Pith. sign in

REVIEW 5 major objections 5 minor 41 references

Efficient Privacy-Preserving Recommendation on Sparse Data using Fully Homomorphic Encryption

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims CSR packing makes FHE-based recommendation practical: encrypt only the M nonzero ratings, pack L per ciphertext, and factor the matrix entirely in encrypted form, cutting communication from n ciphertexts to about M/L and c

desk verdict A plausible but under-specified protocol: the CSR communication bound is correct, but Algorithm 1 cannot run on packed CKKS as written, and the accuracy results are training-set RMSE. read the letter →

arxiv 2509.03024 v1 pith:L4WOMXYB submitted 2025-09-03 cs.CR cs.AIcs.LG

Moontaha Nishat Chowdhury , André Bauer , Minxuan Zhou This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords recommendationsystemsfullyhomomorphicencryptionCKKSCompressedSparseRowmatrixfactorizationdatacommunicationoverheadprivacy-preservingcollaborativefiltering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Recommendation systems learn from large, sparse user-item rating matrices, but encrypting those matrices naively wastes slots on zeros and forces large communication. This paper argues that the Compressed Sparse Row format can be carried into fully homomorphic encryption: only the nonzero ratings are encrypted, several are packed into each ciphertext, and matrix factorization runs entirely on encrypted data at the recommendation server. The measured consequence is communication that scales as M/L ciphertexts instead of n, with one communication round during training, and an RMSE drop of about 87 percent over 20 iterations. The claim matters because earlier private matrix factorization either leaked plaintext to a decryption-capable party, required per-iteration communication, or used circuits so expensive they were impractical.

What carries the argument

The load-bearing object is the CSR triple—data array, column indices, and row pointers—translated into CKKS ciphertexts. CSR packs all nonzero ratings, sorted by user id, into ciphertexts with L slots (L=4096 for polynomial modulus degree 8192), so n user-row encryptions collapse to about M/L ciphertexts. A second mechanism, optimized batching, groups ratings by user-item batch pairs and uses gradient accumulators so each profile in a batch is updated once per batch pair rather than once per rating, reducing redundant homomorphic operations.

What would settle it

Run the protocol on a known sparse rating matrix with a nonzero random mask, have the CSP sort and pack the masked ratings into CSR ciphertexts, and then attempt to remove the mask on the server using only the operations listed in Algorithm 1. If mask removal requires the mask to be permuted in the same CSR order that was applied after masking, or requires extra ciphertext rotations that exceed the CKKS noise budget, the protocol will not recover the true ratings.

Watch

Extended reading notes

Core claim

The central claim is that combining Compressed Sparse Row (CSR) representation with the CKKS fully homomorphic encryption scheme yields an end-to-end privacy-preserving recommendation system that handles sparse user-item matrices without sacrificing accuracy or privacy. Instead of encrypting the full n-by-m rating matrix or one ciphertext per user row, the protocol extracts only the M nonzero ratings, sorts them by user id, and packs them into M/L ciphertexts using CKKS batching. The recommendation server then performs gradient-descent matrix factorization entirely on encrypted data, updates encrypted user and item profiles, and returns a masked encrypted predicted rating matrix that the CSP

Load-bearing premise

The protocol assumes the trusted CSP can sort masked plaintext ratings into CSR order and pack them into ciphertexts such that the recommendation server's mask vector can be removed homomorphically in exactly the same permuted order; if that realignment is missing, the server cannot compute on true ratings.

