REVIEW 4 major objections 4 minor 23 references
Privacy-Preserving Credit Card Approval Using Homomorphic SVM: Toward Secure Inference in FinTech Applications
T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read A credit-card approval classifier can run fully encrypted and still match plaintext accuracy within half a percentage point.
desk verdict The paper's central claim of a fully encrypted SVM inference pipeline is unsupported because the RBF kernel evaluation is left unspecified and the adaptive threshold requires plaintext scores. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the encrypted decision score $C(S')$, built by summing per-support-vector products $C(\alpha_j)\cdot C(K(X',SV_j))$ and adding the encrypted bias. The hybrid kernel $K=\lambda_1 K_p+\lambda_2 K_r$ is the mathematical mechanism that lets a CKKS circuit approximate non-linear separation, although the RBF component requires an unstated arithmetic approximation of $\exp(-\gamma\|X'-SV_j\|^2)$. The adaptive threshold $\theta=\lambda_1\mu+\lambda_2/\sigma$ is the post-processing mechanism tuned to keep classification stable as CKKS noise accumulates, and SIMD packing (processing many values in parallel within one ciphertext) is the performance mechanism that amortizes per-sample cost across a batch.
What would settle it
Inspect the implementation or re-implement Algorithm 2 from the paper. If the encrypted RBF evaluation is actually replaced by a plaintext kernel value, or if no polynomial approximation of $\exp(-\gamma\|x-\mathrm{sv}\|^2)$ exists within a three-level CKKS modulus chain, then the reported 97.06% accuracy cannot be produced by fully encrypted inference. A minimal check is to substitute a pure polynomial kernel and see whether accuracy collapses.
Extended reading notes
Core claim
On its own terms, the paper's central discovery is that the SVM decision score $C(S')=\sum_j C(\alpha_j)C(K(X',SV_j))+C(b)$ can be evaluated end-to-end under CKKS, and the resulting encrypted classifier performs almost indistinguishably from its plaintext counterpart: accuracy 97.06% vs. 97.51%, precision 98.33% vs. 96.82%, recall 95.16% vs. 96.58%, and F1 96.74% vs. 96.70%. The hybrid kernel combines a polynomial term (native to CKKS arithmetic) with an RBF term, and the adaptive threshold $\theta=\lambda_1\mu+\lambda_2/\sigma$ is meant to compensate for noise-induced shifts in the encrypted scores. The paper maintains that with careful parameter selection and SIMD batching, the 44.9 ms per-sample latency makes this practical for privacy-sensitive financial applications.
Load-bearing premise
The claim stands on the unstated assumption that the RBF kernel's exponential can be evaluated inside CKKS using only additions and multiplications with enough precision; the paper never specifies this approximation, and if it is wrong the reported accuracy is not from a real encrypted pipeline.
Editorial extensions
If this is right
- A bank could outsource credit-card approval to an untrusted cloud while keeping both the applicant's features and the model's support vectors encrypted throughout, with only the final label revealed to the client.
- Non-linear SVMs, which usually require operations homomorphic encryption cannot natively perform, become usable in encrypted form, widening the set of financial models that FHE can serve.
- The reported 44.9 ms per-sample latency, if it holds, works out to roughly 20 decisions per second, within the range of interactive credit decisions.
- The adaptive thresholding mechanism offers a general template for other encrypted classifiers: use batch statistics to shift the decision boundary and compensate for CKKS noise instead of enlarging parameters.
Reading between the lines
- My inference: the strongest replication test is the RBF approximation. If no concrete CKKS-friendly polynomial approximation of $\exp(-\gamma\|x-\mathrm{sv}\|^2)$ is supplied, the reported accuracy may come from plaintext kernel evaluation, and the encrypted pipeline would not be complete.
- My inference: because the adaptive threshold uses the mean and spread of decision scores, either the client receives a batch of scores to compute $\theta$, or the server computes encrypted batch statistics; the paper does not specify which, and each choice changes what information the server sees.
