Homomorphic Encryption

The fundamental guarantee that decrypting the result of a computation on ciphertexts yields the exact same output as performing that computation on the original plaintexts. For an encryption scheme E, this property is formally defined as: Dec(E(m1) ⊕ E(m2)) = m1 + m2, where ⊕ is the operation on ciphertexts and + is the operation on plaintexts. This correctness must hold for all supported operations, whether addition, multiplication, or more complex circuits.

A rigorous security definition requiring that a computationally bounded adversary cannot distinguish between the encryptions of any two plaintexts of their choosing. This implies that the ciphertext reveals no partial information about the underlying data. Homomorphic encryption schemes achieve this through probabilistic encryption, where each encryption operation incorporates fresh randomness, ensuring that encrypting the same plaintext twice produces two completely different, unlinkable ciphertexts.

All practical homomorphic encryption schemes are built on lattice-based cryptography, where a small, random 'noise' term is embedded in each ciphertext for security. Each homomorphic operation—especially multiplication—causes this noise to grow additively or multiplicatively. If the noise exceeds a critical threshold, decryption fails. This is the central engineering constraint that determines the multiplicative depth of a circuit before bootstrapping is required.

A revolutionary technique introduced by Gentry in 2009 that enables Fully Homomorphic Encryption (FHE). Bootstrapping evaluates the decryption circuit itself homomorphically, using an encrypted version of the secret key. This process resets the noise in a ciphertext to a fixed, low level without revealing the plaintext, enabling unlimited computation depth. Bootstrapping is computationally expensive and remains the primary bottleneck in FHE performance.

A property ensuring that the evaluated ciphertext reveals no information about the function that was computed, only the result. Without circuit privacy, an adversary could infer the logic of a proprietary algorithm or the structure of a database query. Achieving this requires rerandomizing the output ciphertext after evaluation to strip away any structural artifacts left by the computation. This is critical for applications where the function itself is intellectual property.

A defining requirement for a scheme to be considered fully homomorphic. Compactness mandates that the size of the evaluated ciphertext—and the time to decrypt it—must be bounded by a fixed polynomial in the security parameter, independent of the complexity of the evaluated function. This prevents a trivial 'solution' where the ciphertext simply grows to contain a transcript of the entire computation, forcing the decryptor to re-execute it.

The primary application of HE in federated learning is secure aggregation. Each factory encrypts its local model update (gradients) using the public key of a cryptographic scheme. The central server performs homomorphic addition on these ciphertexts to compute the encrypted global update. The server never possesses the decryption key, ensuring that even if the aggregator is compromised, individual factory contributions remain provably confidential. This is a direct defense against gradient leakage attacks.

Full Homomorphic Encryption (FHE) supports arbitrary computation but is computationally prohibitive for real-time fleet learning. Practical deployments use Partially Homomorphic Encryption (PHE) schemes like the Paillier cryptosystem, which supports additive operations. Since Federated Averaging (FedAvg) requires only summation and scalar multiplication, PHE provides the exact functionality needed with orders of magnitude less overhead than FHE, making it viable for edge gateways on the factory floor.

A model inversion attack allows an adversary to reconstruct recognizable representations of private training data by inspecting model parameters or gradients. By applying HE to the aggregation step, the central server never observes raw gradients. The server only manipulates ciphertexts, mathematically preventing it from executing inversion attacks. This provides a cryptographic guarantee of privacy, which is stronger than the statistical guarantees offered by differential privacy alone.

HE is often combined with Secure Multi-Party Computation (SMPC) to create robust secure aggregation protocols. In a typical setup:

• Secret sharing splits each factory's update among peers.
• Homomorphic encryption protects shares in transit.
• The aggregator reconstructs only the sum. This hybrid approach ensures that no single entity—not even the aggregation server—can access an individual factory's model update, protecting against both external attackers and honest-but-curious infrastructure providers.

HE operations are compute-intensive, expanding ciphertext size by 2-4x and increasing computation time by 100-1000x compared to plaintext. For factory fleet learning, this overhead must be budgeted into the federated round time. Strategies include:

• Using hardware acceleration (FPGAs, GPUs) at the aggregation server.
• Applying gradient compression before encryption to reduce payload size.
• Scheduling aggregation during production downtimes. The trade-off between cryptographic security and training velocity must be explicitly managed by the CTO.

