TT-TFHE: a Torus Fully Homomorphic Encryption-Friendly Neural Network Architecture
Authors: Adrien Benamira
Tristan Guérand
Thomas Peyrin
Sayandeep Saha
Venue: Accepted by TMLR ()

Abstract: This paper presents TT-TFHE, a deep neural network Fully Homomorphic Encryption (FHE) framework that effectively scales Torus FHE (TFHE) usage to tabular and image datasets using the Truth-Table Neural Networks (TTnet) family of Convolutional Neural Networks. The proposed framework provides an easy-to-implement, automated TTnet-based design toolbox with an underlying (python-based) open-source Concrete implementation (CPU-based and implementing lookup tables) for inference over encrypted data. Experimental evaluation shows that TT-TFHE greatly outperforms in terms of time and accuracy all Homomorphic Encryption (HE) set-ups on three tabular datasets, all other features being equal. On image datasets such as MNIST and CIFAR-10, we show that TT-TFHE consistently and largely outperforms other TFHE set-ups and is competitive against other HE variants such as BFV or CKKS (while maintaining the same level of 128-bit encryption security guarantees). In addition, our solutions present a very low memory footprint (down to dozens of MBs for MNIST), which is in sharp contrast with other HE set-ups that typically require tens to hundreds of GBs of memory per user (in addition to their communication overheads). This is the first work presenting a fully practical and production-ready solution of private inference (i.e. a few seconds for inference time and a few dozen MBs of memory) on both tabular datasets and MNIST, that can easily scale to multiple threads and users on server side. We further show that in real-world settings, our proposals reduce costs by one to several orders of magnitude compared to existing solutions.

Published in Transactions on Machine Learning Research (11/2025)
TT-TFHE: a Torus Fully Homomorphic Encryption-Friendly Neural Network Architecture
Adrien Benamira"
adrien.benaminnentuu.dduu
Nongang Technological University
Singapore
Tristan Guérand"
guer0001 Ge.ntu. de.nttu.edu... edu.sg
Nanyang Technological University
Singapore
Thomas Peyrin
thomas wet.:asseppyrrr@ttt...mm edu..
Nangang Technological University Singapore
Sayandeep Saha
snyandeepsaha@cce.cco
IIT Bomboy
India
Reviewed on OpenReview:
https: // openreview. net/ forum? id= tV4ynvae6W
Abstract
This paper presents TT-TFHE, deep neural network Fully Homomorphic Encryption (FHE) framework that effectively scales Torus FHE (TFHE) usage to tabular and image datasets using the Truth- Table Neural Networks (TTnet) family of Convolutional Neural Networks. The proposed framework provides an easy-to-implen -oyyl--tmmlemennt, automated TTnet-based design toolbox with an underlying pyython-basedd open-source Concrete implementation (CPU-based and implementing lookup tables) for inference encrypted data. Experimental evaluation shows that TT-TFHE greatly outperforms in terms of time and accuracy all Homomorphic Encryption (HE) set-ups on three tabular datasets, all other features being equal. On image datasets such as MNIST and CIFAR-10, we show that TT-TFHE consistently and largely outperforms other TFHE set-ups and is competitive against other HE variants such as BFV or CKKS (while maintaining the same level of 128-bit encryption security guarantees). In addition, our solutions present very low memory footprint (down dozens of MBs for MNIST), which is in sharp contrast with other HE set-ups that typically require tens to hundreds of GBs of memory per user (in addition their communication overhcads). This is the first work presenting practical solution of private inference (i.e. a few seconds for inference time and few dozen MBs of memory) on both tabular datasets and MNIST, that can casily scale to multiple threads and users on server side. We further show that in real-world settings, our proposals reduce costs by one to several orders of magnitude compared existing solutions.
1 Introduction
Deep Neural Networks (DNNs) have achieved remarkable results in various fields, including image recognition,
natural language processing or medical diagnostics. "Machine Learning as a Service" (MLaaS) is a recent and
popular DNN-based business use-case (Philipp et al. 2020 Li al. 2017 Ribeiro et al. 2015). where clients pay for predictions from a service provider. However, this approach requires trust between the client and
Both authors contributed equally this research

---

Published in Transactions on Machine Learning Research (11/2025)
the service provider. In cases where the data is sensitive, such military, financial, health information, clients may be hesitant (or are simply not allowed) to share their data with the service provider for privacy reasons. On the service provider's side, training DNNSs requires large amounts of data, technical expertise, and computer resources, which can be expensive and time-consuming. As a result, service providers may hesitate to give the model directly to the client, as it may be easily reverse-engineered (or at least. make the attacker's task much casier), hindering the growth of MLaaS activity. Allowing the clients to perform the inference locally is also not very practical as any model update would have to be pushed to all clients, not to mention the complex support of the various client
/sottwree configurations, etc.
HE/FHE (Gentry 2009) is an ideal technology to address Privacy-Proserving in Machine Learning (PPML) as it allows the computations to be performed directly on encrypled data. By encrypting its data before sharing it with the service provider, the client ensures that it remains private while the service provider can still guarantee accurate predictions. This solves the trust. issue and also gives a competitive advantage regions where data regulations are stricter, such as Europe's General Data Protection Regulation (GDPR) Regulation 2016). The most popular HE schemes are BGV/BFV (Brakerski al.] 2014; Brakerski 2012 Fan & Vercauteren
2020a) and this paper presents our proposed solution that utilizes TFHE to provide a privacy- preserving MLaaS framework for DNNs. TFHE enables very fast gate bootstrapping as well as circuit bootstrapping and operations over Boolean gates. Moreover, extended versions of TFHE, such as Concrete (Chillotti et al. 2020b). allow programmable bootstrapping and enable evaluation of certain functions during the bootstrapping step itself.
2012), CKKS (Cheon et al. 2017) and Torus- FHE (TFHE) (Chillotti al. 2016
The security and flexibility provided by HE come at cost, as the computation, communication, and memory overheads are significant, especially for complex functions such as DNNs:
Time overhead: each mathematical operation required to infer must be executed homomorphicallly it is more resource-intensive than non-HE operations. On the server side, an FHE logic gate computation within a TFHE scheme takes milliseconds (Chillotti et al. 2016), compared to nanoseconds for a standard logic gate. On the client side, the only overhead for the encryption/ /ecryption of the data which is usually not an issue, as milliscconds are enough for those operations.
Communication overhead: the data size required for FHE encryption is significantly larger than that of clear data, An MNIST image sent in clear represents a few kBs, while encrypted within any HE scheme will be of the order of few MBs (excluding the public key which typically requires (s) of MBs) (Clet et al., 2021). Moreover, PPML schemes not based on TFHE, such as those based on CKKS, require significant. communication overhead due to the need for multiple exchanges between the client and the cloud (Clet et al. 2021).
Memory overhead: TFHE-based schemes typically require a few MBs of RAM on the server side, while those based on CKKS need several GBs per image [Gilad-Bachrac) et al. 2016 Brutzkus et al. 2019 even up to hundreds of GBs for the most time-efficient solutions (Lee et al. 2022 (384GB of RAM usage to infer a single CIFAR-10 image using ResNett).
Technical difficulties and associated portability issues: mastering HE/FHI /HEE framework requires highly technical and rare expertise. In their survey, Marcolla et al. (2022 delve into the mathematical foundations of HE/ FEEFE schemes, indicating that a strong mathematical background is essential for mastering FHE frameworks. Moreover, knowledge on the respective performances and trade-offs of the different cxisting implementations also nceded to properly evaluate the fcasibility of a HE/FHE based solution.
These challenges can be approached from different directions, but only a few works have considered designing DNNs models that are compatible/cfficiet with stato-of-tho-art HE frameworks in flexible and portable manner. This paper focuses on integrating the recent FHE scheme, Torus-FHE (TFHE), with DNNs.
Our contributions. To address the above issues, we propose a DNN design framework called TT-TFHE that effectively scales TFHE usage to tabular and large datasets using new family of Convolutional Neural
2

---

Published in Transactions on Machine Learning Research (11/2025)
Networks (CNNs) called Trubh-Table Neural Networks (TTuet). Our proposed framework provides easy- to-implement, automated ITnet-based design toolbox that utilizes the Pytorch and Concrete (python-based) open-source libraries for state-of-the-ar deployment of DNN models on CPU, leading to fast and accurate inference over encrypted data. The TTnet architecture, being lightweight and differentiable, allows for the implementation of CNNs with direct expressions as truth tables, making easy to use in conjunction with the TFHE open-source library (specifically the Concrete implementation) for automated operations on lookup tables. Therefore, in this paper, we try to tackle the TFHE efficiency overhead as well as the peetiical/portability issue. We also introduce novel perspective on PPML by proposing cost comparison of the various state-of-the-art techniques.
Our experimental results. Evaluation on three popular tabular datasets (Cancer, Diabetes, Adult) shows that our proposed TT-TFHE framework outperforms in terms of accuracy (by up to +3%) and time (by factor 7x to 1200x) any state-of-the-arl DNN & HE sel-up. For all these datasets, our inference time runs in few seconds, with very small memory and communication requirements, enabling practical deployment in
industrial/reaalworti scenarios, where tabular datasots are prevalent (Cartella et al.; 2021 Buczak & Guven
2015 Clements et al.) 2020 Ulner et al. 2020
Evans 2009).
For MNIST and CIFAR-10 10 image benchmarks, we further explore an approach for private inference proposed by LoLa (Brutzkus ct al. 2019). in which the user/client side is able to compute first layer and send the encrypted results to the cloud. In this real-world scenario, the user/client performs the computation of a standard public layer (such as the first block of the open-source VGG16 model) and sends the encrypted results to the cloud for further computation using HE. Through experimental evaluation, we demonstrate that our proposed framework greatly outperforms all previons TFHE set-ups (Sanyal et al.) 2018 Fu et al.) 2021: Chillotti et al., 2021) in terms of inference time. Specifically, we show that TT-TFHE can infer one MNIST image in 4.4 seconds with an accuracy of 98.1% or one CIFAR-10 image in 520 seconds with an accuracy of 74%, which from one to several orders of magnitude faster than previous TFHE schemes, and even comparable to the fastest state-of- the---rrttt-rttttee HE set-ups (that do not benefit from the other TFHE advantages) while maintaining the same 128-bit security level. To extend our study to larger datasets, we also give projected results on ImageNet (Krizhevsky et al. 2017
Our solutions represent a significant step towards practical privacy-preserve inference, as they offer fast inference with limited requirements in terms of memory on server side (only a few MBs, in contrary to other TFHE--FHaaetee schemes), and thus can casily be scaled to multiple users. In addition, they benefit from lower communication overhead. In other words, this is the first work presenting a practical solution of private inference (i.e. a few seconds for inference time and few MBs of memory/ cetuuoryccommmnn /commuicctionn) on both tabular datascts and MNIST. We further strengthen this point by offering cost comparison with current ofate-of-the-art the-art approaches. In real-world settings, our proposals reduce costs by one to several orders of magnitude compared to existing solutions.
Outline. In Section 2 we present related works in the field of HE and HF-friendly neural networks. A brief introduction to TTnet is provided in Section 3 In Section 4 we introduce our proposed TT-TFHE framework, while in Section 5 we provide an evaluation of the performance of our framework on various datasets and various privacy settings. Finally, in Section we discuss the limitations of the proposed framework and present our conclusions.
2 Related Works
PPML attracted lot of attention, especially with regard to the implementation of DNNs. Most of these efforts assume that the (unenerypted) model is deployed in the cloud, and the encrypted inputs are sent from the client side for processing. Inference timing of HE-enabled DNN models is the key parameter, but other factors, such as ease of automation and simplicity of such transformation have also been extensively
considered [Beener et al.] 2019 Dathathri et al. 2019 Carpov et al. 2015)
Broadly, the problem can be approached from four complementary directions: 1) Optimizing the implementa- tion of some DNN building blocks, such the activation layers, using HE operations (Jovanovic et al. 2022
3

