Pith. sign in

REVIEW 1 major objections 4 minor 48 references

EinHops: Einsum Notation for Expressive Homomorphic Operations on RNS-CKKS Tensors

T0 review · 1 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Einsum notation gives encrypted tensor operations an explicit three-step pipeline.

desk verdict Brings einsum to RNS-CKKS as a transparent packing language, but the generality claim needs to be scoped down to the fragment actually implemented. read the letter →

arxiv 2507.07972 v1 pith:PNPRK7VW submitted 2025-07-10 cs.CR

Karthik Garimella , Austin Ebel , Brandon Reagen This is my paper
classification cs.CR
keywords einsumnotationRNS-CKKSfullyhomomorphicencryptiontensoroperationsSIMDpackingrotation-and-sumbaby-stepgiant-stepprivacy-preservingmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Einsum notation, the compact "ij,jk->ik" style of expressing tensor operations, can serve as a transparent programming model for encrypted computation under the RNS-CKKS fully homomorphic encryption scheme. The paper argues that any valid einsum expression decomposes into a fixed sequence of FHE-friendly steps: aligning and broadcasting operands to a common slot layout, element-wise SIMD multiplication, and reducing along the contracted dimensions using rotations and additions. The authors implement this idea in EinHops, a minimal system that executes these steps with explicit slot-level operations and leaves the packing strategy visible to the programmer. If the argument is correct, developers can write encrypted tensor programs with a familiar notation and reason directly about how data is laid out in ciphertext slots, instead of relying on opaque compiler abstractions. The approach is currently limited to tensors whose combined dimensions fit in a single encrypted vector.

What carries the argument

The carrying mechanism is a mapping from einsum dimension labels to a fixed slot-layout plan. The plan has three reusable FHE primitives: a permutation step implemented as a baby-step giant-step (BSGS) linear transformation, which rearranges ciphertext slots using a number of rotations that grows roughly with the square root of the vector length; a broadcasting step implemented by logarithmic rotate-and-sum, which replicates values across a new dimension; and a reduction step implemented by the same logarithmic rotate-and-sum, which sums along a contraction dimension. Padding every dimension to a power of two is what makes the broadcast and reduction counts logarithmic, and placing contraction dimensions outermost is what leaves the final sums in contiguous slots without a trailing permutation.

What would settle it

Take a supported einsum expression whose total input sizes fit within the $N/2$ slots, decrypt the intermediate ciphertexts after the broadcast, multiplication, and reduction stages, and compare every slot against the layout predicted by the paper's padding and slot-spacing rules; any mismatch shows the fixed pipeline is incorrect. To test the generality boundary, repeat with an expression whose total input dimension product exceeds $N/2$ and observe whether the system fails, as the stated limitation predicts.

Watch

Extended reading notes

Core claim

The central claim is a structural equivalence: an einsum expression is a plan for a fixed sequence of RNS-CKKS operations, not a black-box tensor call. To execute "ij,jk->ik", EinHops parses the dimension labels and chooses a broadcast shape that puts the contraction dimension outermost and the output dimensions innermost; it then permutes each operand into that shape with a baby-step giant-step matrix-vector product, broadcasts across the new dimensions with a logarithmic rotate-and-sum, multiplies element-wise, and reduces the contraction dimension with another logarithmic rotate-and-sum. A final mask zeros unused slots. Because the equation itself records the layout, the system is eager, interpretable, and works uniformly for transposes, sums, matrix products, batched contractions, and higher-dimensional contractions.

Load-bearing premise

The load-bearing assumption is that the product of all input dimensions fits inside the $N/2$ slots of a single encrypted vector (ciphertext); if a tensor is larger, the fixed pipeline would need to be reworked.