- My inference: a natural ablation is to run the same CKKS pipeline with the polynomial kernel only; if accuracy stays near 97%, the RBF term is not actually contributing under encryption, and the hybrid kernel's role in the result would need re-examination.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes PP-FinTech, a privacy-preserving credit card approval system that combines the CKKS homomorphic encryption scheme with a soft-margin SVM using a hybrid polynomial-RBF kernel. The authors train the SVM in plaintext, encrypt the model parameters and test features, evaluate the SVM decision score homomorphically, and apply an adaptive threshold to the decision score to produce the final classification label. Experiments on the UCI Credit Card Approval dataset report 97.06% accuracy for PP-FinTech versus 97.51% for the plaintext hybrid model, with an average per-sample inference time of 44.9 ms. The paper claims that this demonstrates comparable performance to plaintext models while preserving privacy.
Significance. Privacy-preserving machine-learning inference is an important and timely problem, particularly for financial applications, and an encrypted SVM with a non-linear kernel would be a useful contribution. The paper correctly identifies the need to manage CKKS noise, reports both accuracy and runtime, and uses the OpenFHE library, which are appropriate methodological choices. However, at present the core technical claims are not substantiated: the encrypted RBF kernel evaluation is not specified in a way that is realizable under CKKS, and the adaptive thresholding step explicitly operates on decrypted scores. These issues are load-bearing for the claimed end-to-end encrypted pipeline, so the significance of the work as written is limited.
major comments (4)
- [Section 4.2, Algorithm 2] The line Enc(K_j^r) ← K_r(Enc(X'), Enc(SV_j)) assumes that the RBF kernel can be evaluated under CKKS, but CKKS only supports additions and multiplications. Computing exp(-γ||X' - SV_j||^2) requires a polynomial approximation (for example, Taylor, Chebyshev, or minimax) with a stated degree, approximation interval, coefficient table, and multiplicative-depth budget. None of these are provided. Consequently, the reported 97.06% accuracy and 44.9 ms per-sample latency cannot be attributed to a real CKKS pipeline, and the experimental results are not reproducible from the manuscript.
- [Section 4.2, Algorithm 2 and 'Secure Decryption and Classification'] Algorithm 2 explicitly decrypts Enc(D) to D before computing the adaptive threshold θ = λ1·μ + λ2/σ, and the following subsection applies the threshold to plaintext scores. This breaks the end-to-end encryption claim: the server learns the decrypted decision scores, and the threshold depends on the entire batch of test samples, which also leaks aggregate information about other users' scores. Computing μ and σ homomorphically is not described, and operations such as division and reciprocal required for λ2/σ are not native CKKS operations.
- [Section 4.1, Section 4.2, and Table 1] The hybrid-kernel weights (λ1 = 0.7, λ2 = 0.3) and the adaptive-threshold weights (λ1 = 0.5, λ2 = 0.1) are tuned empirically, and the threshold directly determines the final class label. The paper does not state whether the reported accuracy was obtained on a held-out test set that was not used for this tuning. As written, the evaluation is circular: the threshold weights are chosen to maximize performance on the same data used to report the accuracy, so the claimed 'comparable performance to plaintext' is not established.
- [Section 5.4 and Figure 4] The scalability evaluation is explicitly 'simulated' by scaling the observed per-sample latency, not measured on actual batched encrypted inference. This does not provide empirical evidence for the claimed SIMD-based speedup, especially since the text admits that SIMD was not benchmarked separately. In addition, Figure 4's y-axis is labeled in milliseconds but reaches only about 5 ms for 100 samples, which is inconsistent with a per-sample latency of 44.9 ms (100 samples would take roughly 4.5 seconds).
minor comments (4)
- [Section 4.1] The sentence 'the Credit Card Approval dataset, which is which underwent multiple preprocessing...' contains a typo: 'which is which' should be removed.
- [Section 5.1] The ROC curve discussion mentions that AUC is a key summary metric, but no AUC values are reported for either PT-FinTech or PP-FinTech, so the claim that the encrypted model is nearly identical is not quantified.
- [Section 4.2] The CKKS parameter description would benefit from a table listing the exact modulus chain, scaling factor, ring dimension, and the number of levels, as well as the approximation parameters for the RBF kernel once they are provided.
- [Section 5.2] The runtime breakdown attributes 7 ms to adaptive thresholding, but since Algorithm 2 computes the threshold after decryption, it is unclear whether this 7 ms corresponds to a homomorphic computation or to plaintext post-processing.
Circularity Check
Encrypted kernel output is specified as the encryption of the plaintext kernel result, and the adaptive threshold is fitted to the evaluated score distribution, so the reported encrypted accuracy is partly definitional and partly threshold-fitted rather than an independent homomorphic prediction.
