Outsourced Privacy-Preserving Feature Selection Based on Fully Homomorphic Encryption

1. Introduction

Feature selection is the process of identifying and selecting useful features (variables or attributes) from a dataset with the aim of improving the performance of predictive models and optimizing learning efficiency [1]. Consider a scenario in which a target variable is to be predicted using a large number of potential explanatory variables, with the goal of building a simple yet effective predictive model from a vast set of observations. For instance, in semiconductor manufacturing, more than tens of thousands of external factors can influence the production process from silicon material to the final product. If it is possible to identify in advance which of these factors are critical to product quality, then it is sufficient to construct a classification model based only on those selected features—offering a range of benefits. In practice, such preprocessing can lead to improvements in model accuracy, reductions in training time, and enhanced interpretability of the model. Many feature selection algorithms based on various criteria have been proposed to date [2,3,4,5,6,7,8].

In this study, we consider the feature selection in situations where the training data contains privacy-sensitive information. When the data owner who needs a reasonable learning model and the analyst required to construct the model are the same, privacy is generally not a concern as long as there is no data leakage. However, our focus is on privacy-preserving computation in cases where these two parties are separate. Existing frameworks to address this issue include techniques such as secret sharing [9] and differential privacy [10]. In this work, from the perspective of outsourcing, we focus on an approach based on fully homomorphic encryption (FHE) [11], which is a form of public-key cryptosystem.

In secret sharing schemes, data is split and distributed among parties, which introduces a risk of data leakage if those parties colludes maliciously. Differential privacy, on the other hand, prevents leakage by injecting random noise into the data. However, there exists a trade-off between the amount of noise added and the quality of the learning results, and it cannot guarantee complete protection against data leakage.

By contrast, FHE enables all arithmetic and comparison operations to be performed directly on encrypted data. Since only the data owner possessing the secret key can decrypt the final result, the privacy guarantees are as strong as the underlying public-key encryption. The primary limitations of FHE have been computational inefficiency and the challenge of outsourcing computation in scenarios involving multiple data owners. However, recent advancements such as TFHE [12] and multi-key homomorphic encryption schemes [13] are steadily overcoming these obstacles.

Therefore, we consider a simplified privacy-preserving problem for feature selection: The data owner retains the training data along with a pair of generated public and private keys. Then, the analyst receives the encrypted training data and performs feature selection using FHE scheme. The result of the computation is then returned to the data owner, who decrypts it using the private key.

Note that the proposed method constitutes a fully outsourced computation [14,15] with only a single round of communication between the data owner and the analyst. This aspect significantly strengthens privacy protection. In non-fully outsourced scenarios, multiple interactions or queries from a party may be required. During such interactions, partial decryption of maliciously crafted messages from untrusted analyst could lead to unintentional leakage of the data owner’s private information.

To prevent this, conventional approaches typically rely on assumptions that constrain the behavior of the analysts. For example, the semi-honest model assumes that the analyst follows the protocol faithfully but may attempt to extract as much information as possible from the data he receives. However, imposing such assumptions compromises practical applicability. In contrast, our algorithm requires only single round communication without decryption and ensures that the risk of data leakage depends solely on the strength of the cryptosystem. The TFHE [12] used in this study is proven to be at least secure against chosen-plaintext attacks (IND-CPA secure). Consequently, it offers a significant advantage in terms of both security and practical usability compared to existing methods.

2. Related Works and Our Contributions

Feature selection is broadly categorized into filter method [16], wrapper method [17], and embedded method [18]. Among these, the filter method evaluates the importance of features based on information theory, making it faster than other methods and highly generalizable due to its independence from specific models. While evaluation metrics such as mutual information are commonly used in filter methods [19], this study focuses on feature selection based on a recently proposed consistency measure [20]. Feature selection algorithms using consistency measures have been shown to achieve both high computational efficiency and high classification accuracy on large-scale real-world datasets [7,8]. In contrast, feature selection algorithms based on wrapper or embedded methods are generally impractical for secure computation due to the high computational cost associated with searching for optimal feature subsets or training models. Therefore, this study proposes a consistency measure-based secure feature selection.

