Pith. sign in

REVIEW 3 major objections 4 minor 66 references

ReBoot: Encrypted Training of Deep Neural Networks with CKKS Bootstrapping

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ReBoot claims the first fully encrypted, non-interactive training of deep neural networks, with accuracy comparable to FP32 plaintext training.

desk verdict Original CKKS training framework undone by a central overclaim: only one shallow MNIST run is actually encrypted; all other accuracy numbers are plaintext. read the letter →

arxiv 2506.19693 v1 pith:5EBCR7XJ submitted 2025-06-24 cs.LG

Alberto Pirillo , Luca Colombo This is my paper · ORCID
classification cs.LG
keywords homomorphicencryptionCKKSencryptedtrainingbootstrappingmulti-layerperceptronslocalerrorsignalsSIMDpackingprivacy-preservingmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ReBoot aims to show that multi-layer perceptrons can be trained end-to-end on encrypted data, with no interaction between the data owner and the training service, while keeping accuracy close to ordinary 32-bit floating-point training. The framework is built on the CKKS homomorphic encryption scheme, whose approximate arithmetic supports the real-valued operations of neural networks but accumulates noise with every multiplication. To make training fit inside CKKS's depth and noise budget, ReBoot splits the network into local-loss blocks, approximates ReLU by $z^2+z$, and uses a packing scheme that turns matrix multiplications into element-wise SIMD operations. If the central claim holds, a service provider could train a model without ever seeing the plaintext data, and the cost per training step would be roughly independent of layer width. The paper reports accuracy comparable to plaintext FP32 training across image and tabular benchmarks, with up to 8.83x lower per-iteration latency than prior encrypted-training frameworks.

What carries the argument

The central mechanism is a pair of complementary packing formats together with local-loss blocks. ReBoot encodes every vector or matrix as a flattened $r \times c$ matrix that fills all $N/2$ CKKS slots; inputs and activations appear either in a repeated format, where each row is a copy of the vector, or an expanded format, where each column is a copy, and weight matrices are encoded row-wise or column-wise. Alternating row-encrypted and column-encrypted fully-connected layers makes the output format of one layer exactly the input format of the next, so no homomorphic repacking is ever needed. A local-loss block couples one fully-connected layer, an EncryptedPolyReLU, and a small local classifier; because each block's gradient is computed from its own loss, the backward pass stays inside the block and the multiplicative depth per iteration is bounded by a constant plus $\lfloor 2.5h \rfloor$ forward depth, rather than growing linearly with total depth as in backpropagation. Approximate bootstrapping then refreshes the modulus of weights and velocity between iterations, which is what allows training to continue beyond the original leveled circuit's budget.

What would settle it

Run the actual encrypted training loop on eMLP-2 or eMLP-3 on MNIST, or on a tabular dataset such as Letter Recognition, and compare final test accuracy with the plaintext-trained numbers in the paper's Table 4; if the encrypted accuracy falls outside the reported standard-deviation bands, the equivalence claim is falsified. A second check is to measure encrypted weight precision on the deeper networks after several bootstrapping steps and test whether precision collapses below the level needed for classification.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that end-to-end encrypted training of multi-layer perceptrons is feasible under CKKS if the network and optimizer are redesigned together. ReBoot alternates row-encoded and column-encoded fully-connected layers so that forward and backward passes are built from element-wise multiplications, additions, and rotations only; activations use EncryptedPolyReLU, $\tilde{A} = (\tilde{Z} \odot_\bullet \tilde{Z}) +_\bullet \tilde{Z}$; and each block has its own local classifier and residual-sum-of-squares loss, so gradients never travel through the whole network. This keeps the maximum multiplicative depth at layer $h$ at $\lfloor 2.5h \rfloor$ in the forward pass plus a constant in the backward pass, far below standard backpropagation's $\lfloor 2.5H \rfloor$-scale depth, and approximate bootstrapping refreshes the ciphertext modulus between iterations to sustain training beyond the leveled circuit budget. The headline result is that the encrypted eMLP-1 training curve on MNIST matches its plaintext FP32 counterpart exactly, and the framework beats encrypted logistic regression by up to 3.27% and prior encrypted DNN frameworks by up to 6.83%, with training-step speedups of 3.40x to 8.83x. The paper is explicit that, after establishing the encrypted/plaintext match on eMLP-1/MNIST, all remaining accuracy experiments are run in plaintext; the encrypted pipeline itself is demonstrated end-to-end only in that precision study.

