Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Fast Homomorphic Linear Algebra with BLAS

Youngjin Bae, Jung Hee Cheon, Guillaume Hanrot, Jai Hyun Park, Damien Stehlé

TL;DR

The paper tackles the challenge of performing linear algebra on encrypted data by developing reductions that translate encrypted MM and Mv tasks into equivalent cleartext operations that can be executed with highly optimized BLAS routines under the $CKKS$ scheme. It introduces a suite of formats (RLWE, MLWE, shared-$s$, shared-$a$, and RGSW) and key techniques (ciphertext matrix transpose, external products, and precomputation) to transform encrypted computations into a small number of plaintext matrix multiplications. The core contributions include (i) reductions from CP- MM, CP- Mv, and CC- MM to a few plaintext MM/Mv calls, (ii) a fast ciphertext transpose (C-MT) and lightweight variants that reduce key-management requirements, and (iii) a general RGSW-based framework that can, in principle, reduce any homomorphic linear algebra operation to plaintext BLAS operations. The methods are implemented in the HEaaN library, with extensive experimental results showing the practical viability of CP- MM and CC- MM reductions across large matrices, and demonstrating overheads within 4–12x of cleartext double-precision performance under 128-bit security. Overall, the work significantly narrows the gap between encrypted and plaintext linear algebra, enabling privacy-preserving inference and training tasks that leverage mature, optimized BLAS backends in real-world hardware.

Abstract

Homomorphic encryption is a cryptographic paradigm allowing to compute on encrypted data, opening a wide range of applications in privacy-preserving data manipulation, notably in AI. Many of those applications require significant linear algebra computations (matrix x vector products, and matrix x matrix products). This central role of linear algebra computations goes far beyond homomorphic algebra and applies to most areas of scientific computing. This high versatility led, over time, to the development of a set of highly optimized routines, specified in 1979 under the name BLAS (basic linear algebra subroutines). Motivated both by the applicative importance of homomorphic linear algebra and the access to highly efficient implementations of cleartext linear algebra able to draw the most out of available hardware, we explore the connections between CKKS-based homomorphic linear algebra and floating-point plaintext linear algebra. The CKKS homomorphic encryption system is the most natural choice in this setting, as it natively handles real numbers and offers a large SIMD parallelism. We provide reductions for matrix-vector products, vector-vector products for moderate-sized to large matrices to their plaintext equivalents. Combined with BLAS, we demonstrate that the efficiency loss between CKKS-based encrypted square matrix multiplication and double-precision floating-point square matrix multiplication is a mere 4-12 factor, depending on the precise situation.

Fast Homomorphic Linear Algebra with BLAS

TL;DR

The paper tackles the challenge of performing linear algebra on encrypted data by developing reductions that translate encrypted MM and Mv tasks into equivalent cleartext operations that can be executed with highly optimized BLAS routines under the scheme. It introduces a suite of formats (RLWE, MLWE, shared-, shared-, and RGSW) and key techniques (ciphertext matrix transpose, external products, and precomputation) to transform encrypted computations into a small number of plaintext matrix multiplications. The core contributions include (i) reductions from CP- MM, CP- Mv, and CC- MM to a few plaintext MM/Mv calls, (ii) a fast ciphertext transpose (C-MT) and lightweight variants that reduce key-management requirements, and (iii) a general RGSW-based framework that can, in principle, reduce any homomorphic linear algebra operation to plaintext BLAS operations. The methods are implemented in the HEaaN library, with extensive experimental results showing the practical viability of CP- MM and CC- MM reductions across large matrices, and demonstrating overheads within 4–12x of cleartext double-precision performance under 128-bit security. Overall, the work significantly narrows the gap between encrypted and plaintext linear algebra, enabling privacy-preserving inference and training tasks that leverage mature, optimized BLAS backends in real-world hardware.

Abstract

Homomorphic encryption is a cryptographic paradigm allowing to compute on encrypted data, opening a wide range of applications in privacy-preserving data manipulation, notably in AI. Many of those applications require significant linear algebra computations (matrix x vector products, and matrix x matrix products). This central role of linear algebra computations goes far beyond homomorphic algebra and applies to most areas of scientific computing. This high versatility led, over time, to the development of a set of highly optimized routines, specified in 1979 under the name BLAS (basic linear algebra subroutines). Motivated both by the applicative importance of homomorphic linear algebra and the access to highly efficient implementations of cleartext linear algebra able to draw the most out of available hardware, we explore the connections between CKKS-based homomorphic linear algebra and floating-point plaintext linear algebra. The CKKS homomorphic encryption system is the most natural choice in this setting, as it natively handles real numbers and offers a large SIMD parallelism. We provide reductions for matrix-vector products, vector-vector products for moderate-sized to large matrices to their plaintext equivalents. Combined with BLAS, we demonstrate that the efficiency loss between CKKS-based encrypted square matrix multiplication and double-precision floating-point square matrix multiplication is a mere 4-12 factor, depending on the precise situation.

Paper Structure

This paper contains 72 sections, 17 theorems, 116 equations, 1 figure, 11 tables, 9 algorithms.

Table of Contents

  1. Introduction
  2. Reductions to cleartext linear algebra
  3. Contributions
  4. The algorithms.
  5. Technical tools.
  6. Implementations.
  7. Technical overview
  8. Ciphertext matrix transpose.
  9. $\mathrm{PC- MM}\xspace$.
  10. Ciphertext-ciphertext matrix multiplication.
  11. Lightweight C-MT and $\mathrm{CC- MM}\xspace$ with small key sizes.
  12. General reduction using RGSW-format ciphertexts.
  13. Related works
  14. Preliminaries
  15. RLWE and MLWE ciphertext formats
  16. ...and 57 more sections

Key Result

lemma thmcounterlemma

Let $\mathbf{v} \in {\mathbb{R}}^{d_1}$ be a vector, with $d_1 | N$ or $N | d_1$; we can then write the {RLWE, shared-$a$RLWE, MLWE} encryption under $\mathsf{sk}$ of its CKKS-encoding as follows. There exist a matrix ${\bf S}^*\in {\mathbb{Z}}_{q}^{d_1\times N}$, a vector ${\bf a} \in {\mathbb{Z}}_ Conversely, if Equation eq:col_lwe holds with Further, when $N|d_1$, we can write the shared-$s$ e

Figures (1)

  • Figure 1: Visualization of a $\textrm{C-MT}\xspace$ application to re-formatting client-wise ciphertexts into feature-wise ciphertexts.

Theorems & Definitions (23)

  • lemma thmcounterlemma
  • lemma thmcounterlemma
  • lemma thmcounterlemma
  • lemma thmcounterlemma
  • lemma thmcounterlemma
  • proof
  • theorem thmcountertheorem
  • proof
  • theorem thmcountertheorem
  • proof
  • ...and 13 more