Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

HE-LRM: Encrypted Deep Learning Recommendation Models using Fully Homomorphic Encryption

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read HE-LRM is the first end-to-end FHE DLRM pipeline that keeps embedding tables server-side and runs Criteo-scale recommendation inference in under eight minutes on a CPU.

desk verdict Digit-decomposition embedding lookup is a real advance; missing test AUC and FHE parameter details are load-bearing but fixable gaps. read the letter →

arxiv 2506.18150 v4 pith:CJ7NXYKP submitted 2025-06-22 cs.CR

Karthik Garimella , Austin Ebel , Gabrielle De Micheli , Brandon Reagen This is my paper
classification cs.CR
keywords FullyHomomorphicEncryptionCKKSDLRMprivateinferenceembeddingtablelookupdigitdecompositionblock-diagonalpackingbaby-stepgiant-step
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper establishes that deep learning recommendation models (DLRMs), which route categorical inputs through huge embedding tables, can be executed end-to-end under fully homomorphic encryption without exposing the tables. The central move is a client-side digit decomposition of each categorical index into base-$p$ digits, so the expensive one-hot expansion and indicator-function circuit move before encryption and the lookup becomes one encrypted matrix-vector product. A block-diagonal packing places many embedding tables in one ciphertext and works with the baby-step giant-step linear transformation, so the lookup consumes a single multiplicative level and no bootstrap, giving a 56-fold speedup over the prior compressed lookup protocol. On a single-threaded CPU the complete private inference takes about 24 seconds on UCI Heart Disease and 228-489 seconds on the industry-scale Criteo click-prediction task, with hardware projections bringing those latencies to seconds and sub-seconds.

What carries the argument

The load-bearing object is the client-side digit decomposition of an index $i \in \mathbb{Z}_k$ into $\ell$ tokens in $\mathbb{Z}_p$, a deterministic generalization of the Quotient-Remainder trick. Because the mapping depends only on the dimensions of the compressed tables, the client can one-hot encode each decomposed digit and encrypt a single sparse vector without learning anything about table values. The server multiplies that vector by a block-diagonal matrix in which all embedding tables are placed along the diagonal, so one ciphertext can carry simultaneous lookups across many tables. The baby-step giant-step matrix-vector product performs the lookup in one multiplicative level and places the extracted embeddings into contiguous slots, making the output directly compatible with the next encrypted layers.

What would settle it

Compute test AUC on the held-out seventh day of Criteo for each compression threshold and compare against the uncompressed baseline; if the AUC drop at the advertised 59x-31180x compression ratios is not small, the central practical claim collapses. A target check: instrument the FHE trace to verify the embedding lookup uses exactly one multiplicative level and no bootstrap.

Watch

Extended reading notes

Core claim

HE-LRM is the first end-to-end FHE DLRM pipeline in which dense features, sparse features, and the embedding lookup itself all remain encrypted while the embedding tables stay on the server. The paper's discovery is that a deterministic base-$p$ digit decomposition of a categorical token, computable on the client from the public compressed-table dimensions, removes the need for homomorphic one-hot construction and for the encrypted indicator function earlier methods required. The server receives one-hot encodings of the decomposed digits, multiplies them by a block-diagonal matrix of compressed tables using a baby-step giant-step linear transformation, and produces the embedding vectors in contiguous slots that feed directly into the downstream MLP. This design consumes only one multiplicative level for the lookup, requires no bootstrap, and outperforms the prior compressed-table protocol by up to 56x on the reported configurations.

Load-bearing premise

The load-bearing premise is that digit-decomposed tables keep the trained model accurate enough; the paper reports loss curves but does not state test AUC numbers or plaintext baselines, so the practical value of HE-LRM stands or falls on an unstated accuracy retention.

Editorial extensions

If this is right

  • A single-threaded CPU can run an entire encrypted DLRM inference in about 24 seconds on a small health-prediction model and in 228-489 seconds on a Criteo-scale click-prediction model, with bootstrapping the dominant cost in the small model.
  • Embedding tables never leave the server and coded-token mappings do not have to be sent to the client, so the protocol avoids the model-weight leakage inherent in client-side embedding lookups.
  • The 56x lookup speedup over the prior protocol comes from replacing the encrypted indicator function and its bootstraps with a client-side one-hot encoding plus a single-level matrix-vector product.
  • Projected GPU and ASIC execution of the same FHE traces reduces end-to-end latencies to seconds and sub-seconds, respectively, which is the regime needed for production recommender traffic.
  • The same compression and packing primitives bring a GPT-2-scale transformer embedding lookup from hours to minutes and cut the per-generated-token communication rounds down to a small ciphertext upload.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If compressed embeddings hold up on accuracy, the same client-side digit decomposition should transfer to other sparse-index models, such as user-item collaborative filters or graph node embeddings, where table transfer is the bottleneck.
  • The paper's transformer discussion implies a layout mismatch: its row-major contiguous output must be repacked into column-packed ciphertexts for existing attention implementations; closing that gap could make non-interactive encrypted generation practical, which the paper leaves open.
  • Fixing the decomposition base at $p=4$ in the Criteo experiments leaves room for tuning: making $p$ and $\ell$ per-table choices, or learning them during training, could shift the accuracy-versus-compression frontier that the paper only sketches.
  • The cost picture suggests a simple design rule for FHE-friendly recommenders: cap each table's vocabulary near a power of the decomposition base so the one-hot input fits in one or a few ciphertexts; DLRMs that respect this rule are the ones that reach the ~230-second plateau.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents HE-LRM, a fully homomorphic encryption (FHE) based inference pipeline for Deep Learning Recommendation Models (DLRMs) that supports both dense and sparse features entirely under encryption. The main technical contributions are a client-side digit-decomposition scheme that compresses large embedding tables into smaller base-p tables, and a block-diagonal multi-embedding packing strategy that allows multiple embedding lookups to be performed in a single SIMD matrix-vector product. The approach is implemented in the open-source Orion FHE framework and evaluated on the UCI Heart Disease and Criteo datasets, reporting 24.22 seconds and roughly 228-489 seconds end-to-end CPU latencies. The paper also discusses extending the embedding-lookup primitives to LLM prefill and generation, arguing that all prior CKKS-based transformer inference works leak embedding tables by performing client-side lookups. The claimed headline result is a 56x speedup over the prior CodedHeLUT approach, enabled by reducing the embedding lookup to a single multiplicative level and avoiding encrypted indicator functions and bootstraps.

