FHE Deep Dive

Before getting into homomorphic encryption, it helps to have a clear picture of what conventional encryption types do, what they protect, and where each one sits in a typical AI system. Most AI deployments use several encryption types simultaneously, each covering a different part of the data flow. There are five: symmetric, asymmetric, encryption in transit, encryption at rest, and encryption in use. The first four are standard practice. The fifth is what this module is really about.

Encryption at rest protects data on disk. Encryption in transit protects data on the wire. Both share one weakness: data must be decrypted before it can be processed. The embedding model reads plaintext documents. The vector database stores plaintext embeddings. The LLM receives plaintext context. The processing layer is exposed.

This is where encryption in use comes in. The term covers any technique that allows computation to happen on encrypted data without decrypting it first. The server processes ciphertext. The result, when decrypted by the client, matches what you would get from computing on the plaintext. The server learns nothing about the underlying data.

This gap matters more for AI systems than for traditional applications because of the inference attacks covered in D1. An attacker who can access the vector store at the processing layer can extract embedding vectors that partially reconstruct document content. Encryption in use closes this gap at the layer where the attack happens.

Searchable encryption (SE), also called queryable encryption, solves a specific problem: how to let a database server process search queries without ever seeing the plaintext data or query. The server operates entirely on ciphertext. Only the client who holds the keys can read the results.

This is the technique that bridges conventional encryption and full homomorphic encryption. It does not support arbitrary computation, but it supports the specific operations that vector databases need most: equality checks, range queries, and similarity search.

Security research into vector database deployments highlights searchable encryption as a key technique for protecting queries in RAG implementations. At every step of a RAG pipeline, from query to retrieval to response, there is an opportunity for data to be intercepted in plaintext. Searchable encryption closes this by ensuring neither the query nor the retrieved data ever appears as plaintext on the server side.

MongoDB Queryable Encryption is a production implementation. It uses a secure index built on structured encryption schemes. The encryption keys are held by the application, not MongoDB. AWS KMS, Google Cloud KMS, and Azure Key Vault are all supported as key providers via the KMIP protocol.

In vector databases, the same principle is extended to similarity search: the query vector is encrypted, the stored embeddings are encrypted, and the similarity search operates on ciphertext. This is what VectaX implements using Similarity-Preserving Search, covered in Section 12.

Homomorphic encryption (HE) is a class of encryption schemes that allows mathematical operations to be performed directly on ciphertext. The result of the operation, when decrypted, matches the result of performing the same operation on the original plaintext. The server computes but never reads the data.

HE comes in three levels of power, trading off capability against computational cost.

Partially homomorphic encryption supports exactly one arithmetic operation on encrypted data. You can either add ciphertexts or multiply them, but not both in the same scheme. This sounds limiting, and it is, but single-operation homomorphism is enough for a surprisingly wide range of practical tasks.

RSA is multiplicatively homomorphic. If you encrypt two numbers m1 and m2 under the same RSA public key, multiplying the two ciphertexts together produces a ciphertext that decrypts to m1 times m2. This property was not intentionally designed into RSA; it falls out of the modular exponentiation structure. It enables private set intersection, some types of digital voting, and specific machine learning prediction tasks.

The Paillier cryptosystem (1999) is additively homomorphic. Multiplying two Paillier ciphertexts together produces a ciphertext that decrypts to the sum of the two plaintexts. Paillier is widely used for privacy-preserving aggregation: tallying encrypted votes without decrypting individual ballots, summing encrypted financial data across parties, and computing encrypted dot products for federated model aggregation.

Somewhat homomorphic encryption supports both addition and multiplication on ciphertext, which makes it capable of evaluating any polynomial function of the encrypted data. The catch is that it can only do so up to a bounded number of operations before the ciphertext becomes unreadable.

The bound exists because of noise. SHE schemes add a small random noise value to every ciphertext during encryption. This noise is required for security: without it, the scheme would be algebraically breakable. Each arithmetic operation performed on a ciphertext changes its noise level. Addition increases noise by a small amount. Multiplication increases noise significantly. When the noise grows beyond a threshold, the decryption algorithm can no longer correctly recover the plaintext.

The maximum number of sequential operations (particularly multiplications) that a SHE scheme can support before noise becomes fatal is called the multiplicative depth. A scheme with multiplicative depth 10 can evaluate any polynomial up to degree 2 to the power 10, but not deeper circuits. This is enough for inference with shallow neural networks but not for training deep networks or running large language model inference.

Noise is the central challenge in homomorphic encryption. Every modern HE scheme based on lattice cryptography adds noise to ciphertexts during encryption. The noise is part of the security design: it makes the ciphertext indistinguishable from random to anyone without the key. But it also accumulates as operations are performed, and it eventually breaks decryption.

Think of noise as a budget. You start with a fresh ciphertext and a full noise budget. Each addition spends a little of the budget. Each multiplication spends a lot. When the budget runs out, the ciphertext is corrupted: decryption will produce garbage.

The noise growth rate depends on the encryption parameters. Larger parameters give more noise budget but produce larger ciphertexts and slower operations. Tuning these parameters is a key engineering task when deploying HE for ML: you need enough budget to complete the required computation without making ciphertexts so large that performance becomes impractical.

Fully homomorphic encryption solves the noise problem and removes the operational depth limit. With FHE, you can evaluate any computable function on encrypted data, including deep neural networks, arbitrary SQL queries, and general-purpose programs, without the server ever seeing the plaintext.

