Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

DESIGN: Encrypted GNN Inference via Server-Side Input Graph Pruning

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DESIGN claims that server-side input graph pruning and importance-adaptive polynomial activations cut FHE GNN inference latency by up to 2.39x over a foundational baseline while keeping accuracy competitive.

desk verdict Promising combination of known ideas, but the speedup mechanism isn't supported under CKKS and the paper's own ablation undercuts the adaptive-activation claim. read the letter →

arxiv 2507.05649 v2 pith:2FIH6WAI submitted 2025-07-08 cs.CR cs.AIcs.LG

Kaixiang Zhao , Joseph Yousry Attalla , Qian Lou , Yushun Dong This is my paper
classification cs.CRcs.AIcs.LG
keywords fullyhomomorphicencryptiongraphneuralnetworkinferenceserver-sidepruningencryptednodeimportancescoringadaptivepolynomialactivationCKKSschemeclassificationlatency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that encrypted GNN inference under fully homomorphic encryption can be made much faster by exploiting redundancy in the input graph, entirely on the server and without ever decrypting. Its proposed framework computes cheap, FHE-compatible node importance scores from encrypted degree statistics, partitions nodes into importance levels using approximate homomorphic comparisons, and then uses the resulting masks to prune unimportant graph elements and to vary the polynomial degree of activation functions across nodes. If correct, this would address a central obstacle to practical privacy-preserving graph analytics: the prohibitive latency of homomorphic inference. The paper reports speedups over foundational and optimized FHE GNN baselines while keeping accuracy within the range of other FHE methods.

What carries the argument

The central mechanism is a two-stage pipeline running entirely under CKKS homomorphic encryption: first, encrypted node degrees are computed from the adjacency matrix using homomorphic additions; second, a fixed comparison polynomial $P_{\mathrm{cmp}}(x) = -0.25x^3 + 0.75x + 0.5$ is evaluated on encrypted degree-threshold differences to produce prune masks $\tilde{M}_0$ and level masks $\tilde{M}_1,\ldots,\tilde{M}_m$. These masks then drive logical graph pruning by element-wise homomorphic multiplication with features and adjacency entries, and drive an adaptive activation scheme in which each node receives a polynomial $P_{d_i}$ of degree depending on its importance level.

What would settle it

Run the reported pruning pipeline but replace the fixed comparison polynomial with an exact encrypted comparison on the same degree differences; if the resulting masks change which nodes are pruned, the original speedup cannot be attributed to the stated approximate comparisons. Alternatively, measure the latency of the FHE matrix-multiplication stage with masked versus unmasked ciphertexts of identical packed dimensions: if they are equal, zero-masking alone does not explain the reported savings.

Watch

Extended reading notes

Core claim

The central claim is that a hierarchical, server-side optimization strategy can accelerate FHE-based GNN inference by dynamically adapting the computation to the encrypted input graph. Concretely, the framework computes encrypted node-degree scores, compares them against thresholds using an approximate homomorphic comparison polynomial, and generates multi-level masks that both prune the graph and select different-degree polynomial activations for different importance levels. The reported end-to-end latency drops from 1656.62 seconds to 806.06 seconds on Cora and from 4207.57 seconds to 1759.96 seconds on Citeseer compared with the SEAL baseline, with accuracy comparable to other FHE GNN approaches.

Load-bearing premise

If multiplying graph entries by zero masks does not actually reduce the cost of the packed homomorphic multiplications, or if the fixed cubic comparison polynomial gives wrong answers on real degree-threshold differences, the reported speedups are not explained by the stated mechanisms.

