PrivFT: Private and Fast Text Classification with Homomorphic Encryption

Ahmad Al Badawi; Chan Fook Mun; Khin Mi Mi Aung; Kim Laine; Luong Hoang

REVIEW 4 major objections 5 minor 56 references

PrivFT: Private and Fast Text Classification with Homomorphic Encryption

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PrivFT claims that encrypted text classification can run in under 0.66 seconds per example on a GPU with no loss in accuracy, and that encrypted training on a small dataset takes 5.04 days on an 8-GPU machine.

desk verdict A solid GPU/CKKS engineering paper whose sub-second encrypted inference is the real result; the encrypted-training claim needs the softmax surrogate to be validated before it can be taken at face value. read the letter →

arxiv 1908.06972 v2 pith:RX4O5DK2 submitted 2019-08-19 cs.CR cs.LG

Ahmad Al Badawi , Luong Hoang , Chan Fook Mun , Kim Laine , Khin Mi Mi Aung This is my paper · ORCID

classification cs.CRcs.LG

keywords fullyhomomorphicencryptionCKKSfastTextclassificationprivateinferenceencryptedtrainingGPUaccelerationsoftmaxapproximation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to prove that text classification can be run on encrypted data at a speed that makes the privacy-protecting version usable. It claims that PrivFT, built on the fastText classifier and the CKKS homomorphic encryption scheme, evaluates an encrypted client input in 0.23–0.66 seconds on a GPU while producing exactly the same predictions as the unencrypted model, and that it can train a model from an encrypted dataset in 5.04 days on an 8-GPU machine with accuracy equal to plaintext large-minibatch training. If true, this means a cloud service can classify spam, sentiment, or topic of a text message without ever seeing the message, with the client decrypting the result locally. The caveat is that the encrypted training route currently works only under a polynomial approximation of the softmax scoring function and a very large-minibatch schedule, and the training result rests on a single dataset.

What carries the argument

The load-bearing mechanism is CKKS, the Cheon-Kim-Kim-Song levelled fully homomorphic encryption scheme for approximate real numbers, implemented in its residual number system (RNS) variant and packed so that vectors of up to N/2 real numbers sit in the slots of a single ciphertext. That packing turns the hidden-layer lookup $v\cdot H$ into a sequence of plaintext-ciphertext multiplications and rotation-based total sums, and the output-layer score computation into $n$ plaintext multiplications and additions. The system's depth is kept to 3 multiplications for inference and 46 levels for training by pushing softmax to the client in inference and by replacing it with the degree-2 polynomial $\frac{1}{4}+\frac{1}{2}X+\frac{1}{8}X^2$ in training, combined with minibatch sizes near one million tokens so that weight updates happen only five times per epoch.

What would settle it

Run the encrypted inference path on any document and compare the decrypted class scores to plaintext fastText scores on the same input: any change in the argmax falsifies the zero-loss claim. Then retrain on a second dataset, such as IMDB or AGNews, using the same large-minibatch quadratic-softmax recipe and compare accuracy to plaintext large-minibatch fastText; a material drop would falsify the claim that encrypted training matches plaintext training.

Watch

Extended reading notes

Core claim

PrivFT's central discovery is that a shallow bag-of-words text classifier is small enough and linear enough to be moved almost entirely into ciphertext-space arithmetic. For inference, only the final argmax/softmax decision stays on the client: the client sends a 1-hot bag-of-words vector encrypted under CKKS plus the plaintext word count, and the server evaluates two vector-matrix multiplications using packed SIMD ciphertexts. Because the encrypted computation is algebraically identical to the plaintext fastText score computation, the decrypted scores match exactly, giving 91.49–98.80% accuracy on six public datasets with GPU latency under 0.66 seconds per example. For training, the softmax loss is replaced by the quadratic polynomial $\frac{1}{8}X^2+\frac{1}{2}X+\frac{1}{4}$, and stochastic gradient descent is replaced by two epochs of very large minibatches so the total homomorphic circuit needs only 46 levels; on the YouTube Spam Collection this yields 86.3% accuracy after 5.04 days on an 8-GPU system, the same as plaintext large-minibatch fastText.

Load-bearing premise

The load-bearing assumption is that the quadratic polynomial $\frac{1}{8}X^2+\frac{1}{2}X+\frac{1}{4}$ can stand in for the softmax scoring function without a meaningful accuracy loss; the paper supports this with one dataset and one training run.