Editorial extensions

If this is right

  • If CSR-FHE works as claimed, communication cost grows with the number of nonzero ratings divided by slots per ciphertext, not with the number of users or the number of training iterations.
  • The recommendation server performs all factorization itself, so the protocol needs no repeated communication during the training loop, in contrast to prior per-iteration protocols.
  • With at least 20 iterations typically needed for accuracy improvements, the total communication advantage over per-iteration approaches multiplies linearly in the iteration count.
  • The optimized batching variant shows only a small advantage at high sparsity, but the advantage grows as ratings become denser, making it the scalable variant for larger real-world datasets.
  • The approach is compatible with hardware acceleration of FHE, which the paper cites as offering orders-of-magnitude speedup, strengthening the case that FHE-only recommendation is computable in practice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit a correctness condition in its initialization phase: the mask added by the recommendation server must survive the CSP's CSR sorting and packing, so that the server can remove it after sorting without extra rotations or a second communication round; the protocol description never specifies how the mask vector is realigned to the permuted slots.
  • A testable extension would be to measure the true cost of mask removal and slot access, since the reported communication figures count only the masked CSR ciphertexts and not any auxiliary operations needed to align masks before encryption or after decryption.
  • The comparison to prior work assumes the same number of nonzero ratings and single-iteration measurements for the baselines; a full end-to-end comparison across 20 iterations, including all phases rather than only the factorization loop, would clarify whether the communication advantage holds under realistic convergence conditions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a privacy-preserving recommendation protocol that combines Compressed Sparse Row (CSR) representation with CKKS-based fully homomorphic encryption (FHE) for matrix factorization. Three parties are involved: users, a recommendation server (RS), and a crypto service provider (CSP). Users encrypt their ratings, RS adds a mask, CSP decrypts the masked values, builds a masked CSR matrix, re-encrypts it, and sends the packed ciphertexts to RS. RS then performs encrypted gradient-descent matrix factorization, sends masked encrypted predictions to CSP, which decrypts them for users. The paper claims the lowest communication cost (about M/L ciphertexts instead of n), high accuracy (roughly 87% RMSE reduction over 20 iterations), and end-to-end privacy. It also presents an optimized batching variant with gradient accumulators. Experiments on MovieLens 100K are reported using TenSEAL.

Significance. If the protocol were executable as described, the CSR-FHE packing idea could be a useful step toward sparse-data FHE recommendation, and the communication-cost reduction from n to M/L ciphertexts in the CSP-to-RS leg is a plausible and attractive direction. The paper also makes an explicit comparison with prior work [7], [11], which is helpful. However, the central claims rest on an algorithm that is not implementable as written with packed CKKS ciphertexts, and the experimental evaluation measures RMSE on the training set with no held-out split or plaintext baseline. As submitted, the paper does not provide a sound basis for its efficiency, accuracy, or privacy claims.

