Encrypt What Matters: When Selective Homomorphic Inference Is Efficient
Ali Backour, Juan Reyes, Jaime Punyed, Ana Onoprishvili
cs.CR · cs.LG
Quick verdict
Proposes exact ROI-only FHE inference; real TFHE shows 18× VGG-11 speedup at 32×32 ROI. Sound core, but toy nets, no accuracy eval, public ROI location leaks.
Summary
The paper studies selective homomorphic inference: instead of encrypting an entire input under FHE, only a sensitive region of interest (ROI) is encrypted, and the server partially evaluates the model's circuit on the visible pixels so homomorphic work is confined to computations tainted by the ROI. Because each accumulator splits into encrypted and plaintext contributions, the selective output is exactly identical to full-FHE output, without retraining. The authors derive a locality lemma for stride-1 convolutions (tainted edge grows by k−1 per layer; speedup Θ(n²/m²) before saturation) and validate it with real TFHE (Concrete) measurements on channel-narrowed AlexNet, ResNet-18, and VGG-11 at 224×224, 4-bit quantization, on MNIST-on-canvas. At a 32×32 ROI (2.04% of input), measured speedups are 17.99× (VGG-11), 5.14× (ResNet-18), and 4.34× (AlexNet). A support-propagation predictor (2.7% median error across nine measured configurations) extends the analysis, predicting 2.01× for Swin-T, 1.15× for EfficientNet-B0, and no benefit for ViT, MLP-Mixer, or fully connected networks. Main limitations: only three architectures are measured, all heavily channel-narrowed (1/16–1/64) on a toy task, with no model-accuracy reporting; the ROI location is public by design and no formal leakage analysis is given; non-CNN numbers are predictions rather than measurements; no code release is stated.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Selective homomorphic inference — encrypting only an ROI and partially evaluating the rest of the circuit in plaintext — produces outputs exactly identical to full-FHE evaluation of the same quantized model, without retraining.
- Efficiency is governed by how long encrypted dependencies remain local (the 'locality budget'), not by depth or model family; for stride-1 convnets the speedup scales as Θ(n²/m²) before saturation.
- Measured on real TFHE at a 32×32 ROI (2.04% of a 224×224 input), speedups are 17.99× for channel-narrowed VGG-11, 5.14× for ResNet-18, and 4.34× for AlexNet.
- The support-propagation predictor matches the nine measured configurations with 2.7% median error (8.3% worst case) and predicts no benefit for early-global-mixing architectures (ViT, MLP-Mixer, fully connected), ~2.01× for Swin-T, and only 1.15× for EfficientNet-B0.
Strengths
Exactness is by construction, not just by test
Eq. (1) splits every accumulator into encrypted and plaintext contributions; Appendix A confirms the selective circuit reuses the same lookup tables, accumulator bounds, rounding parameters, and output scales as the full circuit, so outputs are bit-identical — verified on eight held-out inputs under Concrete simulation and under real TFHE keys. No retraining or accuracy loss versus full FHE.
Real TFHE wall-clock measurements with unusually complete disclosure
Table 1 reports medians with IQRs for circuits of 356k–644k PBS (full) on Concrete 2.11.0, Apple M1 Pro, 8 threads; Table 2 separately reports compile/keygen/encryption costs; Appendix A discloses the per-circuit parameter-selection confound rather than hiding it.
Actionable architectural criterion with a closed form
Honest prediction-vs-measurement separation
Weaknesses
Narrow measured evidence base; headline numbers from the most-abbreviated network
No accuracy reporting for the quantized models
Security discussion is one sentence
Speedup attribution conflates two effects
No head-to-head with the prior selective-encryption work it positions against
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper attacks the cost of FHE-based neural-network inference by asking which computations actually need to be encrypted. Setting: an input with a *public* region of interest (ROI) whose pixel values are sensitive; everything outside is public. The contribution is threefold: (1) a selective evaluation protocol (Algorithm 1) that provably reproduces the full-FHE output by splitting every accumulator into encrypted and plaintext contributions (Eq. 1); (2) an analysis of how "tainted" (encrypted-dependent) computation spreads — Lemma 1 gives the tainted edge m+i(k−1) for stride-1 valid convolutions and Θ(n²/m²) speedup before saturation, remaining unsaturated through depth d iff m+2d(k−1)<n; (3) empirical validation on real TFHE plus a support-propagation predictor (Algorithm 2) for architectures too expensive to measure. Claims are stated crisply, and the paper is consistently careful to separate measured from predicted numbers — rarer in this area than it should be.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is selective homomorphic inference?
Instead of encrypting an entire image for FHE-based neural network inference, only a sensitive region of interest (ROI) is encrypted. The server runs all computations that do not depend on the ROI in plaintext and evaluates only ROI-dependent computations under FHE. Because each accumulator is split into encrypted and plaintext contributions, the result is exactly the same as encrypting everything — but much cheaper when the architecture keeps encrypted dependencies local.
How much faster is selective encryption than full encryption?
In the paper's real TFHE measurements at a 32×32 ROI (2.04% of a 224×224 input): 17.99× for channel-narrowed VGG-11, 5.14× for ResNet-18, and 4.34× for AlexNet; VGG-11 reaches 30.63× at a 16×16 ROI. The gain depends heavily on architecture — early downsampling consumes locality, and ViT, MLP-Mixer, and fully connected networks are predicted to gain essentially nothing.
Does selective encryption weaken privacy?
Pixel values inside the ROI are protected by the underlying FHE scheme (Concrete's default 128-bit TFHE parameters), but the ROI's location and shape are sent to the server in the clear by design. The paper does not analyze what this positional leakage reveals — for example, that a face or lesion exists and where — so deployments must treat the ROI location as intentionally disclosed.
Were the speedups measured on real, full-size models?
No. Wall-clock results use channel-narrowed variants (AlexNet at 1/16, ResNet-18 at 1/32, VGG-11 at 1/64 of original width) trained on an MNIST-on-canvas toy task, because full-width FHE is prohibitively slow on the authors' laptop. Spatial dependency propagation is unchanged by narrowing, but absolute runtimes — and possibly the speedup ratios at full width — should be interpreted with care.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 2/3 axis labels are extracted as interleaved text fragments (normal PDF-extraction artifact for figures); all quantitative claims in this review were taken from body text and Tables 1–2, not from figure pixels.
- No truncation detected: the extraction runs continuously from the abstract through the references and Appendices A–C, ending with the predictor-error sentence and page number 9.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.