Load-bearing premise

The load-bearing premise is that running the training loop under CKKS encryption does not change the accuracy results: all accuracy tables except the eMLP-1/MNIST precision study come from plaintext training of the ReBoot architecture, so the encrypted pipeline's identical behavior on deeper, wider, and tabular models is asserted rather than measured.

Editorial extensions

If this is right

  • A machine-learning-as-a-service provider could train a client's model without the client ever sending plaintext data or participating in the training loop after upload.
  • Encrypted training accuracy is close to FP32 plaintext training on the evaluated image and tabular benchmarks; on MNIST the eMLP-1 encrypted curve matches the plaintext curve exactly, and larger eMLPs reach 96.77% on MNIST.
  • Because the backward pass is confined to local blocks, the multiplicative depth grows far more slowly with network depth than in backpropagation, so deeper MLPs become feasible under a fixed CKKS level.
  • Training latency is nearly independent of layer width up to the ciphertext slot limit, because the packing turns matrix multiplications into SIMD operations; the paper reports per-iteration times from about 190 to 630 seconds with up to 8.83x speedups over TFHE-based training.
  • The design also permits early-exit strategies, since each local block produces its own prediction that can be used or discarded after training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the equivalence between encrypted and plaintext training was demonstrated only for eMLP-1 on MNIST, so if CKKS noise behaves differently in deeper or wider networks or on tabular data, the plaintext-derived accuracy tables may overstate what the fully encrypted pipeline would deliver.
  • My inference: the local-loss block design makes the blocks independent during training, so the blocks could in principle be trained in parallel across separate machines, reducing wall-clock latency roughly by the number of blocks.
  • My inference: since latency is nearly flat with layer width up to the slot limit, one cheap way to recover accuracy lost to the polynomial activation is to widen layers rather than deepen them; the paper's own eMLP results show accuracy rising with width.
  • My inference: if the non-interactive training claim extends beyond MLPs, the same packing-plus-local-loss recipe is a natural template for encrypted training of convolutional or recurrent networks, though the paper does not demonstrate those.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes ReBoot, a framework for non-interactive encrypted training of multi-layer perceptrons under the CKKS homomorphic encryption scheme. The contribution is a combination of a packing strategy that exploits CKKS SIMD operations, an MLP architecture based on local-loss blocks to limit multiplicative depth, and an encrypted training algorithm that uses approximate bootstrapping on weights and velocities. The paper reports a precision study on one shallow architecture and then gives accuracy and latency comparisons on image and tabular benchmarks, claiming accuracy comparable to FP32 plaintext training, improvements over prior encrypted logistic regression and encrypted DNN frameworks, and support for arbitrarily deep MLPs.

Significance. If fully substantiated, ReBoot would be a notable step: it would be among the first demonstrations of non-interactive, real-valued encrypted DNN training with CKKS, and its packing and local-loss design could be of practical value for encrypted ML as-a-service. The conceptual material on multiplicative-depth reduction and ciphertext packing is interesting. However, the supporting evidence is currently much narrower than the claims: only one encrypted training run on eMLP-1/MNIST is reported, all other accuracy numbers come from plaintext training, and the stated training algorithm contains apparent mathematical errors in the backward pass. The paper's central contribution is therefore not yet demonstrated by the presented experiments.

