Secure Multiparty Computation and Homomorphic Encryption for ML

A hospital wants a diagnosis from a vendor's model. The hospital cannot send the scan, and the vendor will not ship the weights. Cryptography offers a third option: compute the prediction on data neither side reveals. In 2020 CrypTFlow ran ResNet-50 on ImageNet inputs this way in about 30 seconds under a semi-honest three-party protocol, and in under two minutes with malicious security (Kumar et al., 2020, CrypTFlow: Secure TensorFlow Inference, IEEE S&P, arXiv:1909.07814). The same forward pass in plaintext on a GPU takes on the order of milliseconds. That ratio, not the possibility, is the subject of this concept.

Unlike Differential Privacy and the Epsilon You Actually Get, which bounds what an output reveals, and Federated Learning and Secure Aggregation, which hides individual updates in a sum, these tools hide the inputs to a computation while it runs. They say nothing about what the output leaks.

Secret sharing: linear is cheap, multiplication is not

In additive secret sharing a value \(x\) in the ring \(\mathbb{Z}_{2^\ell}\) is split into random shares \(x_1, \dots, x_m\) with \(x = \sum_i x_i \bmod 2^\ell\). Any \(m-1\) shares are uniformly random and reveal nothing. Addition, and multiplication by a public constant, happen locally on each share with no communication, so the matrix multiplications of a layer with public weights are nearly free.

Multiplying two secrets needs interaction. With a precomputed Beaver triple \((a, b, c)\), \(c = ab\), shared among the parties, they open the masked values \(d = x - a\) and \(e = y - b\), which reveal nothing because \(a\) and \(b\) are random, and compute

using only local operations on shares (Beaver, 1991, Efficient Multiparty Protocols Using Circuit Randomization, CRYPTO). Each multiplication costs one round of communication and one triple.

Non-linearities are where the cost concentrates. ReLU requires a secure comparison, softmax needs exponentials and division, and GeLU has no cheap exact form. Protocols either build these from bit-level circuits, which is communication-heavy, or replace them with polynomial or piecewise approximations, which changes the model. CrypTFlow2 made two-party inference on ResNet-50 practical largely through new comparison and division protocols, reporting an order of magnitude less communication and 20x to 30x less time than prior work (Rathee et al., 2020, CrypTFlow2, ACM CCS, arXiv:2010.06457). Transformers are harder. PUMA evaluates LLaMA-7B in about five minutes per generated token, with approximations for GeLU and softmax (Dong et al., 2023, PUMA: Secure Inference of LLaMA-7B in Five Minutes, arXiv:2307.12533). A 200-token answer at that rate takes over 16 hours.

Homomorphic encryption: compute under one key

Homomorphic encryption lets a single untrusted server compute on ciphertexts, with no second party whose honesty matters. Fully homomorphic schemes date from Gentry's lattice construction (Gentry, 2009, Fully Homomorphic Encryption Using Ideal Lattices, STOC). For ML the workhorse is CKKS, which encrypts approximate real numbers (Cheon, Kim, Kim & Song, 2017, Homomorphic Encryption for Arithmetic of Approximate Numbers, ASIACRYPT). A message \(m\) is scaled by \(\Delta\) and decrypts to \(\Delta m + e\) for a small noise \(e\). Multiplying two ciphertexts yields \(\Delta^2 m_1 m_2\) plus larger noise, so a rescale divides by \(\Delta\) and drops one prime from the ciphertext modulus \(Q = \prod_{i=0}^{L} q_i\). After \(L\) multiplications the modulus is exhausted, and only bootstrapping, a costly homomorphic re-encryption, restores levels.

Two consequences follow. Every activation must be a low-degree polynomial, which is why CryptoNets replaced sigmoids with squaring and reached 99% on MNIST at around 59,000 predictions per hour on one PC (Gilad-Bachrach et al., 2016, CryptoNets, ICML). And throughput comes from packing: with ring dimension \(N = 2^{16}\), one ciphertext holds \(N/2 = 32{,}768\) values processed in parallel.

Where it is actually deployed

The pattern that ships is small computation on a compact encrypted input, not a full network. Apple uses BFV homomorphic encryption for private nearest-neighbour lookups in Enhanced Visual Search: the device encrypts an embedding, the server matches it against a landmark index it cannot read, and returns encrypted results (Apple Machine Learning Research, 2024, Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem).

When it breaks

The output still leaks. A perfectly secure protocol returns the true prediction, and predictions are enough for model extraction and membership inference. Most protocols also reveal shapes: architecture, input length, number of generated tokens.

Trust assumptions are moved, not removed. Three-party protocols assume the servers do not collude, which no participant can verify. Semi-honest security assumes parties follow the protocol; malicious security costs more, and CrypTFlow's malicious variant leans on trusted hardware integrity. Practitioners disagree about whether that trade is acceptable: advocates of confidential computing argue a hardware enclave gives near-plaintext speed for a trust assumption no worse than non-collusion, while cryptographers point to the history of enclave side-channel breaks.

Approximation changes the model. Polynomial activations and CKKS's approximate arithmetic shift outputs. Some systems fine-tune or distil into approximation-friendly models, while PUMA reports comparable accuracy without fine-tuning; accuracy has to be re-measured on the secure path, not assumed from plaintext.

Latency is set by the network. Interactive protocols exchange many rounds of messages, so the round-trip time between parties, not their compute, often dominates; a benchmark measured on a LAN says little about parties in different regions. BOLT, for example, reports its speedups across several network settings precisely because they differ (Pang et al., 2024, BOLT: Privacy-Preserving, Accurate and Efficient Inference for Transformers, IEEE S&P, IACR ePrint 2023/1893). Training under these tools costs far more again than inference.