Editorial extensions

If this is right

Any organization that already uses a shallow bag-of-words linear classifier can provide encrypted inference at sub-second latency and exactly the same predictions as its plaintext service.
The encrypted-training recipe, if reproducible on other datasets, would let a client hand an encrypted dataset to a cloud provider and receive back an encrypted model, with no party other than the client ever seeing data or model.
The design trades a small metadata leak—plaintext word count and the bag-of-words encoding prepared by the client—for the large speed gain of avoiding homomorphic tokenization and dictionary lookup.
The GPU speedups of one to two orders of magnitude over CPU suggest that further gains will come from memory management and tiling rather than from faster ciphertext arithmetic.
Tasks with more than N/2 classes or deeper architectures would break the current packing scheme and depth budget, so the method is specific to classification problems with few classes and small multiplicative depth.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the same client-side linearization trick—precompute the bag-of-words vector and leave nonlinear scoring to the client—should carry over to logistic regression, linear SVMs, and other shallow classifiers, not just fastText.
Editorial inference: the single-dataset training evaluation leaves open whether the quadratic softmax is a good approximation generally; testing it on sentiment or topic datasets would be the natural next experiment.
Editorial inference: one could remove the document-length leak by padding encodings to a fixed word count and encrypting the count, at the price of larger ciphertexts and slower inference; the paper does not explore this variant.
Editorial inference: the reported 0.23–0.66 seconds covers server-side homomorphic evaluation only; a user-facing latency number would also include the 384 MB upload and client-side tokenization and encoding.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper is worth reading for the inference half; the training half is a proof of concept with a hole in the middle. What's genuinely new: a GPU implementation of RNS-CKKS with 1-2 orders of magnitude speedup over SEAL, and an end-to-end encrypted fastText inference that runs under 0.66 seconds per example. The benchmark methodology is sound (100-run averages, concrete parameter sets), and the design choices—client-side one-hot encoding, server-side linear arithmetic only, client-side argmax—are sensible and keep the multiplicative depth at 5. The engineering (RNS rescale via floor, ordered prime chain, tiling to fit GPU memory) is credible.

The soft spots are real but not fatal. First, the 'zero loss to prediction accuracy' claim for inference is asserted, not measured. Since CKKS is approximate, an occasional argmax flip is possible; the parameters likely make it rare, but the paper should show measured encrypted accuracy on the six datasets instead of pointing to plaintext fastText accuracy. Second, the training contribution rests on the unexamined claim that P(X)=1/8 X^2 + 1/2 X + 1/4 is a good softmax approximation. No interval, no error bound, no comparison of P-trained vs softmax-trained accuracy. The result is a single run on one dataset, compared against large-minibatch GD rather than standard fastText. That's enough to call it a feasibility demo, but not enough to claim that encrypted training works generally. The authors do acknowledge some of this in the discussion, which helps. Third, the paper leaks document length (w is sent in plaintext) and no code is actually released despite the promise. The communication-size numbers also look off by a factor of eight for inference; a quick sanity check suggests they used the training N=65536 in that calculation.

The citation pattern looks fine; the related work on FHE/MPC text classification is covered, and the novelty claims (first GPU RNS-CKKS, first encrypted NLP training) are plausible. The paper is honest about the high cost of training.

Who is this for: anyone working on practical FHE or privacy-preserving ML as a service. The inference result is a real data point. The training part is a cautionary example of cost and a reminder that polynomial approximations need validation. I would send this to peer review with a request for the missing measurements and an ablation on the softmax surrogate. If the authors can supply those, the training claim becomes credible; without them, the paper should be revised to frame training purely as a proof of concept.

Referee Report

4 major / 5 minor

Summary. The paper proposes PrivFT, a system for text classification over CKKS homomorphically encrypted data, with two claimed capabilities: (i) inference on encrypted client inputs using a plaintext fastText model, where the client performs tokenization and one-hot encoding and the server computes embedding and class scores homomorphically, and (ii) training a fastText model entirely on encrypted data using minibatch gradient descent with a quadratic polynomial approximation to softmax. The authors contribute a GPU implementation of an RNS variant of CKKS, report 1 to 2 orders of magnitude speedups over Microsoft SEAL on core primitives, report inference latency below 0.66 seconds per example on GPU for six datasets, and report encrypted training on the YouTube Spam dataset in 5.04 days on an 8-GPU DGX-1, with accuracy claimed equal to plaintext large-minibatch training (86.3%). The paper also reports communication sizes for both tasks.