Editorial extensions

If this is right

  • If the reported latency reductions hold, server-side FHE GNN inference becomes substantially more practical, roughly halving end-to-end time on several benchmark datasets.
  • Dynamic, data-dependent pruning can be performed on encrypted graphs without client involvement, preserving the server-side privacy setting that many FHE inference systems assume.
  • Adaptive polynomial activation allocation gives a tunable accuracy-latency tradeoff through pruning thresholds and per-level polynomial degrees.
  • Because the mask generation and activation selection are independent of specific GNN layer operations, the approach is intended to generalize across GNN architectures without major model-specific rewrites.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the speedup from zero-masking depends on the FHE implementation actually reducing cost when ciphertext slots are zeroed; if the packed ciphertext dimensions stay the same and no repacking occurs, the stated mechanism may not fully explain the observed savings.
  • The fixed cubic comparison polynomial only approximates a sign function near the origin, so its correctness on raw degree-threshold differences, which can be far outside $[-1,1]$, is a testable risk that the paper does not address.
  • Degree-based importance is cheap under FHE but may discard high-value low-degree nodes; a natural extension is to compare degree-based pruning against feature-norm-based pruning once the homomorphic cost of feature statistics becomes acceptable.
  • The reported accuracy gaps between FHE inference and plaintext inference remain sizable (for example, about ten points on Cora), so the practical viability of the framework depends on the application's tolerance for utility loss, a point the paper does not quantify.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes DESIGN, a server-side framework for accelerating encrypted GNN inference under CKKS-based fully homomorphic encryption. The method computes encrypted node importance scores from encrypted node degrees, uses an approximate homomorphic comparison polynomial to partition nodes into importance levels, and then applies two optimizations: (1) 'logical pruning' by element-wise zero-masking of features and adjacency entries, and (2) an 'adaptive polynomial activation' that assigns different-degree polynomial approximations to different importance levels via encrypted masks. Experiments on Cora, Citeseer, PubMed, Yelp, and ogbn-proteins report end-to-end FHE inference latency reductions relative to SEAL, OpenFHE, CryptoGCN, LinGCN, and Penguin, with accuracy close to FHE baselines. An ablation study compares the full framework (FF) with pruning-only (PO), adaptive-activation-only (AAO), and baseline (BFG) variants. The paper claims that the two mechanisms jointly reduce homomorphic computation while preserving accuracy.

Significance. If the proposed mechanisms worked as described, the work would address an important bottleneck in privacy-preserving GNN inference: server-side input-adaptive optimization under FHE without client involvement. The paper also ships a public code repository, benchmarks against several relevant baselines, and includes an ablation study, which are strengths. However, the central efficiency claims are not supported by the described operations. Under CKKS, packed ciphertexts are processed in SIMD fashion, and zeroing slots via element-wise multiplication does not reduce the number or cost of homomorphic multiplications unless a repacking or compaction step is present, which the paper never describes. Similarly, the adaptive activation procedure evaluates every polynomial on every node and only then masks, so it does not reduce activation cost. The ablation data confirm that the full framework is slower than the pruning-only variant on all five datasets, contradicting the claimed acceleration of the combined pipeline. These issues are load-bearing for the paper's main contribution, so the reported speedups cannot be attributed to the stated mechanisms.

