When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication

Augusto Vega; Esteban Mocskos; Karthik Swaminathan; Mat\'ias Mazzanti; Radha Venkatagiri; Vattana Chan

REVIEW 4 major objections 5 minor 22 references

When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read In CKKS homomorphic multiplication, a single-bit flip is benign or corrupting depending on whether it enters both uses of a ciphertext component or only one partial product.

desk verdict The timing/location distinction is a real algebraic observation, but the 'masked' conclusion is wrong and the promised empirical evaluation is absent. read the letter →

arxiv 2608.11147 v1 pith:BWYBTB4L submitted 2026-08-11 cs.AR cs.CR

Vattana Chan , Matías Mazzanti , Karthik Swaminathan , Augusto Vega , Esteban Mocskos , Radha Venkatagiri This is my paper · ORCID

classification cs.ARcs.CR

keywords CKKShomomorphicencryptiontransienterrorsfaultinjectionsilentdatacorruptionciphertextmultiplicationerrorresiliencerelinearization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks why some transient hardware bit flips in CKKS homomorphic multiplication vanish without harm while others silently destroy the decrypted result. It argues that the answer is algebraic: because each ciphertext polynomial $c_0$ and $c_1$ is reused across the partial products $d_0,d_1,d_2$, a flip that enters both uses of a component keeps the faulted ciphertext inside the space of valid ciphertexts, so decryption's cancellation suppresses it. A flip that enters only one partial product pushes the ciphertext outside that space, and the result decrypts to severe corruption. The authors support this with structural derivations and fault-injection experiments, and conclude that both the timing and the location of an error, not just its magnitude, determine whether the error is masked or becomes silent data corruption. If correct, fault-resilience strategies for FHE need to protect the asymmetric, single-use paths rather than treat all bits equally.

What carries the argument

The load-bearing object is the double-use symmetry of the ciphertext components inside the three partial products of CKKS multiplication, together with the error polynomial $e_{i,j}=2^j X^i$ that models a single-bit flip. Writing the faulted multiplication as Eq. (5) (fault inside both uses of $c_0$) versus Eq. (6) (fault only inside $d_1$) is what carries the argument: the first expansion remains in ciphertext space because the extra term is a product of a scalar error and a valid ciphertext, while the second does not. This distinction is then tied to the empirical masking-versus-SDC pattern through error-propagation traces and maximum relative error measurements.

What would settle it

Run pairwise fault injections on identical CKKS multiplications: one bit flip in $c_0$ that enters both $d_0$ and $d_1$, and the same flip restricted to $d_1$ only. If the decrypted maximum relative error in the first case is statistically indistinguishable from the second, the paper's algebraic masking claim is refuted; the distinction in Eqs. (5) and (6) predicts a clear gap.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that in the CKKS scheme, ciphertext–ciphertext multiplication has a built-in symmetry that decides the fate of a transient single-bit error. The multiplication forms three partial products $(d_0,d_1,d_2)$; $c_0$ appears in $d_0$ and $d_1$, and $c_1$ appears in $d_1$ and $d_2$. If a bit flip in $c_0$ is present in both of its appearances, the faulted result is algebraically the correct product plus an error term $e_{i,j}(c_0'',c_1'')$, which is itself a valid ciphertext; decryption therefore performs its usual cancellation and leaves only a small extra noise term. If the same flip appears only in $d_1$, the result is the correct product plus $e_{i,j}(0,c_1')$, which is not a ciphertext, so the secret-key cancellation fails and the decrypted output is badly corrupted. The paper concludes that homomorphic multiplication is highly susceptible to faults, and that the timing and location of an error in $c_0$ or $c_1$ determine whether the error is masked or silent.

Load-bearing premise

The masked conclusion rests on the assumption that after relinearization a fault hitting both uses of a component still leaves a valid ciphertext whose decryption error stays small; if relinearization mixes the injected error into both components in a way that breaks the cancellation, the masking result would not follow.