major comments (5)
  1. [Section III-C, Algorithm 1] Algorithm 1 lines 11–19 is not implementable as written with CKKS packed ciphertexts. The ratings are packed into a single ciphertext with L=4096 slots (Fig. 3), but line 14 requires reading Enc data[idx] for an arbitrary rating and line 17 updates Enc U[user] individually. CKKS offers whole-ciphertext SIMD operations and rotations, not random access to a slot by plaintext index. Extracting each rating, routing it to the correct user/item profile, and re-inserting accumulated gradient updates requires masking/rotation/repacking circuits that are not described. Algorithm 2 inherits the same gap: lines 7, 13, 16–17 access 'u local' and 'v local' positions inside packed batch ciphertexts. Without these operations, the claimed encrypted MF loop cannot be executed, so the runtime and accuracy results are not tied to a specified algorithm.
  2. [Section IV-D, Eq. (10)] The accuracy evaluation is on the training set. Eq. (10) sums over NZR, the same non-zero ratings that are optimized in Eq. (1). There is no held-out split, cross-validation, or plaintext matrix-factorization baseline. The 87% RMSE reduction in Fig. 7 therefore only demonstrates that the encrypted model can fit the ratings it was trained on; it does not support the claim of high recommendation accuracy on unseen ratings. It also cannot separate CKKS approximation error from ordinary overfitting. This is load-bearing for the central accuracy claim and needs to be redone with a proper train/test split and a plaintext baseline.
  3. [Section III-C, communication cost] The claimed reduction from (1+n) to (1+M/L) ciphertexts counts only the CSP-to-RS transfer of the CSR-packed rating matrix. However, the initialization phase in Section III-B has users sending M encrypted ratings to the RS and the RS sending M masked ciphertexts to the CSP. Unless users pack their own ratings (not specified), these transmissions dominate the total communication and are not included in Fig. 6's 0.005 MB figure. The 'lowest communication cost' claim requires a full end-to-end accounting of all ciphertext transfers, with the same metric applied to the prior work.
  4. [Section III-B, Algorithm 1 lines 1–4] The mask-removal step is underspecified. RS adds a mask to each encrypted rating; CSP then decrypts, converts to CSR, sorts by user id, packs, and re-encrypts. For RS to remove the mask homomorphically from the packed ciphertext, it must know the exact slot permutation and align its mask vector to it. Neither Algorithm 1 nor the text explains how RS obtains this alignment, or whether the mask is removed before or after packing. If it is removed after packing, per-slot access is needed; if before, the communication model changes. This is a correctness gap in the end-to-end protocol.
  5. [Section II-B and III-B, security claims] The paper repeatedly calls the system 'FHE-only' and 'true end-to-end protection', but the CSP holds the secret key and decrypts the masked ratings to build the CSR matrix (Section III-B). This is the same trusted-third-party-with-decryption pattern for which Kim et al. [11] are criticized (Section II-B). The security properties may be achievable under a non-collusion assumption, but no formal threat model or proof is given, and the 'no privacy tradeoff' claim is stronger than the protocol supports.
minor comments (5)
  1. [Algorithm 1 and Section II-A] Notation is inconsistent: the main text defines the rating matrix as Rn×m, while Algorithm 1 uses Rm×n; row and column index terminology is also mixed. Please harmonize.
  2. [Figure 2] Figure 2 is hard to read: arrow labels are very small and the role of the mask in the figure is ambiguous. A cleaner diagram would help.
  3. [Table I] The complexity expressions use E and Ebatch without defining the unit or the derivation. Please clarify what counts as one homomorphic operation and how Ebatch is computed.
  4. [Section IV] There is no discussion of CKKS noise budget, rescaling, or whether bootstrapping is needed for T iterations. Without this, the practical feasibility of the claimed parameter set is unclear.
  5. [References and typos] There are repeated typos ('Nikoleanko', 'Moivelens') and the reference [14] URL is incomplete. Please proofread.

Circularity Check

1 steps flagged · score 6.0 of 10

Accuracy evidence is in-sample: RMSE is measured on the same NZR used to train U,V, so the reported 87% improvement is the optimizer reducing its own objective.

  1. fitted input called prediction [Section IV-B (Evaluation Metrics), Eq. (10); Section IV-D (Accuracy Analysis); Section II-A1 Eq. (1)]
    "RMSE = s P (u,v)∈N ZR(ˆruv − ruv)2 |N ZR| ... Both methods achieve approximately 87% reduction in RMSE. ... min U,V 1 M P (i,j)∈N ZR (rij − hui, vj i) 2 + λ P i∈[n] kui k 2 2 + µ P j∈[m] kvj k 2 2"

    Equations (1) and (10) sum over exactly the same non-zero set NZR. Algorithm 1 trains U and V by gradient descent on Eq. (1), and the reported RMSE is the same training residual evaluated on the training labels r_uv. The claimed 87% RMSE reduction is therefore the optimizer reducing its own objective, not a prediction on held-out data. The accuracy claim is forced by the fit by construction; no independent test set is reported.

full rationale

The paper's core communication claim is not circular: the (1 + M/L) ciphertext cost follows directly from using CSR to store only the M non-zero ratings, which is a design implication rather than a fitted prediction. The protocol's privacy claims rest on standard CKKS FHE assumptions, not on self-citations, and the cited hardware-acceleration works [37,38] are only used contextually. There is no imported uniqueness theorem, no ansatz smuggled via citation, and no renaming of a known result as a new theoretical derivation. The only circularity-adjacent element is the accuracy evaluation: RMSE is computed over the same NZR set used to fit U,V, so the reported 87% reduction is an in-sample convergence result rather than an independent predictive validation. This makes the accuracy evidence partially circular, while the main protocol/communication contributions retain independent content.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The protocol depends on several unstated choices: random mask alignment, a non-colluding trusted CSP, CKKS noise behavior, and evaluation on training data. These are not derived or independently validated.