major comments (3)
  1. [Section 5.2, Tables 4 and 5] The headline accuracy results are not encrypted-training results. Section 5.2 explicitly states: "Given this demonstrated alignment… subsequent ReBoot accuracy experiments are conducted using plaintext training." Consequently, Tables 4 and 5, the abstract's +3.27% and +6.83% improvements, and the claim of accuracy comparable to FP32 plaintext training all rest on plaintext training of the ReBoot architecture for every configuration except the eMLP-1/MNIST precision study. That validation is a single one-hidden-layer RE-Block network; eMLP-2 and eMLP-3 contain CE-Blocks with larger forward and backward multiplicative depth (Table 1), and no encrypted run with more than one hidden layer is reported. The extrapolation from one shallow encrypted run to deeper architectures and to all tabular datasets is load-bearing and unverified.
  2. [Section 4.3.3, Algorithm 1] The backward pass through EncryptedPolyReLU is mathematically incorrect as written. The derivative of f(z)=z^2+z is 2z+1, so the chain rule requires delta_z = (2z+1) * delta_a; Algorithm 1, step 7 instead evaluates EncryptedPolyReLU' at delta_A, computing 1 + 2*delta_A. Additionally, Algorithm 1, line 10 passes delta_W^{t-1} for the local classifier into UpdateWeights, whereas the surrounding text and Algorithm 2 describe the update using the current gradient delta_W^t. If implemented literally, these errors would corrupt the training procedure; if they are presentation typos, they still need explicit correction because the algorithm as published is not executable as stated.
  3. [Section 4.3, Algorithm 1, Section 3] The claim that ReBoot supports "arbitrarily deep" encrypted training is not supported by the algorithm or the experiments. Bootstrapping in Algorithm 1 (lines 11–12) is applied only to weights and velocities, not to activations flowing between local-loss blocks, while Section 3 correctly notes that CKKS bootstrapping does not reduce accumulated noise. Thus noise in the activation path accumulates with network depth, and no encrypted experiment with more than one hidden layer is reported to show that deeper CKKS training remains feasible or accurate.
minor comments (4)
  1. [Abstract and Section 1] The terminology "fully encrypted and non-interactive training of DNNs" is broader than what is demonstrated; the experiments cover MLPs with at most three hidden layers and only one encrypted run, so the abstract should be qualified to "MLPs" and to the specific validated depth.
  2. [Footnote 1 and Abstract] Footnote 1 says the code "will be released in the next phase," while the abstract states that ReBoot "is made available to the scientific community as a public repository"; please provide the actual repository URL or remove the availability claim.
  3. [Table 5] The textual claim that ReBoot "consistently outperforms prior encrypted DNN methods" is contradicted by Table 5: on Penguins, ReBoot MLP[4-2-3] achieves 81.18% versus 92.20% for Colombo et al., and on Iris the ReBoot result has a standard deviation of 6.40, so the comparison should be discussed honestly rather than summarized as uniformly superior.
  4. [Figure 2] The phrase "exact match" between plaintext and encrypted training accuracy is too strong given the precision decay shown in Figure 2b; please report a quantitative accuracy difference or an error bound instead of claiming an exact match.

Circularity Check

0 steps flagged · score 2.0 of 10

No construction-level circularity: the ReBoot derivation and comparisons are self-contained, and the self-citations are non-load-bearing. The main risk is that most reported 'encrypted' accuracy numbers are plaintext extrapolations, which is an empirical verification gap, not a circular reduction.

full rationale

I walked the claimed derivation chain. The packing operations in Equations (6)-(7), the EncryptedPolyReLU activation in Equation (8), the local-loss block construction, and Algorithms 1-2 are all derived from CKKS primitives and standard local-error-signal updates; no constant is fitted from the target accuracy, and no equation defining an output is simultaneously used as its input. The comparisons in Tables 5-6 use the authors' own prior TFHE work [23] and integer-training work [49] only as external baselines or motivation; those numbers are not reused to define ReBoot's architecture, and they do not force the reported accuracy values. The only load-bearing substitution is in Section 5.2, where the paper writes: 'Given this demonstrated alignment... subsequent ReBoot accuracy experiments are conducted using plaintext training.' The demonstrated alignment comes from one configuration (eMLP-1 on MNIST), and the paper then presents plaintext-trained results for eMLP-2, eMLP-3, and the other image/tabular datasets as ReBoot accuracy. This is an extrapolation of encrypted/plaintext equivalence to deeper, wider networks and different datasets, not a circular step: there is no fitted parameter and no algebraic identity making the claimed encrypted accuracy equal to its input by construction. Self-citations exist, but they are not load-bearing: [23] serves as a comparative baseline and [49] is cited for the general accuracy cost of integer-based training. The score of 2 reflects the minor non-load-bearing self-citations plus the unverified plaintext-to-encrypted extrapolation, while the derivation itself is not circular.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The ledger shows the framework's debt: hyperparameters tuned per dataset, an unverified plaintext-to-encrypted transfer assumption, and the local-loss/quadratic-activation design choices. No new physical entities are invented; the 'entities' are software blocks. The count of hand-chosen constants and domain assumptions is moderate, and the most expensive assumption (plaintext equals encrypted) is the one the paper itself flags in Section 5.2.

