PRICE: Privacy-Preserving Image Classification in Mobile Edge-Cloud Computing with Homomorphic Encryption

1

PRICE: Privacy-Preserving Image Classification in Mobile Edge-Cloud Computing with Homomorphic Encryption

arXiv:2610.25286v1 [cs.CR] 18 Oct 2026

Duc-Huy Nguyen, Bui Duc Manh, Chi-Hieu Nguyen, Dinh Thai Hoang Diep N. Nguyen, Van-Dinh Nguyen, and Quoc-Viet Pham

Abstract—Cloud-assisted image classification enables many mobile AI applications, but transmitting raw images to the cloud raises significant privacy concerns. Homomorphic encryption (HE) allows computation over encrypted data; however, existing end-to-end HE-based inference pipelines incur prohibitive latency and computational overhead, limiting their feasibility for latencysensitive mobile systems. This paper addresses how to enable efficient encrypted image classification in mobile edge-cloud environments without sacrificing accuracy. We propose PRICE, a three-tier edge-cloud architecture that partitions deep neural network inference between a trusted edge and an untrusted cloud. The edge performs lightweight feature extraction in plaintext, while only compact embeddings are encrypted using the CheonKim-Kim-Song (CKKS) scheme and offloaded to the cloud for encrypted final-layer inference. This design avoids homomorphic evaluation of deep backbone layers, significantly reducing computation depth, ciphertext size, and end-to-end latency. To further improve efficiency, we develop RowHyDiag, a rowpacked hybrid diagonal encoding with hoisted-rotation-aware encrypted matrix-vector computation, which minimizes rotation operations and improves slot utilization. Extensive experiments on real devices across five datasets demonstrate that, under the evaluated 128-bit-security configurations, RowHyDiag achieves up to 31.8× faster cloud inference, 85.3× fewer rotations, and 83.0× lower setup payload than the conventional Halevi-Shoup diagonal method. RowHyDiag also outperforms the PEGASUS linear-transformation baseline, providing 1.1-4.5× faster cloud inference and 1.2-3.4× lower setup payload. The results show that PRICE enables deployment-ready, low-latency encrypted inference for mobile edge-cloud systems under a trusted-edge threat model. Index Terms—Encrypted inference, homomorphic encryption, mobile edge-cloud computing, privacy-preserving image classification, low-latency edge-cloud deployment.

I. I NTRODUCTION A. Motivation The rapid advancement of cloud computing has transformed image classification from a primarily on-device task into an on-demand, large-scale service [2], [3]. As deep learning (DL) Duc-Huy Nguyen, Bui Duc Manh, Chi-Hieu Nguyen, Dinh Thai Hoang, and Diep N. Nguyen are with the School of Electrical and Data Engineering, University of Technology Sydney, Sydney, NSW 2007, Australia (e-mail: duc.h.nguyen-3@student.uts.edu.au; duc.m.bui-1@student.uts.edu.au; hieu.c.nguyen@student.uts.edu.au; hoang.dinh@uts.edu.au; diep.nguyen@uts.edu.au). Van-Dinh Nguyen and Quoc-Viet Pham are with the School of Computer Science and Statistics, Trinity College Dublin, Dublin 2, D02PN40, Ireland (e-mail: dinh.nguyen@tcd.ie; viet.pham@tcd.ie). Some results of this work were presented at the ACM MobiCom Conference (Demo Paper), 2025 [1].

models, such as ResNet and EfficientNet, continue to improve visual-recognition accuracy [4], [5], cloud platforms have emerged as a widely adopted solution for executing neural network inference for visual recognition. By providing scalable resources and consistent performance, cloud-based inference enables heterogeneous mobile devices to access powerful models without local execution constraints [6], [7]. This offloading trend is particularly important for resource-constrained devices (i.e., smartphones and tablets), where running modern DL classifiers locally can be computationally expensive, resourceintensive, and latency-sensitive [8], [9]. Consequently, cloudassisted image classification has become widely adopted, enabling mobile users to perform interactive visual recognition by leveraging remote computing resources [2], [10]. Despite these advantages, cloud-based inference introduces a fundamental privacy challenge: users must transmit visual data to external servers that are often modeled as honestbut-curious [11], creating the risk of exposing sensitive content, such as personal identity, location, and behavioral patterns [12]–[14]. To address this issue, secure multi-party computation (SMPC) has emerged as a representative approach for privacy-preserving DL inference [15]. In this setting, a private input is split into random shares and distributed to multiple parties, ensuring that each party sees only an unintelligible share while jointly evaluating inference through interactive protocols [16], [17]. Foundational studies in this domain include Gazelle, a two-party secure inference framework that combines homomorphic encryption with garbled circuits to achieve 20-30× faster inference than earlier approaches [16], and SecureNN, a three-party protocol that enables efficient convolutional neural network (CNN) training and inference with security guarantees against both semi-honest and malicious adversaries [17]. These studies demonstrate the feasibility of CNN inference under representative SMPC settings with different participant roles and adversary models [16], [17]. However, a key limitation of SMPC is the massive communication overhead required for encrypted computation, which affects both non-linear operations (e.g., ReLU approximation via comparison protocols) and linear operations (e.g., matrixvector multiplication via share-wise computation and reconstruction) [15]. Specifically, each layer evaluation requires multiple rounds of interaction between parties to exchange intermediate shares, verify correctness, and reconstruct partial results [15]–[17]. As model depth and width increase, the cumulative communication volume grows substantially, creating

2

significant deployment challenges in bandwidth-constrained mobile-cloud settings. Furthermore, SMPC approaches typically assume different system models depending on party roles: two-party protocols may assume computation between client and server [16], while three-party protocols often assume computation across multiple non-colluding servers [17]. These requirements introduce additional challenges, including trust distribution, network coordination, and synchronization overhead, which are difficult to satisfy in real-world deployments with heterogeneous devices and dynamic network conditions. To address the above challenges, fully homomorphic encryption (FHE) has emerged as a strong alternative that eliminates multi-party coordination by enabling the server to compute directly on ciphertexts without accessing plaintext inputs [18], [19]. Recent studies in FHE-based secure DL inference have focused on making encrypted image classification more efficient by optimizing FHE-encrypted linear and encrypted non-linear functions in neural networks (i.e., reducing the costly homomorphic operations such as ciphertext rotation and key switching) [15], especially for CNN-based image classification models. However, despite these improvements, existing end-to-end FHE-based inference pipelines remain computationally intensive and memory-demanding, especially for deep models [15]. The need to evaluate all layers of a neural network in the encrypted domain results in high latency, large ciphertext sizes, and significant computational overhead. These limitations make current FHE-based approaches difficult to deploy in low-latency mobile-cloud environments. B. Related Works Representative HE/FHE systems for image classification have primarily focused on improving efficiency through packing strategies and operator-level scheduling. CryptoNets [20] was among the first to demonstrate that neural network inference can be performed entirely on encrypted inputs. Using a leveled HE scheme with batched slot packing, CryptoNets evaluated a simple CNN on MNIST and achieved 99% accuracy with a throughput of approximately 59,000 predictions per hour. Although the model was shallow and the per-image latency was high (around 250 s on a single CPU core), it established the foundational paradigm of encoding neural network weights as plaintexts and evaluating layers through ciphertextplaintext operations (e.g., multiplications and additions). To reduce the computational overhead of deep encrypted CNNs, the authors in [21] proposed multiplexed parallel convolutions under the CKKS scheme. The proposed approach packed multiple channel outputs compactly into a single ciphertext to minimize the number of costly homomorphic operations (i.e., ciphertext rotation and bootstrapping). In addition, the authors integrated an imaginary-removing bootstrapping variant to prevent error divergence in approximated ReLU evaluation. On CIFAR-10 with ResNet-20, the study reported 2,271 s latency for one encrypted image using a single CPU thread and 79 s amortized runtime per image when classifying 50 images with 50 threads, corresponding to 4.67 × lower inference latency and 134 × less amortized runtime than the prior CKKS-based ResNet-20 implementation. Despite these

improvements, the reported latency remains far above lowlatency mobile-cloud requirements, and the framework still requires evaluating the full CNN depth under encryption. At a larger model scale, NeuJeans [22] targeted the high cost of encrypted CNN inference by introducing Coefficientsin-Slot (CinS) encoding, which enables multiple convolutions within a single HE multiplication and reduces expensive slot permutations. The authors further showed that CinS aligns with the initial stages of the discrete Fourier transform (DFT), which is also used in CKKS bootstrapping [23], thereby avoiding redundant CinS/slot conversion overhead in Conv2D execution flows. With these co-designed optimizations, NeuJeans reported up to 5.68 × speedup for Conv2D-activation sequences and demonstrated ImageNet-scale encrypted CNN inference in a few seconds [22]. It also reported top-1/top5 encrypted accuracies on 3,000 validation images (e.g., 74.1%/90.5% for ResNet-50). However, the reported end-toend server inference delays are in the second-level range, i.e., 14.11 s (ResNet-18 poly approximation), 56.08 s (ResNet-50), and 40.76 s (MobileNetV2), which remains too high for lowlatency mobile-cloud applications. [22]. Another recent direction focuses on channel-wise ciphertext organization for encrypted CNN inference. In this line, [24] proposed channel-by-channel packing and channel-by-channel convolution for CIFAR-10 classification with ResNet-20 and ResNet-110, and reported approximately 5.04 × and 5.20 × speedups with negligible accuracy deviation from plaintext. These gains are meaningful, but the deployment overhead remains high because the approach still executes a full deep CNN pipeline in the encrypted domain. In end-to-end HEbased inference, each convolutional layer requires numerous ciphertext rotations and key-switching operations to align packed slots and aggregate intermediate results across channels and spatial dimensions. As model depth increases, the number of required rotation indices also grows, forcing the server to preload a large set of evaluation keys, particularly rotation keys, which substantially increases memory and storage overhead. Despite the packing optimizations, the study still reported an amortized runtime of 15.76 s per image (batch size 512), around 370 GB RAM usage, and 6.91 GB of rotation-key storage. While effective in principle, existing end-to-end HE-based DL approaches suffer from high latency and heavy computational and memory overhead. Compared with these approaches, split neural networks offer a promising way to reduce inference latency by executing different parts of a model at different entities. Specifically, Vepakomma et al. [25] introduced SplitNN, in which a neural network is partitioned between participating entities so that raw data need not be directly shared. However, conventional SplitNN relies on data and model partitioning rather than cryptographic protection, i.e., intermediate representations are transmitted in plaintext, may retain sensitive input information, and can be exploited to reconstruct the original input [26], [27]. Alternative privacyenhanced split-computing approaches protect these representations through different mechanisms. Pham et al. [28] integrated differential privacy into split learning by perturbing intermediate representations at the cut layer and investigated

