Pith. sign in

REVIEW 4 major objections 5 minor 35 references

PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A pruning criterion that accounts for polynomial activation sensitivity and rotation cost yields encrypted neural networks that are both more fault-tolerant and faster, cutting catastrophic-layer counts by over an order of magnitude.

desk verdict A useful first cut at reliability-aware pruning for CKKS networks, but the headline 29x reliability claim rests on an int32 proxy that the paper itself does not validate against CKKS per-layer behavior. read the letter →

arxiv 2607.18342 v1 pith:4PJIIXAS submitted 2026-07-20 cs.CR cs.AIcs.ARcs.DCcs.LG

Sahaj Majavdia , Mahdi Taheri This is my paper · ORCID
classification cs.CRcs.AIcs.ARcs.DCcs.LG
keywords homomorphicencryptionCKKSstructuredpruningfaulttolerancebit-flipinjectionsilentdatacorruptionpolynomialactivationneuralnetworkreliability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that how you prune a neural network for homomorphic encryption changes not only speed but also whether transient memory faults silently corrupt the output. It proposes PSAP, a structured pruning method that ranks filters by weight magnitude, the local steepness of the polynomial activations that replace ReLU, and the cost of homomorphic rotations. Across ResNet-20 and ResNet-32 on CIFAR-10 and CIFAR-100, PSAP-pruned models keep catastrophic accuracy drops to at most two layers, versus five to fourteen for magnitude-pruned baselines, and cut rotation counts by up to 45.2 percent. The same pipeline lowers multiplicative depth from 66 to 56 levels on ResNet-32, making bootstrapping-free encrypted inference possible. The point matters because homomorphic inference is memory- and time-heavy, so it is disproportionately exposed to hardware faults, and silent mispredictions are the dangerous failure mode.

What carries the argument

The load-bearing object is the PSAP importance metric combining m_i (filter weight magnitude), S_i (expected absolute gradient of the degree-2 polynomial activation over the filter's activation interval), R_l (normalized homomorphic rotation cost), and a depth-dependent protection factor; alpha and lambda blend the terms. A second mechanism is adaptive mixed-degree allocation: each activation's quadratic curvature rho = |a|/(|a|+|b|+|c|) ranks which activations keep degree two and which fall back to degree one, cutting multiplicative depth while preserving the most nonlinear behavior. The reliability evaluation uses per-layer bit-flip injection to identify fault-critical layers; the paper ar

What would settle it

Inject bit-flips directly into CKKS ciphertext coefficients at BER between 10^-5 and 10^-4 across all layers of a PSAP-pruned network; if the layers that first cause overflow or silent misprediction do not match the int32-identified critical layers (for example the stem or downsampling blocks), the proxy transfer fails. Alternatively, compare per-layer vulnerability rankings under int32 versus CKKS for the same model: any substantial reordering would falsify the conservative-proxy claim.

Watch

Extended reading notes

Core claim

The central claim is that reliability and efficiency in CKKS-based encrypted inference are not competing objectives when pruning is guided by the right signal; CKKS is the approximate-arithmetic homomorphic encryption scheme used here. PSAP scores each filter by combining its weight norm, the expected steepness of its polynomial activation over the filter's operating range, and the layer's rotation cost, multiplied by a depth-protection factor. This concentrates pruning in flat, structurally redundant regions while preserving filters in steep activation regions, which turns out to be where fault damage concentrates. As a result, layer-wise bit-flip vulnerability drops from 5-14 catastrophic

Load-bearing premise

The claim rests on the assumption that bit-flips injected into int32 numerical representations behave like, and rank layers the same way as, bit-flips in actual CKKS ciphertext coefficients — an assumption the paper supports only by qualitative agreement with direct encrypted experiments.

