Fully Homomorphic Encryption (FHE)

FHE supports both unlimited additions and multiplications on ciphertexts, making it Turing-complete. Unlike Partially Homomorphic Encryption (PHE) which supports only one operation type, or Somewhat Homomorphic Encryption (SWHE) which limits circuit depth, FHE can evaluate any computable function on encrypted data. This enables complex operations like training neural networks or running diagnostic algorithms directly on encrypted patient records without ever decrypting them.

The fundamental correctness property: Decrypt(Evaluate(f, Encrypt(m))) = f(m). When a function f is evaluated homomorphically on encrypted data, decrypting the result yields exactly the same output as computing f directly on the plaintext. This guarantee ensures that medical diagnostic models produce identical clinical results whether running on encrypted or unencrypted patient data, preserving both accuracy and privacy.

The defining privacy guarantee: all computation occurs within the encrypted domain. The computing party—whether a cloud provider, research collaborator, or untrusted third party—never accesses plaintext data, intermediate values, or final results. In healthcare federated learning, this means a central server can aggregate encrypted model updates from multiple hospitals and compute a global model without ever seeing any institution's patient data or model parameters.

Modern FHE schemes like BGV, BFV, CKKS, and TFHE base their security on the Learning With Errors (LWE) or Ring-LWE problems—lattice-based hard problems believed resistant to quantum attacks. Each ciphertext contains a small amount of random noise that grows with each homomorphic operation. When noise exceeds a threshold, decryption fails. Bootstrapping, Gentry's breakthrough technique, refreshes ciphertexts by homomorphically evaluating the decryption circuit itself, enabling unlimited computation depth.

FHE schemes are constructed on lattice-based cryptography, placing them in the family of post-quantum cryptographic (PQC) algorithms. Unlike RSA or elliptic curve-based systems vulnerable to Shor's algorithm, the LWE and Ring-LWE problems underlying FHE have no known efficient quantum attacks. For healthcare organizations archiving encrypted patient data for decades, FHE provides long-term confidentiality guarantees against future quantum adversaries.

• Leveled FHE: Parameters are chosen to support a predetermined circuit depth without bootstrapping. More efficient for known computation bounds, such as evaluating a fixed neural network architecture.
• Bootstrapped FHE: Uses Gentry's bootstrapping technique to reset ciphertext noise, enabling unlimited depth computation. Essential when the computation graph is not known in advance or exceeds practical leveled parameters.
• Trade-off: Bootstrapping introduces significant computational overhead—often milliseconds to seconds per operation—making scheme selection critical for latency-sensitive clinical applications.

The broader class of cryptographic schemes enabling computation on ciphertexts. FHE is the most powerful variant, but Partially Homomorphic Encryption (PHE) supports only addition or multiplication, and Somewhat Homomorphic Encryption (SHE) supports a limited number of both operations. PHE schemes like Paillier are computationally lighter and often sufficient for federated averaging, while FHE is reserved for complex non-linear inference.

An alternative cryptographic paradigm where multiple parties jointly compute a function over private inputs without revealing them. Unlike FHE, which is non-interactive after encryption, SMPC relies on communication rounds between parties using protocols like Garbled Circuits or Secret Sharing. In healthcare federated learning, SMPC is often used for secure aggregation of model updates, while FHE protects inference on encrypted patient data.

The mathematical foundation of most modern FHE schemes, including CKKS, BGV, and TFHE. Security relies on the hardness of problems like Learning With Errors (LWE) and Ring-LWE on high-dimensional lattices. Critically, lattice-based constructions are believed to be resistant to Shor's algorithm, making them leading candidates for Post-Quantum Cryptography (PQC) and ensuring long-term confidentiality of encrypted medical records.

A hardware-based alternative to cryptographic computation. TEEs like Intel SGX and AMD SEV create isolated memory enclaves where plaintext data is processed, shielded from the host OS. This avoids the massive computational overhead of FHE but introduces a hardware trust root dependency. In practice, hybrid architectures combine TEEs for performance-sensitive operations with FHE for defense-in-depth against side-channel attacks.

A complementary statistical guarantee, not a cryptographic one. While FHE protects data during computation, differential privacy protects against information leakage in the output. Adding calibrated Laplace or Gaussian noise ensures that an adversary cannot infer the presence of any single patient's record from the model. FHE and differential privacy are frequently combined: FHE secures the computation, and a differentially private mechanism sanitizes the final result.

An adversarial threat that FHE directly mitigates. In a model inversion attack, an adversary with white-box access to a trained model reconstructs representative features of a target class—potentially revealing a patient's face from a diagnostic model. By performing inference on encrypted ciphertexts, FHE ensures the model owner never sees the input query, and the client only receives an encrypted result, neutralizing this entire attack vector.