free parameters (8)
  • Learning rate alpha = not stated
    Used in gradient updates (Algorithms 1 and 2); value never reported.
  • Regularization lambda (and mu) = not stated
    Regularization coefficient in Eqs. (1)-(5); Algorithm 1 uses a single lambda while the loss defines lambda and mu; values not reported.
  • Latent dimension k = 10
    Set in Section IV-A; directly controls model capacity and RMSE.
  • CKKS fractional precision = 32 bits
    Set in Section IV-A; Figure 8 shows RMSE depends on this choice.
  • Polynomial modulus degree = 8192
    Set in Section IV-A; determines L=4096 slots and thus the M/L communication claim.
  • Gradient-dampening factor = 0.1
    Introduced in Algorithm 2 line 10 as alpha/(1+0.1*iteration) without justification or sensitivity analysis.
  • User/item batch sizes = 5 in example; not stated for experiments
    Used in Section III-D to define batch pairs; actual sizes used in Figures 6 and 7 are not reported.
  • Number of iterations T = 20 in accuracy figures
    Determines total runtime; no convergence stopping criterion.
assumptions (5)
  • domain assumption CSP and RS are semi-honest and do not collude; the CSP holding the secret key will not decrypt masked data or combine masks with encryptions.
    Section III-B: CSP decrypts masked ratings with sk; security relies on masks being unknown to CSP and on non-collusion, stated nowhere as a formal assumption but used by the Figure 2 protocol.
  • domain assumption CKKS approximate arithmetic with 32-bit fractional precision produces accurate gradient descent over 20 iterations.
    Section IV-A/D use CKKS without bootstrapping; no noise-growth bound is provided, only empirical RMSE curves.
  • domain assumption CSR row and column indices may be exposed to RS (and CSP) without violating privacy.
    Algorithm 1 sends row and col indices as plaintext to drive updates; this assumes the user-item graph is not sensitive.
  • ad hoc to paper Masks added by RS can be removed from the re-encrypted, CSR-sorted, packed ciphertext at RS.
    Section III-B states RS removes the mask from the masked encrypted CSR matrix, but Algorithm 1 and Section IV give no permutation or alignment procedure; this is an unproved protocol step.
  • ad hoc to paper RMSE computed over the training non-zero set measures recommendation accuracy.
    Section IV-B defines RMSE over NZR, the same non-zero ratings used in gradient updates; no test set or split is defined.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Privacy-Preserving Recommendation on Sparse Data using Fully Homomorphic Encryption." pith.science (2026). https://pith.science/paper/L4WOMXYB

@misc{pith2026250903024,
  author       = {Pith},
  title        = {Pith review of: Efficient Privacy-Preserving Recommendation on Sparse Data using Fully Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L4WOMXYB}},
  note         = {Machine review of arXiv:2509.03024}
}
read the original abstract

In today's data-driven world, recommendation systems personalize user experiences across industries but rely on sensitive data, raising privacy concerns. Fully homomorphic encryption (FHE) can secure these systems, but a significant challenge in applying FHE to recommendation systems is efficiently handling the inherently large and sparse user-item rating matrices. FHE operations are computationally intensive, and naively processing various sparse matrices in recommendation systems would be prohibitively expensive. Additionally, the communication overhead between parties remains a critical concern in encrypted domains. We propose a novel approach combining Compressed Sparse Row (CSR) representation with FHE-based matrix factorization that efficiently handles matrix sparsity in the encrypted domain while minimizing communication costs. Our experimental results demonstrate high recommendation accuracy with encrypted data while achieving the lowest communication costs, effectively preserving user privacy.

Figures

Figures reproduced from arXiv: 2509.03024 by the authors.

