{"id":"9b7adfd2-04e6-46a9-979b-7916608e1a15","arxiv_id":"2506.19693","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"ReBoot adapts CKKS homomorphic encryption, local-loss blocks, and a polynomial ReLU to train MLPs on encrypted data, but only one of its dataset results was produced by actually encrypted training.","lead":"ReBoot claims to be the first system to train real-valued neural networks on encrypted data using the CKKS homomorphic encryption scheme with bootstrapping, without client interaction. The catch is that most of the reported accuracy results come from plaintext training, so the headline claim is only demonstrated for one small model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"All reported accuracy beyond one shallow MNIST encrypted run comes from plaintext training (Section 5.2); the central claim of encrypted FP32-comparable accuracy and arbitrarily deep training is therefore unverified.","rationale":"The reader identifies exactly the assumption I consider load-bearing, so I agree. In good faith, ReBoot makes a plausible technical contribution: an architecture that avoids full backpropagation through the network, a packing scheme for SIMD CKKS, and a real encrypted training run on eMLP-1/MNIST. That run is genuine evidence that the forward pass, local gradients, and weight updates can be executed under CKKS with bootstrapping for a shallow network. But the paper's strongest claim is broader and is stated in the abstract, introduction, and conclusions: ReBoot enables fully encrypted training of DNNs with accuracy comparable to FP32 plaintext training, for arbitrarily deep MLPs. The evidence for that claim is one encrypted MNIST run on the shallowest architecture and a suite of plaintext experiments on all other datasets and on eMLP-2/eMLP-3. Section 5.2 explicitly says subsequent experiments use plaintext training. Since CE-Blocks have a different multiplicative-depth profile and the deeper architectures never run under encryption, there is no basis to assume that the noise management demonstrated on a 32-neuron RE-Block transfers. The arbitrarily deep claim is even less supported: no encrypted network beyond three hidden layers is attempted, and the bootstrapping schedule in Algorithm 1 refreshes weights and velocities but not the activations consumed by subsequent blocks. Given the paper's own statement that CKKS bootstrapping does not reduce accumulated noise, the scalability claim requires either additional bootstrapping of activations or an experimental demonstration; neither is provided. The promised repository is also absent, which prevents checking whether the plaintext experiments use the same hyperparameters as the encrypted ones. These gaps make the reader's REJECT verdict appropriate; the verdict should remain unchanged. A revision that reported encrypted runs for at least eMLP-2/eMLP-3 on image and tabular benchmarks, with released code, could support a CONDITIONAL or ACCEPT verdict.","tokens_in":24973,"tokens_out":5240,"duration_ms":52120,"concrete_test":"Run the complete encrypted training procedure from Algorithm 1 with the CKKS parameters in Table 3 for eMLP-3 on MNIST and Kuzushiji-MNIST, decrypt only at the end, and compare final test accuracy and training curves against the plaintext ReBoot runs in Table 4 over at least 3 seeds. If encrypted accuracy tracks plaintext within the reported variance, the extrapolation is partially validated; if it diverges or fails to converge, the plaintext experiments cannot be reported as encrypted-training accuracy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing premise is that the CKKS encrypted pipeline behaves identically to plaintext training of the same ReBoot architecture on all benchmark configurations. Section 5.2 states this directly: 'Given this demonstrated alignment... subsequent ReBoot accuracy experiments are conducted using plaintext training.' The demonstrated alignment rests on a single experiment: eMLP-1 (one RE-Block, width 32) on MNIST, shown in Figure 2. Tables 4 and 5, including the headline +3.27% and +6.83% improvements and all comparisons with FP32 BP, are therefore plaintext numbers, not encrypted-training results. This matters structurally, because eMLP-2 and eMLP-3 introduce CE-Blocks whose forward pass has multiplicative depth 3 (vs. 2) and backward pass depth 5 (vs. 4) per Table 1; noise accumulation and bootstrapping behavior differ from the only validated RE-Block case. The abstract additionally claims arbitrarily deep encrypted training, yet no encrypted run with more than one hidden layer is reported, and Algorithm 1 only bootstraps weights and velocities, not activations flowing across blocks, while Section 3 notes that CKKS bootstrapping does not refresh accumulated noise. Thus the central claim that ReBoot achieves accuracy comparable to FP32 plaintext training under full encryption is not supported by the experiments presented.