REVIEW 4 major objections 5 minor 13 references
On the Sensitivity to Errors in Homomorphic Computing: Single Transient Bit-flip Client-side Error Characterization
T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash
Pith's one-line read The paper claims that homomorphic multiplication is the most error-sensitive operation in practical CKKS pipelines, and that its fault signature dominates the pipeline whenever a multiplication runs.
desk verdict Plausible new taxonomy, but the paper's central claims are asserted rather than shown. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the CKKS ciphertext as a pair of polynomials $(c_0(X), c_1(X))$ of degree $N$, representing a plaintext polynomial $p(X)$ in a noisy modular arithmetic domain. The paper's analysis mechanism is sequential single-bit fault injection into every coefficient of the plaintext and ciphertext, measuring recovered-data error as Maximum Relative Error Percentage (MREP), and classifying outcomes by which structural positions (values below the scaling factor $\Delta$, values beyond modulus $Q$, gap coefficients, the $N/2$-th coefficient) absorb or propagate the bit flip. The addition/multiplication dichotomy is what carries the argument: it organizes otherwise scattered fault outcomes into two reproducible profiles.
What would settle it
Run a hardware-injected fault experiment during a server-side homomorphic multiplication, for example flipping a bit inside the modular multiplier or NTT unit, and compare the decoded output error distribution with the client-side multiplication pattern; if the server-side faults do not match the same dominance or coefficient-position profile, the paper's characterization is limited to client-side injection.
Extended reading notes
Core claim
Under single-bit-flip injection in Vanilla and RNS variants of CKKS, bit flips in values below the scaling factor or beyond the modulus are masked, while flips in gap coefficients and the N/2-th coefficient behave differently in the plaintext and in the first ciphertext component versus the second. When multiplication is added, these resilient coefficient positions weaken: in Vanilla CKKS they survive only up to an error threshold, and in RNS CKKS they are completely corrupted. Configurations using NTT or combined RNS+NTT arithmetic are fully susceptible: any single bit flip causes catastrophic decoding or decryption failure, so no comparable pattern exists. The paper concludes that the resilience profiles form two patterns, addition and multiplication, and that the multiplication pattern dominates the pipeline whenever multiplication is present.
Load-bearing premise
The load-bearing premise is that flipping a single bit in a client-side plaintext or ciphertext coefficient faithfully represents the transient hardware faults that cause silent data corruption during real server-side execution; if real faults occur inside arithmetic units, in multiple bits, or in different polynomial positions, the observed pattern may not transfer.
Editorial extensions
If this is right
- A CKKS pipeline that contains at least one homomorphic multiplication inherits the multiplication resilience pattern, so its fault behavior can be predicted from that operation alone.
- Fault protection for practical CKKS workloads can prioritize multiplication circuit paths, because addition-only segments show a distinct and more forgiving pattern.
- Because the patterns are parameter- and data-independent, the same resilience characterization applies across different ciphertext moduli, scaling factors, ring degrees, and input data.
- In NTT and RNS+NTT arithmetic modes, the absence of any resilient coefficient position means a single bit flip is already catastrophic, so those modes need stronger detection or correction.
- The two named patterns give a design rule: classify a CKKS pipeline by whether it contains a multiplication, then choose an error-detection strategy accordingly.
Reading between the lines
- An extension the paper leaves implicit is that faults injected directly inside server-side arithmetic units, rather than into stored client-side coefficients, may follow the same multiplication-pattern domination; this is testable with fault injection into a modular multiplier.
- If the domination transfers, error-detection mechanisms could be applied only to multiplication outputs, cutting the overhead of protecting every homomorphic operation.
- The addition-versus-multiplication taxonomy may carry over to other LWE-based schemes whose ciphertexts also split into a data-dependent and a key-dependent component, though the paper does not claim this.
