Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

nGraph-HE2: A High-Throughput Framework for Neural Network Inference on Encrypted Data

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Standard pre-trained neural networks can be evaluated on encrypted data without retraining, preserving accuracy, with reported throughputs of 1,998 images/s on CryptoNets and 381 ms/image on ImageNet-scale MobileNetV2.

desk verdict Real systems contribution with the first encrypted ImageNet inference, but the client-aided activation protocol openly trades away model confidentiality and should be front-and-center in the threat model. read the letter →

arxiv 1908.04172 v2 pith:GQX365VK submitted 2019-08-12 cs.CR

Fabian Boemer , Anamaria Costache , Rosario Cammarota , Casimir Wierzynski This is my paper · ORCID
classification cs.CR
keywords homomorphicencryptionneuralnetworkinferenceCKKSclient-aidedcomputationgraphcompilerbatch-axispackingcomplexMobileNetV2
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that standard, pre-trained neural networks with their native ReLU activations and real-number arithmetic can be evaluated on encrypted data at practical throughput, without retraining or redesigning the model. The route is a graph compiler that treats homomorphic encryption as a hardware target and couples the CKKS approximate homomorphic scheme with a client-aided two-party step for non-polynomial activations. The framework reports 1,998 images/s on the CryptoNets benchmark and the first encrypted inference on ImageNet using MobileNetV2, at 60.4% top-1 accuracy and 381 ms/image amortized runtime. If true, privacy-preserving inference becomes a compiler-level feature for existing models rather than a cryptographic redesign of each network.

What carries the argument

The load-bearing mechanism is the CKKS approximate homomorphic scheme used with batch-axis packing, where one ciphertext holds a batch of real inputs and every weight is a scalar plaintext reused across slots. Two optimizations carry most of the performance: complex packing, which stores two real values as a complex pair in one slot and thereby doubles the number of inputs per ciphertext in networks with no ciphertext-ciphertext multiplications; and lazy rescaling, which postpones or drops the noise-reduction rescale so that it happens once per layer instead of once per multiplication. Depth-aware encoding further reduces cost by encoding plaintext weights at the coefficient-modulus level of the ciphertext they will meet, just-in-time. The non-polynomial activations are handled by a client-aided protocol in which the server hands intermediate ciphertexts to the client, the client decrypts, applies ReLU or MaxPool, and returns a fresh encryption; this also resets the noise budget, letting the effective multiplicative depth be the depth between activation layers rather than the whole network depth.

What would settle it

Run the MobileNetV2-0.35-224 configuration on the same hardware and batch size, and compare encrypted inference against plaintext logits over the 50,000-image ImageNet validation set: if the encrypted top-1 accuracy differs from 60.4% by more than about 0.01% or the amortized runtime exceeds 381 ms/image by more than trial variance, the central claim does not reproduce.

Watch

Extended reading notes

Core claim

nGraph-HE2 extends its predecessor so that standard, pre-trained networks can be evaluated homomorphically without changing their activations or number types. The framework's claim is that, by combining the CKKS approximate homomorphic scheme with a client-aided two-party protocol for non-polynomial functions, the compiler can run real networks on encrypted inputs at usable throughput: 1,998 images/s on CryptoNets and the first homomorphic evaluation of MobileNetV2 on ImageNet, with 60.4%/82.7% top-1/top-5 accuracy and 381 ms/image amortized runtime. The same stack reports a 3x-88x speedup in scalar encoding, 2.6x-4.2x in ciphertext-plaintext addition, and 2.6x in ciphertext-plaintext multiplication in the batch-axis packing setting. The accuracy loss on MobileNetV2 is around 0.01%, which is why the paper positions the approach as preserving model accuracy rather than trading it away.

Load-bearing premise

The client-aided activation step assumes the client is allowed to see intermediate pre-activation values, so the model can leak to the client; if a deployment requires the model weights to remain secret from the client, the privacy guarantee is weakened.

