POSEIDON: Privacy-Preserving Federated Neural Network Learning

I. INTRODUCTION

• Neural networks’ data requirements motivate collaboration, but sensitive data, regulation, and competition can prevent sharing; outsourcing to a trusted party adds cost and a single point of failure.The paper describes confidentiality agreements as time-consuming and costly to prepare.Source: §I · p. 1
• POSEIDON uses multiparty lattice-based homomorphic encryption to protect training data, weights, gradients, and evaluation data across N parties, including against passive collusions of up to N−1.It supports fully connected, convolutional, and pooling layers, and encrypted models can perform inference on encrypted evaluation data.Source: §I · p. 2
• POSEIDON achieves training accuracy on par with centralized or decentralized non-private approaches; it trains a 3-layer MNIST network on 60K samples across 10 parties in 1.4 hours.Its computation and communication overhead scales linearly with the number of parties and logarithmically with features and neurons per layer.Source: §I · p. 2
• Alternating packing enables SIMD operations on encrypted data; arbitrary linear transformations improve bootstrapping, and constrained optimization selects cryptographic parameters.The generic neural-network protocol depends on dataset size and network structure.Source: §I · p. 2

II. RELATED WORK

• Earlier N-party privacy-preserving learning systems support linear or generalized linear models, and SPINDLE does not provide the protocols needed for neural networks.The introduction also notes that some prior cryptographic approaches use traditional encryption vulnerable to post-quantum attacks.Source: §I · p. 1, §II · p. 2
• Prior neural-network privacy work largely addresses inference or centralized training, whereas POSEIDON covers both training and inference in an N-party setting.Inference systems protect a server’s model and clients’ evaluation data; centralized training approaches rely on a trusted party or impractical homomorphic-encryption performance or parameters.Source: §II · pp. 2–3
• Existing MPC-based neural-network training uses two, three, or four servers and outsourced data, while POSEIDON keeps data local and supports N parties under a dishonest-majority, passive-adversary model.The paper contrasts POSEIDON’s linear communication scaling with quadratic scaling in MPC-based solutions.Source: §I · pp. 1–2, §II · p. 3
• Federated-learning updates can leak local data, and differential privacy can reduce model utility; POSEIDON keeps intermediate updates and final weights encrypted.The paper notes that parties decrypting an aggregate model between iterations may infer information about other parties’ data.Source: §I · pp. 1–2, §II · p. 3

III. PRELIMINARIES

• The preliminaries introduce neural-network and MHE background for POSEIDON’s privacy-preserving training and inference in a federated N-party setting.Source: §III · p. 3

A. Neural Networks

• MLPs comprise an input layer, one or more hidden layers, and an output layer, with each neuron connected to every neuron in the next layer.The paper describes neural-network training as iterative feed-forward and backpropagation passes through linear and nonlinear transformations.Source: A. Neural Networks · pp. 3–4
• For MLPs, each layer applies a linear transformation to the previous layer’s activations followed by an activation function, and backpropagation updates weights using mini-batch gradient descent.Each iteration uses a random batch of size B to reduce a cost function such as mean squared error.Source: A. Neural Networks · p. 4
• Convolutional neural-network layers follow similar forward and backpropagation steps; the protocols represent convolutional operations as matrix multiplications and use pooling for downsampling,.Pooling computes the minimum, maximum, or average over each kernel-sized input region, depending on the pooling type.Source: A. Neural Networks · p. 4

B. Distributed Deep Learning

• Each party performs b local SGD iterations and computes partial gradients; parties average them for each model update across m global iterations, equivalent to batch size B=b×N,.The paper describes this as a MapReduce abstraction for data-parallel neural-network training.Source: B. Distributed Deep Learning · p. 4