Homomorphic encryption (HE) is a framework for secure computation that leverages the homomorphic properties of public-key cryptosystems. Specifically, if encrypted integers can be added without decryption, the cryptosystem is said to be additive. Furthermore, if it supports both operations, it is called FHE, e.g., RSA [21], the first public-key cryptosystem, is multiplicative but not additive. Additionally, RSA is not a probabilistic encryption scheme—i.e., it does not produce different ciphertexts for the same plaintext in each execution—making it vulnerable to chosen-plaintext attacks. The first probabilistic HE [22] was capable of computing the sum (i.e., bitwise XOR) of encrypted bits. Subsequently, a scheme enabling the addition of integers was proposed [23]. Later, the first HE capable of both addition and multiplication was introduced [24], but it allowed only single multiplication operation in overall computation, limiting its practicality for secure computation. Eventually, the first FHE, which imposes no restrictions on the number of operations, was proposed [11], making arbitrary secure computations theoretically possible. In practice, fast FHE libraries have become available [25], expanding its applicability. The implementation of the algorithm proposed in this study also utilizes such a library.

Although several private feature selection methods have been proposed to date [26,27,28,29], only a few have addressed privacy-preserving computation for the consistency measure [30], and this study is the first to attempt a fully outsourced computation for it. This is because the computation of the optimal consistency measure reduces to the set cover problem known to be NP-hard [31]. Consequently, approximation algorithms and acceleration techniques for solving this optimization problem have been proposed [7,8], and in this study, we realize a secure fully outsourced computation of such an algorithm.

A core technique in this approximate method is preprocessing via sorting. By sorting the entire dataset with feature values as keys, it becomes possible to efficiently narrow down the important features, enabling a heuristic approach to approximate optimal feature selection. However, executing this algorithm over encrypted data is not straightforward. In general, the lower bound for comparison-based sorting algorithms is $\Omega (nlogn)$, but no secure outsourced computation method is currently known that achieves this lower bound. At present, the fastest known method uses sorting networks with a time complexity of $O\left(n{log}^{2}n\right)$ [33], which is also adopted in this study as preprocessing. It should be noted, however, that if secret sharing among two or more parties is used, faster privacy-preserving sorting becomes feasible [34]. Moreover, disregarding practical constraints, it is theoretically possible to construct sorting networks with $O(nlogn)$ time complexity [35]. Nonetheless, both of these approaches are outside the scope of this study.

Table 1 below summarizes HE-based private feature selection algorithms. Here, k and n denote the number of features and data samples, respectively. A filter method [26] adopts the ${\chi }^2$ statistic as its evaluation criterion and employs additively homomorphic encryption [23]. While this method has a low offline computational cost, its communication overhead is greater than that of the proposed method. Moreover, since it assumes two-party computation, it does not support fully outsourced computation. Additionally, it has not been implemented. Another two-party protocol [30] uses the same consistency measure as the proposed method and adopts the fastest FHE [12]. Although it also achieves exactly single round complexity as our the method, it assumes a two-party setting and therefore does not support fully outsourced computation.

3. Preliminaries

3.1. Consistency-Based Feature Selection

Let $D=\{d_1,d_2,\dots ,d_n\}$ be a set of indices of data, associated with a set $F=\{f_1,f_2,\dots ,f_k\}$ of features and a class variable C, where the feature value $d\left(f_i\right)$ and the class label $d\left(C\right)$ are defined for each data $d\in D$. Table 2 shows an example of the triple $(D,F,C)$.

The feature selection is to find a minimal subset $F^{\prime }\subseteq F$ relevant to C, where $F^{\prime }$ is said to be consistent if, for any $d,d^{\prime }\in D$, $d\left(f_i\right)=d^{\prime }\left(f_i\right)$ for all $f_i\in F^{\prime }$ implies $d\left(C\right)=d^{\prime }\left(C\right)$, and $F^{\prime }$ is minimal, if any proper subset of $F^{\prime }$ is no longer consistent.

For example, consider the mutual information $I(F^{\prime };C)$ for evaluating the relevance of $F^{\prime }$ showing in Table 2. We can see that $f_1$ is more important than $f_5$ due to the fact $I(f_1;C)>I(f_5;C)$. $f_1$ and $f_2$ of Table 2 will be chosen to explain C based on the score of I. However, a closer examination of D reveals that $f_1$ and $f_2$ cannot uniquely determine C. In fact, we find $d_2$ and $d_5$ with $d_2\left(f_1\right)=d_5\left(f_1\right)$ and $d_2\left(f_2\right)=d_5\left(f_2\right)$ but $d_2\left(C\right)\ne d_5\left(C\right)$. On the other hand, we can see that $f_4$ and $f_5$ uniquely determine C using the formula $C=f_4\oplus f_5$ while $I(f_4;C)=I(f_5;C)=0$. It becomes clear that $I(F^{\prime };C)$ alone may not always lead to appropriate feature selection.