Editorial extensions

If this is right

  • Existing production models can be deployed for encrypted inference without retraining or swapping activations, so original model accuracy is preserved.
  • Batch-axis packing plus complex packing puts twice as many images into each ciphertext whenever a network has no ciphertext-ciphertext multiplications, directly doubling throughput.
  • Client-aided activation refreshes the noise budget at each non-polynomial layer, reducing the required multiplicative depth from total network depth to the depth between nonlinearities and allowing much smaller encryption parameters.
  • At the reported amortized throughput, encrypted inference at the ImageNet scale becomes a feasible batch workload, with latency dominated by server-client communication rather than homomorphic arithmetic.
  • Accuracy loss from encryption is around 0.01% on MobileNetV2, so deployment decisions no longer have to trade model accuracy for privacy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If a deployment cannot trust the client with intermediate activations, the same system could swap the client-aided ReLU for a secure two-party or hardware-protected implementation without touching the linear layers, and the throughput gains would likely carry over.
  • Complex packing is not limited to these networks: any real-valued computation graph over encrypted data that uses only addition, subtraction, and multiplication by plaintext constants can run two values per slot, so the trick may apply to other private-computation workloads.
  • The reported communication overhead in the LAN setting suggests a large remaining gain from compressing ciphertexts or overlapping communication, independent of further homomorphic-encryption mathematics.
  • Scaling to larger batches or deeper networks will hit the client-aided round trips: each ReLU or MaxPool boundary costs a client interaction, so latency, not compute, may become the bottleneck for deeper models.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents nGraph-HE2, a framework for privacy-preserving neural network inference on encrypted data built on Intel nGraph and Microsoft SEAL's CKKS implementation. The contributions are: a scalar-encoding optimization that reduces CKKS encoding to O(L) memory/runtime in the batch-axis packing setting; complex packing that packs two real values into one complex slot to double throughput when no ciphertext-ciphertext multiplication is needed; optimized ciphertext-plaintext addition and multiplication; lazy rescaling and depth-aware encoding graph-level optimizations; and a client-aided two-party protocol for non-polynomial activations such as ReLU and MaxPool. The evaluation reports a 3.4x-87.9x scalar-encoding speedup, 2.6x-4.2x ciphertext-plaintext addition speedup, a 2.6x multiplication speedup, an 8x CryptoNets runtime improvement from lazy rescaling, 1,998 images/s on CryptoNets, and the first encrypted ImageNet inference on MobileNetV2 with 60.4%/82.7% top-1/top-5 accuracy and 381 ms/image amortized runtime.

Significance. If the results hold, this is a substantial systems contribution to practical homomorphic inference: the CKKS-specific optimizations are non-trivial, clearly described, and empirically evaluated; the scalar-encoding savings have a supporting proof in Appendix A.3; and the MobileNetV2 result appears to be the first encrypted inference on ImageNet, a concrete milestone for the field. The paper also ships open-source code, which supports reproducibility. The main caveat is that the client-aided protocol reveals intermediate plaintext values to the client, so the broad 'privacy-preserving inference' claim is only valid under a data-privacy threat model, not a model-confidentiality threat model. This limitation is acknowledged in Section 4.1, but it is not reflected in the abstract or introduction, and every headline native-activation result depends on this protocol.

