{"id":"ffe0ff28-9b41-491f-b1f9-ceacd0983528","arxiv_id":"2412.07954","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MOFHEI converts pretrained models into homomorphically encryption-friendly versions and prunes them in blocks aligned with batch packing, cutting HE operations by up to 93%.","lead":"MOFHEI is a framework that rewrites a trained neural network into a version that runs efficiently under homomorphic encryption, then prunes its weights in blocks that match the encryption's packing scheme. The result is up to 9.63x faster encrypted inference and 4 times less memory on a LeNet model, at a reported 2% accuracy cost.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline accuracy claim rests on plaintext metrics: CKKS approximation error is never measured, so 'negligible accuracy loss' is not established for real encrypted inference.","rationale":"I read the paper as an engineering contribution whose value depends on three things: the HE-friendly conversion preserves accuracy, the block-pruning method actually removes HE operations, and the pruned model can be evaluated under CKKS without further accuracy degradation. The first two are supported by the plaintext experiments and the measured PI latency/memory reductions. The third is the weakest link: CKKS is approximate by design, the polynomial activation degrees are not reported, and no decrypted-output accuracy is provided. This is exactly the reader's weakest assumption, and it is genuinely load-bearing because the headline claim promises 'negligible accuracy loss' for encrypted inference, not for plaintext evaluation. The concern is addressable: running the existing PI implementation on a standard encrypted test set and reporting decrypted accuracy would either confirm or refute the claim. I do not see an internal inconsistency that would force rejection; the method is plausible and the reported latency/memory reductions are concrete. Therefore the appropriate verdict remains CONDITIONAL, which matches the reader's verdict, so no change is needed.","tokens_in":18679,"tokens_out":14463,"duration_ms":163064,"concrete_test":"Use the released MOFHEI code to run PI over the full MNIST test set with the LeNet model at 90% layer sparsity and the Table I parameters (PMD=32768, CM=860), encrypting inputs with CKKS/SEAL. Decrypt all outputs, score the predictions, and compare the resulting accuracy to the reported plaintext value of 0.97 in Table III. Also record the maximum per-slot approximation error on a small labeled subset. If the encrypted accuracy is within one point of the plaintext pruned-model accuracy, the concern is resolved; if not, the 'negligible accuracy loss' claim fails for the headline experiment.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that block pruning aligned with batch packing yields large reductions in HE operations, latency, and memory with negligible accuracy loss. Latency and memory reductions are supported by actual PI timing and memory measurements in Table III, but the accuracy side of the claim is not. Section VI reports ACC/MSE values for all models, yet nowhere does the paper describe encrypting test inputs, running the full CKKS PI pipeline, decrypting the outputs, and comparing those decrypted predictions with the plaintext predictions. The ACC/MSE columns appear to be plaintext evaluations of the pruned HE-friendly models. This matters because CKKS is an approximate scheme (Section III-C), and the HE-friendly conversion replaces activations with polynomial approximations of unspecified degree. Rescaling, noise growth, and polynomial evaluation error can shift outputs in ways that do not appear in plaintext evaluation. Without an end-to-end encrypted-accuracy measurement, the phrase 'with negligible accuracy loss' applies only to a plaintext proxy, not to the actual private inference system being proposed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MOFHEI, a framework that converts a pre-trained neural network into a homomorphic-encryption-friendly version (via learnable polynomial activations and average pooling) and then applies iterative block pruning aligned with batch-packing so that entire zeroed packs can be skipped during private inference. The authors evaluate the framework on LeNet variants, an FC network, and autoencoders using the CKKS scheme in SEAL, reporting substantial reductions in HE operation counts, latency, and memory while claiming negligible accuracy loss. The central claim is that block pruning aligned with the packing layout is the key enabler for these efficiency gains.","tokens_in":18819,"tokens_out":8941,"duration_ms":87377,"significance":"If the claims hold, MOFHEI is a practically useful contribution to non-interactive HE-based private inference. The core idea—pruning at the granularity of SIMD packs so that entire ciphertext/plaintext operations can be eliminated—is sound and well motivated by the packing structure of CKKS. The paper provides code, and the reported latency and memory reductions are consistent with the measured pruning ratios. The operation-count reduction logic is plausible for the batch-packing layout, and the comparison with HE-PEx on autoencoders is a useful data point. However, the accuracy side of the central claim is only demonstrated in plaintext; no end-to-end encrypted inference accuracy is reported, which is a load-bearing gap for a system whose whole purpose is encrypted