Private Machine Learning with FHE: Running AI on Encrypted Data

Machine learning models often need access to sensitive data. FHE enables ML inference on encrypted data—the model never sees the plaintext input, yet produces correct predictions. This opens new possibilities for privacy-preserving AI.

The Private ML Challenge

Traditional ML deployment creates privacy tensions:

• Cloud ML services see all your data
• Sensitive inputs (medical, financial, personal) are exposed
• Model providers may learn from your data
• Regulatory constraints limit where data can be processed

FHE ML allows you to use powerful cloud models while keeping data completely private.

How FHE ML Works

The process involves several steps:

The server performs real computation—matrix multiplications, activations, etc.—all on encrypted values.

Supported Operations

FHE supports operations needed for ML:

• Linear layers: Matrix multiplication via homomorphic operations
• Convolutions: Implemented as matrix operations
• Activations: Polynomial approximations of ReLU, sigmoid, etc.
• Pooling: Average pooling works directly; max pooling requires approximation

// Example: Encrypted linear layer
// W is plaintext weights, x is encrypted input
encrypted_output = W * encrypted_x + encrypted_b

// Polynomial ReLU approximation
// x^2 / 4 + x / 2 + 1/4 approximates ReLU for small x
encrypted_relu = a*encrypted_x^2 + b*encrypted_x + c

Model Architecture Considerations

Some architectures work better with FHE:

FHE-Friendly:

• Shallow networks (fewer multiplications)
• Polynomial activations
• Convolutional networks
• Square activations

FHE-Challenging:

• Very deep networks
• Attention mechanisms (expensive comparisons)
• Batch normalization (division issues)
• Sparse operations

CKKS for ML

CKKS is the preferred scheme for ML because:

• Native approximate arithmetic suits ML's tolerance for imprecision
• Efficient rescaling after multiplications
• Real number encoding matches neural network weights
• Good vectorization for batched inference

Performance Reality

FHE ML is slower than plaintext, but increasingly practical:

• Simple classifiers: Milliseconds
• CNNs on small images: Seconds
• Larger networks: Minutes
• With GPU acceleration: 10-100x faster

Real-World Applications

FHE ML is being used for:

• Medical diagnosis on encrypted patient data
• Financial fraud detection without exposing transactions
• Face recognition with encrypted templates (H33's specialty)
• Sentiment analysis on encrypted text

FHE ML represents the future of privacy-preserving AI—powerful models that respect data privacy by design.