Title: HEPrune: Fast Private Training of Deep Neural Networks With Encrypted Data Pruning
Venue: NeurIPS 2024
Accepted: yes
Keywords: Confidential Training

Privacy

Pruning

Cryptographic Computing
Abstract: Non-interactive cryptographic computing, Fully Homomorphic Encryption (FHE), provides a promising solution for private neural network training on encrypted data. One challenge of FHE-based private training is its large computational overhead, especially the multiple rounds of forward and backward execution on each encrypted data sample. Considering the existence of largely redundant data samples, pruning them will significantly speed up the training, as proven in plain non-FHE training. 
Executing the data pruning of encrypted data on the server side is not trivial since the knowledge calculation of data pruning needs complex and expensive executions on encrypted data. There is a lack of FHE-based data pruning protocol for efficient, private training. In this paper, we propose, \textit{HEPrune}, to construct a FHE data-pruning protocol and then design an FHE-friendly data-pruning algorithm under client-aided or non-client-aided settings, respectively. We also observed that data sample pruning may not always remove ciphertexts, leaving large empty slots and limiting the effects of data pruning. Thus, in HEPrune, we further propose ciphertext-wise pruning to reduce ciphertext computation numbers without hurting accuracy. Experimental results show that our work can achieve a $16\times$ speedup with only a $0.6\%$ accuracy drop over prior work. 
The code is publicly available at \href{https://github.com/UCF-Lou-Lab-PET/Private-Data-Prune}.

HEPrune: Fast Private Training of Deep Neural Networks With Encrypted Data Pruning

Abstract

Non-interactive cryptographic computing, Fully Homomorphic Encryption (FHE), provides a promising solution for private neural network training on encrypted data. One challenge of FHE-based private training is its large computational overhead, especially the multiple rounds of forward and backward execution on each encrypted data sample. Considering the existence of largely redundant data samples, pruning them will significantly speed up the training, as proven in plain non-FHE training. Executing the data pruning of encrypted data on the server side is not trivial since the knowledge calculation of data pruning needs complex and expensive executions on encrypted data. There is a lack of FHE-based data pruning protocol for efficient, private training. In this paper, we propose, HEPrune , to construct a FHE data-pruning protocol and then design an FHE-friendly datapruning algorithm under client-aided or non-client-aided settings, respectively. We also observed that data sample pruning may not always remove ciphertexts, leaving large empty slots and limiting the effects of data pruning. Thus, in HEPrune, we further propose ciphertext-wise pruning to reduce ciphertext computation numbers without hurting accuracy. Experimental results show that our work can achieve a 16 × speedup with only a 0 . 6% accuracy drop over prior work. The code is publicly available at https://github.com/UCF-Lou-Lab-PET/Private-Data-Prune.

1 Introduction

Machine learning, especially deep neural networks, has been widely applied in various domains, including healthcare [1], finance [2], and so forth. Due to the lack of expertise and computational resources, the average user often outsources the training task to the cloud servers in the machinelearning-as-a-service (MLaaS) setting. However, the training data is often highly private and private, and it should not be directly shared because of business, legal, and ethical constraints. Private training enables the cloud server to train machine learning models on encrypted data, where strong privacy guarantees are offered by cryptographic primitives such as FHE [3].

However, FHE-based private training is significantly hindered by its substantial execution time. For example, the encrypted training can be 1 ∼ 3 orders of magnitudes slower than in the plaintext training [4, 5, 6]. The high execution time primarily stems from the transformation of a plaintext dataset into an encrypted format, along with the substitution of straightforward plaintext computations with more resource-intensive ciphertext operations. Reducing the number of data samples used for training could greatly accelerate the process. To optimize plaintext datasets, methods like dataset pruning are commonly employed, where the model trainer has access to both the dataset and model.

Dataset pruning involves analyzing data samples, calculating an importance score for each sample during training iterations, and discarding redundant samples to streamline training. Prior research indicates that dataset pruning can enable machine learning model training on a fraction of the data-sometimes as little as 10%-with minimal to no loss in accuracy [7, 8, 9, 10, 11].

Pruning private datasets in encrypted form to accelerate training remains an open problem due to several challenges. First, calculating importance scores and sorting data samples for removal require complex encrypted computations, such as costly non-linear and sorting operations. For instance, calculating the importance score requires tracking changes in training dynamics [11, 12]-such as logits, gradients, and losses-and computing corresponding distances on encrypted data, all of which involve costly FHE operations. These high overheads that may offset-or even surpass-the potential benefits of dataset pruning. Second, plaintext-level data pruning used in the prior plaintext data pruning [7, 8, 9, 10, 11] does not always yield execution and ciphertext reduction benefits, as a single ciphertext often contains multiple plaintext samples within its slots. Therefore, effective ciphertext pruning is critical to enable faster private training.

In this paper, we propose HEPrune , the first encrypted data pruning framework for private training. We begin by constructing an encrypted data pruning method using pure FHE. To accelerate FHEenabled data pruning, we introduce a homomorphic encryption-friendly score (HEFS) to effectively evaluate the importance of data samples. To avoid costly FHE-based sorting, we propose client-aided masking (CAM) to identify less important samples while ensuring data privacy. To bridge the gap between sample-wise importance scores and ciphertext-wise data, we develop a ciphertext-wise pruning (CWP) technique to reduce the number of ciphertexts during private training. We conduct experiments in both training-from-scratch and transfer-learning settings. The proposed encrypted data pruning framework can accelerate private training by 16 × with only a 0 . 6% accuracy drop.

2 Background

2.1 Fully Homomorphic Encryption-Enabled Private Training

Fully Homomorphic Encryption (FHE)[3] is a cryptographic primitive that supports arbitrary computation on encrypted data. An FHE workflow involves four functions: client-side KeyGen , Enc , Dec , and server-side Eval . For Eval , FHE natively supports homomorphic addition, subtraction, and multiplication between ciphertexts and plaintexts, denoted as ⊞ , ⊟ , and ⊠ , respectively. Nonlinear functions such as the comparison function, max function, SoftMax function, and square root function can be approximated using polynomials. We denote these functions as HE . Cmp [13, 14], HE . Max [14], HE . SoftMax [6, 15], and HE . Sqrt [16], respectively. FHE enables confidential training on encrypted datasets. While early works focused on training simple models on small datasets, such as linear regression and logistic regression models[17, 18, 19, 20], recent research has advanced towards training deep neural networks (DNNs) using HE. Although HE provides theoretical data privacy guarantees, privately training DNNs on large encrypted datasets typically incurs substantial computational overhead. For example, training a dense model for one step on a batch of 60 MNIST samples can take over 1 . 5 days in FHESGD [4].

Aline of research has been proposed to accelerate HE-enabled private training. Glyph [5] incorporates two HE schemes, TFHE and BGV, to enable private training in the transfer learning setting, allowing training of an MNIST mini-batch in only 0 . 04 hours. The most recent work, HETAL [6], achieves private training within 1 hour on the MNIST and CIFAR-10 datasets by using optimized matrix multiplication and GPU acceleration. While other cryptographic tools, such as Multi-Party Computation (MPC), can also achieve private training, most existing MPC approaches [21, 22, 23, 24] rely on a non-colluding server assumption, where multiple non-colluding servers are required to ensure security. Additionally, MPC-based methods typically incur significant communication overhead; training a LeNet model on the MNIST dataset, for instance, can generate approximately 500 GB of communication overhead [24]. In contrast, FHE-enabled private training does not require the non-collusion assumption and incurs significantly less communication overhead.

