Pith. sign in

REVIEW 4 major objections 6 minor 56 references

MOFHEI: Model Optimizing Framework for Fast and Efficient Homomorphically Encrypted Neural Network Inference

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Block-aligned pruning cuts encrypted inference cost by up to 9.6x.

desk verdict Solid HE-pruning engineering with real speedups, but the 'negligible accuracy loss' headline rests on plaintext metrics, not on actual CKKS inference. read the letter →

arxiv 2412.07954 v1 pith:L7ICADXN submitted 2024-12-10 cs.CR

Parsa Ghazvinian , Robert Podschwadt , Prajwal Panzade , Mohammad H. Rafiei , Daniel Takabi This is my paper · ORCID
classification cs.CR
keywords homomorphicencryptionprivateinferenceblockpruningbatchpackingCKKSmodeloptimizationprivacy-preservingmachinelearningstructured
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MOFHEI claims that neural network pruning becomes dramatically more effective for homomorphic encryption when the pruning blocks match the encryption's packing layout, because an encrypted operation can only be skipped when an entire packed operand is all zeros. The framework first converts a pretrained model into an HE-friendly version by replacing activations with learnable polynomials, converting max pooling to average pooling, and fine-tuning. It then performs iterative block pruning with configurable block shapes aligned to batch packing, zeroing whole columns of fully-connected weight matrices or whole filters of convolutions. On LeNet over MNIST the method reaches 98% layer-wise sparsity, removes up to 93% of HE operations, and cuts latency and memory by factors of 9.63 and 4.04 with negligible accuracy loss. The paper reports accuracy from plaintext evaluation of pruned models, so the encrypted-inference accuracy is an assumption rather than a measured result.

What carries the argument

The central mechanism is iterative block pruning with configurable block shapes, applied in alignment with batch packing, a SIMD layout that places the same feature of many input instances into one ciphertext. A binary block mask partitions each weight matrix into blocks of a chosen shape; each pruning step sorts blocks by mean absolute weight, zeros the smallest blocks to reach a scheduled sparsity, and excludes masked blocks from backpropagation, followed by fine-tuning. For fully-connected layers the block shape is a whole column, and for convolutional layers the Conv-Dense transformation reshapes filters into columns so that pruning columns equals pruning filters. This creates all-zero plaintext packs, which are the only operands that can be skipped in CKKS SIMD computation.

What would settle it

Run the published private inference pipeline with the same CKKS parameters (128-bit security, polynomial modulus degree 32768, coefficient modulus 860 bits) on an encrypted MNIST test set, decrypt the outputs, and compute accuracy; if the encrypted accuracy differs from the plaintext accuracy by more than the reported accuracy drop at 90% layer-wise sparsity, the central accuracy claim fails.

Watch

Extended reading notes

Core claim

The central claim is that aligning structured pruning with the HE data-packing layout turns model sparsity into direct HE operation savings. Under batch packing, each weight matrix column is encoded as one plaintext; pruning an entire column (or an entire filter after converting convolutions to equivalent fully-connected layers) makes that plaintext all-zero, so the corresponding ciphertext-plaintext multiplication and its associated additions can be skipped. The iterative over-training pruning schedule, building on magnitude-based block masking with a boundary constraint, recovers accuracy while reaching high sparsity. The paper demonstrates reductions of up to 93.4% in HE operations, a 9.63x latency reduction, and a 4.04x memory reduction on MNIST-LeNet, with comparable gains on X-Ray-LeNet, CIFAR-10-MLeNet, EGSS-FcNet, and MNIST autoencoders.

Load-bearing premise

All accuracy and mean-squared-error numbers come from running the pruned models on ordinary unencrypted data; the paper never checks whether actual encrypted inference under CKKS changes the outputs.