Editorial extensions

If this is right

  • A developer can express any supported encrypted tensor operation as an einsum string and receive an explicit plan of slot permutations, broadcasts, multiplications, and reductions, making the data layout a visible part of the program.
  • The same three-stage pipeline covers transposes, sums, matrix-vector products, matrix multiplication, batched matrix multiplication, bilinear transforms, and five-dimensional contractions without changing the underlying mechanism.
  • Users can choose a memory-efficient configuration with only power-of-two rotation keys and roughly 3 GB of working memory, or a compute-efficient configuration with additional BSGS keys and roughly 32 GB that runs faster.
  • The evaluation shows the pipeline runs on both CPU and GPU backends, with the GPU giving roughly a 6x speedup on most tested operations and a small-scale multi-head attention score computed in about 29 seconds.
  • A cleartext backend lets developers inspect every intermediate slot vector, turning debugging of encrypted tensor programs into ordinary vector arithmetic.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that permutation, not multiplication or reduction, dominates the cost of many expressions; improving the permutation primitive would therefore improve the whole pipeline.
  • A natural next step it leaves open is lifting the single-ciphertext restriction; if rotations across multiple ciphertexts are defined consistently, the same broadcast-multiply-reduce pipeline could scale beyond the $N/2$ slot limit.
  • Because each einsum call produces an explicit plan, repeated calls could be compiled rather than eagerly executed, allowing shared permutations and rotations to be hoisted across expressions.
  • The same dimension-label-to-slot-plan mapping should transfer to other SIMD-capable encryption schemes, such as integer-arithmetic schemes, since their primitives also include vector addition, multiplication, and rotation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 4 minor

Summary. EinHops is a system that maps einsum tensor expressions onto RNS-CKKS homomorphic operations. The authors decompose an einsum expression into a fixed pipeline: dimension expansion and broadcasting, element-wise SIMD multiplication, and rotate-and-sum reductions over contraction dimensions. They implement this decomposition in about 1,000 lines of Python on top of the Liberate.FHE backend, evaluate it on 15 tensor operations plus an attention score computation, and report CPU/GPU runtimes and memory usage. The central claim is that this decomposition makes encrypted tensor operations simple, general, and interpretable while keeping packing decisions explicit.

Significance. If the scope is stated accurately, EinHops is a useful and credible systems contribution. It identifies a clean structural correspondence between einsum and FHE slot operations, implements it end-to-end, and ships open-source code. The evaluation against PyTorch's einsum is an external benchmark rather than a circular self-comparison, and the l2 discrepancies around 1e-5 are consistent with CKKS approximation error. The main limitation of the paper is that the advertised generality is broader than the actually supported einsum fragment: repeated-label expressions such as 'ii->i' are valid einsum but are not covered by the broadcast-multiply-reduce decomposition, and no syntax restriction is stated. The system's transparency and minimalism are genuine strengths, but the scope must be corrected before the central claim can be accepted as stated.

major comments (1)
  1. [§3.1-§3.3, §4.1-§4.3, §5.3] The paper's central claim that EinHops handles general einsum expressions is overstated because the described expand/broadcast/multiply/reduce pipeline does not cover repeated-index expressions. In standard einsum, 'ii->i' extracts the diagonal, 'ii->' computes the trace, and 'ijik->jk' traces over the repeated i. These operations are valid in PyTorch and NumPy, but they cannot be produced by the three-step decomposition: the repeated label denotes selection of diagonal positions rather than duplication followed by reduction. Section 5.3 lists only limitations related to single ciphertexts, bootstrap placement, permutations, and JIT support, with no restriction on repeated labels. The authors should either implement repeated-label support (e.g., via a diagonal mask or a pre-permutation) or explicitly restrict the claims to expressions in which each label appears at most once per operand, and state that restriction in the abstract and introduction.
minor comments (4)
  1. [§6, Table 1] The text says all results are averaged over 10 runs with a small standard deviation, but no variance or confidence intervals are reported; adding standard deviations or error bars to Table 1 would make the runtime claims more reproducible.
  2. [§4.1.2] The phrase 'anop' appears to be a typo for 'no-op' (also in the same paragraph); please fix the wording.
  3. [§5.3.1] The single-ciphertext restriction (product of all input dimensions must fit in N/2 slots) is acknowledged in the limitations section, but the abstract and introduction should carry this caveat, since the current wording says the approach is 'general' and supports 'arbitrary' tensor operations without mentioning this bound.
  4. [§6, Table 1] The paper motivates the work by asking how many multiplicative levels, rotations, and keys an operation consumes, but the evaluation reports only runtime and memory; adding columns for level consumption and rotation count per operation would directly support the paper's stated design goals.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the einsum-to-FHE decomposition is an implementation strategy checked against PyTorch, and the only self-citations are contextual.