Editorial extensions

If this is right

  • PSAP-pruned models keep catastrophic (>10 pp drop) layers to at most two versus 5-14 for magnitude pruning, with up to 29x worst-case vulnerability reduction under int32 bit-flip injection.
  • Rotation counts fall by up to 45.2% on ResNet-32, and multiplicative depth drops from 66 to 56 levels, enabling leveled inference without bootstrapping.
  • Fault-critical layers are concentrated in a small structural set (about 1.1% of parameters in ResNet-20), so selective hardening of those layers neutralizes the worst degradation at roughly 2.3% parameter overhead.
  • Under the CKKS scheme, encrypted inference stays safe up to BER around 10^-5; beyond that failures manifest as detectable overflow rather than silent data corruption.
  • Reliability and efficiency can be improved together: the same pruning decisions that cut rotations also reduce catastrophic-layer counts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If int32 layer-wise criticality transfers to full CKKS ciphertext corruption, then per-layer criticality maps could be computed cheaply in plaintext during model design, reserving expensive encrypted experiments for final validation.
  • The overflow-cascade mechanism suggests mixed-degree allocation has a reliability benefit beyond depth reduction: degree-one activations grow error linearly rather than quadratically, which may delay modulus exhaustion; a direct experiment isolating degree-1 versus degree-2 chains would test this.
  • Because fault-critical layers are early structural layers (stem, downsampling), robustness might be further improved by architectural changes rather than pruning alone, for example redesigning the stem or adding residual redundancy at those positions.
  • A testable extension: apply PSAP to other HE-friendly activation families, such as higher-degree polynomials or piecewise approximations, to see whether the sensitivity term remains the dominant reliability signal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PSAP (Polynomial-Sensitivity-Aware Pruning), a structured pruning framework for CKKS-encrypted neural networks. The pipeline converts ReLU networks to degree-2 polynomial activations (SLAF), prunes filters using a score that combines weight magnitude, activation sensitivity, rotation cost, and a depth-dependent protection factor, and then applies adaptive mixed-degree allocation and quantization-aware training. The authors also present a reliability characterization using int32, float32, and direct CKKS bit-flip injection, with full-model and per-layer experiments on ResNet-20/ResNet-32 over CIFAR-10/CIFAR-100. The headline claims are that PSAP reduces catastrophic fault-sensitive layers from 5–14 to at most two under int32 injection, cuts worst-case vulnerability by up to 29×, identifies a 1.1% critical parameter slice for selective hardening, and simultaneously reduces Halevi–Shoup rotations by up to 45.2% and multiplicative depth from 66 to 56 levels.

Significance. If the reliability claims hold for actual encrypted inference, PSAP would be a notable contribution: it is the first pruning criterion for HE networks that explicitly accounts for fault resilience, and it connects model optimization to a practical hardening strategy. The efficiency results are concrete and supported by the reported rotation and depth numbers. The paper also deserves credit for conducting a large experimental campaign (40 full-model and 108 per-layer configurations), reporting confidence intervals for the int32 campaigns, and being transparent about where evidence is qualitative. However, the central reliability claim currently rests on an unvalidated transfer from int32 silent-error behavior to CKKS. The direct CKKS experiments in the paper show no silent-error regime at all—only tolerance up to BER=1e-5 followed by 100% overflow/DUE at BER=1e-4—so the catastrophic-layer and 29× claims have not been demonstrated in the encrypted domain. This is a load-bearing gap that must be addressed before the paper's main message can be accepted.