---

Published in Transactions on Machine Learning Research (11/2025)
Lee et al.
2022: ; 2) Parallelizing the computation and batching of images GGladd et al.
2016 Chou
et al. 2018: Brutzkus et al. 2019) (this is aided by the ring encoding of HE in certain cases) and such efforts
also include implementing hybrid client-server protocol for computation (Juvekar et al.]|2111 Mishra et al.)
2020 3) Optimizing the underlying HE operations (Chillotti et al.) 2016
2021 Ducas & Micciancio, 2015): 4)
Designing a HE-friennlly DNN (Sanyal et al. 2018 Lou & Jiang 2019 Fu et al. 2021
This fourth calegory
has been relatively less explored and the main focus of this work.
To the best of our knowledge, the FHE-DINN paper (Bourse et al.
2018 was the first to propose quantified
DNN to facilitate FHE operations. Then, the TAPAS framework (Sanyal et al. 2018) pushed this strategy further by identifying Binary Neural Networks (BNNs) as effective DNN modelling techniques for HE-enabled inference. This direction has been enhanced later by GateNet (Fu et al. 2021 which optimizes the BNN models by grouping the channels to reduce the number of gates. Lately, CCy-ttyytoNet (Roy & Roy 2025 infered on the frequency of images to reduce memory size and thus reducing inference time.
Yet, none of these works actually explored the automation perspectives for optimizing model itself for HE inference, as they still heavily leverage some manual optimizations concerning the underlying FHE library. Our proposal TT-TFHE is, however, fully automated.
Beyond HE-based approaches, private inference has also been explored through secure Multi-Party Compu- tation (MPC) protocols and GPU-accelerated PPML, frameworks. MPC systems such as ABY3 (Mohassel & Rindal 2018), SecureNN (Wagh et al. 2019), and XONN (Riazi et al. 2019 can achieve low-latency two-party inference and strong correctness guarantees, but require multiple rounds of communication and therefore are less suitable for asynchronous, cloud-only settings. In parallel, GPU-based PPML systems such as CryptGPU (Tan ct al., 2021 and DELPHI (Mishra et al. 2020 leverage high-throughput accelerators to significantly reduce latency for arithmetic-heaay privacy- pressevveg inference, yet depend on specialised hardware and large memory budgets. In contrast, TT-TFHE focuses on the non- non-interactive, single-server setting with an honest-but-curious adversary, aiming for minimal memory footprint, architecture-level automation, and seamless integration with the Concrete FHE ecosystem. These paradigms are therefore complementary: MPC trades communication for speed, GPU-based PPMT, trades hardware for throughput, while TT-TFHE emphasises compactness, non-interactivity, and automated HE-friendly model design.
In addition, compared to previously proposed automated approaches, the translation from non-HE model to HF-enabled model is much simpler as all optimizations are handled during the design phase of the model, making TT-TFHE much more amenable for typical machine learning experts with little knowledge of FHE.
3 Truth-table DCNN (TTnet)
Truth Table Deep Convolutional Neural Networks (TTnet) were proposed by Benamira et al. (2024) as DCNNs convertible into truth tables by design, with security applications. While recent developments in DNN architecture have focused on improving performance, the resulting models have become increasingly complex and difficult to verify, interpret and implement. Thus, the authors focused CNNs, which are widely used, and tried to transform them into Boolean functions that are small enough that their optimal implementation can be computed practically.
CNN filter as a Boolcan function. The conversion property of floating CNN weights filter into a binary truth table is achieved by transforming the CNN filter function into a Boolean function. To accomplish this, the complexity of the CNN filter function is reduced by : (A) decreasing inputs size of the CNN filter, (B) using binary inputs and (C) using binary outputs. (A) is achieved by decreasing the number of connections between convolution layers and (B-C) by utilizing the Heaviside step function, denoted as binact, to binarize the features. Please note the model is different from BNN as we preserve real-valued weights.
CNN filter as an optimized Boolean function. Their proposed method first converts CNN filters into binary truth tables by 1) decreasing the input size (noted as n in the rest of the paper) which reduces the complexity of the CNN filter function, 2) using the Heaviside step function denoted as bin = (1+sgn (x)) (with sgn being the sign function) to transform the inputs and outputs into binary values. This results in Boolean function stored as truth table that can be exhausted practically (for not too large),
4

---

Published in Transactions on Machine Learning Research (11/2025)
seen in Figure La The optimal implementation of this Boolean function then be obtained with the Quine-MeClusee algorithm. To achieve high accuracy, the CNN filter must also be non-linear before the step function. Then, the CNN filter becomes a non-linear truth table, which is referred to as Learning Truth Table (LTT) block.
Patch Size
Batch Normalization ID
Batch Normalization 1D
(kernel size
Truth Table,
0
0
0
0
0
Conv1D
SeLU
bif
0
0
0
0
0
0
0
Conv ID
(a) Converting function dF into truth table. The above example has two layers: the first one has parameters (input channel, output channel, kernel size, stride) (1, 4, 4, 2), while the second (4, 2,). The patch size (the patch being the region of the imput that produces the feature, which commonly referred to as the receptive field (Araujo et al. 2019)) of 4hp is 6 (i.e., green box) since the output feature (i.e., light green box) requires 6 imput entries (L..,, orange and blue box).
(b) LIT overview of Expanding AutoEn- coder LTT in 1 dimension: the ConvlD ID with kernel size 1 is the amplification layer. The intermediate values are real and the input/output values are binary.
Figure 1: A Learning Truth Table (LTT) block. The intermediate values and weights are floating points, input/outpin values are binary.
Description of an LTT block. Among all the families LTT blocks possible, we represent in Figure an Expanding Auto-Encoder LTT block (E-AE LTT). An E-AE LTT block composed of two layers of grouped CNN with an expanding factor. Figure la shows the computation of an E-AE 1D LTT block. We can observe that the input size is small (n 6); the iuput/outuut values are binary and ScLU is activation function. Note that while the inputs are binary, the weights and the intermediate values are real. We integrated LTT blocks into TTnet as CNN filters are integrated into DCNNs: each LTT layer is composed of multiple LIT blocks and there are multiple LIT layers in total.
Example: From LTT Weights To Truth Table. Consider trained 1D-LTT O Payar with input size n n= 4, a stride of size 1, and no padding. The architecture of Pwy given in Figure la is composed of two CNN filter layers: the first one has parameters Wi with (input channel, output channel, kernel size, stride) = (1, 4, 3, 1), while the second W2 = (4, 1, 2, 1). The values of the weights (wi, w2) are given in Figure Ia| The inputs and outputs of aw,,as wrs are binary, and we denote the inputs as [xa, 21, 22, 2z]. To compute the entire distribution of & Luygigg we generate all 2 16 possible coput/oulput pains, and obtain the equivalent truth table. As the inputs
countable, to each input can be associated output, and we build the table that way. This truth table fully characterizes the behavior of wwi We then transform the truth table into optimal Boolean expression using the Quine-McClusee McCluskey algorithm BBlke 1938 This optimal CNF fully characterizes the behaviour of + Puyas as well and is exactly equivalent.
4
The TT-TFHE Framework
4.1
Threat Model
PPML methods are designed to protect against variety of adversaries, inchuding malicious insiders and external attackers who may have access to the neural network's inputs, outputs, internal parameters.
5

