EI-DDLGN: Efficient Encrypted Inference with Deep Differentiable Logic Gate Networks under TFHE

Mahmoud Y. M. Yassin; Mahmoud AbdelHafeez Sayed; Mostafa Taha

cs.CRSep 12, 2026

EI-DDLGN: Efficient Encrypted Inference with Deep Differentiable Logic Gate Networks under TFHE

Authors: Mahmoud Y. M. Yassin, Mahmoud AbdelHafeez Sayed, Mostafa Taha

Organizations: Systems and Computer Engineering, Carleton University, Ottawa, ON, Canada

Abstract

Privacy-preserving inference via Torus Fully Homomorphic Encryption (TFHE) provides strong protection for sensitive data in outsourced deep learning applications. However, most TFHE-compatible neural network frameworks remain based on arithmetic neural architectures, resulting in high inference latency due to programmable bootstrapping (PBS), accumulator growth, and circuit bit-width sensitivity. In this work, we investigate Deep Differentiable Logic Gate Networks (DDLGNs) as a Boolean-native alternative for encrypted inference under TFHE. Because DDLGNs learn Boolean computations directly and discretize into fixed logic gate networks, their inference procedure is naturally aligned with TFHE's Boolean execution model and avoids arithmetic accumulation in hidden layers. We present EI-DDLGN, the first in-depth study of TFHE-based DDLGN inference, and characterize how encrypted execution cost depends on model size, learned Boolean-function distribution, and propagated wire status. We also introduce Model-Fixed-Wire PBS Bypass (MFW-PBS Bypass), a semantics-preserving execution strategy that eliminates unnecessary PBS operations without modifying the learned network topology. Evaluations across 72 depth-width configurations on MNIST, FashionMNIST, and UCI Phishing show that DDLGNs constitute an efficient alternative to arithmetic TFHE inference, achieving substantially improved accuracy-latency trade-offs. Notably, on MNIST, EI-DDLGN-Small matches the accuracy of QAT-FCNN-4 while reducing encrypted inference latency by 13.4x. Our implementation is available at https://github.com/Carleton-SCI/EI-DDLGN

Figures & tables

Model family	What the neuron represents	Main TFHE implication
QAT-FCNN	Quantized weighted neuron; the arithmetic NN is preserved after QAT	Cost depends on circuit bit-width, accumulator growth, and PBS count
BNNs	Binary weighted neuron; Boolean logic mainly approximates arithmetic/dot-product computation but still relies on accumulation operations	Still weight-based; requires deep adder trees and high bootstrapping cost.
DDLGNs	Learned two-input logic gate; the perceptron is redefined as one learned logic operation	Boolean-native network; cost follows learned functions and executed PBS count

Table 1: Comparison between QAT-FCNN [ 17 ] , BNNs [ 8 ] , and DDLGNs [ 15 ] for encrypted inference.

Figure 1: Logic gate network inference with binary activations propagated through learned Boolean gates.

Figure 2: Server-side EI-DDLGN model preparation: training, discretization, export, and TFHE Boolean backend construction.

Figure 3: Client–server EI-DDLGN inference under TFHE: the client encrypts inputs and decrypts predictions, while the server evaluates encrypted logic gates.

Gate $f(a,b)$	$f(0,x)$	$f(1,x)$	$f(x,0)$	$f(x,1)$
$a\land b$	0	$x$	0	$x$
$a\lor b$	$x$	1	$x$	1
$a\oplus b$	$x$	$\neg x$	$x$	$\neg x$
$\neg(a\oplus b)$	$\neg x$	$x$	$\neg x$	$x$
$\neg(a\land b)$	1	$\neg x$	1	$\neg x$
$\neg(a\lor b)$	$\neg x$	0	$\neg x$	0

Table 2: TFHE action selected when one input to a PBS-requiring Boolean function is model-fixed. Here,

x

denotes the remaining encrypted input, while

0

and

1

denote model-fixed outputs.

Model	Dataset	Acc. (%)	$\rho_{\mathrm{fixed}}$ (%)	$\rho_{\mathrm{PBS}}^{\mathrm{base}}$ (%)	$\rho_{\mathrm{PBS}}^{\mathrm{exec}}$ (%)	$\beta_{\mathrm{PBS}}$ (%)
EI-DDLGN (Small) $(2\times 4K)$ $\tau=3$	MNIST	91.55	4.59	65.22	61.58	5.60
	FashionMNIST	77.49	4.99	63.96	61.00	4.63
	UCI Phishing	92.40	9.85	64.45	59.30	7.99
EI-DDLGN (Medium) $(4\times 6K)$ $\tau=5$	MNIST	95.87	2.69	63.58	60.44	4.94
	FashionMNIST	81.27	2.15	61.03	58.91	3.48
	UCI Phishing	93.93	9.38	58.83	48.08	18.27

Table 3: PBS characteristics of representative EI-DDLGN models.