2.2 Dataset Redundancy and Pruning

Not all data samples contribute equally to DNN training [25]; some samples are less important and can be pruned during training. Training on only a subset of data can effectively reduce computational

overhead while achieving generalization performance comparable to training on the full dataset [10, 11]. Several methods have been proposed to identify the most informative data samples. Among these, score-based methods [7, 8, 9, 10] are widely used for their simplicity and effectiveness. These methods compute sample-wise importance scores during training and select the most informative samples based on these scores.

The importance score can be as simple as the entropy loss [8, 10] for each sample. Another commonly used score is the forgetting score [7], which counts the number of "forgetting events" that occur for each sample during training, where a forgetting event is defined as a change in the model's prediction for the same sample between two consecutive epochs. GraNd [9] uses the ℓ 2 -norm of the sample-wise gradient to represent sample importance, while ELN2 [9] approximates GraNd by calculating the ℓ 2 -norm of the error vector. Additional methods for identifying sample importance include submodularity-based methods like GraphCut [26] and gradient-matching-based methods like GradMatch [12]. These methods typically start with an empty set and gradually add samples, in contrast to score-based methods, where sample importance scores are computed simultaneously and independently.

Data pruning methods are generally divided into static and dynamic pruning methods. Static pruning refers to data pruning performed once before training [7, 8, 9, 26], while dynamic pruning involves pruning data every few epochs during training [12, 11, 10]. Although these methods were designed with different motivations and target settings, they can be adapted for use in either setting. For instance, [8] uses entropy loss in a static setting, while [11, 10] apply it in a dynamic setting. Similarly, dynamic pruning methods like [26, 12] can be adapted to static settings, as demonstrated by [27], without losing effectiveness. In this paper, we focus on dynamic pruning.

30

40

50

60

70

80

90

Data Fraction(%)

90

92

94

96

Test Accuracy(%)

(a)

Forget

Entropy

GraNd

ELN2

No Pruning

Forget

Entropy

GradNd

EL2N

HEFS

10 1

10 2

10 3

10 4

10 5

HE Time(min)

(b)

Runtime

Acc

0

1

2

3

4

5

6

0

40

80

120

150

(c)

Empty CT

Sparse CT

88

90

92

94

96

Accuracy(%)

Motivation. FHE-enabled private training provides a strong privacy guarantee for user data. However, private training remains significantly slower in runtime compared to unencrypted training. One primary reason for this is the large dataset size typically used for training, often comprising tens of thousands of samples. As shown in Figure 1(a), removing a fraction of data during training has minimal impact on model accuracy: even with only 30% of the data, the accuracy drop is within 2% . However, directly applying plaintext data pruning methods to private training might not only fail to accelerate the process but could actually extend the training time. As shown in Figure 1(b), computing importance scores with existing methods-such as the forgetting score [7], entropy score [11, 10], GraNd [9], and EL2N [9]-can introduce prohibitive overhead. This inefficiency arises because FHE natively supports only addition and multiplication, while existing data pruning methods often require a range of non-linear operations. Although these non-linear operations can be implemented in FHE through lookup tables or approximations, these computations are extremely costly in FHE, potentially negating the benefits of data pruning. Furthermore, as illustrated in Figure 1(c), although existing methods can effectively prune samples from datasets, they do not necessarily reduce the number of ciphertexts in private training. This is because, during private training, a single ciphertext can contain multiple samples. Naïvely applying sample-wise data pruning can lead to a large number of sparse ciphertexts that cannot be excluded from training.

Threat Model. We consider a private training scenario where a client outsources model training to a cloud server. Our protocol is designed to allow a client to outsource model training while preserving the privacy of their data and model weights. The client's private dataset and model weights are treated as intellectual property that must not be disclosed to the server at any point. We assume the server is

semi-honest, meaning it will follow the protocol specifications but may attempt to gain unauthorized knowledge, such as the dataset and model weights. Sharing certain meta-information about training, such as the model architecture, dataset size, and early stopping signal, is assumed to be safe [6]. Side-channel attacks are beyond the scope of this paper.

3 HEPrune Design

We begin by outlining the pipeline for private training with encrypted data pruning in Section 3.1. In Section 3.2, we provide details of our FHE-based data pruning algorithm. Specifically, we construct an encrypted data pruning baseline to demonstrate how sample importance evaluation and sample removal can be performed using pure FHE operations. We then enhance the efficiency of the data pruning algorithm through FHE-friendly scoring (HEFS) and client-aided masking (CAM). Finally, in Section 3.3, we introduce ciphertext-wise pruning (CWP), which removes sparse ciphertexts and further accelerates the data pruning process.

Training

Data

Encrypt

1

Pruned

Ciphertexts

Homomorphic Sample Scoring

3

Rot

Rot

Sub

Sub

Sample Masking

4

Ciphertext-wise Pruning

5

Predictions

𝑌

𝑃

Forward Pass

2

Predictions

𝑷

Sort &

Compare

Scores

𝑆

Pruning

Mask

𝑀

1

0

1

0

Add

Add

Train

𝚫𝝉

epochs

6

HE Operations

Add

Sub

Rot

Data Encrypted

in Ciphertexts

7

Encrypted

BP

𝐶′

𝐶

3.1 Pipeline of Private Training with Encrypted Data Pruning

It has been widely studied how to perform the gradient descent algorithm in the encrypted state during FHE-enabled private training [4, 5, 6]. However, it remains unclear how data pruning can be incorporated into existing private training frameworks. We illustrate our FHE-based encrypted data pruning framework in Figure 2. During private training, ❶ the client first encrypts the dataset with FHE and sends the encrypted dataset to the server. From this point forward, the dataset will never be decrypted. We refer to the encrypted data samples as ciphertexts. To identify the most informative subset of samples, ❷ , the server first runs the forward pass algorithm on all ciphertexts to obtain the encrypted prediction vector P . ❸ With P and the encrypted ground truth label Y , the server computes the sample-wise importance score S = H ( x ) . We propose an HE-friendly importance score in Section 3.2. ❹ With the importance score, the server can decide which samples to prune. This is achieved by sorting the importance score and finding the threshold importance score ¯ H corresponding to the pruning ratio [7]. A pruning mask is generated by comparing the importance score with the threshold as M = 1 {H ( x ) < H t } . The unimportant samples can be masked by simply multiplying the ciphertexts with the corresponding masks. ❺ To fully reduce the number of ciphertexts, the server performs ciphertext-wise pruning according to the current pruning mask. ❻ The server performs a backpropagation algorithm on the pruned ciphertexts for ∆ τ epochs, and then ❷ starts a new round of the data pruning algorithm to update the training subset. ❼ At the end of private training, the server sends the encrypted model back to the client, and the client decrypts the model.