major comments (4)
  1. [§IV-C2, §IV-D1, Table IV] The central reliability comparison—catastrophic layers and the 29× worst-case reduction—is measured under int32 bit-flip injection, but the direct CKKS experiments show no silent accuracy-loss regime: accuracy and SDC are flat up to BER=1e-5, and all runs fail as DUE/overflow at BER=1e-4 (Figs. 3–5, §IV-C2). The paper's only support for transferring int32 layer rankings to CKKS is the qualitative sentence in §IV-D1 that int32-critical layers correspond to 'earliest ciphertext overflow locations,' with no per-layer CKKS data, correlation statistic, or confidence intervals. This is insufficient for the headline claim. Please provide per-layer CKKS fault-injection results (or an equivalent quantitative mapping) that establishes the same layer ordering, or re-scope the reliability claims to fixed-point/plaintext inference and present the CKKS result solely as a DUE-boundary characterization.
  2. [§III-D1, Eq. (9); §IV-D2] The depth-protection factor in Eq. (9) encodes the conclusion that early layers are more fault-critical, and the paper then validates PSAP by measuring layer criticality and showing that PSAP preserves those same early layers. With γ=0, the reported reliability gains are attributed to the activation-sensitivity term and the depth factor, but there is no ablation that isolates the effect of this ad-hoc prior. Since the paper states that only the relative ordering and not the slope matters, an ablation with Π_l ≡ 1 (or with a shuffled depth ordering) is straightforward and would demonstrate whether the measured reliability benefit comes from the sensitivity/rotation terms or from the hand-coded depth prior. This is needed to substantiate the claim that PSAP is genuinely 'reliability-aware' rather than a fixed prior about network depth.
  3. [§IV-D3, Table V] The selective-hardening experiment is performed entirely in the plaintext domain with an idealized fault-free critical slice, and the paper explicitly states that extending the defense to encrypted ciphertexts is future work. Yet the abstract and conclusion describe the 1.1% critical slice as 'enabling selective hardening at minimal overhead.' The plaintext result is interesting, but it does not demonstrate that the same hardening works for CKKS ciphertexts, where the failure mode is overflow/DUE rather than silent accuracy loss. Please either temper the selective-hardening claims so that they are confined to plaintext/fixed-point deployment, or add a CKKS hardening experiment (even a small-scale one) that shows the protected layers do not change the overflow boundary.
  4. [§IV-C2, Figs. 3–5] The CKKS curves are reported as deterministic and without confidence intervals, which is surprising given the stated 15-trial statistical methodology in §IV-A. If the fault masks are randomly sampled, the CKKS outcomes should vary across trials unless the fault model is degenerate. Please clarify the protocol: were the CKKS runs performed with a single fault mask per BER, or with the same 15-trial procedure? If the latter, report the variance; if the former, explain why a single mask is representative for a 'safe operating boundary' at BER=1e-5. This matters because the safe-boundary claim is a key quantitative output of the paper.
minor comments (5)
  1. [§III-C2, Eq. (6)] The activation sensitivity Si assumes a uniform distribution over [μi−3σi, μi+3σi]. This should be stated as a modeling approximation; actual activation distributions can be highly skewed, and the sensitivity estimate may be biased for filters whose activations concentrate in a small sub-interval.
  2. [§IV-D2, Table IV] The comparison with magnitude pruning is described in §IV-E3 as modifying only the scoring criterion, but the table caption does not state whether the magnitude baseline receives the same fine-tuning, mixed-degree allocation, and QAT pipeline as PSAP. Please make this explicit; if the baselines did not receive identical post-pruning treatment, the clean-accuracy differences (e.g., 89.58 vs. 87.11 for R-32/C-10) could confound the reliability comparison.
  3. [Abstract and §IV-A] The phrase '40 full-model experiments' is not broken down by representation. Clarify how the 40 trials are distributed among int32, float32, and CKKS across the four configurations and five BERs.
  4. [§IV-C2, Fig. 4] The CKKS baseline SDC values at the lowest BER (e.g., 4% for R-20/C-10) are attributed to the numerical gap between quantized plaintext and CKKS execution. Consider reporting this baseline separately from injected-fault SDC so that readers can distinguish intrinsic approximation error from fault-induced corruption.
  5. [General] There is no code-availability statement. Given the complexity of the pipeline and the difficulty of reimplementing HE experiments, a public release would substantially improve reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; PSAP is validated by an independent magnitude-pruning comparison and direct CKKS checks, with only a mild a-priori depth-prior overlap.