Significance. If the claims hold, the inference result is a meaningful practical data point for FHE-based private text classification: sub-second encrypted inference for a shallow text classifier, with a concrete GPU implementation and a careful comparison to a CPU library, would be a useful engineering contribution. The encrypted-training result, by contrast, is more speculative: it depends on an unvalidated polynomial surrogate for softmax and is supported by a single run on a single dataset. The paper does not ship code (availability is only promised), and the 'zero loss to prediction accuracy' claim is not backed by any measured encrypted-inference accuracy. The GPU CKKS microbenchmarks in Table 2 are concrete and averaged over 100 runs, and the inference latency numbers in Table 4 are similarly concrete; these are the strongest parts of the paper.

major comments (4)

[Section 6.6.1, Table 4] The headline claim of 'zero loss to prediction accuracy' is asserted without reporting a single encrypted-inference accuracy number. The only accuracy table, Table 3, lists accuracies of the plaintext fastText model, and the text does not compare plaintext scores with decrypted scores or report classification accuracy on encrypted inputs. Because CKKS is approximate and the inference circuit includes rotations, rescaling, and fixed-point precision rho=40, the reader cannot verify that the precision loss is actually zero; please add an encrypted-vs-plaintext accuracy comparison, or at least a distribution of plaintext-vs-decrypted score errors, for the six datasets.
[Section 4.2, Section 6.6.2] The encrypted training contribution rests on the unvalidated claim that P(X) = (1/8)X^2 + (1/2)X + 1/4 is 'a good approximation' to softmax with 'no noticeable accuracy loss.' No minimax interval, approximation-error bound, or comparison of P with softmax on the logit distribution produced by large-minibatch GD is provided, and P is not a probability map over the unit interval (P(0)=0.25, P(1)=0.875). The only empirical support is a single run (Section 6.1, experiment 3) on one dataset, with accuracy reported only against plaintext large-minibatch GD, not against the standard softmax-SGD model. Please provide either a rigorous error analysis or a plaintext ablation (standard softmax vs P on multiple datasets and hyperparameter settings) before the training claim can be accepted.
[Section 4.1, Section 1.1] The privacy guarantee is weaker than stated because the server receives the client's one-hot vector v and the plaintext word count w, revealing the bag-of-words representation and the document length. The paper should state this limitation explicitly and discuss whether it is acceptable for the intended MLaaS and e-mail use cases; if not, this undermines the statement in Section 1.1 that 'our solution as secure as the encryption scheme itself.'
[Section 6.6.2, Algorithm 5] The description of the encrypted training protocol is not sufficiently complete to be independently reproduced. Algorithm 5 omits how the encrypted labels are represented, how the quadratic loss is computed against encrypted labels, how gradients are extracted from encrypted weight matrices, and how the per-minibatch depth budget of 9 levels is derived. Because the 5.04-day figure and the 86.3% accuracy claim depend on these implementation choices, please specify the full encrypted training circuit or provide the source code.

minor comments (5)

[Section 5.2 vs Section 6.5] The SEAL version is stated inconsistently: Section 5.2 says SEAL v3.3.0, while Section 6.5 and the reference list refer to version 3.2.
[Table 4] Table 4 includes YouTube Spam and Enron Email, but Table 3 does not report plaintext accuracy for those datasets; add them to support the zero-loss claim or clarify why they are omitted.
[Section 4.2] The text cites a 'Minimax approximation algorithm' but gives no interval, degree, or reference for the approximation; state the approximation setup more precisely.
[Equation (1), Algorithm 4] The notation such as c_i[j]_{p_k} and |c|_{p_l} is not defined before use; define the residue notation or refer to a standard source.
[Section 6.6.1, Message Size] The client-to-server message size of 384.375 MB per inference is a notable practical cost but is only reported in passing; a sentence discussing its impact on end-to-end latency or feasibility would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the inference accuracy claim follows from protocol construction, and the training accuracy claim is an under-verified empirical assertion rather than a derivation from fitted inputs.

full rationale

PrivFT's homomorphic inference (Section 4.1) moves only linear operations into the encrypted domain: the client sends a one-hot count vector and word count, the server computes the two vector-matrix products and the 1/w scaling with homomorphic additions/multiplications, and the client decrypts the score vector and performs softmax and argmax in plaintext. The 'zero loss to prediction accuracy' claim therefore follows from the protocol's construction: the encrypted computation evaluates exactly the same arithmetic as the plaintext fastText inference path (up to CKKS fixed-point precision), with no parameter fitted to the reported accuracies. This is not circular. For the training task (Section 4.2), the quadratic polynomial (1/8)X^2 + (1/2)X + 1/4 is introduced as a softmax approximation chosen via a minimax fit to softmax, not as a parameter fitted to the 86.3% accuracy target; the assertion of 'no noticeable accuracy loss' is an empirical claim supported only by a single run on one dataset (Section 6.1), which is a verification gap rather than a circular reduction. The paper's self-citations ([1], [2], [7]) supply GPU polynomial-arithmetic primitives and examples of polynomial approximation, but they are not invoked as a uniqueness theorem or to forbid alternative choices, and the core CKKS correctness and security rest on the external scheme [16] and standard LWE estimator [4]. No equation in the paper reduces a predicted accuracy to a fitted quantity by construction, so no circularity step can be exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces a system called PrivFT but no new physical or mathematical entities; it uses the existing CKKS scheme. The free parameters are mostly experimental choices and the softmax polynomial, all of which affect the accuracy and performance claims. The axioms are standard cryptographic assumptions plus deployment and approximation assumptions specific to the paper.