major comments (5)
  1. [Section 3.2, Eq. (3); Algorithm 2, lines 3–6] The claimed pruning mechanism does not reduce FHE work as described. Multiplying encrypted features and adjacency entries by a 'keep mask' under CKKS costs the same homomorphic multiplication as multiplying by one, and all packed slots are processed together; without a repacking, slot-compaction, or ciphertext-skipping step, the number of HE.Mult and HE.Rotate operations is unchanged. The paper states that pruning 'logically removes' elements but never describes how that logical removal translates into fewer or cheaper ciphertext operations. Therefore the latency reductions in Table 1 cannot be explained by Eq. (3) and Algorithm 2 as written.
  2. [Algorithm 2, lines 12–16; Eq. (5)] The adaptive activation mechanism also does not reduce computational cost as described. In the loop, HE.PolyEval(P_di, Z) is evaluated for every level i on the full encrypted pre-activation vector, and the results are masked and summed. This computes all m polynomials for all nodes, so the cost is proportional to the sum of all polynomial degrees times the number of nodes, not to an importance-weighted average. No per-node or per-slot branching is possible under SIMD-packed CKKS. The claimed savings from lower-degree polynomials for unimportant nodes are therefore not realized by the stated implementation.
  3. [Table 5 and Section B.3] The ablation results directly contradict the claim that adaptive activation accelerates the combined pipeline. On all five datasets, the full framework FF has higher latency than the pruning-only variant PO: Cora 806.06s vs 750.00s, Citeseer 1759.96s vs 1635.50s, PubMed 239.20s vs 222.50s, Yelp 146.21s vs 136.00s, and ogbn-proteins 8.49s vs 7.90s. The text in B.3 acknowledges the Cora and Citeseer cases as 'exceptions' or 'measurement variance,' but the pattern is uniform across every dataset. This is not a local anomaly; it indicates that the adaptive activation stage adds cost rather than providing the claimed benefit within the combined method.
  4. [Appendix C.4, comparison polynomial Pcmp] The fixed comparison polynomial Pcmp(x) = -0.25x^3 + 0.75x + 0.5 is applied to 'the encrypted difference between scores and thresholds,' but the manuscript does not specify any normalization, clamping, or restriction of the input to the interval where this cubic approximates a sign function. Encrypted node degrees are raw integer counts (e.g., thresholds are given as '[5.0, 2.0]'), so score-threshold differences can be far outside [-1,1]; there the cubic grows rapidly and the approximate comparison is unreliable. Without a stated range-control mechanism, the masks M0, M1, ..., Mm may be wrong, which undermines both pruning and adaptive activation.
  5. [Section 4.2] The latency evaluation is written in anticipatory rather than reporting language: 'Our observations, based on the anticipated performance of our framework... are expected to demonstrate the following trends,' and 'will likely exhibit the highest latencies.' This is not an appropriate way to present measured experimental results. The reader cannot tell whether Table 1 reports actual wall-clock measurements or projected numbers. The experimental claims in RQ1 need to be rewritten as completed observations, with the actual measurement methodology and results clearly stated.
minor comments (5)
  1. [Introduction, contributions] The third contribution bullet says 'We will conduct extensive experiments,' future tense, although the paper includes experiments; this should be changed to past or present tense.
  2. [Table 2] The OpenFHE accuracy for Cora is reported as 28.00 ± 2.6%, far below SEAL (68.10%) and CryptoGCN (66.21%) on the same task; this unusual value needs verification and a brief explanation, or it may be a typo.
  3. [Appendix B.3] The discussion of the FF-vs-PO comparison contains a long parenthetical that acknowledges PO can be faster than FF, but the main text still claims adaptive activation helps; the apparent contradiction should be addressed explicitly in the main paper, not only in the appendix.
  4. [Algorithm 1, line 8] The handling of tau0 = infinity in HE.AprxCmp is described only as 'handled appropriately,' but no concrete implementation is given; since this threshold participates in the level-mask computation, a precise definition is needed.
  5. [Reference [28]] Reference [28] is formatted as 'Max. SEAL-Python: Microsoft SEAL 4.x for python,' which appears incomplete or inaccurate; the correct citation for SEAL should be provided.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DESIGN's reported latency and accuracy figures are empirical comparisons against external FHE baselines, and no claimed prediction reduces to fitted inputs or author self-citation.

full rationale

The paper's central efficiency claim is supported by end-to-end measurements against external baselines (SEAL, OpenFHE, CryptoGCN, LinGCN, Penguin) and by ablations that isolate pruning and adaptive activation. These are empirical outcomes, not quantities forced by construction: the importance masks are computed from encrypted degree statistics via approximate homomorphic comparisons, and the reported latencies are measured, not derived from the mask-generation equations. The adaptive activation hyperparameters (thresholds and polynomial degree sets) are openly varied in sensitivity analyses, so presenting chosen configurations is standard hyperparameter reporting rather than fitting a parameter and then renaming it a prediction. Self-citations to the authors' prior surveys and related work appear only in non-load-bearing context passages, and no uniqueness theorem or ansatz from the authors' prior work is invoked to forbid alternatives. The conclusion's admitted limitations about comparison cost, approximation error, and degree-based importance, and the Appendix B.3 observation that the full framework is sometimes slower than pruning-only, are correctness and attribution risks rather than circularity. Potential technical gaps such as zero-masking not reducing packed-ciphertext work without repacking are mechanistic concerns, not examples of a derivation being equivalent to its inputs. Accordingly, no circular step can be exhibited with a quote and a specific reduction, and the honest finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The framework introduces no new physical or cryptographic entities. Its central claims rest on the free thresholds and degree sets, plus two ad hoc implementation assumptions about mask comparisons and pruning cost that are not justified in the text.