The breakthrough came in 2009 when Craig Gentry, then a PhD student at Stanford, published the first FHE construction. His key insight: you can use the homomorphic properties of the scheme to homomorphically compute the decryption function itself, on an encrypted ciphertext. The result is a fresh ciphertext with lower noise that encodes the same plaintext. He called this bootstrapping.

Gentry's original scheme was impractically slow. The bootstrapping operation alone took so long that it was useful only as a theoretical proof. But it established that FHE was possible, and the field has been improving the performance of bootstrapping continuously since 2009. Modern FHE schemes can bootstrap in seconds to minutes depending on parameters and hardware.

The HE model works as follows: mathematical operations (addition, multiplication) are performed directly on the encrypted data. The result of the computation is decrypted to reveal the final output. This model protects AI systems by enabling model inference on encrypted inputs: the client encrypts their query, the server runs inference on the ciphertext, and the client decrypts the result.

Bootstrapping is the technique that converts SHE into FHE. It resets accumulated noise in a ciphertext so that further operations can be performed. The concept is counterintuitive: to reduce noise in a ciphertext, you homomorphically evaluate the decryption circuit of the scheme itself, on the noisy ciphertext, using an encrypted copy of the secret key.

The output is a fresh ciphertext encoding the same plaintext but with noise reset to its initial level. This allows the computation to continue indefinitely, as long as you bootstrap before each noise threshold is reached.

CKKS (Cheon-Kim-Kim-Song, 2017) is the FHE scheme most commonly used for machine learning. It was designed specifically for approximate arithmetic on real and complex numbers, which makes it a natural fit for floating-point ML computations.

The key insight behind CKKS: floating-point numbers are already approximations. When you store 0.1 as a 32-bit float, you are storing an approximation with rounding error. If your computation introduces a small additional approximation error during HE operations, the result is still useful for ML inference where small errors are acceptable. CKKS formalises this by treating the noise in ciphertexts as part of the approximation rather than as an error to be eliminated. This makes operations in CKKS significantly more efficient than in exact-arithmetic FHE schemes.

CKKS also supports SIMD batching (Single Instruction, Multiple Data). A single CKKS ciphertext can encode a vector of values, and arithmetic operations on that ciphertext apply to all values in the vector simultaneously. This is the same principle as GPU parallelism applied to encrypted computation.

CKKS also manages noise growth through a technique called rescaling. After each multiplication, the ciphertext's scale (the implicit denominator used to represent real values) doubles. Rescaling divides the scale back down, keeping the magnitude of ciphertext values manageable. This is more efficient than bootstrapping for managing noise within a computation of bounded depth.

For machine learning inference, the typical workflow is: encode input features as a CKKS vector, apply the model's linear layers as batched ciphertext multiplications, apply activation function approximations (polynomial approximations of ReLU or sigmoid), and repeat per layer. Bootstrapping is called between layers when needed to reset noise.

There are three major open-source FHE libraries. Each implements one or more HE schemes and targets different use cases. Choosing the right library depends on the computation type, programming language, and performance requirements.

FHE has had three well-known problems that kept it out of production for over a decade. They are real. Anyone evaluating FHE for AI workloads needs to understand them, and understand what has changed.

VectaX applies the cryptographic techniques in this module to a specific problem: making RAG pipelines private. More precisely, VectaX delivers encryption in use for vector databases. The core challenge is that vector embeddings in a traditional RAG system are stored and searched in plaintext. As shown in D1, this creates an attack surface: an adversary with access to the vector database can partially reconstruct document content from stored embeddings.

With VectaX, the embeddings are never plaintext on the server side. The entire pipeline from storage through retrieval operates on ciphertext. This is encryption in use applied to RAG: computation (similarity search) happens on encrypted data, without decryption, and the correct results come back.

VectaX uses Similarity-Preserving Search, a specialised form of searchable encryption. The encryption function transforms a plaintext vector into a ciphertext vector such that the cosine similarity ordering between any two ciphertext vectors is the same as the ordering between their corresponding plaintext vectors. Nearest-neighbour search on encrypted vectors returns the same top-k results as nearest-neighbour search on plaintext vectors.

VectaX combines three of the techniques in this module. Similarity-Preserving Search handles the vector layer. Format-preserving encryption (FPE) handles metadata like document IDs, dates, and category fields. RBAC using attribute-based cryptography enforces access control at query time: a user's secret key encodes their roles, groups, and departments, and only queries from users with the right attributes return decryptable results.

This architecture directly addresses the RAG threat model described in D1: sensitive data needs to be protected, but it also needs to be usable. VectaX keeps it usable through similarity preservation and keeps it protected through encryption that never leaves the vector database in plaintext.

Secure multiparty computation (SMPC) is an alternative to homomorphic encryption for the problem of computing on private data held by multiple parties. Rather than encrypting data so that one party can compute on it, SMPC distributes the computation itself across multiple parties so that no single party sees the full plaintext.

SMPC allows multiple parties to jointly compute a function over their inputs while keeping those inputs private. Each party learns only the result of the computation, not the individual inputs of the other parties.

In AI, SMPC is most often used in federated learning scenarios. Multiple organisations each hold private training data. They want to train a shared model without sending their raw data to a central server. SMPC allows them to aggregate model gradients or parameters during training such that each party contributes to the model update without revealing their individual training records.

SMPC and HE are often used together. SMPC protocols typically require significant communication between parties: each round of computation involves multiple message exchanges. This communication overhead can be reduced by using HE. Parties can homomorphically encrypt their inputs before participating in the SMPC protocol, and the computation over encrypted inputs reduces the number of rounds required.