# Encrypted Neural Networks without Overflows

arXiv: https://arxiv.org/abs/2605.23096 · HTML: https://mlsanity.com/paper/2605.23096/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 93 references that are in the map.
- First posted on arXiv 21 May 2026.

## Builds on (most cited first, 17 of 17)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation](https://mlsanity.com/paper/1308.3432/) (2013)
- [Do CIFAR-10 Classifiers Generalize to CIFAR-10?](https://mlsanity.com/paper/1806.00451/) (2018)
- [Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers](https://mlsanity.com/paper/2011.13824/) (2020)
- [Privacy-Preserving Machine Learning with Fully Homomorphic Encryption for Deep Neural Network](https://mlsanity.com/paper/2106.07229/) (2021)
- [Neural Network Verification with Branch-and-Bound for General Nonlinearities](https://mlsanity.com/paper/2405.21063/) (2024)
- [ReluDiff: Differential Verification of Deep Neural Networks](https://mlsanity.com/paper/2001.03662/) (2020)
- [Precise Approximation of Convolutional Neural Networks for Homomorphically Encrypted Data](https://mlsanity.com/paper/2105.10879/) (2021)
- [The 6th International Verification of Neural Networks Competition (VNN-COMP 2025): Summary and Results](https://mlsanity.com/paper/2512.19007/) (2025)
- [NeuroDiff: Scalable Differential Verification of Neural Networks using Fine-Grained Approximation](https://mlsanity.com/paper/2009.09943/) (2020)
- [EVA: An Encrypted Vector Arithmetic Language and Compiler for Efficient Homomorphic Computation](https://mlsanity.com/paper/1912.11951/) (2019)
- [Orion: A Fully Homomorphic Encryption Framework for Deep Learning](https://mlsanity.com/paper/2311.03470/) (2023)
- [NeuJeans: Private Neural Network Inference with Joint Optimization of Convolution and FHE Bootstrapping](https://mlsanity.com/paper/2312.04356/) (2023)
- [TT-TFHE: a Torus Fully Homomorphic Encryption-Friendly Neural Network Architecture](https://mlsanity.com/paper/2302.01584/) (2023)
- [Revisiting Differential Verification: Equivalence Verification with Confidence](https://mlsanity.com/paper/2410.20207/) (2024)
- [Household Electricity Demand Forecasting -- Benchmarking State-of-the-Art Methods](https://mlsanity.com/paper/1404.0200/) (2014)
- [Activate Me!: Designing Efficient Activation Functions for Privacy-Preserving Machine Learning with Fully Homomorphic Encryption](https://mlsanity.com/paper/2508.11575/) (2025)

## Abstract (arXiv)

The popular Cheon-Kim-Kim-Song (CKKS) scheme enables efficient private inference in neural networks by evaluating them on encrypted data. Since CKKS only supports addition, multiplication, and array rotation operations, turning neural networks into CKKS circuits requires approximating all activation functions (e.g. ReLU) with polynomials over fixed input ranges. Traditionally, these ranges are estimated via heuristic sampling techniques. In this paper, we empirically demonstrate that sampled ranges leave the CKKS network exposed to overflow events, i.e. legitimate inputs that exceed the ranges of the circuit and cause corrupted outputs, and propose an improved design technique that completely avoids them. First, we propose a practical algorithm to induce overflow events in a CKKS circuit, i.e. we automatically craft legitimate inputs that exceed the design ranges within the circuit and cause corrupted outputs. As an example, our algorithm can quickly corrupt around 47% of benign inputs in a CIFAR10 neural network. Second, we propose an end-to-end formal verification approach that constructs executable CKKS circuits. These circuits are guaranteed to be overflow-free and come with certified error bounds on the output difference w.r.t. the original neural network. Our experiments demonstrate that our approach supports a larger set of neural network architectures than prior certified techniques, while also delivering executable CKKS artifacts.