Significance. If the results hold, HE-LRM is a meaningful step toward practical private DLRM inference: it is, to my knowledge, the first end-to-end FHE DLRM implementation that keeps embedding tables server-side and performs the entire lookup under encryption, and the reported latencies on standard CPU hardware are substantially better than prior encrypted-lookup baselines. The paper offers a clean, reproducible system contribution: the code is open-sourced, the benchmark numbers are averaged over three runs, and the comparison against CodedHeLUT includes a detailed per-operation breakdown (Table 1) that helps the reader understand where the speedup comes from. The block-diagonal packing observation is also useful beyond DLRMs, and the discussion of LLM embedding costs identifies a real gap in prior FHE-transformer works. However, the significance is tempered by two omissions: no test AUC or plaintext accuracy baseline is reported for the compressed models, and the FHE parameter set is not specified. Both omissions are directly relevant to whether the reported latencies describe a usable deployment-quality model.

major comments (4)
  1. [§6.2 and Table 2] The central practical claim that aggressively compressed DLRMs remain accurate is not supported by any reported test AUC or plaintext baseline. Section 6.2 states only that "more compressed models exhibit slightly higher loss" and that "SiLU models consistently show lower test AUC," and Figure 9 shows training curves, not test AUC values. Table 2 reports compression ratios up to 31180x, but no accuracy is attached to any row. Please report test AUC (and ideally a confidence interval) for each compression threshold in Table 2, for both the ReLU and SiLU variants, together with the AUC of an uncompressed baseline DLRM. Without these numbers, the 56x speedup and the end-to-end latencies in Figure 10 may be achieved on models whose accuracy is below the threshold required for practical deployment.
  2. [§6.1 and §6.3] The FHE parameter set is not specified beyond the statement "we choose an FHE parameter set that enables bootstrapping while maintaining 128-bit security." The latency, level budget, and bootstrap count reported in Section 6.3 and Table 1 all depend on the ring degree N, the chain of coefficient moduli, the scaling factor, and the number of levels reserved for bootstrapping. Please report the concrete parameters (e.g., N, modulus bit lengths, scaling factor, and the estimated security level) used for each reported latency. Without this, the results are not reproducible and the comparison in Table 1 cannot be checked.
  3. [Abstract, §5.1, and Figure 6] The 56x speedup is attributed in the abstract to "client-side digit decomposition," but the comparison in Figure 6 and Table 1 bundles at least two distinct optimizations: eliminating the encrypted indicator function through client-side one-hot encoding, and replacing CodedHeLUT's TableMult with a double-hoisted BSGS linear transformation. The text acknowledges the BSGS substitution, but the headline claim would be clearer if the speedup were decomposed, e.g., by reporting CodedHeLUT with and without the BSGS substitution. This matters because a reader may otherwise credit the entire 56x to the digit-decomposition compression scheme alone.
  4. [§6.4 and Figure 11] The GPU and ASIC latency projections are presented in the abstract and conclusion as concrete outcomes ("can reduce end-to-end latencies to seconds and even sub-seconds"), but they are obtained by feeding Orion's static trace into Cheddar's primitive-level GPU microbenchmarks and Osiris's ASIC cost model, not by running the end-to-end HE-LRM pipeline on those backends. Please state explicitly in Section 6.4 that these are model-based projections, not measured end-to-end results, and report the key assumptions of the Osiris cost model (e.g., array dimensions, clock frequency, memory bandwidth) that drive the sub-second ASIC estimate.
minor comments (6)
  1. [Abstract and §6.3] The abstract reports Criteo latencies of "228 to 489 seconds," and Section 6.3 discusses models around 230 seconds for the highly compressed configurations, while the conclusion says "489 seconds." Please clarify which configuration produces the 489-second number and which produces the 228-second number, so the range is unambiguous.
  2. [Figure 9] The caption of Figure 9 reads "Uncompressed (33M rows)" repeated three times; this looks like a placeholder and should be replaced with the actual compression-ratio labels for each curve.
  3. [§6.3] The UCI model is said to use the "x2 activation function rather than ReLU," but x2 is not defined or motivated in the text; please explain what this activation is and how it was chosen.
  4. [§6.2] The text says the digit-decomposition strategy is implemented with base p=4 for Criteo, but it does not say how p or the embedding-table threshold are chosen per configuration, nor whether the UCI experiments use the same p. Please specify the exact p and threshold for each row of Table 2.
  5. [§5.1] The claim that the client "knows the size of the compressed embedding tables, which is encompassed by our threat model" deserves a sentence clarifying why revealing table dimensions and the base p does not leak information about the learned embeddings themselves; this would preempt a natural security question from readers.
  6. [Table 1] The comparison in Table 1 is helpful, but it should state whether the CodedHeLUT timings are taken from the original paper or reimplemented in the authors' framework, and, if reimplemented, how the reimplementation was validated against the original results.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: HE-LRM's central claims are measured benchmarks and comparisons against an external baseline, not derivations from fitted inputs or self-cited theorems.

