arXiv:2607.18342cs.CRcs.AI2026-07

提出敏感度感知的剪枝方法,提升加密神经网络可靠性。

PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption

  • 结合权重大小、多项式敏感度与旋转开销评分剪枝
  • 剪枝后灾难性错误层减少至最多2个,脆弱性降低29倍
  • 适合对加密推理可靠性要求高的场景

结构化剪枝对在同态加密(HE)下实现神经网络推理至关重要,但其对模型可靠性的影响尚未被研究。本文系统分析了剪枝后CKKS加密神经网络的可靠性,并提出多项式敏感度感知剪枝(PSAP),一种内生可靠性的结构化剪枝方法。PSAP联合考虑权重幅度、多项式激活敏感度和旋转成本对滤波器评分,将剪枝集中在容错区域。在两种架构、两个数据集、两种数值表示及五种比特错误率下(共40个全模型和108个逐层实验),PSAP剪枝模型的灾难性(>10个百分点精度下降)层最多为2个,而基于幅度剪枝的基线为5–14个,在int32位翻转注入下最坏情况脆弱性降低29倍。直接的CKKS加密故障注入表明安全操作边界位于BER~10^{-5},支持以int32注入作为保守的可靠性代理。故障关键结构层仅占总参数的1.1%,可实现低成本定向加固。同时保持良好效率:在ResNet-32上,PSAP将Halevi–Shoup旋转次数减少高达45.2%;自适应混合度分配方案将乘法深度从66层降至56层,实现无需引导的层级推理。

原文摘要 · Abstract (English)

Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.

神经网络加密剪枝同态加密可靠性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。