3

the resulting privacy-accuracy and communication trade-offs on image-classification tasks. This approach provides a statistical privacy guarantee without cryptographic computation. However, stronger perturbation can reduce predictive utility. Moreover, its primary focus is collaborative training rather than low-latency online inference. Khan et al. [29] combined U-shaped split learning with function secret sharing, additive secret sharing, and Beaver triples to protect intermediate computations and labels. This design provides cryptographic confidentiality without perturbing the data. However, it primarily targets secure training and requires interactive computation between two non-colluding servers. These requirements complicate deployment in a latency-sensitive setting with a single cloud provider. HE-enhanced split inference avoids plaintext-representation leakage and noise-induced utility loss, but introduces different system costs. For example, Pereteanu et al. [30] partitioned a network into encrypted server-side front and back segments surrounding a larger plaintext middle segment executed by the client. This design substantially reduces encrypted computation compared with pure HE inference and protects the server-held model segments. However, each request must traverse the client-server boundary multiple times for decryption, plaintext middle-model evaluation, re-encryption, and further encrypted evaluation. Consequently, the design retains multi-second inference latency and increases the number of online communication rounds. Another example is the AI-asa-Service architecture proposed by Lam et al. [31]. In this architecture, the user runs a public pretrained feature extractor locally, encrypts the resulting feature vector, and sends it to a cloud-hosted private network. The private network typically contains one or two fully connected layers evaluated under fully homomorphic encryption. The design encrypts each input feature separately and uses a look-up-table mechanism for nonlinear operations. To support these operations, the client must generate additional ciphertexts, evaluation keys, and keyswitching material. These requirements increase client-side encryption, setup, and communication overhead. The cloud-side computation also increases as the feature dimension or private network grows. Collectively, these costs limit the deployability of existing privacy-preserving inference approaches in lowlatency mobile-cloud environments and motivate the need for a more efficient system design. C. Proposed Approach and Main Contributions To overcome the above limitations in latency-sensitive mobile-cloud deployment, we propose PRICE, a PRivacypreserving Image Classification framework for mobile Edgecloud computing. The design partitions inference across client, trusted edge, and untrusted cloud to minimize encrypted computation while preserving confidentiality. In online operation, the trusted edge performs deep feature extraction in plaintext, encrypts the resulting embedding with CKKS, and sends only ciphertext features to the cloud. The cloud executes ciphertextonly final-layer classification and returns encrypted classification results for decryption at the edge. By avoiding end-toend encrypted deep-network execution at the cloud, this design

reduces computational complexity, evaluation-key burden, and end-to-end latency. Unlike conventional SplitNN [25], our framework does not transmit plaintext intermediate representations between the edge and cloud. It also avoids the intermediate decryption, plaintext evaluation, and re-encryption steps required by Split HE [30]. Therefore, our approach uses only one online edge-cloud request-response exchange. Our proposed framework has an architecture similar to that of Lam et al. [31]: both designs extract features before sending encrypted features to the cloud. However, their cloud-side computations are different. Our framework restricts cloud computation to encrypted final linear-layer evaluation. This restricted design enables RowHyDiag to optimize the encrypted matrix-vector computation. In contrast, Lam et al. support a more general private network that may include nonlinear layers evaluated using encrypted look-up tables. Under our intended managed multi-client deployment, the edge node operates within an organizational boundary, such as an enterprise or hospital gateway or a carrier-operated multi-access edge computing site. The edge is under local administrative control, whereas the third-party cloud remains outside the data owner’s trust domain. Although modern mobile devices may have sufficient computational capability for local feature extraction, the edge in PRICE serves a broader role as a shared trust and service boundary rather than merely as a computational accelerator. It handles CKKS encryption and decryption, keeps the feature extractor and HE context persistently available, and amortizes model loading and cryptographic setup across multiple clients. This design avoids distributing secret keys and model copies to individual client devices. It also provides stable resources as the model size and number of concurrent requests grow. Accordingly, the cloud is untrusted and cannot access raw data, plaintext embeddings, or the secret key. Compared with fully encrypted neural-network inference, PRICE performs the computationally intensive feature extraction at the trusted edge and leaves only encrypted final linear-layer evaluation to the cloud. To further improve cloud efficiency, we introduce RowHyDiag, a row-packed hybrid diagonal encoding with hoisted-rotationaware encrypted linear-layer evaluation, which increases slot utilization and reduces redundant homomorphic operations. Unlike NeuJeans [22], which improves end-to-end encrypted neural-network inference by co-optimizing convolution and FHE bootstrapping through the CinS encoding, our proposed approach RowHyDiag targets efficient encrypted evaluation of the final linear classifier executed by the cloud after the trusted edge has completed plaintext feature extraction. Its algorithmic novelty lies in jointly designing the rowpacked ciphertext layout, diagonal encoding, hoisted rotation schedule, and structured reduction so that multiple output rows are evaluated concurrently within the same CKKS slot space. This joint design reduces the number of ciphertext rotations by up to 85.3× across the evaluated 128-bit-security configurations. Together, the trusted-edge partitioning and RowHyDiag reduce the encrypted workload to a shallow finallayer computation, lowering ciphertext rotations, evaluationkey usage, cloud setup overhead, and end-to-end inference latency while maintaining predictive accuracy across multiple

4

image-classification workloads. Specifically, the main contributions of this work include: • We propose a three-tier edge-cloud architecture that separates plaintext feature extraction and encrypted classification. By executing deep feature extraction at a trusted edge and restricting homomorphic computation to the final classifier at the untrusted cloud, our design avoids evaluating multiple neural-network layers under encryption and substantially reduces encrypted computational complexity and end-to-end inference delay under an explicitly stated trusted-edge threat model. • We develop RowHyDiag for efficient encrypted linearlayer computation in image classification. Across the evaluated 128-bit-security configurations, RowHyDiag achieves 12.2-31.8× faster cloud inference, 32.0-85.3× fewer rotations, and 31.6-83.0× lower one-time cryptographic setup payload than the conventional HaleviShoup diagonal method. It also outperforms the PEGASUS linear-transformation baseline, providing 1.1-4.5× faster cloud inference and 1.2-3.4× lower setup payload. These improvements are validated through theoretical analysis and empirical evaluation. • We conduct extensive simulations and real-device experiments on benchmark datasets (MNIST, CIFAR-10, CIFAR-100, ImageNet-1K, and Australian Landmarks). Results show strong predictive fidelity and deploymentready performance: encrypted accuracy consistently matches plaintext accuracy across all five datasets under different HE parameter configurations, while the maximum relative logit error remains between 9.67 × 10−9 and 3.22 × 10−4 across all evaluated settings. • We additionally build a new application-oriented Australian Landmarks dataset to better evaluate the performance of the proposed approach on real image classification tasks. To the best of our knowledge, this is the first curated Australian-focused landmark dataset used in prior privacy-preserving inference studies, providing an essential real-image benchmark for evaluating system performance under realistic deployment conditions. The remainder of this paper is organized as follows. Section II describes the proposed three-tier framework with main components. Section III details the privacy-preserving image classification technique and Section IV presents the datasets, evaluation metrics, experimental configuration, and baseline methods for evaluation. Section V reports simulation and lowlatency edge-cloud results and Section VI concludes the paper.

which performs preprocessing and deep feature extraction in plaintext, then encrypts the resulting embeddings using the CKKS scheme [32]. The untrusted cloud only executes encrypted inference over ciphertexts, and encrypted outputs are returned to the edge, where the returned ciphertext is decrypted, and the final classification result is then sent back to the user. This three-tier architecture preserves data confidentiality while enabling scalable cloud-assisted computation. Before online inference, the system executes a one-time key setup phase. The trusted edge server generates CKKS keys, including a public key pk for encryption, a secret key sk for decryption, and evaluation keys (e.g., rotation keys rotk) for homomorphic operations. The public and evaluation keys (pk, rotk) are provisioned to the cloud server, while the secret key sk remains exclusively at the edge.

II. T HE P ROPOSED F RAMEWORK

C. Untrusted Cloud Server The untrusted cloud server stores and executes only the encrypted final-layer classifier, together with CKKS public/evaluation keys. It performs encrypted linear-layer inference (matrix-vector multiplication with bias addition) over received encrypted embeddings, then returns encrypted classscore ciphertexts to the edge. Since the cloud never has access to the secret key or plaintext data, it can scale inference while preserving data confidentiality. The process is further detailed in Section III-C.

Fig. 1 presents the proposed three-tier architecture for privacy-preserving image classification. The system comprises: (i) resource-constrained client devices (e.g., smartphones and tablets), (ii) trusted edge servers deployed within an organizational boundary, and (iii) third-party cloud servers treated as untrusted. The core design principle is to ensure that raw user images never leave the trusted environment, while delegating only encrypted computation to the cloud. In this workflow, client devices transmit images to the trusted edge,

A. Client Device In the intended managed multi-client deployment, the client is responsible for data acquisition and transmits the selected image to a nearby trusted edge through a secure HTTPS channel [33]. B. Trusted Edge Node The trusted edge node handles two main processes: (i) feature extraction and encryption before cloud offloading, and (ii) decryption and final prediction after cloud inference. During deployment, the full model is first fine-tuned offline, then partitioned such that the feature extractor is retained at the edge while the final linear classifier is deployed to the cloud. 1) Extract and Encrypt Features: Upon receiving an image from the client, the edge performs preprocessing and runs the deployed feature extractor to obtain a fixed-dimensional embedding. The edge device then applies ℓ2 normalization to stabilize encrypted computation [34] and encrypts the normalized feature vector using CKKS. Only ciphertext embeddings are transmitted to the cloud, ensuring that raw images and plaintext features never leave the trusted environment. The process is explained in detail in Section III-B. 2) Decrypt and Return Results: After receiving encrypted classification results from the cloud, the edge device decrypts them with the secret key, decodes the recovered plaintext class scores, applies argmax, and returns the final prediction to the client. All decryption and post-processing operations are confined to the trusted edge, preserving data confidentiality. The process is explained in detail in Section III-D.

5

1 Client - Edge: Upload Image

Client

2 Edge: Extract & Encrypt Features

3 Cloud: Encrypted Inference

Trusted Edge Node

Untrusted Cloud Server [f]

Upload Image

Preprocess

Feature Extraction

CKKS Encryption

[f]

Key setup:

Encrypted Linear Classifier pk, rotk sent from edge

Encrypted Embedding

sk kept at the edge pk, rotk sent to cloud

Resource-Constrained Devices

[y]

Encrypted Logits

Trusted Edge Server

Untrusted Third-Party Server [y]

Prediction

Argmax

CKKS Decryption

Result Decode

Encrypted Classification Results

4 Edge - Client: Decrypt & Return Result

Fig. 1: System architecture showing three-tier workflow: (1) client sends image to edge server, (2) edge server extracts and encrypts features, (3) cloud server performs encrypted inference, (4) edge server decrypts and returns result to client.

D. Threat Model Scope and Limitations

A. Homomorphic Encryption Background

Our framework considers scenarios in which the edge node is trusted, i.e., it can access raw data, plaintext feature embeddings, model-backbone parameters, and the CKKS secret key. Following the ETSI security architecture standard, the edge operates inside an organizational security boundary, such as an enterprise or hospital gateway, an on-premise industrial appliance, or a carrier-operated MEC site governed by local administrative control and platform-attestation policies [35], [36]. In scenarios where the edge node cannot be fully trusted, plaintext feature extraction and cryptographic key management should be performed within a trusted execution environment (TEE), such as Intel SGX [37] or ARM TrustZone [38]. The client could first verify the TEE through remote attestation and establish a secure channel terminating inside the TEE. This channel thus can protect the data using conventional encryption method at the transport layer. Furthermore, the edge OS will only forward encrypted traffic, while the data will be decrypted and processed inside hardware-protected memory (i.e., TEE). Feature extraction and cryptographic key management would also be performed inside the TEE. Therefore, software outside the TEE, including a compromised host OS or hypervisor, would not have access to raw data, plaintext embeddings, or cryptographic keys. Incorporating a TEE would inevitably introduce additional overhead associated with enclave memory constraints, context switching, model loading, and remote attestation. Nevertheless, TEE-based protection complements rather than alters the cryptographic design of RowHyDiag. A comprehensive integration and evaluation of TEEs is therefore left for future deployment-oriented work.

Homomorphic encryption is a cryptographic approach that allows mathematical operations to be performed directly on encrypted data without decryption. To work with real numbers in neural network layers, we use the CKKS scheme [32], which supports approximate arithmetic on floating-point values. Additionally, CKKS enables Single Instruction, Multiple Data (SIMD)-style processing, which allows multiple data elements to be encoded within a single ciphertext [39], thereby enabling efficient parallel computation for linear layers in neural networks. Additionally, the CKKS scheme is based on the Ring Learning With Errors (RLWE) problem [40], providing strong privacy against decryption attempts. The scheme requires ciphertexts to be represented as one-dimensional vectors over a ring of dimension N , with the number of available slots equal to N/2. The ring dimension N determines both the security level and the supported multiplicative depth. Importantly, raw data must be encoded into plaintexts before encryption so that homomorphic operations can be applied. The main homomorphic operations used in our encrypted inference pipeline are:

III. P ROPOSED P RIVACY-P RESERVING I MAGE C LASSIFICATION T ECHNIQUE In this section, we first provide fundamental background on HE and its core operations. We then describe in detail the proposed methods and algorithms introduced in Section II.