major comments (3)
  1. [Section 4.1; Abstract; Section 1] The client-aided activation protocol sends every pre-activation ciphertext to the client, who decrypts it, applies the non-polynomial function in plaintext, and re-encrypts the result. The client therefore obtains exact intermediate values for every non-polynomial layer, and because the client controls the encrypted inputs, it can in principle recover the server's weight matrices by adaptive queries. The paper explicitly says 'this approach can leak information about the model to the client' and calls it 'a placeholder for more secure implementations,' yet the abstract claims 'privacy-preserving inference' and the introduction claims 'privacy-preserving execution of a full production-level deep neural network' without stating the model-confidentiality exemption. Since CryptoNets-ReLU and all MobileNetV2 results in Table 8 depend on this protocol, the central privacy claim must be re-scoped to a data-privacy-only threat model, or the protocol must be replaced by a secure activation mechanism; otherwise the broad claim is unsupported.
  2. [Section 3.3.1; Table 5] Lazy rescaling is asserted to preserve correctness without a formal noise-budget analysis, and the only supporting evidence is the CryptoNets accuracy of 98.95% reported in Table 5. Because lazy rescaling is one of the three headline contributions and yields an 8x speedup, the paper should either provide a correctness/noise argument or validate the optimization more broadly across architectures and parameter sets; otherwise the claim that it is a generally applicable graph-level optimization is not established.
  3. [Table 7; Section 4.3.1] The throughput comparison in Table 7 mixes nGraph-HE2 measurements with numbers from prior publications (LoLa, Faster CryptoNets, Gazelle, etc.) without stating the hardware, SEAL version, or thread counts used for the prior results. Since the 'state-of-the-art throughput' claim is a central result, the paper should either report same-platform baselines for the comparison methods or explicitly caveat that the comparison is cross-hardware and therefore indicative rather than controlled.
minor comments (5)
  1. [Section 4.3.2; Abstract] The abstract says 'the largest network to date,' but Section 4.3.2 more precisely says 'the largest network whose linear layers have been homomorphically evaluated'; the qualifier should be used in the abstract and conclusion as well, because the client-aided activation computation means the non-linear layers are not evaluated purely homomorphically.
  2. [Reference [12]] Reference [12], 'Efficient Multi-Key Homomorphic Encryption with Packed Ciphertexts with Application to Oblivious Neural Network Inference,' is missing a year and venue; please provide the complete citation.
  3. [Section 3.2.2, Algorithm 6] In Algorithm 6, the comment 'Compute [z·q]2^64' should refer to the Barrett ratio r (i.e., [z·r]2^64), since q is the modulus and r is the precomputed ratio; as written the comment is inconsistent with the code.
  4. [Section 3.1.2, footnote 3] The footnote discussing the correction term for complex multiplication contains an unclear expression 'af + bдi'; this appears to be a typographical error and should be rewritten or removed.
  5. [Section 2.2.3] The notation 'R∗qL' for the ciphertext space appears to be a formatting artifact for R_{q_L}; please clarify the notation so it is consistent with the rest of the paper.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found; the results are measured benchmarks and algebraically derived optimizations, with self-citations used only as prior-work baselines.

full rationale

No circularity found. The paper's contributions are engineering and systems optimizations measured on external workloads; none of the headline numbers is derived from an assumption that contains the result. The 1,998 images/s CryptoNets result is a measured benchmark compared with SEAL baselines and prior published numbers, and the MobileNetV2 accuracy is compared with the unencrypted model accuracy, with the tiny CKKS-noise degradation reported as measured rather than assumed. Complex packing is justified by an explicit algebra identity in Section 3.1.2 and evaluated on a ReLU CryptoNets network; scalar encoding is justified by Lemma 1 in Appendix A.3, which proves that a constant input vector maps to a constant plaintext under CKKS encoding. Lazy rescaling and depth-aware encoding are explicitly credited to prior work ([5]) and are not used as self-supporting premises. Self-citations to nGraph-HE [6] describe the prior compiler implementation that this work extends and provide a baseline; none of the load-bearing claims reduces to a self-citation chain, and no fitted parameter is renamed as a prediction. The acknowledged limitation that client-aided activation computation can leak pre-activation values to the client is a threat-model caveat, not a circularity in the derivation of the performance or accuracy results.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new cryptographic entities or particles. It depends on standard RLWE/CKKS assumptions, a protocol-level assumption about client leakage, a network-structure assumption (no ciphertext-ciphertext multiplication), and an unproven lazy-rescaling correctness assumption. The only hand-tuned numeric inputs are the encryption parameters, batch sizes, and thread counts, which are configuration choices rather than fitted scientific constants.

