{"id":"6f6a6270-62d5-4aa9-bc46-a731e349c2fe","arxiv_id":"1908.06972","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"PrivFT performs fastText text classification on homomorphically encrypted inputs, with GPU inference under 0.66 seconds and a five-day encrypted training run on one dataset.","lead":"PrivFT uses fully homomorphic encryption to classify encrypted text without ever decrypting it, reporting under 0.66 seconds per inference on a GPU. The same system also trains a text classifier on encrypted data, taking about five days on eight GPUs, and may interest anyone building privacy-preserving cloud services.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Encrypted-training claim rests on an unvalidated quadratic softmax surrogate (Sec. 4.2) and a single run on one dataset; without error analysis or a plaintext ablation, the 5.04-day/86.3% result is not established.","rationale":"The GPU CKKS implementation and the sub-second inference experiments are concrete engineering contributions: Table 2 gives primitive latencies, Table 4 reports averages over 100 runs, and the inference path is a short arithmetic circuit with no softmax evaluated on the server. I do not object to those parts. The same cannot be said for encrypted training. The training section is the only part that claims a new algorithmic capability, and its linchpin is an unexamined polynomial substitution for softmax. The paper itself flags that experiment 3 was run once, and the availability statement promises code only at publication. A single favorable run on 1,956 comments cannot support a general claim that an effective model can be trained on encrypted data. The natural next step is a cheap plaintext ablation of the polynomial loss: it isolates the approximation question from cryptographic noise and would either validate or refute the load-bearing assumption. I therefore keep the reader's CONDITIONAL verdict: the inference contribution can stand, but the training claim is unverified until the polynomial is analyzed or ablated. I partially agree with the reader's weakest_assumption: the unvalidated softmax surrogate is the same load-bearing concern, while the word-count leakage is a genuine but less central privacy caveat.","tokens_in":20491,"tokens_out":7732,"duration_ms":77862,"concrete_test":"Run the plaintext analogue of Algorithm 5 with P(X) substituted for softmax on at least three datasets (YouTube Spam, IMDB, AGNews), using the paper's training protocol (beta = 1,007,500 tokens, 2 epochs, large-minibatch GD with the same learning rate and initialization scheme). Compare the resulting test accuracy against fastText's standard softmax large-minibatch baseline, and record the range and quantiles of the logits fed to P. If accuracy drops by more than about 1-2 points on any dataset, or if the maximum |P(x) - softmax(x)| over the observed logit range exceeds about 0.05, the Section 4.2 'no noticeable accuracy loss' assertion is refuted. This requires the authors to release the promised code; without code, the one-run YouTube result cannot be independently checked.","verdict_should_be":"UNCHANGED","load_bearing_attack":"PrivFT's second headline contribution, training an effective model on encrypted data, depends on the assertion in Section 4.2 that the polynomial P(X) = (1/8)X^2 + (1/2)X + 1/4 is a 'good approximation' to softmax with 'no noticeable accuracy loss.' The paper gives no minimax interval, no approximation-error bound, and no comparison of P against softmax on the logit distribution actually produced by large-minibatch training. This matters because P is not a probability map: on the unit interval it is a monotone rescaling (P(0)=0.25, P(1)=0.875), so it may preserve argmax for inference, but its use inside the training loss changes the loss landscape relative to cross-entropy in an unexamined way. The only empirical support is experiment 3, run once on YouTube Spam (Section 6.1), and the reported equality of 86.3% is to fastText trained with large-minibatch GD, not necessarily to the standard softmax SGD model. If P does not faithfully mimic softmax under these hyperparameters, the training claim is unsupported; nothing in the paper would predict how much accuracy degrades. The inference claim is unaffected by this concern, since inference uses plaintext model arithmetic and client-side argmax.