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ReBoot, a framework for non-interactive encrypted training of multi-layer perceptrons under the CKKS homomorphic encryption scheme. The contribution is a combination of a packing strategy that exploits CKKS SIMD operations, an MLP architecture based on local-loss blocks to limit multiplicative depth, and an encrypted training algorithm that uses approximate bootstrapping on weights and velocities. The paper reports a precision study on one shallow architecture and then gives accuracy and latency comparisons on image and tabular benchmarks, claiming accuracy comparable to FP32 plaintext training, improvements over prior encrypted logistic regression and encrypted DNN frameworks, and support for arbitrarily deep MLPs.","tokens_in":25253,"tokens_out":5225,"duration_ms":51438,"significance":"If fully substantiated, ReBoot would be a notable step: it would be among the first demonstrations of non-interactive, real-valued encrypted DNN training with CKKS, and its packing and local-loss design could be of practical value for encrypted ML as-a-service. The conceptual material on multiplicative-depth reduction and ciphertext packing is interesting. However, the supporting evidence is currently much narrower than the claims: only one encrypted training run on eMLP-1/MNIST is reported, all other accuracy numbers come from plaintext training, and the stated training algorithm contains apparent mathematical errors in the backward pass. The paper's central contribution is therefore not yet demonstrated by the presented experiments.","major_comments":[{"comment":"The headline accuracy results are not encrypted-training results. Section 5.2 explicitly states: \"Given this demonstrated alignment… subsequent ReBoot accuracy experiments are conducted using plaintext training.\" Consequently, Tables 4 and 5, the abstract's +3.27% and +6.83% improvements, and the claim of accuracy comparable to FP32 plaintext training all rest on plaintext training of the ReBoot architecture for every configuration except the eMLP-1/MNIST precision study. That validation is a single one-hidden-layer RE-Block network; eMLP-2 and eMLP-3 contain CE-Blocks with larger forward and backward multiplicative depth (Table 1), and no encrypted run with more than one hidden layer is reported. The extrapolation from one shallow encrypted run to deeper architectures and to all tabular datasets is load-bearing and unverified.","section":"Section 5.2, Tables 4 and 5"},{"comment":"The backward pass through EncryptedPolyReLU is mathematically incorrect as written. The derivative of f(z)=z^2+z is 2z+1, so the chain rule requires delta_z = (2z+1) * delta_a; Algorithm 1, step 7 instead evaluates EncryptedPolyReLU' at delta_A, computing 1 + 2*delta_A. Additionally, Algorithm 1, line 10 passes delta_W^{t-1} for the local classifier into UpdateWeights, whereas the surrounding text and Algorithm 2 describe the update using the current gradient delta_W^t. If implemented literally, these errors would corrupt the training procedure; if they are presentation typos, they still need explicit correction because the algorithm as published is not executable as stated.","section":"Section 4.3.3, Algorithm 1"},{"comment":"The claim that ReBoot supports \"arbitrarily deep\" encrypted training is not supported by the algorithm or the experiments. Bootstrapping in Algorithm 1 (lines 11–12) is applied only to weights and velocities, not to activations flowing between local-loss blocks, while Section 3 correctly notes that CKKS bootstrapping does not reduce accumulated noise. Thus noise in the activation path accumulates with network depth, and no encrypted experiment with more than one hidden layer is reported to show that deeper CKKS training remains feasible or accurate.","section":"Section 4.3, Algorithm 1, Section 3"}],"minor_comments":[{"comment":"The terminology \"fully encrypted and non-interactive training of DNNs\" is broader than what is demonstrated; the experiments cover MLPs with at most three hidden layers and only one encrypted run, so the abstract should be qualified to \"MLPs\" and to the specific validated depth.","section":"Abstract and Section 1"},{"comment":"Footnote 1 says the code \"will be released in the next phase,\" while the abstract states that ReBoot \"is made available to the scientific community as a public repository\"; please provide the actual repository URL or remove the availability claim.","section":"Footnote 1 and Abstract"},{"comment":"The textual claim that ReBoot \"consistently outperforms prior encrypted DNN methods\" is contradicted by Table 5: on Penguins, ReBoot MLP[4-2-3] achieves 81.18% versus 92.20% for Colombo et al., and on Iris the ReBoot result has a standard deviation of 6.40, so the comparison should be discussed honestly rather than summarized as uniformly superior.","section":"Table 5"},{"comment":"The phrase \"exact match\" between plaintext and encrypted training accuracy is too strong given the precision decay shown in Figure 2b; please report a quantitative accuracy difference or an error bound instead of claiming an exact match.