Editorial extensions

If this is right

  • Non-interactive private inference on small to medium networks becomes feasible on commodity servers; for example, MNIST-LeNet inference drops from 1272 seconds to 132 seconds at the highest reported sparsity.
  • Models that are too large to run unpruned under HE, such as the CIFAR-10 modified LeNet whose first convolutional layer alone would require over 600 GB of memory, become computable after pruning.
  • The pruning method generalizes to other packing schemes by choosing block shapes that match the encoding, so the same framework can be adapted beyond batch packing.
  • The framework removes the need for post-pruning permutation and expansion steps and for client-side interaction required by some prior structured-pruning schemes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If block-aligned pruning is combined with quantization or tile packing, the same all-zero-pack skipping mechanism should yield further HE operation reductions, since the savings depend on the packing layout rather than the specific model architecture.
  • The accuracy-preservation claim would be stronger and more directly applicable if the paper reported end-to-end encrypted inference accuracy under CKKS; the current plaintext-only evaluation leaves noise growth and rescaling error unmeasured.
  • The pruning time advantage (minutes versus over an hour in prior structured-pruning work) suggests the over-training schedule could scale to larger models, but the memory ceiling for HE inference may still bind before sparsity gains appear.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes MOFHEI, a framework that converts a pre-trained neural network into a homomorphic-encryption-friendly version (via learnable polynomial activations and average pooling) and then applies iterative block pruning aligned with batch-packing so that entire zeroed packs can be skipped during private inference. The authors evaluate the framework on LeNet variants, an FC network, and autoencoders using the CKKS scheme in SEAL, reporting substantial reductions in HE operation counts, latency, and memory while claiming negligible accuracy loss. The central claim is that block pruning aligned with the packing layout is the key enabler for these efficiency gains.

Significance. If the claims hold, MOFHEI is a practically useful contribution to non-interactive HE-based private inference. The core idea—pruning at the granularity of SIMD packs so that entire ciphertext/plaintext operations can be eliminated—is sound and well motivated by the packing structure of CKKS. The paper provides code, and the reported latency and memory reductions are consistent with the measured pruning ratios. The operation-count reduction logic is plausible for the batch-packing layout, and the comparison with HE-PEx on autoencoders is a useful data point. However, the accuracy side of the central claim is only demonstrated in plaintext; no end-to-end encrypted inference accuracy is reported, which is a load-bearing gap for a system whose whole purpose is encrypted inference.

major comments (4)
  1. [Section VI, Table III] All accuracy (ACC) and MSE values in Table III are plaintext evaluations of the pruned HE-friendly models; the paper never reports the accuracy or MSE of actual encrypted inference under CKKS. Since CKKS is approximate (Section III-C) and the activations are replaced by polynomial approximations, the decrypted outputs may deviate from the plaintext predictions. The headline claim of 'negligible accuracy loss' therefore holds only for a plaintext proxy, not for the actual PI system. Please add end-to-end encrypted inference results (e.g., accuracy/MSE on a test set after full CKKS evaluation and decryption) or, at minimum, a noise-budget/error analysis demonstrating that the approximation error is small enough to preserve the reported metrics.
  2. [Table III, CIFAR-10-MLeNet rows] At layer-wise sparsities of 80% and 90%, the CIFAR-10 accuracy drops to 0.56 and 0.40, respectively, from a 0.75 HE-friendly baseline, which is not a 'negligible' loss. The text says accuracy loss is negligible only 'up to 73%' sparsity, but the table shows that even at 50% sparsity (final sparsity 0.73) the accuracy is 0.72, a 0.03 drop. Moreover, the HE-friendly baseline for this model is N/A because the unpruned model is too large to run, so there is no direct baseline for the claimed 'comparable performance'. The claim that pruning enables PI on complex models with comparable performance is therefore not supported at the higher sparsity levels.
  3. [Section V, experimental setup] The batch size b for batch packing is never specified for any experiment. The number of ciphertexts, the latency, and the memory usage reported in Table III all depend directly on b, because batch packing creates one ciphertext per feature. Without stating b, the results are not reproducible and the comparisons with Hunter and HE-PEx are not on an equal footing. Please report the batch size used for each experiment and, if possible, show how latency and memory scale with b.
  4. [Section IV-B, paragraph on FC pruning] The statement that 'Pruning one entire column of the weight matrix allows skipping M HE multiplications and M − 1 HE additions' is inconsistent with the standard dot-product computation for a fully-connected layer with M output neurons. Removing one input column eliminates one multiplication and one addition for each output neuron, i.e., M multiplications and M additions, not M−1 additions. Since the operation-count reductions are a central part of the efficiency claims, the paper should clarify exactly how HE operation counts are counted (e.g., whether additions include the accumulation tree) and verify that the reported totals in Table III follow that convention.
minor comments (6)
  1. [Figure 1 caption] The caption contains a typo: 'clomun-wise' should be 'column-wise'.
  2. [Figure 5] The label 'Perfromance' should be 'Performance'.
  3. [References [2] and [3]] References [2] and [3] are duplicate entries for the same HELayers work (one dated 2011, the other 2023); one should be removed or properly dated.
  4. [Section IV-A and Figure 3] The polynomial degree used for activation approximation is never stated; the figures only show 'Square' or 'Hyperbolic Tangent'. Please specify the degree and the exact coefficient-training procedure for each experiment to enable reproducibility.
  5. [Section VI, Hunter comparison] The comparison with Hunter is not apples-to-apples because Hunter uses interactive SMC and a different packing method; the text should state this limitation more explicitly rather than implying a direct efficiency comparison.
  6. [Title] The title contains an erroneous space: 'H omomorphically' should be 'Homomorphically'.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: MOFHEI's latency, memory, and HE-operation reductions are measured benchmark outputs, not fitted predictions; the only self-citation is minor and non-load-bearing.