free parameters (4)

CKKS precision rho = 40 (inference), 50 (training)
Chosen experimentally (Section 6.4) to balance noise and correctness; no error analysis for the resulting accuracy.
Softmax approximation polynomial coefficients = 1/8, 1/2, 1/4
Used as the loss in encrypted training; asserted via 'Minimax approximation algorithm' with no derivation, interval, or error bound (Section 4.2).
Training hyperparameters (epochs, minibatch size, learning rate) = 2 epochs, 1,007,500 tokens; learning rate not stated
Chosen 'based on prior experience' (Section 5.2.2) to keep multiplicative depth low; not justified for other datasets.
Dictionary size m and embedding dimension n = m=500,000; n=50
Hand-chosen model parameters for the inference benchmark (Section 6.6.1); affect packing, communication, and latency.

assumptions (5)

domain assumption Ring-LWE hardness and the CKKS scheme's semantic security under appropriate parameters.
Invoked in Section 3.4 and in the security discussion ('provably secure when parameters are set appropriately'); the system's privacy guarantee depends on this.
domain assumption The LWE estimator (Albrecht et al. 2015) correctly estimates the security level of the CKKS parameters.
Used in Section 6.4 to claim security levels (e.g., 140-bit for inference, 98-bit for training); the authors do not independently verify.
ad hoc to paper The quadratic polynomial (1/8)X^2 + (1/2)X + 1/4 approximates softmax well enough to preserve training accuracy.
Stated without derivation or error bound in Section 4.2; the training result depends on it.
domain assumption Large-minibatch gradient descent with 2 epochs produces an effective model for text classification.
Assumed in Section 4.2 and Section 5.2.2 and relied on to keep depth low; supported only by citation to Goyal et al. for ImageNet, not for these text tasks.
domain assumption The client can perform tokenization, dictionary lookup, and one-hot encoding in plaintext and can reveal the word count w.
Section 4.1: the client sends encrypted v and plaintext w; the authors call this 'a weak assumption.' If the client cannot see the text in plaintext or cannot reveal length, the protocol changes.

how reviews work

0 comments

Cite this review

Pith. "Pith review of PrivFT: Private and Fast Text Classification with Homomorphic Encryption." pith.science (2026). https://pith.science/paper/RX4O5DK2

@misc{pith2026190806972,
  author       = {Pith},
  title        = {Pith review of: PrivFT: Private and Fast Text Classification with Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RX4O5DK2}},
  note         = {Machine review of arXiv:1908.06972}
}

read the original abstract

The need for privacy-preserving analytics is higher than ever due to the severity of privacy risks and to comply with new privacy regulations leading to an amplified interest in privacy-preserving techniques that try to balance between privacy and utility. In this work, we present an efficient method for Text Classification while preserving the privacy of the content using Fully Homomorphic Encryption (FHE). Our system (named \textbf{Priv}ate \textbf{F}ast \textbf{T}ext (PrivFT)) performs two tasks: 1) making inference of encrypted user inputs using a plaintext model and 2) training an effective model using an encrypted dataset. For inference, we train a supervised model and outline a system for homomorphic inference on encrypted user inputs with zero loss to prediction accuracy. In the second part, we show how to train a model using fully encrypted data to generate an encrypted model. We provide a GPU implementation of the Cheon-Kim-Kim-Song (CKKS) FHE scheme and compare it with existing CPU implementations to achieve 1 to 2 orders of magnitude speedup at various parameter settings. We implement PrivFT in GPUs to achieve a run time per inference of less than 0.66 seconds. Training on a relatively large encrypted dataset is more computationally intensive requiring 5.04 days.

Figures

Figures reproduced from arXiv: 1908.06972 by the authors.

**Figure 1.** Main tasks in text classification. 1.2 Organization of the paper The rest of the paper is organized as follows. We review the state of the art related to our work in Section 2. Section 3 reviews the basic terminology and concepts the paper builds on. A description of how PrivFT performs both inference and training on encrypted data is presented in Section 4. Section 5 provides the implementation details of the CKKS … view at source ↗

**Figure 2.** Network architecture of vanilla fasttext. It should be noted that, firstly, word embedding refers to a fundamental procedure in NLP where words are converted into floating-point vector representations in a manner that captures the context of a word in text, both semantic and syntactic similarity, and relation with other words [43]. More specifically, the similarity of objects is reflected in their similarity in th… view at source ↗