Key Generation: Generates sk, pk, and rotation keys rotk for computation. d • Encryption: Given a plaintext vector c ∈ R and pk, encrypt c into a ciphertext c where c = Encrypt(pk, c). • Decryption: Given a ciphertext c and secret key sk, decrypt c into its plaintext form c where c = Decrypt(sk, c). • Addition: Given two ciphertexts c1 and c2 , perform element-wise encrypted addition EvalAdd(c1 , c2 ) = cadd , where Decrypt(sk, cadd ) ≈ c1 + c2 . • Ciphertext-Plaintext Addition: Given a ciphertext c1 and a plaintext c2 , perform element-wise encrypted addition EvalAdd(c1 , c2 ) = cadd , where Decrypt(sk, cadd ) ≈ c1 + c 2 . • Multiplication: Given two ciphertexts c1 and c2 , perform element-wise encrypted multiplication •

6

EvalMult(c1 , c2 ) = cmult , where Decrypt(sk, cmult ) ≈ c1 × c 2 . • Ciphertext-Plaintext Multiplication: Given a ciphertext c1 and a plaintext c2 , perform element-wise encrypted multiplication EvalMult(c1 , c2 ) = cmult , where Decrypt(sk, cmult ) ≈ c1 × c2 . • Rotation: Given a ciphertext c encrypting a vector (c0 , . . . , c N −1 ), perform rotation by i positions: 2 EvalRotate(c, i) = crot , where Decrypt(sk, crot ) ≈ (ci , . . . , c N −1 , c0 , . . . , ci−1 ) [41]. 2 • Hoisted Rotation: For efficient multiple rotations of the same ciphertext, hoisted key switching [42] precomputes hoisted = EvalFastRotationPrecompute(c) once, then performs crot = EvalFastRotation(c, i, hoisted) for each rotation index i. • Sum Across Slots: Given a ciphertext c with batch size B, perform EvalSum(c, B) = csum using a binary-tree reduction pattern: in each round r = 0, 1, . . . , ⌈log2 B⌉ − 1, the ciphertext is rotated by 2r positions and added to itself, progressively halving the number of unaccumulated elements. After ⌈log2 B⌉ rounds, the sum of all B slot values is replicated across all positions in the resulting ciphertext. Building on these CKKS primitives, the following subsections describe the end-to-end encrypted inference workflow, including feature extraction and encryption at the edge, encrypted inference in the cloud, and decryption with result recovery at the edge (Fig. 1 steps 2-4). B. Feature Extraction and Encryption at the Trusted Edge The trusted edge receives an image from the client, performs preprocessing and feature extraction in plaintext, and encrypts only the resulting feature embedding before offloading it to the cloud. This subsection formalizes the query encoding process and encryption procedure. Given an input image x ∈ RH×W ×C where H, W , and C denote height, width, and number of channels, the trusted edge first applies standard preprocessing operations (e.g., resizing, normalization) to obtain x′ = P(x), where ′ ′ ′ P : RH×W ×C → RH ×W ×C represents the preprocessing transformation. The preprocessed image is then fed into a pre′ ′ ′ trained feature extractor Φ : RH ×W ×C → Rm to extract a compact feature embedding: f = Φ(x′ ) = Φ(P(x)) ∈ Rm ,

(1)

where m is the feature dimension (e.g., m = 512 for ResNet-34, m = 768 for ViT-B/16). This embedding f = [f0 , f1 , . . . , fm−1 ]⊤ serves as the plaintext input for subsequent encrypted classification. For efficient encrypted computation using CKKS with ring dimension N , each ciphertext provides S = N/2 available slots. To improve slot utilization and support efficient encrypted computation (especially tree-style reduction during encrypted inference), we design a slot-replication encoding strategy. First, we pad the feature dimension to the nearest power of two: mpadded = 2⌈log2 m⌉ , (2)

which ensures compatibility with binary-tree reduction patterns. The padded feature vector is defined as: fpadded = [f0 , f1 , . . . , fm−1 , 0, . . . , 0 ] ∈ Rmpadded . | {z }

(3)

mpadded −m

Given that mpadded ≤ S (a condition satisfied by typical configurations where m ≪ S), we compute the number of feature replicas that fit into a single ciphertext. Since each replica occupies mpadded consecutive slots, the total number of replicas is obtained by dividing the available slot count S by the replica size mpadded and taking the floor to discard any incomplete trailing block:   S . (4) npack = mpadded We then replicate fpadded across npack consecutive slot blocks to form the replicated feature vector: frep = [fpadded , fpadded , . . . , fpadded ] ∈ Rnpack ·mpadded . {z } |

(5)

npack copies

This replication strategy enables efficient homomorphic matrix-vector multiplication within our proposed encrypted inference algorithm, which is detailed in Section III-C. Finally, the edge encrypts the replicated feature vector using the CKKS public key: f rep = Encrypt(pk, frep ), (6) resulting in an encrypted query ciphertext f rep that is transmitted to the untrusted cloud for encrypted inference. For illustration, Fig. 6 in Appendix A describes this query encoding workflow, including power-of-two padding and slot replication. C. Encrypted Inference in the Untrusted Cloud In standard plaintext inference, the linear classification layer computes class logits via a straightforward matrix-vector multiplication followed by bias addition. Given a feature vector f ∈ Rm , weight matrix W ∈ Rn×m , and bias vector b ∈ Rn , where n denotes the number of classes and m is the feature dimension, the linear layer computes: ℓ = Wf + b ∈ Rn ,

(7)

where ℓ = [ℓ0 , ℓ1 , . . . , ℓn−1 ]⊤ represents the output logits. The predicted class is then determined by ŷ = arg maxi ℓi . In conventional plaintext computation, this matrix-vector product is readily computed via standard linear algebra operations. However, performing the linear forward pass in (7) homomorphically over CKKS ciphertexts introduces fundamental structural constraints. As described in Section III-A, CKKS ciphertexts require data to be encoded in one-dimensional vectors packed into polynomial slots, and the supported homomorphic operations (ciphertext-plaintext multiplication, ciphertext addition, and slot rotation) are inherently elementwise (Hadamard product) or permutation-based rather than standard matrix operations. Consequently, directly applying W to an encrypted vector f is not feasible under the CKKS evaluation model. To enable efficient encrypted computation

7

Algorithm 1 RowHyDiag Encoding: Pack rows and encode diagonals n×m

1: Input: Weight matrix W ∈ R 2: Output: Packed matrix Wpacked n

−1

, batch size S ∈ Rnpadded ×S , diagonal

padded plaintexts {diagd }d=0 3: Compute mpadded ← 2⌈log2 m⌉ 4: Compute npack ← ⌊S/mpadded ⌋ 5: Compute npacked ← ⌈n/npack ⌉ 6: Compute npadded ← 2⌈log2 npacked ⌉ 7: for ipacked = 0 to npadded − 1 do 8: for j = 0 to S − 1 do 9: iorig ← ipacked npack + ⌊j/mpadded ⌋ 10: jorig ← j mod mpadded 11: if iorig < n and jorig < m then 12: Wpacked [ipacked , j] ← W[iorig , jorig ] 13: else 14: Wpacked [ipacked , j] ← 0 15: end if 16: end for 17: end for 18: for d = 0 to npadded − 1 do 19: for j = 0 to S − 1 do 20: r ← j mod npadded 21: blk ← ⌊j/mpadded ⌋ 22: p ← j mod mpadded 23: c ← blk mpadded + ((d + p) mod mpadded ) 24: diagd [j] ← Wpacked [r, c] 25: end for 26: end for npadded −1 27: return Wpacked , {diagd }d=0

Algorithm 2 BiasEncode: Encode aligned bias plaintext 1: Input: Bias b ∈ Rn , S, mpadded , npack , npacked 2: Output: Bias plaintext biaspt 3: for j = 0 to S − 1 do 4: blk ← ⌊j/mpadded ⌋ 5: p ← j mod mpadded 6: if p < npacked then 7: ibias ← p · npack + blk

if ibias < n then biaspt [j] ← b[ibias ] else biaspt [j] ← 0 end if else 14: biaspt [j] ← 0 15: end if 16: end for 17: return biaspt 8: 9: 10: 11: 12: 13:

in (7), the weight matrix W and bias vector b must be transformed into plaintext representations that align with the one-dimensional ciphertext slot structure and leverage the element-wise multiplication and rotation primitives provided by CKKS. To address this challenge, we propose RowHyDiag (rowpacked hybrid diagonal encoding), which transforms W and b into structured diagonal plaintexts compatible with rotation-and-multiply-based encrypted matrix-vector multiplication. The untrusted cloud receives only the encrypted feature representation f rep from the trusted edge and fully evaluates the linear mapping in (7) in the encrypted domain using ciphertext-plaintext operations. This subsection details the RowHyDiag encoding for the weight matrix and bias vector, followed by the encrypted evaluation procedure that realizes the same mapping in (7) under encryption. 1) RowHyDiag Matrix Encoding: Given classifier weights W ∈ Rn×m and slot count S, we compute   n npacked = , (8) npack

We next zero-pad rows until reaching npadded (which equals npacked when npacked is already a power of two), making the packed matrix compatible with power-of-two scheduling in subsequent encrypted operations. This construction improves slot utilization while preserving the original linear mapping. For illustration, Fig. 7 in Appendix A summarizes the square 4 × 4 workflow, whereas Fig. 9 in Appendix B provides a detailed non-square example. Rows of W are packed blockwise into Wpacked ∈ Rnpadded ×S , npadded −1 and diagonal plaintexts {diagd }d=0 are extracted for rotation-and-multiply evaluation according to the slot-index mapping, as formalized in (10)-(13). For d ∈ {0, . . . , npadded − 1} and slot j ∈ {0, . . . , S − 1}, each diagonal element is defined by r = j mod npadded ,

(10)

blk = ⌊j/mpadded ⌋ ,

(11)

p = j mod mpadded ,

(12)

c = blk · mpadded + ((d + p) mod mpadded ) ,

(13)

(9)

where r denotes the row index, blk denotes the block identifier, p denotes the in-block position, and c denotes the column index. This block-local wrap-around preserves index alignment between packed features and packed weights. This encoding ensures that when we rotate f rep by d positions and multiply with diagd , we obtain the correct elementwise products for encrypted linear-layer evaluation. The proposed RowHyDiag encoding is detailed in Algorithm 1. 2) Bias Encoding: To align post-multiplication accumulation with classifier biases, we encode b ∈ Rn into a plaintext vector biaspt using the same block layout. For slot index j, let blk = ⌊j/mpadded ⌋ and p = j mod mpadded . The mapped class index is ibias = p npack + blk, (14)

Starting from the original matrix of size n × m, we first align columns with mpadded , then pack npack original rows into each packed row to obtain a matrix of size npacked × S.

and biaspt [j] = b[ibias ] if ibias < n; otherwise zero. Equivalently, biases are distributed across npack blocks of size mpadded , where block k stores biases for rows k, k+npack , k+2npack , . . .

npadded = 2⌈log2 npacked ⌉ .

8

Plaintext Computation

Encrypted Matrix-Vector Computation 1 Step 1: Diagonal Products

2 Step 2: Accumulate Partial Logits

3 Step 3: Binary-tree reduction within blocks

4 Step 4: Bias Addition

Fig. 2: Encrypted linear-layer evaluation workflow for Algorithm 3. Left (plaintext): the linear classifier computes ℓ = Wf +b. Right (Encrypted): step 1 forms diagonal products from rotated packed features and diagonal plaintexts; step 2 accumulates partial results; step 3 performs in-block binary-tree reduction via rotations and additions; step 4 adds the aligned bias plaintext to obtain encrypted results ℓ. The final class results are decoded from packed slots using the slot-to-class index mapping.

at the block prefix. This layout matches the organization of intermediate encrypted accumulation, enabling correct homomorphic bias addition without extra reshaping. Fig. 8 in Appendix A illustrates the square-case layout, while Fig. 10 in Appendix B shows a non-square example. The full procedure is provided in Algorithm 2. 3) Encrypted Linear Layer Evaluation: Given the encoded weight diagonals {diagd }, aligned bias plaintext biaspt , and encrypted query f rep from the trusted edge, the untrusted cloud evaluates the linear layer in (7) homomorphically using rotations, ciphertext-plaintext multiplications, and additions. We first perform hoisted key-switching precomputation for f rep to amortize the cost of multiple ciphertext rotations. For d = 0, we multiply the unrotated ciphertext by diag0 to initialize the accumulator; for each d ∈ {1, . . . , npadded − 1}, we rotate the encrypted query by d, multiply by diagd , and accumulate via homomorphic addition. This produces partial results distributed across npack blocks. Because the packed-row coordinate has period npadded , we then apply in-block binarytree reduction with strides npadded , 2npadded , 4npadded , . . ., and finally add the aligned bias plaintext to obtain encrypted results ℓ. Formally, let ρd (·) denote left rotation by d slots, and ⊙ denote slot-wise multiplication. The diagonal accumulation computes: ud = ρd (f rep ) ⊙ diagd , (15)

npadded −1

a=

X

ud .