---

Published in Transactions on Machine Learning Research (11/2025)
The level of secrecy required depends the specific application and the potential impact of successful attack. Common secrecy goals include protecting the input to the inference, ensuring that only aut horized parties know the result of the inference, and keeping the weights and biases of the neural network secret from unauthorized parties. Some PPML approaches also aim to keep the architecture the neural network confidential from unauthorized parties. However, most PPML methods do not address this last point, and some interactive approaches assume that the architecture of the neural network is known all parties. Moreover, attacks on MLaaS settings exist and very tricky to defend against (Tramerr al. 2016 Juuti et al. 2019). Thus, in this paper, assume that attacker client's s data privacy matters, in an honest-but-curious threat model (Lindell 2020). It means that the attacker can be located everywhere except at the client's 's side, and has access to the encrypted inputs, the encrypted outputs, the weights of the model, and does not try to deviate from the designed protocol.
access the neural network and only the
4.2 FHE General Set-Up
In this paper, the client C will encrypt its data locally and send it along with its public key to the server S (there is no need to send again once it is pre-shared). The server will compute its algorithm on the encrypted data and send the encrypted result to C, who will decrypt result locally. The server will have access to the data in clear.
SERVICE PROVIDER
FHE-1
5
N₁
FHE
TTnet as
Flatten
Linear
Final Computations
5
LookUp Table
Regrassion
N₁ Identity. Reshape Public Layer
TO CLOUD
TO CLIENT
In Clear
Bootstrapping Key as described in TFHE
Encrypted
Secret Key as described in TFHE
Figure The / setting. The client computes locally a layer N1, encrypts the obtained output, and sends to the server/cloud with the public key (which can be pre-shared). The server will compute through FHE the TTnet layer with the linear regression and send the result to the client. The client can decrypt this output and make few last computations to obtain the result of the inference. When N1 is identity (0/TT more generally 0/ N₂ for some neural network N2), we denote the setting as Fully Private (Full-Pr).
The classical configuration is that the entire model is computed privately on the server side, and we call this configuration Fully Private (Full-Pr). However, it is quite hard to defend against model weight-stealing attacks (our threat model does not include model privacy) (Tramer et al. 2016 Juuti et al. 2019 Carlini
et al. 2020), we also consider situations where the client can perform some local pre-processing (i.e., first. layer or block of the neural network) to speed up the server computation without compromising its data security, as introduced by Brutzkus et al. (2019). This setting helps the user to obtain the result of the inference faster than Full-Pr situation, with little time/ time/memory cost on their side. Such pre-computation would usually come from a public architocture such as VGG, AlexNet, or ResNet (Simonyan & Zisscrman, 2014 Krizhevsky et al., 2017 He et al.) 2016), which are available online. This is a common approach in deep learning, where most models are finettund from one of these three with fixed first layers followed by shallow network. In our case, this layer will typically be followed by a TTnet model and linear regression that will be computed through FHE on the server side.
We will denote N2 a configuration where the client performs the computation of the neural network Ni locally and the remaining part N₂ performed privately on server side. The final linear regression after N₂ is always performed privately on server side, but some of the last few computations can be done by the client (for example part of the sum and the final Arg in Podschwadt et al. 2022 The general spt

---

Published in Transactions on Machine Learning Research (11/2025)
/1/TT (where the part performed on server is TTnet) is depicted in Figure 2 0/TT will represent one extreme case where the entire TTnet neural network is performed privately (Full-Pr) and N/0 will represent the other extreme case where the entire neural network N is performed on client side, except the final linear regression. We will denote VGG1L the first layer of VGG16 (the first convolution), and VGG18 its first block (the first two convolutions and the pooling layer afterwards). We finally denote e/N the setting where the client will perform some normalization, reshape or other small operations on its data locally and then send its encrypted data to the cloud. Table
recap of the different proposed settings.
Table 1: A recap table of the different proposed settings. A Full-Pr setting refers to use-case where no normalisation nor reshape is done on the client side. One-hot encoding of categorical variable is acceptable in Full-Pr sctting as it does not leak any information about the data or the model.
In the client First layer of VGG First block of VGG First block of VGG Normalization, Reshape
In the cloud
VGG TT VGG TT TTT VGG e/N
LTT block and Linear Regression
LTT block and Linear Regression
Linear Regression
Neural Network
Full-Pr or 0/N
All preprocessing + Neural Network
4.3 Challenges And Optimizations For Integrating Thhet With TFHE-Concree
The Concrete library (Chillotti el al. 2020b is a ware implementation of TFHE. It is designed to provide highly efficient and secure platform for performing mathematical operations on Boolean encrypted data. The library utilizes automated operations on lookup tables (concrete-numpy) to achieve high performance while maintaining high level of security. The library is also designed to be very user- friendfiendly, with simple and intuitive interfaces for performing encryption and decryption operations. The Concrete library has been shown to provide significant improvements in terms of memory and communication overheads compared to other HE schemes. Furthermore, it is open source, which allows researchers and practitioners to easily integrate it into their projects and benefit from its advanced features.
The use of TTnet architecture in combination with TFHE (and more specifically with Concrete) naturally provides a number of advantages. Firstly, the lightweight and disferentiable nature of TTnet allows for the implementation of CNNs with direct expressions as truth tables, which is well-suited for Concrete. Additionally, the reduced complexity of the TTnet architecture leads to reduced computations and good scalability. Yet, the integration of TTnet into the TFHE framework presents several challenges that need to be addressed in order to achieve high performance. We detail below the constraints imposed by FHE libraries and the optimizations implemented to overcome these limitations and achieve state-of-the-a performance on various datasets.
Constraints imposed by Concrete. The Concrete implementation of the TFHE library, which utilizes automated operations on lookup tables, imposes maximum limit of 16 the imput bit size of the truth table. However, has a strong impact on efficiency (see in Appendix B Our tests show that n = 4 or = 6 seem to offer the best trade-offs. Indeed, since we learn kernels of convolutional layers of size (3, 2) or (2, 3), it is convenient to use n a multiple of 2 and/or 3. Moreover, input sizes larger than n = 8 lead to a prohibitive average time per call.
Finally, there is another limitation linked to the precision of the global circuit. Concrete allows for multi- precision circuit, which means that the bitwidth of different parts could be different. For example, if one of the computations operates on 16 bits and another on 4 bits, boths parts will be computed at their respective precisions if nceded. This reduces in general the inference times and the memory needs, as expanded in Appendix
L But. sometimes this setup cannot be done as cryplographic parameters cannol be found. One can also choose to have the same precision everywhere: but one of the computations operates on 16 bits, all lookup tables, even small, will require the call time of 16-bit table lookup. This can be problematic when handling the final linear regression as we will have sum many Boolean values and the sum result bitwidth might be larger than our planned table lookup size, therefore slowing down our entire implementation. If the
7

---

Published in Transactions on Machine Learning Research (11/2025)
sum result of our linear regression requires 16 bits, all our 4-bit lookup tables call time will be on par with 16-bit. table lookups, going from 75ms to almost 5s per call. Therefore, we propose several optimizations to offset a part of the last linear regression to the client, particularly for image datasets (see below).
Limitations imposed by Thnet. The original TTnet paper proposed a training method that is not suitable for high accuracy performance as it was trained to resist PGD attacks (Madry et al. 2017), which reduces accuracy. Additionally, the pre-processing and final sparse layers in TTnet being binary, this also leads to a significant decrease in accuracy. To address these limitations, we replace the final sparse binary linear regression with a linear layer with floating point weights (later quantified on 4 bits to not deteriorate too much the performances on Concrete) and propose new training method that emphasizes accuracy (see below). We also propose to use a setting /T, where a first layer N1 (a layer or block of a general open-source model) is applied to overcome the loss of information due to the first binarization. This is for example a standard method used in BNNs.
Training optimizations. To improve the accuracy of our model, we took several steps to optimize the training process. First, we removed the use of PGD attacks during training, as they have been shown to reduce accuracy. Next, we employed the DoReFa-Net method from Zhou et al. (2016) for CIFAR-10, a technique for training convolutional neural networks with low- bi-biiitdtt activations and gradients. Finally, to overcome the limitations of the TTnet grouping method, we extended the training to 500 epochs, resulting in a more accurate model.
Architectural optimizations. For tabular datasets, the enhancements just proposed are sufficient to achieve high accuracy. However, this is not the case for image datasots such as MNIST, CIFAR-10 and ImageNet. Therefore, we modify the general architecture of our model. Specifically, we use an architecture similar to the one presented for ImageNet in the original TTnet paper. The limitation of our model is that it can see far in the spatial dimension but has limited representation in the channel dimension. To balance this property, we use three techniques: multi-headers. residual connections (He et al. 2016). and channel shuffling (Zhang et al., 2017). We have a single layer composed of four different functions in parallel: one LTT block with a kornel size of (3,2) and group 1 (to see far in space and low in channel), one LTT block with a kernel size of (2,3) and group 1, one LTT block with a keruel size of 1 and 6 groups (Lo see low in space but high in channel representation), and an identity function (as a residual connection for stability). We tried with second layer to increase accuracy, but this led to sub-optimal performance/ accuracy trade-offs with a drastic increase in FHE inference time.
Client server usage as optimizations. We describe here a solution to the multi-precisine issue: we utilize the client's computing resources not only to prepare the input to the server, but also to post-process the server's output. Namcly, the client will compute a small part of the final linear regression. Indeed, we quantify the weights of the final linear regression of TTnet to 4 bits, which we divide into 4 binary matrices. Then, the server performs partial sums on each of these 4 matrices. Since the outputs of TTnet are binary, the weights are binary, and the maximum number input bitwidth for our lookup tables is bits. For optimal performance, we perform sub-sums of size 16 to ensure that the result of each sub-sum is always lesser than 2 as proposed by Zama's 's team It is important to note that by doing this, we maintain the privacy of the weights of the linear regression as they remain unknown to the client. Additionally, the function computation by the client is very light, for example in the case of the MNIST dataset in the VGG, n/TT setting, it will represent at most Mestume
Nosta = 576 = 12 sums of 4-bit integers to be performed for each 4 weight matrices. The 16
client will eventually add these four outputs to obtain its final result, í.e. computing Σi= 2 w; output,. Also, note that this client computation is fixed and will remain the same even if the model needs to be updated. Finally, this limitation introduces trade-off between communication costs and operative costs: we chose here to work with the 'cheaper" solution, accordingly to the philosophy of our work to reduce memory costs, therefore by splitting the final linear regression only when the cryptographic parameters are not found. Appendix E gocs into more details on the costs difference between the two setups.
8

