CoChat
Sign Up
Cited by 127Cryptography and Data SecurityCloud Data Security SolutionsPrivacy-Preserving Technologies in Data

Privacy-preserving neural networks with Homomorphic encryption: Challenges and opportunities

Open access
Pulido-Gaytan, Bernardo, Tchernykh, Andrei, Cortés-Mendoza, Jorge M., Babenko, Mikhail, Radchenko, Gleb, Avetisyan, Arutyun, Drozdov, Alexander Yu·2021·Peer-to-Peer Networking and Applications
DOI 10.1007/s12083-021-01076-8
Open this paper in CoChat — free accountOpen PDF

Abstract

Classical machine learning modeling demands considerable computing power for internal calculations and training with big data in a reasonable amount of time. In recent years, clouds provide services to facilitate this process, but it introduces new security threats of data breaches. Modern encryption techniques ensure security and are considered as the best option to protect stored data and data in transit from an unauthorized third-party. However, a decryption process is necessary when the data must be processed or analyzed, falling into the initial problem of data vulnerability. Fully Homomorphic Encryption (FHE) is considered the holy grail of cryptography. It allows a non-trustworthy third-party resource to process encrypted information without disclosing confidential data. In this paper, we analyze the fundamental concepts of FHE, practical implementations, state-of-the-art approaches, limitations, advantages, disadvantages, potential applications, and development tools focusing on neural networks. In recent years, FHE development demonstrates remarkable progress. However, current literature in the homomorphic neural networks is almost exclusively addressed by practitioners looking for suitable implementations. It still lacks comprehensive and more thorough reviews. We focus on the privacy-preserving homomorphic encryption cryptosystems targeted at neural networks identifying current solutions, open issues, challenges, opportunities, and potential research directions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s12083-021-01076-8

Cites

114 of 114 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Hybrid PPML frameworks could leverage lightweight HE variants with hierarchical FL architectures, distributing computation across edge devices, RSUs, and cloud servers to minimize latency.

    “To address these challenges, hybrid PPML frameworks could leverage lightweight HE variants (like CKKS for approximate arithmetic) with hierarchical FL architectures [17, 109, 149], distributing computation across edge devices, RSUs, and cloud servers to minimize latency.”

    From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [109]

    The “Parallelization” section proposes distributed computing to reduce the overhead of homomorphic-encryption neural networks, and §6.1 describes CKKS as supporting approximate arithmetic (page numbers unavailable). The paper does not describe hierarchical federated learning or distributing work among edge devices, RSUs, and cloud servers to minimize latency; nor does it characterize CKKS as lightweight. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • HE introduces prohibitive latency in large-scale traffic simulations due to polynomial-degree ciphertext operations, conflicting with sub-second response requirements for dynamic traffic management.

    “HE, though theoretically robust, introduces prohibitive latency in large-scale traffic simulations due to polynomial-degree ciphertext operations, conflicting with sub-second response requirements for dynamic traffic management [2, 109, 132].”

    From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [109]

    Section 5.5 (page unavailable) reports latency and memory limitations in homomorphically encrypted neural networks and says processing high-degree polynomials takes time. It does not address large-scale traffic simulations or establish that HE latency conflicts with sub-second response requirements for dynamic traffic management. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • HE's reliance on lattice-based cryptography introduces latency from ciphertext expansion, especially in inference.

    “Moreover, HE's reliance on lattice -based cryptography introduces latency from ciphertext expansion, especially in inference [109].”

    From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [109]

    Section 2.3 describes several lattice-based FHE families, and section 4.2 identifies large encrypted messages as a source of low efficiency. Section 5.5 links message count to latency and memory bottlenecks in private prediction. The paper does not specifically attribute inference latency to ciphertext expansion caused by lattice-based cryptography. (LLM, conf=0.83)

    Experimental — accuracy not yet measured

  • GPU-accelerated HE libraries tailored for CKKS/BFV schemes could expedite encrypted inference.

    “GPU-accelerated HE libraries tailored for CKKS/BFV schemes could expedite encrypted inference, while Chebyshev polynomial approximations may enable HE-compatible ReLU activations [109].”

    From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [109]

    Section 6.1 describes a GPU-accelerated HE library and, separately, libraries supporting CKKS and BFV; the Parallelization section says GPUs could improve NN-HE efficiency. Sections 5.4 and 4.2 discuss Chebyshev polynomial approximations for activation functions and polynomial approximations of ReLU. Our copy does not establish that the GPU-accelerated library is tailored to CKKS/BFV or specifically that Chebyshev approximations enable HE-compatible ReLU. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • HE allows arithmetic operations on ciphertexts but struggles with non-linear functions (like ReLU) due to polynomial approximations.

    “HE allows arithmetic operations on ciphertexts but struggles with non-linear functions (like ReLU) due to polynomial approximations [109].”

    From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [109]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

4 of the 118 references couldn’t be matched to a known paper.

Research works printed but not linked: 4

  1. Takabi H, Hesamifard E, Ghasemi M (2016) Privacy preserving multi-party machine learning with Homomorphic encryption. In: 29th Annual Conference on Neural Information Processing Systems (NIPS). Barcelona, Spain
  2. Tokui S, Oono K, Hido S, Clayton J (2015) Chainer: a next-gen- eration open source framework for deep learning. In: Proceedings of the Workshop on Machine Learning Systems (LearningSys) at the 28th Annual Conference on Neural Information Processing Systems (NIPS), pp 1-6. http://learningsys.org/papers/ LearningSys_2015_paper_33.pdf
  3. Abadi M, Agarwal A, Barham P, Brevdo E (1603) Large-Scale Machine Learning on Heterogeneous Systems. arXiv, Xiaoqiang Z TensorFlow, p 04467 110.
  4. Ryffel T, Trask A, Dahl M, Wagner B (1811) Mancuso J. Passerat-Palmbach J A generic framework for privacy preserving deep learning. arXiv, Rueckert D, p 04017 116.

Cited by

Sorted by citations

Related

Authors
Pulido-Gaytan, B., Tchernykh, A., Cortés-Mendoza, J. M., Babenko, M., Radchenko, G., Avetisyan, A., & Drozdov, A. Y.
Affiliations
  • South Ural State University (RU)
  • North-Caucasus Federal University (RU)
  • Institute for System Programming (RU)
  • Moscow Institute of Physics and Technology (RU)
Corresponding author
Tchernykh, Andrei
ORCID
Venue
Peer-to-Peer Networking and Applications
Publisher
Springer Science and Business Media LLC
Published
2021-03-08
Volume
14
Issue
3
Pages
1666-1691
ISSN
  • 1936-6442 (ISSN-L)
  • 1936-6450
DOI
10.1007/s12083-021-01076-8
OpenAlex
W3134210339
Cited by
126
References
118
Citations by year
2026: 18 · 2025: 33 · 2024: 27 · 2023: 29 · 2022: 13 · 2021: 6
FWCI
6.63
Type
journal article
Language
en
Open access
Licence
Locations
Peer-to-Peer Networking and Applications (publishedVersion, cc-by)
Funders
Ministry of Education and Science of the Russian Federation (075-15-2020-788)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
fully homomorphic encryption, privacy-preserving machine learning, encrypted data processing, cloud security, data breaches, ciphers

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review