full rationale

The central derivation chain is not circular. PSAP's importance metric (Eq. 10) combines weight magnitude, activation sensitivity (Eq. 6), rotation cost, and an explicitly a-priori depth factor (Eq. 9). The depth factor is a stated heuristic ('deliberately simple ... reflecting the higher information density and broader fault influence of early feature extraction stages'), not a parameter fitted to the fault-injection outcomes. Layer criticality in Sec. IV-D1 is measured independently via Eq. (16) fault injection; it could in principle have contradicted the prior, and the quantitative magnitudes (e.g., 40.82 pp worst-case drops) are not encoded in Eq. (9). The controlled comparison against magnitude pruning at the same target sparsity provides independent grounding: the reliability metric is identical for both methods, and the pruning criterion is the only change. Direct CKKS fault injection is used as a cross-check of the int32 proxy rather than as an input to the pruning objective. The main weaknesses—the int32-to-CKKS proxy resting on qualitative agreement without per-layer CKKS correlation statistics, and selective hardening demonstrated only in the plaintext domain (Sec. IV-D3)—are evidence/validity limitations, not circularity. No load-bearing self-citation is present; references to prior HE pruning and fault work are external. Thus no definitional or fitted-input circularity is established; the mild design-to-measurement overlap of the depth prior is a heuristic assumption, not a reduction of a prediction to its inputs.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method is not derived from first principles. Its core ranking metric includes five hand-set or empirical coefficients (α, λ, γ, s0, depth-protection slope), and the reliability conclusions depend on the int32-to-CKKS proxy and the uniform-sensitivity model. No new physical or cryptographic entities are introduced.

free parameters (5)
  • α (PSAP sensitivity exponent) = 0.7
    Eq. (10) controls how much activation sensitivity S_i contributes to filter importance; chosen empirically in Section IV-A with no held-out validation.
  • λ (rotation-cost weight) = 0.3
    Eq. (10) modulates the rotation-cost term; chosen empirically in Section IV-A.
  • γ (sensitivity-aware cap coefficient) = 0 default, 0.5 variant
    Eq. (12) controls per-layer sparsity protection; default 0 disables cap allocation, and the variant is reported separately.
  • s0 (baseline sparsity scaling) = 0.5 at 50% operating point
    Eq. (12) baseline sparsity; effectively the target sparsity chosen by the user and varied from 20% to 50% in the study.
  • Depth protection factor coefficients = Π = 1 + 2(1-δ)
    Eq. (9) uses an arbitrary linear form to give early layers a threefold boost; the paper says the slope is not critical, but it changes the relative ordering of filters.
assumptions (5)
  • domain assumption Activation sensitivity S_i is the expected absolute gradient under a uniform distribution on [μ_i-3σ_i, μ_i+3σ_i] (Eq. 6).
    Assumes uniform input distribution over a 3σ interval; actual activations are not uniform, and S_i may not correspond to fault propagation.
  • ad hoc to paper Early layers have higher information density and broader fault influence (Eq. 9).
    The depth-protection factor Π_ℓ encodes this belief into pruning; the paper later uses layer-wise fault injection to support the same conclusion.
  • domain assumption int32 quantized bit flips are a conservative proxy for CKKS ciphertext coefficient faults.
    All headline reliability numbers rest on this; it is supported only by qualitative agreement with global CKKS experiments in Section IV-D1.
  • domain assumption Faults are independent, uniformly random bit flips in model parameters.
    Standard model of transient single-event upsets, but ignores burst errors, multi-bit upsets, and row-hammer patterns; stated in Section IV-G.
  • domain assumption Degree-2 polynomial activations adequately replace ReLU for CKKS inference.
    Standard in HE-CNN work; Table I shows a nontrivial accuracy drop from this replacement, so the assumption is load-bearing.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption." pith.science (2026). https://pith.science/paper/4PJIIXAS

@misc{pith2026260718342,
  author       = {Pith},
  title        = {Pith review of: PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4PJIIXAS}},
  note         = {Machine review of arXiv:2607.18342}
}
read the original abstract

Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.

Figures

Figures reproduced from arXiv: 2607.18342 by the authors.