---

Published in Transactions on Machine Learning Research (11/2025)
5 Results
The project implementation done in Python, with the PyTorch library (Paszke et al. 2019 for training, in Numpy for testing in clear, and the Concrete library v2.10. for FHE inference. Our workstation consists of Nvidia GeForce 3090 GPUs (only for training) with 24576 MiB memory and eight cores (R)) Core(TM) 17-8650U CPU clocked at 1.90 GHz, 16 GB RAM. For all experiments, the CPU Turbo Boost is deactivated and the processes were limited to using four cores.
5.1 Tabular Datasets
Table 2:
Tabular dataset results for TT-TFHE and competitors. All our models use a table lookup bitwidth of = 5, except for Diabetes where we use 6. We emphasize that the various experiments have been conducted on a different number of CPU cores. Normalized results to a single CPU core are denoted with an
FHE
#CPU
Full-Py
Adult
T/TT
Pull-Pr
Canoer
c/T7
Full-Pr
Diabetes
c/TT
family
cores
Acc.
Time
Ace.
Time
Acc.
Time
Aec.
T Time
Acc.
Time
Acc.
Time
Jovanovic al. 2072
CKKS
1+
81.6%
7.5h
420s
56x
68mm
TAPAS Sanyal et
2018
16
97.1%
3.5e
54.9%
2500
G4s
14.48
111.0s
XGBoost Ghics (Zann)
TFHE
88.0%
96.4%
57.9%
16s
3.6s
27.9s
Ours
14
85.3%
356.48
85.3%
22.4s
97.1%
7,6s
97.1%
4.32s
57.0%
72.645
57.0%
4.86
89.1s
5.64
1.9s
1.08s
18.16s
1.2:
Our experimental results shown in Table demonstrate the superior performance of the proposed TT-TFHE framework on three labular datasets (Cancer, Diabetes, Adult) in terms of both accuracy and computational efficiency. The framework achieved an increase in accuracy of up to +3% compared to state-of-the-as DNN & HE set-ups based on TFHE such as TAPAS (Sanyal et al. 2018) or on CKKS such as the recent work from Jovanovic et al. (022).. More impressively, the inference time per CPU was significantly reduced by a factor 1200x, 13x, and 825x on Adult, Cancer, and Diabetes datasets respectively on the c/TT setting and by a factor 75x, 7x, and 55x on Adult, Cancer, and Diabetes datasets respectively on the Full-Pr setting. Compared to XGBoost, XGboost gives better accuracy on similar bandwidth than models. Our framework is faster in both Full-Pr and e/TT setting except. for the Adult dataset.
This enables the practical deployment of our framework in industrial and real-world scenarios where tabular
datasets are prevalent (Cartella et al. 2021 Buczak & Guven 2015 Clements et al., 2020 Ulmer et al.)
2020 Evans 2009), with low memory and communication overhead (see Table in Section 5.3 Note that these results are either in the Full-Pr or e/TT setting, as the binarization process in TT-TFHE would depends on learned parameters for continuous variables. In Full-Pr setting, the continuous variables are quantized, the client data is then encrypted and sent to the server. In the e/TT setting, the continuous variables are binarized with the parameter learned, reshaped to fit TTnet input and then encrypted and sent to the cloud.
5.2 Image Datasets
Our experimental results and comparisons for image datasets are given in Table
5.2.1
Fully Private (Full-Pr) and c/N Settings
In the Full-Pr configuration, we focused on the performance of our method on the MNIST dataset, as the binarization process in TT-TFHE resulted in a significant loss of accuracy for CIFAR-10 or an increase in inference time. TT-TFHE offers competitive trade-off compared to other TaHE-based methods, such as
TAPAS (Sanyal al. 2018), GateNet (Fu et al. 2021), Zama (Chillotti et al. 2021 Stoian al. (2023) or DCT- DCT-CryptoNets (Roy & Roy 2025 It is three orders of magnitude faster than TAPAS GateNet, while
httpps: http:////booaaamaaaaccntttttt//
9

---

Published in Transactions on Machine Learning Research (11/2025)
Table 3: Image dataset results for TT-TFHE and competitors. Results denoted with * are estimated by the original authors, not measured. All our models use table lookup bitwidth of 4, except the underlined ones that use n = Experiments in this Table have been conducted on a different number of CPU cores. Table 12 in Appendix gives the normalized results to single CPU core.
Full-Pr (0/N)
C/N
V Ours
vG
V
TFHE- haased schemes
TAPAS
GateNet
Zama
Zama.
Zama
NrtpooNessss
Ours
Ours
#CPU cores
16
8
8
96
128
4
4
Acc. (%)
98.6
98.8*
97.1
97.6
98.7
97.2
97.5
98.2
98.1
MNIST
Time
37h
44h+
115s
35min
84min
54.02s
0.04s
8.7s
4.4s
Acc. (76)
80.5x
87.5*
91.6
70.4
62.3
69. 00.4/22.1
74.1/25.3
CIFAR-10
Time
3920/*
5h*
8.7m
8.7m/1h
c/N
Full-Pr (0/N)
non-TFHE-based schemes
CryptoNets
Fast CryptoNets
Lola
Lee et.
al.
Rovida al.
SHE
#CPU cores
6
10
Acc. (%)
99
98.7
99.0
99.5
MNIST
Time
4.2m
30s
2.2s
9.3s
Ace. (%)
76.7
74.1
91.3
91.53
92.5
CIFAR-10
Time
11h
12.2m
37.8m
4.3m
37.6m
showing only an accuracy reduction of 1.4%. In comparison to Zama, our method is 3x faster per CPU for the same level of accuracy. Additionally, we highlight that for our single layer LTT block of size 6, we require 1600 calls to 6-bit lookup tables, which leads cores. Only DCT-CtyptoNet manages to reach high accuracy into the frequency domain which allows smaller imputs and apply various small operations before encrypting the inputs and sending them to the cloud. Our solution is still faster, at the cost of accuracy.
inference time of only 54 seconds
four CPU CIEAR-10: they first convert the images
TT-IFHE is even competitive in terms of inference time with some non- Tee-TFEEE--aseee schemes such as (Fast) CryptoNets Gilad-Bachrach al. 2016). but can be one order of magnitude slower with slightly lower accuracy. Therefore, one can observe that the Full-Pr setting of TFHE implemented in our framework generally underperforms compared to the very latest Full-Pr CKKS or leveled FHE scheme such SHE. This is explained by the first binarization process in TT-TFHE, which compresses too much information embedded in the imput image. Yet, we again emphasize the many advantages of based solutions compared to Ton--eeEb ones: little memory required allowing easy /efficient multi-client inference, low communication overhead, no security warning on TFHE while CKKS secret key can be recovered in polynomial Lime (Li Micciancio 2021) (a fix was proposed afterwards by Li el al. (2022) but not yet. implemented in SEAL for example), etc. Furthermore, CKKS focus on amortized runtime through SIMD which makes comparison difficult. Morcover, We will see in the next sub-scction that the performance situation is very different in the setting where the client can perform some pre-compulation layer.
5.2.2 Other Settings
We first observe that when allowing the client to apply a simple pre-processing layer, the performance increases drastically for TT-TFHE. We have implemented and benchmarkod both VGG,L/TT and VGG scttings, both and
with TTnet models with in accuracy. For reference, we have also tested the VGG setting where only linear regression is computed privately on server: we remark that adding a TTnet in the server computation indeed improves accuracy by about 4%.
and we obtained a 7x performance improvement, with an increase
One could argue that more VGG blocks could be computed on client side to further increase the accuracy, but this would reduce the generality of the first layers and lead to PPML solutions that would not adapt very well multiple use cases. We have tried blocks of other more recent CNNs than VGG, such Denselet (Huang et al. 2017). but the results remained very similar.
10

---

Published in Transactions on Machine Learning Research (11/2025)
We can compare the TT-TFHE results to some TFHE-based competitors, Zama proposed a similar setting" with VGG pre-computed by the client for CIFAR-10, and against which we infer 100x faster per CPU and with a 10% increase in accuracy.
Our TT-TFHE results are now even competitive against non-TFHE- solutions (even though they again miss many of TFHE advantages), being faster than (Fast) CryptoNetss (Gilad-Bachrach et al. 2016) and SHE (Lou& & Jiang 2019), and on par with Lola (Brutzkus et al. 2019) and Lee et al. (2022) per CPU. We note that SHE and Lee et. al. have better accuracy than our model.
5.2.3 Preliminary Results On ImageNet
We would like to highlight that ImageNet not included in our result tables as it remains a very challenging task to perform in an industrial setting. Our estimation suggests that achieving a top-1 accuracy of 21% would take around 120 days with TTnet, which is obviously not practical in real-life scenarios. Furthermore, other methods such as LoLa [Brutzkus et al., 2019) or Lee et al. (2022) did not mention ImageNet in their work. In SHE (Lou & Jiang 2019), the authors projected time of 165 days for fully homomorphic encryption (FHE) model and around 5 hours on 10 cores for a leveled model. However, it is important to note that their experiments were conducted on a 1TB machine, which is not readily available in most industrial settings. Only Roy & Roy (2025) managed to reach 66.3% accuracy in almost 2h, on 96 threads roquiring 4.21GB. While our paper aims provide an industrial approach, ImageNet results are almost out of the scope of our work due to the high computation time and resources required. Designing TTnet architectures compatible with high-resolution images (e.g., 224 X 224) would require many more layers of table lookups and large kernel sizes, thereby compounding cost. In future work, we propose to investigate hicrarchical table-splitting strategies, GPU/FPGA acceleration of TFHE lookup bootstraps, and mixed HE/MPC pipelines to enable ImageNet-scale encrypted inference under TT-TFHE.
5.3 Memooy/Communicatoon Cost Of TT-TFHE
In Tables and 5 we give the memory and communccttion needs for all our settings. We can observe that the deeper the representation, the smaller the communication needs: the inputs to the server become smaller as we go deeper into the neural network (there are also fewer computations to do in the server). Some settings do not need public keys as only linear regression is performed, and thus no programmable bootstrapping is involved (Chillotti et al., 2021 Then, the largest the lookup tables (in terms of the number of features and size), the larger will be the public keys there will be more bootstrapping. Also, the oplimization proposed in Section 4.3 to ease the linear regression comes with a cost: it increases the size of the outputs. Indeod, only the VGG /GG/B/V 0 setting does not use this optimization as there is no lookup-table involved and thus no bootstrapping. Moreover, the encrypted inputs size increases with the number of features. Finally, the pre-processing on the client side is also take into account: between the Full-Pr and the r/TT settings on the Adult dataset, the memory needed is increased by 1000x because of the binarization done with S operations the data. This increase can also be observed on the Diabetes dataset with 313x increase for the same reason. Therefore, an é e/TT setting would be preferable for real-life use as memory requirements and inference time are much lower.
5.4 Comparison With Other Methods.
As stated in Clet et al. (021), CKKS solutions usually require a much larger communication and memory cost than TFHE ones. In Table G we compare between each method the amount of RAM needed on server side for CIFAR-10 dataset. CryptoNets, SHE, Lola and Lee el al. are either Full-Pr or e/N, whereas Zama and ours are not as we let the user do one VGG layer or one VGG block locally. We measured the RAM used by Zama on the same machine used for our experiments. We obsorve that we use less memory than every proposed method with a competitive accuracy. [ee et al. (2022), Rovida & Leporati (2024), SHE (Lou & Jiang 2019) and Roy & Roy (2025) outperform our accuracy by more than 17%. But with huge memory cost: indeed we only need 47.5 MB which is 8000 less than Lee et al.. SHE did not report their RAM needs, but they used a 1 TB machine to run their experiments.
hhttps://github hhttp::/ggthuu..cc/amaaaaaaaaaas http://tt....aa.eeet///////////a /r
aaaee_exapllssccfar.. 1alaar__0__uua wt_.witt__ooeeeeeeeee wwtpmmmddddllppee bodde__ppitttng
11