inference.","major_comments":[{"comment":"All accuracy (ACC) and MSE values in Table III are plaintext evaluations of the pruned HE-friendly models; the paper never reports the accuracy or MSE of actual encrypted inference under CKKS. Since CKKS is approximate (Section III-C) and the activations are replaced by polynomial approximations, the decrypted outputs may deviate from the plaintext predictions. The headline claim of 'negligible accuracy loss' therefore holds only for a plaintext proxy, not for the actual PI system. Please add end-to-end encrypted inference results (e.g., accuracy/MSE on a test set after full CKKS evaluation and decryption) or, at minimum, a noise-budget/error analysis demonstrating that the approximation error is small enough to preserve the reported metrics.","section":"Section VI, Table III"},{"comment":"At layer-wise sparsities of 80% and 90%, the CIFAR-10 accuracy drops to 0.56 and 0.40, respectively, from a 0.75 HE-friendly baseline, which is not a 'negligible' loss. The text says accuracy loss is negligible only 'up to 73%' sparsity, but the table shows that even at 50% sparsity (final sparsity 0.73) the accuracy is 0.72, a 0.03 drop. Moreover, the HE-friendly baseline for this model is N/A because the unpruned model is too large to run, so there is no direct baseline for the claimed 'comparable performance'. The claim that pruning enables PI on complex models with comparable performance is therefore not supported at the higher sparsity levels.","section":"Table III, CIFAR-10-MLeNet rows"},{"comment":"The batch size b for batch packing is never specified for any experiment. The number of ciphertexts, the latency, and the memory usage reported in Table III all depend directly on b, because batch packing creates one ciphertext per feature. Without stating b, the results are not reproducible and the comparisons with Hunter and HE-PEx are not on an equal footing. Please report the batch size used for each experiment and, if possible, show how latency and memory scale with b.","section":"Section V, experimental setup"},{"comment":"The statement that 'Pruning one entire column of the weight matrix allows skipping M HE multiplications and M − 1 HE additions' is inconsistent with the standard dot-product computation for a fully-connected layer with M output neurons. Removing one input column eliminates one multiplication and one addition for each output neuron, i.e., M multiplications and M additions, not M−1 additions. Since the operation-count reductions are a central part of the efficiency claims, the paper should clarify exactly how HE operation counts are counted (e.g., whether additions include the accumulation tree) and verify that the reported totals in Table III follow that convention.","section":"Section IV-B, paragraph on FC pruning"}],"minor_comments":[{"comment":"The caption contains a typo: 'clomun-wise' should be 'column-wise'.","section":"Figure 1 caption"},{"comment":"The label 'Perfromance' should be 'Performance'.","section":"Figure 5"},{"comment":"References [2] and [3] are duplicate entries for the same HELayers work (one dated 2011, the other 2023); one should be removed or properly dated.","section":"References [2] and [3]"},{"comment":"The polynomial degree used for activation approximation is never stated; the figures only show 'Square' or 'Hyperbolic Tangent'. Please specify the degree and the exact coefficient-training procedure for each experiment to enable reproducibility.","section":"Section IV-A and Figure 3"},{"comment":"The comparison with Hunter is not apples-to-apples because Hunter uses interactive SMC and a different packing method; the text should state this limitation more explicitly rather than implying a direct efficiency comparison.","section":"Section VI, Hunter comparison"},{"comment":"The title contains an erroneous space: 'H omomorphically' should be 'Homomorphically'.","section":"Title"}],"recommendation":"major_revision","confidential_remarks":"The main concern is the missing end-to-end encrypted accuracy evaluation. The efficiency results are measured and credible, but without an encrypted-accuracy measurement the central 'negligible accuracy loss' claim is not established for the actual PI system. If the authors can add a small encrypted-inference experiment (even on MNIST-LeNet) demonstrating that plaintext and decrypted outputs agree within a small tolerance, the paper would be substantially stronger. The CIFAR-10 accuracy drop at high sparsity and the unspecified batch size also need to be addressed. I recommend major revision rather than rejection because the core idea is sound and the gaps appear fixable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: MOFHEI is a real engineering contribution to HE-based private inference, and the speedup numbers are believable. The one thing that bothers me is that the accuracy side of the headline claim is not actually measured on encrypted data.\n\nThe new piece is the combination of a learning-based activation conversion with iterative block pruning that matches SIMD packing. Pruning whole columns of a fully-connected weight matrix or whole filters after the Conv-Dense transformation lets you skip entire packed operations. That is the right idea, and the paper shows it works across LeNet variants, an FC network, and autoencoders. The latency and memory reductions in Table III are consistent with the reported operation counts, and the comparison with Hunter and HE-PEx is fair. Pruning time in minutes versus Hunter's hours is a practical advantage. Code is provided.