Let us review the notion of the consistency measure employed in this study. A consistency measure $\mu :2^F\to [0,\infty )$ is a function to represent how far the data deviate from a consistent state, where F is required to satisfy determinisity (i.e., $\mu \left(F\right)=0$ iif F is consistent) and monotonicity (i.e., $F\subseteq G$ implies $\mu \left(F\right)\ge \mu \left(G\right)$). In this study, we focus on the binary consistency: ${\mu }_{\mathrm{bin}}\left(F\right)=0$, F is consistent; 1, otherwise [7]. For other consistency measures, see e.g., rough set [2], ICR [5], and inconsistent pair [6].

As Table 2 illustrates, the importance of a feature $f_i$ is not determined solely by itself, but is influenced by the relative relationship among other features. CWC [8] achieves superior feature selection compared to other statistical measures by computing the relative importance of features. Algorithm 1 outlines the procedure of CWC, where the consistency of the candidate set excluding $f_i$ is evaluated to determine whether to select $f_i$. Here, the order in which features $f_i$ are selected significantly affects the result, so it is important to preprocess the triple $(D,F,C)$ in advance. For example, there is a known method that determines the order of $f_i$ by sorting the triple with the values of $f_i$ as keys. This study also adopts that method.

Algorithm 1 CWC [7] over plaintexts

Require:   A dataset $(D,F,C)$; Ensure:   A minimal consistent subset of F;  1: for   $i=1,\dots ,k$  do  2:    if $F\setminus \left\{f_i\right\}$ is consistent then  3:      update $F\leftarrow F\setminus \left\{f_i\right\}$;  4:    end if  5: end for  6: return F;

3.2. Computation on FHE

The proposed FHE-based private feature selection is implemented using TFHE [25], one of the fastest FHE library for bitwise addition (XOR `⊕’) and bitwise multiplication (AND `·’) over ciphertext. On TFHE, any ℓ-bit integer $m=(m_1,m_2,\dots ,m_{\ell })$ is encrypted bitwise: $E\left[m\right]\equiv (E\left[m_1\right],E\left[m_2\right],\dots ,E\left[m_{\ell }\right])$.

Given $E\left[b\right]$ and $E\left[b^{\prime }\right]$ ($b,b^{\prime }\in \{0,1\}$), FHE allows to compute the bitwise operations $E[b\oplus b^{\prime }]$ and $E[b·b^{\prime }]$ without decrypting $E\left[b\right]$ and $E\left[b^{\prime }\right]$. It also allows all arithmetic and logical operations via XOR and AND as follows: Let $x,y$ represent ℓ-bit integers and $x_i,y_i$ the i-th bit of $x,y$, respectively. Let $c_i$ represent the i-th carry-in bit and $s_i$ the i-th bit of the sum $x+y$. Then, we can obtain the private full-adder $E[x+y]$ using the relations $s_i=x_i\oplus y_i\oplus c_i$ and $c_{i+1}=(x_i\oplus c_i)·(y_i\oplus c_i)\oplus c_i$. We can construct other operations such as subtraction, multiplication, and division based on the full-adder.

On the other hand, we can also obtain the private comparison $E\left[cmp\right(>,x,y\left)\right]$ satifying $cmp(>,x,y)=1$ if $x>y$ and 0 otherwise, because $cmp(>,x,y)$ is identical to the most significant bit of $y+(-x)$, which can be obtained without decryption. Here, $(-x)$ is the bit complement of x obtained by $x_i\oplus 1$ for all i-th bits.

Thus, by using FHE, it is possible to perform all arithmetic operations and comparisons for encrypted variables or elements of arrays. For simplicity, we represent such operations in plaintext notation throughout the remainder of this paper. That is, unless otherwise stated or unless it may cause confusion, an operation such as the addition of two encrypted integers $E\left[x\right]$ and $E\left[y\right]$, resulting in $E[x+y]$, will be denoted simply as $x+y$.

Based on FHE, we can design a private sorting algorithm as follows (e.g. [32]). Note that, in this code, the variables gt, tmp, and any entry in the array arr[1..n] are all encrypted. Therefore, after this code is executed, the resulting arr[1..n] is sorted securely without revealing the private information about arr[1..n].