free parameters (5)
  • Learning rate gamma (per dataset) = 0.00005 to 0.01 (Appendix A, Tables 7-8)
    Chosen by hand per dataset and architecture; affects all accuracy results.
  • Weight decay rate eta = 0.0 to 0.01
    Hand-chosen; Algorithm 2 applies it as (1+eta) scaling of the gradient rather than standard weight decay.
  • Batch size b = 8 to 60
    Hand-chosen per dataset; influences training dynamics and ciphertext packing.
  • Momentum mu = 0.9
    Fixed ad hoc value for the NAG-style update.
  • EncryptedPolyReLU coefficients = 1 and 1 (x^2 + x)
    Fixed polynomial approximation of ReLU chosen for depth 1; adequacy for training is assumed.
assumptions (5)
  • domain assumption CKKS parameter set Theta = {N, q, Delta} provides 128-bit security and sufficient working precision for the training loop.
    Section 5.1 relies on HES estimates; noise growth in the training loop is not independently proven.
  • domain assumption Approximate bootstrapping preserves enough precision for continued training after the observed precision drop.
    Section 5.2 shows precision drop after first bootstrapping; the paper assumes stabilization sustains training.
  • ad hoc to paper Plaintext training of the ReBoot architecture is representative of encrypted training on all other datasets and architectures.
    Section 5.2 assumes equivalence based on a single MNIST eMLP-1 run; all subsequent accuracy tables are plaintext.
  • domain assumption Blockwise training with local loss signals converges to a useful model.
    Section 4.2.3 and 4.3.2 rely on prior local-error literature; no analysis of convergence is provided.
  • domain assumption The x + x^2 polynomial activation is an adequate ReLU surrogate for the datasets used.
    Section 4.2.2; the derivative 1 + 2x is used in the backward pass; adequacy assumed from prior polynomial ReLU work.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ReBoot: Encrypted Training of Deep Neural Networks with CKKS Bootstrapping." pith.science (2026). https://pith.science/paper/5EBCR7XJ

@misc{pith2026250619693,
  author       = {Pith},
  title        = {Pith review of: ReBoot: Encrypted Training of Deep Neural Networks with CKKS Bootstrapping},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5EBCR7XJ}},
  note         = {Machine review of arXiv:2506.19693}
}
read the original abstract

Growing concerns over data privacy underscore the need for deep learning methods capable of processing sensitive information without compromising confidentiality. Among privacy-enhancing technologies, Homomorphic Encryption (HE) stands out by providing post-quantum cryptographic security and end-to-end data protection, safeguarding data even during computation. While Deep Neural Networks (DNNs) have gained attention in HE settings, their use has largely been restricted to encrypted inference. Prior research on encrypted training has primarily focused on logistic regression or has relied on multi-party computation to enable model fine-tuning. This stems from the substantial computational overhead and algorithmic complexity involved in DNNs training under HE. In this paper, we present ReBoot, the first framework to enable fully encrypted and non-interactive training of DNNs. Built upon the CKKS scheme, ReBoot introduces a novel HE-compliant neural network architecture based on local error signals, specifically designed to minimize multiplicative depth and reduce noise accumulation. ReBoot employs a tailored packing strategy that leverages real-number arithmetic via SIMD operations, significantly lowering both computational and memory overhead. Furthermore, by integrating approximate bootstrapping, ReBoot learning algorithm supports effective training of arbitrarily deep multi-layer perceptrons, making it well-suited for machine learning as-a-service. ReBoot is evaluated on both image recognition and tabular benchmarks, achieving accuracy comparable to 32-bit floating-point plaintext training while enabling fully encrypted training. It improves test accuracy by up to +3.27% over encrypted logistic regression, and up to +6.83% over existing encrypted DNN frameworks, while reducing training latency by up to 8.83x. ReBoot is made available to the scientific community as a public repository.

Figures

Figures reproduced from arXiv: 2506.19693 by the authors.

