It allows the
(1) the reduction of noise. It introduces a mechanism that
enables the encryption evaluating the low-degree polyno-
mial homomorphic operations first, then applies a theo-
rem called bootstrapping to refresh a ciphertext for noise
reduction. Therefore, FHE enables an arbitrary number of
operations under polynomial time on the encrypted data.
However, this mechanism introduces extra computation
costs that make FHE very low efficiency. To improve the
efficiency, the paper [34] proposed BGV - a leveled FHE
without Bootstrapping based on the General Learning with
(2) Errors (GLWE) problem, which dramatically improves the
computational efficiency and has 2𝜆 security against lattice
attacks, where 𝜆 is the security parameter. We will use BGV
to our proposed Homo-ELM for privacy-preserving. The
basic notations of BGV are presented first, then BGV algo-
(3) rithms are introduced.
2.2.1 BGV notation
The BGV scheme is constructed based on the polynomial
ring R = ℤ[x]∕f (x) where ℤ[x] is a integer polynomial and
f (x) = xd + 1 , d is a power of 2. For a prime integer q ≥ 2 ,
Rq denotes a polynomial ring with the coefficients from the
range (−q∕2, q∕2] . For example, R2 denotes a polynomi-
(4)
tor, 𝜒 denotes a noise distribution over Rq and N is an inte-
ger which is great and equal than (2n + 1) log q . 𝐯 ∈ Rnq is
a n dimensional vector of Rq . The 𝐯[i] refers to the i − th
coefficient of 𝐯 . The dot product of 𝐮, 𝐯 ∈ Rnq are written as
∑n
⟨𝐮, 𝐯⟩ = i=1 𝐮[i] ⋅ 𝐯[i] ∈ Rnq . The L𝐜 (𝐱) represent a cipher-
text-dependent linear equation over the coefficients of ⟨𝐜, 𝐱⟩ .
The more detail explanation of BGV notation can be referred
in the paper [34].
2.2.2 BGV algorithm
BGV algorithm contains six algorithms: BGVSetup generates
the initial public parameters, BGVKeyGen generates a public
key and a secret key, BGVEnc is for encryption, BGVDec is the
decryption algorithm, BGVRefresh is for the noise reduction,
and BGVAdd and BGVMul are the homomorphic addition and
multiplication algorithms. The details are shown as follows:
(1) BGV initialization: BGVSetup (1𝜆 , 1L ) takes a security
parameter 𝜆 which decides the computational complexity
and security of BGV scheme and a number of levels L as
inputs. Then generates the initial parameters params, which
is shown in Algorithm 1.
(2) Key generation algorithm: BGVKeyGen(params) is
responsible for generating the public key and secret key,
which is shown in Algorithm  2. It takes the output of
BGVSetup as input, generates the secret key sk and the public
13
 International Journal of Machine Learning and Cybernetics

key pk. In details, it invokes SecretKeyGen(paramsj ) and

PubKeyGen(paramsj , 𝐬j ) to generate a secret key sj and a pub-
lic key Aj for each level. In order to reducing the ciphertext
dimension, SwitchKeyGen() produces some auxiliary infor-
mation 𝜏𝐬�� →𝐬j−1 , which are merged into public pk.
j

(5) Homomorphic addition algorithm BGVAdd (pk, 𝐜1 , 𝐜2 )