full rationale

The paper's central claims are empirical and externally grounded. The 56x speedup is a measured comparison against CodedHeLUT, a prior published algorithm from a different group, reported as detailed component timings in Table 1 and Figure 6. The end-to-end latencies on UCI and Criteo are benchmark measurements on a single-threaded CPU, not quantities obtained by definition from the method's own construction. No parameter is fitted to reproduce a target latency or accuracy, so the fitted-input-called-prediction pattern does not apply. The digit-decomposition compression is explicitly presented as a generalization of the Quotient-Remainder method from Shi et al. [58], and the compressed embedding tables are trained end-to-end, so the method does not define its target in terms of the FHE pipeline. The paper does cite prior work by the same authors: Orion [22] is the integration framework, and Osiris [23] supplies the ASIC cost model for projected latencies. These are infrastructure and projection tools rather than load-bearing derivations of the measured results; the CPU measurements and the external CodedHeLUT comparison stand independently. The acknowledged absence of test AUC values and plaintext baselines in Section 6.2 is a real evaluation weakness, but it is an omission of evidence, not a circular step, and the paper does not claim accuracy follows from the FHE construction. The appended limitation in Section 7.4, where the authors state they do not train compressed LLM embeddings in this work and instead identify the problem and demonstrate tractability, further shows that the authors do not disguise assumptions as derived results. Overall, no circular step can be exhibited with a specific equation or fitted-parameter reduction, so the circularity score is low despite minor self-citation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The core of the paper is an engineering optimization, so the ledger is short. The genuinely hand-chosen numbers (base p, compression thresholds, FHE parameters) are evaluation choices, not fitted predictions. The main unproven assumption is accuracy preservation, which is asserted qualitatively rather than demonstrated numerically.

free parameters (3)
  • base p for digit decomposition = 4 (Criteo)
    Section 6.2: 'we implement our digit decomposition strategy (with base p=4) in the CAFE framework for Criteo.' The choice affects compression ratio and one-hot input length; no sweep or justification is given.
  • compression thresholds = 500, 5000, 50000, 500000, 5000000 rows
    Table 2: thresholds determine which tables are compressed and the resulting compression ratio (31180x down to 12.18x). These are hand-chosen evaluation points, not fitted to data.
  • FHE parameter set = not specified
    Section 6.1: 'we choose an FHE parameter set that enables bootstrapping while maintaining 128-bit security' but no ring dimension, level budget, or scaling parameters are given; latencies depend on these.
assumptions (4)
  • domain assumption CKKS is IND-CPA secure under the RingLWE hardness assumption.
    Section 2.1; the privacy guarantee of the whole pipeline rests on this standard cryptographic assumption.
  • domain assumption The client is allowed to know the compressed embedding table dimensions (p, l per feature).
    Section 3 (threat model) states the client knows the input dimensionality; Section 5.1 notes the client must know the compressed table sizes to compute the digit decomposition. If model architecture is sensitive, this leaks structural information.
  • ad hoc to paper Digit-decomposed embeddings preserve DLRM accuracy.
    This is the paper's own design claim; supported only by unquantified training curves in Section 6.2 and no test AUC numbers.
  • standard math BSGS matrix-vector product is correct and implemented per Orion [22].
    Used in Section 5.2; correctness relies on the published Orion linear-transform algorithm.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HE-LRM: Encrypted Deep Learning Recommendation Models using Fully Homomorphic Encryption." pith.science (2026). https://pith.science/paper/CJ7NXYKP

@misc{pith2026250618150,
  author       = {Pith},
  title        = {Pith review of: HE-LRM: Encrypted Deep Learning Recommendation Models using Fully Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CJ7NXYKP}},
  note         = {Machine review of arXiv:2506.18150}
}
abstract

Fully Homomorphic Encryption (FHE) enables computation directly on encrypted data and privacy-preserving neural inference in the cloud. Existing solutions focus on models with dense inputs (e.g., CNNs and MLPs). Recommendation models (e.g., DLRM) pose a different challenge: sparse categorical inputs require private lookups into large embedding tables, which must be implemented using FHE's restrictive operators. Naive lookups incur significant communication and memory costs; prior work proposes compressing embedding tables at the expense of introducing large server-side compute costs (i.e., indicator function) and revealing embedding-table structure. We present HE-LRM, a performance optimized solution for executing recommendation with FHE. First, we develop an embedding compression technique using client-side digit decomposition that achieves 56$\times$ speedup over the state-of-the-art. Next, we propose a multi-embedding packing strategy that enables ciphertext SIMD-parallel lookups across multiple tables. We integrate HE-LRM into the open-source Orion FHE framework to demonstrate end-to-end encrypted DLRM inference. We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively, on a single-threaded CPU. Finally, we show how GPU and ASIC FHE acceleration can reduce end-to-end latencies to seconds and even sub-seconds. Our code can be found at https://github.com/baahl-nyu/orion/tree/criteo-helrm.

Figures

Figures reproduced from arXiv: 2506.18150 by the authors.

