Packing Entries to Diagonals for Homomorphic Sparse-Matrix Vector Multiplication

TL;DR

This paper introduces a novel approach to optimize sparse-matrix vector multiplication in homomorphic encryption by permuting matrices to minimize cyclic diagonals, significantly reducing computational overhead.

Contribution

It formalizes the 2D diagonal packing problem, proposes heuristics for large matrices, and demonstrates substantial reductions in encryption computation costs through optimized permutations.

Findings

Reduced diagonal count by 5.5x on average in experiments

Achieved up to 45.6x reduction for a single matrix instance

Dense row/column elimination further improved costs, up to 23.7x reduction

Abstract

Homomorphic encryption (HE) enables computation over encrypted data but incurs a substantial overhead. For sparse-matrix vector multiplication, the widely used Halevi and Shoup (2014) scheme has a cost linear in the number of occupied cyclic diagonals, which may be many due to the irregular nonzero pattern of the matrix. In this work, we study how to permute the rows and columns of a sparse matrix so that its nonzeros are packed into as few cyclic diagonals as possible. We formalise this as the two-dimensional diagonal packing problem (2DPP), introduce the two-dimensional circular bandsize metric, and give an integer programming formulation that yields optimal solutions for small instances. For large matrices, we propose practical ordering heuristics that combine graph-based initial orderings - based on bandwidth reduction, anti-bandwidth maximisation, and spectral analysis - and an iterative-improvement-based optimization phase employing 2OPT and 3OPT swaps. We also introduce a dense row/column elimination strategy and an HE-aware cost model that quantifies the benefits of isolating dense structures. Experiments on 175 sparse matrices from the SuiteSparse collection show that our ordering-optimisation variants can reduce the diagonal count by $5.5\times$ on average ($45.6\times$ for one instance). In addition, the dense row/column elimination approach can be useful for cases where the proposed permutation techniques are not sufficient; for instance, in one case, the additional elimination helped to reduce the encrypted multiplication cost by $23.7\times$ whereas without elimination, the improvement was only $1.9\times$.