(3) Encryption and decryption algorithms: BGVEnc and
BGVDec are encryption and decryption algorithms of BGV
shown in Algorithm 3. Given the public parameters params,
the plaintext m will be encrypted by corresponding public
key pk and the ciphertext c can be decrypted through secret
key sk. Note that when encrypting and decrypting an image,
BGV must be repeatedly invoked for each pixel of the image.
(4) Noise reduction algorithm: BGVRefresh (cc, 𝜏s�� →sj−1 , qj )
j
BGVAdd (Algorithm 5) is the first homomorphic operation
of BGV that realizes the addition of two encrypted data. By
providing the inputs of two ciphertexts under the same secret
key 𝐬j and the corresponding public key pk, it performs the
modulo addition between 𝐜1 and 𝐜2 . If two ciphertexts under
the different secret key, BGVRefresh will be invoked until 𝐜1 and
𝐜2 under the same secret key 𝐬j at first. After modulo addition,
it runs BGVRefresh for noise and dimension reduction.
(6) Homomor phic multiplication algor it hm
BGVMul (pk, 𝐜1 , 𝐜2 )
BGVMul (Algorithm 6) realizes the multiplication of two
encrypted data. Its inputs is two ciphertexts and correspond-
ing public key pk. If two ciphertexts under the different
secret key, BGVRefresh will be invoked to update 𝐜1 and 𝐜2
under the same key 𝐬j . When two ciphertexts encrypted
under the same secret key 𝐬j , the modulo multiplication
𝐜3 ← 𝐜1 × 𝐜2 is executed. 𝐜3 represented by the coefficients
of the linear equation L(𝐜 ,𝐜 ) (𝐬j × 𝐬j ) is decrypted by the long
long
1 2
secret key 𝐬j ⊗ 𝐬j via dot product. Finally, the noise and
dimension of 𝐜3 are reduced through BGVRefresh.

is the most important algorithm of BGV that adopts key and

modulus switching techniques for the ciphertext dimension
reduction and noise reduction. The details are shwon in
Algorithm 4, it includes three procedures: expand, switch
moduli and switch keys. It takes 𝐜 (encrypted under secret
key 𝐬j   ) as input, and r uns Powersof2(𝐜, qj ) and
′

Scale(𝐜1 , qj , qj−1 , 2) to reduce the noise of ciphertext 𝐜 at first.

Then, it invokes the function SwitchKey(𝜏𝐬�� →𝐬j−1 , 𝐜2 , qj−1 ) to
j

performed key switching for reducing the ciphertext dimen-

sion. At last, it outputs a new ciphertext 𝐜3 under secret key
𝐬j−1 with less noise.

13
International Journal of Machine Learning and Cybernetics

Fig. 1  Homo-ELM overview
Training Stage Prediction Stage
(Local) (Cloud) New Encrypted Data
(Testing data)

Training by Encrypt trained model by

ELM Homomorphic Encryption
Training Data Trained Model Encrypted
(Un-encrypted) (Un-encrypted) Trained Model

Using proposed activation function

HomoFunc(x)
Prediction Result
(Encrypted)

2.3 Homo‑ELM: homomorphic extreme learning
machine
In this subsection, we propose a novel fully homomorphic
extreme learning machine (Homo-ELM) by integrating ELM
and fully homomorphic encryption with a polynomial acti-
vation function. The overview of Homo-ELM is shown in
Fig. 1. Firstly, an un-encrypted Homo-ELM is learned from
a dataset, and then it is transformed into an encrypted Homo-
ELM through the homomorphic encryption algorithm. When
a new encrypted data is provided, encrypted Homo-ELM
can give a prediction result. We use red and green colors
to indicate whether Homo-ELM is under-protected. As we
can see, all the new input and output data are encrypted as
well as the neural network of Homo-ELM eventually. When
applying Homo-ELM to cloud searching task, user privacy
can be preserved from the start to the end. The details will
be discussed in Sect. 4.
We illustrate training and prediction procedures of
Homo-ELM using the MNIST dataset1 as follows. The
an un-encrypted training model and then use homomorphic
encryption algorithm BGVEnc to encrypt the trained model.
In the prediction stage, we put the encrypted testing set into
the encrypted Homo-ELM model and get an encrypted class
label EncY. Finally, we can use the decryption algorithm
BGVDec to decrypt the label and check whether the classifi-
cation result is correct or not.
2.3.1 Activation function for homomorphic
Generally, the activation functions of ELM are the sigmoid
function, sine function, and Gaussian function. They are
listed as follows:
Sigmoid function: g(x) = 1∕(1 + exp(−x))
Sin function:  g(x) = sin(x)
Gaussian function: 
2
g(x) = e−x
However, homomorphic encryption does not support
enough mathematical operations to construct the above
activation functions, it only supports homomorphic addi-
tion, subtraction, and multiplication. Therefore, we need
a suitable activation function for Homo-ELM. Polyno-
mial activation function is an ideal choice, it only contains
computations of addition, subtraction, and multiplication.
Moreover, the papers [35, 36] prove that ELM with polyno-
mial activation function does not degrade the generalization
capabilities. The general polynomial activation function is
as follows:
N
∑
f (x) = an x n (5)
n=0

