Homomorphic Encryption in Production: Practical Limits 2026

Q: What does homomorphic encryption actually let a server do, and what does it stop the server from doing?

It lets a server add and multiply encrypted values and return an encrypted result without ever holding the decryption key, so the server never sees the inputs, the intermediate values or the output. The client encrypts, the server computes, the client decrypts. What it stops the server from doing is everything that depends on seeing the data: it cannot branch on a comparison, because the comparison result is itself encrypted; it cannot stop a loop early, because it does not know when the condition is met; it cannot skip rows with an index, because it cannot tell which rows match; and it cannot tell whether the answer is correct. Every algorithm has to be rewritten as a fixed circuit that does the same work for every possible input. That single property, computing blind, explains the cost multiple, the ban on data-dependent control flow and the precision limits that the vendors' own documentation describes.

Q: Which homomorphic encryption scheme should I use: BFV, BGV, CKKS or TFHE?

The scheme follows from the computation, not from preference. OpenFHE's documentation lists BFV and BGV for exact modular arithmetic on encrypted integers, CKKS for approximate arithmetic on encrypted real numbers, and the FHEW and TFHE family for Boolean circuits and lookup tables with fast bootstrapping. Microsoft SEAL's README gives the practical rule: CKKS is by far the best choice for summing encrypted reals, evaluating machine-learning models or computing distances, and BFV or BGV where exact values are necessary. Apple chose BFV for its private lookups because dot products and cosine similarity on embedding vectors are what it supports efficiently. Zama chose TFHE because programmable bootstrapping evaluates arbitrary functions on small integers, which is what an encrypted token balance or a quantised neural network needs. A balance, a count or a compliance threshold must never be computed in CKKS, because CKKS results are approximate by design and slightly wrong is not a legal category.

Q: What is Apple actually running in production with homomorphic encryption?

Apple's machine learning research site describes two production patterns built on the Brakerski-Fan-Vercauteren scheme with parameters it says achieve post-quantum 128-bit security. The first is private information retrieval, an exact keyword-value lookup in which the device encrypts its keyword, the server computes between the ciphertext and its own database and returns an encrypted value, so the server never learns the phone number that called, the business that emailed or the URL being checked against parental controls. The second is private nearest neighbour search, in which the device encrypts an embedding, the server runs a nearest-neighbour search under encryption and the device decrypts and reranks the candidates locally; this powers Enhanced Visual Search for Photos. Apple pairs the encryption with differential privacy at epsilon 0.8 and decoy queries for shard selection and an OHTTP relay to hide the source address, and it has open-sourced the Swift library with the PIR and PNNS database tooling it uses. The shape is the lesson: a fixed computation, the client holds the key, the server's database is its own.

Q: How does homomorphic encryption compare with a trusted execution environment such as Nitro Enclaves or confidential GPUs?

They move trust to different places at very different prices. Homomorphic encryption trusts lattice mathematics and the client's key, so the server is trusted with nothing, and the cost is orders of magnitude in compute plus a ban on data-dependent logic and a precision ceiling. A trusted execution environment trusts the CPU or GPU vendor's silicon, firmware and attestation chain, and in exchange runs full-size models at near plaintext speed. If every party and regulator can accept an attested enclave in the trusted computing base, the enclave wins on cost almost every time and an LLM on sensitive inputs belongs there, not under encryption. If the threat model says the cloud provider or hardware vendor must not be trusted at all, homomorphic encryption and secure multi-party computation are the two remaining options. One genuine advantage of homomorphic encryption is that it is already lattice-based, so Apple's parameters are chosen for post-quantum security, while an enclave's attestation chain may still rest on classical signatures.

Q: What should I refuse to build with homomorphic encryption?

Refuse the encrypted data warehouse, because a warehouse needs indexes, joins and predicates that skip rows, and computing blind means touching every row for every query. Refuse the encrypted LLM, because attention over long sequences in floating point with data-dependent softmax exhausts noise budgets and needs bootstrapping at every layer; the honest answer is a confidential GPU enclave. Refuse training on encrypted data, because training needs the gradient to steer the next step, which is control flow on data the server cannot see. And refuse any design in which the operator holds the decryption key for convenience, because that is encryption at rest with extra steps and a clean room would be simpler and no less secure. DARPA's programme page states that software FHE on standard hardware remains untenable for practical data security applications and targets a factor of ten from plaintext with purpose-built accelerators; that is the agency that funded the field describing the general case in 2026.