\n\nThe soft spots are real but fixable. The accuracy and MSE columns in Table III appear to come from plaintext evaluation of the pruned HE-friendly models. Nowhere does the paper describe encrypting test inputs, running the full CKKS pipeline, decrypting, and comparing predictions. Since CKKS is approximate and the activation polynomials have unspecified degree, the 'negligible accuracy loss' claim applies to a plaintext proxy, not to the actual private inference system. That needs an end-to-end encrypted accuracy measurement. Minor: the CIFAR-10 experiment has no unpruned baseline because the unpruned model was too large to run; the X-Ray conversion loses 9 points (0.84 to 0.75), which is not negligible even if pruning later recovers some of it; and there are no error bars.\n\nThe central operation-count argument holds up. The paper is clearly written and the authors know the related work. It deserves a serious referee. I would ask for the encrypted accuracy experiment and a bit more transparency on polynomial degree and baseline comparisons before accepting. This is for people working on non-interactive HE inference, especially packing-aware pruning. Send it to review.","headline":"Solid HE-pruning engineering with real speedups, but the 'negligible accuracy loss' headline rests on plaintext metrics, not on actual CKKS inference.","tokens_in":19409,"tokens_out":2580,"would_cite":false,"duration_ms":25873,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Block-aligned pruning cuts encrypted inference cost by up to 9.6x.","keywords":["homomorphic encryption","private inference","block pruning","batch packing","CKKS","model optimization","privacy-preserving machine learning","structured pruning"],"falsifier":"Run the published private inference pipeline with the same CKKS parameters (128-bit security, polynomial modulus degree 32768, coefficient modulus 860 bits) on an encrypted MNIST test set, decrypt the outputs, and compute accuracy; if the encrypted accuracy differs from the plaintext accuracy by more than the reported accuracy drop at 90% layer-wise sparsity, the central accuracy claim fails.","tokens_in":18453,"feed_emoji":"🔐","tokens_out":5098,"duration_ms":48392,"temperature":0.7,"pith_summary":"MOFHEI claims that neural network pruning becomes dramatically more effective for homomorphic encryption when the pruning blocks match the encryption's packing layout, because an encrypted operation can only be skipped when an entire packed operand is all zeros. The framework first converts a pretrained model into an HE-friendly version by replacing activations with learnable polynomials, converting max pooling to average pooling, and fine-tuning. It then performs iterative block pruning with configurable block shapes aligned to batch packing, zeroing whole columns of fully-connected weight matrices or whole filters of convolutions. On LeNet over MNIST the method reaches 98% layer-wise sparsity, removes up to 93% of HE operations, and cuts latency and memory by factors of 9.63 and 4.04 with negligible accuracy loss. The paper reports accuracy from plaintext evaluation of pruned models, so the encrypted-inference accuracy is an assumption rather than a measured result.","feed_headline":"Block-aligned pruning cuts encrypted inference cost by up to 9.6x","feed_subtitle":"MOFHEI prunes weights in the same blocks the encryption packs, dropping up to 93% of HE operations with minor accuracy loss.","key_machinery":"The central mechanism is iterative block pruning with configurable block shapes, applied in alignment with batch packing, a SIMD layout that places the same feature of many input instances into one ciphertext. A binary block mask partitions each weight matrix into blocks of a chosen shape; each pruning step sorts blocks by mean absolute weight, zeros the smallest blocks to reach a scheduled sparsity, and excludes masked blocks from backpropagation, followed by fine-tuning. For fully-connected layers the block shape is a whole column, and for convolutional layers the Conv-Dense transformation reshapes filters into columns so that pruning columns equals pruning filters. This creates all-zero plaintext packs, which are the only operands that can be skipped in CKKS SIMD computation.","core_discovery":"The central claim is that aligning structured pruning with the HE data-packing layout turns model sparsity into direct HE operation savings. Under batch packing, each weight matrix column is encoded as one plaintext; pruning an entire column (or an entire filter after converting convolutions to equivalent fully-connected layers) makes that plaintext all-zero, so the corresponding ciphertext-plaintext multiplication and its associated additions can be skipped. The iterative over-training pruning schedule, building on magnitude-based block masking with a boundary constraint, recovers accuracy while reaching high sparsity. The paper demonstrates reductions of up to 93.4% in HE operations, a 9.63x latency reduction, and a 4.04x memory reduction on MNIST-LeNet, with comparable gains on X-Ray-LeNet, CIFAR-10-MLeNet, EGSS-FcNet, and MNIST autoencoders.","pith_inferences":["If block-aligned pruning is combined with quantization or tile packing, the same all-zero-pack skipping mechanism should yield further HE operation reductions, since the savings depend on the packing layout