Editorial extensions

If this is right

A fault-injection study that records only the bit position, without the component and timing, will misestimate silent data corruption rates for CKKS multiplication.
Protection can focus on single-use paths such as a fault landing only in $d_1$, where decryption cannot cancel the injected error.
A fault that is replicated across both uses of a component can be left unprotected, since decryption still returns the product plus a bounded noise term.
Because $c_0$ and $c_1$ feed different partial products, their resilience profiles differ, so $c_0$ faults and $c_1$ faults follow distinct propagation paths.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not test it, but Eq. (5) implies masked faults still add noise, so many such faults could accumulate and erode the CKKS noise budget over a long computation.
Because the same double-use partial-product structure appears in other RLWE-based multiplication schemes, the masked-versus-SDC distinction may transfer, although the paper does not claim this.
A natural extension would inject faults into the relinearization-key path, since Eqs. (5) and (6) treat the $d^{evk}$ terms as fault-free.
Read as a design pointer, the result suggests protecting the $d_1$ computation rather than triplicating the whole multiplication, which the authors do not state explicitly.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

This paper makes a simple algebraic point about CKKS multiplication under transient faults and then draws a conclusion the algebra does not support. The one genuinely new observation is the timing/location axis: a bit flip that enters both partial products of c0 (or c1) leaves a valid ciphertext, while a flip entering only one partial product produces an invalid ciphertext that decrypts into garbage. That distinction is real and worth keeping, but the paper calls the first case "masked" and claims the resulting error is a low-magnitude term. That claim is wrong.

If you decrypt Eq. (5) one step further, the error term e_{i,j}*(c0'', c1'') yields e_{i,j}*(m'' + noise), where m'' is the plaintext of the second multiplicand. That is a data-dependent term proportional to 2^j times the coefficients of m''. For any high-order bit flip it is not low-magnitude at all; for j near log Q it can be enormous. So the true distinction is not "benign vs. SDC" but "error that avoids the secret-key-dependent blow-up vs. error that includes e_{i,j}*c1''*sk." The paper provides no bound on the "masked" error and no experiments. In fact, the empirical evaluation promised in Section I is entirely absent: no MREP data, no error distributions, no baseline comparison. Fig. 2 is a placeholder.

What the paper does well: the reuse structure of c0/c1 in the schoolbook multiplication and the algebraic decomposition into Eqs. (5) and (6) is a useful way to think about where faults land. The writing is clear about the distinction between the two paths. But the central claim, that timing and location determine whether a fault is silent or corrupting, is unsupported and, as stated, incorrect.

Where it stands: as a preprint it is not ready. The core observation might survive a rewrite that drops the word "masked" and replaces it with "structured-error vs. unstructured-error," adds a real empirical section with actual MREP values, and derives or at least discusses the magnitude of the structured error term. The citations to the authors' own earlier work are fine; the problem is not self-citation, it is the gap between claim and evidence.

Who this is for: people working on fault-tolerant FHE accelerators might get a useful starting point, but only after the fix. I would not bring it to the reading group as is. My recommendation: if you are deciding whether to referee it, say yes—it deserves a serious referee who will catch the missing data and the over-interpretation. But the verdict should be reject, with an invitation to resubmit.

Referee Report

4 major / 5 minor

Summary. The paper studies transient single-bit errors in server-side CKKS homomorphic multiplication, using an unoptimized implementation (no NTT/RNS). It claims that the timing and location of bit flips in the ciphertext components c0 and c1 determine whether the error is masked, silently corrupts the output, or is detected. The central theoretical argument, formalized in Eqs. (5) and (6), distinguishes a fault that enters both partial products d0 and d1 (claimed to yield a valid ciphertext plus a low-magnitude error) from a fault entering only d1 (claimed to produce a non-ciphertext term and hence SDC). The paper also asserts empirical support via an injection tool and MREP evaluation, but no empirical data or figures are included.