-
self definitional
[Section 4.2, 'Data Encryption and HE Kernel Evaluation' (encrypted decision score and hybrid kernel output equations)]
"The hybrid kernel output for each support vector is computed as: C(K(X ′,SV j)) = Enc(K(X ′,SV j)). ... The encrypted decision score is computed as: C(S ′) = Σ_j C(α j)·C(K(X ′,SV j)) + C(b)"
This equation defines the encrypted hybrid kernel output as the encryption of the plaintext kernel output. Substituting it into the encrypted decision-score formula makes C(S′) equal to Enc(Σ_j α_j K(X′,SV_j) + b) by construction, i.e., the claimed homomorphic decision score is just the encryption of the plaintext SVM score. Algorithm 2 writes K_r(Enc(X′), Enc(SV_j)) as if the RBF term were evaluated on ciphertexts, but no CKKS polynomial approximation, depth budget, or coefficient table is given, so the only explicit definitional equation reduces encrypted inference to encrypting a plaintext result rather than to computing on encrypted inputs.
-
fitted input called prediction
[Section 4.2, 'Adaptive Threshold for Secure Classification' and Algorithm 2]
"θ=λ1·µ+λ2/σ ... The weights λ1 = 0.5 and λ2 = 0.1 were determined empirically and fixed to maintain consistent classification behavior across encrypted batches. ... return sign(D−θ);"
The final label is determined by comparing each decrypted score D to θ, where θ is computed from µ and σ of the same batch of decision scores plus empirically fixed constants λ1 and λ2. Thus every reported accuracy on the evaluation batch is produced by a decision boundary that depends on the batch's own score distribution and on constants fitted to the data. The 'prediction' is therefore not an independent test of a fixed plaintext or encrypted decision rule; it is a post-hoc threshold calibration whose fitted parameters directly influence the reported 97.06% accuracy.
full rationale
The core SVM formulation, CKKS background, and the idea of encrypting the trained decision function are standard and do not, by themselves, create a circular derivation; there are also no load-bearing self-citations, so the paper is not circular through a citation chain. However, two steps compromise the central claim that PP-FinTech performs real encrypted inference with 'comparable performance to the plaintext models.' First, the only explicit equation for the encrypted hybrid kernel, C(K(X′,SV_j)) = Enc(K(X′,SV_j)), defines the ciphertext kernel as the encryption of the plaintext kernel output; if that is the operative definition, the encrypted decision score is by construction the encryption of the plaintext SVM score, not a homomorphic evaluation. Second, the adaptive threshold θ = λ1·µ + λ2/σ is computed from the statistics of the very decision scores being classified, and the weights λ1=0.5, λ2=0.1 are stated to be 'determined empirically'; the reported accuracy is therefore partly a property of a fitted threshold rather than an independent prediction. The missing RBF polynomial approximation is also a reproducibility gap that prevents the reader from verifying that the 23.5 ms kernel-evaluation stage actually computes exp(-γ||x−sv||²) under CKKS. Together these issues make the headline accuracy and privacy-preserving inference claim partially circular by definition and by fitted post-processing, warranting a score of 6 rather than a clean non-finding.
Assumptions & free parameters
free parameters (2)
- Hybrid kernel weights λ1, λ2 =
λ1=0.7, λ2=0.3
- Adaptive threshold weights λ1, λ2 =
λ1=0.5, λ2=0.1
assumptions (4)
- standard math The SVM decision function can be evaluated using only additions and multiplications over encrypted values.
- ad hoc to paper The RBF kernel can be approximated by a polynomial under CKKS without exceeding the noise budget.
- ad hoc to paper The adaptive threshold θ = λ1*μ + λ2/σ can be computed from encrypted decision scores without leaking information.
- domain assumption The Credit Card Approval dataset and the 80:20 split are sufficient for a stable performance estimate.