- The total vulnerability of NTT and RNS+NTT modes suggests a hardware-design trade-off between speed optimizations and fault tolerance that a quantitative cost comparison could make explicit.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript analyzes bit-level fault sensitivity in the CKKS homomorphic encryption scheme. The authors inject single bit-flips into client-side plaintext and ciphertext polynomial coefficients, run the full CKKS pipeline, and measure the effect with the Maximum Relative Error Percentage (MREP). From this they claim two resilience 'patterns' (Addition and Multiplication), that the Multiplication pattern dominates whenever a multiplication is performed on the server, and that these patterns are independent of parameters and data. The abstract states that homomorphic multiplication is 'the most error-sensitive operation in practical HE pipelines.'
Significance. If the central claims were substantiated, the paper would provide a useful fault-tolerance taxonomy for CKKS deployments: distinguishing addition-like resilience from multiplication-like propagation, and directing fault-protection efforts toward multiplication. The paper has one genuine strength: the fault-injection methodology is direct and uses an existing open-source framework (LLTFI), and the experimental setup is described in terms of a custom CKKS implementation with togglable RNS/NTT options. However, the manuscript does not establish its central claims: there are no reported MREP values, no error bars, no parameter sweep, no comparison with rotation or bootstrapping, and the injection model does not match the server-side fault scenario depicted in the paper. The claimed 'parameter and data independence' is asserted from a single displayed configuration. As a result, the significance of the work is currently prospective rather than demonstrated.
major comments (4)
- [Section II (error model) and Figure 2] The fault model is inconsistent with the claimed threat scenario. Figure 2 illustrates a faulty CPU corrupting server-side computation on encrypted data, but the experiments inject bit-flips into client-side plaintext and ciphertext coefficients before the pipeline runs. A transient fault inside server-side arithmetic can occur in NTT, RNS limb arithmetic, modular multiplication, relinearization, or carry logic, at a different polynomial position and after noise has already grown. The Section II-B statement that 'whenever a multiplication is performed on the server, the overall resilience profile consistently follows this pattern' is therefore an extrapolation, not a result of the experiments described. A direct Add-versus-Mult comparison under the same fault-injection protocol, and preferably with server-side fault injection inside individual CKKS arithmetic stages, is needed before the 'most error-sensitive operation' claim can be evaluated.
- [Section II-B and Figure 3] The 'domination' claim is not supported by any quantitative comparison. The paper gives no MREP values, no thresholds, no confidence intervals, and no side-by-side comparison of Add-only, Mult-only, Rot-only, or bootstrapped pipelines. The pipeline configurations in Section II list rotations and bootstrapping, but no results for these operations are reported. Figure 3 shows a single configuration (Gaps=2, logQ=60, logDelta=25, N=64, epsilon=0.1) without axes or detailed captions, so the reader cannot verify the claimed pattern or the alleged dominance. The abstract's 'most error-sensitive operation' is thus an overclaim relative to the evidence presented.
- [Section II-C (parameter and data independence)] The claim that the observed resilience heuristics are 'independent of both parameters and data' is load-bearing and unsupported. The only displayed experiment uses one ring dimension, one modulus, one scaling factor, one gap count, and one epsilon value. No parameter sweep over N, logQ, logDelta, gap count, or epsilon is reported, and no multiple datasets are tested. A single point cannot establish parameter/data independence; this assertion is one of the three main contributions and requires either a systematic sweep with reported statistics or a much narrower, formal claim.
- [Section II experimental setup] The experimental configuration is far from 'practical HE pipelines.' N=64 is an extremely small ring dimension; practical CKKS deployments for machine learning workloads typically use ring dimensions of 2^15 or larger and much larger moduli. If the stated goal is to characterize 'practical' pipelines, the authors must either justify why N=64 is representative or show that the patterns persist at realistic parameter sizes. Without such evidence, the universal wording of the claims ('whenever a multiplication is performed,' 'independent of parameters') is unjustified.
minor comments (5)
- [Section II-A] The description of the Addition pattern is difficult to parse: phrases such as 'exceeding the modulus (Q) resilience' and 'masked plaintext' are used without formal definitions of masking or resilience, and no measured values illustrate the claimed behavior.