C. Multiparty Homomorphic Encryption (MHE)

• The CKKS-based MHE scheme distributes the secret key among parties, requires all parties to decrypt, and supports floating-point computation, collaborative operations, and collective key switching.Its security relies on the ring learning with errors problem, which the paper says provides resistance to post-quantum attacks.Source: C. Multiparty Homomorphic Encryption… · p. 4
• A plaintext encodes a vector of up to N/2 values in a cyclotomic polynomial ring of dimension N, where N is a power of two.The scheme defines its plaintext and ciphertext space over that ring.Source: C. Multiparty Homomorphic Encryption… · p. 4
• The scheme provides homomorphic addition, multiplication, and rotation, as well as collective key switching and bootstrapping for encrypted computations.Bootstrapping restores a ciphertext to its initial level and scale; without it, an initial-level ciphertext supports circuits of at most L depth.Source: C. Multiparty Homomorphic Encryption… · p. 4

L. This is done by the bootstrapping functionality (DBootstrap(·)). Encode(·) enables us to pack several values into one ciphertext and operate on them in parallel.

• DKeySwitch requires interaction among all parties, while KS uses a special public key and is non-interactive.Collective key-switching decrypts results or changes a ciphertext’s encryption key; local key-switching supports slot rotations and relinearization after multiplication.Source: L. This is done by the bootstrapping… · p. 5

IV. SYSTEM OVERVIEW

• Section IV introduces POSEIDON’s system and threat model, objectives, and high-level functionality.The functionality is described in Sections IV-C and IV-D.Source: §IV · p. 5

A. System and Threat Model

• N parties train a neural network from local data and one-hot labels; a party or external querier can obtain predictions on confidential evaluation data.The parties seek to protect their local data, intermediate model updates, and resulting model.Source: A. System and Threat Model · p. 5
• The parties are organized as a tree for communication efficiency, but the system is fully distributed and does not depend on network topology.The paper gives fully connected and star networks as alternatives.Source: A. System and Threat Model · p. 5
• The threat model allows passive collusion by up to N−1 parties; prediction-phase membership and model-inversion attacks are out of scope.The paper discusses complementary mechanisms to bound information inferred by a querier and an active-adversary extension in Appendix G-A.Source: A. System and Threat Model · p. 5

B. Objectives

• POSEIDON aims to protect parties’ data, the querier’s data, intermediate updates, and final model weights during training and evaluation.In inference, model holders should not learn the querier’s data or predictions, and the querier should not obtain model weights.Source: B. Objectives · p. 5
• Data confidentiality means parties learn no more about another honest party’s input than can be deduced from their own inputs, or the querier’s input and output.This objective applies during both training and prediction.Source: B. Objectives · p. 5
• Model confidentiality means parties learn no more about trained weights than can be deduced from their own inputs, or the querier’s input and output.This objective applies during both training and prediction.Source: B. Objectives · p. 5

C. Overview of POSEIDON

• POSEIDON keeps model weights encrypted under the parties’ collective public key and uses homomorphic computation and key switching for training and oblivious inference.The parties can compute on local data and encrypted weights, then collectively re-encrypt prediction results under the querier’s public key.Source: C. Overview of POSEIDON · p. 6
• Packing enables SIMD operations on layer weights, while activation-function approximations and collective bootstrapping support encrypted forward and backward passes.The approximated functions include Sigmoid, Softmax, and ReLU; bootstrapping refreshes ciphertexts.Source: C. Overview of POSEIDON · p. 6
• POSEIDON presents synchronous distributed learning protocols; an extension to asynchronous distributed neural networks is provided in Appendix G-B.Source: C. Overview of POSEIDON · p. 6

D. High-Level Protocols

• The protocol uses four phases—PREPARE, MAP, COMBINE, and REDUCE—within an extended MapReduce abstraction for privacy-preserving machine-learning computations.It describes federated neural-network training among N parties.Source: D. High-Level Protocols · p. 6
• In PREPARE, parties agree on network and learning parameters, generate keys, securely normalize or standardize data, pack inputs and labels, and initialize encrypted global weights.The parameters include layer sizes, learning rate, iteration count, activation functions and approximations, and local batch size.Source: D. High-Level Protocols · p. 6
• For MAP, the root sends current encrypted weights to each party, which performs local gradient descent using b forward and backward passes over its batch.The protocol uses Xavier initialization for sigmoid or tanh layers and He initialization for ReLU layers.Source: D. High-Level Protocols · pp. 6–7
• In COMBINE, parents homomorphically sum encrypted local gradients; in REDUCE, the root updates weights using averaged gradients over the global batch of size |B|=b×N.Training stops after a predefined number of epochs.Source: D. High-Level Protocols · p. 7
• For prediction, the querier encrypts evaluation data under the parties’ collective key, and the parties key-switch encrypted forward-pass results so only the querier can decrypt them.Any party can perform oblivious inference, but distributed bootstrapping and key switching require collaboration among all parties.Source: D. High-Level Protocols · p. 7

