Scientific knowledge map · Paper #59
F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption (Extended Version)
2021 · 54th IEEE/ACM International Symposium on Microarchitecture (MICRO)
- Applied
- algorithm
Research question
What does the paper try to establish?
Can one programmable hardware architecture accelerate complete fully homomorphic encryption programs, rather than isolated cryptographic kernels, enough to offset most software overhead?
Central answer
What is the proposed answer?
F1 combines wide FHE-specific vector units, static compiler scheduling, and an explicitly managed memory hierarchy designed around data movement. RTL synthesis and cycle-accurate simulation across seven full workloads report a 5,432-fold geometric-mean speedup over a multicore CPU, with important simulation, scheme-support, and control-flow boundaries.
Evidence profile
Six dimensions, kept separate
The chart summarizes documented evidence and process. It is not a correctness probability, confidence score, or ranking, and no composite score is calculated.
LowMediumHighN/A = not assessed
A smaller value means less documented support for that dimension, not that the paper is false or unimportant.
- Epistemic evidence High
-
The source documents RTL synthesis, a cycle-level model, complete workloads, multiple baselines, traffic analysis, sensitivity studies, and functional checking. The absence of fabricated-silicon measurements remains an explicit boundary.
RTL synthesis, area, frequency, and power model Cycle-accurate methodology, workloads, and baselines Full-program and microbenchmark performance Data movement, sensitivity, scalability, and functional simulation - Auditability High
-
The complete extended PDF is checked in with page count and SHA-256 and is linked to its arXiv source and related official DOI. No public code or simulator artifact is represented.
Problem, architecture thesis, and headline results Related MICRO publication identity - Production provenance Medium
-
Authors, extended-version date, synthesis process, benchmark systems, and related conference DOI are documented, but exact source, RTL, compiler, and simulator revisions are not public in this record.
RTL synthesis, area, frequency, and power model Cycle-accurate methodology, workloads, and baselines Related MICRO publication identity - External scrutiny Medium
-
MICRO publication establishes strong venue scrutiny, but review reports and an independently reproducible hardware artifact are not linked.
Related MICRO publication identity - Reception High
-
The dated exact-DOI OpenAlex record located 262 citations. Under the author-defined rule, 11 or more located citations is High; the count is index- and date-dependent.
Dated citation-count snapshot - Contribution significance High
-
The work advances from operation kernels to full programmable FHE workloads and has substantial measured scholarly reception. This rating does not validate every benchmark assumption or confer correctness.
Problem, architecture thesis, and headline results Full-program and microbenchmark performance Dated citation-count snapshot
Assessment: Ai draft author review pending · 2026-07-11 · rubric 0.2. These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.
Top-down and bottom-up view
Hierarchical knowledge map
Collapse a branch for a top-level reading, or follow its source links and child nodes to audit the evidence and boundaries underneath it.
F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption
A synthesized programmable FHE accelerator and scheduling compiler evaluated by cycle-accurate simulation on complete encrypted workloads.
Problem, architecture thesis, and headline results-
question Research question
research questionCan architecture and compiler co-design accelerate complete parameter-diverse FHE dataflow graphs while keeping their massive data movement manageable?
Problem, architecture thesis, and headline results -
contribution Central answer
simulated and synthesizedSpecialize high-throughput vector units to FHE primitives, expose all data movement to a static compiler, and prioritize reuse through scratchpads and distributed register files rather than relying on a host for unsupported operations.
Vector architecture and managed hierarchy Dataflow translation and static scheduling compiler Automorphism and four-step NTT units -
scope FHE workload model
explicitly scopedFHE programs are known-ahead-of-time dataflow DAGs over large encrypted vectors. F1 supports the common ciphertext operations needed by BGV, GSW, and CKKS; data-dependent branching is unavailable and B/FV is not directly supported by this design.
FHE programming model, operations, and security parameters Scheme, branching, and evidence boundaries -
system F1 architecture rtl implemented
Sixteen compute clusters combine NTT, automorphism, modular multiply and add units with local registers, a banked 64 MB scratchpad, three crossbar networks, and dual HBM2 interfaces.
Vector architecture and managed hierarchy Automorphism and four-step NTT units RTL synthesis, area, frequency, and power model-
mechanism FHE-specific wide-vector units
rtl implementedDedicated four-step NTT and automorphism pipelines handle the structured permutations that do not map well to ordinary element-wise SIMD, while modular units provide high arithmetic throughput.
Automorphism and four-step NTT units -
mechanism Data-movement-first hierarchy
rtl implementedExplicit register files and scratchpad storage, decoupled loads, and high-throughput interconnects are designed to reuse key-switch hints and ciphertexts and hide off-chip latency.