(16)

diagd [j]frep [(j + d) mod S].

(17)

d=0

At the slot level: npadded −1

a[j] =

X d=0

Here, frep [j] denotes the j-th slot of Decrypt(sk, f rep ). Under this notation, the summation is exactly the blockwise wrapped diagonal accumulation induced by (10)-(13). We then apply in-block binary-tree reduction:    mpadded a(0) = a, T = log2 , (18) npadded   t a(t+1) = a(t) + ρ2 npadded a(t) ,

t = 0, . . . , T − 1.

(19)

Finally, ℓ = a(T ) + biaspt .

(20)

For detailed illustration, Fig. 2 visualizes the end-to-end encrypted evaluation flow corresponding to (15)-(20). Algorithm 3 summarizes the full cloud-side encrypted evaluation procedure.

9

Algorithm 3 EncryptedInference: Encrypted Linear Classifier Evaluation 1: Input: Encrypted replicated query f rep , diagonal plaintexts −1

n

padded {diagd }d=0 , bias plaintext biaspt 2: Output: Encrypted results ℓ 3: hoisted ← EvalFastRotationPrecompute(f rep ) 4: acc ← EvalMult(f rep , diag0 ) 5: for d = 1 to npadded − 1 do f rot ← EvalFastRotation(f rep , d, hoisted) 6: 7: prod ← EvalMult(f rot , diagd ) acc ← EvalAdd(acc, prod) 8: 9: end for 10: elements per block ← mpadded /npadded 11: num shifts ← ⌈log2 (elements per block)⌉ 12: stride ← npadded 13: for r = 0 to num shifts − 1 do 14: acc ← EvalAdd(acc, EvalRotate(acc, stride)) 15: stride ← 2 · stride 16: end for 17: ℓ ← EvalAdd(acc, biaspt ) 18: return ℓ

After cloud evaluation, encrypted results are returned to the trusted edge for decryption and class-score extraction. The trusted edge first decrypts the returned ciphertext using the secret key: adec = Decrypt(sk, ℓ) ∈ RS , (21) where adec is the decrypted plaintext vector containing the packed logit values across S slots. To extract individual class scores from the decrypted packed vector, the edge applies the inverse of the RowHyDiag layout. Using the same block structure as bias encoding, for class index i ∈ {0, . . . , n − 1} define p(i) = ⌊i/npack ⌋ ,

(22)

and slot location j(i) = blk(i) mpadded + p(i).

(23)

The recovered class score is then extracted from the corresponding slot: ℓi ≈ adec [j(i)],

i = 0, . . . , n − 1.

This section describes datasets, evaluation metrics, implementation settings, and baseline methods used to validate both prediction accuracy and deployment-oriented encryptedinference performance. A. Datasets

D. Decryption and Result Recovery at the Trusted Edge

blk(i) = i mod npack ,

IV. E XPERIMENT S ETUP

(24)

Equivalently, if a slot is written as j = blk mpadded + p, then it stores class index i = p npack + blk whenever i < n. From (22)-(24), applying the slot mapping across valid classes yields ℓ ≈ Wf + b, (25) which shows that the three-stage trusted edge/untrusted cloud/trusted edge workflow preserves the plaintext linearlayer mapping, up to CKKS approximation error. Raw images, plaintext embeddings, and decryption keys remain inside the trusted edge boundary.

We evaluate the proposed framework on five datasets spanning increasing levels of classification complexity and deployment realism: MNIST [43] (10 classes), CIFAR-10 [44] (10 classes), CIFAR-100 [44] (100 classes), ImageNet-1K [45] (1,000 classes), and a custom Australian Landmarks dataset (9 classes). MNIST is included as a standard low-complexity benchmark with grayscale handwritten digits and limited appearance variation, allowing us to verify numerical correctness and encrypted-plaintext consistency under controlled conditions. CIFAR-10 introduces natural-image diversity (background clutter, viewpoint changes, and intra-class diversity), which is useful for validating robustness beyond digit classification. CIFAR-100 further increases task difficulty through finegrained 100-class recognition, providing a challenging evaluation of scalability for both model accuracy and encrypted inference overhead. ImageNet-1K extends the evaluation to 50,000 validation images and 1,000 output classes, allowing us to assess encrypted-plaintext consistency and encryptedinference scalability at a substantially larger classification scale. In addition to standard benchmarks, we evaluate on a newly curated Australian landmarks dataset to reflect a realistic mobile visual-recognition scenario. This dataset contains 9 landmark classes and 1,981 test images used for final evaluation. We include this dataset because it captures deploymentoriented challenges (scene diversity, landmark-specific visual overlap, and edge-cloud deployment context) that are not fully represented by standard academic benchmarks. The dataset is constructed through web crawling followed by dual-stage filtering (semantic verification and visual consistency verification) to ensure data quality. For simplicity, only summary information is presented in the main text. The full data collection and verification pipeline is described in Appendix C, and Tables VI and VII in Appendix D report the detailed perclass filtering statistics and final train/test split. B. Evaluation Metrics We evaluate three aspects of performance: classification quality, plaintext-encrypted numerical consistency, and system efficiency. For classification quality, top-1 accuracy is defined as N 1 X ⊮[ŷi = yi ], (26) Accuracy = N i=1 where N is the number of test samples, ŷi is the predicted class for sample i, yi is the true class label, and ⊮[·] is the indicator function. We also report confusion matrices for class-level analysis, where element Mij denotes the number of samples

10

with true class i predicted as class j. For system delay, we measure end-to-end latency as Ttotal = Tedge + Tnetwork + Tcloud ,

(27)

where Tedge includes both feature extraction time and encryption time, Tnetwork is network transmission time, and Tcloud is homomorphic inference time. Throughput is reported in images per second and computed as 1/Ttotal when Ttotal is measured in seconds (equivalently, 1000/Ttotal when latency is measured in milliseconds). In addition to runtime, we report ciphertext communication size and rotation-key storage to characterize deployment overhead. To quantify plaintextencrypted numerical consistency, we compute the maximum relative error between plaintext logits ℓ = [ℓ1 , . . . , ℓC ] and encrypted logits ℓ′ = [ℓ′1 , . . . , ℓ′C ] across all test samples: |ℓi,c − ℓ′i,c | , i=1 c=1 |ℓi,c | + ϵ N

C

Max-RelError = max max

Cloud Server

Edge Node

User Device

Fig. 3: Real-device experimental setup used in the three-tier edge-cloud deployment.

(28)

where ϵ = 10−8 prevents division by zero, and ℓi,c denotes the logit for class c of sample i. C. Experimental Configuration 1) Hardware and Network: Our implementation follows the proposed three-tier edge-cloud system shown in Fig. 3, comprising an Android client, a trusted edge node, and an untrusted cloud server. The edge-to-cloud link uses 10 Gigabit Ethernet (10GbE). The trusted edge node is an NVIDIA Jetson Orin 64GB device, and the cloud server is equipped with an Intel Core i9-13900K processor (up to 5.8 GHz, 24 cores / 32 threads) and 32 GB of RAM running Linux. All latency components are measured empirically on this physical testbed using wall-clock timing. Specifically, Tedge is measured endto-end on the Jetson Orin, covering image preprocessing, feature extraction, and CKKS encryption; Tnetwork is obtained by timestamping ciphertext payloads at the sender and receiver endpoints, capturing the actual transfer delay over the 10GbE link; and Tcloud is measured on the cloud server, covering the full homomorphic inference procedure (rotation, multiplication, accumulation, and bias addition). All measurements are taken under real operating conditions, and reported values are averaged over the full test set for each dataset. 2) Model Backbones and Fine-Tuning Settings: Model training and fine-tuning are conducted on the edge node to reflect deployment-oriented resource constraints, while encrypted classification is executed on the cloud. For MNIST, CIFAR-10, and Australian landmarks, we use a ResNet-34 backbone [4] with 512-dimensional embeddings. For CIFAR100, we use ViT-B/16 [46] with 768-dimensional embeddings to support fine-grained 100-class recognition. For ImageNet1K, we use a publicly available ViT-B/16 model pretrained on ImageNet-21K and fine-tuned on ImageNet-1K, also producing 768-dimensional embeddings for the 1,000-class classifier. For ResNet-34 settings, we use Adam optimizer [47] with differential learning rates between the backbone and classifier, weight decay 5×10−4 , and validation-based checkpoint selection following standard transfer learning practices [48]. Specifically, MNIST uses 12 epochs with learning rates 1 × 10−4

TABLE I: HE parameter sets used for encrypted inference. Set

N

HE-2048 2,048 HE-4096 4,096 HE-8192 8,192 HE-16384 16,384 HE-32768 32,768

Modulus chain Multiplicative Depth Security Level (60, 50) (60, 50) (60, 50) (60, 50) (60, 50)

1 1 1 1 1

Prototype Prototype 128-bit 128-bit 128-bit

(backbone) and 1×10−3 (classifier), CIFAR-10 uses 20 epochs with 5 × 10−5 and 3 × 10−4 , and Australian landmarks uses 35 epochs with 5 × 10−5 and 3 × 10−4 . The batch size is 64 in all three cases. For Australian landmarks, we additionally use a ReduceLROnPlateau scheduler [49] (factor 0.5, patience 3; minimum learning rate 10−7 ). For CIFAR-100 with ViT-B/16, we fine-tune for 100 epochs using Adam (learning rate 7 × 10−5 , weight decay 0.05, batch size 128) following established ViT fine-tuning protocols [46], [50]. We apply One-Cycle learning-rate scheduling [51], Mixup (α = 0.2) [52], CutMix (α = 1.0) [53], RandomErasing [54], and label-smoothing cross-entropy (smoothing 0.1) [55], and select the best checkpoint by validation accuracy. 3) HE Parameter Configuration: The encrypted pipeline is implemented in OpenFHE [56] using CKKS. Table I defines five parameter sets, denoted by HE-2048 through HE-32768 according to their ring dimensions N ; each set provides S = N/2 CKKS slots. All parameter sets use multiplicative depth one, a 60-bit first modulus, and a 50-bit scaling modulus. HE-8192, HE-16384, and HE-32768 are configured for 128-bit security, whereas HE-2048 and HE-4096 are included only as prototype parameter sets for evaluating computational scaling, without claiming a standard security level. The remaining implementation settings are FIXEDAUTO scaling, HYBRID key switching, and a uniform ternary secret distribution. These parameter choices follow the HomomorphicEncryption.org guidelines and OpenFHE’s standard parameter interface [57], [58].