free parameters (2)
  • CKKS encryption parameter set (N, L, coefficient modulus bit sizes) = CryptoNets: N=2^11, L=1, 54-bit modulus; MobileNetV2: N=2^12, L=3; batch size 4096
    Performance and security numbers depend on hand-chosen HE parameters and batch sizes. The paper asserts 128-bit security but does not provide a security-estimator reference or exact prime bit sizes.
  • Thread count and batch size = 24-88 threads; batches 1024-4096
    Throughput numbers are measured with specific thread counts and batch sizes chosen to optimize runtime-resource tradeoffs (e.g., 24 threads on CryptoNets, 56 threads on MobileNetV2); these choices affect the reported amortized runtimes.
assumptions (5)
  • standard math RLWE hardness assumption for the security of CKKS
    The paper relies on the ring learning with error assumption for the claimed 128-bit security, without proving or re-deriving it; it refers to CKKS and RLWE references.
  • domain assumption Correctness and approximate-arithmetic properties of the CKKS scheme as per Cheon et al. 2017
    The framework assumes that CKKS addition, multiplication, rescaling, and encoding behave as specified in the cited scheme papers; the paper does not re-prove these properties.
  • domain assumption The client-aided model may reveal intermediate values to the client
    Section 4.1 states that the client receives and decrypts intermediate ciphertexts to compute activations, and acknowledges this can leak model information. The central claim of privacy-preserving inference implicitly assumes this leakage is acceptable.
  • domain assumption Target networks contain no ciphertext-ciphertext multiplications
    Complex packing doubles throughput only when all multiplications are ciphertext-plaintext, as in the linear layers of CryptoNets-ReLU and MobileNetV2 with client-aided ReLU refresh; the paper states this limitation in Section 3.1.2.
  • ad hoc to paper Lazy rescaling preserves correctness without a formal noise-bound analysis
    Section 3.3.1 and Table 5 show empirical accuracy is maintained (98.95% on CryptoNets), but no proof or error bound is provided to justify skipping rescaling after every multiplication; correctness is assumed for the tested configurations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of nGraph-HE2: A High-Throughput Framework for Neural Network Inference on Encrypted Data." pith.science (2026). https://pith.science/paper/GQX365VK

@misc{pith2026190804172,
  author       = {Pith},
  title        = {Pith review of: nGraph-HE2: A High-Throughput Framework for Neural Network Inference on Encrypted Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GQX365VK}},
  note         = {Machine review of arXiv:1908.04172}
}
read the original abstract

In previous work, Boemer et al. introduced nGraph-HE, an extension to the Intel nGraph deep learning (DL) compiler, that enables data scientists to deploy models with popular frameworks such as TensorFlow and PyTorch with minimal code changes. However, the class of supported models was limited to relatively shallow networks with polynomial activations. Here, we introduce nGraph-HE2, which extends nGraph-HE to enable privacy-preserving inference on standard, pre-trained models using their native activation functions and number fields (typically real numbers). The proposed framework leverages the CKKS scheme, whose support for real numbers is friendly to data science, and a client-aided model using a two-party approach to compute activation functions. We first present CKKS-specific optimizations, enabling a 3x-88x runtime speedup for scalar encoding, and doubling the throughput through a novel use of CKKS plaintext packing into complex numbers. Second, we optimize ciphertext-plaintext addition and multiplication, yielding 2.6x-4.2x runtime speedup. Third, we exploit two graph-level optimizations: lazy rescaling and depth-aware encoding, which allow us to significantly improve performance. Together, these optimizations enable state-of-the-art throughput of 1,998 images/s on the CryptoNets network. Using the client-aided model, we also present homomorphic evaluation of (to our knowledge) the largest network to date, namely, pre-trained MobileNetV2 models on the ImageNet dataset, with 60.4\percent/82.7\percent\ top-1/top-5 accuracy and an amortized runtime of 381 ms/image.

Figures

Figures reproduced from arXiv: 1908.04172 by the authors.

Figure 1
Figure 1. Runtime vs. Image size of LAN and localhost Mo [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 2
Figure 2. Runtimes on CryptoNets network with different [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Training Framework for Optimal and Stable Training of Polynomial Neural Networks

    cs.LG 2025-05 conditional novelty 5.0 of 10

    Boundary loss plus selective gradient clipping lets polynomial neural networks train stably at high degrees and match ReLU accuracy on seven datasets.

Reference graph

Works this paper leans on

47 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [1]

    XONN: XNOR-based Oblivious Deep Neural Network Inference

    2019. XONN: XNOR-based Oblivious Deep Neural Network Inference. In 28th USENIX Security Symposium (USENIX Security 19) . USENIX Association, Santa Clara, CA. https://www.usenix.org/conference/usenixsecurity19/presentation/ riazi

    work page 2019

  2. [2]

    Martín Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, et al

  3. [3]

    Paul Barrett. 1986. Implementing the Rivest Shamir and Adleman public key encryption algorithm on a standard digital signal processor. In Conference on the Theory and Application of Cryptographic Techniques . Springer, 311–323

    work page 1986

  4. [4]

    Flavio Bergamaschi, Shai Halevi, Tzipora T Halevi, and Hamish Hunt. 2019. Homomorphic Training of 30,000 Logistic Regression Models. In International Conference on Applied Cryptography and Network Security . Springer, 592–611

    work page 2019

  5. [5]