full rationale

EinHops' central claim is a deterministic system design: parse an einsum expression, expand/broadcast operands, SIMD-multiply, and rotate-and-sum over contraction dimensions. This is not a derivation from first principles that could collapse into its own inputs; it is an engineering decomposition. The correctness evaluation compares EinHops output to PyTorch's einsum, an external reference implementation, and reports an l2 discrepancy of roughly 1e-5; the system is open source. No parameter is fitted to a subset of data and then renamed as a prediction, and no uniqueness theorem is imported from the authors' prior work. The self-citations in the paper, Orion [23] and Porcupine [18], appear only in the related-work discussion and in a non-load-bearing note about lazy bootstrapping scaling poorly; they do not justify the core decomposition. Section 5.3.1 explicitly discloses the single-ciphertext limitation: 'Currently, EinHops only supports operations between single ciphertexts and as a consequence, the product of all input dimensions to an einsum expression must fit within a single ciphertext.' The paper's Section 3 pipeline (expand/broadcast, multiply, reduce) is also not described for repeated-index einsum forms such as 'ii->i' or 'ii->', which are valid in PyTorch and NumPy; this is a completeness and scope risk in the paper's generality claim, not a circularity, because the claim is validated against an external oracle rather than being defined to match its own output. Under the hard-rule standard that circularity requires an exhibited reduction of a claim to its own input or to a load-bearing self-citation, no such step exists here.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The system introduces no new cryptographic primitives or entities. It relies on standard CKKS operations (SIMD add, mult, rotation) and standard algorithms (BSGS, rotate-and-sum). The main free choice is the power-of-two padding, and the main domain assumption is the single-ciphertext size limit.

free parameters (1)
  • power-of-two padding
    The system pads all tensor dimensions up to powers of two, which is a free design choice that simplifies rotation logic but affects slot utilization and performance.
assumptions (3)
  • domain assumption The product of all input dimensions must fit within a single ciphertext (N/2 slots).
    This is a stated limitation in Section 5.3.1. It restricts the applicability of the system to small tensors and is load-bearing for the claimed generality.
  • domain assumption The CKKS encoding maps SIMD operations to element-wise operations on slots, as described in Section 2.1.5.
    This is a standard property of CKKS and is the foundation of the entire approach.
  • standard math Rotate-and-sum and BSGS are valid implementations of broadcasting and reduction.
    These are standard algorithmic techniques in FHE, and the paper provides the algorithm descriptions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EinHops: Einsum Notation for Expressive Homomorphic Operations on RNS-CKKS Tensors." pith.science (2026). https://pith.science/paper/PNPRK7VW

@misc{pith2026250707972,
  author       = {Pith},
  title        = {Pith review of: EinHops: Einsum Notation for Expressive Homomorphic Operations on RNS-CKKS Tensors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PNPRK7VW}},
  note         = {Machine review of arXiv:2507.07972}
}
read the original abstract

Fully Homomorphic Encryption (FHE) is an encryption scheme that allows for computation to be performed directly on encrypted data, effectively closing the loop on secure and outsourced computing. Data is encrypted not only during rest and transit, but also during processing. However, FHE provides a limited instruction set: SIMD addition, SIMD multiplication, and cyclic rotation of 1-D vectors. This restriction makes performing multi-dimensional tensor operations challenging. Practitioners must pack these tensors into 1-D vectors and map tensor operations onto this one-dimensional layout rather than their traditional nested structure. And while prior systems have made significant strides in automating this process, they often hide critical packing decisions behind layers of abstraction, making debugging, optimizing, and building on top of these systems difficult. In this work, we approach multi-dimensional tensor operations in FHE through Einstein summation (einsum) notation. Einsum notation explicitly encodes dimensional structure and operations in its syntax, naturally exposing how tensors should be packed and transformed. We decompose einsum expressions into a fixed set of FHE-friendly operations. We implement our design and present EinHops, a minimalist system that factors einsum expressions into a fixed sequence of FHE operations. EinHops enables developers to perform encrypted tensor operations using FHE while maintaining full visibility into the underlying packing strategy. We evaluate EinHops on a range of tensor operations from a simple transpose to complex multi-dimensional contractions. We show that the explicit nature of einsum notation allows us to build an FHE tensor system that is simple, general, and interpretable. We open-source EinHops at the following repository: https://github.com/baahl-nyu/einhops.