rather than the specific model architecture.","The accuracy-preservation claim would be stronger and more directly applicable if the paper reported end-to-end encrypted inference accuracy under CKKS; the current plaintext-only evaluation leaves noise growth and rescaling error unmeasured.","The pruning time advantage (minutes versus over an hour in prior structured-pruning work) suggests the over-training schedule could scale to larger models, but the memory ceiling for HE inference may still bind before sparsity gains appear."],"forward_implications":["Non-interactive private inference on small to medium networks becomes feasible on commodity servers; for example, MNIST-LeNet inference drops from 1272 seconds to 132 seconds at the highest reported sparsity.","Models that are too large to run unpruned under HE, such as the CIFAR-10 modified LeNet whose first convolutional layer alone would require over 600 GB of memory, become computable after pruning.","The pruning method generalizes to other packing schemes by choosing block shapes that match the encoding, so the same framework can be adapted beyond batch packing.","The framework removes the need for post-pruning permutation and expansion steps and for client-side interaction required by some prior structured-pruning schemes."],"supporting_citations":[{"why":"Introduces batch packing and the HE-friendly conversion template (square activations, scaled average pooling) that MOFHEI builds on.","marker":"[20]"},{"why":"Prior packing-aware structured pruning work that MOFHEI compares against and improves upon in HE operation reduction and pruning time.","marker":"[15]"},{"why":"Prior pruning with permutation and expansion; supplies the autoencoder baselines and the approach whose post-pruning transformations MOFHEI avoids.","marker":"[4]"},{"why":"Provides the iterative magnitude-based pruning schedule with binary masks that MOFHEI extends with configurable block shapes.","marker":"[56]"},{"why":"Defines the CKKS approximate homomorphic encryption scheme used for private inference in the experiments.","marker":"[17]"},{"why":"Supplies the magnitude-based pruning primitives used to implement the iterative block pruning method.","marker":"[43]"},{"why":"Provides the CKKS encryption primitives used for the private inference implementation.","marker":"[48]"}],"fun_headline_variants":["Block-aligned pruning makes encrypted inference 9.6x faster","MOFHEI: 93% fewer HE ops via block-wise pruning","Encrypted AI inference speedup: 9.6x with block pruning","Up to 98% sparsity yields 9.6x faster HE inference","Aligning pruning with packing: 4x less memory for PI"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"All accuracy and mean-squared-error numbers come from running the pruned models on ordinary unencrypted data; the paper never checks whether actual encrypted inference under CKKS changes the outputs.","fun_headline_variants_meta":{"raw":{"variants":["Block-aligned pruning makes encrypted inference 9.6x faster","MOFHEI: 93% fewer HE ops via block-wise pruning","Encrypted AI inference speedup: 9.6x with block pruning","Up to 98% sparsity yields 9.6x faster HE inference","Aligning pruning with packing: 4x less memory for PI"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000243,"raw_usage":{"total_tokens":1552,"prompt_tokens":991,"completion_tokens":561,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":463}},"tokens_in":607,"tokens_out":561,"duration_ms":5793,"temperature":1.0,"reasoning_tokens":463,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:21:50.922405+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the published private inference pipeline with the same CKKS parameters (128-bit security, polynomial modulus degree 32768, coefficient modulus 860 bits) on an encrypted MNIST test set, decrypt the outputs, and compute accuracy; if the encrypted accuracy differs from the plaintext accuracy by more than the reported accuracy drop at 90% layer-wise sparsity, the central accuracy claim fails.","supporting_citations":[{"cited_title":"Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,","cited_arxiv_id":null,"evidence_quote":"Introduces batch packing and the HE-friendly conversion template (square activations, scaled average pooling) that MOFHEI builds on."},{"cited_title":"Hunter: He-friendly structured pruning for efficient privacy-preserving deep learning,","cited_arxiv_id":null,"evidence_quote":"Prior packing-aware structured pruning work that MOFHEI compares against and improves upon in HE operation reduction and pruning time."},{"cited_title":"Efficient Pruning for Machine Learning Under Homomorphic Encryption","cited_arxiv_id":"2207.03384","evidence_quote":"Prior pruning with permutation and expansion; supplies the autoencoder baselines and the approach whose post-pruning transformations MOFHEI avoids."},{"cited_title":"Homomorphic encryption for arithmetic of approximate numbers,","cited_arxiv_id":null,"evidence_quote":"Defines the CKKS approximate homomorphic encryption scheme used for private inference in the experiments."},{"cited_title":"Prune low magnitude,","cited_arxiv_id":null,"evidence_quote":"Supplies the magnitude-based pruning primitives used to implement the iterative block pruning method."},{"cited_title":"Microsoft SEAL (release 3.7),","cited_arxiv_id":null,"evidence_quote":"Provides the CKKS encryption primitives used for the private inference implementation."}],"review_version":1}