V. CRYPTOGRAPHIC OPERATIONS AND OPTIMIZATIONS

• The broader section proceeds from AP to encrypted activation functions, cryptographic building blocks and execution complexity, then constrained optimization of cryptoscheme parameters.The optimization uses a cost function to choose parameters.Source: §V · p. 7

A. Alternating Packing (AP) Approach

• Packing enables SIMD computation across ciphertext slots, while AP processes batch samples one at a time to avoid backpropagation transposes and reduce rotations to logarithmic scaling.The approach targets costly key-switch operations associated with rotations.Source: A. Alternating Packing (AP) Approach · pp. 7–8
• AP alternates row- and column-based packing across consecutive fully connected layers, pads matrices to power-of-two dimensions, and reduces packing transformations between layers.Each layer’s weights use the opposite packing orientation from the previous layer.Source: A. Alternating Packing (AP) Approach · pp. 7–8
• Protocol 3 initializes encrypted weights and encodes each party’s inputs and labels using network dimensions, replication, flattening, and zero gaps.Its generic procedure covers an ℓ-layer MLP and distinguishes flattening matrix rows, columns, or vector inputs.Source: A. Alternating Packing (AP) Approach · p. 8
• Packed rows or columns must align across layers for forward and backpropagation multiplications; gaps and rotations enable this alignment during offline preparation.The passage points to the corresponding operations in Table I.Source: A. Alternating Packing (AP) Approach · p. 8
• For convolutional layers, AP decomposes each input sample into kernel-sized matrices, packs them with gaps, and replicates the weight matrix accordingly.When followed by another convolutional or downsampling layer, gaps are unnecessary and slots are rearranged during training; average pooling is incorporated into bootstrapping.Source: A. Alternating Packing (AP) Approach · p. 8
• For high-depth convolutional layers, alternating row/column packing places all kernels in one ciphertext, trading k MAP-phase multiplications for lower communication overhead.Downsampling layers have no weight matrix and are excluded from offline packing.Source: A. Alternating Packing (AP) Approach · p. 8

• Sigmoid and Softmax use least-squares polynomial approximations evaluated in ⌈log(da+1)⌉ levels for degree da [41], while ReLU uses a least-squares approximation of softplus.Source: B. Approximated Activation Functions · p. 9
• Xavier or He initialization and privacy-preserving collective normalization narrow activation input ranges; approximation intervals and degrees are selected from privacy-preserving data-distribution heuristics [42].Source: B. Approximated Activation Functions · p. 9
• In the forward pass, each layer applies its approximated activation, and backpropagation multiplies the corresponding activation derivative element-wise into its error signal.The first-layer gradient also uses DBootstrapALT.Source: B. Approximated Activation Functions · p. 9

• The pipeline covers a 2-layer MLP with Alternating Packing (AP), and orange steps indicate operations introduced to DBootstrapALT(·).Source: Table I · p. 9

C. Cryptographic Building Blocks

• DBootstrapALT samples Gaussian error with σ=3.2 and requires Q_l > (N+1)||msg||·2^λ.The protocol description specifies independently sampled error coefficients and this modulus constraint.Source: C. Cryptographic Building Blocks · p. 10
• RIS computes packed-vector inner sums and RR replicates slots using log2(s) rotations each, motivating POSEIDON’s embedding of rotations and pooling in bootstrapping.RIS uses iterative left rotations and additions; RR uses right rotations and additions. Rotations are costly cryptographic functions, so the modified bootstrapping performs some required rotations or pooling operations automatically.Source: C. Cryptographic Building Blocks · p. 10
• POSEIDON modifies distributed bootstrapping to apply arbitrary linear transformations, collectively switching CKKS ciphertexts to secret-shared plaintexts before re-encryption.This addresses the CKKS limitation of prior BFV bootstrapping protocols; DBootstrapALT returns a level-L ciphertext encrypting φ(msg), and the authors state that secret-sharing preserves RLWE security.Source: C. Cryptographic Building Blocks · p. 10
• POSEIDON reduces transpose costs by processing batch samples in parallel, replicating vector values instead of transposing weights, and embedding rotations in DBootstrapALT.The replication approach uses RR and RIS to perform the product’s inner sum; embedding the required log2(k) rotations in bootstrapping further reduces the work when bootstrapping is needed before multiplication.Source: C. Cryptographic Building Blocks · p. 10