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The central gap is that nearly all headline accuracy numbers come from plaintext training, with only one shallow encrypted run as validation. I would ask the editor to require genuine encrypted-training runs for at least one deeper architecture and for the headline comparisons before the paper can be considered. The backward-pass errors in Algorithm 1 are also a serious correctness issue that must be resolved in the revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What's genuinely new here: ReBoot is the first CKKS-based framework that tries to train MLPs end-to-end without client interaction, and it does so with some thoughtful engineering. The packing scheme that alternates row/column encodings to avoid repacking is a real contribution. The local-loss block design that keeps backprop within a block and the multiplicative depth table (Table 1) are useful. And the one genuinely encrypted run they do — eMLP-1 on MNIST, 400 iterations, with bootstrapping — looks solid: the encrypted training curve matches plaintext closely, and the weight precision analysis is plausible. That is real evidence.\n\nThe problem is the gap between that single run and the paper's claims. Section 5.2 says clearly: 'subsequent ReBoot accuracy experiments are conducted using plaintext training.' So every accuracy number in Tables 4 and 5, including the headline +3.27% and +6.83% improvements and all FP32 comparisons, is a plaintext-trained model, not an encrypted one. The abstract says ReBoot achieves accuracy comparable to FP32 plaintext training 'while enabling fully encrypted training' — that is only demonstrated for one shallow network on one dataset. The 'arbitrarily deep' claim is never tested under encryption; eMLP-2 and eMLP-3 have higher multiplicative depth and different bootstrapping behavior, but they are never run encrypted. Code is promised but absent, which matters when the central check would be re-running their CKKS pipeline.\n\nTo be fair, the paper is not hiding this. The plaintext-training caveat is stated in Section 5.2, though it is buried after the precision analysis and the abstract does not reflect it. The authors may believe the alignment shown on eMLP-1 is enough to transfer to other configurations. I don't buy that. Depth-3 forward and depth-5 backward (CE-Blocks) accumulate noise differently than depth-2 forward and depth-4 backward (RE-Blocks), and the CKKS bootstrapping they use does not actually refresh noise. So the load-bearing assumption is unverified.\n\nWho is this for? Researchers in HE-ML will want to see the packing and local-loss design, even if they have to squint past the overclaimed results. The paper deserves a serious referee, but the referee should require either encrypted runs for the full benchmark suite or a rewritten abstract that limits the claim to the one validated case. As written, the central claim is not supported.\n\nI would not cite this in its current form, but it is close to something citable if the experiments are fixed. Bring it to the reading group with a caveat.","headline":"Original CKKS training framework undone by a central overclaim: only one shallow MNIST run is actually encrypted; all other accuracy numbers are plaintext.","tokens_in":25790,"tokens_out":1451,"would_cite":false,"duration_ms":16809,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ReBoot claims the first fully encrypted, non-interactive training of deep neural networks, with accuracy comparable to FP32 plaintext training.","keywords":["homomorphic encryption","CKKS","encrypted training","bootstrapping","multi-layer perceptrons","local error signals","SIMD packing","privacy-preserving machine learning"],"falsifier":"Run the actual encrypted training loop on eMLP-2 or eMLP-3 on MNIST, or on a tabular dataset such as Letter Recognition, and compare final test accuracy with the plaintext-trained numbers in the paper's Table 4; if the encrypted accuracy falls outside the reported standard-deviation bands, the equivalence claim is falsified. A second check is to measure encrypted weight precision on the deeper networks after several bootstrapping steps and test whether precision collapses below the level needed for classification.","tokens_in":24745,"feed_emoji":"🔐","tokens_out":8545,"duration_ms":79711,"temperature":0.7,"pith_summary":"ReBoot aims to show that multi-layer perceptrons can be trained end-to-end on encrypted data, with no interaction between the data owner and the training service, while keeping accuracy close to ordinary 32-bit floating-point training. The framework is built on the CKKS homomorphic encryption scheme, whose approximate arithmetic supports the real-valued operations of neural networks but accumulates