Q: What are the real performance and precision limits in 2026?

The limits are published by the vendors. Zama's Concrete ML documentation states that FHE requires all inputs, constants and intermediate values to be integers of at most 16 bits, that models are quantised to meet that limit with a measurable accuracy cost, and that its client-independent deployment mode adds a conversion layer with a 4 to 5 times latency overhead. Its CPU benchmarks are published against an AWS hpc8a.96xlarge with two 96-core AMD EPYC processors and 768 GB of RAM, which is not the class of machine most teams budget for an API tier. TFHE-rs defaults to a failure probability of at most 2 to the minus 128 in the IND-CPA-D model, and Apple's README warns that BFV does not provide IND-CCA security and loses IND-CPA-D security when decryption error is non-negligible. DARPA's goal of a factor of ten from plaintext is a hardware target, not a software reality. The practical rule is to measure the whole circuit at production input size on the hardware you will buy before anyone commits to a roadmap.

Q: What are the most common anti-patterns in homomorphic encryption projects?

Starting from the production model and asking the library to encrypt it, instead of designing a fixed-shape circuit, quantising it and simulating accuracy first. Benchmarking a single encrypted dot product and extrapolating to a pipeline that has multiplicative depth, bootstrapping and ciphertext expansion the demo never showed. Letting the operator hold a decryption key, which removes the guarantee and makes the audit story false. Protecting the content of a query while leaking its pattern through timing, size, shard routing and source address, which Apple closes with decoy queries, differential privacy and a relay. Treating approximate CKKS arithmetic as exact for balances or thresholds. Exposing decryption failures to untrusted callers, which creates an oracle. Choosing a library by GitHub stars rather than by scheme fit and release cadence, when SEAL has stopped NuGet releases and Google's transpiler is archived in favour of HEIR. And buying products described as encrypted databases or encrypted LLMs on the strength of the phrase.

Q: What does a mature adoption path for homomorphic encryption look like?

Five stages, and stopping at the second is a correct outcome rather than a failure. First, write the threat model: who must not see the data, and whether an attested enclave is acceptable to every party and regulator; if it is, take the confidential computing path and stop. Second, reduce the use case to a fixed circuit, a lookup, a dot product, a quantised model or an integer state machine, and pick the scheme by that circuit; if it cannot be reduced, say so in writing and redirect the budget. Third, quantise and simulate in the clear, then measure the compiled circuit at production input size on the hardware you will deploy, with the documented failure probability and security level, and publish the cost multiple against plaintext. Fourth, close the metadata channel with padding or decoys, a differential-privacy budget on routing, an anonymising relay, client-side key custody and threshold decryption for any multi-party output. Fifth, operate it as cryptography: versioned parameter sets, a compiler layer as the integration point so backends can be replaced, and an entry in both the post-quantum inventory and the privacy register.

Satyam Kumar

返回博客

cyber-security-patterns

Homomorphic Encryption in Production: The Server Computes Blind, So Only Fixed-Shape Lookups and Small Models Pay, and Everything Else Is a Trusted-Execution Decision (2026)

By Satyam KumarOctober 9, 202623 min read

homomorphic encryption production fully homomorphic encryption limits fhe vs trusted execution environment privacy enhancing technologies comparison apple homomorphic encryption pir private information retrieval architecture zama tfhe-rs concrete ml encrypted inference openfhe ckks bfv tfhe heir fhe compiler darpa dprive fhe accelerator encrypted machine learning inference confidential computing vs fhe secure multi-party computation vs fhe privacy preserving ml architecture post-quantum lattice cryptography

Homomorphic Encryption in Production: The Server Computes Blind, So Only Fixed-Shape Lookups and Small Models Pay, and Everything Else Is a Trusted-Execution Decision (2026)

Frequently Asked Questions

分享这篇文章

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

人工智能和云架构师。帮助团队构建可扩展到数百万的系统。

LinkedIn GitHub

Homomorphic Encryption in Production: The Server Computes Blind, So Only Fixed-Shape Lookups and Small Models Pay, and Everything Else Is a Trusted-Execution Decision (2026)

Frequently Asked Questions

分享这篇文章

Comments

Leave a comment