**Figure 3.** PrivFT prediction task. Ptxt and Ctxt refer to plaintext and ciphertext, respectively. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 45 canonical work pages

[1]

Al Badawi, Y

A. Al Badawi, Y . Polyakov, K. M. M. Aung, B. Veer- avalli, and K. Rohloff. Implementation and performance evaluation of RNS variants of the BFV homomorphic encryption scheme. IEEE Transactions on Emerging Topics in Computing, pages 1–1, 2019

work page 2019
[2]

High-performance FV somewhat homomorphic encryption on GPUs: An im- plementation using CUDA

Ahmad Al Badawi, Bharadwaj Veeravalli, Chan Fook Mun, and Khin Mi Mi Aung. High-performance FV somewhat homomorphic encryption on GPUs: An im- plementation using CUDA. TCHES, 2:70–95, 2018

work page 2018
[3]

Homomor- phic encryption security standard

Martin Albrecht, Melissa Chase, Hao Chen, Jintai Ding, Shaﬁ Goldwasser, Sergey Gorbunov, Shai Halevi, Jef- frey Hoffstein, Kim Laine, Kristin Lauter, Satya Lokam, Daniele Micciancio, Dustin Moody, Travis Morrison, Amit Sahai, and Vinod Vaikuntanathan. Homomor- phic encryption security standard. Technical report, Ho- momorphicEncryption.org, Toronto, Canad...

work page 2018
[4]

On the concrete hardness of learning with errors

Martin R Albrecht, Rachel Player, and Sam Scott. On the concrete hardness of learning with errors. Journal of Mathematical Cryptology, 9(3):169–203, 2015

2015
[5]

From keys to databases—real-world applications of secure multi- party computation

David W Archer, Dan Bogdanov, Yehuda Lindell, Liina Kamm, Kurt Nielsen, Jakob Illeborg Pagter, Nigel P Smart, and Rebecca N Wright. From keys to databases—real-world applications of secure multi- party computation. The Computer Journal, 61(12):1749– 1771, 2018

work page 2018
[6]

Louis J. M. Aslett, Pedro M. Esperança, and Chri. C. Holmes. Encrypted statistical machine learning: new privacy preserving methods. ArXiv e-prints, 2015

work page 2015
[7]

Towards the AlexNet Moment for Homomorphic Encryption: HCNN, theFirst Homomorphic CNN on Encrypted Data with GPUs

Ahmad Al Badawi, Jin Chao, Jie Lin, Chan Fook Mun, Sim Jun Jie, Benjamin Hong Meng Tan, Xiao Nan, Khin Mi Mi Aung, and Vijay Ramaseshan Chan- drasekhar. The alexnet moment for homomorphic en- cryption: Hcnn, the ﬁrst homomorphic cnn on encrypted data with gpus. arXiv preprint arXiv:1811.00778, 2018

work page Pith review arXiv 2018
[8]

A full RNS variant of FV like some- what homomorphic encryption schemes

Jean-Claude Bajard, Julien Eynard, M Anwar Hasan, and Vincent Zucca. A full RNS variant of FV like some- what homomorphic encryption schemes. In Interna- tional Conference on Selected Areas in Cryptography, pages 423–442. Springer, 2016

work page 2016

Show all 56 references

[9]

Recommendation for key man- agement part 1: General (revision 3)

Elaine Barker, William Barker, William Burr, William Polk, and Miles Smid. Recommendation for key man- agement part 1: General (revision 3). NIST special publication, 800(57):1–147, 2012

2012
[10]

(leveled) fully homomorphic encryption with- out bootstrapping

Zvika Brakerski, Craig Gentry, and Vinod Vaikun- tanathan. (leveled) fully homomorphic encryption with- out bootstrapping. ACM Transactions on Computation Theory (TOCT), 6(3):13, 2014

2014
[11]

Fully homo- morphic encryption from ring-LWE and security for key dependent messages

Zvika Brakerski and Vinod Vaikuntanathan. Fully homo- morphic encryption from ring-LWE and security for key dependent messages. In Annual cryptology conference, pages 505–524. Springer, 2011

2011
[12]

Fast private set intersection from homomorphic encryption

Hao Chen, Kim Laine, and Peter Rindal. Fast private set intersection from homomorphic encryption. In Proceed- ings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1243–1255. ACM, 2017

2017
[13]

Disease prediction by machine learning over big data from healthcare communities

Min Chen, Yixue Hao, Kai Hwang, Lu Wang, and Lin Wang. Disease prediction by machine learning over big data from healthcare communities. Ieee Access, 5:8869–8879, 2017

2017
[14]

A full RNS variant of approximate homomorphic encryption

Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Mi- ran Kim, and Yongsoo Song. A full RNS variant of approximate homomorphic encryption. In International Conference on Selected Areas in Cryptography, pages 347–368. Springer, 2018