Figure 1
Figure 1. End-to-end PSAP pipeline: optimization phases (top), reliability evaluation (top-right), and deployed encrypted inference (bottom). [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Rotation savings vs. target sparsity for magnitude pruning, PSAP with uniform layer-wise sparsity, and PSAP with sensitivity-protected layer-wise [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Post-fault accuracy vs. BER for int32, float32, and CKKS bit-flip modes across all four configurations. Error bars on the int32 curves are 95% CIs over [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Silent Data Corruption (SDC) rate vs. BER for int32, float32, and CKKS modes across all four configurations. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Logit MAE (log scale) vs. BER for int32 and CKKS modes across all four configurations. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: The Overflow Cascade mechanism: scale-bit growth under mixed-degree activation allocation in CKKS. Forward inference: sequential CKKS activations [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Per-layer-group vulnerability heatmap across three BER levels and all four configurations. Values are per-group worst-case accuracy drops (pp). [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 1 linked inside Pith

  1. [1]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inAdvances in Cryptology – ASIACRYPT 2017. Springer International Publishing, 2017, pp. 409–437

    2017

  2. [2]

    Algorithms in HElib,

    S. Halevi and V . Shoup, “Algorithms in HElib,” inAdvances in Cryptology – CRYPTO 2014. Springer Berlin Heidelberg, 2014, pp. 554–571

    2014

  3. [3]

    Hunter: HE-friendly structured pruning for efficient privacy-preserving deep learning,

    Y . Cai, Q. Zhang, R. Ning, C. Xin, and H. Wu, “Hunter: HE-friendly structured pruning for efficient privacy-preserving deep learning,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security. Association for Computing Machinery, 2022, pp. 931–945

    2022

  4. [4]

    SpENCNN: Orchestrating encoding and sparsity for fast homomorphically encrypted neural network inference,

    R. Ran, X. Luo, W. Wang, T. Liu, G. Quan, X. Xu, C. Ding, and W. Wen, “SpENCNN: Orchestrating encoding and sparsity for fast homomorphically encrypted neural network inference,” inProceedings of the 40th International Conference on Machine Learning, vol. 202. PMLR, 2023, pp. 28 718–28 728

    2023

  5. [5]

    MOSAIC: A prune- and-assemble approach for efficient model pruning in privacy-preserving deep learning,

    Y . Cai, Q. Zhang, R. Ning, C. Xin, and H. Wu, “MOSAIC: A prune- and-assemble approach for efficient model pruning in privacy-preserving deep learning,” inProceedings of the 19th ACM Asia Conference on Computer and Communications Security. Association for Computing Machinery, 2024, pp. 1034–1048

    2024

  6. [6]

    PrivCirNet: Efficient private inference via block circulant transformation,

    T. Xu, L. Wu, R. Wang, and M. Li, “PrivCirNet: Efficient private inference via block circulant transformation,” inAdvances in Neural Information Processing Systems, vol. 37. Curran Associates, Inc., 2024, pp. 111 802– 111 831

    2024

  7. [7]

    The soft error problem: An architectural perspective,

    S. S. Mukherjee, J. Emer, and S. K. Reinhardt, “The soft error problem: An architectural perspective,”Proceedings of the 11th International Symposium on High-Performance Computer Architecture, pp. 243–247, 2005

    2005

  8. [8]

    Radiation-induced soft errors in advanced semiconduc- tor technologies,

    R. C. Baumann, “Radiation-induced soft errors in advanced semiconduc- tor technologies,”IEEE Transactions on Device and Materials Reliability, vol. 5, no. 3, pp. 305–316, 2005

    2005

Show all 35 references
  1. [9]

    Ares: A framework for quantifying the resilience of deep neural networks,

    B. Reagen, U. Gupta, L. Pentecost, P. Whatmough, S. K. Lee, N. Mulhol- land, D. Brooks, and G.-Y . Wei, “Ares: A framework for quantifying the resilience of deep neural networks,” inProceedings of the 55th Annual Design Automation Conference, 2018, pp. 17:1–17:6

    2018

  2. [10]

    Understanding error propagation in deep learning neural network (DNN) accelerators and applications,

    G. Li, S. K. S. Hari, M. Sullivan, T. Tsai, K. Pattabiraman, J. Emer, and S. W. Keckler, “Understanding error propagation in deep learning neural network (DNN) accelerators and applications,” inProceedings of the International Conference for High Performance Computing, Network...