60,000 handwritten digits are regarded as the training set.
The remaining 10,000 handwritten images are encrypted by
BGVEnc as prediction set (New Encrypted Data). We first
use a learning algorithm ELM and the training set to train
1
  http://yann.lecun​.com/exdb/mnist​.
where the coefficients an can be real or complex. How-
ever, this general polynomial activation function can not
be used in homomorphic encryption, because homomor-
phic encryption only supports calculating on the integers
ℤ . Thus, a modified polynomial activation function for HE
is as follows:

13

Homofunc(x) = an xn + an−1 xn−1 + ⋯ + a1 x + a0 (6)
where n is a positive integer and ai (0 ≤ i ≤ n) is
restricted to be an integer. Note that polynomial approx-
imation to sigmoid and other functions can not be
used with HE due to division operations, for instance:
sigmoid(x) = 21 + 14 x − 48
1 3 1 5
x + 480 x + O(x6 ) [37]. In Eq. 6,
if large values are given to a and n, Homo-ELM can tackle
more complex problems, but it requires more computing
resources. We need to leverage them according to the com-
plexity of the target problem and the resources.
2.3.2 Homo‑ELM training
According to the overview of Homo-ELM in Fig. 1, we pre-
sent Homo-ELM training algorithm in Algorithm 7.
By providing the inputs of a set of training samples X,
the corresponding labels T, the number of hidden nodes
HiddenNum, and encryption parameters params, Homo-
ELM training algorithm computes the hidden layer values
H through the Homofunc activation function, then com-
putes the output weight 𝛽  , and then assembles the input
and output weights as an un-encrypted neural network
TrainModel, finally invokes homomorphic encryption
algorithm BGVEnc() presented in Sect. 2.2 to achieve and
return the encrypted neural network EncTrainModel.
2.3.3 Homo‑ELM prediction
After the training process, we can get an encrypted Homo-
ELM model, which contains the encrypted input weights
Enc_𝝎 , the encrypted bias Enc_b , the encrypted output
weights Enc𝜷  . Note that all the parameters are encrypted,
we need homomorphic mathematical operations such as
13
International Journal of Machine Learning and Cybernetics
BGVAdd () , BGVMult () to compute those encrypted param-
eters. Homo-ELM prediction algorithm is shown in
Algorithm 8.
This algorithm first computes the encrypted hidden
values encH based on the encrypted parameters and test
images EncY (only test sets are required to be encrypted
by BGVEnc ), and then computes the encrypted prediction
results EncYPre. Finally, a user who possessed the private
key sk can decrypt EncYPre by BGVDec (param, sk, EncYPre)
to obtain the unencrypted prediction results. Note that
when encrypting an image, BGVEnc must be repeatedly
invoked for each pixel of the image.
3 Evaluation
In this section, we demonstrate the effectiveness of our pro-
posed Homo-ELM through comparing with other machine
learning methods through four general datasets. The result
shows that Homo-ELM can achieve better classification per-
formance than other methods.
3.1 Datasets
Four popular datasets are chosen for verifying the proposed
method in the different scales, which include a common
classification dataset Iris provided by Fisher,2 MNIST data-
set of handwritten digits, land satellite images3 and NIST
Special Dataset 194 of handwritten digits and characters
dataset. The detailed description of these datasets is shown
in Table 1. Those datasets represent different complex tasks
2
  http://archi​ve.ics.uci.edu/ml/datas​ets/Iris.
3
  http://www.ntu.edu.sg/home/egbhu​ang/elm_rando​m_hidde​n_nodes​
.html.
4
  https​://www.nist.gov/srd/nist-speci​al-datab​ase-19.
International Journal of Machine Learning and Cybernetics