2018
[15]

Homomorphic en- cryption for approximate matrix arithmetic

Jung Hee Cheon and Andrey Kim. Homomorphic en- cryption for approximate matrix arithmetic. IACR Cryp- tology ePrint Archive, 2018:565, 2018

2018
[16]

Homomorphic encryption for arithmetic of ap- proximate numbers

Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of ap- proximate numbers. In International Conference on the Theory and Application of Cryptology and Information Security, pages 409–437. Springer, 2017

2017
[17]

Faster cryptonets: Lever- aging sparsity for real-world encrypted inference

Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei. Faster cryptonets: Lever- aging sparsity for real-world encrypted inference. arXiv preprint arXiv:1811.09953, 2018

2018 arXiv
[18]

Privacy-preserving text mining as a service

Gianpiero Costantino, Antonio La Marra, Fabio Mar- tinelli, Andrea Saracino, and Mina Sheikhalishahi. Privacy-preserving text mining as a service. In 2017 IEEE Symposium on Computers and Communications (ISCC), pages 890–897. IEEE, 2017

2017
[19]

Privacy- preserving classiﬁcation of personal text messages with secure multi-party computation: An application to hate- speech detection

Martine De Cock, Rafael Dowsley, Anderson CA Nasci- mento, Devin Reich, and Ariel Todoki. Privacy- preserving classiﬁcation of personal text messages with secure multi-party computation: An application to hate- speech detection. arXiv preprint arXiv:1906.02325 , 2019

1906 arXiv
[20]

Bert: Pre-training of deep bidirec- tional transformers for language understanding

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirec- tional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018

2018 arXiv
[21]

CryptoNets: Applying neural networks to encrypted data 14 with high throughput and accuracy

Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. CryptoNets: Applying neural networks to encrypted data 14 with high throughput and accuracy. Technical report, Microsoft, February 2016

2016
[22]

Secure multi-party computation problems and their applications: a review and open problems

Wenliang Du and Mikhail J Atallah. Secure multi-party computation problems and their applications: a review and open problems. In Proceedings of the 2001 work- shop on New security paradigms, pages 13–22. ACM, 2001

2001
[23]

Ma- chine learning in healthcare informatics , volume 56

Sumeet Dua, U Rajendra Acharya, and Prerna Dua. Ma- chine learning in healthcare informatics , volume 56. Springer, 2014

2014
[24]

Arti- ﬁcial Intelligence in Financial Markets: Cutting Edge Applications for Risk Management, Portfolio Optimiza- tion and Economics

Christian L Dunis, Peter W Middleton, Andreas Karathanasopolous, and Konstantinos Theoﬁlatos. Arti- ﬁcial Intelligence in Financial Markets: Cutting Edge Applications for Risk Management, Portfolio Optimiza- tion and Economics. Springer, 2016

2016
[25]

Somewhat prac- tical fully homomorphic encryption

Junfeng Fan and Frederik Vercauteren. Somewhat prac- tical fully homomorphic encryption. Cryptology ePrint Archive, Report 2012/144, 2012

2012
[26]

Fully homomorphic encryption using ideal lattices

Craig Gentry. Fully homomorphic encryption using ideal lattices. In STOC09, pages 169–178. ACM, 2009

2009
[27]

Fully homomorphic encryption with polylog overhead

Craig Gentry, Shai Halevi, and Nigel P Smart. Fully homomorphic encryption with polylog overhead. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 465–
[28]

Machine ethics and automated vehicles

Noah J Goodall. Machine ethics and automated vehicles. In Road vehicle automation, pages 93–102. Springer, 2014

2014
[29]

Accurate, large minibatch sgd: Training imagenet in 1 hour, 2017

Priya Goyal, Piotr Dollár, Ross Girshick, Pieter Noord- huis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tul- loch, Yangqing Jia, and Kaiming He. Accurate, large minibatch sgd: Training imagenet in 1 hour, 2017

2017
[30]

An improved RNS variant of the BFV homomorphic en- cryption scheme

Shai Halevi, Yuriy Polyakov, and Victor Shoup. An improved RNS variant of the BFV homomorphic en- cryption scheme. Cryptology ePrint Archive, Report 2018/117, 2018

2018
[31]

Algorithms in HElib

Shai Halevi and Victor Shoup. Algorithms in HElib. In International Cryptology Conference, pages 554–571. Springer, 2014

2014
[32]

Deep learning for ﬁnance: deep portfolios

JB Heaton, NG Polson, and Jan Hendrik Witte. Deep learning for ﬁnance: deep portfolios. Applied Stochastic Models in Business and Industry, 33(1):3–12, 2017

2017
[33]

