Somewhat Homomorphic Encryption (SWHE)

SWHE schemes can evaluate arithmetic circuits up to a predefined multiplicative depth L. Each multiplication increases the noise in the ciphertext, and once the noise exceeds a threshold, decryption fails. The depth L is chosen at key generation time and determines the size of the parameters. This is in contrast to Fully Homomorphic Encryption (FHE), which uses bootstrapping to support unlimited depth. For ML inference, a fixed-depth network like a ResNet-20 can often be evaluated entirely within an SWHE budget without the overhead of bootstrapping.

The security of SWHE relies on the hardness of the Ring Learning With Errors (RLWE) problem. Each plaintext is encrypted with a small, random error term. Homomorphic additions add these errors together, while multiplications cause the errors to grow multiplicatively. The scheme remains secure as long as the noise does not overwhelm the modulus q. This noise growth is the fundamental constraint that limits the number of operations and defines the 'somewhat' nature of the scheme. The noise budget is consumed predictably with each gate evaluation.

SWHE is often referred to as Leveled Fully Homomorphic Encryption when the circuit depth L is known before encryption. The key distinction from true FHE is the absence of bootstrapping. Bootstrapping homomorphically evaluates the decryption circuit to refresh the noise, enabling unbounded computation. SWHE avoids this expensive procedure entirely. For applications like encrypted inference on a fixed neural network architecture, the depth is known at compile time, making SWHE a more efficient choice than bootstrapped FHE.

Selecting parameters for an SWHE scheme involves a three-way trade-off between security level, circuit depth, and computational efficiency. Larger modulus q and ring dimension n support deeper circuits but increase ciphertext size and operation latency. The security parameter λ (typically 128 bits) dictates the minimum ring dimension. For a fixed security level, the maximum multiplicative depth L is determined by the ratio of the modulus to the initial noise. This parameter selection is often automated by libraries like Microsoft SEAL or PALISADE.

SWHE schemes based on RLWE natively support Single Instruction Multiple Data (SIMD) packing via the Chinese Remainder Theorem. A single ciphertext can encode a vector of up to n plaintext values, where n is the ring dimension (often 2^15 or more). Homomorphic operations then act component-wise on all slots simultaneously. This is critical for ML workloads: a single ciphertext can represent an entire feature vector or a batch of inputs, amortizing the computational cost across thousands of data points in parallel.

SWHE natively supports only addition and multiplication over rings. Non-linear activation functions like ReLU, Sigmoid, or MaxPooling must be replaced with low-degree polynomial approximations. The degree of the approximation directly consumes the multiplicative depth budget. For example, approximating ReLU with a degree-3 polynomial consumes 2 multiplicative levels. This constraint drives research into polynomial-friendly neural architectures and influences the choice between the CKKS scheme (for approximate real arithmetic) and the BFV scheme (for exact integer arithmetic).

The theoretical ideal that SWHE approaches. FHE supports arbitrary computation on encrypted data without any depth limits. While SWHE can only evaluate circuits up to a fixed multiplicative depth before noise corrupts the result, FHE uses bootstrapping to refresh the noise budget, enabling unlimited operations. Most practical FHE schemes are built by extending SWHE constructions with this self-referencing capability.

A simpler, more restricted cousin of SWHE. PHE schemes support only one operation type—either addition (e.g., Paillier) or multiplication (e.g., ElGamal)—but can perform that single operation an unlimited number of times. SWHE advances beyond PHE by supporting both addition and multiplication, which is the minimal requirement for evaluating arbitrary arithmetic circuits, albeit with a strict depth constraint.

The critical resource that defines SWHE's limitations. Every ciphertext contains a small amount of cryptographic noise to ensure security. Each homomorphic operation—especially multiplication—causes this noise to grow. The noise budget is the total tolerable noise before decryption fails. SWHE schemes are parameterized to support a specific number of operations; exceeding this depth causes the noise to overflow, rendering the ciphertext undecryptable.

A practical refinement of SWHE that makes the depth constraint explicit and configurable. In leveled FHE, the scheme's parameters are chosen to support a pre-determined circuit depth known at setup time. This eliminates the need for expensive bootstrapping while still enabling the evaluation of complex, bounded functions. Leveled FHE is the dominant paradigm for privacy-preserving machine learning inference, where the neural network's depth is fixed in advance.

The mechanism that bridges SWHE to full FHE. Bootstrapping homomorphically evaluates the decryption circuit on a noisy ciphertext, producing a fresh encryption of the same plaintext with a reset noise budget. This operation is computationally intensive—often dominating runtime—but it is the only way to transcend SWHE's inherent depth limitation. SWHE schemes deliberately omit bootstrapping to maintain practical performance for bounded computations.

The mathematical foundation underlying virtually all modern SWHE constructions. These schemes base their security on the hardness of lattice problems like Learning With Errors (LWE) and its ring variant (RLWE). The noise that accumulates during homomorphic operations is directly tied to the error term in these hard problems. Lattice-based schemes are also believed to be post-quantum secure, making SWHE a candidate for long-term cryptographic resilience.