full rationale

The central efficiency claims are empirical measurements, not derivations that reduce to the method's inputs by construction. Table III reports measured PI latency, memory use, and HE-operation counts for the HE-friendly and iteratively block-pruned models, with the masks generated by magnitude-based iterative pruning (Algorithm 1) and the accuracy/MSE values measured after fine-tuning; no reported acceleration metric is defined in terms of the polynomial coefficients or pruning masks, and no fitted parameter is renamed as a prediction. The only self-citation is [44] in Section II, which describes a dynamic loading/caching memory mechanism from the authors' prior work; it is cited as related work and is not used to justify MOFHEI's design, so it is not load-bearing. Section III-C explicitly notes that CKKS is approximate and that plaintext and encrypted results differ, and Section VI reports ACC/MSE values without showing end-to-end encrypted-accuracy measurements; this is an evidentiary limitation affecting the accuracy claim, but it is an empirical gap rather than circular reasoning, because the latency, memory, and operation reductions are measured independently of that plaintext proxy. No equation equates an output with an input by definition, no uniqueness theorem from the authors' prior work is invoked, and no known result is merely renamed. Accordingly, the efficiency claim is self-contained apart from one minor self-citation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central results rest on the CKKS implementation, the standard batch-packing layout, and the empirical claim that fine-tuning preserves accuracy after conversion and pruning. The polynomial coefficients and pruning schedules are fitted to data, but they are not used to derive the latency/memory reductions; those are measured. The Conv-Dense transformation is a standard reshaping identity.

free parameters (3)
  • Activation polynomial coefficients (per layer) = learned (not reported as numbers)
    The trainable polynomial coefficients that replace ReLU/tanh are fitted to the training data during the HE-friendly conversion (Section IV-A). The accuracy of the converted model depends on these fitted values.
  • Polynomial degree for activation approximation = not reported
    Central to the conversion but unspecified; treated as a free design choice in Section IV-A.
  • Pruning schedule hyperparameters = s_i=0, s_f in {50,55,...,95}%, t0, Δt, pruning epochs (20-50), learning rates (1e-3, 1e-4)
    Chosen by hand; the reported sparsity-accuracy trade-offs depend on these choices (Section V, Table I).
assumptions (4)
  • domain assumption CKKS scheme (SEAL) supports the operations and packing layout used, with 128-bit security
    The entire PI implementation relies on the CKKS implementation's correctness and security, Section III-C and V.
  • domain assumption An all-zero plaintext pack allows the corresponding HE multiplication to be skipped in the latency model
    Assumed in Section I and IV-B; if skipping were not possible, the latency reduction would not materialize.
  • standard math The im2col-based Conv-Dense transformation preserves the convolution semantics exactly
    Reshaping patches and filters into matrices is a standard identity, Section IV-B.
  • domain assumption Fine-tuning after conversion and pruning recovers accuracy on the test distribution
    This is the empirical premise behind 'negligible accuracy loss', Section IV and VI.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MOFHEI: Model Optimizing Framework for Fast and Efficient Homomorphically Encrypted Neural Network Inference." pith.science (2026). https://pith.science/paper/L7ICADXN

@misc{pith2026241207954,
  author       = {Pith},
  title        = {Pith review of: MOFHEI: Model Optimizing Framework for Fast and Efficient Homomorphically Encrypted Neural Network Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L7ICADXN}},
  note         = {Machine review of arXiv:2412.07954}
}
read the original abstract