// private bubble_sort over ciphertexts

void bubble_sort(int *arr,int n){

    for(int i=0;i<n-1;i++){

        for(int j=1;j<n-1;j++){

            int gt=cmp(>,arr[j-1],arr[j]);

            int tmp=gt*arr[j-1]^(!gt)*arr[j];

            arr[j-1]=gt*arr[j]^(!gt)*arr[j-1];

            arr[j]=tmp;

        }

    }

}

However, it is difficult to improve the $O\left(n^2\right)$ time algorithm to $O(nlogn)$. This is because encrypting pointers is fundamentally meaningless. If pointers are in plaintext, information about the input (e.g., the distribution of values) may be leaked. On the other hand, if the pointers are encrypted, it becomes impossible to access the corresponding memory addresses, and thus computation cannot proceed. Satisfying these conflicting requirements simultaneously appears to be impossible. This difficulty can be partially avoided by using sorting network, where comparisons are performed only between fixed pairs of elements, eliminating the need for pointers. Theoretically, we can construct an optimum sorting network that achieves $O(nlogn)$ comparisons [35], but the circuit size is impractically large. Therefore, in practice, $O\left(n{log}^{2}n\right)$ algorithm [33] is used. This study also adopts this approach.

4. Method

4.1. Sorting Network on FHE

Sorting via FHE is typically performed using sorting networks. It remains an open question whether a fastest algorithm such as quicksort or mergesort can be effectively realized in FHE setting. In this study, we adopt the Batcher’s odd-even mergesort [33] as the basis for sorting. Batcher’s algorithm employs a recursively constructed sorting network according to the number of elements and achieves sorting in $O\left(n{log}^{2}n\right)$ time. However, it requires that the number of data items be a power of two. Therefore, if the input data size does not meet this condition, we insert appropriate dummy elements beforehand to adjust the size. Moreover, since sorting network is basically not a stable sort, we attach a $logn$-bit suffix to each data element to ensure stability. This preprocessing does not affect the correctness or quality of feature selection in any way.

4.2. A Naive Algorithm for Private CWC

In this study, we assume that the data analyst (i.e., an algorithm) receives the input triple $(D,F,C)$ in encrypted form, and that the algorithm is capable of performing FHE operations on encrypted data.

Here, $(D,F,C)$ is possessed as an array, and the algorithm has access to any encrypted entry $d_i\left(f_j\right)$ or $d_i\left(C\right)$ for $i\in \{1,2,\dots ,n\}$ and $j\in \{1,2,\dots ,k\}$. The private CWC (denoted pCWC) utilizes sorting D with the feature vectors $\overrightarrow{F}=(f_1,f_2,\dots ,f_k)$ formed by $f_i\in F$. By sorting $(D,F,C)$ with $\overrightarrow{F}$ as the key, identical feature vectors are placed adjacent to each other, significantly speeding up the consistency checking step.

Table 3 (upper) shows an input $(D,F,C)$ and Table 3 (lower) shows the sorted $(D,F,C)$ where each original index $d_i$ is renamed by the sorted order $D_j$ and for each $i\in \{1,2,\dots ,k\}$, the corresponding feature label $L\left[i\right]\left[j\right]$ is the unique grouping label of $logn$ bits for $D_j$ defined by the feature vector $\overrightarrow{F}[..i]=(f_1,f_2,\dots ,f_i)$.

For example, Table 3 (lower), the labels $L_5$ for $D_1$ and $D_2$ are both 000, indicating that $D_1$ and $D_2$ belong to the same group based on identical feature vector values up to $f_5$. Therefore, the consistency check needs to be performed only for data points that share the same label associated with the tail $f_i$. Thus, by using the sorted $(D,F,C)$ along with the corresponding feature labels in $L[1..k][1..n]$, the consistency checking process becomes significantly simplified.

Algorithm 2 shows a naive pCWC computation based on the sorted $(D,F,C)$ and the feature labels. Given $(D,F,C)$, consider the evaluation of each feature $f_t$ in $F=\{f_1,f_2,\dots ,f_k\}$. The algorithm evaluates the consistency on the feature set $F^{\prime }=F\setminus \left\{f_t\right\}$, obtained by removing $f_t$, and obtains the corresponding Boolean value $b_t$. Specifically, $b_t$ is computed as:

$$b_t=\underset{i=2}{\overset{n}{\bigwedge }}\left((D_{i-1}\ne D_i)\vee (D_{i-1}\left(C\right)=D_i\left(C\right))\right)$$

Here, $b_t=1$ iff $f_t$ is selected. By reporting the resulting $\overrightarrow{b}=(b_1,\dots ,b_k)$ to the data owner, the selected features are obtained after decrypting $\overrightarrow{b}$.