Figure 4: $\rho_{\mathrm{PBS}}^{\mathrm{exec}}$ across the EI-DDLGN depth–width grid under MFW-PBS Bypass. Each panel corresponds to one dataset.

Figure 5: Distribution of the PBS bypass rate $\beta_{\mathrm{PBS}}$ across the analyzed EI-DDLGN models.

Figure 6: Accuracy versus executed PBS count for the EI-DDLGN model grid.

Figure 7: Best accuracy achievable under an EI-DDLGN executed PBS budget.

Parameter	Symbol	Value
LWE dimension	$n$	$739$
Ciphertext modulus	$q$	$2^{32}$
LWE noise standard deviation	$\sigma_{\mathrm{LWE}}$	$5.862\times 10^{-6}$
Estimated security level	–	$132$ bits

Table 4: TFHE parameters used in the encrypted experiments.

Figure 8: EI-DDLGN encrypted evaluation time as a function of width, grouped by depth and dataset.

Model	Size / active conn.	Acc. (%)	Time/img (s)	Circuit bit-width
EI-DDLGN Small	2 layers, 4K width	91.55	6.58	N/A
EI-DDLGN Medium	4 layers, 6K width	95.87	19.33	N/A
EI-DDLGN Large	6 layers, 8K width	97.20	34.14	N/A
QAT-FCNN-4	56 active conn.	91.54	88.24	6-bit: 50%, 7-bit: 50%
QAT-FCNN-6	84 active conn.	92.25	126.97	6-bit: 10%, 7-bit: 90%
QAT-FCNN-8	112 active conn.	92.45	136.68	7-bit: 100%

Table 5: Compact MNIST comparison between EI-DDLGN and reproduced QAT-FCNN arithmetic TFHE baselines. Results are averaged over 10 independent seeds.

Differentiable Logic Gate Networks

See all 14 papers

Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks
Apr 18, 2026Nges Brian Njungle, Eric Jahns, Michel A. KinsyEfficient Neural Network Inference Memory-Efficient Inference
STAM Center, Ira A. Fulton Schools of Engineering · Arizona State University, Tempe, AZ 85281, USA
Fiona: Accelerating FHE Inference with Packing-Aware Ternary Weights
Sep 28, 2026Yiteng Peng, Zhibo Liu, Dongwei Xiao +1Mixed-Precision Quantization Efficient Neural Network Inference
The Hong Kong University of Science and Technology · State Key Laboratory of Novel Software Technology, Nanjing University
Layer-Parallel Inference Reduces Encrypted Nonlinear Depth in Transformers
Jul 6, 2026Ligong Han, Kai Xu, Hao Wang +3Efficient Transformer Inference Transformer Inference
MBZUAI IFM · Red Hat AI Innovation · MIT-IBM Watson AI Lab +3

Apr 18, 2026J/K move · Enter open · S save

Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks

Nges Brian Njungle, Eric Jahns, Michel A. Kinsy

STAM Center, Ira A. Fulton Schools of Engineering · Arizona State University, Tempe, AZ 85281, USA

Efficient Neural Network Inference Memory-Efficient Inference Homomorphic Encryption Privacy-Preserving ML

Open paper AskPDF arXiv

Privacy-preserving machine learning (PPML) has become increasingly important in applications where sensitive data must remain confidential. Homomorphic Encryption (HE) enables computation directly on encrypted data, allowing neural network inference without revealing raw inputs. While prior works have largely focused on inference over a single encrypted image, batch processing of encrypted inputs lags behind, despite being critical for high-throughput inference scenarios and training-oriented workloads. In this work, we address this gap by developing optimized algorithms for batched HE-friendly neural networks. We also introduced a pipeline architecture designed to maximize resource efficiency for different batch size execution. We implemented these algorithms and evaluated our work using HE-friendly ResNet-20 and ResNet-34 models on encrypted CIFAR-10 and CIFAR-100 datasets, respectively. For ResNet-20, our approach achieves an amortized inference time of 8.86 seconds per image when processing a batch of 512 encrypted images, with a peak memory usage of 98.96 GB. These results represent a 1.78x runtime improvement and a 3.74x reduction in memory usage compared to the state-of-the-art design. For the deeper ResNet-34 model, we achieve an amortized inference time of 28.14 on a batch of 256 encrypted images using 246.78GB of RAM

Abstract

Differentiable Logic Gate Networks

Explore similar work

Towards Deep Encrypted Training: Low-Latency, Memory-Efficient, and High-Throughput Inference for Privacy-Preserving Neural Networks

Fiona: Accelerating FHE Inference with Packing-Aware Ternary Weights

Layer-Parallel Inference Reduces Encrypted Nonlinear Depth in Transformers