11

D. Baselines To comprehensively validate our proposed framework, we perform evaluations against baselines following standard practices in HE/FHE-based DL literature. Plaintext (Non-Encrypted) Baseline. Similar to prior works [16], [18], [24], we compare our approach against plaintext inference to quantify the impact of CKKS approximation noise. The plaintext baseline uses identical model weights and biases but evaluates the linear layer directly in floatingpoint arithmetic without encryption. This baseline is used to assess classification accuracy (top-1 accuracy, confusion matrices) and numerical consistency (maximum relative logit error between plaintext and encrypted outputs), verifying that encrypted inference preserves plaintext predictive behavior with negligible accuracy degradation. Halevi-Shoup Diagonal Encoding Baseline. The HaleviShoup diagonal method [41] is a foundational technique for encrypted matrix-vector multiplication that decomposes a square matrix into diagonals, encodes them as plaintexts, and multiplies them with rotated encrypted vectors. Prior HE-based neural network inference approaches have widely adopted this method for encrypted linear operation [59], [60], making it a natural baseline for evaluating the algorithmic contribution of RowHyDiag. The method embeds an n × m weight matrix into an L × L square matrix (where L = max(n, m) rounded to the next power of two), then extracts L diagonal plaintexts for encrypted matrix-vector computation through rotation-and-multiply operations. The rotation count for Halevi-Shoup encoding is given in (29). This baseline enables direct comparison of cloud inference efficiency metrics (latency and memory) to demonstrate that RowHyDiag significantly reduces computational overhead, memory footprint, and inference latency compared to conventional diagonal encoding. PEGASUS Linear-Transformation Baseline. PEGASUS [61] uses a tiled baby-step/giant-step (BSGS) method for encrypted linear transformations. We adapt this method to evaluate the encrypted classifier ℓ = W f + b. The method pads the matrix dimensions to powers of two and constructs D = min(npadded , mpadded ) tiled diagonals. It√then applies a balanced BSGS schedule with baby-step size ⌈ D⌉. Because our framework performs only encrypted linear-layer evaluation at the cloud, the comparison does not include PEGASUS’s conversion, lookup-table evaluation, or scheme-switching operations. Therefore, this baseline represents only the lineartransformation method in PEGASUS, rather than the complete PEGASUS system. RowHyDiag Evaluation Variants. RowHyDiag is designed primarily for short-wide classifier matrices, where the number of output classes is much smaller than the feature dimension. However, as the number of output classes increases, the number of diagonal products also grows. To reduce the resulting rotation overhead, we apply BSGS scheduling, which changes only the order in which the diagonal products are accumulated. Accordingly, we use RowHyDiag for the three small-output datasets and RowHyDiag with BSGS scheduling for CIFAR100 and ImageNet-1K.

TABLE II: Encrypted classification accuracy and maximum relative logit error across HE parameter sets. Dataset

Set

MNIST

HE-2048 HE-4096 HE-8192

99.56

99.56

2.659 × 10−8 3.510 × 10−7 2.208 × 10−7

CIFAR-10

HE-2048 HE-4096 HE-8192

96.64

96.64

9.671 × 10−9 2.400 × 10−8 2.956 × 10−8

Landmarks

HE-2048 HE-4096 HE-8192

95.91

95.91

1.472 × 10−8 1.567 × 10−8 2.196 × 10−8

CIFAR-100

HE-4096 HE-8192 HE-16384 HE-32768

92.69

1.053 × 10−5 3.666 × 10−5 1.153 × 10−4 1.844 × 10−4

85.99

7.096 × 10−5 3.080 × 10−4 9.484 × 10−5 3.216 × 10−4

HE-4096 HE-8192 ImageNet-1K HE-16384 HE-32768

Plain (%) Encrypted (%) Max-Rel. Error

92.69

85.99

V. S IMULATION AND E XPERIMENTAL R ESULTS Before evaluating encrypted inference, we verify that all fine-tuned models converge to stable operating points with small train-validation gaps. Convergence curves and detailed analysis for MNIST, CIFAR-10, CIFAR-100, and Australian landmarks are provided in Fig. 11 in Appendix E. The selected checkpoints achieve 99.47% (MNIST), 97.05% (CIFAR-10), 92.69% (CIFAR-100), and 93.92% (Australian landmarks) validation accuracy, confirming reliable feature representations for downstream encrypted classification. For ImageNet-1K, we instead use the public ViT-B/16 AugReg checkpoint distributed through the timm model collection on Hugging Face.1

A. Encrypted Classification Accuracy Table II summarizes plaintext-versus-encrypted accuracy and the maximum relative logit error for every evaluated HE parameter set. Encrypted and plaintext top-1 accuracies are identical for all five datasets and all tested configurations. The largest observed relative error is 3.216×10−4 on ImageNet-1K under HE-32768, which remains too small to alter any top-1 decision. The errors across the remaining parameter sets are of the same negligible order and likewise preserve all top-1 decisions. To provide class-level transparency for the three 9/10-class datasets, Fig. 4 combines the encrypted confusion matrices for MNIST, CIFAR-10, and Australian landmarks. The matrices show that prediction errors are concentrated in visually similar classes rather than randomly distributed. Together with the identical plaintext and encrypted accuracies for CIFAR-100 and ImageNet-1K in Table II, these results show that the packing and reduction procedure preserves model utility from 9 to 1,000 output classes. 1 https://huggingface.co/timm/vit base patch16 384.augreg in21k ft in1k

12

0

0

2

0

0

1

0

1134

0

0

0

0

0

1

0

0

2

0

0

1026

0

0

0

0

5

1

0

3

0

0

1

1006

0

2

0

0

0

1

4

0

2

0

0

975

0

1

0

0

4

5

0

0

0

1

0

889

2

0

0

0

6

1

4

0

0

0

0

952

0

1

0

7

0

4

2

0

0

0

0

1022

0

0

8

0

0

1

1

0

1

0

1

969

1

9

0

1

0

0

3

0

0

0

0

1005

0

1

2

3

4

5

6

7

8

9

Predicted Label

Confusion Matrix: ResNet-34 on CIFAR-10

1.0

0.8

0.6

airplane 980

0

automobile

4

972

0

bird

11

0

945

4

2

1

2

0

0

10

1

0

0

0

0

0

0

24

10

18

7

5

2

2

0

cat

4

0

6

927

9

42

5

4

2

1

deer

0

0

7

5

976

1

3

7

1

0

dog

2

0

6

32

7

947

2

2

0

2

frog

1

0

5

5

0

3

986

0

0

0

horse

4

0

3

3

7

11

1

971

0

0

ship

12

0

1

0

0

0

2

0

978

7

0.4

0.2

2

truck

13

ile ne pla omob aut

air

0.0

(a) MNIST (10 classes).

0 d

bir

0 cat

0 r

dee

0 dog

0 g

fro

0 se

hor

3 p

shi

0.8

0.6

0.4

0.2

982 ck

tru

Confusion Matrix: ResNet-34 on Australian Landmarks (9 classes)

1.0

0.0

BM

98

0

1

4

0

0

2

0

0

FSS

0

98

0

0

1

3

10

1

0

GBR

1

1

331

4

0

2

1

0

0

GOR

1

1

2

248

1

2

1

0

0

PH

0

1

0

0

88

0

0

0

0

SP

0

2

2

2

1

151

7

4

0

SHB

0

0

0

0

1

1

361

5

0

SOH

0

0

1

0

0

1

6

381

0

U

2

1

2

1

0

1

0

1

144

BM

FSS

GBR

GOR

PH

SP

SHB

SOH

U

1.0

0.8

Row-normalized intensity

0

True Label

0

Row-normalized intensity

0

True Label

True Label

0

Row-normalized intensity

Confusion Matrix: ResNet-34 on MNIST 0 978

0.6

0.4

0.2

0.0

Predicted Label

Predicted Label

(b) CIFAR-10 (10 classes).

(c) Australian landmarks (9 classes).

Fig. 4: Encrypted confusion matrices for the three 9/10-class datasets. The CIFAR-100 and ImageNet-1K matrices are not shown because their 100 and 1,000 classes make them too dense for clear visualization in the main text.

Edge Processing

Network Transmission

End-to-End Latency (ms)

200.00

Cloud Encrypted Inference

184.84 ms

175.00 149.66 ms

150.00 125.00 100.00 75.00

57.46 ms

56.93 ms

MNIST

CIFAR-10

56.88 ms

50.00 25.00 0.00

CIFAR-100 (ViT-B/16)

Datasets

ImageNet-1K (ViT-B/16)

Australian Landmarks

Fig. 5: Per-stage latency breakdown across datasets under the HE-8192 parameter set. Stacked bars show edge processing (blue), network transmission (red), and cloud encrypted inference (green). Total latency is annotated above each bar.

B. Low-Latency Encrypted Inference Analysis 1) Latency and Throughput Analysis: Fig. 5 presents the end-to-end latency breakdown across all five datasets under the common HE-8192 parameter set. For MNIST, CIFAR-10, and Australian Landmarks, the endto-end latencies are 57.46, 56.93, and 56.88 ms, corresponding to throughputs of 17.40, 17.57, and 17.58 images/s, respectively. The three latency components are nearly balanced in these settings: edge processing requires approximately 19.5419.64 ms, network transmission requires 19.00-19.21 ms, and cloud encrypted inference requires 18.21-18.71 ms. These results show that the proposed pipeline supports interactive encrypted classification for the 9/10-class workloads, with no individual stage becoming a dominant bottleneck. The two larger ViT-B/16 workloads exhibit the expected increase in latency. CIFAR-100 requires 92.13 ms for edge processing, 19.67 ms for network transmission, and 37.86 ms for cloud encrypted inference, resulting in 149.66 ms endto-end latency and 6.68 images/s throughput. ImageNet-1K

requires 92.11, 19.20, and 73.53 ms for the corresponding stages, yielding 184.84 ms total latency and 5.41 images/s. The similar edge-processing times follow from the common ViTB/16 backbone and 768-dimensional feature representation. Their network times are also similar because both datasets use the HE-8192 parameter set. In contrast, the cloud component increases from 37.86 ms for CIFAR-100 to 73.53 ms for ImageNet-1K because the encrypted classifier scales from 100 to 1,000 output classes. Overall, cloud inference latency increases with the number of output classes, while end-to-end latency remains below 200 ms for all evaluated workloads. 2) Complexity Analysis of Rotation Count: To understand the algorithmic efficiency of the proposed encoding, we analyze the theoretical rotation complexity of the conventional Halevi-Shoup diagonal method [41], the PEGASUS lineartransformation baseline, and RowHyDiag. Rotation operations (via key-switching) are a major computational cost in encrypted linear-layer evaluation, making rotation count an important complexity metric for encrypted inference systems [59]. Halevi-Shoup Diagonal Encoding. Consider an encrypted matrix-vector computation y = Ax where A ∈ Rn×m is a plaintext matrix (n: number of output rows, m: number of input columns) and x ∈ Rm is encrypted. The Halevi-Shoup diagonal method [41] embeds A into a square matrix of size L × L where L = 2⌈log2 max(n,m)⌉ is the smallest power of two greater than or equal to max(n, m). The method then extracts L diagonal plaintexts and performs encrypted matrixvector multiplication through rotation-and-multiply operations. For each diagonal d ∈ {0, 1, . . . , L − 1}, the encrypted vector is rotated by d positions, multiplied with the corresponding diagonal plaintext, and the resulting L ciphertexts are summed via homomorphic addition. Since no further reduction is needed (each output element is already in its final position after summation), the total rotation count is [41]: RHalevi-Shoup (n, m) = L − 1 = 2⌈log2 max(n,m)⌉ − 1

(29)

For typical classification tasks where m ≫ n, the rotation count is dominated by the input dimension and scales as O(m).

13

PEGASUS Linear-Transformation. For output dimension n and input dimension m, the baseline pads the two dimensions to n b = 2⌈log2 n⌉ and m b = 2⌈log2 m⌉ , respectively. The resulting tiled representation contains DP = min(b n, m). b

(30)

The baseline evaluates these diagonals using √ a balanced BSGS schedule with baby-step size BP = ⌈ DP ⌉ and GP = ⌈DP /BP ⌉ giant groups. Preparing the reusable baby steps requires BP − 1 rotations, while accumulating the giant groups requires GP − 1 rotations. When n b < m, b each output is distributed across m/b b n column groups. Combining these partial values requires an additional log2 (m/b b n) rotations. Substituting the padded dimensions and BSGS parameters gives the following rotation count in terms of n and m: RPEGASUS LT (n, m) =

q

min 2⌈log2 n⌉ , 2⌈log2 m⌉ 

 −1


⌈log2 n⌉ ⌈log2 m⌉ min 2 , 2   +  lq −1
m    ⌈log n⌉ ⌈log m⌉ min 2 2 , 2 2     2⌈log2 m⌉ + max 0, log2 ⌈log n⌉ . 2 2

(31) RowHyDiag Encoding. In contrast, RowHyDiag uses the available CKKS slots to pack multiple classifier rows before extracting the diagonals. For slot count S = N/2 and input dimension m, the feature length is first padded to mpadded = 2⌈log2 m⌉ .