Figure 1
Figure 1. Prior FHE inference protocols perform embedding [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Architecture of a Deep Learning Recommendation [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Latencies (single-threaded) of primitive homomor [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Embedding table sizes (number of rows) for each [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Prior work [68] compressed embedding lookup with k rows and an embedding dimension of size d = 3. The client must store the coded token mapping of size k ×ℓ locally. Prior work performs this compressed lookup homomorphically by utilizing pℓ slots per ciphertext and per…
Figure 6
Figure 6. Figure 6: Comparison of encrypted embedding lookups using a fixed set of FHE parameters for different settings of [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Client-side base-p digit decomposition maps the token “cat” (14) to coded tokens (2,3). case is to simply encrypt each compressed index separately and perform the methods discussed before. However, this method would require one CKKS ciphertext per embedding table and m…
Figure 8
Figure 8. Figure 8: Block-diagonal packing of embedding tables, which [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Training curves and performance trade-offs for com [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: End-to-end (aggregate) FHE latency of a single [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: Projected GPU [14] and ASIC [23] for the SiLU￾based DLRMs. even GPU acceleration provides roughly 200× speedup over CPU, bringing previously impractical runtimes from minutes down to seconds. We examine these speedups across differ￾ent compression ratios to understand…
Figure 12
Figure 12. Figure 12: A state-of-the-art ciphertext-plaintext matrix [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: LLM Embedding latency using our block-diagonal [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: The HE-LRM architecture. Beginning from the [PITH_FULL_IMAGE:figures/full_fig_p015_14.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Efficient Privacy-Preserving Recommendation on Sparse Data using Fully Homomorphic Encryption

    cs.CR 2025-09 reject novelty 4.0 of 10

    Encrypted matrix factorization using Compressed Sparse Row representation and CKKS fully homomorphic encryption is claimed to reduce communication cost to M/L ciphertexts while keeping accuracy, but the evaluation lac...

Reference graph

Works this paper leans on

74 extracted references · 54 canonical work pages · cited by 1 Pith paper

  1. [1]

    Fab: An fpga- based accelerator for bootstrappable fully homomorphic encryption

    Rashmi Agrawal, Leo de Castro, Guowei Yang, Chi- raag Juvekar, Rabia Yazicigil, Anantha Chandrakasan, Vinod Vaikuntanathan, and Ajay Joshi. Fab: An fpga- based accelerator for bootstrappable fully homomorphic encryption. In2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), pages 882–895. IEEE, 2023

    work page 2023

  2. [2]

    Helayers: A tile tensors framework for large neural networks on encrypted data.arXiv preprint arXiv:2011.01805, 2020

    Ehud Aharoni, Allon Adir, Moran Baruch, Nir Drucker, Gilad Ezov, Ariel Farkash, Lev Greenberg, Ramy Masalha, Guy Moshkowich, Dov Murik, et al. Helayers: A tile tensors framework for large neural networks on encrypted data.arXiv preprint arXiv:2011.01805, 2020

    arXiv 2011

  3. [3]

    Llama 3 model card

    AI@Meta. Llama 3 model card. 2024. URL: https://github.com/meta-llama/llama3/ blob/main/MODEL_CARD.md

    work page 2024

  4. [4]

    Privft: Private and fast text classification with homomorphic encryption.IEEE Access, 8:226544–226556, 2020

    Ahmad Al Badawi, Louie Hoang, Chan Fook Mun, Kim Laine, and Khin Mi Mi Aung. Privft: Private and fast text classification with homomorphic encryption.IEEE Access, 8:226544–226556, 2020

    work page 2020

  5. [5]

    Tenseal: A library for encrypted tensor operations using homomorphic encryption.arXiv preprint arXiv:2104.03152, 2021

    Ayoub Benaissa, Bilal Retiat, Bogdan Cebere, and Alaa Eddine Belfedhal. Tenseal: A library for encrypted tensor operations using homomorphic encryption.arXiv preprint arXiv:2104.03152, 2021

    arXiv 2021

  6. [6]

    ngraph-he2: A high- throughput framework for neural network inference on encrypted data

    Fabian Boemer, Anamaria Costache, Rosario Cam- marota, and Casimir Wierzynski. ngraph-he2: A high- throughput framework for neural network inference on encrypted data. InProceedings of the 7th ACM work- shop on encrypted computing & applied homomorphic cryptography, pages 45–56, 2019

    work page 2019

  7. [7]

    ngraph-he: a graph compiler for deep learning on homomorphically encrypted data

    Fabian Boemer, Yixing Lao, Rosario Cammarota, and Casimir Wierzynski. ngraph-he: a graph compiler for deep learning on homomorphically encrypted data. In Proceedings of the 16th ACM international conference on computing frontiers, pages 3–13, 2019

    work page 2019

  8. [8]

    Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys

    Jean-Philippe Bossuat, Christian Mouchet, Juan Troncoso-Pastoriza, and Jean-Pierre Hubaux. Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys. InAnnual International Confer- ence on the Theory and Applications of Cryptographic Techniques, pages 587–617. Springer, 2021

    work page 2021

Show all 74 references
  1. [9]

    Fast homomorphic evaluation of deep discretized neural networks

    Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. Fast homomorphic evaluation of deep discretized neural networks. InAdvances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, Au- gust 19–23, 2018, Procee...

    2018

  2. [10]

    The-x: Privacy-preserving transformer in- ference with homomorphic encryption.arXiv preprint arXiv:2206.00216, 2022

    Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. The-x: Privacy-preserving transformer in- ference with homomorphic encryption.arXiv preprint arXiv:2206.00216, 2022

    2022 arXiv

  3. [11]

    Bootstrapping for approxi- mate homomorphic encryption

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. Bootstrapping for approxi- mate homomorphic encryption. InAnnual International Conference on the Theory and Applications of Crypto- graphic Techniques, pages 360–384. Springer, 2018

    2018

  4. [12]

    Homomorphic encryption for arithmetic of approximate numbers

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yong- soo Song. Homomorphic encryption for arithmetic of approximate numbers. InAdvances in cryptology– ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptology and informa- tion security, Hong kong, ...