Figure 1
Figure 1. Overview of ReBoot encrypted architecture for a [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Precision analysis of eMLP-1 on the MNIST dataset. the recommendations of the Homomorphic Encryption Standard (HES) [5]. The scheme level 𝑙 is set to 𝑙 = 𝜏ReBoot+𝜏bs, where 𝜏ReBoot represents the maximum multiplicative depth required for training, as explained in Section 4.4, and 𝜏bs accounts for the additional depth needed to perform iterative bootstrapping [8]. The polynomial de￾gree 𝑁 is chosen as the smallest va… view at source ↗
Figure 3
Figure 3. Computational demands of ReBoot encrypted NNs [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 43 canonical work pages

  1. [1]

    Selcuk Uluagac, and Mauro Conti

    Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Mauro Conti. 2018. A Survey on Homomorphic Encryption Schemes: Theory and Implementation. ACM Comput. Surv. 51, 4, Article 79 (jul 2018), 35 pages. https://doi.org/10.1145/ 3214303

    work page 2018

  2. [2]

    Abien Fred Agarap. 2019. Deep Learning using Rectified Linear Units (ReLU). arXiv:1803.08375 [cs.NE] https://arxiv.org/abs/1803.08375

    arXiv 2019

  3. [3]

    Ahmad Al Badawi, Louie Hoang, Chan Fook Mun, Kim Laine, and Khin Mi Mi Aung. 2020. Privft: Private and fast text classification with homomorphic en- cryption. IEEE Access 8 (2020), 226544–226556

    work page 2020

  4. [4]

    Ahmad Al Badawi and Yuriy Polyakov. 2023. Demystifying bootstrapping in fully homomorphic encryption. Cryptology ePrint Archive (2023)

    work page 2023

  5. [5]

    Martin Albrecht, Melissa Chase, Hao Chen, Jintai Ding, Shafi Goldwasser, Sergey Gorbunov, Shai Halevi, Jeffrey Hoffstein, Kim Laine, Kristin Lauter, Satya Lokam, Daniele Micciancio, Dustin Moody, Travis Morrison, Amit Sahai, and Vinod Vaikuntanathan. 2019. Homomorphic Encryption Standard. Cryptology ePrint Archive, Paper 2019/939. https://eprint.iacr.org/2019/939

    work page 2019

  6. [6]

    Ali, Jinhyun So, and A

    Ramy E. Ali, Jinhyun So, and A. Salman Avestimehr. 2024. On Polyno- mial Approximations for Privacy-Preserving and Verifiable ReLU Networks. arXiv:2011.05530 [cs.LG] https://arxiv.org/abs/2011.05530

    arXiv 2024

  7. [7]

    Ahmad Al Badawi, Andreea Alexandru, Jack Bates, Flavio Bergamaschi, David Bruce Cousins, Saroja Erabelli, Nicholas Genise, Shai Halevi, Hamish Hunt, Andrey Kim, Yongwoo Lee, Zeyu Liu, Daniele Micciancio, Carlo Pas- coe, Yuriy Polyakov, Ian Quah, Saraswathy R.V., Kurt Rohloff, Jonathan Say- lor, Dmitriy Suponitsky, Matthew Triplett, Vinod Vaikuntanathan, a...

    work page 2022

  8. [8]

    Youngjin Bae, Jung Hee Cheon, Wonhee Cho, Jaehyung Kim, and Taekyung Kim

    work page

Show all 66 references
  1. [9]

    Flavio Bergamaschi, Shai Halevi, Tzipora T Halevi, and Hamish Hunt. 2019. Homomorphic training of 30,000 logistic regression models. In Applied Cryptog- raphy and Network Security: 17th International Conference, ACNS 2019, Bogota, Colombia, June 5–7, 2019, Proceedings 17 . Spr...

    2019

  2. [10]

    Christopher M. Bishop. 1995. Neural networks for pattern recognition. https: //api.semanticscholar.org/CorpusID:60563397

    1995

  3. [11]

    Fabian Boemer, Anamaria Costache, Rosario Cammarota, and Casimir Wierzyn- ski. 2019. nGraph-HE2: A High-Throughput Framework for Neural Network In- ference on Encrypted Data. In Proceedings of the 7th ACM Workshop on Encrypted Computing & Applied Homomorphic Cryptography (Lond...

    2019

  4. [12]

    Jean-Philippe Bossuat, Christian Mouchet, Juan Troncoso-Pastoriza, and Jean- Pierre Hubaux. 2021. Efficient Bootstrapping for Approximate Homomorphic Encryption with Non-sparse Keys. In Advances in Cryptology – EUROCRYPT 2021, Anne Canteaut and François-Xavier Standaert (Eds.)...

    2021

  5. [13]

    Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. 2012. (Leveled) fully homomorphic encryption without bootstrapping. In Proceedings of the 3rd Inno- vations in Theoretical Computer Science Conference (Cambridge, Massachusetts) (ITCS ’12). Association for Computing Mach...