noise with every multiplication. To make training fit inside CKKS's depth and noise budget, ReBoot splits the network into local-loss blocks, approximates ReLU by $z^2+z$, and uses a packing scheme that turns matrix multiplications into element-wise SIMD operations. If the central claim holds, a service provider could train a model without ever seeing the plaintext data, and the cost per training step would be roughly independent of layer width. The paper reports accuracy comparable to plaintext FP32 training across image and tabular benchmarks, with up to 8.83x lower per-iteration latency than prior encrypted-training frameworks.","feed_headline":"Fully encrypted neural-network training matches plaintext accuracy","feed_subtitle":"ReBoot trains MLPs over encrypted data with no client interaction, at plaintext-grade accuracy and up to 8.83x faster steps.","key_machinery":"The central mechanism is a pair of complementary packing formats together with local-loss blocks. ReBoot encodes every vector or matrix as a flattened $r \\times c$ matrix that fills all $N/2$ CKKS slots; inputs and activations appear either in a repeated format, where each row is a copy of the vector, or an expanded format, where each column is a copy, and weight matrices are encoded row-wise or column-wise. Alternating row-encrypted and column-encrypted fully-connected layers makes the output format of one layer exactly the input format of the next, so no homomorphic repacking is ever needed. A local-loss block couples one fully-connected layer, an EncryptedPolyReLU, and a small local classifier; because each block's gradient is computed from its own loss, the backward pass stays inside the block and the multiplicative depth per iteration is bounded by a constant plus $\\lfloor 2.5h \\rfloor$ forward depth, rather than growing linearly with total depth as in backpropagation. Approximate bootstrapping then refreshes the modulus of weights and velocity between iterations, which is what allows training to continue beyond the original leveled circuit's budget.","core_discovery":"On its own terms, the paper's discovery is that end-to-end encrypted training of multi-layer perceptrons is feasible under CKKS if the network and optimizer are redesigned together. ReBoot alternates row-encoded and column-encoded fully-connected layers so that forward and backward passes are built from element-wise multiplications, additions, and rotations only; activations use EncryptedPolyReLU, $\\tilde{A} = (\\tilde{Z} \\odot_\\bullet \\tilde{Z}) +_\\bullet \\tilde{Z}$; and each block has its own local classifier and residual-sum-of-squares loss, so gradients never travel through the whole network. This keeps the maximum multiplicative depth at layer $h$ at $\\lfloor 2.5h \\rfloor$ in the forward pass plus a constant in the backward pass, far below standard backpropagation's $\\lfloor 2.5H \\rfloor$-scale depth, and approximate bootstrapping refreshes the ciphertext modulus between iterations to sustain training beyond the leveled circuit budget. The headline result is that the encrypted eMLP-1 training curve on MNIST matches its plaintext FP32 counterpart exactly, and the framework beats encrypted logistic regression by up to 3.27% and prior encrypted DNN frameworks by up to 6.83%, with training-step speedups of 3.40x to 8.83x. The paper is explicit that, after establishing the encrypted/plaintext match on eMLP-1/MNIST, all remaining accuracy experiments are run in plaintext; the encrypted pipeline itself is demonstrated end-to-end only in that precision study.","pith_inferences":["My inference: the equivalence between encrypted and plaintext training was demonstrated only for eMLP-1 on MNIST, so if CKKS noise behaves differently in deeper or wider networks or on tabular data, the plaintext-derived accuracy tables may overstate what the fully encrypted pipeline would deliver.","My inference: the local-loss block design makes the blocks independent during training, so the blocks could in principle be trained in parallel across separate machines, reducing wall-clock latency roughly by the number of blocks.","My inference: since latency is nearly flat with layer width up to the slot limit, one cheap way to recover accuracy lost to the polynomial activation is to widen layers rather than deepen them; the paper's own eMLP results show accuracy rising with width.","My inference: if the non-interactive training claim extends beyond MLPs, the same packing-plus-local-loss recipe is a natural template for encrypted training of convolutional or recurrent networks, though the paper does not demonstrate those."],"forward_implications":["A machine-learning-as-a-service provider could train a client's model without the client ever sending plaintext data or participating in the training loop after upload.","Encrypted training accuracy is close to FP32 plaintext training on the evaluated image and tabular benchmarks; on MNIST the eMLP-1 encrypted