We formalize the above workflow into an encrypted data pruning protocol in Figure 5 in Appendix A. Our protocol is the first of its kind to introduce data pruning to private training and is an enhanced private training framework with encrypted data pruning extension over existing works [4, 5, 6]. Additionally, our protocol can work in both the transfer learning setting [5, 6] and training-fromscratch setting [4]. Our protocol is fully compatible with the early stop techniques adopted in [6]. As in [6], sending meta information during training is allowed in our protocol, such as the logits, early stop signals, and importance scores. The privacy of data and models is strongly guaranteed as they are encrypted and never decrypted by the server. We first instantiate a baseline of encrypted data pruning using only FHE operations in Section 3.2, and then propose HEFS and CAM to optimize the overhead of the encrypted data pruning algorithm. In Section 3.3, we propose CWP to effectively reduce the number of ciphertexts involved in training and thus boost the efficiency of private training.

3.2 HE-enabled Data Pruning

While FHE can support arbitrary computation on encrypted data, computing non-linear functions is typically expensive. Applying existing data pruning methods to private training can lead to additional overhead that negates or even exceeds the benefits of performing data pruning. For the entropy-based methods [8, 11, 10], although the entropy loss is typically considered cost-free in the plaintext, it is not explicitly computed during private training. Instead, we compute the gradient directly without calculating the loss itself, as illustrated in Figure 5, step 3(b). Computing the entropy loss in FHE requires approximating the logarithm function, which is computationally expensive. The forgetting score [7] is simpler to compute, requiring only comparison operations between the current prediction and prediction from the last epoch. However, the forgetting score cannot be easily made dynamic, as it usually requires calculations over the full dataset for multiple epochs. The most viable existing data pruning method is the EL2N [9], which simply utilizes the prediction P and label Y . Although originally proposed as a static pruning method, we find that EL2N also remains effective in a dynamic setting, similar to the entropy score [10]. We first instantiate an FHE-enabled data pruning algorithm, detailed in Algorithm 1, based on the dynamic version of EL2N (HE2LN). Subsequently, we demonstrate that even EL2N remains computationally expensive in the encrypted state and propose the HE-friendly score (HEFS) and client-aided masking (CAM) to accelerate the encrypted data pruning.

Algorithm 1: Homomorphic Data Pruning

HEL2N Baseline. The EL2N score is defined as H ( x ) = E w t ∥ p ( x ; w t ) -y ∥ 2 , where p ( x ; w t ) is the prediction vector for sample x and y the corresponding ground truth label. In essence, the EL2N score is the ℓ 2 -norm of the error vector, which can be computed via pure FHE operation as shown in Algorithm 1. We first compute the prediction vector P by encrypted forward pass. The HE . SoftMax in the forward pass is evaluated by polynomial approximation [15] and domain extension technique [28]. Computing the forward pass in the encrypted state is the same as existing private training frameworks [6]. With the encrypted prediction vector P and the ground truth label

Y , we can compute the EL2N score homomorphically. Specifically, we first compute the sum of squares over the error vector, which requires homomorphic subtraction, multiplication, and rotation. Then we take the square root of sum of squares to compute the ℓ 2 -norm of the error vector. While HE . Sqrt can be implemented via Newton iterative algorithm [16], the overhead is prohibitive as the Newton iterative algorithm needs ∼ 10 iterations to compute an accurate square root. Additionally, the Newton iterative algorithm in FHE involves considerable ciphertext-ciphertext multiplication. This leads to a large number of additional relinearization and bootstrapping operations. A single square root over a ciphertext can take up to 2 minutes.

̸

HE-friendly Score. Simple as the EL2N score is, using it to evaluate the importance of data samples in the encrypted state can still incur prohibitive overhead due to its complex non-linearity. We propose an HE-friendly importance score (HEFS) to address this issue. We first derive the formulation of HEFS, and then demonstrate how it can be computed via pure FHE operation. To determine how a single data sample affects the training, we can quantify the importance of a sample by the difference of the gradient before and after removing a sample. Denote the gradient of a sample ( x, y ) over the weights at time t as g t ( x, y ) = ∇ w t ℓ ( p ( w t -1 , x ) , y ) . Given a minibatch of B samples S = { ( x i , y i ) } B -1 i =0 , the importance of a sample can be quantified by the difference of the time derivative of the loss function, ∆ t , before and after removing the sample from the minibatch. The difference of the derivative is bounded by the sample's gradient [9]. Specifically, let S ¬ k = S \ { ( x k , y k ) } be the set after removing a certain sample ( x k , y k ) . For ∀ ( x i , y i ) ∈ S and i = k , it holds that

EL2N approximates the ℓ 2 -norm of the gradient by the ℓ 2 -norm of the error vector. We further streamline the EL2N score using the ℓ 1 -norm. More formally, we define the HEFS as:

HEFS can be efficiently computed during private training. Specifically, the circuit for HEFS consists of only two FHE subtractions and one max operation, which can be computed as:

In the above equation, the homomorphic subtraction ⊟ is significantly faster than other FHE operations. HE . Max can be effectively computed via HE . Cmp . While the HE . Max operation has the same time complexity as HE . Cmp , the concrete runtime of HE . Max is even more efficient, typically 1 . 5 ∼ 2 × faster under the same parameter setting [14]. The proposed HEFS is a close approximation to the original EL2N score, which guarantees the effectiveness of the HEFSbased data pruning. We show the accuracy of the data pruning using HEFS in Section 4.

Algorithm 2: Client-aided Sample Pruning

Input : The pruning ratio p . The server holds the encrypted dataset ¯ D = { ¯ X i , ¯ Y i } C - 1 i =0 and encrypted score ¯ score and the client holds the secret key SK .

Output : The pruned encrypted dataset

Client:

score

HE

.

Dec

(

¯

score,

SK

)

;

θ

QuickSelect

(

score, p

)

;

mask

Compare

(

score, θ

)

;

Sends

mask

to the server;

Server:

¯

D

′

¯

D

;

for

i

0

to

C

-

1

do

if

mask

i

== 0

then

¯

D

′

¯

D

′

\ {

( ¯

X

i

,

¯

Y

i

)

}

;

//

remove

an

empty

ciphertext

else

( ¯

X

i

,

¯

Y

i

)

mask

i

⊠

( ¯

X

i

,

¯

Y

i

)

;

//

remove

unimportant

samples

return

¯

D

′

Client-aided Masking. After evaluating the importance of each data sample, we need to remove the less informative ones from the training set. This requires the server to sort all importance scores homomorphically to determine the threshold of important scores, ¯ H . Given a dataset with N data samples, O ( N 2 ) homomorphic comparisons are needed. Since N is typically large for machine learning model training, such sorting incurs prohibitive overhead in the encrypted state, which can offset the benefits of data pruning or even prolong the total training time. To effectively identify and remove the less important data samples, we propose client-aided masking (CAM) in Algorithm 2. We offer an analysis on the computation, communication overhead, and security implications as follows.

Efficiency. In contrast to the heavy server-side homomorphic sorting, finding H t is extremely fast on the client's side, with only O ( N ) runtime via the quick select algorithm. In practice, this process takes only 15 ms on the CIFAR-10 dataset. Additionally, the communication overhead is minimal.

For the CIFAR-10 dataset with 43 , 750 training samples, only 2 CKKS ciphertexts are needed to transfer the encrypted importance scores when the slots are fully utilized. This incurs only 4 MB of communication overhead. For comparison, the early stopping signals used to determine early stopping incur 18 MBcommunication overhead when transferring the encrypted logits [6].