We next analyze the complexity of our algorithm where in the following discussion, we assume that the cost of each homomorphic operation under FHE is constant. That is, the computational cost of arithmetic and comparison operations on encrypted data is treated as $O\left(1\right)$, unless otherwise specified.

Algorithm 2 Naive pCWC for ciphertexts

Require:   An encrypted $(D,F,C)$; Ensure:   A minimal consistent subset of F;  1: for   $t=k,k-1,\dots ,1$  do  2:    sort $(D,F^{\prime },C)$ with $\overrightarrow{F^{\prime }}$ as the key for $F^{\prime }=F\setminus \left\{f_t\right\}$;  3:    compute $L\left[j\right]\left[i\right]$ for all $j=1,2,\dots ,k$ and $i=1,2,\dots ,n$;  4:    compute the consistency $b_t\in \{0,1\}$ of $(D,F^{\prime },C)$;  5:    update $D_i\left(f_t\right)\leftarrow D_i\left(f_t\right)·b_t$ for all $i=1,2,\dots ,n$;  6: end for  7: return $\overrightarrow{b}=(b_1,b_2,\dots ,b_k)$ representing the selected subset of F;

Theorem 1.

  Algorithm 2 (naive pCWC) on ciphertexts simulates Algorithm 1 (CWC) on plaintexts. The time and space complexities are $O\left(k^{2}n{log}^{3}n\right)$ and $O\left(kn\right)$ for $\left|F\right|=k$ and $\left|D\right|=n$, respectively.

Proof. 

Assuming that $(D,F^{\prime },C)$ is already sorted, the feature label $L\left[t\right]\left[i\right]$ of $D_i$ for $\overrightarrow{F}[..t]$ can be computed based on whether $D_{i-1}(..f_t)=D_i(..f_t)$ holds, where $D_i(..f_t)$ stands for $D_i\left(f_1\right)\dots D_i\left(f_t\right)$. When the predecessor $L\left[t\right][i-1]$ for $D_{i-1}$ is already defined, using the logical bit x to indicate whether $D_{i-1}(..f_t)=D_i(..f_t)$, the next $L\left[t\right]\left[i\right]$ is defined as: $L\left[i\right]\leftarrow L[i-1]+\neg x$. These computations can be performed on FHE. Moreover, the logical bit $b_t$, which determines whether the feature $f_t$ should be selected, can also be computed by FHE according to its definition. By updating each $f_t$ as: $D_i\left(f_t\right)\leftarrow D_i\left(f_t\right)·b_t$, we can effectively remove $f_t$ from $(D,F,C)$. Thus, Algorithm 2 correctly simulates the original CWC on plaintexts.

When sorting the encrypted $(D,F^{\prime },C)$ using a sorting network, the number of comparisons required is $O\left(kn{log}^{2}n\right)$. Since our method appends a $\lceil logn\rceil$-bit suffix to each data entry to achieve stable sorting, the computation time for one feature $f_t$ becomes $O\left(kn{log}^{3}n\right)$. Therefore, the total computation time across all features is $O\left(k^{2}n{log}^{3}n\right)$. The space complexity is clear.    □

4.3. Improved Private CWC

In the naive approach, sorting of $(D,F^{\prime },C)$ is iterated for each $F^{\prime }=F\setminus \left\{f_t\right\}$ with specified $f_t\in F$, resulting in high computational cost. Therefore, we aim to accelerate this algorithm. It should be noted that, since $(D,F,C)$ are encrypted, pointer-based referencing cannot be used. In this study, we propose a method that avoids full sorting at each step by partitioning F into two sequences—selected features and unprocessed features—and processing them independently before merging the results.

The key concept here is to utilize the feature labels in $L\left[t\right][1..n]$ introduced in Algorithm 2 for partial sorting. Suppose that we are focusing on a current feature $f_t$. That is, feature selection has already been completed for the suffix vector $\overrightarrow{F}[t+1..]=(f_{t+1},f_t,\dots ,f_k)$. In this case, we define the feature labels for $\overrightarrow{F}[t+1..]$ and store them in the array $PostL[1..n]$ as follows: $PostL\left[i\right]=PostL\left[i^{\prime }\right]$ iff $D_i(f_{j+1}..)=D_{i^{\prime }}(f_{j+1}..)$. This groups the suffix sequences of F that share the same feature vector.

