Efficient Encrypted Computation in Convolutional Spiking Neural Networks with TFHE

Longfei Guo; Pengbo Li; Ting Gao; Yonghai Zhong; Haojie Fan; Jinqiao Duan

cs.CRMar 25, 2026

Efficient Encrypted Computation in Convolutional Spiking Neural Networks with TFHE

Authors: Longfei Guo, Pengbo Li, Ting Gao, Yonghai Zhong, Haojie Fan, Jinqiao Duan

Organizations: School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China · Center for Mathematical Science, Huazhong University of Science and Technology, Wuhan, China · School of Mathematics and Statistics, Huazhong University of Science and Technology, Wuhan, China · Steklov-Wuhan Institute for Mathematical Exploration, Huazhong University of Science and Technology, China ·

Abstract

With the rapid advancement of AI technology, we have seen more and more concerns on data privacy, leading to some cutting-edge research on machine learning with encrypted computation. Fully Homomorphic Encryption (FHE) is a crucial technology for privacy-preserving computation, while it struggles with continuous non-polynomial functions, as it operates on discrete integers and supports only addition and multiplication. Spiking Neural Networks (SNNs), which use discrete spike signals, naturally complement FHE's characteristics. In this paper, we introduce FHE-DiCSNN, a framework built on the TFHE scheme, utilizing the discrete nature of SNNs for secure and efficient computations. By leveraging bootstrapping techniques, we successfully implement Leaky Integrate-and-Fire (LIF) neuron models on ciphertexts, allowing SNNs of arbitrary depth. Our framework is adaptable to other spiking neuron models, offering a novel approach to homomorphic evaluation of SNNs. Additionally, we integrate convolutional methods inspired by CNNs to enhance accuracy and reduce the simulation time associated with random encoding. Parallel computation techniques further accelerate bootstrapping operations. Experimental results on the MNIST and FashionMNIST datasets validate the effectiveness of FHE-DiCSNN, with a loss of less than 3% compared to plaintext, respectively, and computation times of under 1 second per prediction. We also apply the model into real medical image classification problems and analyze the parameter optimization and selection.

Figures & tables

Figure 1: Schematic visualisation of the CSNN network. For the network, we use a convolutional layer with kernal_size = 3, stridge = 1,padding=1, and an average pooling layer with kernal_size = 2, stridge = 2, padding=0.

	$\tau=2.0$	$\tau=3.0$	$\tau=4.0$	$\tau=\infty$ (IF)
$\theta=20$	97.48	97.60	97.10	97.06
$\theta=30$	97.66	97.50	97.60	97.23
$\theta=40$	97.60	97.87	98.00	97.32
$\theta=50$	97.69	97.90	97.30	97.15
$\theta=60$	97.72	97.70	98.00	97.25
$\theta=100$	97.68	97.55	96.90	96.38

Table 1: Different

\theta

and

\tau

parameters on the MNIST dataset (%)

	$\tau=2.0$	$\tau=3.0$	$\tau=4.0$	$\tau=\infty$ (IF)
$\theta=20$	86.38	85.24	86.47	82.38
$\theta=30$	86.65	86.37	86.97	83.20
$\theta=40$	87.20	86.85	85.82	83.38
$\theta=50$	87.04	86.64	79.52	83.27
$\theta=60$	87.29	81.69	77.21	82.67
$\theta=100$	83.11	74.72	74.45	81.76

Table 2: Different

\theta

and

\tau

parameters on the FashionMNIST dataset (%)

	$\tau=2.0$	$\tau=3.0$	$\tau=4.0$
$\theta=20$	81.46	87.95	83.75
$\theta=30$	80.42	87.87	86.50
$\theta=40$	80.78	87.19	86.04
$\theta=50$	80.01	87.41	85.97
$\theta=60$	81.79	87.53	85.66
$\theta=100$	81.62	84.75	83.60

Table 3: Different

\theta

and

\tau

parameters on the Tumor dataset (%)

	Poisson-encoded SNN [ 18 ]	CSNN
bootstrapping	$(784\times 2+2\times 160+2\times 10)\times T_{1}$	$(7840\times 2+2\times 160+2\times 10)\times T_{2}$
Spiking Activation Layer	$5\times T_{1}$	$6\times T_{2}$

Table 4:

T_{1}

and

T_{2}

represent the simulation time required for Poisson-encoded SNN and CSNN, respectively, to achieve their respective peak accuracy performances. Typically,

T_{1}

falls within the range of [20-100], while

T_{2}

falls within the range of [2-4].

