# Volley Revolver: A Novel Matrix-Encoding Method for Privacy-Preserving Neural Networks (Inference)

arXiv: https://arxiv.org/abs/2201.12577 · HTML: https://mlsanity.com/paper/2201.12577/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 26 references that are in the map.
- First posted on arXiv 29 Jan 2022.

## Builds on (most cited first, 4 of 4)

- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications](https://mlsanity.com/paper/1801.03239/) (2018)
- [Low Latency Privacy Preserving Inference](https://mlsanity.com/paper/1812.10659/) (2018)
- [Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference](https://mlsanity.com/paper/1811.09953/) (2018)

## Built on by (most cited first, 5 of 5)

- [CryptoGCN: Fast and Scalable Homomorphically Encrypted Graph Convolutional Network Inference](https://mlsanity.com/paper/2209.11904/) (2022)
- [Multinomial Logistic Regression Algorithms via Quadratic Gradient](https://mlsanity.com/paper/2208.06828/) (2022)
- [Privacy-Preserving CNN Training with Transfer Learning: Multiclass Logistic Regression](https://mlsanity.com/paper/2304.03807/) (2023)
- [Privacy-Preserving 3-Layer Neural Network Training](https://mlsanity.com/paper/2308.09531/) (2023)
- [LFFR: Logistic Function For (single-output) Regression](https://mlsanity.com/paper/2407.09955/) (2024)

## Abstract (arXiv)

In this work, we present a novel matrix-encoding method that is particularly convenient for neural networks to make predictions in a privacy-preserving manner using homomorphic encryption. Based on this encoding method, we implement a convolutional neural network for handwritten image classification over encryption. For two matrices A and B to perform homomorphic multiplication, the main idea behind it, in a simple version, is to encrypt matrix A and the transpose of matrix B into two ciphertexts respectively. With additional operations, the homomorphic matrix multiplication can be calculated over encrypted matrices efficiently. For the convolution operation, we in advance span each convolution kernel to a matrix space of the same size as the input image so as to generate several ciphertexts, each of which is later used together with the ciphertext encrypting input images for calculating some of the final convolution results. We accumulate all these intermediate results and thus complete the convolution operation. In a public cloud with 40 vCPUs, our convolutional neural network implementation on the MNIST testing dataset takes ~ 287 seconds to compute ten likelihoods of 32 encrypted images of size 28 × 28 simultaneously. The data owner only needs to upload one ciphertext (~ 19.8 MB) encrypting these 32 images to the public cloud.