Table 1  Description of Database/number Total images Training images Test images Image size Category
databases
Iris 150 100 50 4×1 3
Land Satellite Image 6435 3217 3218 6×6 6
MNIST 70,000 60,000 10,000 28 × 28 10
NIST 19 150,000 140,000 10,000 32 × 32 26

varying in the input size of images, number of categories to
predict, and dataset size.
Note that NIST Special Database 19 has 810,000 images
from 3600 writers which include four forms: digit, upper-
case, lowercase, and free form text. Considering the limita-
tion of computing resource, we use 150,000 lowercase char-
acters as training dataset and only choose 6000 lowercase
as test dataset.
3.2 Experimental result and discussion
The experiments were carried out from the Microsoft Surface
laptop, which has a core i7 5820K 3.30 GHz CPU, 16 GB
RAM, and 512 GB SSD based on Matlab 2017b and homo-
morphic encryption framework HElib.5 The main hyperpa-
rameters of HElib are modulus p = 957073583844512077 ,
a parameter d = 4096 of polynomial ring, security param-
eter 𝜆 = 128 , levels L = 16 . Note that the input weights of
Homo-ELM are randomly generated. Therefore, all results
are averaged from 10 repeated experiments.
3.2.1 Analysis of the activation function Homofunc
Table 2 shows the comparison results between Homofunc
and Sigmoid functions of ELM (500 hidden nodes) on the
on four un-encrypted databases are described at the last two
lines of Table 2. It shows that the relative test accuracies
of Homofunc(x) = x3 activation function (99.59%, 97.43%,
98.62%, and 97.71%) are better than Homofunc(x) = x2
(99.45%, 96.11%, 97.97%, and 96.91%). With large values
assigned to a and n, ELM can achieve higher accuracy on
those classification tasks.
3.2.2 Normalization of data and Homo‑ELM parameters
In general, the normalization makes input weight 𝜔 from −1
to 1, the range of bias b from 0 to 1, and the range of input
data X [−1, 1] . However, homomorphic encryption only sup-
ports calculating the integers ℤ . Therefore, the parameters
of the trained model and data are normalized from 0 to Z
before homomorphic encryption. In details, 𝜔 , 𝛽 and X are
normalized through the following two steps:
• Feature scaling For a given feature x, it is normalized
into the range [0, 1] by Min–Max normalization method
(see Eq. 7) at first.
x − Min(x)
x� = (7)
Max(x) − Min(x)
• Scaling rounding Then, we round x up to the nearest
′

un-encrypted data. We do this experiment because homo- whole number by round function.
morphic encryption only supports a few mathematical opera-
tors that can not implement the common activation func-
�
xnorm = round(x × 𝛼) (8)
tions such as Sigmoid and Guassion activation functions,
we must make sure the modified polynomial activation func- where 𝛼 is a multiple of 10. Note that when the larger
tion supports homomorphic encryption without too much value of 𝛼 is chosen, the more information can be
accuracy lost. Moreover, the proposed Homofunc function reserved. We need chose this value according to the
contains the parameters n and ai . They can not be set too size of the input dataset and the available computing
large because the large size of the encrypted data will exceed resources.
the maximum machine word length. Therefore, we take
Homofunc(x) = x2 and x3 as our activation function, where
Table 2  ELM accuracy on unnormalized and unencrypted data
n = 2 or 3, an = 1, ai = 0, 0 ≤ i < n . From the results, we
can see that Homofunc activation function has the closest Activation function Iris Land satellite MNIST NIST19
accuracy to the Sigmoid function. Hence, the results proved Sigmoid 94.31 88.95 91.28 89.37
that Homofunc activation function is feasible for homomor- 93.79 85.49 89.43 86.61
Homofunc(x) = x2
phic encryption. Moreover, the relative accuracy between
Homofunc(x) = x3 93.92 86.66 90.02 87.32
the accuracy of ELM by Homofunc and Sigmoid function
Homofunc(x) = x2 99.45 a 96.11 a 97.97 a 96.91 a
Homofunc(x) = x3 99.59 a 97.43 a 98.62 a 97.71 a
5
  https​://githu​b.com/shaih​/HElib​. a
Denotes the relative accuracy from sigmoid function