    2017

  3. [11]

    Optimizing selective protection for CNN resilience,

    A. Mahmoud, S. K. S. Hari, C. W. Fletcher, S. V . Adve, C. Sakr, N. Shanbhag, P. Molchanov, M. B. Sullivan, T. Tsai, and S. W. Keckler, “Optimizing selective protection for CNN resilience,” in2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE), 2...

    2021

  4. [12]

    BinFI: An efficient fault injector for safety-critical machine learning systems,

    Z. Chen, G. Li, K. Pattabiraman, and N. DeBardeleben, “BinFI: An efficient fault injector for safety-critical machine learning systems,” in Proceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis, 2019, pp. 1–23

    2019

  5. [13]

    Reliability analysis of fully homo- morphic encryption systems under memory faults,

    R. A. Rajagede and Y . Solihin, “Reliability analysis of fully homo- morphic encryption systems under memory faults,”arXiv preprint arXiv:2509.20686, 2025

    2025

  6. [14]

    On the vulnerability of FHE computation to silent data corruption,

    J. Mu, G. Yu, Z. Kan, S. Bian, L. Kong, Z. Liu, C. Liu, J. Ye, and H. Li, “On the vulnerability of FHE computation to silent data corruption,”arXiv preprint arXiv:2603.23253, 2026

    2026

  7. [15]

    CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy,

    R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy,” inProceedings of The 33rd International Conference on Machine Learning, vol. 48, 2016, pp. 201– 210

    2016

  8. [16]

    GAZELLE: A low latency framework for secure neural network inference,

    C. Juvekar, V . Vaikuntanathan, and A. Chandrakasan, “GAZELLE: A low latency framework for secure neural network inference,” in27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 1651–1669

    2018

  9. [17]

    CryptoNAS: Private inference on a ReLU budget,

    Z. Ghodsi, A. K. Veldanda, B. Reagen, and S. Garg, “CryptoNAS: Private inference on a ReLU budget,” inAdvances in Neural Information Processing Systems, vol. 33, 2020, pp. 16 961–16 971

    2020

  10. [18]

    Privacy-preserving machine learning with fully homomorphic encryption for deep neural networks,

    J.-W. Lee, H. Kang, Y . Lee, W. Choi, J. Eom, M. Deryabin, E. Lee, J. Lee, D. Yoo, Y .-S. Kim, and J.-S. No, “Privacy-preserving machine learning with fully homomorphic encryption for deep neural networks,” IEEE Access, vol. 10, pp. 30 039–30 054, 2022

    2022

  11. [19]

    HyPHEN: A hybrid packing method and its optimizations for homomorphic encryption-based neural networks,

    D. Kim, J. Park, J. Kim, S. Kim, and J. H. Ahn, “HyPHEN: A hybrid packing method and its optimizations for homomorphic encryption-based neural networks,”IEEE Access, vol. 12, pp. 3024–3038, 2024

    2024

  12. [20]

    Efficient pruning for machine learning under homomorphic encryption,

    E. Aharoni, M. Baruch, P. Bose, A. Buyuktosunoglu, N. Drucker, S. Pal, T. Pelleg, K. Sarpatwar, H. Shaul, O. Soceanu, and R. Vaculin, “Efficient pruning for machine learning under homomorphic encryption,” inComputer Security – ESORICS 2023. Springer Nature Switzerland, 2024, p...

    2023

  13. [21]

    MOFHEI: Model optimizing framework for fast and efficient homomor- phically encrypted neural network inference,

    P. Ghazvinian, R. Podschwadt, P. Panzade, M. H. Rafiei, and D. Takabi, “MOFHEI: Model optimizing framework for fast and efficient homomor- phically encrypted neural network inference,” inIEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, a...