Figure 1
Figure 1. Compressed Sparse Matrix Structure. For sparse matrix R with n users, m items, and M non-zero elements, CSR requires only M values, M column indices, and n+1 row pointers, compared to n×m dense storage. CSR enables efficient row-wise operations fundamental to matrix factorization [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Overview of FHE based CSR matrix factorization. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. FHE based CSR matrix factorization. dimensional latent factors. The Enc U and Enc V packed ciphertext of Algorithm 1 are then processed for all the values in Enc Data of CSR matrix, where the GDU and GDV store gradients to process only non-zero ratings and their corresponding user-item profile updates. Finally, encrypted predicted rating matrix Rˆ is calcu￾lated by the updated encrypted user and item profile matrice… view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: User-item batch pair generation. Algorithm 2 Gradient Update with Accumulator Require: Batch groups batch groups, encrypted factors U batches, V batches Ensure: Updated factor batches 1: for each (u batch idx, v batch idx), ratings ∈ batch groups do 2: Enc U batch ← En…
Figure 6
Figure 6. Figure 6: Comparison of Performance Trade-off Analysis. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: RMSE over iterations for CSR Matrix Factorization variants: with [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Effect of fractional precision (22-bit vs. 32-bit) on RMSE over 15 [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Performance metrics comparison (CSR methods is the most balanced). [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 40 canonical work pages

  1. [7]

    Privacy-preserving matrix factorization

    Nikolaenko, Valeria, et al. “Privacy-preserving matrix factorization.” Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security. 2013

    work page 2013

  2. [11]

    Efficient privacy-preserving matrix factorization via fully homomorphic encryption

    Kim, Sungwook, et al. “Efficient privacy-preserving matrix factorization via fully homomorphic encryption.” Proceedings of the 11th ACM on Asia conference on computer and communications security. 2016

    work page 2016

  3. [1]

    A survey of collaborative filtering techniques

    Su, Xiaoyuan, and Taghi M. Khoshgoftaar. “A survey of collaborative filtering techniques.” Advances in artificial intelligence 2009.1 (2009): 421425

    work page 2009

  4. [2]

    When being weak is brave: Privacy issues in recommender systems

    Ramakrishnan, Naren, et al. “When being weak is brave: Privacy issues in recommender systems.” Technical paper posted on the Computing Research Repository at http://xxx. lanl. gov/abs/cs. CG/0105028 (2001)

    work page arXiv 2001

  5. [3]

    Robust de-anonymization of large sparse datasets

    Narayanan, Arvind, and Vitaly Shmatikov. “Robust de-anonymization of large sparse datasets.” 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, 2008

    work page 2008

  6. [4]

    BlurMe: Inferring and obfuscating user gender based on ratings

    Weinsberg, Udi, et al. “BlurMe: Inferring and obfuscating user gender based on ratings.” Proceedings of the sixth ACM conference on Rec- ommender systems. 2012

    work page 2012

  7. [5]

    Collaborative filtering with privacy

    Canny, John. “Collaborative filtering with privacy.” Proceedings 2002 IEEE symposium on security and privacy. IEEE, 2002

    work page 2002

  8. [6]

    Differentially private recommender systems: Building privacy into the netflix prize contenders

    McSherry, Frank, and Ilya Mironov. “Differentially private recommender systems: Building privacy into the netflix prize contenders.” Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining. 2009

    work page 2009

Show all 41 references
  1. [9]

    k-anonymity: A model for protecting privacy

    Sweeney, Latanya. “k-anonymity: A model for protecting privacy.” International journal of uncertainty, fuzziness and knowledge-based systems 10.05 (2002): 557-570

    2002

  2. [10]

    Privacy-preserving collaborative filtering using fully homomorphic encryption

    Jumonji, Seiya, et al. “Privacy-preserving collaborative filtering using fully homomorphic encryption.” IEEE Transactions on Knowledge and Data Engineering 35.3 (2021): 2961-2974

    2021

  3. [12]

    Tenseal: A library for encrypted tensor opera- tions using homomorphic encryption

    Benaissa, Ayoub, et al. “Tenseal: A library for encrypted tensor opera- tions using homomorphic encryption.” arXiv preprint arXiv:2104.03152 (2021)

    2021 arXiv

  4. [13]

    Homomorphic encryption for arithmetic of approximate numbers

    Cheon, Jung Hee, et al. “Homomorphic encryption for arithmetic of approximate numbers.” Advances in cryptology–ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptol- ogy and information security, Hong kong, China, December 3-7, 2017, proceedin...