13
 International Journal of Machine Learning and Cybernetics

Table 3  ELM accuracy on normalized but unencrypted data by AES) on all datasets. In details, Homo-ELM achieves
Activation Function Iris Land satellite MNIST NIST19
test accuracy of 89.55%, 78.62%, 72.27%, and 71.89% on
encrypted data while ELM achieves the accuracy of 81.52%
Sigmoid 34.31 22.65 21.91 25.37 72.62%, 62.23%, and 65.81%. In addition, compared to
Homofunc(x) = x 2 91.79 86.30 85.70 83.41 the Homo-ELM with 100 hidden nodes on the encrypted
Homofunc(x) = x3 92.12 86.96 86.82 84.92 datasets, ELM achieves the accuracy of 90.72%, 80.16%,
74.49%, and 73.12% over un-encrypted datasets. The relative
accuracy between Homo-ELM (encrypted) and ELM (un-
Table 4  Homo-ELM accuracy on normalized and encrypted data encrypted) is 98.71%, 98.07%, 97.02%, and 98.32% respec-
Homofunc(x) Iris Land satellite MNIST NIST19
tively. The average of those relative accuracies is 98.03%. In
short, Homo-ELM can achieve better classification accuracy
x2 89.55 78.62 72.27 71.89 with high-level security than ELM on the encrypted data.
x3 90.21 77.23 74.59 72.16 Compared to the ELM on un-encrypted data, the proposed
x2 + x + 1 91.37 79.19 73.24 73.02 Homo-ELM can classify encrypted images without much
accuracy loss.

We normalize the input weight 𝜔 , bias and input data X into
the range 0 < 𝜔 < 100 , 0 < bias < 10000 and 0 < X < 100
respectively. The comparison results between Homofunc
and Sigmoid functions of ELM (500 hidden nodes) on the
un-encrypted data are shown in Table 3. It shows that ELM
based on sigmoid function has too low accuracies to be
used in practice. ELM based on Homofunc(x) function can
achieve the acceptable accuracy.
In addition, we take Homofunc function on encrypted
data. The results of Homo-ELM with 100 hidden nodes
based on different settings of Homofunc function are shown
in Table 4. It demonstrates the different values of a and n
will affect the accuracy of Homo-ELM. The more complex
Homofunc function given, Homo-ELM can achieve higher
accuracy. This conforms the experiments of ELM. Note
that, we take the Homofunc(x) = x2 as activation function
in following experiments due to the limitation of comput-
ing resource.
3.2.4 Limitation
Fully homomorphic encryption can make computations on
the encrypted data without compromising the privacy of
users. However, some challenges are still unsolved when
applying it to the complex problems in practices, because
when we set a large parameter d and modulus p of homo-
morphic encryption, in which the d and p determine the size
of the polynomial ring, the length of encryption results will
be explosive, and the computation time of homomorphic
addition and multiple will be too long to be acceptable.
Therefore, we need to leverage them according to the com-
plexity of the target problem and the resources. Besides,
homomorphic matrix multiplication can be executed in par-
allel, this will much save the computing time and alleviate
this problem. We will do this work in the future.
4 Application: Homo‑ELM cloud storage