    2012

  6. [14]

    Zvika Brakerski, Adeline Langlois, Chris Peikert, Oded Regev, and Damien Stehlé

  7. [15]

    Sergiu Carpov, Nicolas Gama, Mariya Georgieva, and Juan Ramon Troncoso- Pastoriza. 2019. Privacy-preserving semi-parallel logistic regression training with Fully Homomorphic Encryption. Cryptology ePrint Archive, Paper 2019/101. https://eprint.iacr.org/2019/101

    2019

  8. [16]

    Giuliano Casale and Manuel Roveri. 2023. Scheduling inputs in early exit neural networks. IEEE Trans. Comput. 73, 2 (2023), 451–465

    2023

  9. [17]

    Melissa Chase, Hao Chen, Jintai Ding, Shafi Goldwasser, Sergey Gorbunov, Jeffrey Hoffstein, Kristin Lauter, Satya Lokam, Dustin Moody, Travis Morrison, et al. 2017. Security of homomorphic encryption. HomomorphicEncryption. org, Redmond W A, Tech. Rep(2017)

    2017

  10. [18]

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song

  11. [19]

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homo- morphic Encryption for Arithmetic of Approximate Numbers. In International Conference on the Theory and Application of Cryptology and Information Security . https://api.semanticscholar.org/CorpusID:3164123

    2017

  12. [20]

    Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène. 2018. TFHE: Fast Fully Homomorphic Encryption over the Torus. Cryptology ePrint Archive, Paper 2018/421. https://eprint.iacr.org/2018/421

    2018

  13. [21]

    Tarin Clanuwat, Mikel Bober-Irizar, Asanobu Kitamoto, Alex Lamb, Kazuaki Yamamoto, and David Ha. 2018. Deep Learning for Classical Japanese Literature. arXiv:cs.CV/1812.01718 [cs.CV]

    2018 arXiv

  14. [22]

    Aurora AF Colombo, Luca Colombo, Alessandro Falcetta, and Manuel Roveri

  15. [23]

    Luca Colombo, Alessandro Falcetta, and Manuel Roveri. 2024. Training Encrypted Neural Networks on Encrypted Data with Fully Homomorphic Encryption. In Proceedings of the 12th Workshop on Encrypted Computing & Applied Homomorphic Cryptography (Salt Lake City, UT, USA) (W AHC ’2...

    2024

  16. [24]

    Eric Crockett. 2020. A low-depth homomorphic circuit for logistic regression model training. Cryptology ePrint Archive (2020)

    2020

  17. [25]

    Li Deng. 2012. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine 29, 6 (2012), 141–142

    2012

  18. [26]

    Nir Drucker, Guy Moshkowich, Tomer Pelleg, and Hayim Shaul. 2022. BLEACH: Cleaning Errors in Discrete Computations over CKKS. Cryptology ePrint Archive, Paper 2022/1298. https://eprint.iacr.org/2022/1298

    2022

  19. [27]

    Junfeng Fan and Frederik Vercauteren. 2012. Somewhat Practical Fully Ho- momorphic Encryption. Cryptology ePrint Archive, Paper 2012/144. https: //eprint.iacr.org/2012/144

    2012

  20. [28]

    R. A. FISHER. 1936. THE USE OF MULTIPLE MEASURE- MENTS IN TAXONOMIC PROBLEMS. Annals of Eugenics 7, 2 (1936), 179–188. https://doi.org/10.1111/j.1469-1809.1936. tb02137.x arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1111/j.1469- 1809.1936.tb02137.x

    1936

  21. [29]

    M.J. Flynn. 1966. Very high-speed computing systems. Proc. IEEE 54, 12 (1966), 1901–1909. https://doi.org/10.1109/PROC.1966.5273

    1966

  22. [30]

    Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing (Bethesda, MD, USA) (STOC ’09). Association for Computing Machinery, New York, NY, USA, 169–178. https://doi.org/10.1145/1536414.1536440

    2009

  23. [31]

    Shafi Goldwasser and Silvio Micali. 2019. Probabilistic encryption & how to play mental poker keeping secret all partial information. In Providing sound foundations for cryptography: on the work of Shafi Goldwasser and Silvio Micali . 173–201

    2019

  24. [32]

    Kyoohyung Han, Seungwan Hong, Jung Hee Cheon, and Daejun Park. 2018. Efficient logistic regression on large encrypted data. Cryptology ePrint Archive (2018)

