Hardware Accelerators

[Janmajayamall]

Checking Craterlake - https://dl.acm.org/doi/pdf/10.1145/3470496.3527393. Craterlake accelerates both HE operations and bootstrapping for CKKS (including fully packed bootstrapping)

A few points to note:

1. Table 3 show impressive performance increase over baseline CPU.
2. Comment on HE-MPC based accelerators:

HE-MPC accelerators are hampered by communication: To
avoid the overheads of FHE, recent work has proposed accelerators
for private deep learning that combine shallow homomorphic encryption (HE) with multi-party computation (MPC): Gazelle [43]
and Cheetah [59]. These systems require very frequent communication with the client, essentially after every single level of multiplication. So while they reduce accelerator overheads, they are limited
by high client-server communication and client encryption/decryption overheads. Delphi [52] shows that each DNN inference takes
gigabytes of traffic, which dominates performance. However, the
above accelerators do not consider this traffic. CHOCO [64] shows
that, even after accelerating client operations, communication costs
dominate.

3. Comment that "GPUs are inefficient on FHE" Section 10

While the data-parallel
nature of GPUs may seem a good fit for FHE, these efforts achieve
modest speedups over multicore CPUs. This is because GPUs lack
modular arithmetic, cannot implement all-to-all operations like
NTTs and automorphisms efficiently, and their on-chip memories
are too small to enable sufficient reuse (Fig. 11), despite their use
of HBM. Specifically, state-of-the-art GPU approaches carefully
tune algorithms to achieve high off- and on-chip bandwidth utilization [42]; however, this prior work [42] is 200× slower than
CraterLake. This shows that CraterLake’s high reuse is crucial: to
achieve the same throughput as CraterLake, a GPU would need
over 100 TB/s of memory bandwidth.

[Janmajayamall]

SoK on FHE accelerators - https://arxiv.org/pdf/2212.01713.pdf

One of the author (from HKUST) is working on another FHE accelerator for both arithmetic schemes (CKKS) and binary schemes (TFHE) and may include modules to switch between them. For more information check this comment - https://github.com/google/heir/discussions/39#discussioncomment-7998502

[Janmajayamall]

ISA details of BASALISC (https://eprint.iacr.org/2022/657) - https://github.com/google/heir/discussions/55#discussioncomment-6471392

BASALISC differs from (other ASIC) accelerators mentioned in SoK (https://arxiv.org/pdf/2212.01713.pdf) as it provides necessary APIs only for polynomial operations (& other maintenance things) as opposed to implementations for key-switching (or bootstrapping)