Cite this review
Pith. "Pith review of Privacy-Preserving Credit Card Approval Using Homomorphic SVM: Toward Secure Inference in FinTech Applications." pith.science (2026). https://pith.science/paper/S37AFKDC
@misc{pith2026250505920,
author = {Pith},
title = {Pith review of: Privacy-Preserving Credit Card Approval Using Homomorphic SVM: Toward Secure Inference in FinTech Applications},
year = {2026},
howpublished = {\url{https://pith.science/paper/S37AFKDC}},
note = {Machine review of arXiv:2505.05920}
}
read the original abstract
The growing use of machine learning in cloud environments raises critical concerns about data security and privacy, especially in finance. Fully Homomorphic Encryption (FHE) offers a solution by enabling computations on encrypted data, but its high computational cost limits practicality. In this paper, we propose PP-FinTech, a privacy-preserving scheme for financial applications that employs a CKKS-based encrypted soft-margin SVM, enhanced with a hybrid kernel for modeling non-linear patterns and an adaptive thresholding mechanism for robust encrypted classification. Experiments on the Credit Card Approval dataset demonstrate comparable performance to the plaintext models, highlighting PP-FinTech's ability to balance privacy, and efficiency in secure financial ML systems.
Figures
Reference graph
Works this paper leans on
-
[1]
Homomorphic encryption enabled svm for preserving privacy of p2p communication,
S. Sahu, R. Ganeshan, and V. Muneeswaran, “Homomorphic encryption enabled svm for preserving privacy of p2p communication,” in2024 IEEE International Students’ Conference on Electrical, Electronics and Computer Science (SCEECS). IEEE, 2024, pp. 1–6
work page 2024
-
[2]
C. Jana, S. Banerjee, S. Maur, and S. Dalai, “Mathematical morphology based sensing of power system disturbances using pca aided support vector machine,” IEEE Sensors Journal, 2024
work page 2024
-
[3]
Configurable encryption and decryption archi- tectures for ckks-based homomorphic encryption,
J. Lee, P. N. Duong, and H. Lee, “Configurable encryption and decryption archi- tectures for ckks-based homomorphic encryption,”Sensors, vol. 23, no. 17, p. 7389, 2023
work page 2023
-
[4]
Survey on fully homomorphic encryption, theory, and applications,
C. Marcolla, V. Sucasas, M. Manzano, R. Bassoli, F. H. Fitzek, and N. Aaraj, “Survey on fully homomorphic encryption, theory, and applications,”Proceedings of the IEEE, vol. 110, no. 10, pp. 1572–1609, 2022
work page 2022
-
[5]
Y. Wu, X. Sun, Y. Zhang, X. Zhong, and L. Cheng, “A power transformer fault di- agnosis method-based hybrid improved seagull optimization algorithm and support vector machine,”Ieee Access, vol. 10, pp. 17 268–17 286, 2021
work page 2021
-
[6]
Homomorphic encryption for arith- metic of approximate numbers,
J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arith- metic of approximate numbers,” inAdvances in cryptology–ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptology and in- formation security, Hong kong, China, December 3-7, 2017, proceedings, part i 23. Springer, 2017, pp. 409–437
work page 2017
-
[7]
Approximate homomorphic encryp- tion with reduced approximation error,
A. Kim, A. Papadimitriou, and Y. Polyakov, “Approximate homomorphic encryp- tion with reduced approximation error,” inCryptographers’ Track at the RSA Con- ference. Springer, 2022, pp. 120–144
work page 2022
-
[8]
OpenFHE: Open-source fully homomorphic encryption library,
A. A. Badawi, A. Alexandru, J. Bates1, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y. Lee, Z. Liu, D. Micciancio1, C. Pascoe, Y. Polyakov, S. R. Ian Quah, K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V. Vaikuntanathan, and V. Zucca, “OpenFHE: Open-source fully homomorphic encryption library,” Cryptology ePrint ...