    2017

  5. [13]

    {DaCapo}: Automatic boot- strapping management for efficient fully homomorphic encryption

    Seonyoung Cheon, Yongwoo Lee, Dongkwan Kim, Ju Min Lee, Sunchul Jung, Taekyung Kim, Dongyoon Lee, and Hanjun Kim. {DaCapo}: Automatic boot- strapping management for efficient fully homomorphic encryption. In33rd USENIX Security Symposium (USENIX Security 24), pages 6993–7010, 2024

    2024

  6. [14]

    Ched- dar: A swift fully homomorphic encryption library de- signed for gpu architectures

    Wonseok Choi, Jongmin Kim, and Jung Ho Ahn. Ched- dar: A swift fully homomorphic encryption library de- signed for gpu architectures. InProceedings of the 31st ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 1, page...

    2026

  7. [15]

    Por- cupine: A synthesizing compiler for vectorized homo- morphic encryption

    Meghan Cowan, Deeksha Dangwal, Armin Alaghi, Car- oline Trippel, Vincent T Lee, and Brandon Reagen. Por- cupine: A synthesizing compiler for vectorized homo- morphic encryption. InProceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and I...

    2021

  8. [16]

    Criteo display advertising chal- lenge dataset

    Criteo Labs. Criteo display advertising chal- lenge dataset. https://www.kaggle.com/c/ criteo-display-ad-challenge , 2014. One week of anonymized ad impressions for CTR prediction; accessed 2025-10-26

    2014

  9. [17]

    cuHE: CUDA homomorphic encryption library

    Wei Dai. cuHE: CUDA homomorphic encryption library. URL: https://github.com/vernamlab/ cuHE

  10. [18]

    Eva: An encrypted vector arithmetic language and compiler for efficient homomorphic computation

    Roshan Dathathri, Blagovesta Kostova, Olli Saarikivi, Wei Dai, Kim Laine, and Madan Musuvathi. Eva: An encrypted vector arithmetic language and compiler for efficient homomorphic computation. InProceedings of the 41st ACM SIGPLAN conference on programming 17 language design an...

    2020

  11. [19]

    Chet: an optimizing compiler for fully-homomorphic neural-network inferencing

    Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. Chet: an optimizing compiler for fully-homomorphic neural-network inferencing. InPro- ceedings of the 40th ACM SIGPLAN conference on pro- gramming langu...

    2019

  12. [20]

    Low-precision hardware architectures meet recommendation model in- ference at scale.IEEE Micro, 41(5):93–100, 2021

    Zhaoxia Deng, Jongsoo Park, Ping Tak Peter Tang, Haixin Liu, Jie Yang, Hector Yuen, Jianyu Huang, Daya Khudia, Xiaohan Wei, Ellie Wen, et al. Low-precision hardware architectures meet recommendation model in- ference at scale.IEEE Micro, 41(5):93–100, 2021

    2021

  13. [21]

    A unified vector processing unit for fully homomorphic encryption

    Jiangbin Dong, Xinhua Chen, and Mingyu Gao. A unified vector processing unit for fully homomorphic encryption. In2025 Design, Automation & Test in Europe Conference (DATE), pages 1–7, 2025. doi: 10.23919/DATE64628.2025.10992987

    2025

  14. [22]

    Orion: A fully homomorphic encryption framework for deep learning

    Austin Ebel, Karthik Garimella, and Brandon Reagen. Orion: A fully homomorphic encryption framework for deep learning. InProceedings of the 30th ACM In- ternational Conference on Architectural Support for Programming Languages and Operating Systems, Vol- ume 2, ASPLOS ’25, pag...

    2025

  15. [23]

    Osiris: A systolic approach to accelerating fully homomorphic encryption

    Austin Ebel and Brandon Reagen. Osiris: A systolic approach to accelerating fully homomorphic encryption. ACM Transactions on Architecture and Code Optimiza- tion, 2024

    2024

  16. [24]

    A pragmatic introduction to secure multi-party com- putation.Found

    David Evans, Vladimir Kolesnikov, and Mike Rosulek. A pragmatic introduction to secure multi-party com- putation.Found. Trends Priv. Secur., 2(2–3):70–246, December 2018.doi:10.1561/3300000019

    2018 doi

  17. [25]

    F1: A fast and programmable accelerator for fully homo- morphic encryption (extended version), 2021

    Axel Feldmann, Nikola Samardzic, Aleksandar Krastev, Srini Devadas, Ron Dreslinski, Karim Eldefrawy, Nicholas Genise, Chris Peikert, and Daniel Sanchez. F1: A fast and programmable accelerator for fully homo- morphic encryption (extended version), 2021. arXiv: 2109.05371

    2021 arXiv

  18. [26]

    Fully homomorphic encryption using ideal lattices

    Craig Gentry. Fully homomorphic encryption using ideal lattices. InProceedings of the Forty-First Annual ACM Symposium on Theory of Computing, STOC ’09, page 169–178, New York, NY , USA, 2009. Association for Computing Machinery. doi:10.1145/1536414. 1536440

    2009 doi

  19. [27]

    Learning to collide: Recommendation system model compres- sion with learned hash functions.arXiv preprint arXiv:2203.15837, 2022