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PrivFT, a system for text classification over CKKS homomorphically encrypted data, with two claimed capabilities: (i) inference on encrypted client inputs using a plaintext fastText model, where the client performs tokenization and one-hot encoding and the server computes embedding and class scores homomorphically, and (ii) training a fastText model entirely on encrypted data using minibatch gradient descent with a quadratic polynomial approximation to softmax. The authors contribute a GPU implementation of an RNS variant of CKKS, report 1 to 2 orders of magnitude speedups over Microsoft SEAL on core primitives, report inference latency below 0.66 seconds per example on GPU for six datasets, and report encrypted training on the YouTube Spam dataset in 5.04 days on an 8-GPU DGX-1, with accuracy claimed equal to plaintext large-minibatch training (86.3%). The paper also reports communication sizes for both tasks.","tokens_in":20775,"tokens_out":4244,"duration_ms":44946,"significance":"If the claims hold, the inference result is a meaningful practical data point for FHE-based private text classification: sub-second encrypted inference for a shallow text classifier, with a concrete GPU implementation and a careful comparison to a CPU library, would be a useful engineering contribution. The encrypted-training result, by contrast, is more speculative: it depends on an unvalidated polynomial surrogate for softmax and is supported by a single run on a single dataset. The paper does not ship code (availability is only promised), and the 'zero loss to prediction accuracy' claim is not backed by any measured encrypted-inference accuracy. The GPU CKKS microbenchmarks in Table 2 are concrete and averaged over 100 runs, and the inference latency numbers in Table 4 are similarly concrete; these are the strongest parts of the paper.","major_comments":[{"comment":"The headline claim of 'zero loss to prediction accuracy' is asserted without reporting a single encrypted-inference accuracy number. The only accuracy table, Table 3, lists accuracies of the plaintext fastText model, and the text does not compare plaintext scores with decrypted scores or report classification accuracy on encrypted inputs. Because CKKS is approximate and the inference circuit includes rotations, rescaling, and fixed-point precision rho=40, the reader cannot verify that the precision loss is actually zero; please add an encrypted-vs-plaintext accuracy comparison, or at least a distribution of plaintext-vs-decrypted score errors, for the six datasets.","section":"Section 6.6.1, Table 4"},{"comment":"The encrypted training contribution rests on the unvalidated claim that P(X) = (1/8)X^2 + (1/2)X + 1/4 is 'a good approximation' to softmax with 'no noticeable accuracy loss.' No minimax interval, approximation-error bound, or comparison of P with softmax on the logit distribution produced by large-minibatch GD is provided, and P is not a probability map over the unit interval (P(0)=0.25, P(1)=0.875). The only empirical support is a single run (Section 6.1, experiment 3) on one dataset, with accuracy reported only against plaintext large-minibatch GD, not against the standard softmax-SGD model. Please provide either a rigorous error analysis or a plaintext ablation (standard softmax vs P on multiple datasets and hyperparameter settings) before the training claim can be accepted.","section":"Section 4.2, Section 6.6.2"},{"comment":"The privacy guarantee is weaker than stated because the server receives the client's one-hot vector v and the plaintext word count w, revealing the bag-of-words representation and the document length. The paper should state this limitation explicitly and discuss whether it is acceptable for the intended MLaaS and e-mail use cases; if not, this undermines the statement in Section 1.1 that 'our solution as secure as the encryption scheme itself.'","section":"Section 4.1, Section 1.1"},{"comment":"The description of the encrypted training protocol is not sufficiently complete to be independently reproduced. Algorithm 5 omits how the encrypted labels are represented, how the quadratic loss is computed against encrypted labels, how gradients are extracted from encrypted weight matrices, and how the per-minibatch depth budget of 9 levels is derived. Because the 5.04-day figure and the 86.3% accuracy claim depend on these implementation choices, please specify the full encrypted training circuit or provide the source code.","section":"Section 6.6.2, Algorithm 5"}],"minor_comments":[{"comment":"The SEAL version is stated inconsistently: Section 5.2 says SEAL v3.3.0, while Section 6.5 and the reference list refer to version 3.2.","section":"Section 5.2 vs Section 6.5"},{"comment":"Table 4 includes YouTube Spam and Enron Email, but Table 3 does not report plaintext accuracy for those datasets; add them to support the zero-loss claim or clarify why they are omitted.","section":"Table 4"},{"comment":"The text cites a 'Minimax approximation algorithm' but gives no interval, degree, or reference for the approximation; state the approximation setup more precisely.","section":"Section 4.2"},{"comment":"The