D. Execution Pipeline

• Each layer’s forward and backward pass uses one RIS and one RR, except the last layer; DBootstrapALT embeds masking and rotations to reduce computational cost.The pipeline extends to an ℓ-layer MLP, and the table description assumes initial level L=7.Source: D. Execution Pipeline · pp. 10–11
• Convolutional layers follow the fully connected pipeline, with fewer RIS operations; DBootstrapALT can embed pooling and its derivative instead of a separate slot-rearrangement operation.When a convolutional layer feeds a fully connected layer, RR prepares the flattened output; when it feeds pooling, the modified bootstrap embeds pooling and its derivative.Source: D. Execution Pipeline · p. 11
• POSEIDON evaluates average pooling by embedding its forward computation and derivative in DBootstrapALT, saving log2(h) rotations and additions and one level when masking is needed.Max/min pooling are nonlinear and remain impractical under encrypted arithmetic because they require high-precision approximations.Source: D. Execution Pipeline · p. 11

E. Complexity Analysis

• Table II expresses complexity in key-switch operations; KS and DBootstrap are two orders of magnitude slower than addition, making addition complexity negligible.KS(·) is distinct from DKeySwitch(·).Source: E. Complexity Analysis · p. 11
• Communication complexity depends only on party count N, ciphertexts sent per global iteration z, and ciphertext size |c|; distributed bootstrapping takes one communication round and scales with N and |c|.Building blocks requiring no communication are marked with −.Source: E. Complexity Analysis · pp. 11–12
• Forward and backward pass costs are per-layer FC estimates and overestimate CV costs; packing can save 2log2(hℓ) rotations per LGD computation.Packing also changes multiplication and rotation counts depending on layer structure and label packing.Source: E. Complexity Analysis · p. 11
• MAP costs are local per party and depend on layer count ℓ, while COMBINE aggregation is negligible; P1 performs REDUCE, SetScale divisions consume no levels, and activation costs depend on approximation degree da.The derivative ϕ′(·) has the same complexity as ϕ(·) with degree da−1.Source: E. Complexity Analysis · p. 11

F. Parameter Selection

• The parameter-selection cost function uses building-block complexities and integrates reduced rescaling, allowing r=Q/S consecutive multiplications before rescaling to reduce level consumption.Here Q is the ciphertext modulus and S is the initial scale.Source: F. Parameter Selection · p. 12
• The number of bootstraps B depends on total consumed levels, the bootstrap threshold L−τ, and r=Q/S, with complexity parameterized by ring size, network structure, and global iterations.The network parameters include layer count ℓ and neuron counts h1,h2,...,hℓ.Source: F. Parameter Selection · p. 12
• For fixed scale S and security level λ, the optimization selects N and L subject to Q^(L−τ)>2^λ|plaintext|N, with N determined by postQsec(Q,λ).The cost function uses initial level L for KS complexity for clarity, although actual KS cost depends on ciphertext level.Source: F. Parameter Selection · p. 12
• If the selected ring has too few slots for a weight matrix, POSEIDON splits its flattened weights across multiple ciphertexts and processes them in parallel; a 1,024×64 matrix with 4,096 slots uses 16 ciphertexts.The approach packs each weight matrix into one ciphertext when the available slots suffice.Source: F. Parameter Selection · p. 12