Significance. If correct, the paper would provide a useful fault-propagation model for CKKS multiplication and guide fault-tolerant HE accelerator design. The algebraic distinction between faults entering one versus both partial products is a conceptually clear starting point. However, the central claim is not established: the key assertion that the error term in Eq. (5) is low-magnitude is incorrect, and the manuscript contains no empirical results to back the claimed observations. The paper is therefore of limited value in its current form.

major comments (4)

[Section III-C, Eq. (5)] The assertion that the error term e_{i,j}*(c0'', c1'') decrypts to an 'additional low-magnitude term' is incorrect. Decrypting that term yields e_{i,j}*(m'' + e''), where m'' is the plaintext encoded in the second ciphertext and e'' is its inherent noise. In CKKS, plaintext coefficients are scaled by the scaling factor Δ and encode arbitrary real or complex data, so e_{i,j}*m'' is not small: for a bit flip at position j it contributes 2^j times a shifted coefficient of m''. For high-order bit flips this error is comparable to or larger than the message itself. The paper provides no bound on ||e_{i,j}*m''||, so the 'masked' outcome is in fact a data-dependent corruption, not a benign result.
[Section III-C, Eq. (5)] The derivation assumes that after relinearization the faulted ciphertext is exactly the correct multiplication result plus e_{i,j}*(c0'', c1'') with (c0'', c1'') a valid ciphertext. The paper does not prove that the relinearization step, which involves key-switching and rounding, preserves this additive structure. If relinearization mixes the error into the ciphertext components differently, the algebraic form of Eq. (5) may not hold. This is a load-bearing gap because Eq. (5) is the entire basis for the claimed masking behavior.
[Sections I and II] The manuscript explicitly claims empirical support ('These observations are supported by both theoretical analysis and empirical evaluation'; 'we injected single bit transient errors ... using MREP'), but no MREP results, error distributions, or baseline comparisons appear anywhere in the paper. The only referenced figure (Fig. 2) is not included. This absence means the central claim cannot be verified empirically, despite the paper's framing.
[Sections I and III-B] The proposed dichotomy between 'masked' and SDC collapses once the error term in Eq. (5) is recognized as a data-dependent corruption proportional to e_{i,j}*m''. Both the 'both partial products' and 'one partial product' fault cases then produce silent corruption, differing only in whether an additional secret-key-dependent term appears. The abstract's claim that timing and location determine whether the output is correct is therefore unsupported; the two cases differ in error magnitude, not in masked versus SDC behavior.

minor comments (5)

[Section III-A] Figure 2 is referenced but not included in the manuscript; add the figure with the error characterization data it is meant to show.
[Section III-A] The term 'gap' is used without definition; clarify whether it refers to the number of unused slots between FFT slots or to another structural parameter.
[Section I] The phrase 'the timing of errors' is not operationalized; the analysis concerns which partial product (d0 or d1) receives the fault, not a time axis. Explain what 'timing' means in this context.
[Section II] The C-CKKS implementation is described as based on OpenFHE, HEaaN, SEAL, and PyFHE, but the manuscript does not specify which components are taken from each; add an implementation note or a repository link for reproducibility.
[Section III-C] The statement that the sign of e_{i,j} does not affect the analysis should be justified, since a 1-to-0 flip produces a negative error; the magnitude analysis is sign-independent, but this is not stated.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the CKKS fault-propagation analysis is self-contained polynomial algebra, and the cited prior works are contextual rather than load-bearing for the central claim.

full rationale

The paper's central derivation, Eqs. (4)-(6), is a direct expansion of CKKS ciphertext multiplication under an injected bit-flip error polynomial. The distinction between a fault entering both partial products d0 and d1 versus only d1 follows algebraically from the structure of the multiplication formula; no parameter is fitted to data and then renamed as a prediction, and no uniqueness theorem or ansatz is imported from the authors' prior work. The self-citations [21] and [22] are used only to refer to prior analyses of the resilience of the scaling factor, modulus, and gap/slot structure (footnote 3), not to establish the paper's new c0/c1 timing and location claims. The empirical evaluation uses the authors' own C-CKKS implementation and the external LLTFI tool, but this does not make the derivation circular. A possible weakness is that the assertion that the error term in Eq. (5) is of 'low-magnitude' is not proven and may be incorrect for high-order bit flips; however, that is a correctness or soundness concern, not a circularity concern, because the claim is not true by construction or by definition of the inputs. The derivation is therefore self-contained and receives a circularity score of 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no fitted parameters or invented entities. It relies on standard CKKS decryption and relinearization assumptions, a simplified bit-flip error model, and the premise that unoptimized CKKS is representative. The main unstated support is the validity of treating the error term e*(c0'',c1'') as a ciphertext after relinearization.