notation such as c_i[j]_{p_k} and |c|_{p_l} is not defined before use; define the residue notation or refer to a standard source.","section":"Equation (1), Algorithm 4"},{"comment":"The client-to-server message size of 384.375 MB per inference is a notable practical cost but is only reported in passing; a sentence discussing its impact on end-to-end latency or feasibility would help.","section":"Section 6.6.1, Message Size"}],"recommendation":"major_revision","confidential_remarks":"The paper's main engineering contribution, the GPU CKKS implementation, is solid and the latency measurements are concrete. The largest risks are the unvalidated softmax surrogate for training and the absence of measured encrypted inference accuracy. If the authors can supply even a small encrypted-accuracy table and one additional plaintext ablation for the polynomial loss, the central claims would be much better supported. I would also encourage the editor to insist on source code release, since the promised availability statement is not yet fulfilled."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth reading for the inference half; the training half is a proof of concept with a hole in the middle. What's genuinely new: a GPU implementation of RNS-CKKS with 1-2 orders of magnitude speedup over SEAL, and an end-to-end encrypted fastText inference that runs under 0.66 seconds per example. The benchmark methodology is sound (100-run averages, concrete parameter sets), and the design choices—client-side one-hot encoding, server-side linear arithmetic only, client-side argmax—are sensible and keep the multiplicative depth at 5. The engineering (RNS rescale via floor, ordered prime chain, tiling to fit GPU memory) is credible.\n\nThe soft spots are real but not fatal. First, the 'zero loss to prediction accuracy' claim for inference is asserted, not measured. Since CKKS is approximate, an occasional argmax flip is possible; the parameters likely make it rare, but the paper should show measured encrypted accuracy on the six datasets instead of pointing to plaintext fastText accuracy. Second, the training contribution rests on the unexamined claim that P(X)=1/8 X^2 + 1/2 X + 1/4 is a good softmax approximation. No interval, no error bound, no comparison of P-trained vs softmax-trained accuracy. The result is a single run on one dataset, compared against large-minibatch GD rather than standard fastText. That's enough to call it a feasibility demo, but not enough to claim that encrypted training works generally. The authors do acknowledge some of this in the discussion, which helps. Third, the paper leaks document length (w is sent in plaintext) and no code is actually released despite the promise. The communication-size numbers also look off by a factor of eight for inference; a quick sanity check suggests they used the training N=65536 in that calculation.\n\nThe citation pattern looks fine; the related work on FHE/MPC text classification is covered, and the novelty claims (first GPU RNS-CKKS, first encrypted NLP training) are plausible. The paper is honest about the high cost of training.\n\nWho is this for: anyone working on practical FHE or privacy-preserving ML as a service. The inference result is a real data point. The training part is a cautionary example of cost and a reminder that polynomial approximations need validation. I would send this to peer review with a request for the missing measurements and an ablation on the softmax surrogate. If the authors can supply those, the training claim becomes credible; without them, the paper should be revised to frame training purely as a proof of concept.","headline":"A solid GPU/CKKS engineering paper whose sub-second encrypted inference is the real result; the encrypted-training claim needs the softmax surrogate to be validated before it can be taken at face value.","tokens_in":21331,"tokens_out":5979,"would_cite":true,"duration_ms":59220,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PrivFT claims that encrypted text classification can run in under 0.66 seconds per example on a GPU with no loss in accuracy, and that encrypted training on a small dataset takes 5.04 days on an 8-GPU machine.","keywords":["fully homomorphic encryption","CKKS","fastText","text classification","private inference","encrypted training","GPU acceleration","softmax approximation"],"falsifier":"Run the encrypted inference path on any document and compare the decrypted class scores to plaintext fastText scores on the same input: any change in the argmax falsifies the zero-loss claim. Then retrain on a second dataset, such as IMDB or AGNews, using the same large-minibatch quadratic-softmax recipe and compare accuracy to plaintext large-minibatch fastText; a material drop would falsify the claim that