Due to the extensive application of machine learning (ML) in a wide range of fields and the necessity of data privacy, privacy-preserving machine learning (PPML) solutions have recently gained significant traction. One group of approaches relies on Homomorphic Encryption (HE), which enables us to perform ML tasks over encrypted data. However, even with state-of-the-art HE schemes, HE operations are still significantly slower compared to their plaintext counterparts and require a considerable amount of memory. Therefore, we propose MOFHEI, a framework that optimizes the model to make HE-based neural network inference, referred to as private inference (PI), fast and efficient. First, our proposed learning-based method automatically transforms a pre-trained ML model into its compatible version with HE operations, called the HE-friendly version. Then, our iterative block pruning method prunes the model's parameters in configurable block shapes in alignment with the data packing method. This allows us to drop a significant number of costly HE operations, thereby reducing the latency and memory consumption while maintaining the model's performance. We evaluate our framework through extensive experiments on different models using various datasets. Our method achieves up to 98% pruning ratio on LeNet, eliminating up to 93% of the required HE operations for performing PI, reducing latency and the required memory by factors of 9.63 and 4.04, respectively, with negligible accuracy loss.

Figures

Figures reproduced from arXiv: 2412.07954 by the authors.

Figure 1
Figure 1. An example of HE-friendly fully-connected layer’s pruning process with clomun-wise pruning blocks [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Example of the proposed Conv-Dense operation [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Regression/Autoencoder (AE) model architectures of [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (2 more)
Figure 3
Figure 3. Figure 3: Classification model architectures; the values inside the [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 5
Figure 5. Figure 5: Various performance over layer-wise sparsity. For performance, we use the original model as the baseline. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 40 canonical work pages

  1. [1]

    E. G. D. P. R. 2016. (2016) Regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation). [Online]. Available: http://data.europa.eu/eli/...

    work page 2016

  2. [2]

    Helayers: A tile tensors framework for large neural networks on encrypted data,

    E. Aharoni, A. Adir, M. Baruch, N. Drucker, G. Ezov, A. Farkash, L. Greenberg, R. Masalha, G. Moshkowich, D. Murik et al., “Helayers: A tile tensors framework for large neural networks on encrypted data,” 2011

    work page 2011

  3. [3]

    Helayers: A tile tensors framework for large neural networks on encrypted data,

    ——, “Helayers: A tile tensors framework for large neural networks on encrypted data,” Proceedings on privacy enhancing technologies , 2023

    work page 2023

  4. [4]

    Efficient Pruning for Machine Learning Under Homomorphic Encryption

    E. Aharoni, M. Baruch, P. Bose, A. Buyuktosunoglu, N. Drucker, S. Pal, T. Pelleg, K. Sarpatwar, H. Shaul, O. Soceanu et al. , “He- pex: Efficient machine learning under homomorphic encryption using pruning, permutation and expansion,” arXiv preprint arXiv:2207.03384, 2022

    work page Pith review arXiv 2022

  5. [5]

    Complex encoded tile tensors: Accelerating encrypted analytics,

    E. Aharoni, N. Drucker, G. Ezov, H. Shaul, and O. Soceanu, “Complex encoded tile tensors: Accelerating encrypted analytics,” IEEE Security & Privacy, vol. 20, no. 5, pp. 35–43, 2022

    work page 2022

  6. [6]

    An efficient lattice-based signature scheme with provably secure instantia- tion,

    S. Akleylek, N. Bindel, J. Buchmann, J. Kr ¨amer, and G. A. Marson, “An efficient lattice-based signature scheme with provably secure instantia- tion,” in International Conference on Cryptology in Africa . Springer, 2016, pp. 44–60

    work page 2016

  7. [7]

    A Guide to Fully Homomorphic Encryption,

    F. Armknecht, C. Boyd, C. Carr, A. Jaschke, and C. A. Reuter, “A Guide to Fully Homomorphic Encryption,” Cryptology ePrint Archive , p. 35, 2015

    work page 2015

  8. [8]

    Towards concise models of grid stability,

    V . Arzamasov, K. B ¨ohm, and P. Jochem, “Towards concise models of grid stability,” in 2018 IEEE International Conference on Com- munications, Control, and Computing Technologies for Smart Grids (SmartGridComm). IEEE, 2018, pp. 1–6

    work page 2018

Show all 56 references
  1. [9]

    Foundations of garbled circuits,

    M. Bellare, V . T. Hoang, and P. Rogaway, “Foundations of garbled circuits,” in Proceedings of the 2012 ACM conference on Computer and Communications security, 2012, pp. 784–796

    2012

  2. [10]

    What is the state of neural network pruning?