    2017

  5. [14]

    Available: https://files.grouplens.org/datasets/movielens/ml-100k

    Grouplens, Grouplens Moivelens 100k dataset [Online]. Available: https://files.grouplens.org/datasets/movielens/ml-100k

  6. [15]

    Large-scale matrix factorization with distributed stochastic gradient descent

    Gemulla, Rainer, et al. “Large-scale matrix factorization with distributed stochastic gradient descent.” Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining. 2011

    2011

  7. [16]

    Fully homomorphic encryption using ideal lattices

    Gentry, Craig. “Fully homomorphic encryption using ideal lattices.” Proceedings of the forty-first annual ACM symposium on Theory of computing. 2009

    2009

  8. [17]

    Encoding-free ElGamal encryption without random oracles

    Chevallier-Mames, Beno ˆıt, Pascal Paillier, and David Pointcheval. “Encoding-free ElGamal encryption without random oracles.” Public Key Cryptography-PKC 2006: 9th International Conference on Theory and Practice in Public-Key Cryptography, New York, NY , USA, April 24-26, 200...

    2006

  9. [18]

    Protocols for secure computations

    Yao, Andrew C. “Protocols for secure computations.” 23rd annual symposium on foundations of computer science (sfcs 1982). IEEE, 1982

    1982

  10. [19]

    Faster secure Two-Party computation using garbled circuits

    Huang, Yan, et al. “Faster secure Two-Party computation using garbled circuits.” 20th USENIX Security Symposium (USENIX Security 11). 2011

    2011

  11. [20]

    Graphsc: Parallel secure computation made easy

    Nayak, Kartik, et al. “Graphsc: Parallel secure computation made easy.” 2015 IEEE symposium on security and privacy. IEEE, 2015

    2015

  12. [21]

    PProx: efficient privacy for recommendation-as-a-service

    Rosinosky, Guillaume, et al. “PProx: efficient privacy for recommendation-as-a-service.” Proceedings of the 22nd International Middleware Conference. 2021

    2021

  13. [22]

    Federated recommendation systems

    Yang, Liu, et al. “Federated recommendation systems.” Federated Learn- ing: Privacy and Incentive. Cham: Springer International Publishing,

  14. [23]

    Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption

    Kim, Jinsu, et al. “Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption.” ACM Transactions on Privacy and Security (TOPS) 21.4 (2018): 1-30

    2018

  15. [24]

    Fully homomorphic SIMD operations

    Smart, Nigel P., and Frederik Vercauteren. “Fully homomorphic SIMD operations.” Designs, codes and cryptography 71 (2014): 57-81

    2014

  16. [25]

    Differentially private data release for data mining

    Mohammed, Noman, et al. “Differentially private data release for data mining.” Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining. 2011

    2011

  17. [26]

    Privacy-preserving personalized recom- mendation: An instance-based approach via differential privacy

    Shen, Yilin, and Hongxia Jin. “Privacy-preserving personalized recom- mendation: An instance-based approach via differential privacy.” 2014 IEEE international conference on data mining. IEEE, 2014

    2014

  18. [27]

    A survey on fully ho- momorphic encryption: An engineering perspective

    Martins, Paulo, Leonel Sousa, and Artur Mariano. “A survey on fully ho- momorphic encryption: An engineering perspective.” ACM Computing Surveys (CSUR) 50.6 (2017): 1-33

    2017

  19. [28]

    A guide to fully homomorphic encryption

    Armknecht, Frederik, et al. “A guide to fully homomorphic encryption.” Cryptology ePrint Archive (2015)

