• Supported one-dimensional operations under FHE:

• Multiplication
• Addition
• Rotation

Polynomial approximation for non-linear activations

Packing for convolution (Pooling): transferring 3D operation to 1D operation

• High-degree approximation

• Slow: more multiplications, more bootstrappings
• Accurate: high-degree polynomials
• Training/fine-tuning: not necessary

• Low-degree approximation

• Fast: less multiplications, less bootstrappings
• Not Accurate: low-degree polynoimals
• Training/fine-tuning: necessary

• Low-degree polynomial approximation for non-linear activations

• Swish: $p = 0.12050344x^2 +0.5x+0.153613744$
• Softplus: $ p = 0.082812671x^2 +0.5x+0.75248 $
• ReLU: $p = 0.125x^2 +0.5x+0.25$

• Small depth, low precision, training required

• High-degree polynomial approximation for ReLU

• Composed Polynomials: $p_{\alpha, 1}$ (degree 7), $p_{\alpha, 2}$ (degree 7), $p_{\alpha, 3}$ (degree 27)
• Approximation for $\mathrm{sgn}$: $p_{\alpha}(x)=p_{\alpha, 3}(p_{\alpha, 2}(p_{\alpha, 1}(x)))$
• Approximation for ReLU: $r_{\alpha} = \frac{x+xp_{\alpha}(x)}{2}$ (ReLU=$\frac{x+x\mathrm{sgn}(x)}{2}$)

• High depth, high precision, training not required

• Polynomial neural network training suffers from numerical instability

• Backward Propagation: clip gradients
• Forward Propagation: cannot do clipping under FHE (function $\mathrm{max}$ is not a polynomial)

• AESPA: Basis-Wise Normalization

• Normalize polynomial basis separately: $h_0(x)$, $h_1(x)$, $h_2(x)$, $h_3(x)$
• Aggregate polynomial basis by trainable weights Approximation for $f(x)=\gamma \sum_{i=0}^d \hat{f_i}\frac{h_i(x)-\mu_i}{\sqrt{\sigma_i^2+\epsilon}} +\beta$

• Single-input-single-output packing: pack a 3D tensor channel by channel

• Take advantage of SIMD to reduce the complexity of rotation and multiplication

• Repeated packing: $x^{(M)} = [x, x, \cdots, x]$ with $M=\lfloor \frac{N}{2d} \rfloor$ copies
• Multiplexed packing: pack different channels interchangeably

• Homomorphic evaluation architecture of ResNets

• Experimental results on CIFAR datasets

• High-degree polynomials $\rightarrow$ Levels $\Uparrow \rightarrow$ Bootstrapping $\Uparrow \rightarrow$ Latency $\Uparrow$

• High-degree polynomials $\rightarrow$ Approximation Precision $\Uparrow \rightarrow$ Accuracy $\Uparrow$

• Security Requirement

• Latency

• Prediction Accuracy

• Wei Ao and Vishu Boddeti. AutoFHE: Automated Adaption of CNNs for Efficient Evaluation over FHE, USENIX Security 2024

• Flexible Architecture
• On demand Bootstrapping

• Wei Ao and Vishu Boddeti. AutoFHE: Automated Adaption of CNNs for Efficient Evaluation over FHE, USENIX Security 2024

• MPCNN: Low-Complexity Convolutional Neural Networks on Fully Homomorphic Encryption Using Multiplexed Parallel Convolutions, ICML 2022
• AESPA: Accuracy Preserving Low-degree Polynomial Activation for Fast Private Inference, arXiv 2022
• REDsec: Running Encrypted Discretized Neural Networks in Seconds, NDSS 2023
• AutoFHE: Automated Adaption of CNNs for Efficient Evaluation over FHE, USENIX Security 2024