- Type
- Cryptographic technique
- Key property
- Computation on ciphertext
- Variants
- Partial (PHE), somewhat (SHE), fully (FHE)
- First practical scheme
- Craig Gentry, 2009
- Common libraries
- Microsoft SEAL, TFHE, Concrete-ML, TenSEAL
- Related
- Differential privacy, federated learning, secure multi-party computation
- Type
- Cryptographic technique
- Key property
- Computation on ciphertext
- Variants
- Partial (PHE), somewhat (SHE), fully (FHE)
- First practical scheme
- Craig Gentry, 2009
- Common libraries
- Microsoft SEAL, TFHE, Concrete-ML, TenSEAL
- Related
- Differential privacy, federated learning, secure multi-party computation
History and Background
The concept of "computing on encrypted data" dates to Rivest, Adleman and Detrozio in the 1970s, but the field is dated from Craig Gentry's 2009 PhD thesis, the first scheme shown to be fully homomorphic — capable of supporting an unlimited sequence of additions and multiplications. Gentry's construction was prohibitively slow, and a decade of follow-up work produced the practical leveled schemes used today, which support a bounded depth of computation and are far cheaper. The main modern families are BFV and BGV (exact arithmetic over integers), CKKS (approximate arithmetic on real numbers, the usual choice for machine-learning inference) and TFHE (fast Boolean operations and bootstrapping).[1][5]
Adoption has been driven by open-source libraries rather than standards bodies: Microsoft SEAL is the most widely used C++ implementation, TenSEAL wraps it for Python and PyTorch, and Zama's Concrete-ML offers scikit-learn-compatible models that run directly on ciphertext. Cloud providers have followed — Amazon Web Services documents end-to-end encrypted machine-learning inference on Amazon SageMaker AI using fully homomorphic encryption (FHE), where queries, responses and intermediate values stay encrypted even from the provider itself.[2][3]
Key Concepts and Technology
Three properties separate the variants. Partial homomorphic encryption supports one operation indefinitely (for example RSA's multiplication); somewhat homomorphic encryption supports both operations but only up to a noise-limited depth; fully homomorphic encryption supports arbitrary operations through a procedure called bootstrapping, which refreshes the noise that accumulates in every ciphertext operation. Noise management is the central engineering problem: each operation inflates it, and decryption fails once it crosses a threshold.
For AI, the practical trade-off is cost. Encrypted operations are typically orders of magnitude slower than plaintext ones, so current practice restricts itself to inference rather than training, uses approximation-friendly schemes such as CKKS, and quantizes or otherwise simplifies models so that the number of homomorphic operations stays small. Researchers routinely compare FHE against alternatives such as garbled circuits and secure multi-party computation: FHE is non-interactive and requires no online communication rounds, while garbled circuits are often faster and lighter on memory.[5] A related early milestone is CryptoNets (2016), which showed that a neural network could classify encrypted images end to end.[1]
Applications and Impact
Documented use cases cluster where regulation forbids raw data from leaving the data owner: healthcare providers running a cloud-hosted model on encrypted patient records, insurers scoring medical procedures, telecom operators scanning customer messages for phishing, and oil-and-gas companies having satellite imagery interpreted without revealing sensitive locations.[3] Other experiments include encrypted image watermarking for AI-generated content, where a watermarking service embeds or verifies marks without ever seeing the image, and confidential model serving, where the model weights themselves stay secret from the cloud operator.[4]
>See Also
🇲🇾 Relevance to Malaysia: homomorphic encryption maps directly onto the Personal Data Protection Act 2010 as amended in 2024, which governs how personal data — including sensitive data such as health and financial information — may be processed and to whom it is disclosed. Malaysian banks, insurers and healthcare providers that want to use cloud AI without exporting identifiable records are the natural audience for encrypted inference. The technique also complements rather than replaces the country's other privacy controls: differential privacy, federated learning and confidential computing each answer a different question, and most deployments combine them. For local adopters the practical position in 2026 is that FHE is usable for narrow, high-value inference paths — fraud scoring, document classification, medical prediction — but not for training large models or for general-purpose analytics. Malaysian data-centre growth under the National AI Office and the national compute agenda makes in-country encrypted inference increasingly attractive to regulated sectors, while the Ministry of Digital's published guidelines on data protection by design give organisations a framework for documenting why a privacy-enhancing technology was chosen.[2]
References
- ↑Gentry, C. (2009). *A Fully Homomorphic Encryption Scheme*. Stanford University doctoral dissertation. https://crypto.stanford.edu/craig/
- ↑Microsoft Research. Microsoft SEAL: homomorphic encryption library. https://www.microsoft.com/en-us/research/project/microsoft-seal/
- ↑Amazon Web Services. End-to-end encrypted ML inference with Amazon SageMaker AI and FHE. https://aws.amazon.com/blogs/machine-learning/end-to-end-encrypted-ml-inference-with-amazon-sagemaker-ai-and-fhe/
- ↑Zama. Encrypted image watermarking using fully homomorphic encryption and Concrete ML. https://zama.ai/post/encrypted-image-watermarking-using-fully-homomorphic-encryption
- ↑arXiv (2025). Comparison of Fully Homomorphic Encryption and Garbled Circuit techniques in privacy-preserving machine learning inference. https://arxiv.org/abs/2510.07457