Security. Directly asking the client to decrypt and reveal the model weights and datasets to the server clearly breaches the client's privacy and is therefore prohibited. However, exchanging meta information about training does not directly compromise private information and is typically permitted. For instance, HETAL [6] allows the server to send the logits of the validation set to the client, who then computes the loss and determines whether to stop training early. Such exchanges of meta information are crucial to ensure the effectiveness of private training. Further details can be found in Appendix B.

1

0

1

0

0

0

0

0

0

0

1

0

1

1

1

1

pop_front()

pop_back()

Pruning Mask

𝑴

Ciphertexts

𝑫

Ciphertext Queue

Pruned Ciphertexts

𝑫′

HE.Rot

HE.Add

Compute

Sparsity

1

2

0

1

4

Sort by

Sparsity

2

𝒔𝒑𝒂𝒓𝒔𝒊𝒕𝒚

3

3.3 Ciphertext-wise Pruning

While the HEFS and CAM make the encrypted data pruning algorithm much more practical, the resulting ciphertexts remain largely sparse, thus limiting the training time acceleration. To this end, we propose ciphertext-wise pruning to effectively reduce the number of ciphertexts involved in training, as illustrated in Figure 3, which further boosts the efficiency of the private training. We detail the steps of ciphertext-wise pruning in Algorithm 3. Without loss of generality, we refer to all the slots occupied by a single sample within a ciphertext as a sample slot. Once the server obtains the pruning mask, ciphertext-wise pruning can be performed without client involvement.

We denote the number of samples in each ciphertext as B and M i is a Boolean array that indicates whether each of the B samples should be pruned. ❶ The server first computes the sparsity of each ciphertext, which is done by simply counting the number of 0 -s in each M i . ❷ After computing the ciphertext-wise sparsity, the server can sort the ciphertexts along with their corresponding masks. We represent the sorted ciphertexts in a dequeue. To perform ciphertextwise pruning, the server first identifies two ciphertexts ct front and ct back from the queue. ❸ After removing the full ciphertexts and empty ciphertexts from the queue via Trim () , we then leverage the most sparse ciphertext ct back to fill

in the empty slots in the least sparse ciphertexts ct front . The key step is to align samples in ct back with the empty slots in ct front . The function FZero () returns the index of the first empty sample slot slot empty in ct front , sets the corresponding mask to 1 , and decreases the sparsity of ct front by 1 . Similarly, FOne () returns the first non-empty sample slot slot used in ct back and sets the corresponding mask and sparsity. By taking the difference of slot used and slot empty , the server can

determine how much the ct back should be rotated to align with ct front . We mask out the other slots in ct back and obtain ct align and keep only the first sample slot slot used . This ensures only the empty sample slot in ct front is filled and the non-empty slots in ct front will not be corrupted. Then, ct align is rotated and added to ct front to fill in the empty slot in ct front . After merging the two ciphertexts, if ct front is full or there are no remaining ciphertexts to merge, the server adds it to the final set ¯ D ′ . We defer the details about Trim () , FZero () , Fone () and Mask () to the Appendix D. We remark the pruning mask generated by CAM is not encrypted, while enables efficient operations related to the pruning mask without invoking heavy FHE computation.

4 Experiments

4.1 Experimental Setup

Models and Datasets. To demonstrate the generalizability, we evaluate the proposed encrypted data pruning methods in two settings, the transfer learning setting as in HETAL [6] and trainingfrom-scratch setting as in FHESGD [4]. For the transfer learning setting, we adopt the same feature extractors as [6], the pre-trained ViT Base [29] model and the pre-trained MPNet Base [30] model. The client first extracts samples into a 768-dimension feature and then encrypts the features. The server performs private training on the encrypted features. For the training-from-scratch setting, the client encrypts the raw dataset directly, and the server performs private training on the encrypted dataset. We use a 3 -layer MLP, with two hidden layers of dimension 128 , which is a widely used structure in the private training setting [4, 21]. We perform encrypted data pruning on four widely used image datasets: MNIST [31], CIFAR-10 [32], Face Mask Detection [33], DermaMNIST [34] for image classification and one audio dataset SNIPS [35] for sentiment analysis. We partition the datasets as training, validation, and test set. The size of the training set and validation set is 7 : 1 . We defer the number of samples in each set in the Appendix C.

System Setup and Implementation. We use the RNS version of the CKKS [36, 37] scheme for homomorphic encryption. We use the bootstrapping method for CKKS in [38]. Our implementation is based on the OpenFHE [39] library. For HE parameters, we set the cyclotomic ring dimension as N = 2 16 and ciphertext modulus 1555 bits to guarantee a security level of 128-bit under the Homomorphic Encryption Standard [40]. Each ciphertext has N/ 2 = 32768 slots and we set the multiplicative depth as L = 12 . All experiments were conducted using an AMD Ryzen Threadripper PRO 3955WX processor operating at 2.2GHz, equipped with 125GB of memory. We use the SingleInstruction-MultipleData (SIMD) technique [41] to fully utilize the ciphertext slots and amortize the cost of homomorphic operations. Under SIMD, multiple data samples can be coded into one ciphertext. We adopt the most efficient encoding methods proposed in [6, 42]. For nonlinear operations like SoftMax and ReLU, we adopt approximation-based methods. We report the CPU version of HETAL, as their GPU implementation is not publicly available.

4.2 Results

End-to-end performance. As shown in Table 1, we compare the end-to-end training time and accuracy on five datasets with HETAL [6] and an unencrypted baseline. HETAL is known to be the most efficient full-data private training framework. For fair comparison, we unify the batch size as 128 . For HETAL, we maintain the security parameters used in their original paper. For the proposed encrypted data pruning method, we set the pruning ratio as p = 0 . 9 , i.e., only 10% of the data remains for training in each epoch. The total training time is reduced by ∼ 6 . 6 × across datasets. The accuracy drop is as small as 0 . 25% on the Face Mask Detection dataset. With encrypted data pruning, the accuracy is even 0 . 14% higher than the unencrypted baseline and HETAL.

Effectiveness of the proposed methods. In Table2, we demonstrate the effectiveness of each proposed technique. We start by training on the full CIFAR-10 dataset using the framework of HETAL. For the encrypted data pruning methods, we fix the pruning ratio as p = 0 . 9 . In the prune baseline, we naively apply plaintext data pruning method to HETAL, which prolongs the total training time. Sorting 43750 importance score in CIFAR-10 can take more than 200 hours, which offsets the benefits of data pruning. By incorporating the client-aided masking, the server can remove the unimportant samples more effectively. The client-aided methods speed up the private training by 1 . 49 × with a 0 . 41% accuracy drop. The communication cost increases slightly by approximately 1 . 2 × . Yet, as the EL2N score involves costly square root computation, the speed-up is modest. By incorporating HEFS, we improve the overhead during importance score computation. With HEFS, the private training can be accelerated by 2 . 78 × . The HEFS also achieves a ∼ 0 . 2% higher accuracy. When ciphertext-wise pruning is applied, the runtime speed-up is the most significant, achieving a 6 . 5 × speed-up over HETAL with only 0 . 2% accuracy drop.