Figures

Figures reproduced from arXiv: 2507.07972 by the authors.

Figure 1
Figure 1. RNS-CKKS encrypts one-dimensional vectors of a [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Einsum notation for a matrix-matrix multiplication in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (Left) Matrix-vector products between an unencrypted matrix and an encrypted vector with 𝑛 slots. The canonical Halevi-Shoup method multiplies the diagonals of the matrix with the (homomorphically) aligned ciphertext [28]. For a full 𝑛 ×𝑛 matrix, Halevi-Shoup requires 𝑛 homomorphic rotations. The Baby-Step Giant-Step (BSGS) algorithm pre-rotates the cleartext diagonals, therefore reducing the homomorphic rotation co… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Broadcasting in FHE using𝑂(log𝑛) operations. (Top) Expanding outer dimensions ((1, 4) → (2, 4)) does not per￾mute the ordering of existing elements. (Bottom) Expanding inner dimensions ((4, 1) → (4, 2)) strides existing elements and requires a permutation before broadc…
Figure 5
Figure 5. Figure 5: Reductions in FHE using 𝑂(log𝑛) operations. Sum￾ming an inner dimension ("ij->i") introduces gaps between the desired output, whereas summing the outer dimension ("ij->j") produces the desired sums in contiguous slots. algorithm to ensure that we fill up the first "jik…
Figure 6
Figure 6. Figure 6: An overview of EinHops using the same example from Listing [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: EinHops systems overview from the hardware to [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 29 canonical work pages

  1. [1]

    torch.Tensor.stride — PyTorch Documentation

    2025. torch.Tensor.stride — PyTorch Documentation. https://docs.pytorch.org/ docs/stable/generated/torch.Tensor.stride.html. (2025). Accessed: 2025-06-26

    work page 2025

  2. [2]

    Daniel G. a. Smith and Johnnie Gray. 2018. opt_einsum - A Python package for optimizing contraction order for einsum-like expressions. Journal of Open Source Software 3, 26 (2018), 753. https://doi.org/10.21105/joss.00753

    doi:10.21105/joss.00753 2018

  3. [3]

    Martín Abadi, Ashish Agarwal, Paul Barham, Eugene Brevdo, Zhifeng Chen, Craig Citro, Greg S. Corrado, Andy Davis, Jeffrey Dean, Matthieu Devin, San- jay Ghemawat, Ian Goodfellow, Andrew Harp, Geoffrey Irving, Michael Isard, Yangqing Jia, Rafal Jozefowicz, Lukasz Kaiser, Manjunath Kudlur, Josh Levenberg, Dandelion Mané, Rajat Monga, Sherry Moore, Derek Mur...

  4. [4]

    Ehud Aharoni, Allon Adir, Moran Baruch, Nir Drucker, Gilad Ezov, Ariel Farkash, Lev Greenberg, Ramy Masalha, Guy Moshkowich, Dov Murik, Hayim Shaul, and Omri Soceanu. 2023. HeLayers: A Tile Tensors Framework for Large Neural Networks on Encrypted Data. Proceedings on Privacy Enhancing Technologies 2023, 1 (Jan. 2023), 325–342. https://doi.org/10.56553/pop...

    doi:10.56553/popets-2023-0020 2023

  5. [5]