    Marcelo Blatt, Alexander Gusev, Yuriy Polyakov, Kurt Rohloff, and Vinod Vaikun- tanathan. 2019. Optimized Homomorphic Encryption Solution for Secure Genome-Wide Association Studies. (2019)

    work page 2019

  6. [6]

    Fabian Boemer, Yixing Lao, Rosario Cammarota, and Casimir Wierzynski. 2019. nGraph-HE: a graph compiler for deep learning on homomorphically encrypted data. In Proceedings of the 16th ACM International Conference on Computing Frontiers. ACM, 3–13

    work page 2019

  7. [7]

    Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev

    work page

  8. [8]

    Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. 2018. Fast homomorphic evaluation of deep discretized neural networks. In Annual International Cryptology Conference. Springer, 483–512

    2018

Show all 47 references
  1. [9]

    Zvika Brakerski. 2012. Fully homomorphic encryption without modulus switch- ing from classical GapSVP. In Annual Cryptology Conference. Springer, 868–886

    2012

  2. [10]

    Alon Brutzkus, Oren Elisha, and Ran Gilad-Bachrach. 2019. Low La- tency Privacy Preserving Inference. In International Conference on Machine Learning . https://github.com/microsoft/CryptoNets/tree/ 6db77e36c4103385f0a621284d0c3609f0308e74#cryptonets

    2019

  3. [11]

    Porter, and Mona Vij

    Chia che Tsai, Donald E. Porter, and Mona Vij. 2017. Graphene-SGX: A Practical Library OS for Unmodified Applications on SGX. In2017 USENIX Annual Technical Conference (USENIX ATC 17) . USENIX Association, Santa Clara, CA, 645–658. https://www.usenix.org/conference/atc17/techn...

    2017

  4. [12]

    Hao Chen, Wei Dai, Miran Kim, and Yongsoo Song. [n. d.]. Efficient Multi-Key Homomorphic Encryption with Packed Ciphertexts with Application to Oblivious Neural Network Inference. ([n. d.])

  5. [13]

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song

  6. [14]

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homo- morphic encryption for arithmetic of approximate numbers. In International Conference on the Theory and Application of Cryptology and Information Security . Springer, 409–437

    2017

  7. [15]

    Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene. 2016. Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 3–33

    2016

  8. [16]

    In Interna- tional Conference on Selected Areas in Cryptography

    A full RNS variant of approximate homomorphic encryption. In Interna- tional Conference on Selected Areas in Cryptography . Springer, 347–368

  9. [17]

    Scott Cyphers, Arjun K. Bansal, Anahita Bhiwandiwalla, Jayaram Bobba, Matthew Brookhart, Avijit Chakraborty, William Constable, Christian Convey, Leona Cook, Omar Kanawi, Robert Kimball, Jason Knight, Nikolay Korovaiko, Varun Kumar, Yixing Lao, Christopher R. Lishka, Jaikrishn...

    2018 arXiv

  10. [18]

    Leonardo Dagum and Ramesh Menon. 1998. OpenMP: an industry standard API for shared-memory programming. IEEE computational science and engineering 5, 1 (1998), 46–55

    1998

  11. [19]

    Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei

  12. [20]

    arXiv preprint arXiv:1811.09953 (2018)

    Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference. arXiv preprint arXiv:1811.09953 (2018)

    2018 arXiv

  13. [21]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition . Ieee, 248–255

    2009

  14. [22]

    Junfeng Fan and Frederik Vercauteren. 2012. Somewhat Practical Fully Ho- momorphic Encryption. Cryptology ePrint Archive, Report 2012/144. https: //eprint.iacr.org/2012/144

    2012

  15. [23]

    Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. 2019. CHET: an optimizing compiler for fully-homomorphic neural-network inferencing. In Proceedings of the 40th ACM SIGPLAN Conference on Programming La...

    2019

  16. [24]

    Daniel Demmler, Thomas Schneider, and Michael Zohner. 2015. ABY-A Frame- work for Efficient Mixed-Protocol Secure Two-Party Computation.. In NDSS

    2015

  17. [25]

    Shai Halevi and Victor Shoup. 2018. Faster homomorphic linear transformations in helib. In Annual International Cryptology Conference. Springer, 93–120

    2018

  18. [26]

    Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. 2019. Deep Neural Networks Classification over Encrypted Data. In Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy (CODASPY ’19) . ACM, New York, NY, USA, 97–108. https://doi.org/10.1145/32...

