{"id":"62f4976e-2001-46a7-9d84-7b8ac8748605","arxiv_id":"2504.15817","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"EFFACT combines a streaming compiler, circuit-level function-unit reuse, and compact NTT and automorphism units to accelerate FHE workloads efficiently at small SRAM size.","lead":"EFFACT is a chip and compiler system for fully homomorphic encryption, which lets cloud servers compute on encrypted data without seeing it. The authors report that it delivers high area and power efficiency gains over prior FHE accelerators while using much less on-chip memory.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline margins rest on an unvalidated linear-scaling extrapolation from a 12.5 MHz/64-lane FPGA prototype to 300 MHz/256-lane FPGA and 1024-lane ASIC configurations; if scaling is sublinear, the 1.22x/1.46x/1.48x claims may vanish.","rationale":"The reader's weakest assumption is the right one. EFFACT's contributions are real and partly independently checkable: complete RTL, Lattigo-based functional verification, a compiler, and a cycle-accurate simulator for scaling experiments. Those give confidence that the architecture works at the tested scale. The central efficiency claims, however, all pass through one extrapolation: the only physical FPGA data comes from a 12.5 MHz, 64-lane implementation, and the paper explicitly scales that to 300 MHz/256 lanes and 500 MHz/1024 lanes. The paper itself discloses the congestion and the bandwidth-throttling FIFO, so the assumption is not hidden; it is simply unverified. For memory-bound bootstrapping, linear throughput scaling with lanes and frequency is exactly the assumption most likely to fail: doubling lanes does not halve runtime when DRAM latency and on-chip SRAM capacity are fixed, and congestion level 7 means the 12.5 MHz prototype may not be representative of the timing-closed design. Because the claimed margins are modest (1.22x, 1.46x, 1.48x), even a 20-30% scaling error could erase them, so the verdict should remain CONDITIONAL rather than ACCEPT. I would not move to REJECT: the authors disclose the extrapolation, provide RTL and functional verification, and the proposed test is a calibration exercise on infrastructure they already describe, not an open-ended re-derivation.","tokens_in":26301,"tokens_out":4414,"duration_ms":40513,"concrete_test":"Calibrate the cycle-accurate simulator used in Section VI.C against the physical 12.5 MHz/64-lane FPGA measurements: configure the simulator with VCU128 HBM bandwidth, 64 lanes, 12.5 MHz, and 7.6 MB SRAM, then compare simulated runtimes for bootstrapping, HELR, and ResNet-20 against the measured wall-clock times on those same workloads. If the simulator matches the prototype within about 10%, rerun it at 300 MHz/256 lanes and 500 MHz/1024 lanes with the corresponding HBM bandwidths (460 GB/s and 1.2 TB/s); if the predicted speedup over the prototype is materially below 24x for the FPGA and below the combined frequency-times-lane product for the ASIC, the linear-scaling assumption fails and the efficiency claims must be recomputed. A stronger check is to place and route the 256-lane design with congestion below about 4 and measure it at 300 MHz on a board with equivalent DRAM bandwidth.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The headline efficiency margins are not measured at the advertised configurations. Section V.C states that the FPGA implementation \"runs only at 12.5 MHz with 64 lanes\" and that the authors \"scale the performance of the 12.5 MHz with 64 lanes version to our target 300 MHz with 256 lanes FPGA-EFFACT and 1024 lanes ASIC-EFFACT.\" Every headline number in Table VII (FPGA bootstrapping 0.566 us, ASIC 0.0548 us; HELR 64.55/8.7 ms) and the efficiency comparisons in Figures 9 and 10 therefore depend on throughput scaling linearly with frequency and lane count. That scaling is not validated end-to-end. The prototype suffers routing congestion level 7, so a 24x frequency increase and 4x or 16x lane increase cannot be assumed to preserve memory, FIFO, NTT-pipeline, and arbiter behavior. Bootstrapping is memory-bound, and the HBM bandwidth was deliberately lowered through an asynchronous FIFO, meaning the 64-lane baseline already runs bandwidth-throttled. If the true scaling is 70-80% of linear for memory-bound kernels, the claimed 1.22x, 1.46x, and 1.48x margins are comparable to the extrapolation error. The cycle-accurate simulator used in Section VI.C is not first calibrated against the 12.5 MHz/64-lane FPGA runtime, so the extrapolation has no measured anchor.