    Jason Ansel, Edward Yang, Horace He, Natalia Gimelshein, Animesh Jain, Michael Voznesensky, Bin Bao, Peter Bell, David Berard, Evgeni Burovski, Geeta Chauhan, Anjali Chourdia, Will Constable, Alban Desmaison, Zachary DeVito, Elias Ellison, Will Feng, Jiong Gong, Michael Gschwind, Brian Hirsh, Sherlock Huang, Kshiteej Kalambarkar, Laurent Kirsch, Michael L...

    arXiv 2024

  6. [6]

    Cédric Augonnet, Andrei Alexandrescu, Albert Sidelnik, and Michael Garland

    work page

  7. [7]

    Mark Blacher, Christoph Staudt, Julien Klaus, Maurice Wenig, Niklas Merk, Alexander Breuer, Max Engel, Sören Laue, and Joachim Giesen. 2024. Einsum Benchmark: Enabling the Development of Next-Generation Tensor Execution Engines. In Advances in Neural Information Processing Systems , A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and ...

    work page 2024

  8. [8]

    James Bradbury, Roy Frostig, Peter Hawkins, Matthew James Johnson, Chris Leary, Dougal Maclaurin, George Necula, Adam Paszke, Jake VanderPlas, Skye Wanderman-Milne, and Qiao Zhang. 2018. JAX: composable transformations of Python+NumPy programs. (2018). http://github.com/jax-ml/jax

    work page 2018

Show all 48 references
  1. [9]

    Zvika Brakerski. 2012. Fully Homomorphic Encryption without Modulus Switch- ing from Classical GapSVP. Cryptology ePrint Archive, Paper 2012/078. (2012). https://eprint.iacr.org/2012/078

    2012

  2. [10]

    Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. 2011. Fully Homo- morphic Encryption without Bootstrapping. Cryptology ePrint Archive, Paper 2011/277. (2011). https://eprint.iacr.org/2011/277

    2011

  3. [12]

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song

  4. [13]

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2016. Homomor- phic Encryption for Arithmetic of Approximate Numbers. Cryptology ePrint Archive, Paper 2016/421. (2016). https://eprint.iacr.org/2016/421

    2016

  5. [14]

    Seonyoung Cheon, Yongwoo Lee, Dongkwan Kim, Ju Min Lee, Sunchul Jung, Taekyung Kim, Dongyoon Lee, and Hanjun Kim. 2024. DaCapo: Automatic Boot- strapping Management for Efficient Fully Homomorphic Encryption. In 33rd USENIX Security Symposium (USENIX Security 24) . USENIX Asso...

    2024

  6. [15]

    Sharan Chetlur, Cliff Woolley, Philippe Vandermersch, Jonathan Cohen, John Tran, Bryan Catanzaro, and Evan Shelhamer. 2014. cuDNN: Efficient Primitives for Deep Learning. (2014). arXiv:cs.NE/1410.0759 https://arxiv.org/abs/1410.0759

    2014 arXiv

  7. [16]

    Cryptology ePrint Archive, Paper 2018/931

    A Full RNS Variant of Approximate Homomorphic Encryption. Cryptology ePrint Archive, Paper 2018/931. (2018). https://eprint.iacr.org/2018/931

    2018

  8. [17]

    PyTorch Contributors. 2024. Broadcasting semantics. https://docs.pytorch.org/ docs/stable/notes/broadcasting.html. (2024). Accessed: 2025-06-26

    2024

  9. [18]

    Lee, and Brandon Reagen

    Meghan Cowan, Deeksha Dangwal, Armin Alaghi, Caroline Trippel, Vincent T. Lee, and Brandon Reagen. 2021. Porcupine: a synthesizing compiler for vectorized homomorphic encryption. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and...

    2021

  10. [19]

    Roshan Dathathri, Blagovesta Kostova, Olli Saarikivi, Wei Dai, Kim Laine, and Madan Musuvathi. 2020. EVA: an encrypted vector arithmetic language and compiler for efficient homomorphic computation. In Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Desig...

