Volley Revolver: A Novel Matrix-Encoding Method for Privacy-Preserving Deep Learning (Inference++)

2025-12-21

AI Summary

Existing homomorphic encryption (HE)-based CNN inference methods are constrained by the limited number of plaintext slots per ciphertext, rendering them impractical for high-resolution images. To overcome this limitation, we propose a cross-ciphertext matrix encoding paradigm that breaks the conventional “one-ciphertext-per-entire-image” constraint. Our approach employs 3D structured matrix encoding and optimized ciphertext sharding to distribute image representation across multiple ciphertexts while explicitly preserving spatial structure. We further design structure-preserving batched homomorphic convolution and matrix multiplication algorithms. The method supports arbitrary input resolutions and achieves significant scalability improvements—up to several-fold speedup over state-of-the-art baselines—without compromising model accuracy. To our knowledge, this is the first work enabling efficient, scalable, end-to-end privacy-preserving CNN inference on high-resolution images, providing a critical technical pathway for deploying privacy-aware AI in real-world applications.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Large Vision Models
• Search and Optimization: Non-convex Optimization

Application Category

• Security and Privacy: Privacy-enhancing technologies
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Privacy-preserving inference of convolutional neural networks (CNNs) using homomorphic encryption has emerged as a promising approach for enabling secure machine learning in untrusted environments. In our previous work, we introduced a matrix-encoding strategy that allows convolution and matrix multiplication to be efficiently evaluated over encrypted data, enabling practical CNN inference without revealing either the input data or the model parameters. The core idea behind this strategy is to construct a three-dimensional representation within ciphertexts that preserves the intrinsic spatial structure of both input image data and model weights, rather than flattening them into conventional two-dimensional encodings. However, this approach can operate efficiently $only$ when the number of available plaintext slots within a ciphertext is sufficient to accommodate an entire input image, which becomes a critical bottleneck when processing high-resolution images. In this paper, we address this fundamental limitation by proposing an improved encoding and computation framework that removes the requirement that a single encrypted ciphertext must fully contain one input image. Our method reformulates the data layout and homomorphic operations to partition high-resolution inputs across multiple ciphertexts while preserving the algebraic structure required for efficient convolution and matrix multiplication. As a result, our approach enables privacy-preserving CNN inference to scale naturally beyond the slot-capacity constraints of prior methods, making homomorphic evaluation of CNNs practical for higher-resolution and more complex datasets.

Problem

• Enables secure CNN inference on encrypted data
• Overcomes ciphertext slot limits for high-resolution images
• Scales privacy-preserving deep learning to complex datasets

Innovation

• Partition high-resolution inputs across multiple ciphertexts
• Reformulate data layout and homomorphic operations for efficiency
• Enable scalable privacy-preserving CNN inference beyond slot constraints