VI. SECURITY ANALYSIS

• With CKKS parameters providing post-quantum security level λ, POSEIDON achieves Data and Model Confidentiality during training against a passive adversary corrupting at most N−1 parties.The proof sketch relies on semantic security, simulatable protocols, and decryption requiring collaboration of all parties.Source: §VI · pp. 12–13
• Because intermediate and final model weights remain encrypted, POSEIDON protects trained-model confidentiality and eliminates federated-learning attacks targeting those parameters or the final model [53], [78], [86], [120].The model is treated as a function of the parties’ inputs.Source: §VI · p. 13
• During prediction, POSEIDON achieves Data and Model Confidentiality against passive adversaries corrupting at most N−1 parties, including confidentiality of the querier’s input.Membership inference [102] and model inversion are explicitly out of scope.Source: §VI · p. 13

VII. EXPERIMENTAL EVALUATION

• The evaluation compares POSEIDON with state-of-the-art privacy-preserving solutions; Table III reports accuracy and execution times for 10 parties and compares model accuracy with non-private approaches.The supplied table passage gives no result values.Source: §VII · p. 13, Table III · p. 14

A. Implementation Details

• POSEIDON is implemented in Go using Lattigo for multiparty cryptography and Onet for decentralized TCP communication over TLS-secured channels.Source: A. Implementation Details · p. 13

B. Experimental Setup

• Experiments use Mininet with 0.17 ms average delay and 1 Gbps bandwidth, and default to 10 or 50 parties with 32-bit precision and six levels.They run on 10 Linux servers with Intel Xeon E5-2680 v3 CPUs; polynomial parameters are N=2^13 or 2^14 depending on feature dimension.Source: B. Experimental Setup · p. 13

C. Datasets

• The evaluation uses BCW, MNIST, ESR, CREDIT, SVHN, CIFAR-10, CIFAR-100, and synthetic datasets to assess scalability.SVHN is converted to grayscale; dimensions are padded to powers of two for training, and datasets are randomly and evenly distributed among parties.Source: C. Datasets · p. 13

D. Neural Network Configuration

• Configurations range from 2-layer, 64-neuron fully connected networks for BCW, ESR, and CREDIT to deeper or convolutional models for image datasets.Training uses 100 to 54,000 global iterations across datasets; the default local batch size is 10, and learning parameters are selected by grid search with 3-fold cross-validation on clear data.Source: D. Neural Network Configuration · p. 14

E. Empirical Results

• POSEIDON improves model accuracy by 1−3% over local training and is on par with centralized and decentralized non-private approaches.The reported accuracy gain is more significant when data is partitioned across 50 parties.Source: E. Empirical Results · p. 14, §VIII · p. 16
• POSEIDON reaches 864,000 MNIST predictions per hour; with 10 parties it trains MNIST in 1.4 hours and BCW, ESR, and CREDIT each in under 15 minutes.MNIST training takes less than an hour with 20 parties using the same local batch size.Source: E. Empirical Results · pp. 14–15
• Runtime is almost independent of party count at fixed samples per party, decreases with parallel processing at fixed total samples, and scales linearly with sample count.Runtime also scales proportionally with layers when layer type and size are fixed; for feature counts above 64, one-cipher runtime grows more than multi-cipher runtime.Source: E. Empirical Results · p. 15, Figure 2 · p. 15

F. Comparison with Prior Work

• For a 3-layer, 128-neuron MNIST network over 15 epochs, POSEIDON takes 73.1 hours, compared with SecureML at 81.7, SecureNN at 1.03, and FALCON [111] at 0.56 hours.The comparison uses N=3 and POSEIDON’s approximated activation functions; POSEIDON accuracy is 92.5% with SmoothReLU and 96.2% with tanh.Source: F. Comparison with Prior Work · pp. 15–16
• POSEIDON yields >94% accuracy in the compared MNIST settings, while Shokri and Shmatikov achieve similar accuracy only at privacy budget per parameter ≥10 and ≤90% at budgets 0.001, 0.01, or 0.1.The paper contrasts DP’s privacy–accuracy tradeoff with POSEIDON’s accuracy–complexity tradeoff.Source: F. Comparison with Prior Work · p. 16
• For one batch of 60 samples, POSEIDON takes 6.3s in a single thread and 1s in 30 threads, versus 33,840s and 2,400s for Nandakumar et al..POSEIDON reports 128-bit security versus 80 bits for; for batch B=192, CryptoDL takes 10,476.3s versus POSEIDON’s 34.7s.Source: F. Comparison with Prior Work · p. 16