---

Published in Transactions on Machine Learning Research (11/2025)
Table 4: Memory and communication needs for TFHE in various settings. Each dataset column is split into two configurations: Full-Pr and c/TT. Communication cost includes encrypted inputs, outputs, and public keys. All tabular models use table lookup bitwidth of n and image models a bitwidth of 4, except underlined values which use n 6.
Adult
Cancer
Diabetes
Full-Pr
e/TT
Full-Pr
e/TT
Full-Pr
e/TT
Encryption Keys
135 kB
38.1 kB
22 kB
22 kB
135 kB
21.6 kB
Public Keys
1.56 CB
220.0 MB
168.96 MB
168.96 MB
1.53 GB
101.6 MB
Client
Encrypted Iuput Size
12.5 MB
8.5 MB
1.2 MB
1.2 MB
37 MB
4.6 MB
Encrypled Output Size
0.25 MB
0.03 MB
0.5 MB
0.5 MB
MB
2.0 MB
Server
RAM
15 GB
13.6 MB
1.04 MB
1.04 MB
6.9 GB
3.4 MB
Communication Cost (with key)
1.6 GB
229.0 MB
170.66 MB
170.66 MB
1.6 GB
108.2 MB
Communication Cost (without key)
13 MB
8.53 MB
1.7 MB
1.7 MB
38 MB
6.6 MB
Table 5: Memory and communication needs for TT-TFHE in various settings. The client will have to send the public keys and the encrypted inputs to the server and then receive the encrypted outputs from it. The communication cost is therefore the sum of these three items. All tabular models use a table lookup bitwidth of and images model table lookup bitwidth of n = 4, except for underlined results who use bitwidth of 6.
MNIST
CTFAR-10
e/N
VGG
vGG,,/TT
VGG,p/TT
VGG
VGG
Encryption Keys
20.9 KB
10 &15
21.7 KB
21.7 kB
10 KB
21.7 KB / 334.11 BB
21.7
334.11 RB
Client
Public Keys
706.9 MB
0 MB
152.4 MB
152.4 MB
0 MB
538.41 MB
14.79 GB
538.41 MB 14.79 GB
Encrypted Input
11.5
75.7
GB
MB
3.31
Encrypted Output Size
2.5 MR
0.1 MR
40.6 MR
640.3 kT
0.1 MR
100.08 MR 2.5 MB
160.08 MR
2.5 MB
Server
RAM
33.7 MB
0.6 MB
18.1 MB
18.1 MBB
0.5 MB
1844 MB
47.5 MB
18.1 M8
17.5 MB
Communication Cost (with key)
$70
76.3
1.3
21.5 CB
Communication Cost (without key)
102.5 M11
11.6 MB
29 MB
10 3113
76.3 MB
1.2 GB
18.3 GB
1.2 GB
18.3 GB
Table RAM usage between different methods for the inference of single image of CIFAR-10. CryptoNets authors did not report results on CIFAR-10, but LoLa team (Brutzkus al. 2019) estimated that it would take around 100 GBs to infer one image of this dataset with CryptoNets. SHE memory is reported as an upper bound numbers were not given except for the experimental setup. The DCT-CryptoNets authors also did not publish memory requirements, but we obtained them through direct correspondence.
Dataset
Method
FHE type Accuracy
Server RAM
CryptoNets SHE LoLa
BFY
100 GB
LTFHE 92.5%
<1 TB
BFV
74.1%
12 GB
Lee et al.
CKKS
91.31%
384 GB
CIFAR-10
Rovida et al. DCT CCT-CryptoNet Zama / Ours VGG,,/
CKKS
91.53%
15 GB
TFHE
91.6%
4.21 GB
TFHE
62.31%
8.3 GB
TFIE
69.4%
18.4 MB
Ours VGG
TFHE
74.1%
47.5 MB
The best accuracy is the ResNet proposed by DCT-CryptoNet Roy & Roy 2025).. but it also leads to high consumption in RAM. With LoLa setting, the accuracy is indeed lower but it requires 32x lesser RAM than Lee et al. (2022). Then, our method reduces again the memory server by almost a factor of 252x for the same accuracy. Rovida & Leporati (2244) manage to reach a similar accuracy than DCT-CryptoNet Roy & Roy [2025), but with a higher memory requirement. RAM size on server matters for cloud computing as pricing increases along with memory need
R thus low-memory solutions help the scalability of the MLaaS.
12

---

Published in Transactions on Machine Learning Research (11/2025)
6 Cost Study And Comparisons For Deployment At Industrial Scale
We propose a novel perspective on the costs of FHE for industrial-scale machine learning deployment. While accuracy is important, time and memory are equally crucial from an industrial standpoint as they have an important impact on costs.
From the viewpoint of cloud providers, the costs are determined by the computation and RAM memory per image (assuming a full load of the servers). We aim to rank the methods based on the costs required to deploy FHE-based private machine-learning technologies in real-life scenarios.
To achieve this, we make some assumptions: we compare the cost per method for 100,000 customers, with each customer sending one input request. We used the AWS Lambda pricing of $0.00001 66667 GB-second 5 We do not consider the cost of communication (this is to our disadvantage as Cased solutions typically roquire much larger communication cost. than TFHE ones).
We conduct a comparison of two realistic use cases for large-scale deployment: tabular and MNIST datasets. For each case, calculate the cost of sample image.
6.1 Tabular Dataset
Table 7 gives a comparison of the costs of two different methods for the tabular datasets. As memory requirements were not disclosed in previous works by Jovanovic et al. (2022) or (Sanyal et al. (2018), we could not include them in the comparison. Yet, to compare our method with state-of-the-art methods, we implemented the Zama library's open-source Pythomic XGBoost. We tested 2 levels of model precision for the XGboost: 4-bit and 6-bit precision. The cost gain factor in Table 7 is a mcasure of the relative improvement in cost efficiency of the proposed method compared to our TThee model (calculated as the ratio of the two costs per sample). For instance, in the case of the 4bit XGBoost model on the Adult dataset, the cost gain factor of our proposed method over Zama's XGBoost is 250. This means that our proposed method achieves 250-fold reduction in the cost per sample compared to Zama's XGBoost.
Table 7: Comparison of cost per sample for different methods across datasets. The time and memory needed are given per sample. The cost is estimated for 100,000 customers. All the Zama XGBoost models are e e/N as a quantization step in the clear is necessary for them, ours are also c/N because a binarization stop with a learned parameter done.
Methods
Adult
Cancer
Diabetes
XGboost
Ours
XGboost
Ours
XGboost
Ours
Precision model
6bits
4bits
5bits
6bits
4bits
6bits
6bits
4bits
6bits
Accuracy
86.0%
84.3%
85.3%
96.4%
94.3%
97.1%
57.9%
57.9%
57.0%
FHE Time (4 cores)
16s
12.8s
5.6s
3.6s
2.3s
1.08s
27.9s
26.9s
1.2s
Memory
372MB
335MB
3.4MB
329MB
294MB
12MB
381MB
349MB
32MB
Total Cost
$8.9
$7.9
$0.03
$2.0
$1.1
$0.02
$17.7
$15.6
$0.06
Cost gain factor
281
250
1
62
35
558
493
Table 7 shows that our proposed method achieves significantly lower costs than the statc-of-the-art methods In particular, on the Adult dataset, our method achieves a total cost of only $0.03, which is between 250x to 281x x lower than that of Zama's XGBoost. Moreover, our method achieves comparable accuracy while requiring significantly less memory and FHE time. These results demonstrate that our proposed method is a more cost-cfficient and practical solution for largo-scale deployments for tabular datascts. We also explored implementing another compact classical ML model, GLRM (Wei et al.] 2019), using a naive quantization of its final linear parameters. However, this resulted in substantial loss of accuracy. Adapting GLRM, any other mule-based model, to the quantized setting would require extensive modifications, which fall outside the scope of this work.
13

---

Published in Transactions on Machine Learning Research (11/2025)
6.2 MNIST Dataset
Table presents comparison of different methods on the MNIST dataset. The table displays performance metrics, including accuracy, FHE inference time (4 cores), and memory usage, as well as the estimated cost per sample and the cost gain factor. The memory requirements were not disclosed the works of [Sanyal et al. (2018). We also exchuded SHE from the comparison, as its memory requirement 1TB RAM makes it impractical for scalability.
Our proposed method achieved an accuracy of 98.1%, with an FHE time of 4.4s and memory usage of 18MB. Our method has a total cost of only $0.13, which is between 114x to 36000x lower than other state-of-the-art methods. Our method is largely more cost-effective than the other methods for the MNIST dataset.
Table 8: Comparison of cost per sample for different methods the MNIST datasct. The time and memory needed are given by sample. The cost is estimated for 100,000 customers.
Performances
Costs
FHE Time
Cost Total
Cost Gain Factor
Methods
Accuracy
Memory
(4 cores)
Zama
97.1%
172.5s
1.5GB
431$
3.3k
Fast CryptoNets
98.7%
59s
48GB
4720$
36k
Lola
99.0%
4.4s
2GB
14.78
114
Ours
98.1 %
1.4s
18MB
0.13$
7 Limitations And Conclusion
7.1 Limitations
Our proposed framework is still not performant as the latest non-TeHE-based solutions with regard to running time and accuracy. Moreover, CIFAR-10 and larger datasets remain out of reach for industrial use. Furthermore, while TT-TFHE enhances privacy during inference (the server never receives decrypted client data and computes only on ciphertexts), is important to acknowledge that inference-time privacy does not eliminate all risks. For example, model inversion, side-channel leakage (e.g., timing or memory access patterus), or collusion between client and server remain potential vulnerabilities. Furthermore, the model architecture may be exposed in our setup, adversarial reconstruction of inputs from outputs remains open concern. As such, deployment of TT-TFHE in sensitive settings should consider complementary mitigations (such as differential-privacy preprocessing, audited hardware environments, or side-channel hardening) beyond simply encrypting the inference pipeline.
7.2 Conclusion
In this paper, presented new framework, TT-TFHE, which greatly outperforms all TFHE-based PPML solutions in terms of inference time, while maintaining acceptable accuracy. Thanks to the compact nature of TTnet, our proposed framework is a practical solution for real-world applications, particularly for tabular data and small image datasets like MNIST, as it requires minimal memory /communication cost, provides strong security for the client's data, and is easy to deploy. We believe that this research will spark further investigations into the utilization of truth tables for privacy-preserving data usage, technology advocated by the recent NIST Artificial Intelligence Risk Management Framework Ai 2023
14