free parameters (4)
  • Importance thresholds tau = [5.0, 2.0] in C.4
    Hand chosen; control which nodes are pruned and level assignment; no stated selection rule. The pruning ratio is effectively tuned via these thresholds.
  • Polynomial degree set = PSet2 (5,3,2) for main results; PSet1 and PSet3 in sensitivity
    Selected per dataset to balance accuracy and latency; reported speedups depend on this choice. The activation described in C.4 uses P2 and P1, which does not match degrees up to 7 in Table 3.
  • Number of importance levels m = 2 retained levels plus a prune level
    Arbitrary; larger m would require more homomorphic comparisons and more masks, changing the cost-accuracy trade-off.
  • Comparison polynomial coefficients = -0.25, 0.75, 0.5
    Fixed cubic sign approximation, valid only on [-1,1]; no justification is given for evaluating it on unbounded degree-threshold differences.
assumptions (4)
  • standard math CKKS approximate arithmetic and the standard FHE noise-growth model hold as implemented in SEAL.
    Invoked in Section 2 and C.2 for the leveled FHE evaluation without bootstrapping.
  • domain assumption Node degree is a sufficient proxy for task-relevant node importance for pruning.
    Section 3.1 adopts degree for FHE efficiency, citing plaintext pruning works, but no experiment compares degree-based masks to random masks or oracle importance.
  • ad hoc to paper Zeroed entries in fixed-size packed ciphertexts reduce the cost of homomorphic matrix multiplication.
    Section 3.2, Eq. 3 applies masks but no repacking or sparse-multiplication scheme is described; FF being slower than PO in Table 5 is inconsistent with this assumption.
  • ad hoc to paper The fixed cubic polynomial Pcmp approximates the comparison function on all score-threshold differences encountered.
    Appendix C.4 specifies Pcmp(x) = -0.25x^3 + 0.75x + 0.5 on raw differences; dataset degrees can far exceed the [-1,1] approximation interval.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DESIGN: Encrypted GNN Inference via Server-Side Input Graph Pruning." pith.science (2026). https://pith.science/paper/2FIH6WAI

@misc{pith2026250705649,
  author       = {Pith},
  title        = {Pith review of: DESIGN: Encrypted GNN Inference via Server-Side Input Graph Pruning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2FIH6WAI}},
  note         = {Machine review of arXiv:2507.05649}
}
read the original abstract

Graph Neural Networks (GNNs) have achieved state-of-the-art performance in various graph-based learning tasks. However, enabling privacy-preserving GNNs in encrypted domains, such as under Fully Homomorphic Encryption (FHE), typically incurs substantial computational overhead, rendering real-time and privacy-preserving inference impractical. In this work, we propose DESIGN (EncrypteD GNN Inference via sErver-Side Input Graph pruNing), a novel framework for efficient encrypted GNN inference. DESIGN tackles the critical efficiency limitations of existing FHE GNN approaches, which often overlook input data redundancy and apply uniform computational strategies. Our framework achieves significant performance gains through a hierarchical optimization strategy executed entirely on the server: first, FHE-compatible node importance scores (based on encrypted degree statistics) are computed from the encrypted graph. These scores then guide a homomorphic partitioning process, generating multi-level importance masks directly under FHE. This dynamically generated mask facilitates both input graph pruning (by logically removing unimportant elements) and a novel adaptive polynomial activation scheme, where activation complexity is tailored to node importance levels. Empirical evaluations demonstrate that DESIGN substantially accelerates FHE GNN inference compared to state-of-the-art methods while maintaining competitive model accuracy, presenting a robust solution for secure graph analytics. Our implementation is publicly available at https://github.com/LabRAI/DESIGN.

Figures

Figures reproduced from arXiv: 2507.05649 by the authors.