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents EFFACT, a full-stack FHE acceleration platform comprising a vector ISA, a compiler backend with static scheduling and streaming optimizations, and RTL implementations targeting both FPGA and ASIC. The authors argue that by rebalancing computing resources, using a 27 MB on-chip SRAM, and introducing streaming memory access plus circuit-level function-unit reuse, a cost-sensitive accelerator can approach the throughput of much larger designs. The experimental sections report an FPGA version running on a VCU128 board and an ASIC version synthesized in 28 nm, with claims that FPGA-EFFACT outperforms state-of-the-art FPGA accelerators by 1.22x geometric mean and that ASIC-EFFACT achieves at least 1.46x performance per area and 1.48x performance per Watt versus prior ASICs.","tokens_in":26588,"tokens_out":6732,"duration_ms":57223,"significance":"If the headline numbers hold, EFFACT would be a substantial step toward practical, cost-effective FHE acceleration: it demonstrates that a 27 MB SRAM, ~2K multipliers, and a 500 MHz clock can deliver bootstrapping and ML workloads at efficiency comparable to much larger and faster designs. The paper's strengths include a complete RTL implementation, functional verification against the Lattigo software library on the FPGA, an actual end-to-end FPGA evaluation, a compiler with automatic scheduling and streaming, and a design-space analysis that goes beyond simple resource scaling. The novelty of the streaming memory access and the NTT-as-MAC reuse scheme is plausible and well motivated by the instruction-mix analysis. However, the central efficiency claims rest on unmeasured extrapolation from the 12.5 MHz/64-lane FPGA prototype to the 300 MHz/256-lane and 500 MHz/1024-lane configurations, which is a load-bearing weakness that must be resolved before the results can be accepted as stated.","major_comments":[{"comment":"The headline performance and efficiency numbers are not measured at the advertised configurations. Section V.C states that the FPGA 'runs only at 12.5 MHz with 64 lanes' and that the authors 'scale the performance of the 12.5 MHz with 64 lanes version to our target 300 MHz with 256 lanes FPGA-EFFACT and 1024 lanes ASIC-EFFACT.' Every decisive figure, including the 0.566 us / 0.0548 us bootstrapping times, the HELR times, and the Figures 9 and 10 efficiency ratios, therefore assumes throughput scales linearly with frequency and lane count. The paper provides no measurement at any intermediate point to validate this assumption. The reported routing congestion level 7, the deliberately lowered HBM bandwidth through an asynchronous FIFO, and the observation that bootstrapping is memory-bound jointly make linear scaling unlikely to hold exactly. Because the claimed margins over SOTA are modest (1.22x, 1.46x, 1.48x), even a 20–30% shortfall from linear scaling could erase them. The authors should either measure the scaled configurations end-to-end or provide a validated performance model anchored to the measured 12.5 MHz runtime, with explicit accounting for memory bandwidth scaling and congestion effects.","section":"§V.C and Table VII"},{"comment":"The cycle-accurate simulator used for the scalability study (EFFACT-54/108/162 and Figure 10) and for the DRAM-transfer analysis (Figure 11) is not calibrated against the 12.5 MHz/64-lane FPGA implementation. The simulator is the only evidence that performance scales as resources are added, and it is also used to attribute the DRAM-transfer reduction to the streaming optimization. Without a reported comparison of simulated versus measured cycles for at least one benchmark on the actual FPGA, the simulator's treatment of memory stalls, NTT pipeline conflicts, and arbiter contention is unverified. I request a calibration plot (simulated vs. measured cycles for bootstrapping or HELR on the 64-lane prototype) and, ideally, a validation of the simulator's scaling predictions against a second measured configuration.","section":"§VI.C"},{"comment":"The 27 MB SRAM capacity is selected from the paper's own design-space exploration ('we choose 27MB as a trade-off') and then used in the evaluated ASIC configuration and in the comparisons against prior designs that use much larger SRAMs. This is a legitimate design methodology, but it makes the efficiency claims sensitive to the chosen operating point on the SRAM-vs-performance curve. The paper should clarify whether 27 MB is a conclusion of the analysis or an input, and report how the headline area- and power-efficiency ratios change if the second turning point (54 MB) is used instead. This would strengthen the robustness of the '1.46x/1.48x' claims against the criticism that the comparison is tuned to a single favorable point.","section":"§IV.D.5 and Figure 4"}],"minor_comments":[{"comment":"The speedup factors for bootstrapping (13.49x, 4743.79x, 0.82x, 0.31x, 0.26x, and 4.93x for GPU, F1, BTS, CraterLake, ARK, and MAD) do not align unambiguously with the entries in Table VII: for example, the GPU column ('Over 100x') lists 0.270 us, which gives 4.93x relative to ASIC-EFFACT's 0.0548 us, not 13.49x. Please verify the ordering and the values.","section":"§VI.B"},{"comment":"The text refers to 'SAHRP-EFFACT'; this appears to be a typo for 