---

Published in Transactions on Machine Learning Research (11/2025)
References
NIST AI. Artificial intelligence risk management framework (ai rmf 1.0). 2023.
André Araujo, Wade Norris, and Jack Sim. Computing receptive fields of convolutional neural networks. ptpp:///distlll..p///111/ renpputin-receetiveee
Distill, 2019. doi: (0.23915/distill.0002.
Adrien Benamira, Thomas Peyrin, Trevor Yap, Tristan Guérand, and Bryan Hooi. Truth table net: Scalable, compact & verifiable neural networks with a dual convolutional small boolean circuit networks form. In Kate Larson (ed.), Proceedings of the Thirty- Third International Joint Conference on Artificial Intelligence, IJCAI-24, pp. 13 21. International Joint. Conferences on Artificial Intelligence Organization, 2024. doi: 10.24963 /ta/://///cai2224444 URL https://doi. 20t./////.9///ccii.. 2024/2 Main Track.
Archie Blake. Corrections to Canonical expressions in Boolean algebra. Journal of Symbolic Logic, 3(2): 112 113, 1938. doi: 10.2307 /32077226659
Fabian Boemer, Yixing Lao, Rosario Cammarota, and Casimir Wierzynski. ngraph-ho: a graph compiler for deep learning on homomorphically encrypted data. In Proceedings of the 16th ACM International Conference on Computing Frontiers, pp. 3-13, 2019.
Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. Fast homomorphic evaluation of deep discretized neural networks. In Annual International Cryptology Conference, pp. 483-512. Springer, 2018.
Zvika Brakerski. Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP, In Reihanch Safavi-Naini and Ran Canctti (ods.), Advances in Cryptology - CRYPTO 2012 32nd Annual Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2012. Proceedings, volume 7417 of Lecture Notes in Computer Science, pp. 868 886. Springer, 2012. doi: 10.1007 /97007/977-3-7 3-6---8-------0-0 32009-5 50. URL
Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (leveled) fully homomorphic encryption without bootstrapping, ACM Transactions Compulation Theory (TOCT), 6(3):1 36, 2014.
Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. Low latency privacy preserving inference. In International Conference on Machine Learning, pp. 812- 821- PMLR, 2019.
Anna Buezak and Erhan Guven. survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials, 18(2):1153-1176, 2015.
Nicholas Carlini, Matthew Jagielski, and llya Mironov. Cryptanalytic extraction of neural network models. In Advances in Sowpllogy-CRYOOOOOO 2020: 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbora, CA, USA, August 1 17-21, 2020, Proceedings,, Part ITT, pp. 189-218. Springer, 2020.
Sergiu Carpov, Paul Dubrulle, and Renaud Sirdey. Armadillo: compilation chain for privacy preserving applications. In Proceedings of the 3rd International Workshop on Security in Cloud Computing, pp. 13-19, 2015.
Francesco Cartella, Orlando Anunciacao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. Adversarial attacks for tabular data: Application to fraud detection and imbalanced data. arXiv preprint arXiv:2101.08030, 2021.
Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approximate numbers. Tn International conference on the theory and application of cryplology and information security, pp. 409-437. Springer, 2017.
Mariaa Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene. Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds. In international conference on the theory and application of cryptology and informalion securily, pp. 3 33. Springer, 2016.
15

---

Published in Transactions on Machine Learning Research (11/2025)
Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène. Tfhe: fast fully homomorphic encryption over the torus. Journal of Cryplology, 33(1):34-91 -1- 2020a.
Tlaria Chillotti, Marc Joye, Damien Ligier, Jean-Baptiste Orfila, and Samuel Tap. Concrete: Concrete operates on ciphertexts rapidly by extending tfhc. In WAHC 2020-8th Workshop on Encrypted Computing & Applied Homomorphic Cryplography, volume 15, 2020b.
alaiia Chillotti, Mare Joye, and Pascal Paillier. Programmable bootstrapping enables efficient homomorphic inference of deep neural networks. In International Symposium on Cyber Security Cryptography and Machine Learning, pp. 19. Springer, 2021.
Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei. Faster cryptonets: Leveraging sparsity for real-world encrypted inference. arXiv preprint (51:181110995 2018.
Jillian M Clements, Di Xu, Nooshin Yousefi, and Dmitry Efimov. Sequential deep learning for credit risk monitoring with tabular financial data. arXiv preprinl arXiv:2012.13330, 2020.
Pferre-Emmanue Clet, Oana Stan, and Martin Zuber. Biv, ckks, tfhe: Which one is the best for secure neural network evaluation in the cloud? In International Conference Applied Cryptography and Network Security, pp. 279 300. Springer, 2021.
Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saced Maleki, Madanlal Musuvathi, and Todd Mytkowicz. Chet: optimizing compiler for fully-homomorphicc neural-network inferencing. Tn Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 142 156, 2019.
Léo Ducas and Daniele Micciancio. Fhew: bootstrapping homomorphic encryption in less than a second. In Annual international conference on the theory and applications of cryptographic techniques, pp. 617 640. Springer, 2015.
David S Evans. The online advertising industry: Economics, evolution, and privacy. Journal of economic perspectives, 23(3):37 60, 2009.
Junfeng Fan and Frederik Vercauteren. Somewhat Practical Fully Homomorphic Encryption. IACR Cryptol. ePrint Arch., pp. 144, 2012. URL http:///eprinttiacr iatp:iiintiaarrroo/221202222.22. 0r1//01//44/
Cheng Fu, Hanxian Huang, Xinyun Chen, and Jishen Zhao. Gatenet: Bridging the gap between binarized neural network and fhe evaluation. In ICLR Workshop on Security and Safety in Machine Learning Systems, 2021.
Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of compuling, pp. 169-178, 2009.
Ran filad-Bachrach Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Nachrig, and John Wernsing. Cryp- toncts: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pp. 201 210. PMLR, 2016.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
Nikola Jovanovic, Mare Fischer, Samuel Steffen, and Martin Vechev. Private and reliable neural network inference. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 1663 1677, 2022.
16

---

Published in Transactions on Machine Learning Research (11/2025)
Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. Prada: protecting against dnn model stealing attacks. In 2019 IEFE European Symposium on Securily and Privacy (FuroSEP), pp. 312-527. IEFE, 2019.
Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. (GAZELLE): low latency framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pp- 1651-1669, 2018.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 60(6):84-90) 2017.
Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. In International Conference on Machine Learning, pp. 12403 12422. PMLR, 2022.
Baiyu Li and Daniele Micciancio. On the security of homomorphic encryption on approximate numbers. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 648-677. Springer, 2021.
Baiyu Li, Daniele Micciancio, Mark Schultz, and Jessica Sorrell. Securing approximate homomorphic encryption using differential privacy. In Advances in Cryptology CRYPTO 2022: 42nd Annual International Cryplology Conference, CRYPTO 2022, Santa Barbara, CA, USA, August 15 18, 2022, Proceedings, Part Springer, 2022.
I, pp.
Li Erran Li, Eric Chen, Jeremy Hermann, Pusheng Zhang, and Luming Wang. Scaling machine learning as a service. In International Conference on Predictive Applications and APIs, pp. 14-29. PMLRR 2017.
Yehuda Lindell. Secure multiparty computation. Communications of the ACM, 64(1):86 96, 2020.
Qian Lou and Lei Jiang. She: A fast and accurate deep neural network for encrypted data. Advonces in Neural Information Processing Systems, 32, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 06083, 2017.
Chiara Marcolla, Victor Sucasas, Marc Manzano, Riccardo Bassoli, Frank HP Fitzek, and Najwa Aaraj. Survey on fully homomorphic encryption, theory, and applications. Proceedings of the IEEE, 110(10): 1572-1609, 2022.
Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, and Raluca Ada Popa. Delphi: A cryptographic inference service for neural networks. In 29th USENIX Security Symposium (USENIX Security 20), pp. 2505 2522, 2020.
Payman Mohassel and Peter Rindal. Aby3: A mixed protocol framework for machine learning. In Proccedings of the ACM SIGSAC Conference on Compuler and Communications Security (CCS), pp. 35 35-52, 2018.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, hegh-performance deep learning library. In Advonces in Nearal Information Processing Systems 32, pp. 8024 8035. Curran Associates, Inc., 2019.
Robert Philipp, Andreas Mladenow, Christine Strauss, and Alexander Völz. Machine learning as service: Challenges in research and applications. In Proceedings of the 22nd International Conference on Information Integration and Web-based Applications & Services, pp. 396-406, 2020.
Robert Podschwadt, Daniel Takabi, Peizhao Hu, Mohammad H Rafici, and Zhipeng Cai. A survey of doop learning architectures for mivacc-preeeervnn machine learning with fully homomorphic encryption. IEEE Access, 10:117477-117500, 2022.
17