    D. Blalock, J. J. Gonzalez Ortiz, J. Frankle, and J. Guttag, “What is the state of neural network pruning?” Proceedings of machine learning and systems, vol. 2, pp. 129–146, 2020

    2020

  3. [11]

    (leveled) fully ho- momorphic encryption without bootstrapping,

    Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “(leveled) fully ho- momorphic encryption without bootstrapping,” ACM Transactions on Computation Theory (TOCT) , vol. 6, no. 3, pp. 1–36, 2014

    2014

  4. [12]

    (Leveled) fully homomorphic encryption without bootstrapping,

    ——, “(Leveled) fully homomorphic encryption without bootstrapping,” ACM Transactions on Computation Theory (TOCT) , vol. 6, no. 3, pp. 1–36, 2014, publisher: ACM New York, NY , USA

    2014

  5. [13]

    All-or-nothing disclosure of secrets,

    G. Brassard, C. Cr ´epeau, and J.-M. Robert, “All-or-nothing disclosure of secrets,” in Advances in Cryptology—CRYPTO’86: Proceedings 6 . Springer, 1987, pp. 234–238

    1987

  6. [14]

    Low latency privacy preserving inference,

    A. Brutzkus, R. Gilad-Bachrach, and O. Elisha, “Low latency privacy preserving inference,” inInternational Conference on Machine Learning. PMLR, 2019, pp. 812–821

    2019

  7. [15]

    Hunter: He-friendly structured pruning for efficient privacy-preserving deep learning,

    Y . Cai, Q. Zhang, R. Ning, C. Xin, and H. Wu, “Hunter: He-friendly structured pruning for efficient privacy-preserving deep learning,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, 2022, pp. 931–945

    2022

  8. [16]

    A full RNS variant of approximate homomorphic encryption,

    J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full RNS variant of approximate homomorphic encryption,” in International Conference on Selected Areas in Cryptography . Springer, 2018, pp. 347–368

    2018

  9. [17]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” in International Conference on the Theory and Application of Cryptology and Information Security . Springer, 2017, pp. 409–437

    2017

  10. [18]

    Tfhe: fast fully homomorphic encryption over the torus,

    I. Chillotti, N. Gama, M. Georgieva, and M. Izabach `ene, “Tfhe: fast fully homomorphic encryption over the torus,” Journal of Cryptology , vol. 33, no. 1, pp. 34–91, 2020

    2020

  11. [19]

    Faster cryptonets: Leveraging sparsity for real-world encrypted inference,

    E. Chou, J. Beal, D. Levy, S. Yeung, A. Haque, and L. Fei-Fei, “Faster cryptonets: Leveraging sparsity for real-world encrypted inference,” arXiv preprint arXiv:1811.09953 , 2018

    2018 arXiv

  12. [20]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,

    N. Dowlin, R. Gilad-Bachrach, K. Laine, K. Lauter, and M. Naehrig, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” in International Conference on Machine Learning. PMLR, 2016, pp. 201–210

    2016

  13. [21]

    Somewhat Practical Fully Homomorphic Encryption

    J. Fan and F. Vercauteren, “Somewhat Practical Fully Homomorphic Encryption.” IACR Cryptol. ePrint Arch. , vol. 2012, p. 144, 2012, publisher: Citeseer

    2012

  14. [22]

    The lottery ticket hypothesis: Finding sparse, trainable neural networks,

    J. Frankle and M. Carbin, “The lottery ticket hypothesis: Finding sparse, trainable neural networks,” arXiv preprint arXiv:1803.03635 , 2018

    2018 arXiv

  15. [23]

    Fully homomorphic encryption using ideal lattices,

    C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the 41st annual ACM Symposium on theory of computing - STOC ’09. Bethesda, MD, USA: ACM Press, 2009, p. 169. [Online]. Available: http://portal.acm.org/citation.cfm?doid=1536414.1536440

    2009

  16. [24]