encrypted training matches plaintext training.","tokens_in":20251,"feed_emoji":"🔐","tokens_out":8644,"duration_ms":83333,"temperature":0.7,"pith_summary":"The paper sets out to prove that text classification can be run on encrypted data at a speed that makes the privacy-protecting version usable. It claims that PrivFT, built on the fastText classifier and the CKKS homomorphic encryption scheme, evaluates an encrypted client input in 0.23–0.66 seconds on a GPU while producing exactly the same predictions as the unencrypted model, and that it can train a model from an encrypted dataset in 5.04 days on an 8-GPU machine with accuracy equal to plaintext large-minibatch training. If true, this means a cloud service can classify spam, sentiment, or topic of a text message without ever seeing the message, with the client decrypting the result locally. The caveat is that the encrypted training route currently works only under a polynomial approximation of the softmax scoring function and a very large-minibatch schedule, and the training result rests on a single dataset.","feed_headline":"Encrypted text classification runs in under 0.66 seconds","feed_subtitle":"A homomorphic fastText pipeline matches plaintext accuracy on six datasets and trains on encrypted data in five days.","key_machinery":"The load-bearing mechanism is CKKS, the Cheon-Kim-Kim-Song levelled fully homomorphic encryption scheme for approximate real numbers, implemented in its residual number system (RNS) variant and packed so that vectors of up to N/2 real numbers sit in the slots of a single ciphertext. That packing turns the hidden-layer lookup $v\\cdot H$ into a sequence of plaintext-ciphertext multiplications and rotation-based total sums, and the output-layer score computation into $n$ plaintext multiplications and additions. The system's depth is kept to 3 multiplications for inference and 46 levels for training by pushing softmax to the client in inference and by replacing it with the degree-2 polynomial $\\frac{1}{4}+\\frac{1}{2}X+\\frac{1}{8}X^2$ in training, combined with minibatch sizes near one million tokens so that weight updates happen only five times per epoch.","core_discovery":"PrivFT's central discovery is that a shallow bag-of-words text classifier is small enough and linear enough to be moved almost entirely into ciphertext-space arithmetic. For inference, only the final argmax/softmax decision stays on the client: the client sends a 1-hot bag-of-words vector encrypted under CKKS plus the plaintext word count, and the server evaluates two vector-matrix multiplications using packed SIMD ciphertexts. Because the encrypted computation is algebraically identical to the plaintext fastText score computation, the decrypted scores match exactly, giving 91.49–98.80% accuracy on six public datasets with GPU latency under 0.66 seconds per example. For training, the softmax loss is replaced by the quadratic polynomial $\\frac{1}{8}X^2+\\frac{1}{2}X+\\frac{1}{4}$, and stochastic gradient descent is replaced by two epochs of very large minibatches so the total homomorphic circuit needs only 46 levels; on the YouTube Spam Collection this yields 86.3% accuracy after 5.04 days on an 8-GPU system, the same as plaintext large-minibatch fastText.","pith_inferences":["Editorial inference: the same client-side linearization trick—precompute the bag-of-words vector and leave nonlinear scoring to the client—should carry over to logistic regression, linear SVMs, and other shallow classifiers, not just fastText.","Editorial inference: the single-dataset training evaluation leaves open whether the quadratic softmax is a good approximation generally; testing it on sentiment or topic datasets would be the natural next experiment.","Editorial inference: one could remove the document-length leak by padding encodings to a fixed word count and encrypting the count, at the price of larger ciphertexts and slower inference; the paper does not explore this variant.","Editorial inference: the reported 0.23–0.66 seconds covers server-side homomorphic evaluation only; a user-facing latency number would also include the 384 MB upload and client-side tokenization and encoding."],"forward_implications":["Any organization that already uses a shallow bag-of-words linear classifier can provide encrypted inference at sub-second latency and exactly the same predictions as its plaintext service.","The encrypted-training recipe, if reproducible on other datasets, would let a client hand an encrypted dataset to a cloud provider and receive back an encrypted model, with no party other than the client ever seeing data or model.","The design trades a small metadata leak—plaintext word count and the bag-of-words encoding prepared by the client—for the large speed gain of avoiding