    2018

  25. [33]

    Allison M Horst, Alison Presmanes Hill, and Kristen B Gorman. 2020. allison- horst/palmerpenguins: v0.1.0. https://doi.org/10.5281/zenodo.3960218

    2020 doi

  26. [34]

    Andras Janosi, William Steinbrunn, Matthias Pfisterer, and Robert Detrano

  27. [35]

    Chao Jin, Mohamed Ragab, and Khin Mi Mi Aung. 2020. Secure transfer learning for machine fault diagnosis under different operating conditions. InInternational Conference on Provable Security . Springer, 278–297. 13 Alberto Pirillo and Luca Colombo

    2020

  28. [36]

    Andrey Kim, Yongsoo Song, Miran Kim, Keewoo Lee, and Jung Hee Cheon. 2018. Logistic regression model training based on the approximate homomorphic encryption. BMC medical genomics 11 (2018), 23–31

    2018

  29. [37]

    Seewoo Lee, Garam Lee, Jung Woo Kim, Junbum Shin, and Mun-Kyu Lee. 2023. HETAL: efficient privacy-preserving transfer learning with homomorphic en- cryption. In International Conference on Machine Learning . PMLR, 19010–19035

    2023

  30. [38]

    Baiyu Li, Daniele Micciancio, Mark Schultz-Wu, and Jessica Sorrell. 2022. Se- curing Approximate Homomorphic Encryption Using Differential Privacy. In Advances in Cryptology – CRYPTO 2022 , Yevgeniy Dodis and Thomas Shrimpton (Eds.). Springer Nature Switzerland, Cham, 560–589

    2022

  31. [39]

    Qian Lou, Bo Feng, Geoffrey Charles Fox, and Lei Jiang. 2020. Glyph: Fast and Accurately Training Deep Neural Networks on Encrypted Data. In Advances in Neural Information Processing Systems , H. Larochelle, M. Ran- zato, R. Hadsell, M.F. Balcan, and H. Lin (Eds.), Vol. 33. Cu...

    2020

  32. [40]

    Vadim Lyubashevsky, Chris Peikert, and Oded Regev. 2010. On Ideal Lattices and Learning with Errors over Rings. J. ACM 60 (2010), 43:1–43:35. https: //api.semanticscholar.org/CorpusID:1606347

    2010

  33. [41]

    Kentaro Mihara, Ryohei Yamaguchi, Miguel Mitsuishi, and Yusuke Maruyama. 2020. Neural Network Training With Homomorphic Encryption. arXiv:2012.13552 [cs.CR] https://arxiv.org/abs/2012.13552

    2020 arXiv

  34. [42]

    Luis Montero, Jordan Frery, Celia Kherfallah, Roman Bredehoft, and Andrei Stoian. 2024. Neural Network Training on Encrypted Data with TFHE. arXiv preprint arXiv:2401.16136 (2024)

    2024 arXiv

  35. [43]

    Hesham Mostafa, Vishwajith Ramesh, and Gert Cauwenberghs. 2018. Deep supervised learning using local errors. Frontiers in neuroscience 12 (2018), 608

    2018

  36. [44]

    Karthik Nandakumar, Nalini Ratha, Sharath Pankanti, and Shai Halevi. 2019. Towards Deep Neural Network Training on Encrypted Data. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 40–48. https://doi.org/10.1109/CVPRW.2019.00011

    2019

  37. [45]

    Arild Nøkland and Lars Hiller Eidnes. 2019. Training Neural Networks with Local Error Signals. arXiv:1901.06656 [stat.ML]

    2019 arXiv

  38. [46]

    Monique Ogburn, Claude Turner, and Pushkar Dahal. 2013. Homomorphic encryption. Procedia Computer Science 20 (2013), 502–509

    2013

  39. [47]

    Prajwal Panzade, Daniel Takabi, and Zhipeng Cai. 2024. I can’t see it but I can Fine- tune it: On Encrypted Fine-tuning of Transformers using Fully Homomorphic Encryption. arXiv:2402.09059 [cs.LG] https://arxiv.org/abs/2402.09059

    2024 arXiv

  40. [48]

    Adeetya Patel, Michael Eickenberg, and Eugene Belilovsky. 2023. Local learning with neuron groups. arXiv preprint arXiv:2301.07635 (2023)

    2023 arXiv

  41. [49]