HE and Differential Privacy (DP) address complementary threat models. HE protects data in transit and computation from the aggregator, while DP protects the output model from inference attacks by end-users. A robust fleet learning architecture applies DP noise to local updates before HE encryption. This dual-layer defense ensures that even if the decrypted global model is published, individual factory data remains indistinguishable, satisfying both operational security and regulatory compliance requirements.

The most powerful variant of homomorphic encryption that supports arbitrary computation (both addition and multiplication) on ciphertexts. Unlike Partially Homomorphic Encryption (PHE) which supports only one operation, or Somewhat Homomorphic Encryption (SHE) which supports limited circuits, FHE enables unlimited depth circuits through a computationally intensive bootstrapping procedure introduced by Craig Gentry in 2009.

• Key limitation: High computational overhead (10,000x–1,000,000x slower than plaintext)
• Primary use case: Cloud-based inference on highly sensitive data where zero plaintext exposure is mandatory
• Leading schemes: CKKS (for approximate arithmetic), BGV/BFV (for exact integer arithmetic), TFHE (for fast bitwise operations)

A cryptographic protocol where multiple parties jointly compute a function over their private inputs without revealing those inputs to each other. While homomorphic encryption operates on data encrypted under a single key, SMPC distributes trust across multiple non-colluding parties.

• Garbled circuits: Boolean circuit representation evaluated via encrypted truth tables
• Secret sharing: Additive splitting of data (e.g., Shamir's Secret Sharing) across participants
• Trade-off: SMPC incurs high communication overhead between parties, whereas FHE is computationally heavy but communication-light
• Hybrid approaches: Combining FHE for local computation with SMPC for collaborative steps is an active research frontier

A hardware-enforced secure enclave within a CPU that isolates code and data from the host operating system, hypervisor, and other processes. Unlike homomorphic encryption, which protects data through mathematical guarantees, TEEs rely on hardware root of trust (e.g., Intel SGX, AMD SEV, ARM TrustZone).

• Performance: Near-native execution speed, dramatically faster than FHE
• Attack surface: Vulnerable to side-channel attacks (cache timing, power analysis, speculative execution)
• Attestation: Cryptographic proof that a specific enclave is running unmodified code on genuine hardware
• Complementary role: TEEs can accelerate FHE bootstrapping or serve as a trusted decryption endpoint for FHE results

The mathematical foundation underlying all practical homomorphic encryption schemes. Lattice problems like Learning With Errors (LWE) and its ring variant Ring-LWE provide the hardness assumptions that make FHE secure.

• Post-quantum security: Lattice problems are believed to resist attacks from both classical and quantum computers, unlike RSA and elliptic curve cryptography
• Noise growth: Each homomorphic operation adds noise to the ciphertext; when noise exceeds a threshold, decryption fails—this is the core constraint FHE must manage
• NIST standardization: Lattice-based schemes (CRYSTALS-Kyber, CRYSTALS-Dilithium) are central to post-quantum cryptography standards

A cryptographic paradigm where a decryption key can be restricted to reveal only a specific function of the plaintext, rather than the entire message. Unlike homomorphic encryption where computation happens on ciphertexts and the result is decrypted, functional encryption embeds the computation into the key itself.

• Attribute-based encryption (ABE): A subclass where decryption succeeds only if the ciphertext attributes satisfy the key's policy
• Inner product functional encryption: Computes weighted sums over encrypted vectors without revealing individual components
• Limitation: General-purpose functional encryption for arbitrary circuits remains impractical; current constructions are function-specific

A protocol where a prover convinces a verifier that a statement is true without revealing any information beyond the validity of the statement itself. While homomorphic encryption protects data confidentiality during computation, ZKPs provide computational integrity—proving that a computation was performed correctly.

• zk-SNARKs: Succinct, non-interactive proofs with a trusted setup phase
• zk-STARKs: Transparent, scalable proofs without trusted setup, but with larger proof sizes
• Synergy with FHE: A server can compute on encrypted data and attach a ZKP to prove the computation was executed correctly without revealing the data or the computation path