As shown in Algorithm 2, feature labels for any prefix vector $\overrightarrow{F}[..t]$ are stored in the array $L\left[t\right][1..n]$. Therefore, to group $(D,F\setminus \left\{f_t\right\},C)$, we first independently compute $L\left[t\right][1..n]$ for prefix vector $\overrightarrow{F}[..t]$ and $PostL[1..n]$ for the corresponding suffix vector $\overrightarrow{F}[t+1..]$, and then calculate the ranks of $L\left[t\right][1..n]$ and $PostL[1..n]$ to merge them correctly. This approach enables us to avoid iterative sorting for the entire $(D,F^{\prime },C)$.

Algorithm 3 Improved pCWC for ciphertexts

Require:   An encrypted $(D,F,C)$; Ensure:   A minimal consistent subset of F;  1: sort $(D,F,C)$ with $\overrightarrow{F}$ as the key;  2: compute the feature label $L\left[j\right]\left[i\right]$ for all $j=1,2,\dots ,k$ and $i=1,2,\dots ,n$;  3: initialize $PostL[1..n]\leftarrow (0,0,\dots ,0)$ and $MapL[1..n]\leftarrow (1,2,\dots ,n)$;  4: for   $t=k,\dots ,1$  do  5:    sort $(f_{t+1}[1..n],PostL[1..n]$, $C[1..n]$, $MapL[1..n])$ as the key $f_{t+1}[1..n]$;  6:    update $PostL[1..n]$ by the sorted $f_{t+1}[1..n]$;  7:    sort $(f_t,L[t-1][1..n])$ by the inverse $Map{L}^{-1}[1..n]$;  8:    compute the consistency $b_t\in \{0,1\}$ of $\left(L\right[t-1\left]\right[1..n],PostL[1..n],C[1..n\left]\right)$;  9:    update $f_t:D_{\ell }\left(f_t\right)\leftarrow D_{\ell }\left(f_t\right)·b_t$ for all $\ell =1,2,\dots ,n$; 10: end for 11: return $\overrightarrow{b}=(b_1,b_2,\dots ,b_k)$ representing the selected subset of F;

The task of Algorithm 3 is divided into three phases: preprocessing on $(D,F,C)$ (Figure 1), partial sorting of $(D,F,C)$ with respect to a specific feature $f_t$ (Figure 2), and the decision-making and update of $(D,F,C)$ based on $f_t$ (Figure 3), respectively.

Figure 1 illustrates the preprocessing of $(D,F,C)$. Here, it is assumed that the sorting of $(D,F,C)$ has already been completed, and each $D_i$ represents its rank in the sorted order. For this sorted $(D,F,C)$, a label $L_t$ is assigned to each $D_i$ based on $\overrightarrow{F}[..t]$, such that $L\left[t\right]\left[i\right]=L\left[t\right]\left[j\right]$ iff $D_i(..f_t)=D_j(..f_t)$. That is, $L\left[t\right][1..n]$ group labels for $D_i$s sharing the same value of $\overrightarrow{F}[..t]$.

Next, we focus on a specific feature $f_t$ and determine whether it should be selected. For this purpose, we require the sorting result of $(D,F^{\prime },C)$, where $F^{\prime }=F\setminus \left\{f_t\right\}$ (see Figure 2). However, since $\overrightarrow{F}[..t-1]$ has already been sorted, we divide F into $\overrightarrow{F}[..t-1]$, $f_t$, and $\overrightarrow{F}[t+1..]$ with the current $f_t$, and only $\overrightarrow{F}[t+1..]$ is sorted . Because the sorting of $\overrightarrow{F}[..t-1]$ is performed sequentially for $t=k,k-1,\dots ,t$, it only needs to be executed for the current value of $f_t$. As a result, the computational cost is significantly reduced compared to naively sorting both the prefix and suffix for every possible $f_t$.

However, performing sorting on $\overrightarrow{F}[..t-1]$ breaks the alignment between the previously synchronized $\overrightarrow{F}[..t-1]$ and $\overrightarrow{F}[t+1..]$. To keep this correspondence, we introduce a reference array $MapL[1..n]$ initialized by $(1,2,\dots ,n)$, and sort $\left(PostL\right[1..n],MapL[1..n\left]\right)$ simultaneously. We then compute the inverse array $Map{L}^{-1}[1..n]$ by sorting $(1,2,\dots ,n)$ with $MapL[1..n]$ as the key, and by sorting $Map{L}^{-1}[1..n]$ together with $\overrightarrow{F}[t+1..]$, the synchronization between the prefix and corresponding suffix of $\overrightarrow{F}$ is maintained. Through this procedure, we obtain the correctly sorted result of $(D,F^{\prime },C)$ without $f_t$ excluded.