VIII. CONCLUSION

• POSEIDON performs both neural-network training and inference in an N-party setting while protecting data and model confidentiality against collusions of up to N−1 parties.It uses lattice-based multiparty homomorphic encryption and extended distributed bootstrapping under a passive-adversary model.Source: F. Comparison with Prior Work · p. 16, §VIII · p. 16

APPENDIX A SYMBOLS AND NOTATIONS

• Table V summarizes the symbols and notation used throughout the paper.Source: Appendix A · p. 18, Table V · p. 19

APPENDIX B COMPARISON TO OTHER STATE-OF-THE-ART SOLUTIONS

• Table VI compares private deep-learning frameworks by MPC setup, confidentiality adversary capabilities, and the maximum collusion among training or inference servers.The authors restrict fair comparison to collusions among the parties responsible for training.Source: Appendix B · p. 18, Table VI · p. 20
• POSEIDON is presented as the only solution that trains and evaluates neural networks in an N-party setting while protecting data and model confidentiality against collusions of up to N−1 parties.The authors distinguish this federated-learning approach from cloud-outsourcing models.Source: Appendix B · p. 18

APPENDIX C APPROXIMATED ACTIVATION FUNCTION ALTERNATIVES

• SmoothReLU (softplus) gives the better degree-3 approximation, while the ReLU-equivalent alternative better approximates exact ReLU at degree 7 with one extra multiplicative-depth level; POSEIDON uses SmoothReLU for efficiency.The alternatives are fitted using least squares.Source: Appendix C · p. 18
• The derivative of softplus is sigmoid, whose approximation is used as the derivative; Chebyshev bounds maximum error asymptotically but needs a larger degree than least squares for high accuracy.Least squares minimizes squared error over an interval, while Chebyshev is more appropriate for keeping error bounded throughout it.Source: Appendix C · p. 19

APPENDIX D APPROXIMATION OF THE MAX/MIN POOLING AND ITS DERIVATIVE

• Repeated power-and-renormalization steps increase the ratio of the largest input to the others and make the normalized maximum tend toward 1; equal inputs remain at 0.5.For vectors, each iteration raises values to a power and normalizes by their powered sum, then multiplies by the original vector to extract the maximum.Source: Appendix D · p. 20
• The direct max-pooling approach approximates the square-root in max(a,b) with a polynomial and uses log(f) rotations and bootstraps for a kernel of size f; the authors recommend average-pooling as more efficient and precise.The iterative alternative requires an expensive inverse, especially for high accuracy or very small inputs.Source: Appendix D · p. 20

APPENDIX E TECHNICAL DETAILS OF DISTRIBUTED BOOTSTRAPPING WITH ARBITRARY LINEAR TRANSFORMATIONS (DBOOTSTRAPALT(·))

• DBootstrapALT(·) applies a linear transformation to secret-shared plaintext during bootstrapping, before the refreshed ciphertext is reconstructed.The protocol uses the conversion from ciphertext to secret-shared values; arbitrary-precision complex arithmetic preserves lower bits when encoding, decoding, and transforming values of magnitude 100 to 200 bits.Source: Appendix E · p. 20
• DBootstrapALT(·) provides the same security as Mouchet et al.’s original DBootstrap(·) protocol under the passive-adversary model.The proof follows the original protocol’s security analysis, with Lemma 1 establishing statistical indistinguishability of shares in C.Source: Appendix E · p. 20
• During DBootstrapALT(·), parties sample polynomial masks uniformly from [0, 2^(λ+δ)), bounding the probability of a distinguishable coefficient by 2^-λ.The parties estimate the message magnitude from the circuit and expected input range to derive δ.Source: Appendix E · p. 21
• The ciphertext modulus must exceed (N+1)·||M|| when bootstrapping is called to accommodate additions of N masks without modular reduction.The appendix characterizes the protocol as equivalent to a depth-3-to-4 circuit, yet says its cost remains negligible compared with centralized bootstrapping when transformations use rotations.Source: Appendix E · p. 21

