Homomorphic encryption lets a server compute on data it cannot read, and after a decade of work on the CKKS family the remaining problem is not security but cost: overheads still run orders of magnitude above plaintext, so most 2026 systems papers either accelerate the arithmetic in hardware or route around full FHE with hybrids and restricted operation sets.
Summary
Homomorphic encryption (HE) is a class of encryption schemes in which arithmetic on ciphertexts corresponds to arithmetic on the underlying plaintexts. A client encrypts, an untrusted server computes, the client decrypts and gets the answer it would have got in the clear. Fully homomorphic encryption (FHE) is the general case: arbitrary computation on encrypted data with no decryption key on the server side. The dominant modern constructions rest on Ring Learning with Errors (RLWE) lattice problems and split into approximate-arithmetic schemes (CKKS, and the related BGV) used for neural network and vector workloads, and Boolean/gate-level schemes (TFHE) used for general-purpose integer and control-flow code. Simpler additive-only schemes such as Paillier sit at the cheap end.
A second, quieter theme in the same literature is avoidance. Bifrost keeps only linear layers in CKKS on the accelerator and runs non-linear and cache-state operators inside a CPU trusted execution environment. A music retrieval paper observes that if only one operand is encrypted, similarity search collapses to additions and ciphertext-plaintext multiplications, removing bootstrapping entirely. PrivDNN pushes work to the client with partial model encryption specifically to avoid the server carrying the ciphertext-domain load. Where systems designers reach for these, they are telling you what full FHE still costs.
Evidence base
Open questions
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.
Recent mentions
2026-07-10The Next VC Meme Is...substack
2025-12-01The Holy Grail of Crypto Privacy: Encrypted Ethereum, FHE & Living Forever | Rand Hindi, Zama Co-Founderweb
2025-10-09A Specific Theory of Sovereign AIsubstack
2025-09-10UK Opportunity in AI: Compound Semiconductorssubstack
2023-10-13Understanding Confidential Computing (feat. Ilja Aizenberg, M Ventures)substack
2023-07-06🔮E07: Decentralised AIsubstack
Frontier questions
Does modified AI silicon actually close the gap? MPX reports 20% extra area for dual-mode operation and more than 1.2x lower polynomial-multiplication latency 2026 06 16 mpx a unified systolic array for matrix and polynomial multi; what total end-to-end speedup do such changes deliver on a full CKKS inference, and would a GPU or TPU vendor accept the area and precision changes proposed in FHECore-style designs 2026 07 29 fhecore rethinking gpu microarchitecture for fully homomorph?
How much of the current gap is scheme-inherent versus tooling? With CKKS a decade old and no fifth generation indicated 2026 07 08 libfhe a numba based cuda python library for non rns ckks bg, is there a remaining algorithmic step change, or only compounding engineering at 1.2x-3.9x per layer?
Do the polynomial approximations required for non-linear operators hold accuracy on frontier-scale models, given that automated per-layer search already faces roughly 10^225 configurations for a 32-layer model 2026 07 28 atlas automated approximation of transformers for efficient ?
Is the reliability envelope compatible with commodity infrastructure? Encrypted fault injection indicates a safe boundary near a bit-error rate of 10^-5 2026 07 22 prism sensitivity aware polynomial pruning for efficient neu; what does mandatory checksum protection 2026 07 22 an efficient fault tolerance scheme for ckks computation on add to the already large overhead in production?