---

Published in Transactions on Machine Learning Research (11/2025)
Protection Regulation. Regulation (eu) 2016/679 of the european parliament and of the council. Regulation (eu), 679:2016, 2016.
M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, and Farinaz Koushanfar. Xonn: Xnor-based oblivious deep neural network inference. In USENIX Security Symposium, pp- 1501-1518, 2019.
Mauro Ribeiro, Katarina Grolinger, and Miriam A.M. Capretz. Mlaas: Machine learning as a service. In 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA), pp. 896 902, 2015. doi: 111109//CMMA.200
Lorenzo Rovida and Alberto Leporati. Encrypted image classification with low memory footprint using fully homomorphic encryption. Cryptology ePrint Archive, Paper 2024/460, 2024. URL httth:///pprrnni iacr oxg/2024/460
Arjun Roy and Kaushik Roy. Det-oryptonets: Scaling private inference in the frequency domain, 2025. URL attps://arxiv.org//
Amartya Sanyal, Matt J. Kusner, Adrià Gascón, and Varun Kanade. Tapas: Tricks to accelerate (encrypted) prodiction a service, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.15533 2014.
Andrei Stoian, Jordan Frery, Roman Bredchoft, Luis Montero, Celia Kherfallah, and Benoit Chevallier-Mames Deep neural networks for encrypled inference with tfe.. arXiv preprinl arXiv:2302. 10906, 2023.
Tianyuan Tan, Brian Knott, Wenting Cui, Youngsok Kim, Jiayi Tian, Kemal Acar, Mehmet Gursoy, Stacey Truex, Yen-Yor Yun Doan, and An Wu. Cryptgpu: Fast privacy-preserving machine learning on the gpu. In IEEE Symposium on Security and Privacy (SBP), pp- 1021-1038, 2021.
Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis, 2016.
Dennis Ulmer, Lotta Meijerink, and Giovanni Cinà. Trust issues: Uncertainty estimation does not enable reliable ood detection on medical tabular data. In Emily Alsentzer, Matthew B. A. McDermott, Fabian Falck, Suproteem K. Sarkar, Subhrajit Roy, and Stephanie L. Hyland (eds.), Proceedings of the Machine Learning for Health NewrIPS Workshop, volume 136 of Proceedings of Machine Learning Research, pp- 341-354. PMLR, 11 Dec 2020. URL httts::/ppoceeddnnss mlr, wwwpppresssvvie wwwvvv1111eee22eee html
Sameer Wagh, Divya Gupta, and Nishanth Chandran. Securenn: Neural networks in the multi-party computation setting. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Securily (CCS), pp. 587-60 602, 2019.
Dennis Wei, Sanjeeb Dash, Tian Gao, and Oktay Gunluk. Generalized Linear Rule Models. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 6687-6696. PMLR, 09-15 Jun 2019. URL https://prooeeeding. www.nngg.........mm..mm........m wwl...press/vv watps///9///ee1.... wwwi19......... html
Xiangyu Zhang, Xinyu Zhou, Mengxiao Lin, and Jian Sun. Shufflnet: An extremely efficient convolutional neural network for mobile devices, 2017.
Shuchang Zhou, Zekun Ni, Xinyu Zhou, He Wen, Yuxin Wu, and Yuheng Zou. Dorefa-net: Training low bitwidth convolutional neural networks with low bitwidth gradients. CoRR, abs/ 0666606160, 2016. URL http://arxiv.org/
18

---

Published in Transactions on Machine Learning Research (11/2025)
A
General architecture of TTnet
Layer
Layer
Flatson
ETT Blue
CoarzD (bo Biites
Barch Norm Strmatitttioo
(oardD (bod) 8 2>> fiieer
Step funetion
GRLD
P Preprocessinn
LVT Bir
Hotch
BiDsyy Lineer
Stop
Ploatin lupus
toput
Hisary
(a)
Binary
(b)
Binary
Binary
Flosting
Figure 3: (a) General architecture of the TTnet model with one-channel input. Layer 0 is pre-processing layer that allows image binarization. Then follow two layers of Learning Truth Table (LTT) blocks: three blocks in the first layer, six in the second. It should be noted that the LTT block of layer 2 does not take as input all the filters of layer 1, as it is usually the case: it only takes the filter of their groups. Finally, the last linear layer performs the classification. (b) Architecture a LIT block. It composed two layers of grouped 2D-CNN with an expanding factor of can be seen as an expanding auto-encoder. The intermodiate values are real and the input/output values are binary.
On Concrete table lookups
Table g presents the average time per call on lookup tables of different sizes for Concrete. We can observe that computation time doubles between 5-bit and 6-bit tables. From 8-bit to 9-bit, it increases by a factor 3.8x with almost seconds for each call. Thus, we focused on tables with a maximum size of 6 bits. The code used obtain this table available on Zama website Experiments were performed on our CPU, without. Turbo Boost.
C Architecture description
We detail below the architecture of the various models use. All the linear regression weights are quantified to 4-bit.
Adult. This model is composed one LTT block of kernel size and stride with no padding. results in 274 rules being activated, i.e. with weight during linear regression being different from 0.
Cancer. This model is composed of one LTT block of kernel size 5 and stride 4 with no padding, It results in 80 rules being activated, i.e. with weight during linear regression being different from O.
Diabctes. This model is composed of one LTT block of kernel size 6 and stride 5 with padding. It results in 295 rules being activated, d.e. with weight during linear regression being different from 0.
MNIST e/TT This model is composed of one LTT block of kernel size and stride with no padding. The input is binarized and resized 20 20 before entering the LTT block. is followed by linear layer of 1600 features to 10 classes.
hhttps: http:///..........aaaoc////////a
19

---

Published in Transactions on Machine Learning Research (11/2025)
Table Measured time lookup table call through TFHE library Concrete, according to the table input bit sizes.
Input bit size
Average time per call (ms)
49.3
57.6
3
57.3
4
74.6
5
75.2
6
169.9
7
353.4
8
774.4
2979.5
10
2756
11
3023.2
12
3732.5
13
3956.5
14
4030.1
15
4009.4
16
4499.5
MNIST VGG1B/0 This model is composed of the first VGG block followed by linear layer of 1176 features to 10 classes.
MNIST /T This model is composed of the first VGG block followed by one LIT block of kernel size and stride with no padding and 24 channels. It is followed by linear layer of 1176 features to 10 classes.
MNIST V TT This model is composed of the first VCG block followed by one LTT block of kernel size and stride with no padding and 16 channels. It followed by a linear layer of 576 features to 10 classes
CIFAR-10 1/ This model is composed of the first VCG block followed by linear layer of 64*11*11 7744 features to 10 classes.
CIFAR-10 /G There are two models for this setup:
The first model is composed of the first VGG layer followed by three LTT blocks in parallel of kernel size (2 and stride with no padding and one residual layer in parallel. The outputs are then concatenated into vector of size 64 * 11 11 30976. It is followed by lincar layer of 30976 features to 10 classes.
The second model is composed of the first VGG layer followed by three LIT blocks and one residual layer all in parallel. The first LTT block uses kernel size (3, 2) and stride with padding, the second one kernel size 32 and stride 2 with padding, the third one kernel size of size 1 and 6 groups and stride 2 with no padding. The outputs are then concatenated into a vector of size 64 * 11 * 11 * 4 30976. It is followed by a linear layer of 30976 features to 10 classes
CIFAR-10 VGG R/TT There are two models for this setup:
The first model is composed of the first VGG block followed by three LTT blocks in parallel kernel size (2,2) and stride with no padding and one residual layer in parallel. The outputs are then concatenated into vector of size 64 11 4 30976. It is followed by linear layer of 30976 features to 10 classes.
20

---

Published in Transactions on Machine Learning Research (11/2025)
The second model is composed of the first VGG block followed by three LTT blocks and one residual layer all in parallel. The first. LTT block uses kernel size (3, 2) and stride with padding, the second one a kernel size (2, 3) and stride 2 with no padding, the third one a kernel size of size 1 and 6 groups and stride with no padding. The outputs are then concatenated into a vector of size 64 * 4 30976. is followed by a linear layer of 30976 features to 10 classes.
D Dataset description
All datasots have been split times in 80-20 train-test split for k-fold testing.
The Adult dataset comprises 48,842 individuals, each with 14 features and label that indicates whether their income is above or below 50KS USD or not. After one hot encoding, it resulted in 94 binary features and 6 numerical features. The dataset is available at https://archive ics.uci. www.m///aaaastss.. Adult
Adult.
The Cancer dataset is composed of 569 data points, each with 30 mumerical characteristics. The objective is to predict whether lumor is malignant benign. To achieve this, we transformed each integer value into a one-hot vector, resulting in a total of 81 binary features. The dataset is available at https://archive.ttt wttp:eee.........../...eeeeeeeee
Cancer.
Diabetes. The Diabetes dataset includes 100,000 patient records, each with 50 characteristics that are both categorical and numerical. We retained 43 of these features, 5 of which are numerical, and the rest are categorical. This resulted in 291 binary features and 5 numerical features. The goal is to predict one of the three labels for hospital readmission. The dataset is available at https://archh ics uci, edu/mm/ datasets
E
Ablation Study on CIFAR10
In order to evaluate the effectiveness of our proposed framework, we conducted an ablation study on the CIFAR10 dataset. Our study investigated the impact of architectural optimizations on the number and precision of truth tables, the procision of the last layer, and the error precision the FHE model. The resulting table of evaluation metrics (Table 10 displays the accuracy, time on cores, and memory usage for various configurations of the framework. Our baseline model was trained with 4-bit truth table precision, 4-bit LT precision, 48 filters, and error O. Preliminary results suggest that accuracy can decrease with loss than 4 bits, and time increases dramatically with higher precision. These findings provide important insights into the optimization of our framework for practical applications in real-world scenarios.
Table 10: Ablation study on the CTFAR10 dataset. The table displays the evaluation metrics for various configuration of the proposed TT-TFHE framework. The baseline model was trained with 4-bit truth table precision, 4bit LT precision and error =0. The estimated results denoted with an asterix (*).
Parameters
Accuracy
Time on cores
Memory 18 MB
4bit
74.1%
522s
Influence
6bit
75.3%
1h
48 MB
Truth Table precision
16bit
80.2%
days*
1bit
65.8%
253s
MB
Influence
4bit 74.1%
522s
18 MB
LR precision
Sbit (splitted)
74.1%
483s
1.6 GB
0
82
522s
18MB
Influence p error (on first 100 images)
0.05
82
437s
14MB
0.1
82
353s
14MB
21