work page 2022
Show all 23 references
-
[9]
Privacy-preserving fair learning of support vector machine with homomorphic encryption,
S. Park, J. Byun, and J. Lee, “Privacy-preserving fair learning of support vector machine with homomorphic encryption,” inProceedings of the ACM Web Confer- ence 2022, 2022, pp. 3572–3583
2022
-
[10]
Privacy-preserving online medical predi- agnosis training model based on soft-margin svm,
G. Deng, M. Tang, Y. Xi, and M. Zhang, “Privacy-preserving online medical predi- agnosis training model based on soft-margin svm,”IEEE Transactions on Services Computing, vol. 16, no. 3, pp. 2072–2084, 2022
2022
-
[11]
Achieving privacy-preserving online di- agnosis with outsourced svm in internet of medical things environment,
B. Xie, T. Xiang, X. Liao, and J. Wu, “Achieving privacy-preserving online di- agnosis with outsourced svm in internet of medical things environment,”IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 6, pp. 4113–4126, 2021
2021
-
[12]
Achieving privacy-preserving and verifiable support vector machine training in the cloud,
C. Hu, C. Zhang, D. Lei, T. Wu, X. Liu, and L. Zhu, “Achieving privacy-preserving and verifiable support vector machine training in the cloud,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 3476–3491, 2023
2023
-
[13]
Exploring the future of privacy-preserving heart disease prediction: a fully homomorphic encryption-driven logistic regression ap- proach,
V. S. Naresh and S. Reddi, “Exploring the future of privacy-preserving heart disease prediction: a fully homomorphic encryption-driven logistic regression ap- proach,”Journal of Big Data, vol. 12, no. 1, p. 52, 2025
2025
-
[14]
Ppdnn-crp: privacy-preserving deep neural network processing for credit risk prediction in cloud: a homomorphic encryption-based approach,
V. S. Naresh, “Ppdnn-crp: privacy-preserving deep neural network processing for credit risk prediction in cloud: a homomorphic encryption-based approach,”Jour- nal of Cloud Computing, vol. 13, no. 1, p. 149, 2024
2024
-
[15]
Privacy preserving image encryption with opti- mal deep transfer learning based accident severity classification model,
U. Sirisha and B. S. Chandana, “Privacy preserving image encryption with opti- mal deep transfer learning based accident severity classification model,”Sensors, vol. 23, no. 1, p. 519, 2023
2023
-
[16]
Machine learning, deep learn- ing and data preprocessing techniques for detection, prediction, and monitoring of stress and stress-related mental disorders: a scoping review,
M. Razavi, S. Ziyadidegan, R. Jahromi, S. Kazeminasab, V. Janfaza, A. Mah- moudzadeh, E. Baharlouei, and F. Sasangohar, “Machine learning, deep learn- ing and data preprocessing techniques for detection, prediction, and monitoring of stress and stress-related mental disorders:...
2023 arXiv
-
[17]
Comparative assessment of improved svm method under dif- ferent kernel functions for predicting multi-scale drought index,
C. B. Pande, N. Kushwaha, I. R. Orimoloye, R. Kumar, H. G. Abdo, A. D. Tolche, and A. Elbeltagi, “Comparative assessment of improved svm method under dif- ferent kernel functions for predicting multi-scale drought index,”Water Resources Management, vol. 37, no. 3, pp. 1367–1399, 2023
2023
-
[18]
Efficient non-conservative realization of dy- namic scaling-based controllers via matrix pencils for uncertain nonlinear strict- feedback systems,
P. Krishnamurthy and F. Khorrami, “Efficient non-conservative realization of dy- namic scaling-based controllers via matrix pencils for uncertain nonlinear strict- feedback systems,”Systems & Control Letters, vol. 169, p. 105393, 2022
2022
-
[19]
Mimd programs execution support on simd machines: a holistic survey,
D. Mustafa, R. Alkhasawneh, F. Obeidat, and A. S. Shatnawi, “Mimd programs execution support on simd machines: a holistic survey,”IEEE Access, 2024
2024
-
[20]
Classification of fire and smoke images using decision tree algorithm in comparison with logistic regression to measure accuracy, precision, recall, f-score,
B. H. Reddy and P. Karthikeyan, “Classification of fire and smoke images using decision tree algorithm in comparison with logistic regression to measure accuracy, precision, recall, f-score,” in2022 14th International Conference on Mathematics, Actuarial Science, Computer Scie...
2022
-
[21]
Deep roc analysis and auc as balanced average accuracy, for improved classifier selection, audit and explana- tion,
A. M. Carrington, D. G. Manuel, P. W. Fieguth, T. Ramsay, V. Osmani, B. Wernly, C. Bennett, S. Hawken, O. Magwood, Y. Sheikhet al., “Deep roc analysis and auc as balanced average accuracy, for improved classifier selection, audit and explana- tion,”IEEE Transactions on Pattern...
2022
-
[22]
Precision–recall curve (prc) classification trees,
J. Miao and W. Zhu, “Precision–recall curve (prc) classification trees,”Evolution- ary intelligence, vol. 15, no. 3, pp. 1545–1569, 2022
2022
-
[23]
Induction motor fault classification based on roc curve and t-sne,
C.-Y. Lee and W.-C. Lin, “Induction motor fault classification based on roc curve and t-sne,”Ieee Access, vol. 9, pp. 56 330–56 343, 2021
2021
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.