GPU-Accelerated Encrypted Neural Network Training Gets a 48× Speedup — But the Finish Line Is Still Far Away

A Rust CKKS implementation moves homomorphic-encryption training onto the GPU, cutting 100-update MNIST training from 4 hours to 5 minutes. Honest about what it doesn't yet prove.

Imagine you're doing long division, but you're wearing oven mitts. Every step — carry the remainder, multiply, subtract — takes ten times longer because you can't feel the pencil. Now imagine someone hands you a calculator that still requires oven mitts, but it processes each button press in parallel across a hundred fingers at once. You're still encumbered, but the wall-clock time collapses. That's what this paper does for neural network training under homomorphic encryption: the math is still expensive, but GPU parallelism absorbs the overhead. The committed claim: a single-author, MIT-licensed Rust CKKS implementation that moves encrypted neural network training — including bootstrapping, the most expensive operation in leveled HE — onto the GPU, achieving a 48.68× speedup over its own CPU path on a matched 100-update MNIST experiment. Decoded parameters are bitwise identical between CPU and GPU runs. A separate full training run (10 passes over 4,800 images, 1,000 updates) reaches 90.35% MNIST test accuracy versus 90.41% for a plaintext twin. The ladder here is unusual and the author is admirably honest about it. The natural comparison target is ReBoot (Lou et al., 2024), the current reference for non-interactive encrypted training. But this paper explicitly declines to claim unconditional superiority: the released ReBoot baseline doesn't meet the community's security-estimator threshold, and its full-setting CPU time is unmeasured. So the paper's primary comparison is internal — GPU vs. CPU on its own implementation — rather than head-to-head against the field's best. That's scientifically clean but it means we don't actually know where this sits on the absolute performance ladder. Architecturally, this is CKKS (approximate arithmetic HE) with rectangular diagonal packing, baby-step giant-step ciphertext-matrix evaluation, and feature-major SIMD mini-batch lanes. The key move is device-resident bootstrapping — keeping the ciphertext refresh cycle on the GPU rather than round-tripping to the host, which is where the 48× comes from. Key generation and client-side operations remain on the CPU. The implementation is in Rust with a CUDA backend, which is a pragmatic choice for reproducibility and integration. Integrity is a mixed bag. On the positive side: code is released, parameters are verified bitwise at 100 updates, and the author is unusually transparent about limitations — noting that the 48× ratio is internal, that the full 1,000-update CPU/GPU parameter match isn't verified, that a larger-batch key-switch target was missed, and that the ReBoot baseline has security issues. On the negative side: this is MNIST, the smallest possible demonstration; there's no independent replication; and the full-run accuracy comparison (90.35% vs 90.41%) is reported without confidence intervals or variance across seeds. The milestone question is where the rubber meets the road. Encrypted training at MNIST scale has been demonstrated before; the novelty here is the GPU acceleration, not the task. The next meaningful milestone is encrypted training on a non-trivial dataset — CIFAR-10 or a small tabular task — in under an hour, with accuracy parity to plaintext. That likely requires both algorithmic improvements to bootstrapping cost and larger GPU memory to hold deeper ciphertext pipelines. We're probably 2-4 years from that if the community invests. The obvious experiment the author didn't run: a direct wall-clock comparison against ReBoot under matched security parameters. The paper gives the honest reason — ReBoot's released code doesn't meet security thresholds — but a fixed-up ReBoot comparison would have been the headline result. My read: the author tried, hit the security-parameter mismatch, and correctly chose not to publish an apples-to-oranges number. That's integrity, but it also means the paper's competitive position is unresolved.