    Cryptonas: Private inference on a relu budget,

    Z. Ghodsi, A. K. Veldanda, B. Reagen, and S. Garg, “Cryptonas: Private inference on a relu budget,” Advances in Neural Information Processing Systems, vol. 33, pp. 16 961–16 971, 2020

    2020

  17. [25]

    Dynamic network surgery for efficient dnns,

    Y . Guo, A. Yao, and Y . Chen, “Dynamic network surgery for efficient dnns,” Advances in neural information processing systems, vol. 29, 2016

    2016

  18. [26]

    Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,

    S. Han, H. Mao, and W. J. Dally, “Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,” arXiv preprint arXiv:1510.00149 , 2015

    2015 arXiv

  19. [27]

    Learning both weights and con- nections for efficient neural network,

    S. Han, J. Pool, J. Tran, and W. Dally, “Learning both weights and con- nections for efficient neural network,” Advances in neural information processing systems, vol. 28, 2015

    2015

  20. [28]

    Cryptodl: Deep neural networks over encrypted data,

    E. Hesamifard, H. Takabi, and M. Ghasemi, “Cryptodl: Deep neural networks over encrypted data,” arXiv preprint arXiv:1711.05189, 2017

    2017 arXiv

  21. [29]

    Cheetah: Lean and fast secure Two-Party deep neural network inference,

    Z. Huang, W. jie Lu, C. Hong, and J. Ding, “Cheetah: Lean and fast secure Two-Party deep neural network inference,” in 31st USENIX Security Symposium (USENIX Security 22) . Boston, MA: USENIX Association, Aug. 2022, pp. 809–826. [Online]. Available: https://www. usenix.org/con...

    2022

  22. [30]

    Quantization and training of neural networks for efficient integer-arithmetic-only inference,

    B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko, “Quantization and training of neural networks for efficient integer-arithmetic-only inference,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 2...

    2018

  23. [31]

    A programmable approach to neural network compression,

    V . Joseph, G. L. Gopalakrishnan, S. Muralidharan, M. Garland, and A. Garg, “A programmable approach to neural network compression,” IEEE Micro, vol. 40, no. 5, pp. 17–25, 2020

    2020

  24. [32]

    {GAZELLE}: A low latency framework for secure neural network inference,

    C. Juvekar, V . Vaikuntanathan, and A. Chandrakasan, “ {GAZELLE}: A low latency framework for secure neural network inference,” in 27th {USENIX} Security Symposium ( {USENIX} Security 18) , 2018, pp. 1651–1669

    2018

  25. [33]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” in Proceedings of the 25th international conference on Machine learning , 2009, pp. 1097–1104

    2009

  26. [34]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  27. [35]

    Mnist handwritten digit database,

    Y . LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” ATT Labs, 2010. [Online]. Available: http://yann.lecun.com/exdb/mnist/

    2010

  28. [36]

    Privacy-preserving machine learning with fully homomorphic encryption for deep neural network,

    J.-W. Lee, H. Kang, Y . Lee, W. Choi, J. Eom, M. Deryabin, E. Lee, J. Lee, D. Yoo, Y .-S. Kim et al., “Privacy-preserving machine learning with fully homomorphic encryption for deep neural network,” IEEE Access, vol. 10, pp. 30 039–30 054, 2022

    2022

  29. [37]

    Muse: Secure inference resilient to malicious clients

    R. Lehmkuhl, P. Mishra, A. Srinivasan, and R. A. Popa, “Muse: Secure inference resilient to malicious clients.” in USENIX Security Symposium, 2021, pp. 2201–2218

    2021

  30. [38]

    Learning efficient convolutional networks through network slimming,

    Z. Liu, J. Li, Z. Shen, G. Huang, S. Yan, and C. Zhang, “Learning efficient convolutional networks through network slimming,” inProceed- ings of the IEEE international conference on computer vision , 2017, pp. 2736–2744

    2017

  31. [39]

    Hemet: a homomorphic-encryption-friendly privacy-preserving mobile neural network architecture,

    Q. Lou and L. Jiang, “Hemet: a homomorphic-encryption-friendly privacy-preserving mobile neural network architecture,” in International conference on machine learning . PMLR, 2021, pp. 7102–7110

    2021

  32. [40]

    Communication-efficient learning of deep networks from de- centralized data,

    H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Ag ¨uera y Arcas, “Communication-efficient learning of deep networks from de- centralized data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS) . PMLR, 2017, pp. 1273–1282