1

5

10

20

40

50

60

70

80

90

Data Fraction(%)

0

50

100

150

200

250

300

HE Time(min)

(a) Different pruning ratios on CIFAR-10

1

5

10

20

40

50

60

70

80

90

Data Fraction(%)

0

50

100

150

200

250

300

HE Time(min)

(b) Different pruning ratios on MNIST

95.6

95.8

96.0

96.2

96.4

96.6

96.8

97.0

Accuracy(%)

88

90

92

94

96

98

100

Accuracy(%)

Runtime

Acc

No Pruning Acc

Ablation on the pruning ratio. In Figure 4, we demonstrate the effectiveness of the proposed encrypted data pruning method under different data pruning ratios. In Figure 4 (a), we demonstrate the training time and accuracy achieved using different fractions of the CIFAR-10 dataset. Surprisingly, we find that even using only 1% of the data, the accuracy drop is only around 0 . 6% , and the training can be sped up by ∼ 16 × . Training with the 40% ∼ 70% of the data even leads to higher accuracy than training with the full dataset. The same phenomenon is observed in plaintext data pruning [9]. This is because some noisy or low-quality samples are excluded from training while retaining enough informative samples are maintained. We note that we can achieve ∼ 2 . 2 × speed up when training with 40% of the data without any loss of accuracy on the CIFAR-10 dataset. In Figure 4 (b), we experiment with the MNIST dataset and observe a similar trend. On the MNIST dataset, using only 1% of the data achieves 91 . 29% accuracy with ∼ 15 × speed-up. Yet, using 5% of the data achieves a significantly higher accuracy of 95 . 2% , which is only 0 . 5% lower than training with the full dataset.

Training from scratch. We show the performance of encrypted data pruning in the training from scratch setting in Table 3. We train a 3 -layer MLP on the MNIST dataset. We set the pruning

frequency as 10 epoch. When training with only 1% data, the end-to-end training time could be 60 . 8 × faster with an accuracy drop of 5 . 26% . Increasing the training data fraction can effectively improve the test accuracy. When using 40% and 50% fraction of data, the training accuracy is 0 . 03% ∼ 0 . 06% higher than training with the full dataset. We remark that warm-start strategy can also improve the test accuracy.

5 Discussion

Broader Impact. In this paper, we propose a framework that enables encrypted data pruning during confidential training. The proposed techniques can accelerate the private training without sacrificing the model accuracy. By incorporating data homomorphic friendly data pruning techniques, our framework makes the HE-enabled private training more practical while ensuring the data privacy.

Limitations. (1) More Model Support. Currently, the proposed methods have only been applied to simple models like MLP. Extending the encrypted data pruning to private training on larger models like CNNs and Transformers can enhance its utility. (2) More Dataset Support. In this paper, we have experimented on relatively small datasets. Extending to larger datasets will enhance its utility.

6 Conclusion

The paper presents a novel framework for encrypted data pruning aimed at enhancing private training of deep neural networks. Plaintext data pruning methods offer limited benefits in encrypted settings due to their lack of optimization for cryptographic processes. Our approach introduces crypto-oriented optimizations, including HE-friendly score, client-aided masking, and ciphertext-wise pruning, which effectively harness the potential of data pruning, achieving up to a 16-fold acceleration in training times without compromising accuracy.

References

Dinggang Shen, Guorong Wu, and Heung-Il Suk. Deep learning in medical image analysis. Annual review of biomedical engineering , 19:221-248, 2017.

Matthew F Dixon, Igor Halperin, and Paul Bilokon. Machine learning in finance , volume 1170. Springer, 2020.

Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing , pages 169-178, 2009.

Karthik Nandakumar, Nalini Ratha, Sharath Pankanti, and Shai Halevi. Towards deep neural network training on encrypted data. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops , pages 0-0, 2019.

Qian Lou, Bo Feng, Geoffrey Charles Fox, and Lei Jiang. Glyph: Fast and accurately training deep neural networks on encrypted data. Advances in neural information processing systems , 33:9193-9202, 2020.

Seewoo Lee, Garam Lee, Jung Woo Kim, Junbum Shin, and Mun-Kyu Lee. Hetal: Efficient privacy-preserving transfer learning with homomorphic encryption. In International Conference on Machine Learning , pages 19010-19035. PMLR, 2023.

Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Bengio, and Geoffrey J Gordon. An empirical study of example forgetting during deep neural network learning. arXiv preprint arXiv:1812.05159 , 2018.

Cody Coleman, Christopher Yeh, Stephen Mussmann, Baharan Mirzasoleiman, Peter Bailis, Percy Liang, Jure Leskovec, and Matei Zaharia. Selection via proxy: Efficient data selection for deep learning. arXiv preprint arXiv:1906.11829 , 2019.

Mansheej Paul, Surya Ganguli, and Gintare Karolina Dziugaite. Deep learning on a data diet: Finding important examples early in training. Advances in Neural Information Processing Systems , 34:20596-20607, 2021.

Truong Thao Nguyen, Balazs Gerofi, Edgar Josafat Martinez-Noriega, François Trahay, and Mohamed Wahib. Kakurenbo: Adaptively hiding samples in deep neural network training. Advances in Neural Information Processing Systems , 36, 2024.

Ziheng Qin, Kai Wang, Zangwei Zheng, Jianyang Gu, Xiangyu Peng, Zhaopan Xu, Daquan Zhou, Lei Shang, Baigui Sun, Xuansong Xie, et al. Infobatch: Lossless training speed up by unbiased dynamic data pruning. arXiv preprint arXiv:2303.04947 , 2023.

Krishnateja Killamsetty, Sivasubramanian Durga, Ganesh Ramakrishnan, Abir De, and Rishabh Iyer. Grad-match: Gradient matching based data subset selection for efficient deep model training. In International Conference on Machine Learning , pages 5464-5474. PMLR, 2021.

Jung Hee Cheon, Dongwoo Kim, and Duhyeong Kim. Efficient homomorphic comparison methods with optimal complexity. In Advances in Cryptology-ASIACRYPT 2020: 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, South Korea, December 7-11, 2020, Proceedings, Part II 26 , pages 221-256. Springer, 2020.

Eunsang Lee, Joon-Woo Lee, Jong-Seon No, and Young-Sik Kim. Minimax approximation of sign function by composite polynomial for homomorphic comparison. IEEE Transactions on Dependable and Secure Computing , 19(6):3711-3727, 2021.

Joon-Woo Lee, HyungChul Kang, Yongwoo Lee, Woosuk Choi, Jieun Eom, Maxim Deryabin, Eunsang Lee, Junghyun Lee, Donghoon Yoo, Young-Sik Kim, et al. Privacy-preserving machine learning with fully homomorphic encryption for deep neural network. iEEE Access , 10:3003930054, 2022.

Hongyuan Qu and Guangwu Xu. Improvements of homomorphic evaluation of inverse square root. Available at SSRN 4258571 .

Valeria Nikolaenko, Udi Weinsberg, Stratis Ioannidis, Marc Joye, Dan Boneh, and Nina Taft. Privacy-preserving ridge regression on hundreds of millions of records. In 2013 IEEE symposium on security and privacy , pages 334-348. IEEE, 2013.

Hao Chen, Ran Gilad-Bachrach, Kyoohyung Han, Zhicong Huang, Amir Jalali, Kim Laine, and Kristin Lauter. Logistic regression over encrypted data from fully homomorphic encryption. BMC medical genomics , 11:3-12, 2018.

Andrey Kim, Yongsoo Song, Miran Kim, Keewoo Lee, and Jung Hee Cheon. Logistic regression model training based on the approximate homomorphic encryption. BMC medical genomics , 11:23-31, 2018.