Figure 1
Figure 1. Ablation study on the Cora dataset. Left Y-axis: Inference Latency (s, log scale, lower is better). Right Y-axis: Node Classification Accuracy (in percent￾age, higher is better). To answer RQ3 and dissect the distinct contributions of the core mechanisms within our framework, we con￾duct a comprehensive ablation study. This study eval￾uates how the FHE-compatible statistical pruning stage and the adaptive polynomial… view at source ↗
Figure 2
Figure 2. Impact of Pruning Ratio on DESIGN Performance for the Cora dataset. The left y-axis repre￾sents Accuracy (%), and the right y￾axis represents Latency (s). Higher accuracy and lower latency are con￾sidered as better performance. To address RQ4, we investigate the sensitivity of our frame￾work’s performance—in terms of both inference latency and accuracy—to its key hyperparameters. Specifically, we analyze the impact … view at source ↗
Figure 3
Figure 3. Node classification accuracy (%) comparison across different datasets and FHE methods. [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Ablation study results for the Citeseer, PubMed, Yelp, and ogbn-proteins datasets. Each [PITH_FULL_IMAGE:figures/full_fig_p017_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Systematic Survey of Model Extraction Attacks and Defenses: State-of-the-Art and Perspectives

    cs.CR 2025-08 conditional novelty 4.0 of 10

    The paper classifies model extraction attacks and defenses into attack, defense, and computing environment categories and surveys their current state.

Reference graph

Works this paper leans on

52 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    A survey on homomorphic encryption schemes: Theory and implementation

    Abbas Acar, Hidayet Aksu, A Selcuk Uluagac, and Mauro Conti. A survey on homomorphic encryption schemes: Theory and implementation. ACM Computing Surveys (Csur), 51(4):1–35, 2018

    2018

  2. [2]

    Helayers: A tile tensors framework for large neural networks on encrypted data

    Ehud Aharoni, Allon Adir, Moran Baruch, Nir Drucker, Gilad Ezov, Ariel Farkash, Lev Greenberg, Ramy Masalha, Guy Moshkowich, Dov Murik, et al. Helayers: A tile tensors framework for large neural networks on encrypted data. arXiv preprint arXiv:2011.01805, 2020

    arXiv 2011

  3. [3]

    Openfhe: Open-source fully homomorphic encryption library

    Ahmad Al Badawi, Jack Bates, Flavio Bergamaschi, David Bruce Cousins, Saroja Erabelli, Nicholas Genise, Shai Halevi, Hamish Hunt, Andrey Kim, Yongwoo Lee, et al. Openfhe: Open-source fully homomorphic encryption library. In proceedings of the 10th workshop on encrypted computing & applied homomorphic cryptography, pages 53–63, 2022

    work page 2022

  4. [4]

    Homomorphic encryption standard

    Martin Albrecht, Melissa Chase, Hao Chen, Jintai Ding, Shafi Goldwasser, Sergey Gorbunov, Shai Halevi, Jeffrey Hoffstein, Kim Laine, Kristin Lauter, et al. Homomorphic encryption standard. Protecting privacy through homomorphic encryption, pages 31–62, 2021

    work page 2021

  5. [5]

    Multiparty computation with low communication, computation and interaction via threshold fhe

    Gilad Asharov, Abhishek Jain, Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan, and Daniel Wichs. Multiparty computation with low communication, computation and interaction via threshold fhe. In Advances in Cryptology–EUROCRYPT 2012: 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 1...

    work page 2012

  6. [6]

    (leveled) fully homomorphic encryption without bootstrapping

    Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory (TOCT), 6(3):1– 36, 2014

    work page 2014

  7. [7]

    Privacy-preserving query over encrypted graph-structured data in cloud computing

    Ning Cao, Zhenyu Yang, Cong Wang, Kui Ren, and Wenjing Lou. Privacy-preserving query over encrypted graph-structured data in cloud computing. In2011 31st International Conference on Distributed Computing Systems, pages 393–402. IEEE, 2011

    work page 2011

  8. [8]

    Privacy-preserving classification on deep neural network

    Hervé Chabanne, Amaury De Wargny, Jonathan Milgram, Constance Morel, and Emmanuel Prouff. Privacy-preserving classification on deep neural network. Cryptology ePrint Archive, 2017

    work page 2017

Show all 52 references
  1. [9]

    Dygnn: Algorithm and architecture support of dynamic pruning for graph neural networks