- [Figure 3 caption] The caption is garbled: 'ptx’, c′0, and c′1 denote computed ciphertext-ciphertext c0, c1, and decrypted ptx respectively' does not clearly identify which curves correspond to which quantities, and the axes, units, and legend are not described.
- [Section I] The enumeration 'we present that 1). error resilience ... 2). Multiplication pattern dominates ... 3). the two resilience patterns observed are parametric and data independent' contains grammatical and formatting errors, and 'parametric' appears to be used to mean 'parameter-dependent' while the claim later says 'independent of parameters'; the intended meaning should be clarified.
- [Section II (tooling)] The paper says fault injection uses LLTFI, which is designed for machine learning applications, but does not explain how it was adapted to inject into CKKS polynomial coefficients or which code locations were instrumented.
- [Conclusion] The phrase 'formal awareness' and 'formally categorized' overstate the level of formality; the analysis is purely empirical and no formal model or theorem is presented.
Circularity Check
No circularity: the sensitivity taxonomy is obtained by direct fault-injection measurement, not by fitted parameters, self-citation, or definitional identity.
full rationale
The paper does not contain a circular derivation chain. The central sensitivity taxonomy (Addition pattern vs. Multiplication pattern) is obtained by direct fault injection: Section II states that “each bit of every polynomial coefficient (in both the plaintext and the ciphertext) is flipped in sequence … After each bit error injection, we execute the entire HE pipeline, and compare the recovered data after decoding … using MREP.” No parameter is fitted to a target quantity, no “prediction” is drawn from a fitted model, and no load-bearing claim is justified by self-citation. The cited tools (OpenFHE, HEaaN, SEAL, PyFHE, LLTFI) are external resources, not the authors’ own prior results invoked as authority. The assertion that the multiplication pattern dominates is an empirical generalization from the injected experiments, not a definitional identity. The main weakness is external validity: single bit flips are injected client-side into plaintext/ciphertext coefficients, whereas the conclusion concerns server-side faulty computation (“whenever a multiplication is performed on the server”). That mismatch is a threat to how well the result transfers to real transient faults inside server arithmetic, but it is not circularity, because the output of the fault-injection experiments is not assumed in the input. An independent server-side injection comparison would strengthen the paper, but its absence does not make the derivation circular.
Assumptions & free parameters
free parameters (5)
- ring dimension N =
64
- modulus log Q =
logQ = 60
- scaling factor log delta =
logDelta = 25
- gap count =
2
- epsilon =
0.1
assumptions (3)
- domain assumption The custom C-CKKS implementation faithfully realizes standard CKKS, RNS, NTT, and combined RNS+NTT operations.
- domain assumption Single-bit flips in plaintext and ciphertext coefficients model the transient hardware faults that cause silent data corruption.
- ad hoc to paper Maximum Relative Error Percentage is an adequate scalar summary of silent data corruption.
Cite this review
Pith. "Pith review of On the Sensitivity to Errors in Homomorphic Computing: Single Transient Bit-flip Client-side Error Characterization." pith.science (2026). https://pith.science/paper/FARZX74F
@misc{pith2026260811155,
author = {Pith},
title = {Pith review of: On the Sensitivity to Errors in Homomorphic Computing: Single Transient Bit-flip Client-side Error Characterization},
year = {2026},
howpublished = {\url{https://pith.science/paper/FARZX74F}},
note = {Machine review of arXiv:2608.11155}
}
read the original abstract
Homomorphic Encryption (HE) enables computation on encrypted data without decryption and is a key primitive for privacy-preserving computation in sensitive domains such as healthcare, finance, and government. Its security relies on noise injection, which introduces intrinsic error sensitivity and raises concerns about the fault tolerance of HE systems, as hardware- and software-induced faults can evade traditional detection mechanisms and lead to silent data corruption. In this work, we analyze the sensitivity of HE to bit-level faults, focusing on the CKKS (Cheon--Kim--Kim--Song) scheme widely used for approximate arithmetic in AI and machine learning workloads. We identify homomorphic multiplication as the most error-sensitive operation in practical HE pipelines and characterize how faults propagate and amplify through it, exposing a critical robustness vulnerability and motivating the need for more resilient HE deployments.