Universal lan- guage model ﬁne-tuning for text classiﬁcation

Jeremy Howard and Sebastian Ruder. Universal lan- guage model ﬁne-tuning for text classiﬁcation. arXiv preprint arXiv:1801.06146, 2018

2018 arXiv
[34]

Multilingual detection of hate speech against immigrants and women in twitter at semeval-2019 task 5: Frequency analysis interpolation for hate in speech detection

Òscar Garibo i Orts. Multilingual detection of hate speech against immigrants and women in twitter at semeval-2019 task 5: Frequency analysis interpolation for hate in speech detection. In Proceedings of the 13th International Workshop on Semantic Evaluation, pages 460–463, 2019

2019
[35]

User data privacy: Face- book, cambridge analytica, and privacy protection.Com- puter, 51(8):56–59, 2018

Jim Isaak and Mina J Hanna. User data privacy: Face- book, cambridge analytica, and privacy protection.Com- puter, 51(8):56–59, 2018

2018
[36]

Using fully homomorphic encryption for statistical analysis of categorical, ordinal and numerical data

Wen jie Lu, Shohei Kawasaki, and Jun Sakuma. Using fully homomorphic encryption for statistical analysis of categorical, ordinal and numerical data. Cryptol- ogy ePrint Archive, Report 2016/1163, 2016. https: //eprint.iacr.org/2016/1163

2016
[37]

Bag of tricks for efﬁcient text classiﬁ- cation

Armand Joulin, Edouard Grave, Piotr Bojanowski, and Tomas Mikolov. Bag of tricks for efﬁcient text classiﬁ- cation. arXiv preprint arXiv:1607.01759, 2016

2016 arXiv
[38]

GAZELLE: A low latency framework for secure neural network inference

Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. GAZELLE: A low latency framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pages 1651– 1669, 2018

2018
[39]

Privacy- preserving genome-wide association studies on cloud environment using fully homomorphic encryption

Wen-Jie Lu, Yoshiji Yamada, and Jun Sakuma. Privacy- preserving genome-wide association studies on cloud environment using fully homomorphic encryption. In BMC medical informatics and decision making , vol- ume 15, page S1. BioMed Central, 2015

2015
[40]

Machine learning forensics for law enforce- ment, security, and intelligence

Jesús Mena. Machine learning forensics for law enforce- ment, security, and intelligence. Auerbach Publications, 2016

2016
[41]

Regularizing and optimizing LSTM language models

Stephen Merity, Nitish Shirish Keskar, and Richard Socher. Regularizing and optimizing LSTM language models. arXiv preprint arXiv:1708.02182, 2017

2017 arXiv
[42]

Efﬁcient estimation of word representations in vector space

Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efﬁcient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781, 2013

2013 arXiv
[43]

Distributed representations of words and phrases and their compositionality

Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Cor- rado, and Jeff Dean. Distributed representations of words and phrases and their compositionality. In Ad- vances in neural information processing systems, pages 3111–3119, 2013

2013
[44]

Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop , pages 113–124

Michael Naehrig, Kristin Lauter, and Vinod Vaikun- tanathan. Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop , pages 113–124. ACM, 2011. 15

2011
[45]

Residue number systems: theory and implementation, volume 2

Amos R Omondi and Benjamin Premkumar. Residue number systems: theory and implementation, volume 2. World Scientiﬁc, 2007

2007
[46]

Large-scale distributed second-order optimization using kronecker- factored approximate curvature for deep convolutional neural networks

Kazuki Osawa, Yohei Tsuji, Yuichiro Ueno, Akira Naruse, Rio Yokota, and Satoshi Matsuoka. Large-scale distributed second-order optimization using kronecker- factored approximate curvature for deep convolutional neural networks. In The IEEE Conference on Computer Vision and Pat...

2019
[47]

Glove: Global vectors for word representa- tion

Jeffrey Pennington, Richard Socher, and Christopher Manning. Glove: Global vectors for word representa- tion. In Proceedings of the 2014 conference on empiri- cal methods in natural language processing (EMNLP), pages 1532–1543, 2014

2014
[48]

Deep contextualized word representations

Matthew E Peters, Mark Neumann, Mohit Iyyer, Matt Gardner, Christopher Clark, Kenton Lee, and Luke Zettlemoyer. Deep contextualized word representations. arXiv preprint arXiv:1802.05365, 2018

2018 arXiv
[49]

Learning to generate reviews and discovering sentiment

Alec Radford, Rafal Jozefowicz, and Ilya Sutskever. Learning to generate reviews and discovering sentiment. arXiv preprint arXiv:1704.01444, 2017

2017 arXiv
[50]

http://sealcrypto.org, 2017

Simple Encrypted Arithmetic Library (release 2.3.1). http://sealcrypto.org, 2017. Microsoft Research, Redmond, W A

