CKKS Scheme

Unlike exact schemes (BFV/BGV), CKKS treats a ciphertext's inherent noise as an analogue to floating-point rounding error. The critical rescaling operation divides the ciphertext by a scale factor after multiplication, truncating the least significant bits to maintain a stable scale and manage noise growth. This mirrors the behavior of standard floating-point arithmetic, making it ideal for computations that are inherently tolerant of small precision loss, such as deep learning inference.

CKKS natively supports Single Instruction, Multiple Data (SIMD) parallelism by packing up to N/2 complex numbers into a single ciphertext (where N is the ring dimension). A single homomorphic addition or multiplication simultaneously operates on all packed slots. This massively increases amortized throughput, allowing a single encrypted operation to process thousands of data points or neural network neurons in parallel.

CKKS is a leveled scheme, meaning it supports computation up to a predetermined multiplicative depth without bootstrapping. Each ciphertext is associated with a level L, and each multiplication consumes one level via rescaling. The noise budget is implicitly managed by the modulus chain; once the lowest level is reached, no further multiplications are possible unless a computationally expensive bootstrapping operation is invoked to refresh the ciphertext.

CKKS can only natively evaluate polynomial functions (addition and multiplication). To compute non-linear activation functions like ReLU, Sigmoid, or Softmax, these must be replaced with low-degree polynomial approximations (e.g., minimax or Chebyshev approximations). The design of accurate, low-degree polynomial substitutes is a central research challenge for implementing deep neural networks entirely within the CKKS encrypted domain.

Advanced operations rely on key switching to transform ciphertexts between different secret keys. Specifically, Galois keys are public evaluation keys that enable homomorphic rotation of the SIMD slots within a packed ciphertext. These rotations are essential for implementing matrix multiplication and convolutional layers, as they allow the algorithm to align data across different slots without decryption.

CKKS is the dominant scheme for encrypted inference because its approximate nature aligns perfectly with the noise-tolerant forward pass of neural networks. Frameworks like Microsoft SEAL and OpenFHE provide optimized CKKS implementations. In a typical deployment, a client encrypts their input data, the server evaluates the model homomorphically on the ciphertext, and the client decrypts the encrypted prediction—ensuring the server never sees the raw input.

The defining noise management operation of the CKKS scheme. After every multiplication, the ciphertext modulus is divided by the scale factor, which simultaneously reduces the noise budget and maintains a stable scale for subsequent operations. This is analogous to truncating floating-point precision to prevent overflow. Rescaling is what makes CKKS a leveled scheme—each multiplication consumes one level, and the circuit depth must be known before encryption.

CKKS exploits Single Instruction Multiple Data (SIMD) parallelism by packing up to N/2 complex numbers into a single ciphertext, where N is the ring dimension. A single homomorphic addition or multiplication simultaneously operates on all packed slots. This is critical for encrypted neural network inference, where entire layers of neurons can be processed in parallel, dramatically improving amortized throughput over scalar FHE schemes.

CKKS natively supports only addition and multiplication of complex numbers. Non-linear activation functions like ReLU, sigmoid, and softmax must be approximated by low-degree polynomials. Techniques include:

• Minimax approximation for optimal error bounds
• Chebyshev polynomials for numerical stability
• Composition of small-degree polynomials to approximate high-degree functions

The approximation degree directly impacts the multiplicative depth required and the precision of the encrypted inference result.

Unlike TFHE, CKKS bootstrapping is designed for approximate arithmetic rather than binary circuits. It refreshes the ciphertext noise and restores consumed levels by homomorphically evaluating the decryption circuit. Key characteristics:

• Computes the modular reduction function to raise the modulus
• Typically requires high-degree polynomial approximations of the sine function
• Enables fully homomorphic CKKS operation beyond the initial multiplicative depth
• Significantly more computationally expensive than rescaling

After a homomorphic multiplication, the resulting ciphertext grows to three ring elements instead of two. Relinearization is a key-switching procedure that reduces it back to two elements using a relinearization key, preventing exponential growth in ciphertext size during sequential multiplications. The related Galois keys enable homomorphic rotation of packed slots, which is essential for implementing matrix multiplication and convolution operations in the encrypted domain.

Two dominant open-source libraries implementing the CKKS scheme:

• Microsoft SEAL: C++ library with .NET wrappers, widely adopted for research. Provides BFV and CKKS with a focus on ease of use and educational clarity.
• OpenFHE: Community-driven C++ library offering a unified API across BFV, BGV, CKKS, and TFHE. Supports hardware acceleration, multi-key extensions, and proxy re-encryption. Both libraries provide the foundational primitives—rescaling, relinearization, rotation—required to build encrypted inference pipelines.