'SHARP-EFFACT'.","section":"§VI.B"},{"comment":"The figure caption contains stray '(a)' and '(b)(a)' labels that do not match the intended subfigure structure; please clean up the caption and the panel labels.","section":"Figure 4"},{"comment":"The sentence 'we have excluded code optimization from our evaluation' is unclear, since the sensitivity study in Figure 11 appears to attribute part of the runtime improvement to 'global streaming and memory opt' and 'full EFFACT', both of which involve compiler passes. Please clarify what exactly is excluded and how the 12.9% instruction reduction figure is used.","section":"§IV.B.1"},{"comment":"The TFHE bootstrapping result (0.576 ms) is presented without comparison to prior TFHE accelerators or to the authors' own CKKS results; please provide context or soften the claim of 'excellent acceleration capabilities' for boolean schemes.","section":"§VI.D"},{"comment":"The column labeled 'Over 100x' is used interchangeably as 'GPU [30]' in the text; please unify the notation so the reader can map the table to the references.","section":"Table VII"}],"recommendation":"major_revision","confidential_remarks":"The manuscript fits the HPCA scope and the authors have done a substantial amount of implementation work, including RTL synthesis, FPGA bring-up, and verification against Lattigo. The main risk is the unvalidated linear-scaling extrapolation; if the authors can supply a calibrated performance model or a measured second data point, the paper would be publishable. The comparison with prior ASICs relies on published numbers and standard technology scaling, which is acceptable in this community. I would not recommend rejection on the basis of the internal-tuning loop around the SRAM size, but the scaling evidence is essential."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"EFFACT is a believable, well-engineered FHE accelerator with real evidence behind it, but the headline margins — 1.22x FPGA gmean, 1.46x perf/area, 1.48x perf/Watt — all rest on a linear-scaling extrapolation from a prototype that runs at 12.5 MHz with 64 lanes. If that scaling is modestly sublinear, the margins shrink to noise. The stress-test note and the reader are right about this, and the arithmetic checks out.\n\nWhat is actually new: the full stack is a genuinely new combination. The compiler merges single-consumer loads/stores into streaming instructions so operands flow from DRAM straight to function units; the NTT butterfly units reconfigure as MAC units to chew through the serial normal-MULT/ADD chains; the double-Montgomery BConv merge absorbs the 1/N post-scaling and the Montgomery representation conversions; and the residue-polynomial ISA with an LLVM-style backend covers CKKS, BGV, and BFV. The instruction-mix analysis in Figure 3, used to justify dropping dedicated BConv units and re-allocating compute resources, is data-driven and sensible. The paper also ships real RTL, TSMC 28nm synthesis, a VCU128 FPGA implementation, and functional verification against Lattigo. That is more concrete evidence than most work in this line provides.\n\nThe soft spot is exactly where the reader put it, and it is load-bearing. Section V.C states the FPGA runs at 12.5 MHz with 64 lanes while the 300 MHz/256-lane FPGA and 1024-lane ASIC numbers are scaled from it. The stress-test adds that the cycle-accurate simulator in Section VI.C is never calibrated against the 12.5 MHz prototype, so there is no measured anchor for the extrapolation. I checked; that is accurate. The margins are thin enough that this matters. Table VII shows ASIC-EFFACT's raw bootstrapping is already 0.26–0.31x of CraterLake/ARK, so the efficiency wins come from area and power, not speed. If bootstrapping scales at 70–80% of linear — plausible for a bandwidth-throttled design with routing congestion level 7 — the 1.46x/1.48x claims land near parity. The 27 MB SRAM choice comes from the paper's own design-space exploration; that is mild internal tuning, standard for this literature, and not a real problem.\n\nWho gets value: the FHE accelerator design community and anyone comparing cost-sensitive designs against the MAD/SHARP/CraterLake lineage. The architecture is worth studying even if the stated margins are projections.