💻 computer science

Jaguar: Fast Private CNN Inference with Power-of-Two Homomorphic Arithmetic

Jaguar is a private CNN inference system that leverages a power-of-two ciphertext ring to enable efficient scalar-polynomial convolution and exact local truncation, thereby eliminating protocol bottlenecks and achieving significantly lower latency and communication overhead compared to state-of-the-art hybrid HE/2PC solutions.

Original authors: Yewon Jeong, Nayoung Jung, Hyeri Roh, Woo-Seok Choi

Published 2026-06-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yewon Jeong, Nayoung Jung, Hyeri Roh, Woo-Seok Choi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you want to ask a super-smart chef (the Server) to cook a complex meal for you using your secret family recipe (the Client's data). You don't want the chef to see your recipe, and the chef doesn't want to reveal their secret cooking techniques (the Model).

To solve this, you use a special "magic kitchen" where the ingredients are locked in unbreakable boxes (Encryption). The chef can cook with the boxes without ever opening them. This is called Private Inference.

However, there's a problem: The current magic kitchens are slow and clumsy. The chef spends 99% of the time just trying to figure out how to mix the ingredients inside the boxes, and they have to do extra, unnecessary steps to make sure the measurements are precise.

Enter Jaguar, a new system designed to fix these bottlenecks. Here is how it works, using simple analogies:

1. The Old Way: The "Prime Number" Trap

Most previous systems used a rule based on Prime Numbers (like 7, 13, 17) to do the math inside the locked boxes.

The Problem: Prime numbers are great for general math, but they are terrible for the specific type of "mixing" (convolution) needed for image recognition. It's like trying to cut a perfect square cake using a circular saw. You have to do a lot of extra cutting and sanding (modular reduction) to make the pieces fit, which slows everything down.
The Precision Mess: Also, when the chef mixed the ingredients, the measurements got too big (doubled precision). The chef had to cook with the big measurements, then stop, call a second person to chop them down to size (truncation), and then check if the food was good (ReLU). This was two separate, slow steps.

2. The Jaguar Solution: The "Power-of-Two" Switch

Jaguar makes one bold change: It switches the math rule from Prime Numbers to Powers of Two (like 2, 4, 8, 16, 32).

Why this helps: In the digital world, powers of two are like "perfectly fitting Lego bricks." You don't need to sand or cut anything. If you need to reduce a number, you just "mask" the extra bits off (like snapping off a Lego piece). This makes the math incredibly fast.

3. The Three Magic Tricks of Jaguar

A. The "Scalar-Polynomial" Kitchen (SPA-CONV)

Old Way: The chef had to multiply two giant, complex recipes together at once. This was heavy and slow.
Jaguar Way: Because the math is now based on powers of two, the chef doesn't need to multiply two giant recipes. Instead, they just take a single ingredient (a scalar), multiply it by a recipe, and slide it over. They do this many times and add the results.
The Result: It's like swapping a heavy industrial mixer for a simple, fast hand whisk. The paper claims this makes the "mixing" step 2 to 3 times faster than the previous best systems.

B. The "Pre-Trim" Trick (Exact Truncation)

Old Way: The chef cooked with oversized measurements, then had to stop and call a second person to trim the excess.
Jaguar Way: Because the math is based on powers of two, the chef can simply shift the decimal point (a "right shift") before checking if the food is good.
The Result: The trimming happens instantly, inside the box, with zero extra communication. The "chopping" step is completely eliminated. This saves a massive amount of time and data transfer.

C. The "Secret Tool" for the Chef (NTT-Assisted Decryption)

The Concern: You might worry, "If we stop using Prime Numbers, won't the chef get stuck when they finally need to open the box to see the result?"
The Fix: Jaguar allows the chef to use a special, temporary "Prime Number tool" only for the final step of opening the box. This tool is kept secret and local to the chef.
The Result: The chef gets the speed of the "Lego" math for 99% of the work, but still gets the precision of the "Prime" math for the final reveal.

The Final Scorecard

The researchers tested Jaguar on famous image-recognition models (like ResNet and MobileNet) and compared it to the current leaders (Cheetah and Rhombus).

Speed: Jaguar is 2 to 3.7 times faster at the end-to-end task.
Communication: It sends 1.1 to 1.7 times less data back and forth between the client and server.
Accuracy: It maintains the same high accuracy as the original models.

In short: Jaguar realized that the old rules of the "magic kitchen" were holding everyone back. By switching to a simpler, more digital-friendly math system (Powers of Two) and reorganizing the cooking steps, it made private, secure image recognition significantly faster and more efficient.

Technical Summary: Jaguar

Problem Statement

Hybrid Homomorphic Encryption (HE) and Secure Two-Party Computation (2PC) frameworks currently represent the practical design point for exact private Convolutional Neural Network (CNN) inference, avoiding the accuracy degradation of fully homomorphic polynomial approximations. However, these systems face two critical bottlenecks:

HE Convolution Latency: The linear layer computation is dominated by Number Theoretic Transform (NTT)-based polynomial arithmetic and modular prime reductions. Profiling of state-of-the-art systems like Cheetah reveals that convolution alone consumes over 96% of linear-layer latency, with NTT operations and modular reductions accounting for the vast majority of this time.
Inefficient Precision Flow: In fixed-point inference, linear layers produce outputs at doubled fractional precision ( $2f$ bits). Conventional hybrid systems pass these wide-bitwidth values directly into ReLU protocols, followed by a separate, interactive 2PC truncation protocol to restore the target precision. This approach incurs unnecessary computational costs for the wider bitwidth during ReLU and adds significant communication overhead for the truncation step.