Miran Kim, Yongsoo Song, Shuang Wang, Yuhou Xia, Xiaoqian Jiang, et al. Secure logistic regression based on homomorphic encryption: Design and evaluation. JMIR medical informatics , 6(2):e8805, 2018.

Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE symposium on security and privacy (SP) , pages 19-38. IEEE, 2017.

Payman Mohassel and Peter Rindal. Aby3: A mixed protocol framework for machine learning. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security , pages 35-52, 2018.

Sameer Wagh, Shruti Tople, Fabrice Benhamouda, Eyal Kushilevitz, Prateek Mittal, and Tal Rabin. Falcon: Honest-majority maliciously secure framework for private deep learning. arXiv preprint arXiv:2004.02229 , 2020.

Jean-Luc Watson, Sameer Wagh, and Raluca Ada Popa. Piranha: A { GPU } platform for secure computation. In 31st USENIX Security Symposium (USENIX Security 22) , pages 827-844, 2022.

Angelos Katharopoulos and François Fleuret. Not all samples are created equal: Deep learning with importance sampling. In International conference on machine learning , pages 2525-2534. PMLR, 2018.

Rishabh Iyer, Ninad Khargoankar, Jeff Bilmes, and Himanshu Asanani. Submodular combinatorial information measures with applications in machine learning. In Algorithmic Learning Theory , pages 722-754. PMLR, 2021.

Chengcheng Guo, Bo Zhao, and Yanbing Bai. Deepcore: A comprehensive library for coreset selection in deep learning. In International Conference on Database and Expert Systems Applications , pages 181-195. Springer, 2022.

Jung Hee Cheon, Wootae Kim, and Jai Hyun Park. Efficient homomorphic evaluation on large intervals. IEEE Transactions on Information Forensics and Security , 17:2553-2568, 2022.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Kaitao Song, Xu Tan, Tao Qin, Jianfeng Lu, and Tie-Yan Liu. Mpnet: Masked and permuted pre-training for language understanding. Advances in neural information processing systems , 33:16857-16867, 2020.

Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine , 29(6):141-142, 2012.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Larxel. Face mask detection, 2020. Accessed: May 20, 2024.

Jiancheng Yang, Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. Medmnist v2-a large-scale lightweight benchmark for 2d and 3d biomedical image classification. Scientific Data , 10(1):41, 2023.

Alice Coucke, Alaa Saade, Adrien Ball, Théodore Bluche, Alexandre Caulier, David Leroy, Clément Doumouro, Thibault Gisselbrecht, Francesco Caltagirone, Thibaut Lavril, et al. Snips voice platform: an embedded spoken language understanding system for private-by-design voice interfaces. arXiv preprint arXiv:1805.10190 , 2018.

Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology-ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23 , pages 409-437. Springer, 2017.

Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. A full rns variant of approximate homomorphic encryption. In Selected Areas in Cryptography-SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15-17, 2018, Revised Selected Papers 25 , pages 347-368. Springer, 2019.

Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. Bootstrapping for approximate homomorphic encryption. In Advances in Cryptology-EUROCRYPT 2018: 37th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Tel Aviv, Israel, April 29-May 3, 2018 Proceedings, Part I 37 , pages 360-384. Springer, 2018.

Ahmad Al Badawi, Jack Bates, Flavio Bergamaschi, David Bruce Cousins, Saroja Erabelli, Nicholas Genise, Shai Halevi, Hamish Hunt, Andrey Kim, Yongwoo Lee, Zeyu Liu, Daniele Micciancio, Ian Quah, Yuriy Polyakov, Saraswathy R.V., Kurt Rohloff, Jonathan Saylor, Dmitriy Suponitsky, Matthew Triplett, Vinod Vaikuntanathan, and Vincent Zucca. Openfhe: Opensource fully homomorphic encryption library. Cryptology ePrint Archive, Paper 2022/915, 2022. https://eprint.iacr.org/2022/915 .

Martin Albrecht, Melissa Chase, Hao Chen, Jintai Ding, Shafi Goldwasser, Sergey Gorbunov, Shai Halevi, Jeffrey Hoffstein, Kim Laine, Kristin Lauter, et al. Homomorphic encryption standard. Protecting privacy through homomorphic encryption , pages 31-62, 2021.

Nigel P Smart and Frederik Vercauteren. Fully homomorphic simd operations. Designs, codes and cryptography , 71:57-81, 2014.

Eric Crockett. A low-depth homomorphic circuit for logistic regression model training. Cryptology ePrint Archive , 2020.

Baiyu Li and Daniele Micciancio. On the security of homomorphic encryption on approximate numbers. In Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages 648-677. Springer, 2021.

Appendix

A Encrypted data pruning protocol

In this section, we detail the proposed encrypted data pruning protocol. The main overhead associated with performing performing encrypted data pruning is determined by Step 3.(d) in Figure 5.

Parties:

Client C , Server S .

Input:

C holds a private dataset D , with N samples and labels { ( X i , Y i ) } N - 1 i =0 .

Output:

C learns a trained model M and S learns nothing.

Protocol:

1: C encrypts the dataset with HE . Enc , and sends the encrypted dataset ¯ D = { ¯ X i , ¯ Y i } C -1 i =0 to the server.

2: S initializes M with random parameters W 0 and chooses the hyperparamerters for training: the learning rate η , pruning ratio p and the pruning frequency ∆ τ .

3: For each epoch τ , repeat the following:

(a) S performs forward pass homomorphically: P = HE . SoftMax ( M ( X,W ))

(b) S computes gradients and updates model: W τ +1 ← W τ + η ∇ W , where ∇ W L CE = 1 N ( P -Y ) T X

(c) S sends P to C , C determines early stop.

(d) If ( τ mod ∆ τ == 0) , S performs data pruning as follows:

(i) S computes the importance score: ¯ score = Prune . Eval ( ¯ P, ¯ Y )

(ii) S sends ¯ score to C , can C computes a pruning mask mask .

(iii) S removes unimportant samples: ¯ D ′ = Prune . Remove ( ¯ D,mask )

(iv) Continue step 3(a) to train the model on the pruned dataset ¯ D ′ = { ¯ X ′ i , ¯ Y ′ i } C ′ -1 i =0

4: S sends the trained model M with encrypted optimal weights ¯ W ∗ to C . C decrypts the model with HE . Dec and obtain the final model M with optimal plaintext weights W ∗ .

B Analysis of Client-aided Masking

In this section, we offer more details about the proposed Client-aided Masking (CAM).

The main privacy issue is that (1) the server may learn private information based on the meta information, (2) the server may crack the secret key. Exposing the pruning mask mask to the server only reveals the location of unimportant data samples, while all samples are still encrypted by HE, hence the server still learns nothing about the data sample itself, which avoids the security issue (1). One of the most recent and well-known attacks is the IND-CPA+ [43]. However, it operates under the assumption that the server can ask the client to decrypt specific ciphertexts. The assumption is not upheld in Algorithm 2. Since the server can not specify the ciphertext to be decrypted and that the client only sends the server the resulting mask, rather than the decrypted scores.

The communication depends on the level of ciphertexts. As shown in Table 4, the lower level the ciphertext is at, the smaller the ciphertext is. Therefore, the server can set the ciphertext to L = 0 to reduce the communication overhead.