    2020

  11. [20]

    Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène. 2018. TFHE: Fast Fully Homomorphic Encryption over the Torus. Cryptology ePrint Archive, Paper 2018/421. (2018). https://eprint.iacr.org/2018/421

    2018

  12. [21]

    Grégoire Delétang, Anian Ruoss, Paul-Ambroise Duquenne, Elliot Catt, Tim Genewein, Christopher Mattern, Jordi Grau-Moya, Li Kevin Wenliang, Matthew Aitchison, Laurent Orseau, Marcus Hutter, and Joel Veness. 2024. Language Modeling Is Compression. In ICLR

    2024

  13. [22]

    DESILO. 2023. Liberate.FHE: A New FHE Library for Bridging the Gap between Theory and Practice with a Focus on Performance and Accuracy. (2023). https: //github.com/Desilo/liberate-fhe

    2023

  14. [23]

    Austin Ebel, Karthik Garimella, and Brandon Reagen. 2025. Orion: A Fully Ho- momorphic Encryption Framework for Deep Learning. In Proceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2 (ASPLOS ’25...

    2025 doi

  15. [24]

    Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. 2019. CHET: an optimizing compiler for fully-homomorphic neural-network inferencing. In Proceedings of the 40th ACM SIGPLAN Conference on Programming La...

    2019

  16. [25]

    Junfeng Fan and Frederik Vercauteren. 2012. Somewhat Practical Fully Ho- momorphic Encryption. Cryptology ePrint Archive, Paper 2012/144. (2012). https://eprint.iacr.org/2012/144

    2012

  17. [26]

    Harvey L. Garner. 1959. The residue number system. In Papers Presented at the the March 3-5, 1959, Western Joint Computer Conference (IRE-AIEE-ACM ’59 (Western)). Association for Computing Machinery, New York, NY, USA, 146–153. https://doi.org/10.1145/1457838.1457864

    1959

  18. [27]

    Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing (STOC ’09). Association for Computing Machinery, New York, NY, USA, 169–178. https://doi.org/10.1145/1536414.1536440

    2009

  19. [28]

    Albert Einstein. 1916. The foundation of the general theory of relativity.Annalen Phys. 49, 7 (1916), 769–822. https://doi.org/10.1002/andp.19163540702

    1916 doi

  20. [29]

    Shai Halevi and Victor Shoup. 2018. Faster Homomorphic Linear Transfor- mations in HElib. In Advances in Cryptology – CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I . Springer-Verlag, Berlin, Heidel...

    2018 doi

  21. [30]

    Kyoohyung Han and Dohyeong Ki. 2019. Better Bootstrapping for Approximate Homomorphic Encryption. Cryptology ePrint Archive, Paper 2019/688. (2019). https://eprint.iacr.org/2019/688 11

    2019

  22. [31]

    Harris, K

    Charles R. Harris, K. Jarrod Millman, Stéfan J. van der Walt, Ralf Gommers, Pauli Virtanen, David Cournapeau, Eric Wieser, Julian Taylor, Sebastian Berg, Nathaniel J. Smith, Robert Kern, Matti Picus, Stephan Hoyer, Marten H. van Kerkwijk, Matthew Brett, Allan Haldane, Jaime Fe...

    2020

  23. [32]

    Shai Halevi and Victor Shoup. 2014. Algorithms in HElib. Cryptology ePrint Archive, Paper 2014/106. (2014). https://eprint.iacr.org/2014/106

    2014

  24. [33]

    Aleksandar Krastev, Nikola Samardzic, Simon Langowski, Srinivas Devadas, and Daniel Sanchez. 2024. A Tensor Compiler with Automatic Data Packing for Simple and Efficient Fully Homomorphic Encryption. Proc. ACM Program. Lang. 8, PLDI, Article 152 (June 2024), 25 pages. https://...