    Benjamin Ghaemmaghami, Mustafa Ozdal, Rakesh Ko- muravelli, Dmitriy Korchev, Dheevatsa Mudigere, Kr- ishnakumar Nair, and Maxim Naumov. Learning to collide: Recommendation system model compres- sion with learned hash functions.arXiv preprint arXiv:2203.15837, 2022

    2022 arXiv

  20. [28]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. InInternational con- ference on machine learning, pages 201–210. PMLR, 2016

  21. [29]

    Post-training 4-bit quantization on embedding tables.arXiv preprint arXiv:1911.02079, 2019

    Hui Guan, Andrey Malevich, Jiyan Yang, Jongsoo Park, and Hector Yuen. Post-training 4-bit quantization on embedding tables.arXiv preprint arXiv:1911.02079, 2019

    1911 arXiv

  22. [30]

    Lee, An- drey Malevich, Dheevatsa Mudigere, Mikhail Smelyan- skiy, Liang Xiong, and Xuan Zhang

    Udit Gupta, Carole-Jean Wu, Xiaodong Wang, Maxim Naumov, Brandon Reagen, David Brooks, Bradford Cot- tel, Kim Hazelwood, Bill Jia, Hsien-Hsin S. Lee, An- drey Malevich, Dheevatsa Mudigere, Mikhail Smelyan- skiy, Liang Xiong, and Xuan Zhang. The architectural implications of fa...

    2020 arXiv

  23. [31]

    CipherGPT: Secure two-party GPT inference

    Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen jie Lu, Cheng Hong, and Kui Ren. CipherGPT: Secure two-party GPT inference. Cryptology ePrint Archive, Paper 2023/1147, 2023. URL: https://eprint.iacr. org/2023/1147

    2023

  24. [32]

    Cheetah: Lean and fast secure Two-Party deep neural network inference

    Zhicong Huang, Wen jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure Two-Party deep neural network inference. In31st USENIX Security Symposium (USENIX Security 22), pages 809–826, Boston, MA, August 2022. USENIX Association. URL: https://www.usenix.org/ con...

    2022

  25. [33]

    tiktoken: A fast bpe to- keniser for use with openai’s models.https://github

    Shantanu Jain and OpenAI. tiktoken: A fast bpe to- keniser for use with openai’s models.https://github. com/openai/tiktoken, 2022. Accessed: 2026-02-06

    2022

  26. [34]

    Heart Disease

    Andras Janosi, William Steinbrunn, Matthias Pfisterer, and Robert Detrano. Heart Disease. UCI Machine Learning Repository, 1989. DOI: https://doi.org/10.24432/C52P4X

    1989 doi

  27. [35]

    Wonkyung Jung, Sangpyo Kim, Jung Ho Ahn, Jung Hee Cheon, and Younho Lee. Over 100x faster bootstrap- ping in fully homomorphic encryption through memory- centric optimization with gpus.IACR Transactions on Cryptographic Hardware and Embedded Systems, pages 114–148, 2021. 18

    2021

  28. [36]

    GAZELLE: A low latency framework for secure neural network inference

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. GAZELLE: A low latency framework for secure neural network inference. In27th USENIX Security Symposium (USENIX Security 18), pages 1651– 1669, Baltimore, MD, August 2018. USENIX Associa- tion. URL: https://www.us...

    2018

  29. [37]

    Learning multi-granular quantized embeddings for large- vocab categorical features in recommender systems

    Wang-Cheng Kang, Derek Zhiyuan Cheng, Ting Chen, Xinyang Yi, Dong Lin, Lichan Hong, and Ed H Chi. Learning multi-granular quantized embeddings for large- vocab categorical features in recommender systems. In Companion Proceedings of the Web Conference 2020, pages 562–566, 2020

    2020

  30. [38]

    Sharp: A short-word hierarchical accelerator for robust and prac- tical fully homomorphic encryption

    Jongmin Kim, Sangpyo Kim, Jaewan Choi, Jaiyoung Park, Donghwan Kim, and Jung Ho Ahn. Sharp: A short-word hierarchical accelerator for robust and prac- tical fully homomorphic encryption. InProceedings of the 50th Annual International Symposium on Computer Architecture, pages 1...

    2023

  31. [39]

    ARK: Fully homomorphic encryption accelerator with runtime data generation and inter-operation key reuse

    Jongmin Kim, Gwangho Lee, Sangpyo Kim, Gina Sohn, Minsoo Rhu, John Kim, and Jung Ho Ahn. ARK: Fully homomorphic encryption accelerator with runtime data generation and inter-operation key reuse. In2022 55th IEEE/ACM International Symposium on Microar- chitecture (MICRO). IEEE,...

    2022

  32. [40]

    Sangpyo Kim, Jongmin Kim, Michael Jaemin Kim, Wonkyung Jung, John Kim, Minsoo Rhu, and Jung Ho Ahn. BTS. InProceedings of the 49th Annual Interna- tional Symposium on Computer Architecture. ACM, jun

  33. [41]

    Mascot: A quantization framework for efficient matrix factorization in recommender systems

    Yunyong Ko, Jae-Seo Yu, Hong-Kyun Bae, Yongjun Park, Dongwon Lee, and Sang-Wook Kim. Mascot: A quantization framework for efficient matrix factorization in recommender systems. In2021 IEEE International Conference on Data Mining (ICDM), pages 290–299. IEEE, 2021

    2021

  34. [42]

    A tensor compiler with automatic data packing for simple and efficient fully homomorphic encryption.Proceedings of the ACM on Programming Languages, 8(PLDI):126– 150, 2024

    Aleksandar Krastev, Nikola Samardzic, Simon Lan- gowski, Srinivas Devadas, and Daniel Sanchez. A tensor compiler with automatic data packing for simple and efficient fully homomorphic encryption.Proceedings of the ACM on Programming Languages, 8(PLDI):126– 150, 2024

    2024

  35. [43]

    Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions

    Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. InInternational Conference on Machine Learning, pages...