Algorithm 4: Ciphertext-wise Pruning

C Datasets and Hyperparameters

We detail how we divide the training set, validation set and test set in Table 5. For all tasks, we use a batch size of 128 . For the transfer learning setting, we use a learning rate of 0 . 5 and set the pruning frequency as every ∆ τ = 5 epochs. For the training from scratch setting, we use a leaning rate of

0 . 1 and set the pruning frequency as every ∆ τ = 10 epochs. Prior works [9, 12] adopt a warm start strategy, which trains the model for 10 ∼ 20 epochs on the full dataset. The warm start period is computation intensive as it uses the whole dataset. Therefore, we use a random start strategy and randomly choose a fraction of data samples according to the pruning ratio p .

D Ciphertext-wise pruning

In Algorithm 4, we detail the Trim () , FZero () , Fone () and Mask () functions, which are used during ciphertext-wise pruning. When k > 0 , the server perform left rotation on ct back by | k | sample slot. If K < 0 , right rotation is performed.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We accurately describe the Abstract and Introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: In Section 5.

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: Section 3.1

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: In Section 4.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer:[Yes]

Justification: Code is released with anonymity.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: Section 4

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: In Section 4, we report the mean and variance of the results.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: Section 4 System Setup.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The authors have reviewed the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We report Broader Impact in Section 5.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We cite datasets and models in the paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We provide an anonymous URL to release our code in the abstract.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: This work does not involve crowdsourcing or human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification:

Guidelines:This work does not involve crowdsourcing or human subjects.