Figure 3 illustrates the task for verifying the consistency of the sorted $(D,F^{\prime },C)$ and determines whether $f_t$ is a necessary feature. Since this information is extracted as an encrypted logical bit $b_t$, the decision can be reflected back to $(D,F,C)$ by computing the product of $b_t$ with all values of $f_t$. These operations are carried out sequentially in the order $t=k,k-1,\dots ,1$, and by decrypting the resulting bit vector $\overrightarrow{b}=(b_1,b_2,\dots ,b_k)$, we obtain the final feature selection result.

Theorem 2.

  Algorithm 3 (improved pCWC) on ciphertexts simulates Algorithm 1 (CWC) on plaintexts. The time and space complexities are $O\left(kn{log}^{3}n\right)$ and $O\left(kn\right)$ for $\left|F\right|=k$ and $\left|D\right|=n$, respectively.

Proof. 

We first show the correctness of Algorithm 3, that is it correctly simulates Algorithm 2. To establish this, it is sufficient to prove that for any feature $f_t$, Algorithm 3 (1) correctly sorts $(D,F\setminus \left\{f_t\right\},C)$, and (2) accurately determines the consistency of the sorted $(D,F\setminus \left\{f_t\right\},C)$.

As a result of preprocessing, for any t, $(D,F,C)$ is already sorted using the prefix vector $\overrightarrow{F}[..t]=(f_1,f_2,\dots ,f_t)$ as the key, and thus the correct label $L\left[t\right]\left[i\right]$ for $D_i$ has been computed.

Now, assuming that the feature labels $PostL[1..n]$ corresponding to the suffix $\overrightarrow{F}[t+2..]$ has been computed in the previous loop, we can obtain the updated ranks for the extended suffix $\overrightarrow{F}[t+1..]$ by sorting $PostL[1..n]$ using $f_{t+1}$ as the key. Then, by updating $PostL[1..n]$ based on the sorted values and their corresponding $f_{t+1}$ values, we can compute the new $PostL[1..n]$ that reflects the extended suffix $\overrightarrow{F}[t+1..]$. All of these computations can be performed under FHE, in the same manner as in Algorithm 2.

The next necessary step is to restore the correspondence between $L[t-1][1..n]$ and $PostL[1..n]$. The array $L[t-1][1..n]$ has retained its original order from the initial sorting for prefixes, whereas the current $PostL[1..n]$ has been reordered according to the current suffix. Suppose that the previous $PostL[1..n]$ corresponding to the suffix $\overrightarrow{F}[t+2..]$ was already synchronized with $L[t-1][1..n]$.

To preserve the previous ordering of $PostL[1..n]$ (i.e., the ordering synchronized with $L[t-1][1..n]$), we first sort the initialized index array $MapL[1..n]=(1,2,\dots ,n)$ together with $PostL[1..n]$. Then, since the original positions of $MapL[1..n]$ are retained in the inverse index array $Map{L}^{-1}[1..n]$, we can restore the correct correspondence between $L[t-1][1..n]$ and $PostL[1..n]$ by sorting $L[t-1][1..n]$ using $Map{L}^{-1}[1..n]$ as the key. All of these operations can be performed solely through sorting on encrypted data under FHE.

Moreover, since both $f_{t+1}$ and C are always kept in synchronization with $PostL[1..n]$, and each $f_t$ is always sorted in accordance with $L[t-1][1..n]$, Algorithm 3 correctly sorts $(D,F\setminus \left\{f_t\right\},C)$. The consistency check applied to the sorted $(D,F\setminus \left\{f_t\right\},C)$ is identical to that in Algorithm 2. Therefore, we conclude that the improved algorithm correctly simulates the naive one.

Next, we evaluate the computational complexity. The sorting of $(D,F,C)$ in Lines 2–4 is identical to that of Algorithm 2, and thus requires $O\left(kn{log}^{3}n\right)$ time.

Among Lines 6–15, the most computationally expensive operations are the sorting steps in Line 8 and Line 10. In Line 8, sorting is performed using $f_{t+1}$ as the key. To ensure stability, a $logn$-bit suffix is appended to each entry, allowing the operation to be treated as sorting integers of $O(logn)$ bits. Therefore, the time complexity is $O\left(n{log}^{3}n\right)$.