The evaluation result shows that Homo-ELM can achieve

3.2.3 Analysis of Homo‑ELM
better classification performance than other methods on
multi-class classification problem over the encrypted data. In
this section, we will show how Homo-ELM can be applied
To demonstrate the effectiveness of the proposed Homo-
to the cloud storage searching problem while preserving the
ELM, a comparison between Homo-ELM and ELM are
privacy of users.
listed in Table 5. The results show that Homo-ELM is more
The overview of Homo-ELM cloud storage application
accurate than ELM over the encrypted data (data encrypted
is shown in Fig. 2. In the left side, Homo-ELM is trained

Table 5  Accuracy comparison Models Iris Land satellite MNIST NIST19

between Homo-ELM and ELM
ELM (un-encrypted) 90.72 ± 0.26 80.16 ± 0.37 74.49 ± 1.02 73.12 ± 0.92
ELM (encrypted) 81.52 ± 0.21 72.62 ± 0.42 62.23 ± 1.72 65.81 ± 1.28
Homo-ELM (encrypted) 89.55 ± 0.31 78.62 ± 0.35 72.27 ± 1.22 71.89 ± 1.17
Homo-ELM (encrypted) a 98.71 a 98.07 a 97.02 a 98.32 a
a
Denotes the relative accuracy from ELM on un-encrypted data

13
International Journal of Machine Learning and Cybernetics
Fig. 2  Homo-ELM cloud stor-
age application
User Devices
Data
(un-encrypted)
Learning
Algorithm
Homo-ELM
(un-encrypted)
and encrypted on local user devices such as personal com-
puters or mobile devices first, and then the encrypted data
and encrypted Homo-ELM are uploaded to the cloud. The
privacy is preserved because all the data and neural net-
work of Homo-ELM are encrypted before transferred to the
cloud. Homo-ELM is a multi-class classifier that can only
deal with the classification problems. Therefore, we need a
cloud service that warps Homo-ELM classifier to deal with
the searching problems. In the right side, a searching service
is provided to end-users. It takes a user searching query Q
as inputs (Note that Q is encrypted before to be sent to the
cloud) and returns the searching results idx of data storage
index based on the encrypted data and encrypted Homo-
ELM. The details are shown as follows. For each encrypted
data d of the user u, the encrypted Homo-ELM predicts an
encrypted classification label l in the cloud, if the encrypted
label l equals to the searching query Q, return the index idx
of the encrypted data, then the user can download the target
encrypted data based on the index idx to local devices.
5 Conclusion and future work
In this paper, we proposed a novel fully homomorphic
extreme learning machine with a newly designed activa-
tion function that enables ELM for cloud searching task
without compromising the privacy of user. The prediction
process of neural network is fully protected that means
the potential privacy breaching is prevented on the pub-
lic cloud. Moreover, the encrypted data can be directly
and accurately searched without time-consuming steps of
decryption. The experiments demonstrate the effective-
ness of our proposed Homo-ELM. This work contributes
Searching Query
(Encrypted)
Cloud Storage Provider
Uploading
Data Data
(encrypted) (encrypted)
Cloud
Storage
Homomorphic
Search
Encryption
Service
Homo-ELM Homo-ELM
(encrypted) (encrypted)
Searching Result
to the usage of machine learning in cloud computing
environments.
In the future, we will apply Homo-ELM to more complex
cloud tasks on various kinds of devices such as computers,
smartphone, and wearable devices. Moreover, we plan to
improve the classification performance by designing new
polynomial functions to replace non-polynomial functions
and extend Homo-ELM to support more mathematics opera-
tors on encrypted data. Furthermore, other learning methods
[38, 39] will be considered for improving the classification
performance.
Acknowledgements  The work presented in this paper was funded
by the Multi-Year Research Grant of the University of Macau (No.
2019-00020-FST, 2018-00138-FST) and the Science and Technology
Development Fund of Macau SAR (No.0021/2019/A, 273/2017/A).
References
1. Chi P, Lei C (2018) Audit-free cloud storage via deniable attrib-
ute-based encryption. IEEE Tran Cloud Comput 6(2):414–427
2. Wei J, Liu W, Hu X (2018) Secure data sharing in cloud comput-
ing using revocable-storage identity-based encryption. IEEE Trans
Cloud Comput 6(4):1136–1148
3. Luna JM, Abdallah CT, Heileman GL (2018) Probabilistic opti-
mization of resource distribution and encryption for data storage
in the cloud. IEEE Trans Cloud Comput 6(2):428–439
4. Dawn XS, Wagner D, Perrig A (2000) Practical techniques for
searches on encrypted data. In: Proceeding 2000 IEEE symposium
on security and privacy. S P 2000, pp 44–55
5. Bösch C, Hartel P, Jonker W, Peter A (2014) A survey of
provably secure searchable encryption. ACM Comput Surv
47(2):18:1–18:51
13