assumptions (5)

domain assumption CKKS decryption cancellation: c0 + c1*sk ≈ message + small error
Invoked in Section I and in Section III-C; the masking argument depends on the randomness canceling during decryption.
domain assumption Relinearization preserves the ciphertext shape: (d0,d1) + d2*evk ≈ (c0,c1)
Used in Eq. (3) and again in Eq. (5); the analysis assumes the faulted result after relinearization is a valid ciphertext.
domain assumption Fault model: a transient bit flip adds an error polynomial 2^j X^i to a coefficient
Section III-C Eq. (4); this ignores carry propagation in modular arithmetic and sign-dependent asymmetry.
ad hoc to paper Unoptimized CKKS (no NTT/RNS) is representative of the scheme
Section II explicitly restricts scope; the conclusion may not hold for optimized implementations where the arithmetic order changes.
domain assumption A fault can affect both uses of c0 or c1 simultaneously
Section III-B distinguishes 'both uses' from 'one use'; the timing claim assumes such a hardware scenario is physically possible.

how reviews work

0 comments

Cite this review

Pith. "Pith review of When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication." pith.science (2026). https://pith.science/paper/BWYBTB4L

@misc{pith2026260811147,
  author       = {Pith},
  title        = {Pith review of: When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BWYBTB4L}},
  note         = {Machine review of arXiv:2608.11147}
}

abstract

Homomorphic Encryption (HE) is a privacy-preserving encryption paradigm that enables computation directly on encrypted data without requiring decryption. In this paper, we study errors in fully homomorphic encryption (FHE) computations, with a particular focus on server-side homomorphic multiplication in the unoptimized CKKS (Cheon--Kim--Kim--Song) scheme. We show that both the timing and the location of errors in the ciphertext components $c_0$ and $c_1$ have a significant impact on the correctness of the final FHE output.

Figures

Figures reproduced from arXiv: 2608.11147 by the authors.

**Figure 2.** Error characterization of bit-flips occurring on [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 9 canonical work pages

[1]

Heterogeneity and dynamicity of clouds at scale: Google trace analysis,

C. Reiss, A. Tumanov, G. R. Ganger, R. H. Katz, and M. A. Kozuch, “Heterogeneity and dynamicity of clouds at scale: Google trace analysis,” inProceedings of the Third ACM Symposium on Cloud Computing, ser. SoCC ’12. New York, NY , USA: Association for Computing Machinery, 2012. [Online]. Available: https://doi.org/10.1145/2391229.2391236

work page arXiv 2012
[2]

L. A. Barroso, J. Clidaras, and U. Hölzle,The Datacenter as a Computer: An Introduction to the Design of Warehouse- Scale Machines, Second Edition, 2013. [Online]. Available: http: //dx.doi.org/10.2200/S00516ED2V01Y201306CAC024

work page doi:10.2200/s00516ed2v01y201306cac024 2013
[3]

Fully homomorphic encryption using ideal lattices,

C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 169–178

2009
[4]

Homomorphic encryption for arithmetic of approximate numbers,

J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inAdvances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409– 437

2017
[5]

An improved rns variant of the bfv homomorphic encryption scheme,

S. Halevi, Y . Polyakov, and V . Shoup, “An improved rns variant of the bfv homomorphic encryption scheme,” inTopics in Cryptology–CT-RSA 2019: The Cryptographers’ Track at the RSA Conference 2019, San Francisco, CA, USA, March 4–8, 2019, Proceedings. Springer, 2019, pp. 83–105

work page
[6]

Evaluating 2-dnf formulas on ciphertexts,

D. Boneh, E.-J. Goh, and K. Nissim, “Evaluating 2-dnf formulas on ciphertexts,” inProceedings of the Second International Conference on Theory of Cryptography, ser. TCC’05. Berlin, Heidelberg: Springer- Verlag, 2005, p. 325–341. [Online]. Available: https://doi.org/10.1007/ 978-3-540-30576-7_18

work page 2005
[7]