\n\nRecommendation: send it to serious peer review. The disclosure is honest and the design is interesting. The right referee outcome is to demand validation: calibrate the simulator against the prototype, or report the scaled numbers as projections with sensitivity bounds.","headline":"Credible FHE accelerator with real RTL evidence, but the headline 1.22x/1.46x/1.48x margins all rest on an unvalidated linear-scaling extrapolation from a 12.5 MHz/64-lane prototype.","tokens_in":27195,"tokens_out":6712,"would_cite":true,"duration_ms":54081,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"EFFACT claims that a compact FHE accelerator with 27 MB of SRAM can approach the throughput of resource-unconstrained designs while using a fraction of the area and power.","keywords":["fully homomorphic encryption","FHE accelerator","CKKS","streaming memory access","NTT reuse","FPGA","ASIC","compiler optimization"],"falsifier":"Measure the 256-lane FPGA at its advertised 300 MHz clock after relieving the reported routing congestion; if the observed bootstrapping latency and DRAM bandwidth utilization are not close to the values linearly extrapolated from the 12.5 MHz prototype, the headline speedup and efficiency ratios shrink.","tokens_in":26061,"feed_emoji":"🔐","tokens_out":9198,"duration_ms":80071,"temperature":0.7,"pith_summary":"The paper argues that practical FHE acceleration does not require hundreds of megabytes of on-chip SRAM and tens of thousands of multipliers. EFFACT profiles real workloads and rebalances the compute mix, streams single-use operands directly from DRAM into functional units, and reuses NTT hardware as multiply-accumulate units, so a 27 MB SRAM design can serve CKKS, BGV, and BFV schemes. The authors report that the FPGA version outperforms prior FPGAs by 1.22× geometric mean, and that the ASIC version achieves at least 1.46× performance per chip area and 1.48× performance per watt against prior ASIC accelerators after technology scaling. If the reported extrapolations hold, this points to a much cheaper path to practical fully homomorphic encryption.","feed_headline":"Small FHE accelerator claims near-parity with giant designs","feed_subtitle":"EFFACT streams data around its 27 MB SRAM and reuses NTT units, targeting 1.46× area efficiency gains.","key_machinery":"The central mechanism is a compiler-directed partial streaming dataflow: single-consumer temporaries are merged into the instruction that uses them and are delivered from DRAM through a FIFO directly into the functional unit, bypassing SRAM staging. A second mechanism is circuit-level function-unit reuse, in which the NTT butterfly units are reconfigured to run as multiply-accumulate units, so the same modular multipliers serve both NTT and ordinary MULT/ADD work. A fine-grained NTT unit that shares one modular multiplier and adder across all pipeline stages, and a double-Montgomery representation that merges iNTT post-scaling and base-conversion constants, further reduce area without a proportional throughput loss.","core_discovery":"EFFACT's central claim is that a cost-sensitive FHE accelerator can be both small and fast if its resources match the actual instruction mix of real workloads. Profiling bootstrapping, HELR, and ResNet-20 at the residue-polynomial level shows that NTT instructions are a small fraction of total instructions and that most modular MULT/ADD instructions cannot overlap with NTT. EFFACT therefore removes dedicated base-conversion units, uses a fine-grained NTT unit, reuses the butterfly data paths as MAC units, and adds a compiler pass that streams single-use operands from DRAM straight to functional units. On this basis, the paper reports a 27 MB SRAM ASIC that runs fully-packed bootstrapping in 0.0548 ms amortized time and claims performance-per-area and per-watt gains of at least 1.46× and 1.48× over prior ASIC accelerators, with an FPGA version claiming a 1.22× geometric-mean speedup over prior FPGAs.","pith_inferences":["The paper leaves implicit that its 27 MB SRAM choice is a knee in the design space: the sensitivity study shows EFFACT-54 and EFFACT-108 scale almost linearly on HELR and ResNet, so a memory-heavy or throughput-critical deployment could rationally trade area for another 2–3×.","The instruction-mix analysis is portable: any ring-based FHE accelerator with the same serial NTT/BConv pattern could adopt the fine-grained NTT plus MAC-reuse scheme even if it keeps a larger SRAM.","A direct test the paper does not run is whether the scheme-generic ISA extends efficiently to bit-oriented TFHE workloads; the automorphism unit's shift mode is sketched but not measured, so that is the natural next benchmark."],"forward_implications":["If the reported scaling is sound, 27 MB of SRAM and about two thousand multipliers place bootstrapping throughput within a small multiple of designs with more than 280 MB of SRAM.","The compiler's streaming and scheduling pass reduces bootstrapping DRAM transfers by roughly 40 percent relative to the memory-aware baseline, so the efficiency gains are credited largely to software rather than extra hardware.","Because the ISA and compiler backend are scheme-generic, the same hardware accelerates CKKS, BGV, and BFV workloads, and the paper demonstrates this with a BGV database-lookup workload.","Removing dedicated base-conversion hardware and reusing NTT units as MAC units is claimed to preserve performance while cutting computing area, since the profiled workloads keep most MULT/ADD work serialized behind NTT chains."],"supporting_citations":[{"why":"Defines the memory-aware caching baseline