SIMD Operations

A single ciphertext encrypts a vector of plaintext values organized into independent slots. When a homomorphic operation—such as addition or multiplication—is applied to the ciphertext, it executes simultaneously on every slot. This transforms a vector operation into the cost of a single scalar operation, achieving massive amortized throughput gains. For example, adding two vectors of 8,192 elements requires only one homomorphic addition rather than 8,192 sequential operations.

To perform operations between different slots within the same ciphertext—essential for convolutions and matrix transpositions—the scheme employs Galois automorphisms. Using Galois keys as public evaluation keys, the computation can cyclically rotate the slot vector left or right. This enables cross-slot communication without decrypting, allowing linear algebra primitives like dot products and convolutions to be implemented entirely in the encrypted domain.

The number of available slots is determined by the ring dimension N of the underlying RLWE ciphertext, typically a power of two such as 8,192 or 32,768. Each slot encodes a single plaintext element—an integer modulo the plaintext modulus in BFV/BGV, or a fixed-point real number in CKKS. Higher packing density directly increases amortized throughput, making large ring dimensions critical for maximizing the efficiency of encrypted inference on deep neural networks.

When a computation requires operating on only a subset of slots, multiplicative masking is employed. A plaintext mask vector—with ones in active slots and zeros elsewhere—is multiplied homomorphically to zero out irrelevant values. This enables conditional logic and branching within the packed computation model without sacrificing the SIMD parallelism of the remaining active slots.

The computational cost of a homomorphic operation is independent of the number of slots being processed. A ciphertext multiplication costs the same whether it processes one slot or 32,768 slots simultaneously. This creates an amortized efficiency curve where the cost per slot approaches zero as packing density increases, making SIMD operations the primary mechanism for achieving practical performance in privacy-preserving machine learning workloads.

In encrypted neural network inference, SIMD packing enables batch processing of multiple inputs simultaneously. A single ciphertext can encode multiple independent user queries, and each layer of the model processes all queries in parallel. This architecture is fundamental to production FHE inference systems, where serving multiple encrypted requests concurrently amortizes the heavy computational cost of homomorphic matrix multiplications across the entire batch.

The foundational technique that encodes multiple plaintext values into a single ciphertext, enabling SIMD parallelism. In schemes like CKKS and BGV, a ciphertext encrypts a vector of values rather than a scalar. Each slot in the vector operates independently under homomorphic addition and multiplication, allowing a single operation to process thousands of data points simultaneously. This is the primary mechanism for achieving amortized throughput in encrypted computation, reducing the per-operation cost to a fraction of scalar processing.

Noise management operations that are critical for maintaining correctness during SIMD computation. In the CKKS scheme, rescaling divides a ciphertext by a scale factor after multiplication, truncating precision to keep the scale stable across successive operations. Modulus switching reduces the ciphertext modulus to proportionally shrink the absolute noise. Both operations are applied uniformly across all SIMD slots, preserving the packed structure while preventing noise from overwhelming the signal and causing decryption failures.

The process of approximating non-linear functions (like ReLU, sigmoid, or tanh) with low-degree polynomials to enable their evaluation within leveled HE schemes. Since SIMD operations are restricted to addition and multiplication, non-linear activation functions in neural networks must be replaced by polynomial equivalents. The approximation degree directly impacts multiplicative depth and noise growth, creating a trade-off between accuracy and computational cost that applies uniformly across all packed slots.

Programmable bootstrapping in TFHE and standard bootstrapping in CKKS/BGV can be applied to packed ciphertexts to refresh the noise budget and enable unlimited computation depth. In the CKKS scheme, bootstrapping homomorphically evaluates the decryption circuit on the entire packed ciphertext, resetting noise across all slots simultaneously. This allows deep SIMD circuits—such as full neural network inference—to execute without manual depth management, though at a significant latency cost per bootstrap operation.

SIMD packing is the primary driver of amortized throughput in encrypted neural network inference. By packing multiple input samples (e.g., images, text embeddings) into a single ciphertext, a model can process an entire batch with one set of homomorphic operations. This transforms the latency profile from per-sample to per-batch, making privacy-preserving inference viable for high-volume applications. The batch size is limited by the polynomial ring dimension, typically 2^15 or 2^16 slots in practice.