2017
[51]

N. P. Smart and F. Vercauteren. Fully homomorphic SIMD operations. Designs, Codes and Cryptography, 71(1):57–81, 2014

2014
[52]

How to ﬁne-tune bert for text classiﬁcation? arXiv preprint arXiv:1905.05583, 2019

Chi Sun, Xipeng Qiu, Yige Xu, and Xuanjing Huang. How to ﬁne-tune bert for text classiﬁcation? arXiv preprint arXiv:1905.05583, 2019

1905 arXiv
[53]

Attention is all you need

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Ad- vances in neural information processing systems, pages 5998–6008, 2017

2017
[54]

Healer: homomorphic computation of exact logistic regression for secure rare disease variants analysis in gwas

Shuang Wang, Yuchen Zhang, Wenrui Dai, Kristin Lauter, Miran Kim, Yuzhe Tang, Hongkai Xiong, and Xiaoqian Jiang. Healer: homomorphic computation of exact logistic regression for secure rare disease variants analysis in gwas. Bioinformatics, 32(2):211–218, 2015

2015
[55]

Xlnet: General- ized autoregressive pretraining for language understand- ing

Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Ruslan Salakhutdinov, and Quoc V Le. Xlnet: General- ized autoregressive pretraining for language understand- ing. arXiv preprint arXiv:1906.08237, 2019

1906 arXiv
[56]

Protocols for secure computations

Andrew C Yao. Protocols for secure computations. In 23rd annual symposium on foundations of computer science (sfcs 1982), pages 160–164. IEEE, 1982. 16

1982

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Al Badawi, Y

A. Al Badawi, Y . Polyakov, K. M. M. Aung, B. Veer- avalli, and K. Rohloff. Implementation and performance evaluation of RNS variants of the BFV homomorphic encryption scheme. IEEE Transactions on Emerging Topics in Computing, pages 1–1, 2019

work page 2019

[2] [2]

High-performance FV somewhat homomorphic encryption on GPUs: An im- plementation using CUDA

Ahmad Al Badawi, Bharadwaj Veeravalli, Chan Fook Mun, and Khin Mi Mi Aung. High-performance FV somewhat homomorphic encryption on GPUs: An im- plementation using CUDA. TCHES, 2:70–95, 2018

work page 2018

[3] [3]

Homomor- phic encryption security standard

Martin Albrecht, Melissa Chase, Hao Chen, Jintai Ding, Shaﬁ Goldwasser, Sergey Gorbunov, Shai Halevi, Jef- frey Hoffstein, Kim Laine, Kristin Lauter, Satya Lokam, Daniele Micciancio, Dustin Moody, Travis Morrison, Amit Sahai, and Vinod Vaikuntanathan. Homomor- phic encryption security standard. Technical report, Ho- momorphicEncryption.org, Toronto, Canad...

work page 2018

[4] [4]

On the concrete hardness of learning with errors

Martin R Albrecht, Rachel Player, and Sam Scott. On the concrete hardness of learning with errors. Journal of Mathematical Cryptology, 9(3):169–203, 2015

2015

[5] [5]

From keys to databases—real-world applications of secure multi- party computation

David W Archer, Dan Bogdanov, Yehuda Lindell, Liina Kamm, Kurt Nielsen, Jakob Illeborg Pagter, Nigel P Smart, and Rebecca N Wright. From keys to databases—real-world applications of secure multi- party computation. The Computer Journal, 61(12):1749– 1771, 2018

work page 2018

[6] [6]

Louis J. M. Aslett, Pedro M. Esperança, and Chri. C. Holmes. Encrypted statistical machine learning: new privacy preserving methods. ArXiv e-prints, 2015

work page 2015

[7] [7]

Towards the AlexNet Moment for Homomorphic Encryption: HCNN, theFirst Homomorphic CNN on Encrypted Data with GPUs

Ahmad Al Badawi, Jin Chao, Jie Lin, Chan Fook Mun, Sim Jun Jie, Benjamin Hong Meng Tan, Xiao Nan, Khin Mi Mi Aung, and Vijay Ramaseshan Chan- drasekhar. The alexnet moment for homomorphic en- cryption: Hcnn, the ﬁrst homomorphic cnn on encrypted data with gpus. arXiv preprint arXiv:1811.00778, 2018

work page Pith review arXiv 2018

[8] [8]

A full RNS variant of FV like some- what homomorphic encryption schemes

Jean-Claude Bajard, Julien Eynard, M Anwar Hasan, and Vincent Zucca. A full RNS variant of FV like some- what homomorphic encryption schemes. In Interna- tional Conference on Selected Areas in Cryptography, pages 423–442. Springer, 2016

work page 2016