CraterLake

Abstract

Fully Homomorphic Encryption (FHE) enables offloading computation to untrusted servers with cryptographic privacy. Despite its attractive security, FHE is not yet widely adopted due to its prohibitive overheads, about 10,000× over unencrypted computation. Recent FHE accelerators have made strides to bridge this performance gap. Unfortunately, prior accelerators only work well for simple programs, but become inefficient for complex programs, which bring additional costs and challenges.We present CraterLake, the first FHE accelerator that enables FHE programs of unbounded size (i.e., unbounded multiplicative depth). Such computations require very large ciphertexts (tens of MBs each) and different algorithms that prior work does not support well. To tackle this challenge, CraterLake introduces a new hardware architecture that efficiently scales to very large ciphertexts, novel functional units to accelerate key kernels, and new algorithms and compiler techniques to reduce data movement.We evaluate CraterLake on deep FHE programs, including deep neural networks like ResNet and LSTMs, where prior work takes minutes to hours per inference on a CPU. CraterLake outperforms a CPU by gmean 4,600× and the best prior FHE accelerator by 11.2× under similar area and power budgets. These speeds enable realtime performance on unbounded FHE programs for the first time. CCS CONCEPTS• Computer systems organization → Parallel architectures; • Security and privacy → Cryptography.

PAF-FHE: Low-Cost Accurate Non-Polynomial Operator Polynomial Approximation in Fully Homomorphic Encryption Based ML Inference

“…However, both MPC and GC are non-realistic because of the large-size packets in need of transferring among data sources and compute nodes. Alternatively, F1 [24], CraterLake [25], and BTS [10] propose replacing all non-polynomial kernels with a single low-degree polynomial approximation and processing it in the FHE domain. However, the latency gets bottlenecked by the replaced polynomial approximation for a long multiplication chain.…”

Towards Fast and Scalable Private Inference

“…HE introduces a large computational overhead of 4-6 orders of magnitude slowdown over their plaintext counterparts (1080 seconds for a single ResNet-18 inference [10,38]). Rather than directly using HE for computing linear layers, it is common to combine HE with Additive Secret Sharing (SS), another cryptographic building block that supports plaintext-level speeds for computing linear layers.…”

“…PI: Prior work has explored using HE only, which is convenient as privacy primitives are not changed [14,38]. However, these protocols cannot leverage LPHE and introduce accuracy loss via the approximation of ReLU, even with complex training [11].…”

“…Non-hybrid approaches have been proposed. However, they often sacrifice accuracy due to approximating activation functions with polynomials and are not considered here [11,14,38].…”

“…Recent studies have focused on enhancing hybrid protocols through improved neural architecture design [5,6,13,20], protocol optimization [6,21,27,29], and hardware acceleration [18,22,23,36,38]. State-of-the-art PI protocols break the entire PI process into two phases, a pre-processing (or offline) phase and an online phase, to move expensive computations offline and improve online inference latency.…”