---
title: 'Falcon: Optimized HE-2PC Inference'
url: https://www.emergentmind.com/topics/falcon-bc4c92c0-1d5c-441b-80ce-4e8a4b0cedbc
type: topic
---

# Falcon: Optimized HE-2PC Inference

Searching arXiv for the specified Falcon paper and closely related HE-2PC/mobile inference work to ground citations.
Falcon is a homomorphic-encryption-based two-party computation framework for private neural-network inference that targets efficient architectures such as MobileNetV2 and EfficientNet, whose extensive use of depthwise and group convolutions exposes inefficiencies in prior HE-2PC systems. The framework is designed around the observation that existing approaches are not optimized for the computation characteristics and communication bottleneck of homomorphically encrypted depthwise convolutions, and that their packing procedures waste polynomial capacity through zero padding. Falcon addresses this by combining a zero-aware greedy packing algorithm with a communication-aware operator tiling strategy, yielding lower operator latency, lower end-to-end communication, and improved accuracy under iso-communication constraints, while preserving cryptographic security and inference correctness [2308.13189].

## 1. Problem formulation and system motivation

Falcon is situated in privacy-preserving inference under HE-based 2PC, where the dominant practical costs are not only arithmetic over encrypted data but also the representation of convolutional operators inside ciphertext-polynomial structures. The motivating claim is that existing HE-2PC frameworks, including CrypTFlow2, Iron, and Cheetah, are not well optimized for efficient networks such as MobileNetV2 and EfficientNet-Lite, even though such networks achieve state-of-the-art accuracy with lightweight computation in the plaintext setting [2308.13189].

The specific bottleneck identified by Falcon is the packing algorithm for depthwise convolutions. Previous methods, notably Cheetah and Iron, pack depthwise convolutions by naively padding with zeros to mimic dense convolutions. This creates large polynomials containing mostly zeros, which increases both communication and compute. Falcon treats this as a structural inefficiency rather than a cryptographic limitation. This suggests that the principal optimization space lies in how filters and activations are embedded into ciphertext-compatible layouts, rather than in changing the underlying HE-2PC security model.

Falcon therefore targets two coupled inefficiencies. First, prior methods optimize input packing but do not adequately optimize output communication, even though output ciphertext transfer dominates total bandwidth in practice, especially for depthwise convolutions. Second, prior packing layouts do not exploit the fact that the computation order of different convolution channels does not affect correctness, and thus do not reuse zero paddings between neighboring filters [2308.13189].

## 2. Zero-aware greedy packing for depthwise convolutions

Falcon’s first core contribution is a zero-aware greedy packing algorithm that formulates the packing of depthwise convolution filters as a shortest common superstring problem. Let $\{\tilde{W}_0,\ldots,\tilde{W}_{C-1}\}$ denote zero-padded filters. Falcon seeks a packing vector $\tilde{W}$ such that each $\tilde{W}_i$ is a subsequence of $\tilde{W}$ and the total packed length is minimized:

$$
\text{minimize } Len(\tilde{W})
\quad
\text{s.t. } \tilde{W}_i \text{ is a subsequence of } \tilde{W},\ \forall i.
$$

The operational intuition is that neighboring filters can share runs of zeros, so the packing should overlap these regions rather than duplicating them. Falcon uses Ukkonen’s SCS greedy algorithm, iteratively merging pairs of vectors with the longest shared zero overlap. The result is a denser weight polynomial with less zero waste [2308.13189].

The paper gives the coefficient mappings for packed depthwise convolution. For input tensor $\mathbf{X}[c,i,j]$ and weight tensor $\mathbf{W}[c',l,l']$, Falcon defines

$$
\hat{x} = \pi_{\mathrm{dwconv}^i}(\mathbf{X}),
\qquad
\hat{x}[cHW + iW + j] = \mathbf{X}[c,i,j],
$$

and

$$
\hat{w} = \pi_{\mathrm{dwconv}^w}(\mathbf{W}),
\qquad
\hat{w}[\mathrm{offset}(c')HW + O - lW - l'] = \mathbf{W}[c',l,l'].
$$

The offset calculation is chosen to arrange filters for maximal zero sharing. Falcon reports that utilization of weight polynomial coefficients is nearly doubled versus Cheetah, and that the method reduces both the number of polynomial multiplications and the number of ciphertexts. For large $C$, Falcon improves channel utilization from $\frac{1}{C_x}$ in Cheetah to $>\frac{2}{C_x+2}$ [2308.13189].

A central point is that these gains do not arise from approximating or changing the convolution semantics. The paper explicitly states that there is no loss in accuracy or correctness from zero-sharing rearrangements, and no reduction in cryptographic security or inference correctness [2308.13189].

## 3. Communication-aware tiling and extension to group convolutions

Falcon’s second core contribution is a communication-aware operator tiling strategy. Prior work is described as optimizing input packing but not output packing, whereas in deployment the transfer of output ciphertexts dominates total bandwidth. Falcon therefore chooses tiling parameters to balance the communication costs of inputs and outputs rather than maximizing only one side of the packing problem [2308.13189].

The optimization objective is stated as

$$
\text{minimize}\quad \left\lVert \frac{1}{C_x} + \frac{1}{C_w} \right\rVert
$$

subject to

$$
(C_x + 2)C_w \leq \frac{2N}{HW} + 2,
\qquad
C_x = kC_w,\; k\in\mathbb{Z}^+,
$$

where $N$ is the polynomial degree and $HW$ is the input spatial size. Here $C_x$ and $C_w$ represent input and weight polynomial sizes. Falcon explicitly allows a partial sacrifice of input packing in exchange for better output packing, with the goal of minimizing total communication [2308.13189].

