Homomorphic Encryption

Supports unlimited operations of a single type—either addition or multiplication, but not both. This constraint makes PHE computationally efficient and practical for specific use cases.

• Additive PHE (Paillier): Allows encrypted values to be summed. Used in private voting tallies and encrypted financial aggregation.
• Multiplicative PHE (RSA, ElGamal): Allows encrypted values to be multiplied. Used in blind signatures and anonymous credential systems.
• Performance: Operations are fast, with minimal ciphertext expansion, making PHE suitable for production workloads where only one type of arithmetic is needed.

Supports both addition and multiplication, but only for a limited number of operations before the ciphertext noise becomes too large and decryption fails. SHE is a stepping stone toward fully homomorphic schemes.

• Noise Budget: Each operation increases noise. When the budget is exhausted, the ciphertext is corrupted.
• Bounded Depth Circuits: Can evaluate low-degree polynomials, sufficient for specific machine learning primitives like encrypted inference on shallow neural networks.
• Efficiency: More flexible than PHE but less computationally intensive than FHE, offering a practical middle ground for targeted privacy-preserving computations.

Supports arbitrary computation on encrypted data with unlimited additions and multiplications. FHE enables general-purpose programs to run over ciphertexts without ever decrypting the inputs.

• Bootstrapping: A critical technique introduced by Gentry that refreshes the noise budget by homomorphically evaluating the decryption circuit itself, enabling unbounded computation.
• Schemes: Modern FHE schemes include BGV, BFV (integer arithmetic), and CKKS (approximate floating-point arithmetic), each optimized for different workloads.
• AI Applications: Enables private inference on encrypted medical images, confidential federated learning, and encrypted database queries without exposing the query or the results.

Modern homomorphic encryption schemes derive their security from hard problems on mathematical lattices—periodic arrangements of points in high-dimensional space. These problems are believed to be resistant to both classical and quantum attacks.

• Learning With Errors (LWE): The foundational problem. Given a noisy linear equation system, recovering the secret vector is computationally infeasible.
• Ring-LWE: A structured variant using polynomial rings that dramatically improves efficiency by reducing key sizes and enabling fast number-theoretic transforms.
• Post-Quantum: Lattice-based cryptography is a leading candidate for NIST's post-quantum standardization, ensuring long-term security for encrypted AI data even against future quantum adversaries.

Homomorphic encryption introduces significant data expansion—the encrypted output is orders of magnitude larger than the plaintext input. This is a primary engineering challenge for production deployment.

• Expansion Factor: A single plaintext integer may become kilobytes or megabytes of ciphertext, depending on scheme parameters and security level.
• Memory Pressure: Training a model on encrypted data requires storing massive ciphertexts in memory, often exceeding available RAM for large datasets.
• Mitigations: Techniques like packing (batching multiple plaintexts into one ciphertext via SIMD-style operations) and ciphertext compression reduce storage and transmission costs significantly.

While both protect data in use, Confidential Computing via hardware enclaves and Homomorphic Encryption operate on fundamentally different trust models.

• TEE (Intel SGX, AMD SEV): Data is decrypted inside a hardware-protected enclave. The CPU vendor is trusted. Performance is near-native, but side-channel attacks remain a concern.
• FHE: Data is never decrypted. Trust resides solely in the mathematics of the cryptosystem. No hardware vendor trust is required, but performance overhead is extreme.
• Hybrid Approaches: Emerging architectures combine both—using FHE for the most sensitive linear algebra operations and TEEs for non-linear activations—to balance security guarantees with practical throughput.

The strongest form of homomorphic encryption, supporting arbitrary computation (both addition and multiplication) on ciphertexts. FHE schemes like CKKS and BGV/BFV enable unlimited circuit depths, allowing complex neural network training and inference directly on encrypted data. The primary trade-off is significant computational overhead and ciphertext expansion, though hardware acceleration and algorithmic optimizations are rapidly closing the performance gap.

Schemes supporting only one operation type (addition or multiplication) an unlimited number of times. RSA (multiplicative) and Paillier (additive) are classic examples. PHE is computationally lightweight compared to FHE, making it practical for specific use cases like encrypted vote tallying or privacy-preserving aggregation in federated learning, where only summation of model updates is required.

An intermediate scheme allowing both addition and multiplication but only for a limited circuit depth. SHE is often the practical stepping-stone to FHE; schemes like BGV start as SHE and use bootstrapping to refresh ciphertexts and achieve full homomorphism. SHE is useful for fixed-depth computations like evaluating a pre-trained model's forward pass without needing the full overhead of FHE bootstrapping.

A hardware-based alternative providing a secure enclave where code and data are isolated from the host operating system. Technologies like Intel SGX and AMD SEV allow computation on plaintext data within a hardware-encrypted boundary. While faster than pure cryptographic HE, TEEs require hardware root of trust and are vulnerable to side-channel attacks. Often used in confidential computing for AI inference where latency is critical.