APPENDIX F SUPPLEMENTARY EXPERIMENTAL RESULTS

• Appendix F supplies supplementary POSEIDON microbenchmarks and execution times for various neural-network architectures omitted from the main text.These results are presented as further experimental results due to space constraints.Source: Appendix F · p. 21

A. Microbenchmarks

• Max-pooling is 6 times slower than average-pooling, achieves 7-bit final precision, and takes 4.72s at 12-bit precision.The passage attributes its greater communication to numerous DBootstrap(·) operations and says this supports using average-pooling in the encrypted domain.Source: A. Microbenchmarks · p. 21
• The PREPARE offline phase generates collective encryption, decryption, evaluation, and rotation keys, with rotation-key generation consuming most time and bandwidth.REDUCE updates one weight matrix in the root and collectively refreshes it.Source: A. Microbenchmarks · p. 21

B. Benchmarks on Various Neural Network Topologies

• Topology benchmarks report execution times per global iteration for feed-forward and backpropagation, alongside the number of communications, across networks parameterized by (d,h1,h2,h3).The setup uses b=12, B=120, N=10 parties, and ASigmoid with da=3; communication covers COMBINE and DBootstrap(·) operations.Source: Table VII · p. 21, B. Benchmarks on Various Neural… · p. 22

C. Benchmarks on Various Convolutional Neural Network Topologies

• The CNN benchmark reports extrapolated per-global-iteration execution times for various topologies, using batch size B=120 and N=10 parties.Times combine forward and backpropagation because derivative-of-pooling operations are included in the bootstrapping function; topology encodes padded feature count, convolution and pooling kernel sizes, and fully connected layer dimensions.Source: C. Benchmarks on Various Convolutional… · pp. 22–23, Table IX · p. 23

APPENDIX G EXTENSIONS

• APPENDIX G presents security, learning, and optimization extensions that can be integrated into POSEIDON.Source: Appendix G · p. 23

A. Security Extensions

• POSEIDON protects training data and model confidentiality against passive adversaries with up to N−1 colluding parties, but active-adversary defenses remain future work.Verifiable computation such as zero-knowledge proofs and redundant computation could address active adversaries at increased computational cost; prediction-query limits or output noise could mitigate membership inference [102], model inversion, and model stealing [107].Source: A. Security Extensions · p. 23

B. Learning Extensions

• POSEIDON’s learning extensions include early stopping via validation-error aggregation and asynchronous training, although collective bootstrapping still requires every party to be available.Early-stop options include GLα, PQα, and UPs; after global iterations, parties homomorphically aggregate validation errors for collective decryption, with negligible loss leakage when validation samples are sufficient. Centralized bootstrapping could support unavailable parties but would increase ciphertext size and overhead.Source: B. Learning Extensions · p. 23
• Asynchronous learning decreased accuracy by 1–4% with 40–80% server failure probability, while one party holding 90% of MNIST data decreased accuracy by 6%.The preliminary analysis used the evaluation network; uneven and asynchronous distributions were otherwise considered orthogonal to the work. Non-iid data can cause parameter divergence, and proposed mitigations include hyperparameter adjustments or sharing uniformly distributed data [68], [118].Source: B. Learning Extensions · p. 23
• For LSTMs, RNNs, and ResNets, POSEIDON requires adapting LGD computation and packing; ResNet skip connections require ciphertext-slot alignment, achievable with DBootstrapALT(·).The existing packing protocols are tailored to MLPs and CNNs.Source: B. Learning Extensions · p. 24

C. Optimization Extensions

• CNN optimization can embed costly FFT/inverseFFT domain switching into distributed bootstrapping when multiple convolutional layers precede a fully connected layer; GPU acceleration remains an option.GPU support requires GPU-compatible cryptographic functions and extending Lattigo; Badawi et al. [18] report one-to-two-orders-of-magnitude speedups for GPU CKKS over CPU.Source: C. Optimization Extensions · p. 24