Homomorphic Encryption

The core mathematical property is the homomorphism: Decrypt( Eval( Encrypt(m1), Encrypt(m2) ) ) = m1 ⊙ m2. This means a function Eval operates on encrypted data Encrypt(m) to produce a ciphertext that decrypts to the correct result. The scheme preserves the algebraic structure of the plaintext space.

• Additive HE: Supports addition on ciphertexts (e.g., Paillier). Enc(a) ⊕ Enc(b) = Enc(a + b)
• Multiplicative HE: Supports multiplication on ciphertexts (e.g., ElGamal). Enc(a) ⊗ Enc(b) = Enc(a × b)
• Fully HE (FHE): Supports arbitrary circuits of both addition and multiplication, enabling any computable function.

HE schemes are categorized by the depth and type of circuits they can evaluate before the noise inherent in the ciphertext corrupts the result.

• Partially HE (PHE): Supports only one operation type (addition or multiplication) an unlimited number of times. Ideal for simple aggregation.
• Somewhat HE (SHE): Supports both addition and multiplication but only for circuits of a limited, pre-defined depth. Noise grows with each multiplication.
• Fully HE (FHE): Supports unbounded depth circuits through a critical operation called bootstrapping, which homomorphically evaluates the decryption circuit itself to reset the noise level, enabling infinite computation.

All practical HE schemes are built on the Learning With Errors (LWE) or Ring-LWE problems, which embed a small amount of random noise into each ciphertext for security. Each homomorphic operation, especially multiplication, causes this noise to grow exponentially.

• Noise Budget: A finite logarithmic measure of how many operations can be performed before the noise overwhelms the plaintext, making decryption impossible.
• Bootstrapping: A computationally intensive procedure introduced by Craig Gentry that runs the decryption algorithm homomorphically on an encrypted ciphertext, producing a new, "refreshed" ciphertext with a full noise budget. This is the key enabler of FHE.

HE directly mitigates data poisoning risks by cryptographically isolating the training data from the model trainer. A data owner can encrypt their dataset and send it to an untrusted cloud environment where the model is trained homomorphically.

• Data Confidentiality: The trainer never sees the raw data, preventing targeted label flipping or backdoor injection based on data inspection.
• Verifiable Integrity: The data owner retains control. Any malicious modification by the compute node would result in a corrupted ciphertext that fails decryption or produces a nonsensical plaintext, making the attack immediately detectable.
• Secure Aggregation: In federated settings, HE allows a central server to aggregate encrypted model updates without ever seeing individual client gradients, preventing gradient leakage and Byzantine attacks.

The primary trade-off for HE's privacy guarantee is a massive increase in computational cost and data size. A single operation on encrypted data can be orders of magnitude slower than its plaintext equivalent.

• Ciphertext Expansion: An encrypted integer can be hundreds of kilobytes to megabytes in size, compared to 4-8 bytes for a plaintext integer. This creates significant memory and bandwidth pressure.
• SIMD Batching: Modern schemes like CKKS and BFV use Single Instruction, Multiple Data (SIMD) encoding to pack thousands of plaintext values into a single ciphertext, amortizing the cost of operations across many data points simultaneously.
• Hardware Acceleration: Specialized FPGA and ASIC designs are being developed to accelerate the polynomial arithmetic that dominates HE computation.

Different FHE schemes are optimized for different data types and computation patterns. Choosing the right scheme is critical for practical performance.

• BFV / BGV: Optimized for exact integer arithmetic. Ideal for encrypted counters, private set intersection, and database queries where precision is mandatory.
• CKKS (HEAAN): Supports approximate fixed-point arithmetic on real numbers. The most efficient scheme for machine learning inference and training where floating-point noise is acceptable.
• TFHE (CGGI): Optimized for very fast bootstrapping of single bits or small integers. Best for evaluating branching programs and decision trees where latency is critical.
• Hybrid Approaches: Modern compilers like HECO automatically select and switch between schemes based on the program's computational graph.

Perform anomaly detection directly on encrypted training samples without decrypting them. This allows a third-party security service to compute a data quality score and flag potential poisoned inputs while remaining completely blind to the underlying data content.