	Multi-threading	Without multi-threading
DiSNN [ 18 ]	2.62s	8.32s
Ours	0.34s	8.29s

Table 5: Comparison of the run times of the two models

$V_{th}+\max_{t}(\|I[t]\|)$	Spiking Layer1	Spiking Layer2	Spiking Layer3
$\tau=2$	29.60	70.00	24.90
$\tau=3$	36.00	86.00	32.10
$\tau=4$	85.2	175.00	51.70
$\tau=\infty$ (IF)	29.80	31.10	20.60

Table 6: Spiking Activation Layer Results for Different Thresholds

\tau

	$\tau=2$	$\tau=3$	$\tau=4$	$\tau=\infty$ (IF)
$\max\sum_{j}\|\omega_{j}\|$	17.42	18.87	10.24	11.89

Table 7: Based on the noise estimation mentioned above, the quantity

\max\sum_{j}\left|\omega_{j}\right|

can be employed to estimate the growth of noise in DiCSNNs for various

\theta

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

FEnc $^2$ : Unifying Data Packing for Efficient Private Inference via Convolution and Architecture-Aware Fragment Encoding
Jun 15, 2026Ran Ran, Zhaoting Gong, Nuo Xu +3Efficient Neural Network Inference Homomorphic Encryption
North Carolina State University · University of Minnesota · University of California, Santa Cruz +1
GPU Acceleration of Sparse Fully Homomorphic Encrypted DNNs
Apr 13, 2026Lara D'Agata, Carlos Agulló-Domingo, Óscar Vera-López +7Sparse Matrix Multiplication Homomorphic Encryption
University of Glasgow, UK · University of Murcia, Spain · AMD +1
Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks
Apr 18, 2026Nges Brian Njungle, Eric Jahns, Michel A. KinsyEfficient Neural Network Inference Memory-Efficient Inference
STAM Center, Ira A. Fulton Schools of Engineering · Arizona State University, Tempe, AZ 85281, USA

Jun 15, 2026J/K move · Enter open · S save

FEnc $^2$ : Unifying Data Packing for Efficient Private Inference via Convolution and Architecture-Aware Fragment Encoding

Ran Ran, Zhaoting Gong, Nuo Xu, Yuanchao Xu+2

North Carolina State University · University of Minnesota · University of California, Santa Cruz+1

Efficient Neural Network Inference Homomorphic Encryption Privacy-Preserving ML

Open paper AskPDF arXiv

Fully Homomorphic Encryption (FHE) enables privacy-preserving machine learning but incurs extreme computational and memory overhead. These costs come not only from expensive low-level primitives, including Number Theoretic Transform (NTT), rotation, and key-switching, but also from inefficient ciphertext packing at the application level. Existing packing strategies typically preserve either neighboring data elements or feature grouping, but not both, leading to wasted ciphertext slots, excessive rotations, and inflated ciphertext counts. We propose FEnc2, a unified and principled fragment-based encoding framework for CKKS-based private convolutional neural network inference. FEnc2 optimizes slot utilization, rotation complexity, and ciphertext density through two components: 1)Conv-aware Encoding, which analytically selects an optimal fragment size to decouple spatial dependencies and jointly minimize inner-outer rotations across layers, and 2)Arch-aware Ct Compression, which restores ciphertext density after feature- or channel-reduction layers. Together, these transformations reshape encrypted workload structure and reduce homomorphic operations by one to two orders of magnitude. With full memory capacity utilized, i.e., at maximum batch size, FEnc2 achieves end-to-end latency speedups over the state-of-the-art Orion of up to 228.83x on GPU and 226.06x on CPU for LeNet on MNIST, and up to 4.55x on GPU and 9.43x on CPU for MobileNet on ImageNet. FEnc2 is hardware-agnostic yet architecturally transformative: by optimizing encrypted tensor layout before execution, it reduces ciphertext count and workload pressure on hardware, complementing primitive-level optimizations such as NTT and keyswitch accelerators. These results show that application-level data layout is a first-order architectural design dimension for encrypted inference and an important enabler for next-generation FHE systems.

Abstract

Privacy-Preserving ML

Explore similar work

FEnc2^22: Unifying Data Packing for Efficient Private Inference via Convolution and Architecture-Aware Fragment Encoding

GPU Acceleration of Sparse Fully Homomorphic Encrypted DNNs

Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks

FEnc $^2$ : Unifying Data Packing for Efficient Private Inference via Convolution and Architecture-Aware Fragment Encoding