    Cen Chen, Kenli Li, Xiaofeng Zou, and Yangfan Li. Dygnn: Algorithm and architecture support of dynamic pruning for graph neural networks. In 2021 58th ACM/IEEE Design Automation Conference (DAC), pages 1201–1206. IEEE, 2021

    2021

  2. [10]

    Lightgnn: Simple graph neural network for recommendation

    Guoxuan Chen, Lianghao Xia, and Chao Huang. Lightgnn: Simple graph neural network for recommendation. arXiv preprint arXiv:2501.03228, 2025

    2025 arXiv

  3. [11]

    Atom: A framework of detecting query-based model extraction attacks for graph neural networks

    Zhan Cheng, Bolin Shen, Tianming Sha, Yuan Gao, Shibo Li, and Yushun Dong. Atom: A framework of detecting query-based model extraction attacks for graph neural networks. arXiv preprint arXiv:2503.16693, 2025

    2025 arXiv

  4. [12]

    Homomorphic encryption for arithmetic of approximate numbers

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approximate numbers. In Advances in cryptology–ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptology and information security, Hong kong, Chin...

    2017

  5. [13]

    Chet: an optimizing compiler for fully-homomorphic neural- network inferencing

    Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. Chet: an optimizing compiler for fully-homomorphic neural- network inferencing. In Proceedings of the 40th ACM SIGPLAN conference on programming languag...

    2019

  6. [14]

    Privacy-preserving graph-based machine learning with fully homomorphic encryption for collaborative anti-money laundering

    Fabrianne Effendi and Anupam Chattopadhyay. Privacy-preserving graph-based machine learning with fully homomorphic encryption for collaborative anti-money laundering. In International Conference on Security, Privacy, and Applied Cryptography Engineering, pages 80–105. Springer, 2024

    2024

  7. [15]

    Graph u-nets

    Hongyang Gao and Shuiwang Ji. Graph u-nets. Ininternational conference on machine learning, pages 2083–2092. PMLR, 2019

    2019

  8. [16]

    Fully homomorphic encryption using ideal lattices

    Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 169–178, 2009

    2009

  9. [17]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pages 201–210. PMLR, 2016

  10. [18]

    Neural message passing for quantum chemistry

    Justin Gilmer, Samuel S Schoenholz, Patrick F Riley, Oriol Vinyals, and George E Dahl. Neural message passing for quantum chemistry. In International conference on machine learning , pages 1263–1272. PMLR, 2017

    2017

  11. [19]

    Algorithms in helib

    Shai Halevi and Victor Shoup. Algorithms in helib. In Advances in Cryptology–CRYPTO 2014: 34th Annual Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2014, Proceedings, Part I 34, pages 554–571. Springer, 2014

    2014

  12. [20]

    Open graph benchmark: Datasets for machine learning on graphs

    Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural information processing systems, 33:22118–22133, 2020

    2020

  13. [21]

    Privacy-preserving node clas- sification in customer services with federated graph neural networks

    Zengyi Huang, Min Tang, Yuxing Wei, and Guoqiang Deng. Privacy-preserving node clas- sification in customer services with federated graph neural networks. IEEE Transactions on Consumer Electronics, 2024

    2024

  14. [22]

    Redundancy-free computation for graph neural networks

    Zhihao Jia, Sina Lin, Rex Ying, Jiaxuan You, Jure Leskovec, and Alex Aiken. Redundancy-free computation for graph neural networks. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 997–1005, 2020

    2020

  15. [23]

    A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges

    Wei Ju, Siyu Yi, Yifan Wang, Zhiping Xiao, Zhengyang Mao, Hourun Li, Yiyang Gu, Yifang Qin, Nan Yin, Senzhang Wang, et al. A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges. arXiv preprint arXiv:2403.04468, 2024

    2024

  16. [24]

    {GAZELLE}: A low latency framework for secure neural network inference

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. {GAZELLE}: A low latency framework for secure neural network inference. In 27th USENIX security symposium (USENIX security 18), pages 1651–1669, 2018

    2018

  17. [25]

    Semi-supervised classification with graph convolutional networks

    Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907, 2016

    2016 arXiv

  18. [26]