• The service receives only ciphertexts and returns encrypted scores
• Prevents the security auditor from becoming a data leak vector
• Compatible with spectral signature analysis on encrypted feature vectors

Execute data sanitization and filtering algorithms over encrypted datasets in untrusted cloud environments. The sanitizer can apply schema validation, outlier removal, and distributional checks without ever accessing raw data.

• The cloud provider processes only ciphertexts
• Sanitized encrypted data is returned for decryption only by the data owner
• Eliminates the risk of a compromised sanitization node injecting new poisoned samples

Combine Byzantine-resilient aggregation rules with homomorphic encryption in federated learning. The central server computes Krum or trimmed mean over encrypted client model updates, mathematically guaranteeing that malicious gradients are excluded without the server ever seeing individual contributions.

• Protects against gradient leakage attacks
• Prevents the aggregator from profiling individual client data distributions
• Maintains convergence guarantees even with encrypted outlier rejection

Calculate influence functions over encrypted training sets to identify the most harmful samples without revealing dataset contents. This enables a privacy-preserving forensic audit to pinpoint poisoned data points responsible for model degradation.

• The auditor computes influence(x_i) on encrypted data
• Only the ranked list of suspicious indices is revealed to the data owner
• Prevents the auditor from extracting sensitive training examples during investigation

Maintain an immutable audit log of all data transformations where each entry is homomorphically encrypted. This allows compliance officers to verify data provenance and detect unauthorized modifications in the pipeline without accessing the raw lineage records.

• Each pipeline stage appends encrypted metadata to the log
• Integrity checks are performed homomorphically on the ciphertext chain
• Any tampering with training data is cryptographically detectable

Enable multiple distrusting organizations to jointly compute a data quality score over their combined encrypted datasets using Secure Multi-Party Computation (SMPC) enhanced with homomorphic encryption. This detects cross-organizational poisoning patterns without any party revealing its proprietary data.

• Each party contributes encrypted quality metrics
• The consensus score identifies systemic poisoning campaigns
• No single party can reconstruct another's training samples

The most powerful variant of homomorphic encryption, FHE supports both addition and multiplication on ciphertexts an unlimited number of times. This enables arbitrary computation on encrypted data, making it a holy grail for privacy. However, FHE incurs massive computational overhead—often 10,000x to 1,000,000x slower than plaintext operations—due to the noise management required in lattice-based schemes like CKKS and BGV.

A restricted form of homomorphic encryption that supports only one operation type—either addition or multiplication—but can perform it an unlimited number of times.

• Additive PHE (Paillier): Allows summing encrypted values. Used in e-voting and private auctions.
• Multiplicative PHE (RSA/ElGamal): Allows multiplying encrypted values. Used in key exchange and blind signatures.

PHE is significantly faster than FHE and practical for production systems with narrow computational requirements.

A middle-ground scheme that supports both addition and multiplication but only for a limited number of operations before the ciphertext noise becomes overwhelming and decryption fails. SHE is often used as a building block for bootstrapping—a technique that refreshes ciphertexts to enable deeper circuits, effectively converting SHE into FHE. Gentry's original 2009 breakthrough used this exact approach.

A cryptographic protocol where multiple parties jointly compute a function over their private inputs without revealing those inputs to each other. Unlike homomorphic encryption, which operates on data encrypted by a single party, SMPC distributes trust across participants.

• Garbled circuits: Boolean circuit evaluation via encrypted truth tables.
• Secret sharing: Splitting data into shares distributed across nodes.

SMPC often complements HE in hybrid architectures for privacy-preserving machine learning.

A hardware-enforced secure enclave within a CPU that isolates code and data from the host operating system. Technologies like Intel SGX, AMD SEV, and ARM TrustZone provide confidentiality and integrity for computation without the cryptographic overhead of HE.

• Data is decrypted only inside the enclave.
• The host OS, hypervisor, and even cloud provider cannot inspect enclave memory.

TEEs offer near-native performance but require trust in the hardware vendor's implementation.

A mathematical framework that provides provable privacy guarantees by injecting calibrated statistical noise into query responses or model training. Unlike HE, which protects data during computation, differential privacy protects against inference attacks on the output itself.

• Epsilon (ε): The privacy budget parameter; lower values mean stronger privacy.
• Global vs. Local DP: Noise added centrally by a trusted curator vs. by individual users.

Often combined with HE to protect data both in transit and at the output boundary.