The root cause of both issues is the reliance on prime-modulus arithmetic (specifically NTT-friendly primes) inherited from standard FHE library designs. While optimal for generic polynomial multiplication, this regime is suboptimal for hybrid HE/2PC systems, which perform single linear layers followed by immediate conversion to additive shares over $\mathbb{Z}_{2^\ell}$ .

Methodology

Jaguar addresses these bottlenecks through a single, central design choice: adopting a power-of-two ciphertext ring ( $q = 2^Q, p = 2^P$ ) as the arithmetic substrate, rather than the conventional prime modulus. This choice enables three interconnected technical innovations:

1. SPA-CONV: Coefficient-Domain Convolution

By utilizing a power-of-two ring, Jaguar eliminates the need for NTT-based polynomial multiplication in the linear path. Instead, it employs Scalar–Polynomial Accumulation (SPA-CONV).

Mechanism: Convolution is evaluated as a sum of shifted scalar–polynomial products. For each filter weight (scalar), the system performs a coefficient-wise shift of the input ciphertext and accumulates the result.
Advantage: This approach replaces expensive polynomial-by-polynomial multiplication and modular prime reductions with scalar–polynomial multiplications, coefficient shifts, and bitwise masking (for reduction modulo $2^Q$ ). It requires no plaintext–ciphertext polynomial multiplication or server-side NTT.

2. Exact Pre-ReLU Ciphertext-Side Truncation

The power-of-two modulus ensures that the BFV scale factor $\Delta = q/p = 2^{Q-P}$ is also a power of two.

Mechanism: This divisibility allows for exact truncation directly on the ciphertext components via arithmetic right shifts (implemented as logical shifts on unsigned residues) before the ReLU operation.
Benefit: This eliminates the need for a separate, interactive 2PC truncation protocol. Furthermore, it reduces the bitwidth of the input to the ReLU protocol from $\ell$ to $\ell-f$ , thereby reducing the communication and computational cost of the non-linear stage.

3. NTT-Assisted Decryption

While the server-side linear path avoids NTT, the client must still perform a polynomial multiplication ( $\hat{c}'_1 \cdot \hat{s}$ ) during decryption.

Mechanism: Jaguar recovers the efficiency of NTT for this specific local operation by using an auxiliary NTT-friendly prime ( $q_{ntt}$ ) solely on the client side. The client maps coefficients to this auxiliary prime, performs the multiplication via NTT, and maps the result back to the power-of-two ring.
Benefit: This preserves the $O(N \log N)$ complexity for client-side decryption without disturbing the power-of-two protocol substrate or introducing NTT costs on the server.

Key Contributions

Power-of-Two Arithmetic Substrate: Jaguar is the first HE/2PC system to use a power-of-two ciphertext ring as the central arithmetic regime for ImageNet-scale CNN inference, moving away from the standard NTT-prime backend.
SPA-CONV Kernel: A novel convolution kernel that evaluates pointwise, dense, and depthwise convolutions as sums of scalar–polynomial products and coefficient shifts, eliminating NTT and modular prime reductions in the linear path.
Zero-Communication Truncation: A proof of correctness for exact ciphertext-side truncation that removes the post-ReLU truncation protocol entirely, a feature absent in prior hybrid systems.
NTT-Assisted Decryption: A client-local technique that utilizes an auxiliary prime to maintain decryption efficiency without compromising the protocol's power-of-two design.

Experimental Results

The authors evaluated Jaguar on ImageNet-scale ResNet-18, ResNet-50, and MobileNetV2 using a dual Intel Xeon Gold 6250 setup with AVX disabled.

Latency: Jaguar achieves 2.07–3.72× lower end-to-end latency than Cheetah and 2.16–3.36× lower than Rhombus across LAN and WAN settings.
- On ResNet-50, convolution-kernel latency drops by 79%.
- The ReLU+truncation stage sees a 2.32× (LAN) and 1.80× (WAN) latency reduction.
Communication: Jaguar reduces communication by 1.16–1.76× compared to Cheetah.
- The truncation stage communication is reduced to zero.
- ReLU communication is reduced due to the smaller input bitwidth.
- Note: On ResNet-50, Jaguar's communication is slightly higher than Rhombus (1.28×) because Rhombus is specifically optimized for the pointwise and matrix-vector components dominating ResNet-50's communication, whereas Jaguar trades a portion of communication for significantly lower compute across the entire convolution path. However, on ResNet-18 and MobileNetV2, Jaguar outperforms Rhombus in both latency and communication.
Microbenchmarks: In compute-only convolution benchmarks (AVX disabled), Jaguar shows geometric mean speedups of 2.47× (dense), 11.82× (pointwise), and 11.65× (depthwise) over Cheetah for packed layouts.

Significance

The paper claims that Jaguar demonstrates that changing the fundamental HE arithmetic regime—from prime-modulus to power-of-two—unlocks substantial gains for practical private CNN inference that cannot be achieved by merely optimizing packing or communication on top of conventional backends. By aligning the ciphertext modulus with the share domain ( $\mathbb{Z}_{2^\ell}$ ) and enabling reduction-free arithmetic, Jaguar resolves the primary bottlenecks of HE convolution and precision flow simultaneously. The system proves that a power-of-two ring is not only viable but superior for hybrid HE/2PC inference, provided that the specific requirements of convolution (scalar–polynomial accumulation) and decryption (local NTT recovery) are addressed.