Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.
Fully homomorphic encryption (FHE) enables computation on encrypted data, but practical encrypted Transformer inference is bottlenecked by the sequential composition of many nonlinear blocks. We study whether Structured Newton Layer Parallelism (SNLP) can make this inter-layer composition more FHE-friendly: each Transformer block still requires polynomial approximations for operations such as softmax and RMSNorm, but SNLP reduces the layerwise sequential nonlinear depth from L stages to a small number of solver iterations plus linear structured corrections. Using a simulation framework based on Chebyshev polynomial approximations, we measure error accumulation under sequential versus SNLP inference across 8 models and 4 architecture families. On a 0.5B IDN-trained model, SNLP reduces symbolic bootstraps from 53 to 20 (2.65x) with only +1.2% perplexity degradation, while lowering error amplification (1.36x vs. 1.42x). Across all tested models, SNLP has lower amplification than sequential inference. Ablations show that softmax approximation dominates the error budget and CKKS arithmetic noise is negligible in our setting, suggesting that SNLP is complementary to block-level FHE-friendly operator design rather than a replacement for it.
Deep neural network (DNN) backdoor attacks implant hidden malicious behaviors during model training so that inputs containing a trigger are misclassified to an attacker-specified target. While prior studies have explored pruning as a defense, the impact of conventional compression-oriented pruning, which is primarily used for model size reduction and efficiency, on the effectiveness of existing general backdoor attacks has not been fully examined. We show that many existing attacks are fragile under such pruning. To this end, we propose Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed. M2K suppresses pruning-prone parameters and redistributes critical information into more stable ones. M2K consists of three stages: (1) training a base backdoor model and learning a soft mask to estimate parameters likely to be pruned; (2) applying targeted regularization to encourage the redistribution of critical information into preserved parameters; and (3) fine-tuning by freezing likely-to-be-pruned parameters while distilling knowledge into the retained ones. Experiments across multiple attack types, datasets, and pruning strategies show that M2K maintains high attack success rates and competitive clean accuracy after aggressive compression, demonstrating its robustness to compression-oriented pruning.
Jing Shang, Jian Wang, Kailun Wang et al.· Neural Networks· 0 citations
Encrypted inference under homomorphic encryption (HE) imposes stringent constraints on computation, making the direct deployment of deep neural networks infeasible on resource-constrained edge devices. Existing approaches, such as FHEEDGE and UniHENN, primarily focus on improving the efficiency of encrypted computation through algorithmic and systems-level optimizations. In contrast, we adopt a complementary perspective by redesigning neural architectures to align with the inherent cost model of HE operations. In this work, we present a framework that reformulates HE-aware model design as a constrained neural architecture search problem, where the objective is to identify architectures that are both cryptographically feasible and computationally efficient while preserving task performance. Starting from a pretrained network, we perform a structured, iterative transformation process that includes HE-compatible operator substitutions, depth–width trade-offs, and rotation-efficient design strategies such as successive average pooling. These transformations are guided by constraints on ciphertext slots, multiplicative depth, and rotation complexity, and are evaluated using short-horizon training to efficiently explore the architecture space. We provide a theoretical analysis showing that the transformed network approximates the original model with bounded error under layer-wise Lipschitz propagation, ensuring controlled performance degradation. As a case study, we apply the proposed framework to encrypted crack detection for structural health monitoring. The optimized model achieves an execution time of 86.5 seconds for single-threaded CPU inference in the encrypted domain, compared to an estimated 3.5 hours required by the original encrypted convolutional pipeline. Furthermore, deployment on a Raspberry Pi demonstrates end-to-end encrypted inference within approximately 7.5 minutes. These results highlight that architecture-level optimization, when framed as a constrained search problem, complements existing algorithmic acceleration approaches and provides a practical pathway for enabling efficient and privacy-preserving inference on edge devices across a broad class of sensitive AI workloads.
Reeshav Chowdhury, Anoop Mishra, Deepak Khazanchi et al.· ACM Transactions on Internet...· 0 citations
FHEON is presented, an open-source configurable framework for developing privacy-preserving neural network models for inference using the CKKS scheme of HE, and outperform all state-of-the-art HE inference works in both latency and memory utilization.
Nges Brian Njungle, Eric Jahns, Michel A. Kinsy· Proceedings on Privacy Enhan...· 1 citation
Homomorphic Encryption (HE) enables computation on encrypted data without decryption and is a key primitive for privacy-preserving computation in sensitive domains such as healthcare, finance, and government. Its security relies on noise injection, which introduces intrinsic error sensitivity and raises concerns about the fault tolerance of HE systems, as hardware- and software-induced faults can evade traditional detection mechanisms and lead to silent data corruption. In this work, we analyze the sensitivity of HE to bit-level faults, focusing on the CKKS (Cheon--Kim--Kim--Song) scheme widely used for approximate arithmetic in AI and machine learning workloads. We identify homomorphic multiplication as the most error-sensitive operation in practical HE pipelines and characterize how faults propagate and amplify through it, exposing a critical robustness vulnerability and motivating the need for more resilient HE deployments.
Matías Mazzanti, Vattana Chan, Karthik Swaminathan et al.· 0 citations
SVIiT is described as communication-reduced relative to the evaluated MPC baselines rather than universally lightweight, and its present practical scope is primarily high-bandwidth LAN or provider-edge deployments.
Tingting Chen· ICST Transactions on Scalabl...· 0 citations