    2024

  14. [22]

    AutoFHE: Automated adaption of CNNs for efficient evaluation over FHE,

    W. Ao and V . N. Boddeti, “AutoFHE: Automated adaption of CNNs for efficient evaluation over FHE,” in33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, 2024, pp. 2173–2190

    2024

  15. [23]

    Pruning filters for efficient convnets,

    H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. P. Graf, “Pruning filters for efficient convnets,” in5th International Conference on Learning Representations, ICLR 2017,Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017

    2017

  16. [24]

    Channel pruning for accelerating very deep neural networks,

    Y . He, X. Zhang, and J. Sun, “Channel pruning for accelerating very deep neural networks,” in2017 IEEE International Conference on Computer Vision (ICCV), 2017, pp. 1398–1406

    2017

  17. [25]

    TFHE: Fast fully homomorphic encryption over the torus,

    I. Chillotti, N. Gama, M. Georgieva, and M. Izabach `ene, “TFHE: Fast fully homomorphic encryption over the torus,”Journal of Cryptology, vol. 33, no. 1, pp. 34–91, 2020

    2020

  18. [26]

    GlitchFHE: Attacking fully homomorphic encryption using fault injection,

    L. L. Mankali, M. Nabeel, F. Raees, M. Maniatakos, O. Sinanoglu, and J. Knechtel, “GlitchFHE: Attacking fully homomorphic encryption using fault injection,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 8481–8500

    2025

  19. [27]

    Self-learning activation functions to increase accuracy of privacy-preserving convolutional neural networks with homomorphic encryption,

    B. Pulido-Gaytan and A. Tchernykh, “Self-learning activation functions to increase accuracy of privacy-preserving convolutional neural networks with homomorphic encryption,”PLOS ONE, vol. 19, no. 7, p. e0306420, 2024

    2024

  20. [28]

    Highly accurate cnn inference using approximate activation functions over homomorphic encryption,

    T. Ishiyama, T. Suzuki, and H. Yamana, “Highly accurate cnn inference using approximate activation functions over homomorphic encryption,” in 2020 IEEE International Conference on Big Data, 2020, pp. 3989–3995

    2020

  21. [29]

    Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys,

    J.-P. Bossuat, C. Mouchet, J. Troncoso-Pastoriza, and J.-P. Hubaux, “Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys,” inAdvances in Cryptology – EUROCRYPT 2021. Springer International Publishing, 2021, pp. 587–617

    2021

  22. [30]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  23. [31]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009

    2009

  24. [32]

    DeepReDuce: ReLU reduction for fast private inference,

    N. K. Jha, Z. Ghodsi, S. Garg, and B. Reagen, “DeepReDuce: ReLU reduction for fast private inference,” inProceedings of the 38th Interna- tional Conference on Machine Learning, vol. 139. PMLR, 2021, pp. 4839–4849

    2021

  25. [33]

    OpenFHE: Open-source fully homomorphic encryption library,

    A. Al Badawi, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Lee, Z. Liu, D. Miccian- cio, I. Quah, Y . Polyakov, R. V . Saraswathy, K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V . Vaikuntanathan, and V . Zucca, “OpenFHE...

    2022

  26. [34]

    Statistical fault injection: Quantified error and confidence,

    R. Leveugle, A. Calvez, P. Maistri, and P. Vanhauwaert, “Statistical fault injection: Quantified error and confidence,” inDesign, Automation & Test in Europe Conference & Exhibition, 2009, pp. 502–506

    2009

  27. [35]

    AESPA: Accuracy preserving low-degree polynomial activation for fast private inference,

    J. Park, M. J. Kim, W. Jung, and J. H. Ahn, “AESPA: Accuracy preserving low-degree polynomial activation for fast private inference,” arXiv preprint arXiv:2201.06699, 2022

    2022 arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.