    Unifews: Unified entry-wise sparsification for efficient graph neural network

    Ningyi Liao, Zihao Yu, and Siqiang Luo. Unifews: Unified entry-wise sparsification for efficient graph neural network. arXiv preprint arXiv:2403.13268, 2024

    2024 arXiv

  19. [27]

    Comprehensive graph gradual pruning for sparse training in graph neural networks

    Chuang Liu, Xueqi Ma, Yibing Zhan, Liang Ding, Dapeng Tao, Bo Du, Wenbin Hu, and Danilo P Mandic. Comprehensive graph gradual pruning for sparse training in graph neural networks. IEEE Transactions on Neural Networks and Learning Systems, 2023

    2023

  20. [28]

    SEAL-Python: Microsoft SEAL 4.x for python

    Max. SEAL-Python: Microsoft SEAL 4.x for python

  21. [29]

    Delphi: A cryptographic inference system for neural networks

    Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, and Raluca Ada Popa. Delphi: A cryptographic inference system for neural networks. In Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, pages 27–30, 2020

    2020

  22. [30]

    Aby3: A mixed protocol framework for machine learning

    Payman Mohassel and Peter Rindal. Aby3: A mixed protocol framework for machine learning. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 35–52, 2018. 11

    2018

  23. [31]

    Secureml: A system for scalable privacy-preserving machine learning

    Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE symposium on security and privacy (SP), pages 19–38. IEEE, 2017

    2017

  24. [32]

    Polynomial approximation of inverse sqrt function for fhe

    Samanvaya Panda. Polynomial approximation of inverse sqrt function for fhe. In International Symposium on Cyber Security, Cryptology, and Machine Learning, pages 366–376. Springer, 2022

    2022

  25. [33]

    Lingcn: Structural linearized graph convo- lutional network for homomorphically encrypted inference

    Hongwu Peng, Ran Ran, Yukui Luo, Jiahui Zhao, Shaoyi Huang, Kiran Thorat, Tong Geng, Chenghong Wang, Xiaolin Xu, Wujie Wen, et al. Lingcn: Structural linearized graph convo- lutional network for homomorphically encrypted inference. Advances in Neural Information Processing Sys...

    2023

  26. [34]

    Cryptogcn: Fast and scalable homomorphically encrypted graph convolutional network inference

    Ran Ran, Wei Wang, Quan Gang, Jieming Yin, Nuo Xu, and Wujie Wen. Cryptogcn: Fast and scalable homomorphically encrypted graph convolutional network inference. Advances in Neural information processing systems, 35:37676–37689, 2022

    2022

  27. [35]

    Penguin: Parallel-packed homomorphic encryption for fast graph convolutional network inference

    Ran Ran, Nuo Xu, Tao Liu, Wei Wang, Gang Quan, and Wujie Wen. Penguin: Parallel-packed homomorphic encryption for fast graph convolutional network inference. Advances in Neural Information Processing Systems, 36:19104–19116, 2023

    2023

  28. [36]

    Chameleon: A hybrid secure computation framework for machine learning applications

    M Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M Songhori, Thomas Schneider, and Farinaz Koushanfar. Chameleon: A hybrid secure computation framework for machine learning applications. In Proceedings of the 2018 on Asia conference on computer and communication...

    2018

  29. [37]

    A graph-based model to measure struc- tural redundancy for supply chain resilience

    Wen Jun Tan, Allan N Zhang, and Wentong Cai. A graph-based model to measure struc- tural redundancy for supply chain resilience. International Journal of Production Research, 57(20):6385–6404, 2019

    2019

  30. [38]

    Secgnn: Privacy-preserving graph neural network training and inference as a cloud service

    Songlei Wang, Yifeng Zheng, and Xiaohua Jia. Secgnn: Privacy-preserving graph neural network training and inference as a cloud service. IEEE Transactions on Services Computing, 16(4):2923–2938, 2023

    2023

  31. [39]

    Cega: A cost-effective approach for graph-based model extraction and acquisition

    Zebin Wang, Menghan Lin, Bolin Shen, Ken Anderson, Molei Liu, Tianxi Cai, and Yushun Dong. Cega: A cost-effective approach for graph-based model extraction and acquisition. arXiv preprint arXiv:2506.17709, 2025