This formulation is significant because it shifts optimization from a purely local operator view to a bandwidth-aware systems view. A plausible implication is that Falcon is especially well matched to WAN and communication-constrained deployments, which is consistent with the paper’s observation that Falcon’s latency improvement becomes even greater at reduced network bandwidths.

Falcon also extends its packing and tiling principles to group convolutions. The extension treats entire groups as atomic packing units, applying zero-aware packing across groups while using standard packing within a group. The paper presents this as natural support for group convolutions rather than as a separate mechanism, indicating that the packing abstraction is intended to generalize across efficient-convolution operators [2308.13189].

## 4. Operator-level and network-level performance

At the operator level, Falcon reports substantial gains over prior HE-based 2PC frameworks for depthwise convolution. Relative to Cheetah, communication is reduced by $1.4\times$ to $4.0\times$ and latency by $1.8\times$ to $3.2\times$. Relative to Iron, communication is reduced by $3.6\times$ to $11.8\times$. Relative to CrypTFlow2, latency is reduced by $15.6\times$ to $19.9\times$ [2308.13189].

Packing efficiency improves with larger polynomial degree $N$. At $N=4096$, Falcon reaches $4.0\times$ less communication than Cheetah. At $N=32768$, the communication reduction rises to $11.1\times$ over Cheetah and $32.9\times$ over Iron. The paper also states that latency improvement is greater at reduced bandwidths, reinforcing the role of communication as the practical bottleneck [2308.13189].

At the network level, Falcon is evaluated on MobileNetV2 and EfficientNet-Lite on CIFAR-100 and TinyImageNet. For MobileNetV2 on CIFAR-100, CrypTFlow2 requires 2.32GB and 622s, Cheetah 0.60GB and 132s, and Falcon 0.46GB and 109s. For MobileNetV2 on TinyImageNet, the corresponding figures are 2.42GB and 1067s for CrypTFlow2, 0.70GB and 168s for Cheetah, and 0.54GB and 130s for Falcon. For EfficientNet-Lite on CIFAR-100, the reported numbers are 0.83GB and 564s for CrypTFlow2, 0.50GB and 103s for Cheetah, and 0.34GB and 77s for Falcon. For EfficientNet-Lite on TinyImageNet, they are 1.28GB and 915s, 0.64GB and 146s, and 0.45GB and 107s, respectively [2308.13189].

Summarized across these network-level experiments, Falcon achieves a $21\%$ to $36\%$ end-to-end speedup over Cheetah, with communication savings of $31\%$ to $48\%$. These results are notable because they are reported on end-to-end models rather than only on isolated operators, and because the target models are efficient architectures whose depthwise structure is the source of the original overhead [2308.13189].

## 5. Accuracy under iso-communication constraints

Falcon’s evaluation emphasizes not only lower latency and bandwidth, but also higher model accuracy at similar communication budgets. On TinyImageNet with $N=4096$, at approximately 0.5GB communication, Falcon achieves 60.75% top-1 accuracy, compared with 57.0% for Cheetah and 50.1% for CrypTFlow2. On TinyImageNet with $N=32768$, at approximately 2.8GB communication, Falcon achieves 68.4%, compared with 62.0% for Cheetah and 57.6% for CrypTFlow2 [2308.13189].

On CIFAR-100, Falcon achieves on average 1.4% higher accuracy over Cheetah for iso-communication. The abstract further states that Falcon allows 1.4% and 4.2% accuracy improvement over Cheetah on CIFAR-100 and TinyImageNet, respectively, with iso-communication [2308.13189]. These results are important because they indicate that the packing and tiling gains can be converted into either lower communication for a fixed model or higher-accuracy model choices under a fixed communication budget.

The paper also reports that Falcon’s benefits increase with deeper network layers, where channels increase and spatial dimensions shrink. This block-wise analysis is consistent with the logic of the packing method: larger channel counts increase opportunities for zero sharing and denser packing. This suggests that Falcon’s advantage should be strongest in precisely those later efficient-network blocks where depthwise convolutions remain structurally prominent but standard packing becomes increasingly wasteful.

## 6. Significance within private mobile inference

Falcon is best understood as a systems-level optimization of HE-2PC for efficient neural architectures. Its contribution is not a new cryptographic primitive, but a reformulation of operator realization so that depthwise and group convolutions map more efficiently onto ciphertext-polynomial resources. In that sense, Falcon co-optimizes computation and communication rather than privileging one at the expense of the other [2308.13189].

The framework’s quantitative profile supports this characterization. It reduces polynomial multiplications, improves coefficient utilization, lowers ciphertext counts, and balances input/output communication. At the same time, it preserves inference correctness and cryptographic security, and the resulting efficiency permits more accurate models under the same communication budget [2308.13189].

More broadly, Falcon identifies a mismatch between efficient-network design in plaintext deep learning and operator realization in privacy-preserving inference. Efficient architectures such as MobileNetV2 and EfficientNet-Lite are lightweight in conventional deployment, yet they can become inefficient under HE-2PC if depthwise operators are packed as if they were dense convolutions. Falcon’s main conceptual contribution is to close that mismatch by making packing density and communication structure first-class optimization targets for encrypted inference.

Source: https://www.emergentmind.com/topics/falcon-bc4c92c0-1d5c-441b-80ce-4e8a4b0cedbc