Training TFHE-Based Neural Networks with Approximated Floating-Point Arithmetic
Authors: Emanuele Nicoletti (Politecnico di Milano), Fabrizio Pittorino (Politecnico di Milano), Alessandro Falcetta (Politecnico di Milano), Luca Colombo (Politecnico di Milano), Manuel Roveri (Politecnico di Milano)
Volume: 2026
Issue: 4
Pages: 376–395
DOI: https://doi.org/10.56553/popets-2026-0126
Artifact: Available, Functional
Abstract: Training neural networks under Torus Fully Homomorphic Encryption (TFHE) is severely constrained by the native restriction of the scheme to boolean and integer arithmetic, forcing prior work to rely on quantized integer pipelines limited to shallow MLPs. We present a framework that enables approximate floating-point training within TFHE by reinterpreting IEEE 754 representations as encrypted integers and operating on them with redesigned arithmetic. Our core contribution adapts L-mul, an approximate integer-based multiplication, to the encrypted setting, introducing numerical safeguards that prevent catastrophic wrap-around errors near zero and in subnormal ranges. We extend this approach to approximate division and implement exact addition and square root, yielding a sufficient arithmetic for backpropagation with SGD. For CPU-based FP32 encrypted operations, our approach achieves up to 2.1x faster multiplication and 29.3x faster division compared to state-of-the-art exact TFHE floating-point arithmetic, alongside up to 57x lower peak memory. Using these primitives, we perform, to our knowledge, the first fully encrypted training of a small-scale CNN under TFHE. To bypass the prohibitive overhead of training deep networks in this encrypted environment, we utilize plain-text emulation. We ensure strict output alignment by verifying that the network parameters generated during emulation are identical to those produced by the encrypted execution. Leveraging this equivalence, we use emulation to evaluate convergence on larger architectures (LeNet-5, VGG-style CNNs, and ResNet-20) across six benchmarks from MNIST variants to CIFAR-10 and medical imaging, matching exact-arithmetic baselines within 1% accuracy. Fully encrypted training of these deeper models remains beyond current hardware; we provide wall-clock projections quantifying this gap.
Keywords: fully homomorphic encryption, TFHE, encrypted training, neural network training, floating-point, L-mul
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