In Line 10, sorting is performed using $MapL[1..n]$ as the key. Since $MapL[1..n]$ is initialized as $(1,2,\dots ,n)$, no additional suffix is required for stable sorting, and this operation also runs in $O\left(n{log}^{3}n\right)$ time. Because the above process is repeated k times, the overall computational time is $O\left(kn{log}^{3}n\right)$.

Finally, the additional data structures used by Algorithm 3, besides $(D,F,C)$, include $L[1..k][1..n]$, $PostL[1..n]$, $MapL[1..n]$, and $Map{L}^{-1}[1..n]$. Since each of these has a size of $O\left(kn\right)$, the total space complexity of the algorithm is also $O\left(kn\right)$.    □

5. Experimental Results

We implemented the proposed private CWC (Algorithm 3) in C++. For FHE operations, we used TFHE library [25]. The experiments were conducted on a machine equipped with an Intel(R) Core(TM) i9-10900X CPU running at 3.70GHz and 32 GB of memory. We used gcc version 11.4.0 as the compiler. All experiments were executed inside a Docker container specifically built for this purpose.

To evaluate the effectiveness of the proposed method (Algorithm 3), we compared it with the naive baseline approach (Algorithm 2). In the baseline algorithm, label computation becomes a bottleneck due to the need for k sorting operations, which makes the method impractical for large values of k. To address this issue, a decision-tree-based data structure can be used to classify encrypted feature vectors and assign labels without sorting [36,37]. Assuming this data structure, the computational complexity of the baseline algorithm becomes $O(k{n}^{2}logn)$, and then, the total complexity of Algorithm 2 can be considered as $O(min\{k^{2}n{log}^{3}n,k{n}^{2}logn\})$. In contrast, the improved method (Algorithm 3) has a complexity of $O\left(kn{log}^{3}n\right)$. We experimentally compared the execution times of these algorithms while varying k and n.

The experimental results are illustrated in Figure 4. Figure 4a compares the computation time of the proposed algorithm, which has a theoretical complexity of $O\left(kn{log}^{3}n\right)$, with a naive implementation that uses decision-tree-based secure computation [36,37,38] and has a complexity of $O(k{n}^{2}logn)$. In this experiment, we measured the computation time of both algorithms as the number of records n increases. The results clearly show that the proposed method reduces computation time even for relatively small values of n, and this advantage becomes more pronounced as n increases.

On the other hand, Figure 4b shows the impact of the parameters $(k,n)$ on the computation time of the proposed algorithm. In this experiment, we compared the execution time for $k\in \{4,8,16,32\}$ and $n\in \{8,16,32\}$. Although the theoretical time complexity of the proposed method is $O\left(kn{log}^{3}n\right)$, the results empirically confirm that the computation time increases linearly with k. Therefore, it is confirmed that the proposed privacy-preserving computation algorithm behaves as expected by design.

6. Discussion

In this study, we proposed a feature selection algorithm based on FHE. While various plaintext feature selection methods have been studied, consistency-based feature selection has been shown to offer both scalability and effectiveness. Therefore, the development of privacy-preserving computation protocols for consistency-based feature selection is a critical research challenge.

Although existing FHE-based two-party algorithms have addressed this goal to some extent, the protocol proposed in this work is the first to realize fully outsourced computation for consistency-based feature selection. We demonstrated that our proposed privacy-preserving algorithm is superior both theoretically and experimentally compared to a naive approach that uses decision-tree-based data structures under secure computation.

On the other hand, the proposed algorithm has several directions for future improvement. First, this work assumes that the input data $(D,F,C)$ is binary. Removing this assumption and extending the algorithm to support multi-valued or symbolic attribute domains is one of the most important future enhancements. Since TFHE library [25] used in this study, is optimized for bitwise and integer operations, alternative libraries or methods capable of handling real-valued data more efficiently should be considered. In addition, while this study assumes a point-to-point computation model between data owner and analyst, extending the model to support one-to-many computations is also important for broader applicability. Such an extension could be realized by leveraging multi-key FHE [39,40,41,42].

By addressing these aspects, the proposed algorithm can be extended and adapted to enable privacy-preserving feature selection across a wide range of application domains such as FHE-based machine learning [43,44,45,46,47] and federated machine learning [48,49,50,51].