Figures
Reference graph
Works this paper leans on
-
[1]
Cloud computing and economic growth,
K. Konstantinos, M. Persefoni, F. Evangelia, M. Christos, and N. Mara, “Cloud computing and economic growth,” inProceedings of the 19th Panhellenic Conference on Informatics, 2015, pp. 209–214
work page 2015
-
[2]
Security and privacy issues in cloud computing,
J. Sen, “Security and privacy issues in cloud computing,” inCloud technology: concepts, methodologies, tools, and applications. IGI global, 2015, pp. 1585–1630
work page 2015
-
[3]
A modification of the RSA public-key encryption pro- cedure (corresp.),
H. Williams, “A modification of the RSA public-key encryption pro- cedure (corresp.),”IEEE Transactions on Information Theory, vol. 26, no. 6, pp. 726–729, 1980
work page 1980
-
[4]
A public key cryptosystem and a signature scheme based on discrete logarithms,
T. Elgamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,”IEEE Transactions on Information Theory, vol. 31, no. 4, pp. 469–472, 1985
work page 1985
-
[5]
X. Yi, R. Paulet, E. Bertino, X. Yi, R. Paulet, and E. Bertino,Homo- morphic encryption. Springer, 2014
2014
-
[6]
Homomorphic encryption for arithmetic of approximate numbers,
J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inAdvances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409– 437
2017
-
[7]
A full RNS variant of approximate homomorphic encryption,
J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full RNS variant of approximate homomorphic encryption,” inSelected Areas in Cryptography–SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15–17, 2018, Revised Selected Papers 25. Springer, 2019, pp. 347–368
work page 2018
-
[8]
On lattices, learning with errors, random linear codes, and cryptography,
O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” inProceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing, ser. STOC ’05, 2005, p. 84–93. [Online]. Available: https://doi.org/10.1145/1060590.1060603
arXiv 2005
Show all 13 references
-
[9]
Silent data corruptions at scale,
H. D. Dixit, S. Pendharkar, M. Beadon, C. Mason, T. Chakravarthy, B. Muthiah, and S. Sankar, “Silent data corruptions at scale,” 2021. [Online]. Available: https://arxiv.org/abs/2102.11245
2021 arXiv
-
[10]
OpenFHE: Open-source fully homomorphic encryption library,
A. A. Badawi, A. Alexandru, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Lee, Z. Liu, D. Micciancio, C. Pascoe, Y . Polyakov, I. Quah, S. R.V ., K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V . Vaikuntanathan, and V . Z...
2022
-
[11]
Microsoft SEAL (release 4.1),
“Microsoft SEAL (release 4.1),” https://github.com/Microsoft/SEAL, Jan. 2023, microsoft Research, Redmond, W A
2023
-
[12]
py-fhe: A Python library for fully homomorphic encryp- tion,
S. Erabelli, “py-fhe: A Python library for fully homomorphic encryp- tion,” https://github.com/sarojaerabelli/py-fhe, 2020, gitHub repository, implemented BFV , CKKS, and CKKS bootstrapping schemes; MIT license
2020
-
[13]
Lltfi: Framework agnostic fault injection for machine learning applications (tools and artifact track),
U. K. Agarwal, A. Chan, and K. Pattabiraman, “Lltfi: Framework agnostic fault injection for machine learning applications (tools and artifact track),” in2022 IEEE 33rd International Symposium on Software Reliability Engineering (ISSRE), 2022, pp. 286–296
2022
Reviewed August 12, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.