(leveled) fully ho- momorphic encryption without bootstrapping,

Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “(leveled) fully ho- momorphic encryption without bootstrapping,”ACM Transactions on Computation Theory (TOCT), vol. 6, no. 3, pp. 1–36, 2014

2014
[8]

Lp-henn: fully homomorphic encryption accelerator with high energy efficiency,

Z. Tian, L. Chen, S. Fan, X. Deng, R. Hou, D. Meng, and M. Zhang, “Lp-henn: fully homomorphic encryption accelerator with high energy efficiency,”Cybersecurity, vol. 8, no. 1, p. 98, 2025. [Online]. Available: https://link.springer.com/article/10.1186/s42400-025-00360-x

work page doi:10.1186/s42400-025-00360-x 2025

Show all 22 references

[9]

F1: A fast and programmable accelerator for fully homomorphic encryption,

N. Samardzic, A. Feldmann, A. Krastev, S. Devadas, R. Dreslinski, C. Peikert, and D. Sanchez, “F1: A fast and programmable accelerator for fully homomorphic encryption,” inMICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, ser. MICRO ’21. New York, NY...

2021 doi
[10]

Cheetah: Optimizing and accelerating homomorphic encryption for private inference,

B. Reagen, W.-S. Choi, Y . Ko, V . T. Lee, H.-H. S. Lee, G.-Y . Wei, and D. Brooks, “Cheetah: Optimizing and accelerating homomorphic encryption for private inference,” in2021 IEEE International Symposium on High-Performance Computer Architecture (HPCA), 2021, pp. 26–39

2021
[11]

Poseidon: Practical homomorphic encryption accelerator,

Y . Yang, H. Zhang, S. Fan, H. Lu, M. Zhang, and X. Li, “Poseidon: Practical homomorphic encryption accelerator,” in2023 IEEE Interna- tional Symposium on High-Performance Computer Architecture (HPCA), 2023, pp. 870–881

2023
[12]

Heap: A fully homomorphic encryption accelerator with parallelized bootstrapping,

R. Agrawal, A. Chandrakasan, and A. Joshi, “Heap: A fully homomorphic encryption accelerator with parallelized bootstrapping,” inProceedings of the 51st Annual International Symposium on Computer Architecture, ser. ISCA ’24. IEEE Press, 2025, p. 756–769. [Online]. Available: h...

2025
[13]

TREBUCHET: Fully homomorphic encryption accelerator for deep computation,

D. B. Cousins, Y . Polyakov, A. A. Badawi, M. French, A. Schmidt, A. Jacob, B. Reynwar, K. Canida, A. Jaiswal, C. Mathew, H. Gamil, N. Neda, D. Soni, M. Maniatakos, B. Reagen, N. Zhang, F. Franchetti, P. Brinich, J. Johnson, P. Broderick, M. Franusich, B. Zhang, Z. Cheng, and ...

2023
[14]

A full RNS variant of approximate homomorphic encryption,

J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full RNS variant of approximate homomorphic encryption,” inSelected Areas in Cryptography–SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15–17, 2018, Revised Selected Papers 25. Springer, 2019, pp. 347–368

2018
[15]

On the concrete hardness of learning with errors,

M. R. Albrecht, R. Player, and S. Scott, “On the concrete hardness of learning with errors,”Journal of Mathematical Cryptology, vol. 9, no. 3, pp. 169–203, 2015

2015
[16]

Silent data corruptions at scale,

H. D. Dixit, S. Pendharkar, M. Beadon, C. Mason, T. Chakravarthy, B. Muthiah, and S. Sankar, “Silent data corruptions at scale,” 2021. [Online]. Available: https://arxiv.org/abs/2102.11245

2021 arXiv
[17]

OpenFHE: Open-source fully homomorphic encryption library,

A. A. Badawi, A. Alexandru, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Lee, Z. Liu, D. Micciancio, C. Pascoe, Y . Polyakov, I. Quah, S. R.V ., K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V . Vaikuntanathan, and V . Z...

