Hybrid MPC-HE Protocol

The protocol partitions a neural network into linear layers (convolutions, matrix multiplications) and non-linear layers (ReLU, MaxPool, Softmax).

• HE Domain: Linear operations are executed on packed ciphertexts using SIMD operations, achieving high throughput without interaction.
• MPC Domain: Non-linear functions are evaluated using secret-shared inputs and optimized circuits (e.g., Garbled Circuits or OT-based comparisons), avoiding costly polynomial approximations.

A critical bridging primitive that transitions data between cryptographic domains without decryption.

• HE-to-MPC: The party holding the HE ciphertext additively secret-shares the plaintext under the encryption and distributes shares to MPC parties, who then interactively remove the HE mask.
• MPC-to-HE: MPC parties collectively encrypt their output shares under a target public key, combining them homomorphically to produce a single ciphertext for further linear processing.

The hybrid model ensures the model owner's weights and the client's input remain private.

• Client Input: Encrypted under HE and never revealed in plaintext to the model host or MPC parties.
• Model Weights: Stored as secret shares among non-colluding MPC servers, preventing any single server from reconstructing the proprietary model.
• Output: Only the designated recipient can decrypt the final result, typically via threshold decryption.

Protocol designers balance local computation against interactive rounds.

• HE-Heavy Designs: Minimize interaction by performing as many layers as possible under HE, switching to MPC only for deep non-linearities. This reduces bandwidth but increases local compute.
• MPC-Heavy Designs: Switch to MPC early to leverage efficient bit-wise operations, reducing ciphertext noise management overhead but increasing communication rounds between MPC servers.
• Optimal Hybrid: Typically places the first few linear layers in HE to compress input dimensionality before the MPC switch.

Security depends on the non-collusion of distinct parties.

• Honest-Majority MPC: Assumes a majority of MPC servers follow the protocol, enabling high-throughput secret-sharing schemes.
• Dishonest-Majority MPC: Tolerates arbitrary corruption but incurs higher overhead; often used when the model owner operates all MPC nodes.
• HE Assumption: Relies solely on the hardness of lattice problems (e.g., RLWE), independent of the MPC trust model.

Real-world implementations combine specific schemes.

• Gazelle (CKKS + GMW): Uses packed CKKS for linear layers and a custom GMW-based MPC protocol for ReLU and MaxPool, optimizing for low-latency CNN inference.
• Delphi (TFHE + ABY): Employs TFHE for initial layers and switches to the ABY framework for mixed arithmetic, boolean, and Yao-based MPC.
• CHET (CKKS + ABY): A compiler framework that automatically partitions TensorFlow models between CKKS and ABY, optimizing the cut point for minimal latency.

A cryptographic protocol enabling multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. In a hybrid context, MPC handles non-linear operations (like ReLU or MaxPool) that are computationally expensive in pure HE.

• Secret Sharing: Inputs are split into random shares distributed among computing parties.
• Garbled Circuits: A two-party protocol where a function is represented as a boolean circuit and evaluated without revealing inputs.
• Security Guarantee: Provides information-theoretic or computational security depending on the adversary model (honest-majority vs. dishonest-majority).

A cryptographic scheme enabling arbitrary computation directly on encrypted data. In the hybrid protocol, FHE handles the linear layers (matrix multiplications, convolutions) where its Single Instruction Multiple Data (SIMD) packing excels.

• CKKS Scheme: Optimized for approximate arithmetic on real numbers, ideal for neural network weights and activations.
• Noise Budget: Ciphertexts accumulate error with each operation; bootstrapping refreshes this budget.
• Computational Cost: Linear operations are fast, but non-linear functions require expensive polynomial approximations.

A two-party MPC protocol where a function is represented as a boolean circuit. The circuit generator 'garbles' each gate by encrypting its truth table, and the evaluator decrypts only the path corresponding to their inputs.

• Constant Round Complexity: Requires a fixed number of communication rounds regardless of circuit depth.
• Non-Linear Efficiency: Excels at evaluating comparison, bitwise operations, and activation functions.
• Hybrid Role: Often used in the MPC portion of hybrid protocols to evaluate non-linear layers that are inefficient in FHE.

A multi-key variant of homomorphic encryption requiring a threshold of parties to collaborate during decryption. This prevents any single entity from unilaterally accessing the plaintext result.

• Distributed Decryption: Each party holds a share of the secret key and produces a partial decryption.
• Hybrid Synergy: Combines the output privacy of FHE with the access control of MPC.
• Use Case: Enables scenarios where a model owner and data owner jointly decrypt inference results without either gaining full access.