(32)

The number of classifier rows combined in each packed row is   S npack = ⌈log m⌉ . (33) 2 2 The resulting number of packed rows is then padded to a power of two: l l mm log2 n n pack npadded = 2 . (34) The direct schedule evaluates the npadded diagonal products using npadded − 1 hoisted rotations. It then combines the partial feature contributions through an in-block binary-tree reduction, which requires ⌈log2 (mpadded /npadded )⌉ additional rotations. Substituting Eqs. (32)-(34) gives the following rotation count in terms of n, m, and S: &

&

log2

RRowHyDiag (n, m, S) = 2

''

⌊

 + log2

n S/2⌈log2 m⌉



⌋

−1

2⌈log2 m⌉ ⌈log2 m⌉ ⌋⌉⌉ 2⌈log2 ⌈n/⌊S/2

 .

(35) For MNIST, CIFAR-10, and Australian Landmarks, row packing produces a small number of diagonals, so we use the direct schedule. For the larger-output CIFAR-100 and ImageNet-1K classifiers, we instead apply BSGS to the same npadded diagonal products. We use baby-step size BR = √ ⌈ npadded ⌉ and GR = ⌈npadded /BR ⌉ giant groups. This reduces the rotations in the diagonal stage from npadded − 1

to (BR − 1) + (GR − 1), while the row-packed encoding and in-block reduction remain unchanged. Substituting the padded dimensions gives the following rotation count in terms of n, m, and S: &q BSGS RRowHyDiag (n, m, S) =

' ⌈log2 ⌈n/⌊S/2⌈log2 m⌉ ⌋⌉⌉

2

−1

 log2 ⌈n/⌊S/2⌈log2 m⌉ ⌋⌉⌉ ⌈   2 +  lp m − 1  log2 ⌈n/⌊S/2⌈log2 m⌉ ⌋⌉⌉  ⌈ 2      2⌈log2 m⌉ + log2 . ⌈log2 m⌉ ⌋⌉⌉ 2⌈log2 ⌈n/⌊S/2 

(36)

Table III reports the rotation counts obtained from Eqs. (29), (31), (35), and (36). Comparison. For the 9/10-class tasks, RowHyDiag decreases from 13 to 9 rotations as S increases from 1,024 to 4,096, while Halevi-Shoup and the PEGASUS lineartransformation baseline remain at 511 and 11 rotations, respectively. For CIFAR-100, RowHyDiag with BSGS decreases from 18 to 11 rotations over S = 2,048-16,384, compared with 24 for the PEGASUS baseline and 1,023 for Halevi-Shoup. For ImageNet-1K, the RowHyDiag count decreases from 45 to 18, compared with 62 and 1,023 rotations for the two baselines. These reductions result from slot-aware row packing, which packs more output rows together as S increases and therefore reduces the number of RowHyDiag diagonals. These results are consistent with the asymptotic rotation complexity. Power-of-two padding changes each dimension by at most a constant factor. Therefore, Halevi-Shoup uses Θ(max(n, m)) diagonals and has rotation complexity O(max(n, m)). The PEGASUS linear-transformation baseline uses DP = Θ(min(n, m)) tiled diagonals. Its balanced BSGS schedule therefore has rotation complexity p  m  O min(n, m) + max 0, log . (37) n For RowHyDiag, npack = Θ(S/m) and hence the number of packed diagonals is l nm m , (38) DR = npadded = Θ S assuming a valid packing configuration with S ≥ 2⌈log2 m⌉ . The direct RowHyDiag schedule thus has rotation complexity   m O DR + log , (39) DR whereas applying BSGS to its diagonal stage reduces the rotation component to p   rl  m nm m m O DR + log =O + log . DR S ⌈nm/S⌉ (40) In the intended short-wide regime, where n is small and S = Θ(m), DR remains small and the RowHyDiag rotation complexity approaches O(log m). BSGS changes the rotation schedule but does not reduce the number of ciphertextplaintext products. RowHyDiag evaluates DR diagonal products, whereas the PEGASUS linear-transformation baseline

14

TABLE III: Rotation counts across the evaluated slot counts. The smallest count in each setting is shown in bold. n×m

Dataset MNIST, CIFAR-10, Australian Landmarks

CIFAR-100

ImageNet-1K

S

Halevi-Shoup

PEGASUS LT

RowHyDiag

(9-10) × 512

1,024 2,048 4,096

511 511 511

11 11 11

13 10 9

100 × 768

2,048 4,096 8,192 16,384

1,023 1,023 1,023 1,023

24 24 24 24

18 15 12 11

1,000 × 768

2,048 4,096 8,192 16,384

1,023 1,023 1,023 1,023

62 62 62 62

45 32 24 18

TABLE IV: Memory and resource summary for RowHyDiag using the HE-8192 parameter set (decimal MB/KB). Metric Setup (MB) Context+PK (KB) Rotation keys (MB) Rotation indices (#) Upload/query (KB) Return/query (KB)

9/10 classes

CIFAR-100

ImageNet-1K

7.35 263.54 7.08 9 263.01 263.21

12.07 263.54 11.81 15 263.01 263.21

25.45 263.54 25.18 32 263.01 263.21

evaluates DP products. Their diagonal-product counts are therefore O(DR ) and O(DP ), respectively. Thus, rotation count captures the main key-switching cost but does not alone determine the complete homomorphic runtime. 3) Memory and Resource Analysis: Beyond computational complexity, deployable systems require careful consideration of storage and communication overhead. We therefore report two deployment-oriented metrics: the one-time setup payload and per-query communication volume. The setup payload includes the cryptographic context, public key, and rotation keys provided to and stored by the cloud. Per-query communication includes the uploaded feature ciphertext and returned result ciphertext. Table IV summarizes these costs under the common HE-8192 parameter set. For the 9/10-class settings (MNIST, CIFAR-10, and Australian Landmarks), the setup payload is 7.35 MB, including 263.54 KB for the context and public key and 7.08 MB for nine rotation keys. Rotation keys account for approximately 96.3% of the setup payload, indicating that evaluation-key material, rather than the query ciphertext, is the dominant static overhead. At inference time, the encrypted upload and returned result are 263.01 KB and 263.21 KB per image, respectively. The near-equal upload and return sizes follow from the slot-position-matching decode strategy: the cloud returns one logits ciphertext in the same packed layout without ciphertext expansion. These values are shared by the three datasets because they use the same HE-8192 configuration and comparable packing layouts. For CIFAR-100, the larger output dimension increases the number of required rotation indices from 9 to 15. Consequently, rotation-key storage grows to 11.81 MB and the total setup payload reaches 12.07 MB. ImageNet-1K further increases the output dimension to 1,000 classes, requiring 32 ro-

TABLE V: Empirical performance comparison of RowHyDiag and baselines. Entries report cloud latency (ms/image) / setup payload (MB). Dataset

Set

Halevi-Shoup PEGASUS LT

RowHyDiag

MNIST

HE-2048 HE-4096 HE-8192

167.79 / 100.82 253.50 / 201.35 418.57 / 402.41

6.79 / 2.24 12.07 / 4.46 19.79 / 8.92

6.29 / 2.63 10.71 / 4.07 18.64 / 7.35

CIFAR-10

HE-2048 HE-4096 HE-8192

168.00 / 100.82 253.07 / 201.35 418.57 / 402.41

7.14 / 2.24 11.07 / 4.46 19.71 / 8.92

6.86 / 2.63 8.21 / 4.07 18.07 / 7.35

CIFAR-100

HE-4096 554.57 / 402.96 HE-8192 899.93 / 805.35 HE-16384 1629.00 / 1610.13 HE-32768 -

36.64 / 9.58 55.00 / 19.15 85.86 / 38.29 153.21 / 76.56

31.29 / 7.22 37.86 / 12.07 51.21 / 19.41 83.07 / 35.66

ImageNet-1K

HE-4096 557.21 / 402.96 117.74 / 24.55 68.11 / 17.85 HE-8192 895.53 / 805.35 180.21 / 49.06 73.53 / 25.45 HE-16384 1610.89 / 1610.13 306.11 / 98.08 89.89 / 38.29 HE-32768 - 536.79 / 196.12 119.42 / 57.68

HE-2048 Australian Landmarks HE-4096 HE-8192

166.93 / 100.82 251.50 / 201.35 418.00 / 402.41

7.36 / 2.24 11.64 / 4.46 19.00 / 8.92

7.21 / 2.63 10.50 / 4.07 18.07 / 7.35

tation indices, 25.18 MB of rotation keys, and a 25.45 MB total setup payload. Rotation keys therefore remain the dominant setup component, accounting for approximately 97.8% and 98.9% of the CIFAR-100 and ImageNet-1K setup payloads, respectively. Because all three settings use the same ring dimension, their per-query upload and return sizes remain unchanged; the larger class counts primarily affect the number of required rotation keys. Relative to the 9/10-class settings, setup payload increases by approximately 1.6× for CIFAR-100 and 3.5× for ImageNet-1K. At the 1,000-class scale, the RowHyDiag setup payload is 25.45 MB. 4) Empirical Comparison with Baselines: Having established the theoretical rotation advantage, we compare our proposed approach RowHyDiag with the conventional Halevi-Shoup diagonal method and the PEGASUS lineartransformation baseline. All methods use the same model, cryptographic parameters, hardware, and evaluation settings. Table V reports cloud inference latency and one-time setup payload. The setup payload includes the cryptographic context, public key, and rotation keys. Comparison with Halevi-Shoup. Under the prototype HE2048 and HE-4096 settings, our proposed approach RowHy-

15

Diag is 8.2-30.8× faster and reduces the setup payload by 22.6-55.8×. Under the configurations providing 128-bit security, RowHyDiag is 12.2-31.8× faster and reduces the setup payload by 31.6-83.0×. Halevi-Shoup is unavailable at HE32768 because its setup payload is too large to transmit over the network. Halevi-Shoup requires substantially more rotations and rotation keys, whereas the packed schedule of RowHyDiag reduces both costs. Comparison with the PEGASUS linear-transformation baseline. Under the prototype settings, the two methods have comparable latency at HE-2048, although the PEGASUS baseline has a slightly smaller setup payload. At HE-4096, RowHyDiag is 1.1-1.7× faster and reduces the setup payload by 1.1-1.4×. Under the configurations providing 128-bit security, RowHyDiag is 1.1-4.5× faster and reduces the setup payload by 1.2-3.4×. These improvements arise from the RowHyDiag packing layout, which reduces both the number of diagonal products and the required rotation keys. For the larger CIFAR100 and ImageNet-1K classifiers, BSGS scheduling preserves these advantages as the number of output classes increases. VI. C ONCLUSION This paper presents PRICE, a deployment-ready three-tier edge-cloud framework for privacy-preserving image classification with CKKS homomorphic encryption. The design keeps secret-key operations and deep feature extraction at the trusted edge while restricting the untrusted cloud to encrypted finallayer inference. To improve cloud-stage efficiency, we develop RowHyDiag, a row-packed hybrid diagonal encoding method with hoisted-rotation-aware computation, improving slot utilization and reducing costly homomorphic operations. Theoretical complexity analysis and empirical evaluation across five datasets demonstrate that, under the evaluated 128-bit-security configurations, RowHyDiag achieves 12.2-31.8× faster cloud inference, requires 32.0-85.3× fewer rotations, and reduces the setup payload by 31.6-83.0× compared with the Halevi-Shoup diagonal method. RowHyDiag is also 1.1-4.5× faster than the PEGASUS linear-transformation baseline and reduces its setup payload by 1.2-3.4×. Encrypted accuracy matches plaintext accuracy across all five datasets, confirming that encrypted evaluation preserves the predictive results. These results show that our proposed framework supports low-latency encrypted inference for mobile edge-cloud systems under a trusted-edge threat model. R EFERENCES [1] C.-H. Nguyen, B. D. Manh, D. T. Hoang, D. N. Nguyen, and L. Wang, “Demo: PP-AICloud for edge-assisted privacy-preserving AI inference with homomorphic encryption in cloud-based mobile services,” in Proceedings of the 31st Annual International Conference on Mobile Computing and Networking, 2025, p. 1166–1168. [2] Y. Huang, X. Qiao, P. Ren, L. Liu, C. Pu, S. Dustdar, and J. Chen, “A lightweight collaborative deep neural network for the mobile web in edge cloud,” IEEE Transactions on Mobile Computing, vol. 21, no. 7, pp. 2289–2305, Jul. 2022. [3] M. Gao, R. Shen, L. Shi, W. Qi, J. Li, and Y. Li, “Task partitioning and offloading in DNN-task enabled mobile edge computing networks,” IEEE Transactions on Mobile Computing, vol. 22, no. 4, pp. 2435–2445, Apr. 2023.

