Research map / Federated learning and privacy / Privacy attacks and secure learning

Jaguar: Fast Private CNN Inference with Power-of-Two Homomorphic Arithmetic

NeurIPS 2026 · Federated learning and privacy › Privacy attacks and secure learning · approach: Encryption-based private learning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Jaguar builds a hybrid HE/2PC private CNN inference system on a power-of-two BFV ciphertext ring, using coefficient-domain scalar-polynomial convolution (SPA-Conv), exact pre-ReLU ciphertext truncation, and NTT-assisted client decryption via an auxiliary prime.

Problem

Hybrid HE/2PC private CNN inference is bottlenecked by prime-modulus homomorphic convolution arithmetic and by a precision flow that runs ReLU at doubled bitwidth followed by a separate interactive truncation protocol.

Approach

Use a power-of-two ciphertext modulus q=2^Q and plaintext modulus p=2^P so that convolution becomes sums of scalar-polynomial products and coefficient shifts (no NTT or prime reduction), ciphertext-side right shifts give exact truncation before ReLU, and NTT is used only at the client over an auxiliary prime for decryption.

Key results

• End-to-end LAN latency with AVX disabled: Jaguar 8.64 s vs Cheetah 30.30 s on ResNet-18 (3.51x), 32.44 s vs 120.82 s on ResNet-50 (3.72x), 18.41 s vs 46.99 s on MobileNetV2 (2.55x).
• Communication reduction vs Cheetah of 1.16x (ResNet-18), 1.39x (ResNet-50), 1.76x (MobileNetV2); on ResNet-50 Rhombus uses less communication (750 MiB vs Jaguar 962 MiB).
• On ResNet-50 the truncation stage drops from 1.08 s to 0.19 s (LAN) with zero truncation communication, and ReLU communication drops 1.83x (271.69 to 148.61 MiB).

Surprising findings

• On ResNet-50 Jaguar uses more communication than Rhombus (962 vs 750 MiB), so it is not best on communication for that model.
• Packed dense 3x3 convolution is slower than Cheetah in several shapes (speedups as low as 0.29x), with the advantage concentrated in split layouts and pointwise/depthwise convolutions.

Limitations

• No native power-of-two fully-connected/MatMul backend; the classifier is converted to the Cheetah FC backend.
• Noise-budget analysis is based on a Gaussian propagation model and is only an estimate; correctness is checked empirically on evaluated layers.
• Parameter selection (f,P) was tuned on 500 validation examples, with fixed-point agreement sensitive to P (e.g., ResNet-50 drops to 8% at P=29).

Experimental setup

Datasets: ImageNet

Benchmarks: ImageNet

Metrics: end-to-end latency communication (MiB) convolution kernel latency agreement with FP32 baseline top-1 accuracy

Baselines: Cheetah Rhombus Falcon Gazelle CrypTFlow2

Builds on: Cheetah BFV CrypTFlow2 Rhombus

Closest papers by meaning

• DCT-CryptoNets: Scaling Private Inference in the Frequency Domain (ICLR 2025 · similarity 0.87)
• CipherPrune: Efficient and Scalable Private Transformer Inference (ICLR 2025 · similarity 0.87)
• PrivCirNet: Efficient Private Inference via Block Circulant Transformation (NeurIPS 2024 · similarity 0.87)
• Converting Transformers to Polynomial Form for Secure Inference Over Homomorphic Encryption (ICML 2024 · similarity 0.86)
• An Efficient Private GPT Never Autoregressively Decodes (ICML 2025 · similarity 0.84)
• Nimbus: Secure and Efficient Two-Party Inference for Transformers (NeurIPS 2024 · similarity 0.84)