    2017

  33. [41]

    Explor- ing generalization in deep learning,

    B. Neyshabur, S. Bhojanapalli, D. McAllester, and N. Srebro, “Explor- ing generalization in deep learning,” Advances in neural information processing systems, vol. 30, 2017

    2017

  34. [42]

    T. U. D. of Health and H. S. (HHS). (1996) The health insurance portability and accountability act of 1996 (hipaa). [Online]. Available: https://www.cdc.gov/phlp/publications/topic/hipaa.html 11

    1996

  35. [43]

    Prune low magnitude,

    T. M. Optimization, “Prune low magnitude,” https://www.tensorflow.org/ model optimization/api docs/python/tfmot, 2021, accessed on February 16, 2023

    2021

  36. [44]

    Mem- ory efficient privacy-preserving machine learning based on homomor- phic encryption,

    R. Podschwadt, P. Ghazvinian, M. GhasemiGol, and D. Takabi, “Mem- ory efficient privacy-preserving machine learning based on homomor- phic encryption,” in International Conference on Applied Cryptography and Network Security . Springer, 2024, pp. 313–339

    2024

  37. [45]

    Spencnn: orchestrating encoding and sparsity for fast homomorphically encrypted neural network inference,

    R. Ran, X. Luo, W. Wang, T. Liu, G. Quan, X. Xu, C. Ding, and W. Wen, “Spencnn: orchestrating encoding and sparsity for fast homomorphically encrypted neural network inference,” in International Conference on Machine Learning. PMLR, 2023, pp. 28 718–28 728

    2023

  38. [46]

    T. J. Rivlin, Chebyshev polynomials. Courier Dover Publications, 2020

    2020

  39. [47]

    Facenet: A unified embed- ding for face recognition and clustering,

    F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embed- ding for face recognition and clustering,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 815– 823

    2015

  40. [48]

    Microsoft SEAL (release 3.7),

    “Microsoft SEAL (release 3.7),” https://github.com/Microsoft/SEAL, Sep. 2021, microsoft Research, Redmond, W A

    2021

  41. [49]

    How to share a secret. commun. acm,

    A. Shamir, “How to share a secret. commun. acm,” 1979

    1979

  42. [50]

    Fully homomorphic encryption with relatively small key and ciphertext sizes,

    N. P. Smart and F. Vercauteren, “Fully homomorphic encryption with relatively small key and ciphertext sizes,” in International Workshop on Public Key Cryptography. Springer, 2010, pp. 420–443

    2010

  43. [51]

    Fully homomorphic SIMD operations,

    ——, “Fully homomorphic SIMD operations,” Designs, codes and cryptography, vol. 71, no. 1, pp. 57–81, 2014, publisher: Springer

    2014

  44. [52]

    Rafiki: Machine learning as an analytics service system,

    W. Wang, S. Wang, J. Gao, M. Zhang, G. Chen, T. K. Ng, and B. C. Ooi, “Rafiki: Machine learning as an analytics service system,” arXiv preprint arXiv:1804.06087, 2018

    2018 arXiv

  45. [53]

    Chestx- ray8: Hospital-scale chest x-ray database and benchmarks on weakly- supervised classification and localization of common thorax diseases,

    X. Wang, Y . Peng, L. Lu, Z. Lu, M. Bagheri, and R. Summers, “Chestx- ray8: Hospital-scale chest x-ray database and benchmarks on weakly- supervised classification and localization of common thorax diseases,” Proceedings of the IEEE Conference on Computer Vision and Pattern Re...

    2017

  46. [54]

    Differential privacy in deep learning: Privacy and beyond,

    Y . Wang, Q. Wang, L. Zhao, and C. Wang, “Differential privacy in deep learning: Privacy and beyond,” Future Generation Computer Systems , vol. 148, pp. 408–424, 2023

    2023

  47. [55]

    Protocols for secure computations,

    A. C. Yao, “Protocols for secure computations,” in Proceedings of the 23rd Annual Symposium on Foundations of Computer Science (FOCS) . IEEE, 1982, pp. 160–164

    1982

  48. [56]

    To prune, or not to prune: exploring the efficacy of pruning for model compression,

    M. Zhu and S. Gupta, “To prune, or not to prune: exploring the efficacy of pruning for model compression,” arXiv preprint arXiv:1710.01878 , 2017. 12

    2017 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.