[4] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778. [5] M. Tan and Q. Le, “EfficientNetV2: Smaller models and faster training,” in Proceedings of the 38th International Conference on Machine Learning (ICML), 2021, pp. 10 096–10 106. [6] T. Liu, L. Fang, Y. Zhu, W. Tong, and Y. Yang, “A near-optimal approach for online task offloading and resource allocation in edge-cloud orchestrated computing,” IEEE Transactions on Mobile Computing, vol. 21, no. 8, pp. 2687–2700, Aug. 2022. [7] J. Li, W. Liang, Y. Li, Z. Xu, X. Jia, and S. Guo, “Throughput maximization of delay-aware DNN inference in edge computing by exploring DNN model partitioning and inference parallelism,” IEEE Transactions on Mobile Computing, vol. 22, no. 5, pp. 3017–3030, May 2023. [8] Y. Kang, J. Hauswald, C. Gao, A. Rovinski, T. Mudge, J. Mars, and L. Tang, “Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,” in Proceedings of the 22nd International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), 2017, pp. 615–629. [9] Z. Xu, D. Yang, C. Yin, J. Tang, Y. Wang, and G. Xue, “A coscheduling framework for DNN models on mobile and edge devices with heterogeneous hardware,” IEEE Transactions on Mobile Computing, vol. 22, no. 3, pp. 1275–1288, 2023. [10] H. Li, X. Li, Q. Fan, Q. He, X. Wang, and V. C. M. Leung, “Distributed dnn inference with fine-grained model partitioning in mobile edge computing networks,” IEEE Transactions on Mobile Computing, vol. 23, no. 10, pp. 9060–9074, Oct. 2024. [11] O. Goldreich, Foundations of Cryptography: Volume 2, Basic Applications. Cambridge University Press, 2004, published May 2004. [12] M. Rigaki and S. Garcı́a, “A survey of privacy attacks in machine learning,” ACM Computing Surveys, vol. 56, no. 4, pp. 1–34, 2023. [13] R. Zhao, Y. Zhang, T. Wang, W. Wen, Y. Xiang, and X. Cao, “Visual content privacy protection: A survey,” ACM Computing Surveys, vol. 57, no. 5, pp. 122:1–122:36, 2025. [14] Z. Wang, Y. Sun, D. Liu, J. Hu, X. Pang, Y. Hu, and K. Ren, “Location privacy-aware task offloading in mobile edge computing,” IEEE Transactions on Mobile Computing, vol. 23, no. 3, pp. 2269–2283, Mar. 2024. [15] W. Zeng, T. Xu, Y. Chen, Y. Zhou, M. Zhang, J. Tan, C. Hong, and M. Li, “Towards efficient privacy-preserving machine learning: A systematic review from protocol, model, and system perspectives,” arXiv preprint arXiv:2507.14519, 2025. [16] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, “GAZELLE: A low latency framework for secure neural network inference,” in 27th USENIX Security Symposium, 2018, pp. 1651–1669, ePrint 2018/073. [17] S. Wagh, D. Gupta, and N. Chandran, “SecureNN: Efficient and private neural network training,” in Proceedings on Privacy Enhancing Technologies (PETS), vol. 2019, no. 2, 2019, pp. 26–49, ePrint 2018/442. [18] B. D. Manh, C.-H. Nguyen, D. T. Hoang, D. N. Nguyen, M. Zeng, and Q.-V. Pham, “Privacy-preserving cyberattack detection in blockchainbased IoT systems using AI and homomorphic encryption,” IEEE Internet of Things Journal, vol. 12, no. 11, pp. 16 478–16 492, 2025. [19] A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomorphic encryption schemes,” ACM Computing Surveys, vol. 51, no. 4, pp. 79:1–79:35, 2018. [20] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” in Proceedings of the 33rd International Conference on Machine Learning (ICML), 2016, pp. 201– 210. [21] E. Lee, J.-W. Lee, J. Lee, Y.-S. Kim, Y. Kim, J.-S. No, and W. Choi, “Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions,” in Proceedings of the 39th International Conference on Machine Learning (ICML), 2022, pp. 12 403–12 422. [22] J. H. Ju, J. Park, J. Kim, M. Kang, D. Kim, J. H. Cheon, and J. H. Ahn, “NeuJeans: Private neural network inference with joint optimization of convolution and FHE bootstrapping,” in Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 4361–4375. [23] J. H. Cheon, K. Han, A. Kim, M. Kim, and Y. Song, “Bootstrapping for approximate homomorphic encryption,” in Advances in Cryptology – EUROCRYPT 2018, 2018, pp. 360–384. [24] J. H. Cheon, M. Kang, T. Kim, J. Jung, and Y. Yeo, “Batch inference on deep convolutional neural networks with fully homomorphic encryption

16

using channel-by-channel convolutions,” IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 2, pp. 1674–1685, 2025. [25] P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,” arXiv preprint arXiv:1812.00564, 2018. [26] D. Pasquini, G. Ateniese, and M. Bernaschi, “Unleashing the tiger: Inference attacks on split learning,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 2113–2129. [27] X. Niu et al., “PrivaScissors: Enhance the privacy of collaborative inference through the lens of mutual information,” arXiv preprint arXiv:2306.07973, 2023. [28] N. D. Pham, K. T. Phan, and N. Chilamkurti, “Enhancing accuracy– privacy trade-off in differentially private split learning,” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 9, no. 1, pp. 988–1000, 2025. [29] T. Khan, M. Budzys, and A. Michalas, “Split happens: Combating advanced threats with split learning and function secret sharing,” in IEEE Conference on Communications and Network Security (CNS), 2025, pp. 1–9. [30] G.-L. Pereteanu, A. Alansary, and J. Passerat-Palmbach, “Split HE: Fast secure inference combining split learning and homomorphic encryption,” arXiv preprint arXiv:2202.13351, 2022. [31] K.-Y. Lam, X. Lu, L. Zhang, X. Wang, H. Wang, and S. Q. Goh, “Efficient FHE-based privacy-enhanced neural network for trustworthy AIas-a-service,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4451–4468, 2024. [32] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology – ASIACRYPT 2017, 2017, pp. 409–437. [33] E. Rescorla, “The transport layer security (tls) protocol version 1.3,” RFC 8446, 2018. [Online]. Available: https://www.rfc-editor.org/rfc/ rfc8446 [34] F. Schroff, D. Kalenichenko, and J. Philbin, “FaceNet: A unified embedding for face recognition and clustering,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015, pp. 815–823. [35] ETSI, “Multi-access edge computing (MEC); study on MEC security,” European Telecommunications Standards Institute, Tech. Rep. GR MEC 041 V3.1.1, 2024. [Online]. Available: https://www.etsi.org/deliver/etsi gr/mec/001 099/041/03.01.01 60/gr mec041v030101p.pdf [36] ——, “Multi-access edge computing (MEC); framework and reference architecture,” European Telecommunications Standards Institute, Tech. Rep. GS MEC 003 V4.1.1, 2024. [Online]. Available: https://www.etsi.org/deliver/etsi gs/mec/001 099/003/04.01. 01 60/gs mec003v040101p.pdf [37] F. McKeen, I. Alexandrovich, I. Anati, D. Caspi, S. Johnson, R. LeslieHurd, and C. Rozas, “Intel software guard extensions (Intel SGX) support for dynamic memory management inside an enclave,” in Proceedings of the Hardware and Architectural Support for Security and Privacy 2016, 2016. [38] M. Sabt, M. Abi Aad, and J. Pellegrino, “Trusted execution environment: What it is, and what it is not,” 2015 IEEE Trustcom/BigDataSE/ISPA, pp. 57–64, 2015. [39] H. Chen, K. Laine, R. Player, and Y. Xia, “Efficient homomorphic conversion between (ring) LWE ciphertexts,” in Applied Cryptography and Network Security, ser. Lecture Notes in Computer Science, vol. 11464, 2019, pp. 1–18. [40] V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” in Advances in Cryptology – EUROCRYPT 2010, 2010, pp. 1–23. [41] S. Halevi and V. Shoup, “Algorithms in helib,” in Advances in Cryptology – CRYPTO 2014, 2014, pp. 554–571. [42] H. Chen, K. Laine, and R. Player, “Simple encrypted arithmetic library – seal v2.1,” IACR Cryptology ePrint Archive, Report 2017/224, 2017. [Online]. Available: https://eprint.iacr.org/2017/224 [43] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998. [44] A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009. [45] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2009, pp. 248–255.

[46] A. Dosovitskiy and et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” in International Conference on Learning Representations (ICLR), 2021. [47] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014, published as a conference paper at ICLR 2015. [Online]. Available: https://arxiv.org/abs/1412.6980 [48] S. Kornblith, J. Shlens, and Q. V. Le, “Do better ImageNet models transfer better?” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 2661–2671. [49] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al., “PyTorch: An imperative style, high-performance deep learning library,” in Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), vol. 32, 2019, pp. 8024–8035. [50] H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jégou, “Training data-efficient image transformers & distillation through attention,” in Proceedings of the International Conference on Machine Learning (ICML), 2021, pp. 10 347–10 357. [51] L. N. Smith and N. Topin, “Super-convergence: Very fast training of neural networks using large learning rates,” in Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications, vol. 11006, 2019. [52] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” in International Conference on Learning Representations (ICLR), 2018. [53] S. Yun, D. Han, S. J. Oh, S. Chun, J. Choe, and Y. Yoo, “Cutmix: Regularization strategy to train strong classifiers with localizable features,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019. [54] Z. Zhong, L. Zheng, G. Kang, S. Li, and Y. Yang, “Random erasing data augmentation,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 07, pp. 13 001–13 008, 2020. [55] C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2818–2826, 2016. [56] D. Technologies, “Openfhe: Open-source fully homomorphic encryption library,” https://github.com/openfheorg/openfhe-development, 2022, version 1.0. [57] HomomorphicEncryption.org, “Homomorphic encryption security standard,” HomomorphicEncryption.org, Tech. Rep., 2018. [Online]. Available: https://homomorphicencryption.org/standard/ [58] J.-P. Bossuat, R. Cammarota, J. H. Cheon, I. Chillotti, B. R. Curtis, W. Dai, H. Gong, E. Hales, D. Kim, B. Kumara, C. Lee, X. Lu, C. Maple, A. Pedrouzo-Ulloa, R. Player, L. A. Ruiz Lopez, Y. Song, D. Yhee, and B. Yildiz, “Security guidelines for implementing homomorphic encryption,” Cryptology ePrint Archive, Paper 2024/463, 2024. [Online]. Available: https://eprint.iacr.org/2024/463 [59] X. Jiang, M. Kim, K. Lauter, and Y. Song, “Secure outsourced matrix computation and application to neural networks,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018, pp. 1209–1222. [60] M. Kim, X. Jiang, K. Lauter, E. Ismayilzada, and S. Shams, “Secure human action recognition by encrypted neural network inference,” Nature Communications, vol. 13, no. 1, p. 4799, 2022. [61] W.-j. Lu, Z. Huang, C. Hong, Y. Ma, and H. Qu, “PEGASUS: Bridging polynomial and non-polynomial evaluations in homomorphic encryption,” in 2021 IEEE Symposium on Security and Privacy (SP), 2021, pp. 1057–1073. [62] T. Weyand, A. Araujo, B. Cao, and J. Sim, “Google landmarks dataset v2 – a large-scale benchmark for instance-level recognition and retrieval,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 2575–2584. [63] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervision,” in Proceedings of the 38th International Conference on Machine Learning (ICML), 2021, pp. 8748–8763.