that EFFACT compares its DRAM traffic and efficiency against.","marker":"[2]"},{"why":"FPGA bootstrapping accelerator used as a baseline for FPGA-EFFACT comparisons.","marker":"[4]"},{"why":"Supplies the amortized-time methodology and the GPU bootstrapping performance baseline.","marker":"[30]"},{"why":"Provides the orthogonal word-length and NoC optimizations used in the efficiency comparisons.","marker":"[33]"},{"why":"ASIC accelerator baseline and source of the automorphism-unit design approach.","marker":"[34]"},{"why":"ASIC bootstrapping accelerator used as a baseline in the performance and efficiency comparisons.","marker":"[35]"},{"why":"Reference software implementation used to verify the functional correctness of EFFACT.","marker":"[49]"},{"why":"ASIC accelerator baseline and comparison point for Montgomery multiplication and resource use.","marker":"[62]"},{"why":"Resource-unconstrained ASIC baseline whose computing-area analysis motivates removing base-conversion units.","marker":"[63]"},{"why":"FPGA accelerator used as a baseline for bootstrapping and HELR comparisons.","marker":"[75]"}],"fun_headline_variants":["FHE accelerator trims SRAM with streaming, reuses NTT for 1.46× area efficiency","Streaming memory and shared NTT cut FHE area costs by 1.46×","Reusing NTT hardware and streaming DRAM cuts FHE area needs","Small FHE accelerator: 1.46× better area/watt via smart resource reuse"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported FPGA and ASIC numbers are scaled from a physical prototype that runs at 12.5 MHz with 64 lanes, so the central claim assumes that throughput scales linearly with frequency and lane count all the way to 300 MHz with 256 lanes and to the 1024-lane ASIC.","fun_headline_variants_meta":{"raw":{"variants":["FHE accelerator trims SRAM with streaming, reuses NTT for 1.46× area efficiency","Streaming memory and shared NTT cut FHE area costs by 1.46×","Reusing NTT hardware and streaming DRAM cuts FHE area needs","Small FHE accelerator: 1.46× better area/watt via smart resource reuse"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001036,"raw_usage":{"total_tokens":4425,"prompt_tokens":1076,"completion_tokens":3349,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":692,"completion_tokens_details":{"reasoning_tokens":3254}},"tokens_in":692,"tokens_out":3349,"duration_ms":20509,"temperature":1.0,"reasoning_tokens":3254,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:16:47.855139+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the 256-lane FPGA at its advertised 300 MHz clock after relieving the reported routing congestion; if the observed bootstrapping latency and DRAM bandwidth utilization are not close to the values linearly extrapolated from the 12.5 MHz prototype, the headline speedup and efficiency ratios shrink.","supporting_citations":[{"cited_title":"Mad: Memory-aware design techniques for accelerating fully homomorphic encryption,","cited_arxiv_id":null,"evidence_quote":"Defines the memory-aware caching baseline that EFFACT compares its DRAM traffic and efficiency against."},{"cited_title":"FAB: An FPGA-based Accelerator for Bootstrappable Fully Homomorphic Encryption","cited_arxiv_id":"2207.11872","evidence_quote":"FPGA bootstrapping accelerator used as a baseline for FPGA-EFFACT comparisons."},{"cited_title":"Over 100x faster bootstrapping in fully homomorphic encryption through memory- centric optimization with GPUs,","cited_arxiv_id":null,"evidence_quote":"Supplies the amortized-time methodology and the GPU bootstrapping performance baseline."},{"cited_title":"ARK: Fully Homomorphic Encryption Accelerator with Runtime Data Generation and Inter-Operation Key Reuse","cited_arxiv_id":"2205.00922","evidence_quote":"ASIC accelerator baseline and source of the automorphism-unit design approach."},{"cited_title":"BTS: An Accelerator for Bootstrappable Fully Homomorphic Encryption","cited_arxiv_id":"2112.15479","evidence_quote":"ASIC bootstrapping accelerator used as a baseline in the performance and efficiency comparisons."},{"cited_title":"Overgen: Improving fpga usability through domain-specific overlay generation,","cited_arxiv_id":null,"evidence_quote":"Reference software implementation used to verify the functional correctness of EFFACT."},{"cited_title":"Cheetah: Optimizing and accelerating homomorphic encryption for private inference,","cited_arxiv_id":null,"evidence_quote":"ASIC accelerator baseline and comparison point for Montgomery multiplication and resource use."},{"cited_title":"The learning with errors problem (invited survey),","cited_arxiv_id":null,"evidence_quote":"Resource-unconstrained ASIC baseline whose computing-area analysis motivates removing base-conversion units."},{"cited_title":"Poseidon: Practical homomorphic encryption accelerator,","cited_arxiv_id":null,"evidence_quote":"FPGA accelerator used as a baseline for bootstrapping and HELR comparisons."}],"review_version":1}