---

Published in Transactions on Machine Learning Research (11/2025)
In Table 11 give the different metrics with part of the LR being delegated to the client not (split not ) We can observe that while the inference time reduces greatly (1.6x), the RAM needed is few order of magnitude higher due to the large outputs being computed at that time.
Table 11:
Impact of splitting the linear regression on 4bits on all the different metrics on the CIFAR-10 dataset, in the VGG TT setting.
CIFAR10
Not Split
Split
Encryption Keys
33 kB
22 kB
Public Keys
538 MB
107 MB
Client
Encrypted Input Size
485 MB
485 MB
Encrypted Output Size
160 kB
1.6 GB
RAM
18 MB
1.6 GB
Server
Inference Time
520s
320s
Communication Cost (with key)
GB
2.3 GB
Communication Cost (without key)
485 MB
1.6 GB
F Single CPU estimations
Table 12: Normalized image dataset results for TT-TFHE and competitors to single CPU core. Results denoted with are estimated by the original authors, not measured. All our models table lookup bitwidth of 4, except the underlined ones that use = 6.
Full-Pr (0/N)
c/N Zama DCT-CryptoNets
VGG18/0 Ours
VG /N
VOG
E-Hsed schemes
TAPAS
GateNet
Ours
7ama
Ours
Ours
#CPU cores
1
1
1
1
1
Acc. (%)
98.6
98.8*
97.1
97.2
97.5
98.2
98.1
MNIST
Time
592h
881*
11.5m
4m
0.16s
34.8s
17.6s
Acc. (%) Time
80.5*
91.6
70.4
62.3
69.4/72.1
74.1/75.3
CIFAR-10
7840h
36h
1.6s
61.8h
35m/ /4h
35m /th
c/N
Full Pr (0/N)
non-T Mon-TFHE-basee schemes
CryptoNets
Fast CryptoNets
Lola
Lee et. al.
Rovida et ol.
SHE
#CPU cores
Acc. (%)
99
98.7
99.0
99.5
MNIST
Time
16.6m
3.9m
17.6s
93s
Acc. (%)
76.7
74.1
91.3
91.53
92.5
CIFAR-10
Time
66h
97m
37.9m
4.3m
6.3h
22


Reviews:
[{"review_id": "uUR3wBQzPs", "reviewer": "Reviewer_sape", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "S1: The TTnet approach seems very interesting and novel. \nS2: I like the fact that the authors created an easy to use framework that can be used and help new research.\n\nW1: The related works section is very short and skips multiple related works in the PPML area. There have been GPU-based FHE works that will probably be significantly faster (and that's fine!), MPC works that evaluate LLMs, and even other FHE works, that have not been mentioned here. It's fine if TT-TFHE is slower than related works, but they need to be referenced, otherwise the comparisons are unfair.\nW2: I'd also like to see comparisons with related works experimentally. (To clarify, W1 is about theoretical, W2 is about experiments).\nW3: This approach seems to share ideas from split inference/split learning works, which have been vulnerable to attacks. Is this framework also vulnerable to these attacks?\nW4: Is your framework open source?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "TT-TFHE focuses on tabular and image datasets using TFHE and truth-table neural networks (TTnet). TT-TFHE is a Pytorch and Concrete based framework providing an automated way of scaling TTnets using TFHE. TT-TFHE outperforms other FHE implementations based on BFV or CKKS. In their evaluations, the authors report increased accuracy and significant runtime improvements (7-1200x) for three popular datasets.\n\nFor MNIST and CIFAR-10, the authors focus on the approach by LoLa which splits the inference and has the client compute the first layer and send the encrypted results to the cloud. It’s not clear though, if the runtime improvements they report are using this method and compare against frameworks that do end-to-end FHE evaluation.\n\nThe related works section is very short and fails to report and compare with multiple notable FHE works. Many works from venues like CCS, USENIX, S&P, NDSS, PETS, IEEE TIFS, etc, which focus on PPML inference (even LLM inference!!), look-up tables (LUTs) both in the context of FHE and MPC, FHE inference using GPUs, and many more have not been included here. For example, a notable work from 2021 is CrypTen, that focuses on MPC-based PPML inference and also provides a very easy to use framework using PyTorch. Not to mention since then, how many works have improved upon CrypTen. I understand that the authors want to focus on CNNs and LTTs, but the SOTA on PPML has improved a lot compared to what the authors report.\n\nUnfortunately, this is also reflected in Section 5, where the comparisons are only against 2-3 works. More elaborate (and fair) comparisons need to be made both theoretically and experimentally.\n\nI’d appreciate a bit more details on TTnets, I am not sure I really understood how CNN filters can be converted and optimized to Boolean functions. Is there any novelty on that or is this just from previous works? If it’s the latter, citations are missing.\n\nOn the threat model, the authors mention malicious insiders, but this is incompatible with FHE’s threat model, which assumes an HBC CSP. The threat model needs to be cleaned up and explained further. The authors say “in this paper, we assume that an attacker can access the neural network and only the client’s data privacy matters.” This is incorrect. A malicious CSP can completely corrupt the computation. The threat model is very simple and the same as most FHE works: it’s a semi-honest CSP. This section is confusing. Also, it fails to address who has the inputs and who owns the model.\n\nIn section 4.2 it became clear that the client computes the first layer. Why? This reveals weights to the client, if the model owner is different. There have been works that do this approach as well, but I also don’t think they are cited here. Some examples that come to my mind: Zama, PermLLM, Fission, Split learning for health. But all these are kind of insecure, see: Model inversion attacks against collaborative inference, Testing Robustness of Homomorphically Encrypted Split Model LLMs, and Unleashing the tiger: Inference attacks on split learning. Since the authors take a “split inference” approach, they’d need to demonstrate why this approach is secure and not vulnerable to such attacks.\n\nIs your framework open source?", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please address my comments W1, W2, and W3, in that order of priority. \n\nW1 and W2 are crucial to be able to assess the paper better.\n\nW3 is crucial to understand whether TT-FHE is secure against known attacks.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ej9te2Id6o", "reviewer": "Reviewer_WL3m", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The main contribution of the work is an implementation (reportedly effective) of a special type of Convolutional Neural Network (which is conducive to FHE) using a user-friendly library (TFHE-Concrete).\nThe authors discuss a few different challenges that seemingly arise in such an implementation:\n\nA. Constraints imposed by the library: FHE is inherently sensitive to computational depth - this is due to noise accumulation in FHE computations. This results in different trade-offs between performance and efficiency. It appears that Concrete is no different and the authors tuned a certain trade-off parameter (similar to hyper parameter tuning) in terms of input bit size. While an implementation challenge, it is not a noteworthy research challenge, imo. \n\nB. Limitations imposed by TTNet: The original paper that proposed TTNet had the objective of resisting PGD attacks. The authors propose changes in architecture to remove this constraint. In the words of the authors such a change -- \"is for example a\nstandard method used in BNNs\"\n\nC. Training Optimizations: In the words of the authors: \"... to overcome the limitations of the TTnet grouping method, we extended the training to 500 epochs, resulting in a more accurate model.\" Training longer for better accuracy is the most obvious \"Training Optimization\".\n\nD. Architectural optimizations: The authors explore a bunch of other proposed architectures (multiple headers, residual connections, shuffling etc.) which are commonplace in deep networks literature. I fail to see any novelty here as well. \n\nAs written, I find that the paper lacks sufficient novelty. \n\nThe paper is reasonably well written and easy to follow. However there are some rather strange statements in the paper. A few examples:\n\n1. \"Technical difficulties and associated portability issues: mastering an HE/FHE framework requires\nhighly technical and rare expertise.\" I am not sure if a research paper can be accepted just because it is hard to implement and that the authors posses a unique skill. It doesn't strengthen the paper in anyway and I suggest such statements be removed (there is no way to verify it in any case - that implementing FHE based approaches is a rare skill).\n2. \"… so that their optimal implementation can be computed practically\" What does computing an implementation mean exactly? \n3. \"… propose a new training method that emphasizes accuracy\" ..  isn’t that pretty much all the training methods objective? the goal is to improve accuracy.\n4. \"…Finally, to overcome the limitations of the TTnet grouping method, we extended the training to 500 epochs, resulting in a more accurate model\" --> this cannot be claimed as novelty, I am sure.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The papers presents an approach for training a variant of CNN known as TTNet on encrypted data using Torus Fully Homomorphic Encryption. This is done using the Torus FHE Concrete Library, which provides the necessary capabilities for implementing FHE computations. The key contribution claimed is an \"efficient implementation of the TTNet Model using the TFHE-Concrete library\"", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Please refer to the strengths and weaknesses section.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "FTzbPCVnrA", "reviewer": "Reviewer_tLL8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1.\tThe paper focuses on making FHE-based inference practical, which is a timely and important problem.\n2.\tThe integration of TTnet with TFHE is interesting, and the framework is implemented in a way that’s accessible and efficient.\n3.\tThe authors evaluate on a mix of tabular and image datasets and include comparisons with other HE methods.\n4.\tThe cloud deployment cost analysis is particularly valuable and appreciated.\n5.\tCompared to CKKS or BFV-based approaches, this method uses significantly less memory, making it more suitable for real-world multi-user applications.\n\nWeaknesses:\n1.\tPerformance on CIFAR-10 is decent but doesn’t quite reach the best results in the literature (especially those using leveled HE or hybrid schemes).\n2.\tThe paper rightly admits that ImageNet-scale use cases are out of scope for now, but that does limit generalizability.\n3.\tThe paper mentions using DoReFa-Net, removing PGD, and extending to 500 epochs, but doesn’t give much detail on how training proceeds, how long it takes, or how stable it is.\n4.\tSome parts, particularly in the abstract and introduction, are a bit wordy or repetitive.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents TT-TFHE, a framework for running deep neural network inference on encrypted data using the TFHE scheme. The key idea is to design convolutional layers as truth tables (via a family of networks called TTnet), which aligns well with TFHE’s lookup-table-based computation. The authors integrate this approach into a PyTorch + Concrete implementation and demonstrate results on both tabular and image datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1.\tIt would be helpful to know more about the training process, how long it takes, whether there are specific difficulties in convergence, and how stable the training is with the changes authors made (e.g., DoReFa, longer epochs)?\n2.\tThe authors acknowledge in the limitations that performance on harder vision tasks isn’t competitive with the very best HE schemes. That’s fine, but it might help to also reflect on this tradeoff earlier in the discussion and suggest future work or directions to improve accuracy (possibly adding more layers or smarter quantization?).\n3.\tTypos:\nConvolutionnal -> Convolutional\ninfered -> inferred\n\nAwkward/redundant phrasing: We also give projected results on ImageNet, We try to tackle the TFHE efficiency overhead as well as the technical/portability issue, Therefore, in this paper, we try to tackle…\nA pass over the writing to remove redundancy and tighten some phrasing would improve flow. \n4.\tIt would be interesting to briefly discuss whether TT-FHE can be considered in multi-party/federated settings, as this could broaden the practical applications of the framework.", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)