17

A PPENDIX C AUTOMATED DATASET C ONSTRUCTION WITH D UAL V ERIFICATION

Fig. 6: Illustration of query encoding with power-of-two padding and slot replication. The feature vector f is padded to fpadded with mpadded = 2⌈log2 m⌉ , then replicated across S slots to form frep with npack = ⌊S/mpadded ⌋.

A PPENDIX A E NCODING W ORKFLOW I LLUSTRATIONS This appendix collects the main encoding workflow illustrations used to support the query encoding, RowHyDiag matrix encoding, and bias encoding procedures described in Section III of the main manuscript, specifically Fig. 6, Fig. 7, and Fig. 8. These figures first show the square-case layouts, which provide the basic intuition for padding, slot replication, row packing, and bias placement.

A PPENDIX B N ON -S QUARE E NCODING E XAMPLES Building on the square-case illustrations in Appendix A, this appendix provides non-square examples that clarify how the same RowHyDiag and bias-encoding rules apply when the number of rows and columns are not equal. For a representative non-square case, we consider an original weight matrix of size 6 × 15 under CKKS slot size S = 32. Column alignment gives mpadded = 16, and row packing with npack = 2 produces a packed matrix of size npacked × S = 3 × 32. To enable power-of-two scheduling in subsequent encrypted computation, the packed matrix is then padded to npadded = 4 rows, yielding Wpacked ∈ R4×32 . Fig. 9 visualizes this full pipeline (row packing, row padding, and blockwise diagonal extraction) and clarifies how non-square dimensions map to the packed CKKS layout. For the same non-square setting (n = 6, mpadded = 16, npack = 2), bias encoding follows the same block structure used by packed matrix-vector accumulation. The bias vector b ∈ R6 is mapped by ibias = p npack + blk, so valid class biases are placed at the leading positions of each block and all remaining slots are zero-filled. Fig. 10 illustrates this blockaligned placement, which ensures that ciphertext-plaintext bias addition remains index-consistent with the reduced accumulator slots.

This appendix presents the general data-construction methodology used in this work, i.e., web crawling, semantic filtering, and visual verification. The goal is to describe a reusable pipeline design independent of any specific dataset. To build a high-quality image dataset, we design a collection pipeline consisting of web crawling and dual-stage filtering. The pipeline ensures that collected images are diverse, visually relevant, and suitable for deep learning training. We first define target classes with distinguishable visual characteristics, then crawl publicly available images licensed for academic use, and finally apply two filtering stages to remove irrelevant or lowquality samples. Data Crawling: Some prior works have crawled images from Flickr, Wikimedia Commons, and Google Images. A commonly used source is Flickr (e.g., Oxford Buildings and Paris datasets), where data are collected through the Flickr REST API using text queries, tags, and license filters. Wikimedia Commons is also widely used; for example, Google Landmarks Dataset v2 [62] is built from web-scale landmark sources. Because Flickr API access became restricted to Pro subscribers from August 2024, our framework uses Wikimedia Commons API category crawling. For each target class, we collect candidate images via category traversal and retain only Public Domain or research-permitted licensed content. Semantic Verification: Crawled images may still include irrelevant content due to ambiguous names, incorrect tags, or noisy categories. We therefore use CLIP ViT-B/32 [63] for semantic filtering. For each class, we define multiple text prompts based on class names and characteristics, embed both text and images into CLIP space, compute similarities, and keep an image only if its maximum prompt similarity exceeds a predefined threshold. KNN-Based Visual Verification: Even after semantic filtering, some images may remain visually mismatched (e.g., cartoons, misleading metadata, or unrelated scenes). We therefore apply a second stage based on visual similarity to high-quality reference galleries. For each candidate image, we compute similarity scores against gallery embeddings, retrieve the top-k neighbors above threshold, and keep the image only if at least ⌈k/2⌉ of the k nearest neighbors belong to the target class. A PPENDIX D AUSTRALIAN L ANDMARKS DATASET C ONSTRUCTION S TATISTICS Building on the general pipeline in Appendix C, this appendix instantiates the same process for the 9-class Australian landmarks dataset and reports the final quantitative statistics used in the main experiments. A. Dataset Collection and Construction To evaluate our privacy-preserving landmark recognition framework, we construct a dataset of 9 Australian landmarks using the two-stage verification pipeline. The primary crawler source is the Wikimedia Commons API, which provides

18

Row packing

Pad to

Packed Matrix

rows

Padded Matrix Blockwise Diagonal Extraction

Fig. 7: Illustration of RowHyDiag matrix encoding. Row packing (square example): rows of W are packed to form Wpacked with mpadded = m and npacked = 2. Pad to npadded rows: Wpacked is aligned as the padded packed matrix. Blockwise diagonal extraction: diagonal plaintexts diag0 and diag1 are generated for encrypted linear-layer evaluation. TABLE VI: Dual-stage filtering pipeline statistics Landmark

Fig. 8: Square-case bias encoding illustration (4 × 4 example).

public-domain and Creative Commons licensed images suitable for academic research. We first identify Wikimedia category pages for each target landmark (e.g., Category:Sydney_Opera_House, Category:Uluru), then recursively traverse categories and subcategories to collect candidate images and metadata. For each image, we retain only samples with licenses permitting research use, enforce a minimum resolution of 224 × 224, and remove duplicates using MD5 hash matching. The remaining candidates are filtered in two stages. Stage 1 (CLIP semantic verification): with 9 landmarks and 4 prompts per landmark, we build 36 prompts and compute image-text similarity using CLIP [63]. A sample is accepted only if its maximum similarity exceeds τCLIP = 0.24 and the highestscoring prompt belongs to the correct landmark class. Stage 2 (reference-gallery visual verification): we run kNN retrieval against landmark-specific reference galleries selected for viewpoint and illumination diversity. A sample is accepted only if

Crawled

Stage 1 Passed

Stage 2 Passed

Final Accepted

Sydney Opera House Sydney Harbour Bridge Uluru Great Ocean Road Great Barrier Reef Blue Mountains Flinders Street Station Parliament House Surfers Paradise

2,660 2,522 804 1,601 2,112 780 669 597 1,156

2,023 1,959 772 1,345 1,762 570 579 462 973

1,943 1,836 760 1,277 1,700 521 563 442 842

1,943 1,836 760 1,277 1,700 521 563 442 842

Total

12,901

10,445

9,884

9,884

Filtering Effectiveness: Stage 1 pass rate: Stage 2 pass rate: Overall pass rate:

80.96% (CLIP semantic filter) 94.63% (Reference visual filter) 76.62% (Dual-stage combined)

at least ⌈k/2⌉ of its k = 8 nearest neighbors belong to the target class and exceed cosine similarity threshold τref = 0.28. Table VI summarizes filtering statistics, and Table VII reports the final train/test split. In Table VI, the Stage 2 and Final columns are identical because no additional filtering is applied after Stage 2. The Australian Landmarks dataset is published on Hugging Face at https://huggingface.co/datasets/huyn1602/ Australian Landmarks Dataset. A PPENDIX E C ONVERGENCE A NALYSIS OF M ODEL F INE -T UNING This appendix reports convergence behavior for all finetuned models to confirm that each reaches a stable operating

19

Row packing

Pad to

Packed Matrix

rows

Padded Matrix Blockwise Diagonal Extraction

Fig. 9: Non-square-case workflow of RowHyDiag encoding (6 × 15 example). Row packing: rows of W are packed to form a 3 × 32 matrix with mpadded = 16 and npacked = 3 (npack = 2). Pad to npadded rows: the packed matrix is zero-padded to 4 × 32 with npadded = 4. Blockwise diagonal extraction: diagonal plaintexts are generated from Wpacked for encrypted matrix-vector computation. TABLE VII: Final dataset statistics (train/test split) Landmark

Fig. 10: Non-square bias encoding example. The original bias vector b ∈ R6 is distributed across npack = 2 blocks of size mpadded = 16. Block 0 contains biases b0 , b2 , b4 at positions 0, 1, 2, while block 1 contains biases b1 , b3 , b5 at positions 16, 17, 18. Remaining positions are zero-padded.

point before encrypted inference. Fig. 11 consolidates training and validation convergence across all four datasets and shows stable behavior without erratic validation fluctuations. For MNIST (Fig. 11(a)), convergence is rapid: by epoch 12, training and validation accuracies reach 99.65% and 99.47%, respectively, with a very small gap. For CIFAR-10 (Fig. 11(b)), the model reaches 99.94% training and 97.05% validation accuracy at epoch 20; the larger but still controlled gap is consistent with higher natural-image variability and task difficulty compared with MNIST. For CIFAR-100 (Fig. 11(c)), ViT-B/16 converges more gradually under stronger augmentation and One-Cycle scheduling, with training accuracy increasing from 3.96% to 94.06% and validation accuracy from 32.15% to 92.63% over 100 epochs; the best validation point is 92.69%

Train (80%)

Test (20%)

Sydney Opera House Sydney Harbour Bridge Uluru Great Ocean Road Great Barrier Reef Blue Mountains Flinders Street Station Parliament House Surfers Paradise

1,554 1,468 608 1,021 1,360 416 450 353 673

389 368 152 256 340 105 113 89 169

Total

7,903

1,981

at epoch 87. For the Australian landmarks dataset (Fig. 11(d)), ResNet34 improves from 78.38% to 97.91% training accuracy and from 87.47% to 93.54% validation accuracy across 35 epochs, with the best checkpoint at epoch 33 (93.92% validation accuracy). Overall, these results confirm that all selected checkpoints (99.47% MNIST, 97.05% CIFAR-10, 92.69% CIFAR100, and 93.92% landmarks) provide stable and reliable feature representations for encrypted final-layer inference. This is important because the encrypted stage evaluates only the final classifier on extracted embeddings; therefore, post-training convergence directly determines the performance upper bound of encrypted inference.

20

Training and Validation Accuracy on MNIST

Accuracy (%)

100

99

98 Training Accuracy Validation Accuracy Best Model (Epoch 12, 99.47%)

97 1

2

4

6

8

Epoch

10

12

(a) Training and Validation Accuracy on CIFAR-10

Accuracy (%)

100

96

92 Training Accuracy Validation Accuracy Best Model (Epoch 20, 97.05%)

88 1

5

10

15

Epoch

20

(b) Training and Validation Accuracy on CIFAR-100

100

Accuracy (%)

80 60 40 20

Training Accuracy Validation Accuracy Best Model (Epoch 87, 92.69%)

0 1

20

40

60

Epoch

80

100

(c) Training and Validation Accuracy on Australian Landmarks

100

Accuracy (%)

95 90 85 80

Training Accuracy Validation Accuracy Best Model (Epoch 33, 93.92%)

75 1

5

10

15

20

Epoch

25

30

35

(d)

Fig. 11: Fine-tuning convergence across all evaluated datasets: (a) MNIST, (b) CIFAR-10, (c) CIFAR-100, and (d) Australian landmarks. ResNet-34 on MNIST, CIFAR-10, and Australian landmarks converges quickly with small train–validation gaps, while ViT-B/16 on CIFAR-100 converges more gradually but remains stable at a high-accuracy operating point.

Related documents

• ATLAS: Automated Approximation of Transformers for Efficient Homomorphic Inference in One Hour#677696
• ATLAS: Automated Approximation of Transformers for Efficient Homomorphic Inference in One Hour#674495
• ATLAS: Automated Approximation of Transformers for Efficient Homomorphic Inference in One Hour#405569
• Trust in Edge-Enabled IoT Security: Features, Challenges and Research Directions#1051075
• Trust in Edge-Enabled IoT Security: Features, Challenges and Research Directions#1028582