Vector architecture and managed hierarchy Data movement, sensitivity, scalability, and functional simulation
-
-
algorithm Static scheduling compiler
implementedThe compiler lowers homomorphic operations to primitive dataflows, chooses operation variants, assigns compute and storage, schedules transfers far ahead of use, and emits cycle-level instructions with fixed component latencies.
Dataflow translation and static scheduling compiler -
evidence group Implementation evidence
rtl synthesizedComponents are implemented in RTL and synthesized in a commercial 14/12 nm flow. The modeled 151.4 square millimeter design runs most logic at 1 GHz, double-pumps SRAM at 2 GHz, and has a reported 180.4 W thermal design power.
RTL synthesis, area, frequency, and power model -
evidence group Evaluation design cycle accurate simulation
A cycle-accurate simulator and RTL-derived activity energies evaluate logistic regression, two LoLa networks with weight variants, encrypted database lookup, and BGV and CKKS bootstrapping against a four-core Xeon baseline; HEAX is used for operation-level comparison.
Cycle-accurate methodology, workloads, and baselines-
claim 5,432-fold geometric-mean full-program speedup
simulated measurementAcross seven workloads the reported speedups range from 1,195-fold to 17,412-fold over the CPU, with LoLa-CIFAR falling from about 20 minutes to 241 ms in the model.
Full-program and microbenchmark performance -
claim Operation-level speedups over HEAX extension
simulated microbenchmarkNTT, automorphism, homomorphic multiplication, and permutation microbenchmarks report roughly 172-fold to 1,866-fold speedups over an augmented HEAX design across selected parameter sets.
Full-program and microbenchmark performance -
evidence Data movement and ablation analysis
sensitivity studyTraffic breakdowns show key-switch hints dominate high-depth workloads, while alternate low-throughput units and a generic capacity-aware scheduler substantially slow the design, supporting the paper's co-design rationale.
Data movement, sensitivity, scalability, and functional simulation
-
-
artifact Functional simulator
internal simulator describedA C++ simulator built on NTL checks FHE-level input-output behavior and produces dataflow graphs for supported parameter ranges, but its internal algorithms are not the same as the RTL functional units.
Data movement, sensitivity, scalability, and functional simulation -
limitation group Boundaries
materialResults come from RTL synthesis and cycle-accurate simulation, not fabricated silicon; the architecture assumes static branch-free FHE DAGs, omits direct B/FV support, compares to a particular CPU and augmented prior accelerator, and does not expose a reproduction artifact in this map.
FHE programming model, operations, and security parameters Cycle-accurate methodology, workloads, and baselines Scheme, branching, and evidence boundaries -
artifact group Versioned paper resources
source availableThe complete extended version is checked in with fixity metadata. The DOI identifies the related, distinct MICRO conference version; this map does not treat the two author lists or texts as byte-identical.
Problem, architecture thesis, and headline results Related MICRO publication identity -
scrutiny External scrutiny
venue reviewedThe related F1 paper appeared at MICRO 2021 and the extended manuscript exposes more detail. Review reports and independent hardware reproduction are not linked.
Related MICRO publication identity -
lineage From kernel accelerators to complete programs
documentedF1 positions itself against host-assisted accelerators for isolated FHE operations by supporting all operations of complete selected programs in one compiler-controlled architecture.
Problem, architecture thesis, and headline results Full-program and microbenchmark performance
Audit trail
Source index
Locators state the depth of the current audit. PDF page numbers, where present, are one-based file pages; metadata-, summary-, and abstract-bounded records explicitly identify their limitations.
- Problem, architecture thesis, and headline results Abstract and Section 1, PDF pages 1-2
- FHE programming model, operations, and security parameters Section 2, PDF pages 2-4
- Vector architecture and managed hierarchy Section 3, PDF pages 4-5
- Dataflow translation and static scheduling compiler Section 4, PDF pages 5-7
- Automorphism and four-step NTT units Section 5, PDF pages 7-9
- RTL synthesis, area, frequency, and power model Section 6 and Table 2, PDF pages 9-10
- Cycle-accurate methodology, workloads, and baselines Section 7, PDF pages 10-11
- Full-program and microbenchmark performance Section 8.1 and Tables 3-4, PDF pages 11-12
- Data movement, sensitivity, scalability, and functional simulation Sections 8.2-8.5, PDF pages 12-13
- Scheme, branching, and evidence boundaries Sections 1, 2.1, 2.5, 6-8, PDF pages 1-4 and 9-13
- Related MICRO publication identity DOI 10.1145/3466752.3480070; this map represents the distinct arXiv extended version
- Dated citation-count snapshot OpenAlex reported 262 citations for the DOI-identified MICRO work when accessed 2026-07-11