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a data pruning algorithm for the training of Homomorphic Encryption (HE)-based neural networks. The authors introduce an HE-friendly importance score and client-aided masking to prune samples in the dataset. The authors further propose ciphertext-wise pruning to merge ciphertexts with empty slots, thereby reducing computational costs during training. Finally, the paper presents empirical studies to validate the effectiveness of the proposed data pruning method.\n\nSTRENGTHS:\nThe main advantages can be listed as follows:\n\n1.\tThe paper provides a new data pruning method for data encrypted by HE scheme. The authors propose the HEL2N score, which substitutes the $\\ell_2$-norm in the EL2N score with $\\ell_1$-norm, and the client will select important samples based on the score computed by server.\n2.\tThe paper proposes the ciphertext-wise pruning, enabling the server to merge ciphertexts with empty slots with the communication of the client.\n3.\tThe paper conducted experiments on five datasets and compares the proposed method with the HETAL method to demonstrate its effectiveness.\n\nWEAKNESSES:\nDespite many strengths, there are some issues with the paper as follows:\n\n1.\tThe submission requires further revisions for clarity and consistency. At line 43 “methds” should be “methods”; At line 74 and Figure 1 “CIFAR10” should be “CIFAR-10” as in Section 4; At line 326 “Table2” should be “Table 2”; At line 340 “Figure 4(4)” should be “Figure 4(a)”; Figure 1 and 4 should have sub-captions denoting which subgraph is (a) or (b).\n2.\tThe computation costs associated with data pruning raise concerns. As given by Eqn. (1), computing the HEL2N score involves multiple gradient computations for each sample, which is computationally intensive. Moreover, ciphertext-wise pruning seems to require a large number of rotations, which is also a very slow HE operation. If the data pruning process is time-consuming, it may negate the benefits, making it more efficient to train directly without pruning.\n3.\tThe novelty of the paper is questionable. The HEL2N score primarily modifies the $\\ell_2$-norm in the EL2N score to an $\\ell_1$-norm, and directly computing the square of EL2N score seems to be faster than HEL2N score. The trick of masking is also common place in HE literature. Moreover, one advantage of HE-based method is that they do not require any communications between server and client. The requirement for client-server communication in client-aided masking and ciphertext-wise pruning could diminish the significance of the proposed method.\n\nQUESTIONS:\n1.\tWhy not directly compute the square of the EL2N score, which would avoid the need for computing the square root or the maximum value and is a simpler process?\n2.\tIs the running time for HE-based data pruning included in the total running time reported in the Tables in Section 4.2? If so, what proportion of the total running time does the HE-based data pruning constitute? \n3.\tHow does the proposed method compare to a baseline that directly randomly samples a subset of ciphertext at each epoch, instead of computing importance score and merging ciphertext? I think this baseline is simpler and more efficient.\n\nLIMITATIONS:\nThe authors addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-06-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focuses on the scenario where the client encrypts the model and dataset with homomorphic encryption and outsources them to the server for training. It accelerates the training process through dynamic data pruning. This paper makes the following three contributions: \nFirst, this paper is the first to use dynamic data pruning to accelerate model training in homomorphic encryption (HE) scenarios. Second, because using the plaintext data pruning method in the HE scenario incurs significant overhead, this paper proposes an HE-friendly method for evaluating the importance of data samples. Lastly, because of the high cost of sorting in HE, this paper proposes that the client undertake this part of the computation. Additionally, since a single SIMD ciphertext can contain multiple data samples, pruning may not reduce the number of ciphertexts, even though the samples within each ciphertext become more sparse. To address this issue, the paper proposes to combine several sparse ciphertexts to reduce HE computation.\n\nSTRENGTHS:\n1) This paper is the first to apply dynamic data pruning to accelerate model training in HE scenarios.\n2) It introduces a HE-friendly important score to make data pruning more efficient.\n3) This paper uses ciphertext-wise pruning to reduce the number of ciphertexts while keeping detailed information.\n\nWEAKNESSES:\n1) The HE-friendly score needs more explanation. In this paper, the score is directly introduced without any theoretic proof of its effectiveness. \n2) The work is a bit incremental. Applying data pruning in the HE scenario doesn't seem very challenging, and there is no significant difference between data pruning in plaintext and ciphertext.\n\nQUESTIONS:\n1) Is there any theoretic proof of the effectiveness of the proposed HE-friendly score?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n1. The paper introduces a Homomorphic Encryption (HE)-based confidential training framework that enhances training efficiency through encrypted data pruning.\n2. The paper proposes HE-Friendly Score (HEFS), an enhancement over the existing EL2N score, to efficiently assess the importance of encrypted data samples.\n3. Due to the high complexity of sorting scores and calculating the pruning mask on the server, the paper introduces a method that generates data pruning masks with the assistance of the client, enabling the server to perform pruning.\n4. The paper proposes a method for pruning at the ciphertext level to reduce sparsity in the encrypted data, thereby accelerating the training process.\n5. The performance of HEFS, CAM, and CWP is evaluated on diverse datasets such as MNIST, CIFAR-10, Face Mask Detection, DermaMNIST, and SNIPS. The results are compared with the previous method, HETAL (ICML2023), to demonstrate improvements in training speed and accuracy.\n6. The experimental results indicate that the proposed methods can accelerate confidential training by up to 16 times with minimal loss in accuracy.\n\nSTRENGTHS:\n1. This paper tackles the novel problem of accelerating confidential training through encrypted data pruning, a topic that appears to have not been previously explored in existing research.\n2. The methodologies and experimental procedures are clearly explained, ensuring the reproducibility of the results by providing their code (although I have not tested the code yet).\n3. Considering that HE training is a very challenging subject due to the computational complexity of operations on homomorphically encrypted data, it is noteworthy that the authors have implemented detailed techniques such as pruning within the homomorphic encryption framework for the first time. However, it is crucial that the design carefully considers both security and performance limitations.\n\nWEAKNESSES:\n1. There are concerns regarding the privacy threat setting in this paper. The focus is solely on the importance of the client's data privacy, without explicitly considering the server's model privacy. In other words, the server's model is assumed to be publicly available information. This assumption is reflected in the final step, where the client recovers the weights of the trained model and sends them back to the server.\n2. If the server's model is publicly available, it would be more efficient for the client to process the data in plaintext after receiving the pretrained model. If the scenario involves a massive pretrained model, such as a large language model (LLM), which individual clients cannot train, then training such an LLM in an encrypted state would require at least 1000 times more computation on the server due to the difference in computational overhead between homomorphic encryption and plaintext operations. This level of computation may be unmanageable, and the final decryption of the model by the client would also be infeasible due to the enormous size (100 trillion parameters) of the model.\n3. If the primary concern is the client's privacy, it would be significantly more efficient to have the client train on a pretrained model in plaintext, use federated learning, or adopt other methods rather than struggling with encrypted training on the server, as proposed in this paper. The bottom line is that if the server's model privacy is not considered in the security threat model, it is questionable whether this approach is practical or appropriate.\n4. The HE.cmp operation does not yield a precise 1 or 0; rather, it produces a fractional value when the two compared values are similar. During the sorting process in Algorithm 1, swapping based on HE.cmp might introduce noise if the score differences are not substantial. This could affect performance. To avoid this, HE.cmp would need a high-degree approximation. The paper does not provide sufficient information on HE.cmp, and additional explanation would be beneficial.\n5. Due to the overhead of homomorphic encryption operations, involving the client in the training process because of the complexity of sorting diminishes the method's utility. While the paper does not consider the server's model privacy, allowing the client to access intermediate values during training does not pose an additional security risk. However, in scenarios where the server's model privacy is a concern, this method could enable the client to gain critical information about the model. Increasing the client's role in plaintext processing during training could significantly reduce the server's burden and enhance overall performance. In extreme cases, the client could potentially handle the entire training process in plaintext. The paper needs to explain why the client should only assist with sorting.\n\nQUESTIONS:\nIs it true that the pruning mask is also encrypted? The distinction between encrypted and non-encrypted elements in the algorithm is not entirely clear. While an overline appears to indicate encrypted values, there are instances where this is not consistently applied.\nIn scenarios where the server does not send scores to the client, the mask would presumably remain encrypted. If this is the case, how does the server determine which parts to prune, and how does it use rotation to merge ciphertexts and create pruned ciphertexts? Is it assumed that the client must decrypt the data and create the mask in plaintext? If so, the paper should explicitly state this assumption.\n\nLIMITATIONS:\nThey addressed it adequately.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a method for pruning data in a utility-preserving way under homomorphic encryption, evaluating the method to demonstrate that the savings from training on pruned data outweighs the costs of encrypted data pruning computations. The methods for determining how relevant data items are to improving training performance are similar in spirit to those in the active/few-shot learning literature, but the paper does not explicitly draw this parallel.\n\nAlthough the paper offers a concrete threat model related to \"private training\" (where model training is outsourced to a third party), several aspects of the threat model seem not to achieve the stated goal of limiting the outsourcing party/vendor's ability to learn useful facts about the data. As the current state-of-the-art is to bind third-party infrastructure providers contractually, I'd like to see a map from how the approach in this paper, in a threat model that is weak, could be strengthened to a threat model that would obviate these purely contractual limitations. For example, there are standard constructions to move from honest-but-curious models to models where the third party is more adversarial (although some reliance must always be assumed in the case of outsourced computation). More difficult are the problems of separating data flows from inferences about the content of training data through various sorts of indirect leakage (training time, ciphertext size, dependence of the presence/absence of the allowed \"early stop\" signal, etc). Although this problem is difficult in general, I suspect there are ways to organize the threat model here so that it can make stronger claims around solving them. At a minimum the threat model should declare indirect data flow out of scope while recognizing that it can leak data items to the outsourcing partner.\n\nA few structural aspects of the paper confuse an otherwise solid presentation: a core assumption in the setup of the model in which the protocol is used is that the outsourcing partner will compare the sorted data items (under encryption) to a threshold importance score determined by the utility loss of pruning, but how this threshold is set/computed is left open (an experiment uses an ex vacuo value of 0.9 for this parameter, but why is not explained even in this concrete context!); although it is clear that the goal is only to outsource training, it is not clear that an organization without the infrastructure capability for training will have infrastructure capability for things like serving - this should be declared out of scope or unpacked/discussed a bit; approximations made to simplify computation under encryption, such as the replacement of $\\ell_2$ with $\\ell_1$ norm at 204-205, are not directly evaluated or justified; in general, the grouping of samples into batch ciphertexts is assumed but not explained - the paper should explain its necessity and the benefits it provides vs. the simple solution of putting each sample in its own ciphertext.\n\nAlthough the evaluation is valuable in supporting the core claims of the paper, there are some structural issues there as well: although the experiments characterize the tradeoff between utility and pruning ratio, this tradeoff is very different for the two example datasets. How general ought a tradeoff curve for this be? How data dependent might it be? Relatedly, might pruning affect performance for different classes differentially, especially in situations where class balance is poor? Much of the \"fairness\" literature focuses on ways that aggregate analysis breaks down when distinct classes might or ought to be treated differently by the model. Does this affect the analysis? Could it in some cases?\n\nLast, I observe that 4MB of communication overhead for a tiny database (CIFAR-10, 43750 samples) is manageable but there is no discussion of scaling here. Are the proposed applications small like this? If not, at what point is the overhead too much? Does scale cause this to break down? I here recognize that the paper inherits the inherent inefficiency of FHE constructions.\n\nSTRENGTHS:\n* The research question is well motivated and the solution a useful tool to making private outsourced training a more realistic option. I am not well versed enough in the FHE training literature to evaluate the novelty of this specific approach, but the core idea is sound.\n* Evaluations justify the theoretical claims nicely, even where improvements are available.\n* The overall argumentation is strong, even if some details are never defined or explained as noted in the summary.\n\nWEAKNESSES:\n* The summary notes several places where definitions can be sharpened or details can be re-ordered to improve the presentation.\n* There are a handful of places where some copyediting would improve the presentation, although the high-level argument structure is in general strong.\n* The key question of how the pruning ratio is determined must be explained, since it is an input to most of the provided private training algorithms and also a key determinant of the model in which the protocol is meant to be used.\n\nQUESTIONS:\n* How does the pruning ratio get determined in practice? Is it necessary to do many private training runs and measure utility on the resultant models? How does this cost compare to the cost of non-private training?\n* Is the scale problem being swept under the rug at 237-240 an issue for larger data sets, or is the idea that this should only apply to data sets at the scale demonstrated? How does communication overhead scale as the training runs become larger?\n* Can the issue of indirect data leakage be managed somehow, or must it simply be assumed away in the security model? It's a hard problem, so solving it may well be out of scope here, but also past computation-on-encrypted-data methods have failed catastrophically due to indirect leakage problems so it's necessary to say something about it. What can or should the paper say?\n\nLIMITATIONS:\nAs noted in the summary, there are places where limitations could be more clearly expressed, for example with regard to indirect data leakage, with regard to the determination of the critical pruning ratio parameter, and also with regard to aggregated analysis and generality of the pruning/utility tradeoff.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-25"}