2022
[18]

Microsoft SEAL (release 4.1),

“Microsoft SEAL (release 4.1),” https://github.com/Microsoft/SEAL, Jan. 2023, microsoft Research, Redmond, W A

2023
[19]

py-fhe: A Python library for fully homomorphic encryp- tion,

S. Erabelli, “py-fhe: A Python library for fully homomorphic encryp- tion,” https://github.com/sarojaerabelli/py-fhe, 2020, gitHub repository, implemented BFV , CKKS, and CKKS bootstrapping schemes; MIT license

2020
[20]

Lltfi: Framework agnostic fault injection for machine learning applications (tools and artifact track),

U. K. Agarwal, A. Chan, and K. Pattabiraman, “Lltfi: Framework agnostic fault injection for machine learning applications (tools and artifact track),” in2022 IEEE 33rd International Symposium on Software Reliability Engineering (ISSRE), 2022, pp. 286–296

2022
[21]

Characterizing the sensitivity to individual bit flips in client-side operations of the ckks scheme,

M. Mazzanti, A. Vega, P. Bose, and E. Mocskos, “Characterizing the sensitivity to individual bit flips in client-side operations of the ckks scheme,” 2025. [Online]. Available: https://arxiv.org/abs/2507.20891

2025
[22]

Quantifying the bit- error resilience of fhe compute,

A. Vega, M. Mazzanti, and E. Mocskos, “Quantifying the bit- error resilience of fhe compute,” inProceedings of the 31st IEEE International Symposium on High Performance Computer Architecture (HPCA 2025). Las Vegas, NV , USA: IEEE, Mar. 2025, workshop paper. [Online]. Available...

2025

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Heterogeneity and dynamicity of clouds at scale: Google trace analysis,

C. Reiss, A. Tumanov, G. R. Ganger, R. H. Katz, and M. A. Kozuch, “Heterogeneity and dynamicity of clouds at scale: Google trace analysis,” inProceedings of the Third ACM Symposium on Cloud Computing, ser. SoCC ’12. New York, NY , USA: Association for Computing Machinery, 2012. [Online]. Available: https://doi.org/10.1145/2391229.2391236

work page arXiv 2012

[2] [2]

L. A. Barroso, J. Clidaras, and U. Hölzle,The Datacenter as a Computer: An Introduction to the Design of Warehouse- Scale Machines, Second Edition, 2013. [Online]. Available: http: //dx.doi.org/10.2200/S00516ED2V01Y201306CAC024

work page doi:10.2200/s00516ed2v01y201306cac024 2013

[3] [3]

Fully homomorphic encryption using ideal lattices,

C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 169–178

2009

[4] [4]

Homomorphic encryption for arithmetic of approximate numbers,

J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inAdvances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409– 437

2017

[5] [5]

An improved rns variant of the bfv homomorphic encryption scheme,

S. Halevi, Y . Polyakov, and V . Shoup, “An improved rns variant of the bfv homomorphic encryption scheme,” inTopics in Cryptology–CT-RSA 2019: The Cryptographers’ Track at the RSA Conference 2019, San Francisco, CA, USA, March 4–8, 2019, Proceedings. Springer, 2019, pp. 83–105

work page

[6] [6]

Evaluating 2-dnf formulas on ciphertexts,

D. Boneh, E.-J. Goh, and K. Nissim, “Evaluating 2-dnf formulas on ciphertexts,” inProceedings of the Second International Conference on Theory of Cryptography, ser. TCC’05. Berlin, Heidelberg: Springer- Verlag, 2005, p. 325–341. [Online]. Available: https://doi.org/10.1007/ 978-3-540-30576-7_18

work page 2005

[7] [7]

(leveled) fully ho- momorphic encryption without bootstrapping,

Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “(leveled) fully ho- momorphic encryption without bootstrapping,”ACM Transactions on Computation Theory (TOCT), vol. 6, no. 3, pp. 1–36, 2014

2014

[8] [8]

Lp-henn: fully homomorphic encryption accelerator with high energy efficiency,

Z. Tian, L. Chen, S. Fan, X. Deng, R. Hou, D. Meng, and M. Zhang, “Lp-henn: fully homomorphic encryption accelerator with high energy efficiency,”Cybersecurity, vol. 8, no. 1, p. 98, 2025. [Online]. Available: https://link.springer.com/article/10.1186/s42400-025-00360-x

work page doi:10.1186/s42400-025-00360-x 2025