    2024 doi

  25. [34]

    Jeremy Kun. 2024. Shift Networks. (Sept. 2 2024). https://www.jeremykun.com/ 2024/09/02/shift-networks/ Math and Programming blog post

    2024

  26. [35]

    Lawson, Richard Hanson, David Kincaid, and Fred Krogh

    C. Lawson, Richard Hanson, David Kincaid, and Fred Krogh. 1979. Basic linear algebra subprograms for FORTRAN usage. ACM Trans. Math. Softw. 5 (09 1979), 308–323. https://doi.org/10.1145/355841.355847

    1979

  27. [36]

    Dongwoo Kim and Cyril Guyot. 2023. Optimized Privacy-Preserving CNN Inference With Fully Homomorphic Encryption.IEEE Transactions on Information Forensics and Security 18 (2023), 2175–2187. https://doi.org/10.1109/TIFS.2023. 3263631

    2023 doi

  28. [37]

    Yongwoo Lee, Seonyeong Heo, Seonyoung Cheon, Shinnung Jeong, Changsu Kim, Eunkyung Kim, Dongyoon Lee, and Hanjun Kim. 2022. HECATE: Performance- Aware Scale Optimization for Homomorphic Encryption Compiler. In 2022 IEEE/ACM International Symposium on Code Generation and Optimi...

    2022

  29. [38]

    Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Miran Kim. 2024. THOR: Secure Transformer Inference with Homomorphic Encryption. Cryptology ePrint Archive, Paper 2024/1881. (2024). https://eprint.iacr.org/2024/1881

    2024

  30. [39]

    NVIDIA Corporation. 2025. cuBLAS Library. NVIDIA Corporation. Version 12.9. Documentation: https://docs.nvidia.com/cuda/cublas/

    2025

  31. [40]

    Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. 2022. Low-Complexity Deep Convolutional Neural Networks on Fully Homomorphic Encryption Using Multiplexed Parallel Convolutions. In Proceedings of the 39th International Confer...

    2022

  32. [41]

    Tim Rocktäschel. 2018. Einsum is All You Need – Einstein Summation in Deep Learning. (2018). https://web.archive.org/web/20250514130020/https://rockt.ai/ 2018/04/30/einsum Accessed: 2025-06-25

    2018

  33. [42]

    Gomez, Lukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2023. Attention Is All You Need. (2023). arXiv:cs.CL/1706.03762 https://arxiv.org/abs/1706.03762

    2023 arXiv

  34. [43]

    Alexander Viand, Patrick Jattke, Miro Haller, and Anwar Hithnawi. 2023. HECO: fully homomorphic encryption compiler. In Proceedings of the 32nd USENIX Conference on Security Symposium (SEC ’23) . USENIX Association, USA, Article 264, 18 pages

    2023

  35. [44]

    PyTorch Team. 2025. torch.einsum. (2025). https://pytorch.org/docs/stable/ generated/torch.einsum.html Accessed: 2025-06-21

    2025

  36. [45]

    Edward Z. Yang. 2019. PyTorch Internals. https://blog.ezyang.com/ 2019/05/pytorch-internals/. (May 2019). https://blog.ezyang.com/2019/05/ pytorch-internals/ Long -form essay based on a talk at the PyTorch NYC meetup (May 14, 2019). 12

    2019

  37. [48]

    Jelle Vos, Daniël Vos, and Zekeriya Erkin. 2022. Efficient Circuits for Permut- ing and Mapping Packed Values Across Leveled Homomorphic Ciphertexts. In Computer Security – ESORICS 2022 , Vijayalakshmi Atluri, Roberto Di Pietro, Christian D. Jensen, and Weizhi Meng (Eds.). Spr...

    2022

  38. [2015]

    TensorFlow: Large-Scale Machine Learning on Heterogeneous Systems. (2015). https://www.tensorflow.org/ Software available from tensorflow.org

    2015

  39. [2018]

    Cryptology ePrint Archive, Paper 2018/153

    Bootstrapping for Approximate Homomorphic Encryption. Cryptology ePrint Archive, Paper 2018/153. (2018). https://eprint.iacr.org/2018/153

    2018

  40. [2024]

    In Proceedings of the International Conference for High Performance Computing, Networking, Storage, and Analysis (SC ’24)

    CUDASTF: Bridging the Gap Between CUDA and Task Parallelism. In Proceedings of the International Conference for High Performance Computing, Networking, Storage, and Analysis (SC ’24) . IEEE Press, Article 43, 17 pages. https://doi.org/10.1109/SC41406.2024.00049

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.