    2022

  36. [44]

    Privacy-preserving text classification on bert embeddings with homomorphic encryption.arXiv preprint arXiv:2210.02574, 2022

    Garam Lee, Minsoo Kim, Jai Hyun Park, Seung-won Hwang, and Jung Hee Cheon. Privacy-preserving text classification on bert embeddings with homomorphic encryption.arXiv preprint arXiv:2210.02574, 2022

    2022 arXiv

  37. [45]

    Pre-training of deep bidirectional transformers for language understand- ing.arXiv preprint arXiv:1810.04805, 3(8):4171–4186, 2018

    JDMCK Lee and K Toutanova. Pre-training of deep bidirectional transformers for language understand- ing.arXiv preprint arXiv:1810.04805, 3(8):4171–4186, 2018

    2018 arXiv

  38. [46]

    {ELASM}:{Error- Latency-Aware} scale management for fully homomor- phic encryption

    Yongwoo Lee, Seonyoung Cheon, Dongkwan Kim, Dongyoon Lee, and Hanjun Kim. {ELASM}:{Error- Latency-Aware} scale management for fully homomor- phic encryption. In32nd USENIX Security Symposium (USENIX Security 23), pages 4697–4714, 2023

    2023

  39. [47]

    Hecate: Performance-aware scale optimization for homomorphic encryption compiler

    Yongwoo Lee, Seonyeong Heo, Seonyoung Cheon, Shin- nung Jeong, Changsu Kim, Eunkyung Kim, Dongyoon Lee, and Hanjun Kim. Hecate: Performance-aware scale optimization for homomorphic encryption compiler. In 2022 IEEE/ACM International Symposium on Code Generation and Optimizatio...

    2022

  40. [48]

    Fastquery: Communication- efficient embedding table query for private llm inference,

    Chenqi Lin, Tianshi Xu, Zebin Yang, Runsheng Wang, Ru Huang, and Meng Li. Fastquery: Communication- efficient embedding table query for private llm inference,

  41. [49]

    Oblivious neural network predictions via minionn trans- formations

    Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn trans- formations. InProceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 619–631, 2017

    2017

  42. [50]

    Cafe+: Towards compact, adaptive, and fast embedding for large-scale online recommendation models.ACM Transactions on Information Systems, 2025

    Zirui Liu, Hailin Zhang, Boxuan Chen, Zihan Jiang, Yikai Zhao, Yangyu Tao, Tong Yang, and Bin Cui. Cafe+: Towards compact, adaptive, and fast embedding for large-scale online recommendation models.ACM Transactions on Information Systems, 2025

    2025

  43. [51]

    Coy- ote: A compiler for vectorizing encrypted arithmetic circuits

    Raghav Malik, Kabir Sheth, and Milind Kulkarni. Coy- ote: A compiler for vectorizing encrypted arithmetic circuits. InProceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3, pages 118– 133, 2023

    2023

  44. [52]

    Thor: Secure transformer inference with homo- morphic encryption

    Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Mi- ran Kim. Thor: Secure transformer inference with homo- morphic encryption. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 3765–3779, 2025. 19

    2025

  45. [53]

    Deep learning recommen- dation model for personalization and recommendation systems.arXiv preprint arXiv:1906.00091, 2019

    Maxim Naumov, Dheevatsa Mudigere, Hao-Jun Michael Shi, Jianyu Huang, Narayanan Sundaraman, Jongsoo Park, Xiaodong Wang, Udit Gupta, Carole-Jean Wu, Alisson G Azzolini, et al. Deep learning recommen- dation model for personalization and recommendation systems.arXiv preprint arX...

    1906 arXiv

  46. [54]

    Language models are un- supervised multitask learners

    Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are un- supervised multitask learners. 2019

    2019

  47. [55]

    Cheetah: Optimizing and accelerating homo- morphic encryption for private inference

    Brandon Reagen, Woo-Seok Choi, Yeongil Ko, Vin- cent T Lee, Hsien-Hsin S Lee, Gu-Yeon Wei, and David Brooks. Cheetah: Optimizing and accelerating homo- morphic encryption for private inference. In2021 IEEE International Symposium on High-Performance Com- puter Architecture (HP...

    2021

  48. [56]

    Sadegh Riazi, Kim Laine, Blake Pelton, and Wei Dai

    M. Sadegh Riazi, Kim Laine, Blake Pelton, and Wei Dai. Heax: An architecture for computing on encrypted data. InProceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS ’20, page 1295–1309, New Yo...

    2020 doi

  49. [57]

    Craterlake: A hardware accelerator for efficient un- bounded computation on encrypted data

    Nikola Samardzic, Axel Feldmann, Aleksandar Krastev, Nathan Manohar, Nicholas Genise, Srinivas Devadas, Karim Eldefrawy, Chris Peikert, and Daniel Sanchez. Craterlake: A hardware accelerator for efficient un- bounded computation on encrypted data. InProceedings of the 49th Ann...