    2015

  20. [29]

    Survey on fully homomorphic encryption, theory, and applications

    Marcolla, Chiara, et al. “Survey on fully homomorphic encryption, theory, and applications.” Proceedings of the IEEE 110.10 (2022): 1572- 1609

    2022

  21. [30]

    An Enhanced Latent Factor Recommendation Approach for Sparse Datasets of E-Commerce Platforms

    Wu, Wenbin, et al. “An Enhanced Latent Factor Recommendation Approach for Sparse Datasets of E-Commerce Platforms.” Systems 13.5 (2025): 372

    2025

  22. [31]

    (Leveled) fully homomorphic encryption without bootstrapping

    Brakerski, Zvika, Craig Gentry, and Vinod Vaikuntanathan. “(Leveled) fully homomorphic encryption without bootstrapping.” ACM Transac- tions on Computation Theory (TOCT) 6.3 (2014): 1-36

    2014

  23. [32]

    Somewhat practical fully homomorphic encryption

    Fan, Junfeng, and Frederik Vercauteren. “Somewhat practical fully homomorphic encryption.” Cryptology ePrint Archive (2012)

    2012

  24. [33]

    TFHE: fast fully homomorphic encryption over the torus

    Chillotti, Ilaria, et al. “TFHE: fast fully homomorphic encryption over the torus.” Journal of Cryptology 33.1 (2020): 34-91

    2020

  25. [34]

    A framework for secure computations with two non-colluding servers and multiple clients, applied to recommendations

    Veugen, Thijs, et al. “A framework for secure computations with two non-colluding servers and multiple clients, applied to recommendations.” IEEE Transactions on Information Forensics and Security 10.3 (2014): 445-457

    2014

  26. [35]

    Microsoft SEAL (release 4.1)

    “Microsoft SEAL (release 4.1)”, Jan. 2023. https://github.com/microsoft/SEAL (accessed May 25, 2025)

    2023

  27. [36]

    The impact of basic matrix factorization refinements on recommendation accuracy

    Lak, Parisa, Bora Caglayan, and Ayse Basar Bener. “The impact of basic matrix factorization refinements on recommendation accuracy.” 2014 IEEE/ACM International Symposium on Big Data Computing. IEEE, 2014

    2014

  28. [37]

    UFC: A Unified Accelerator for Fully Homo- morphic Encryption

    Zhou, Minxuan, et al. “UFC: A Unified Accelerator for Fully Homo- morphic Encryption.” 2024 57th IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 2024

    2024

  29. [38]

    FHEmem: A processing in-memory accelerator for fully homomorphic encryption

    Zhou, Minxuan, et al. “FHEmem: A processing in-memory accelerator for fully homomorphic encryption.” IEEE Transactions on Emerging Topics in Computing (2025)

    2025

  30. [39]

    F1: A fast and programmable accelerator for fully homomorphic encryption

    Samardzic, Nikola, et al. “F1: A fast and programmable accelerator for fully homomorphic encryption.” MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture. 2021

    2021

  31. [40]

    SHARP: A short-word hierarchical accelerator for robust and practical fully homomorphic encryption

    Kim, Jongmin, et al. “SHARP: A short-word hierarchical accelerator for robust and practical fully homomorphic encryption.” Proceedings of the 50th Annual International Symposium on Computer Architecture. 2023

    2023

  32. [41]

    HE-LRM: Encrypted Deep Learning Rec- ommendation Models using Fully Homomorphic Encryption

    Garimella, Karthik, et al. “HE-LRM: Encrypted Deep Learning Rec- ommendation Models using Fully Homomorphic Encryption.” arXiv preprint arXiv:2506.18150 (2025)

    2025 arXiv

  33. [42]

    Exploiting Unstructured Sparsity in Fully Homomorphic Encrypted DNNs

    Ferguson, Aidan, et al. “Exploiting Unstructured Sparsity in Fully Homomorphic Encrypted DNNs.” Proceedings of the 5th Workshop on Machine Learning and Systems. 2025

    2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.