    Alberto Pirillo, Luca Colombo, and Manuel Roveri. 2024. NITRO-D: Native Integer-only Training of Deep Convolutional Neural Networks. arXiv:2407.11698 [cs.LG] https://arxiv.org/abs/2407.11698

    2024

  42. [50]

    Rumelhart, Geoffrey E

    David E. Rumelhart, Geoffrey E. Hinton, and Ronald J. Williams. 1986. Learning representations by back-propagating errors. Nature 323 (1986), 533–536. https: //api.semanticscholar.org/CorpusID:205001834

    1986

  43. [51]

    Simone Scardapane, Michele Scarpiniti, Enzo Baccarelli, and Aurelio Uncini. 2020. Why should we add early exits to neural networks? Cognitive Computation 12, 5 (2020), 954–966

    2020

  44. [52]

    David Slate. 1991. Letter Recognition. UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C5ZP40

    1991 doi

  45. [53]

    N. P. Smart and F. Vercauteren. 2014. Fully homomorphic SIMD operations. Des. Codes Cryptography 71, 1 (apr 2014), 57–81. https://doi.org/10.1007/s10623-012- 9720-4

    2014 doi

  46. [54]

    Ilya Sutskever, James Martens, George Dahl, and Geoffrey Hinton. 2013. On the importance of initialization and momentum in deep learning. In Proceedings of the 30th International Conference on International Conference on Machine Learning - Volume 28 (Atlanta, GA, USA) (ICML’13...

    2013

  47. [55]

    Surat Teerapittayanon, Bradley McDanel, and Hsiang-Tsung Kung. 2016. Branchynet: Fast inference via early exiting from deep neural networks. In 2016 23rd international conference on pattern recognition (ICPR) . IEEE, 2464–2469

    2016

  48. [56]

    Vele Tosevski and Glenn Gulak. 2025. Large-Scale Recurrent Neural Networks with Fully Homomorphic Encryption for Privacy-Enhanced Speaker Identifica- tion. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5

    2025

  49. [57]

    Roman Walch, Samuel Sousa, Lukas Helminger, Stefanie Lindstaedt, Christian Rechberger, and Andreas Trügler. 2022. Cryptotl: Private, efficient and secure transfer learning. arXiv preprint arXiv:2205.11935 (2022)

    2022 arXiv

  50. [58]

    William Wolberg, Olvi Mangasarian, Nick Street, and W. Street. 1993. Breast Cancer Wisconsin (Diagnostic). UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C5DW2B

    1993 doi

  51. [59]

    Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms. arXiv:1708.07747 [cs.LG]

    2017 arXiv

  52. [60]

    Joon Soo Yoo and Ji Won Yoon. 2021. t-BMPNet: Trainable Bitwise Multilayer Per- ceptron Neural Network over Fully Homomorphic Encryption Scheme. Security and Communication Networks 2021, 1 (2021), 7621260

    2021

  53. [61]

    Linlin Zhang, Hideo Saito, Liang Yang, and Jiajie Wu. 2022. Privacy-preserving federated transfer learning for driver drowsiness detection.IEEE Access 10 (2022), 80565–80574. A Experiments Hyperparameters This section reports the hyperparameter configurations used in the exper...

    2022

  54. [1989]

    UCI Machine Learning Repository

    Heart Disease. UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C52P4X

    doi

  55. [2013]

    In Proceedings of the forty-fifth annual ACM symposium on Theory of computing

    Classical hardness of learning with errors. In Proceedings of the forty-fifth annual ACM symposium on Theory of computing . 575–584

  56. [2018]

    Bootstrapping for approximate homomorphic encryption. In Advances in Cryptology–EUROCRYPT 2018: 37th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Tel A viv, Israel, April 29-May 3, 2018 Proceedings, Part I 37 . Springer, 360–384

    2018

  57. [2022]

    In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA) (CCS ’22)

    META-BTS: Bootstrapping Precision Beyond the Limit. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA) (CCS ’22). Association for Computing Machinery, New York, NY, USA, 223–234. https://doi.org/10.1145/3548606.3560696

    2022

  58. [2024]

    In Biocomputing 2025: Proceedings of the Pacific Symposium

    Enhancing Privacy-Preserving Cancer Classification with Convolutional Neural Networks. In Biocomputing 2025: Proceedings of the Pacific Symposium . World Scientific, 565–579

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.