6. Awad A, Matthews A, Qiao Y, Lee B (2018) Chaotic searchable
encryption for mobile cloud storage. IEEE Trans Cloud Comput
6(2):440–452
7. LeCun Y, Bengio Y, Hinton G (2015) Deep learning. Nature
521(7553):436
8. Schmidhuber J (2015) Deep learning in neural networks: an over-
view. Neural Netw 61:85–117
9. Wang W, Vong CM, Yang Y, Wong PK (2017) Encrypted image
classification based on multilayer extreme learning machine. Mul-
tidimens Syst Signal Process 28(3):851–865
10. Huang GB, Zhu QY, Siew CK (2006) Extreme learning machine:
theory and applications. Neurocomputing 70(1):489–501 (Neural
Networks)
11. Lendasse A, Vong CM, Toh KA, Miche Y, Huang GB (2006)
Advances in extreme learning machines (ELM2015). Neurocom-
puting 261:1–3 (Advances in Extreme Learning Machines)
12. Wang R, Chow C, Lyu Y, Lee VCS, Kwong S, Li Y, Zeng J (2018)
Taxirec: recommending road clusters to taxi drivers using rank-
ing-based extreme learning machines. IEEE Trans Knowl Data
Eng 30(3):585–598
13. Rong H, Huang G, Sundararajan N, Saratchandran P (2009)
Online sequential fuzzy extreme learning machine for function
approximation and classification problems. IEEE Trans Syst Man
Cybern Part B (Cybern) 39(4):1067–1072
14. Rong HJ, Jia YX, Zhao GS (2014) Aircraft recognition using mod-
ular extreme learning machine. Neurocomputing 128:166–174
15. Phong LT, Aono Y, Hayashi T, Wang L, Moriai S (2018) Pri-
vacy-preserving deep learning via additively homomorphic
encryption. IEEE Trans Inf Forensics Secur 13(5):1333–1345
16. Zhang Q, Wang C, Wu H, Xin C, Phuong TV (2018) Gelu-net:
a globally encrypted, locally unencrypted deep neural network
for privacy-preserved learning. In: Proceedings of the twenty-
seventh international joint conference on artificial intelligence,
IJCAI-18, international joint conferences on artificial intelli-
gence organization, no 7, pp 3933–3939
17. Samet S, Miri A (2012) Privacy-preserving back-propagation
and extreme learning machine algorithms. Data Knowl Eng
79–80:40–61
18. Hashimoto M, Kaneda Y, Zhao Q (2016) An elm-based privacy
preserving protocol for cloud systems. In: 2016 IEEE sympo-
sium series on computational intelligence (SSCI), pp 1–6
19. Hashimoto M, Zhao Q (2017) An ELM-based privacy preserv-
ing protocol for implementing aware agents. In: 2017 3rd IEEE
international conference on cybernetics (CYBCONF), pp 1–6
20. Özgür Çatak F, Mustacoglu AF (2018) CPP-ELM: cryptograph-
ically privacy-preserving extreme learning machine for cloud
systems. Int J Comput Intell Syst 11:33–44
21. Kuri S, Hayashi T, Omori T, Ozawa S, Aono Y, Phong LT,
Wang L, Moriai S (2017) Privacy preserving extreme learning
machine using additively homomorphic encryption. In: 2017
IEEE symposium series on computational intelligence (SSCI),
pp 1–8
22. Cao W, Wang X, Ming Z, Gao J (2018) A review on neural net-
works with random weights. Neurocomputing 275:278–287
23. Wang X, Zhang T, Wang R (2019) Noniterative deep learning:
incorporating restricted boltzmann machine into multilayer ran-