    2019

  19. [27]

    Craig Gentry, Shai Halevi, and Nigel P Smart. 2012. Homomorphic evaluation of the AES circuit. In Annual Cryptology Conference. Springer, 850–867

    2012

  20. [28]

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning. 201–210

    2016

  21. [29]

    Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. 2014. The CIFAR-10 dataset. online: http://www. cs. toronto. edu/kriz/cifar. html (2014)

    2014

  22. [30]

    Yann LeCun. 1998. The MNIST database of handwritten digits. http://yann. lecun. com/exdb/mnist/ (1998)

    1998

  23. [31]

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. 2018. GAZELLE: A Low Latency Framework for Secure Neural Network Inference. In 27th (USENIX) Security Symposium (USENIX) Security 18) . 1651–1669

    2018

  24. [32]

    Duhyeong Kim and Yongsoo Song. 2018. Approximate Homomorphic Encryption over the Conjugate-invariant Ring. Cryptology ePrint Archive, Report 2018/952. https://eprint.iacr.org/2018/952

    2018

  25. [33]

    Vadim Lyubashevsky, Chris Peikert, and Oded Regev. 2013. On Ideal Lattices and Learning with Errors over Rings. J. ACM 60, 6, Article 43 (Nov. 2013), 35 pages. https://doi.org/10.1145/2535925

    2013 doi

  26. [34]

    Payman Mohassel and Peter Rindal. 2018. ABY 3: a mixed protocol framework for machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . ACM, 35–52

    2018

  27. [35]

    Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. 2017. Oblivious neural network predictions via miniONN transformations. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . ACM, 619– 631

    2017

  28. [36]

    Patrick Longa and Michael Naehrig. 2016. Speeding up the Number Theo- retic Transform for Faster Ideal Lattice-Based Cryptography. Cryptology ePrint Archive, Report 2016/504. https://eprint.iacr.org/2016/504

    2016

  29. [37]

    Kurt Rohloff. 2018. The PALISADE Lattice Cryptography Library. Retrieved 2019-03-25 from https://git.njit.edu/palisade/PALISADE

    2018

  30. [38]

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. 2018. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 4510–4520

    2018

  31. [39]

    Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer

  32. [40]

    Tim van Elsloo, Giorgio Patrini, and Hamish Ivey-Law. 2019. SEALion: a Framework for Neural Network Inference on Encrypted Data. arXiv preprint arXiv:1904.12840 (2019)

    2019 arXiv

  33. [41]

    M Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M Songhori, Thomas Schneider, and Farinaz Koushanfar. 2018. Chameleon: A hybrid secure computation framework for machine learning applications. In Proceedings of the 2018 on Asia Conference on Computer and Communi...

    2018

  34. [42]

    Wenhao Wang, Yichen Jiang, Qintao Shen, Weihao Huang, Hao Chen, Shuang Wang, XiaoFeng Wang, Haixu Tang, Kai Chen, Kristin Lauter, et al. 2019. Toward Scalable Fully Homomorphic Encryption Through Light Trusted Computing Assistance. arXiv preprint arXiv:1905.07766 (2019). 11 A ...

    2019 arXiv

  35. [44]

    Microsoft SEAL (release 3.3)

    SEAL 2019. Microsoft SEAL (release 3.3). https://github.com/Microsoft/SEAL. Microsoft Research, Redmond, WA

    2019

  36. [46]

    Sameer Wagh, Divya Gupta, and Nishanth Chandran. 2019. SecureNN: 3-Party Secure Computation for Neural Network Training. Proceedings on Privacy En- hancing Technologies 1 (2019), 24

    2019

  37. [2016]

    In OSDI, Vol

    Tensorflow: a system for large-scale machine learning. In OSDI, Vol. 16. 265–283

  38. [2017]

    In NIPS-W

    Automatic differentiation in PyTorch. In NIPS-W

  39. [2018]

    Cryptology ePrint Archive, Report 2018/758

    CHIMERA: Combining Ring-LWE-based Fully Homomorphic Encryp- tion Schemes. Cryptology ePrint Archive, Report 2018/758. https://eprint.iacr. org/2018/758

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.