homomorphic tokenization and dictionary lookup.","The GPU speedups of one to two orders of magnitude over CPU suggest that further gains will come from memory management and tiling rather than from faster ciphertext arithmetic.","Tasks with more than N/2 classes or deeper architectures would break the current packing scheme and depth budget, so the method is specific to classification problems with few classes and small multiplicative depth."],"supporting_citations":[{"why":"Supplies the fastText architecture and its bag-of-words training approach that PrivFT adapts to the encrypted setting.","marker":"[37]"},{"why":"Introduces the CKKS scheme for approximate arithmetic on encrypted real numbers, which is the cryptographic foundation of PrivFT.","marker":"[16]"},{"why":"Provides the full residual number system variant of CKKS that the GPU implementation follows.","marker":"[14]"},{"why":"The CPU CKKS implementation used as the baseline whose primitive latencies are compared to measure GPU speedups.","marker":"[50]"},{"why":"Supplies the GPU polynomial arithmetic, RNS, and discrete Galois transform routines on which the implementation is built.","marker":"[1,2]"},{"why":"Gives the TotalSum procedure used to accumulate packed slots via ciphertext rotations.","marker":"[31]"},{"why":"Sets the security parameter recommendations that justify the CKKS parameter choices.","marker":"[3]"},{"why":"Supports the premise that very large minibatch SGD can train accurate models, which the encrypted training schedule relies on.","marker":"[29]"}],"fun_headline_variants":["Encrypted text inference under 0.66 seconds, zero accuracy loss","Private text classification: fast encrypted inference and training","GPU-accelerated homomorphic encryption for text classification","Fully encrypted training and inference for text classification","Homomorphic encryption makes text classification private and fast"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that the quadratic polynomial $\\frac{1}{8}X^2+\\frac{1}{2}X+\\frac{1}{4}$ can stand in for the softmax scoring function without a meaningful accuracy loss; the paper supports this with one dataset and one training run.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted text inference under 0.66 seconds, zero accuracy loss","Private text classification: fast encrypted inference and training","GPU-accelerated homomorphic encryption for text classification","Fully encrypted training and inference for text classification","Homomorphic encryption makes text classification private and fast"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000521,"raw_usage":{"total_tokens":2559,"prompt_tokens":1021,"completion_tokens":1538,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":637,"completion_tokens_details":{"reasoning_tokens":1461}},"tokens_in":637,"tokens_out":1538,"duration_ms":11520,"temperature":1.0,"reasoning_tokens":1461,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:40:08.743538+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the encrypted inference path on any document and compare the decrypted class scores to plaintext fastText scores on the same input: any change in the argmax falsifies the zero-loss claim. Then retrain on a second dataset, such as IMDB or AGNews, using the same large-minibatch quadratic-softmax recipe and compare accuracy to plaintext large-minibatch fastText; a material drop would falsify the claim that encrypted training matches plaintext training.","supporting_citations":[{"cited_title":"Homomorphic encryption for arithmetic of ap- proximate numbers","cited_arxiv_id":null,"evidence_quote":"Introduces the CKKS scheme for approximate arithmetic on encrypted real numbers, which is the cryptographic foundation of PrivFT."},{"cited_title":"A full RNS variant of approximate homomorphic encryption","cited_arxiv_id":null,"evidence_quote":"Provides the full residual number system variant of CKKS that the GPU implementation follows."},{"cited_title":"http://sealcrypto.org, 2017","cited_arxiv_id":null,"evidence_quote":"The CPU CKKS implementation used as the baseline whose primitive latencies are compared to measure GPU speedups."},{"cited_title":"Algorithms in HElib","cited_arxiv_id":null,"evidence_quote":"Gives the TotalSum procedure used to accumulate packed slots via ciphertext rotations."},{"cited_title":"Homomor- phic encryption security standard","cited_arxiv_id":null,"evidence_quote":"Sets the security parameter recommendations that justify the CKKS parameter choices."},{"cited_title":"Accurate, large minibatch sgd: Training imagenet in 1 hour, 2017","cited_arxiv_id":null,"evidence_quote":"Supports the premise that very large minibatch SGD can train accurate models, which the encrypted training schedule relies on."}],"review_version":1}