dom weight neural networks. IEEE Trans Syst Man Cybern Syst
49(7):1299–1308
13
International Journal of Machine Learning and Cybernetics
24. Wang X, Wang R, Xu C (2018) Discovering the relationship
between generalization and uncertainty by incorporating com-
plexity of classification. IEEE Trans Cybern 48(2):703–715
25. Tu E, Zhang G, Rachmawati L, Rajabally E, Huang G (2018)
Exploiting AIS data for intelligent maritime navigation: a com-
prehensive survey from data to methodology. IEEE Trans Intell
Transp Syst 19(5):1559–1582
26. Cui D, Huang GB, Liu T (2018) ELM based smile detection using
distance vector. Pattern Recognit 79:356–369
27. Sun F, Huang G, Wu QMJ, Song S, Wunsch DC II (2017) Effi-
cient and rapid machine learning algorithms for big data and
dynamic varying systems. IEEE Trans Syst Man Cybern Syst
47(10):2625–2626
28. Huang G, Zhou H, Ding X, Zhang R (2012) Extreme learning
machine for regression and multiclass classification. IEEE Trans
Syst Man Cybern Part B (Cybern) 42(2):513–529
29. Rivest RL, Adleman L, Dertouzos ML (1978) On data banks and
privacy homomorphisms. Found Secure Comput 4(11):169–180
30. Naccache D, Stern J (1998) A new public key cryptosystem based
on higher residues. In: Proceedings of the 5th ACM conference
on computer and communications security. CCS ’98. ACM, New
York, NY, pp 59–66
31. Boneh D, Goh EJ, Nissim K (2005) Evaluating 2-DNF formulas
on ciphertexts. In: Proceedings of the second international con-
ference on theory of cryptography. TCC’05. Springer, Berlin, pp
325–341
32. Gentry C (2009) Fully homomorphic encryption using ideal lat-
tices. In: Proceedings of the forty-first annual ACM symposium
on theory of computing. STOC ’09. ACM, New York, NY, pp
169–178
33. van Dijk M, Gentry C, Halevi S, Vaikuntanathan V (2010) Fully
homomorphic encryption over the integers. In: Gilbert H (ed)
Advances in cryptology—EUROCRYPT 2010. Springer, Berlin,
pp 24–43
34. Brakerski Z, Gentry C, Vaikuntanathan V (2014) (leveled) Fully
homomorphic encryption without bootstrapping. ACM Trans
Comput Theory (TOCT) 6(3):13:1–13:36
35. Liu X, Lin S, Fang J, Xu Z (2015) Is extreme learning machine
feasible? a theoretical assessment (part I). IEEE Trans Neural
Netw Learn Syst 26(1):7–20
36. Lin S, Liu X, Fang J, Xu Z (2015) Is extreme learning machine
feasible? a theoretical assessment (part II). IEEE Trans Neural
Netw Learn Syst 26(1):21–34
37. Temurtas F, Gulbag A, Yumusak N (2004) A study on neural
networks using Taylor series expansion of sigmoid activation
function. In: Computational science and its applications—ICCSA
2004. Springer, Berlin, pp 389–397
38. Pan SJ, Yang Q (2010) A survey on transfer learning. IEEE Trans
Knowl Data Eng 22(10):1345–1359
39. Wang R, Wang X, Kwong S, Xu C (2017) Incorporating diversity
and informativeness in multiple-instance active learning. IEEE
Trans Fuzzy Syst 25(6):1460–1475
Publisher’s Note Springer Nature remains neutral with regard to
jurisdictional claims in published maps and institutional affiliations.