Circuit Privacy

The core property ensuring the evaluator learns nothing about the circuit beyond what is inferable from the output and the input size. This prevents an untrusted server from extracting proprietary model weights or architecture details during encrypted inference. It is a stronger guarantee than standard IND-CPA security, which only hides the plaintext data, not the computation being performed.

A circuit is private if its output distribution is computationally indistinguishable from that of a universal circuit receiving the same function description. This means the encrypted result looks identical regardless of whether a simple linear model or a complex deep neural network was evaluated. The property is formalized by requiring the existence of a simulator that can reproduce the evaluator's view without access to the private function.

A primary method for achieving circuit privacy by smudging the final ciphertext with a large amount of fresh statistical noise. This drowns out the inherent noise signature that would otherwise leak information about the sequence of operations performed. The technique requires the noise bound to be superpolynomially larger than the functional noise, creating a trade-off between privacy strength and ciphertext modulus size.

In TFHE, programmable bootstrapping can simultaneously refresh the noise budget and sanitize the ciphertext distribution. By evaluating the decryption circuit homomorphically, the output ciphertext is re-encrypted with fresh randomness, erasing the accumulated noise pattern that encodes the computational history. This makes the output statistically independent of the evaluated function.

Standard fully homomorphic encryption guarantees data privacy but not function privacy. A vanilla FHE ciphertext's noise growth pattern acts as a side channel, leaking the multiplicative depth and structure of the evaluated circuit. Circuit privacy is a distinct, optional property that must be explicitly constructed, often at a significant computational cost, to protect proprietary model IP in cloud inference scenarios.

Circuit privacy can be defined with different adversarial models. Worst-case privacy guarantees indistinguishability for all possible functions and inputs, providing the strongest theoretical guarantee. Average-case or distributional privacy only requires indistinguishability for functions and inputs drawn from a specific distribution, which is often sufficient for practical machine learning deployments and can be achieved with lower overhead.