curve matches the plaintext curve exactly, and larger eMLPs reach 96.77% on MNIST.","Because the backward pass is confined to local blocks, the multiplicative depth grows far more slowly with network depth than in backpropagation, so deeper MLPs become feasible under a fixed CKKS level.","Training latency is nearly independent of layer width up to the ciphertext slot limit, because the packing turns matrix multiplications into SIMD operations; the paper reports per-iteration times from about 190 to 630 seconds with up to 8.83x speedups over TFHE-based training.","The design also permits early-exit strategies, since each local block produces its own prediction that can be used or discarded after training."],"supporting_citations":[{"why":"Supplies the CKKS approximate-arithmetic scheme that ReBoot's real-valued encrypted operations are built on.","marker":"[19]"},{"why":"The approximate bootstrapping procedure ReBoot calls to refresh the ciphertext modulus and continue training.","marker":"[18]"},{"why":"Documents that CKKS bootstrapping does not refresh noise, motivating ReBoot's depth-minimizing architecture.","marker":"[26]"},{"why":"The encrypted logistic regression baseline whose binary-MNIST accuracy ReBoot exceeds by 3.27%.","marker":"[32]"},{"why":"The BGV-based encrypted DNN training baseline on C-MNIST that ReBoot compares against.","marker":"[44]"},{"why":"The BFV/TFHE hybrid encrypted-DNN baseline on MNIST whose accuracy ReBoot improves by up to 6.83%.","marker":"[39]"},{"why":"The TFHE encrypted-training framework providing accuracy and latency baselines on T-MNIST and Fashion-MNIST.","marker":"[23]"},{"why":"The TFHE-based training baseline for per-iteration latency comparisons.","marker":"[60]"},{"why":"The interaction-based CKKS training protocol that ReBoot contrasts with its non-interactive design.","marker":"[41]"}],"fun_headline_variants":["First fully encrypted DNN training, plaintext-level accuracy","ReBoot: Training deep nets under CKKS encryption, matching plaintext","No decryption during training: ReBoot matches plaintext accuracy","Fully encrypted non-interactive DNN training hits FP32 accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that running the training loop under CKKS encryption does not change the accuracy results: all accuracy tables except the eMLP-1/MNIST precision study come from plaintext training of the ReBoot architecture, so the encrypted pipeline's identical behavior on deeper, wider, and tabular models is asserted rather than measured.","fun_headline_variants_meta":{"raw":{"variants":["First fully encrypted DNN training, plaintext-level accuracy","ReBoot: Training deep nets under CKKS encryption, matching plaintext","No decryption during training: ReBoot matches plaintext accuracy","Fully encrypted non-interactive DNN training hits FP32 accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001169,"raw_usage":{"total_tokens":4956,"prompt_tokens":1187,"completion_tokens":3769,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":803,"completion_tokens_details":{"reasoning_tokens":3696}},"tokens_in":803,"tokens_out":3769,"duration_ms":28541,"temperature":1.0,"reasoning_tokens":3696,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:27:50.765661+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the actual encrypted training loop on eMLP-2 or eMLP-3 on MNIST, or on a tabular dataset such as Letter Recognition, and compare final test accuracy with the plaintext-trained numbers in the paper's Table 4; if the encrypted accuracy falls outside the reported standard-deviation bands, the equivalence claim is falsified. A second check is to measure encrypted weight precision on the deeper networks after several bootstrapping steps and test whether precision collapses below the level needed for classification.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The TFHE-based training baseline for per-iteration latency comparisons."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the CKKS approximate-arithmetic scheme that ReBoot's real-valued encrypted operations are built on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Documents that CKKS bootstrapping does not refresh noise, motivating ReBoot's depth-minimizing architecture."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The encrypted logistic regression baseline whose binary-MNIST accuracy ReBoot exceeds by 3.27%."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The BFV/TFHE hybrid encrypted-DNN baseline on MNIST whose accuracy ReBoot improves by up to 6.83%."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The TFHE encrypted-training framework providing accuracy and latency baselines on T-MNIST and Fashion-MNIST."},{"cited_title":"Neural Network Training With Homomorphic Encryption","cited_arxiv_id":"2012.13552","evidence_quote":"The interaction-based CKKS training protocol that ReBoot contrasts with its non-interactive design."}],"review_version":2}