    2022

  50. [58]

    Compositional embeddings using complementary partitions for memory-efficient recom- mendation systems

    Hao-Jun Michael Shi, Dheevatsa Mudigere, Maxim Nau- mov, and Jiyan Yang. Compositional embeddings using complementary partitions for memory-efficient recom- mendation systems. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Dis- covery & Data Mining,...

    2020

  51. [59]

    Compressing word embeddings via deep compositional code learn- ing

    Raphael Shu and Hideki Nakayama. Compressing word embeddings via deep compositional code learn- ing. InProceedings of the International Conference on Learning Representations (ICLR), 2018. Available at https://openreview.net/forum?id=BJRZzFlRb

    2018

  52. [60]

    Delphi: A cryptographic inference service for neural networks

    Wenting Zheng Srinivasan, PMRL Akshayaram, and Popa Raluca Ada. Delphi: A cryptographic inference service for neural networks. InProc. 29th USENIX secur. symp, volume 3, 2019

    2019

  53. [61]

    Clustering the sketch: dynamic compression for embedding tables.Advances in Neural Information Processing Systems, 36:72155– 72180, 2023

    Henry Tsang and Thomas Ahle. Clustering the sketch: dynamic compression for embedding tables.Advances in Neural Information Processing Systems, 36:72155– 72180, 2023

    2023

  54. [62]

    Sealion: A framework for neural network inference on encrypted data.arXiv preprint arXiv:1904.12840, 2019

    Tim van Elsloo, Giorgio Patrini, and Hamish Ivey-Law. Sealion: A framework for neural network inference on encrypted data.arXiv preprint arXiv:1904.12840, 2019

    1904 arXiv

  55. [63]

    Heco: fully homomorphic encryption com- piler

    Alexander Viand, Patrick Jattke, Miro Haller, and Anwar Hithnawi. Heco: fully homomorphic encryption com- piler. InProceedings of the 32nd USENIX Conference on Security Symposium, SEC ’23, USA, 2023. USENIX Association

    2023

  56. [64]

    Feature hashing for large scale multitask learning

    Kilian Weinberger, Anirban Dasgupta, John Langford, Alex Smola, and Josh Attenberg. Feature hashing for large scale multitask learning. InProceedings of the 26th annual international conference on machine learning, pages 1113–1120, 2009

    2009

  57. [65]

    Arion: Attention- optimized transformer inference on encrypted data

    Linhan Yang, Jingwei Chen, Wangchen Dai, Shuai Wang, Wenyuan Wu, and Yong Feng. Arion: Attention- optimized transformer inference on encrypted data. Cryptology ePrint Archive, 2025

    2025

  58. [66]

    Poseidon: Prac- tical homomorphic encryption accelerator

    Yinghao Yang, Huaizhi Zhang, Shengyu Fan, Hang Lu, Mingzhe Zhang, and Xiaowei Li. Poseidon: Prac- tical homomorphic encryption accelerator. In2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), pages 870–881, 2023. doi:10.1109/HPCA56546.2023.10070984

    2023

  59. [67]

    Tt-rec: Tensor train compression for deep learn- ing recommendation models.Proceedings of Machine Learning and Systems, 3:448–462, 2021

    Chunxing Yin, Bilge Acun, Carole-Jean Wu, and Xing Liu. Tt-rec: Tensor train compression for deep learn- ing recommendation models.Proceedings of Machine Learning and Systems, 3:448–462, 2021

    2021

  60. [68]

    Privacy-preserving embedding via look-up ta- ble evaluation with fully homomorphic encryption

    Jae yun Kim, Saerom Park, Joohee Lee, and Jung Hee Cheon. Privacy-preserving embedding via look-up ta- ble evaluation with fully homomorphic encryption. In Proceedings of the International Conference on Ma- chine Learning (ICML), 2024. Available at https: //openreview.net/foru...

    2024

  61. [69]

    Concrete ML: a privacy-preserving machine learning library using fully homomorphic encryption for data scientists, 2022

    Zama. Concrete ML: a privacy-preserving machine learning library using fully homomorphic encryption for data scientists, 2022. https://github.com/ zama-ai/concrete-ml

    2022

  62. [70]

    Secure transformer infer- ence made non-interactive.Cryptology ePrint Archive, 2024

    Jiawen Zhang, Xinpeng Yang, Lipeng He, Kejia Chen, Wen-jie Lu, Yinghao Wang, Xiaoyang Hou, Jian Liu, Kui Ren, and Xiaohu Yang. Secure transformer infer- ence made non-interactive.Cryptology ePrint Archive, 2024

    2024

  63. [71]

    MOAI: Module-optimizing architec- ture for non-interactive secure transformer inference

    Linru Zhang, Xiangning Wang, Jun Jie Sim, Zhicong Huang, Jiahao Zhong, Huaxiong Wang, Pu Duan, and Kwok Yan Lam. MOAI: Module-optimizing architec- ture for non-interactive secure transformer inference. In 20 The Fourteenth International Conference on Learning Representations, ...

    2026

  64. [72]

    Dqrm: Deep quantized recommendation models.arXiv preprint arXiv:2410.20046, 2024

    Yang Zhou, Zhen Dong, Ellick Chan, Dhiraj Kalamkar, Diana Marculescu, and Kurt Keutzer. Dqrm: Deep quantized recommendation models.arXiv preprint arXiv:2410.20046, 2024. 21

    2024 arXiv

  65. [2022]

    3527415,doi:10.1145/3470496.3527415

    URL: https://doi.org/10.1145%2F3470496. 3527415,doi:10.1145/3470496.3527415

  66. [2024]

    URL: https://arxiv.org/abs/2405.16241, arXiv:2405.16241

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.