    2025 arXiv

  32. [40]

    Piranha: A {GPU} platform for secure computation

    Jean-Luc Watson, Sameer Wagh, and Raluca Ada Popa. Piranha: A {GPU} platform for secure computation. In 31st USENIX Security Symposium (USENIX Security 22) , pages 827–844, 2022

    2022

  33. [41]

    Graph neural networks in recom- mender systems: a survey

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. Graph neural networks in recom- mender systems: a survey. ACM Computing Surveys, 55(5):1–37, 2022

    2022

  34. [42]

    A comprehensive survey on graph neural networks

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S Yu. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems, 32(1):4–24, 2020

    2020

  35. [43]

    Input feature pruning for accelerating gnn inference on heterogeneous platforms

    Jason Yik, Sanmukh R Kuppannagari, Hanqing Zeng, and Viktor K Prasanna. Input feature pruning for accelerating gnn inference on heterogeneous platforms. In 2022 IEEE 29th In- ternational Conference on High Performance Computing, Data, and Analytics (HiPC), pages 282–291. IEEE, 2022

    2022

  36. [44]

    Auto graph encoder-decoder for neural network pruning

    Sixing Yu, Arya Mazaheri, and Ali Jannesari. Auto graph encoder-decoder for neural network pruning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 6362–6372, 2021

    2021

  37. [45]

    Graphsaint: Graph sampling based inductive learning method

    Hanqing Zeng, Hongkuan Zhou, Ajitesh Srivastava, Rajgopal Kannan, and Viktor Prasanna. Graphsaint: Graph sampling based inductive learning method. arXiv preprint arXiv:1907.04931, 2019. 12

    1907 arXiv

  38. [46]

    Cipherprune: Efficient and scalable private transformer inference

    Yancheng Zhang, Jiaqi Xue, Mengxin Zheng, Mimi Xie, Mingzhe Zhang, Lei Jiang, and Qian Lou. Cipherprune: Efficient and scalable private transformer inference. arXiv preprint arXiv:2502.16782, 2025

    2025 arXiv

  39. [47]

    Heprune: Fast private training of deep neural networks with encrypted data pruning

    Yancheng Zhang, Mengxin Zheng, Yuzhang Shang, Xun Chen, and Qian Lou. Heprune: Fast private training of deep neural networks with encrypted data pruning. Advances in Neural Information Processing Systems, 37:51063–51084, 2024

    2024

  40. [48]

    A survey on privacy in graph neural networks: Attacks, preservation, and applications

    Yi Zhang, Yuying Zhao, Zhaoqing Li, Xueqi Cheng, Yu Wang, Olivera Kotevska, Philip S Yu, and Tyler Derr. A survey on privacy in graph neural networks: Attacks, preservation, and applications. IEEE Transactions on Knowledge and Data Engineering, 2024

    2024

  41. [49]

    A survey of model extraction attacks and defenses in distributed computing environments

    Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A survey of model extraction attacks and defenses in distributed computing environments. arXiv preprint arXiv:2502.16065, 2025

    2025 arXiv

  42. [50]

    A survey on model extraction attacks and defenses for large language models

    Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A survey on model extraction attacks and defenses for large language models. arXiv preprint arXiv:2506.22521, 2025

    2025 arXiv

  43. [51]

    keep mask

    Cheng Zheng, Bo Zong, Wei Cheng, Dongjin Song, Jingchao Ni, Wenchao Yu, Haifeng Chen, and Wei Wang. Robust graph representation learning via neural sparsification. In International Conference on Machine Learning, pages 11458–11468. PMLR, 2020. 13 A Related Work FHE-based Machi...

    2020

  44. [52]

    These operations not only increase the direct computational time but also contribute significantly to noise growth in ciphertexts and necessitate a greater multiplicative depth

    HE.Mult, HE.Add, HE.Rotate Medium (≥ 1) High Feature Variance HE.Mult, HE.Add/⊕, HE.Mult (ptxt), HE.Rotate High (≥ 2) Very High The analysis presented in Table 8 clearly illustrates that metrics requiring homomorphic multiplication (HE.Mult), such as the squared L2 norm of nod...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.