Drifting Towards Better Error Probabilities in Fully Homomorphic Encryption

📣 Exciting News! Our latest research on improving security and efficiency in Fully Homomorphic Encryption (FHE) will be presented at EUROCRYPT 2025, taking place in Madrid from May 4–8, 2025!

The Problem: Why Does Decryption Failure Matter in FHE?

Fully Homomorphic Encryption (FHE) allows computations on encrypted data, making it a game-changer for privacy-preserving applications. However, ensuring both efficiency and strong security is a major challenge. In practice, allowing a small probability of decryption errors can significantly improve performance by reducing computational overhead and memory requirements. However, this trade-off introduces potential vulnerabilities, particularly when moving beyond standard IND-CPA security to stronger IND-CPA^D security.

FHE schemes traditionally focus on achieving IND-CPA security, ensuring that an adversary cannot distinguish between encrypted messages under chosen-plaintext attacks. However, in certain realistic deployments—especially in public-key scenarios—adversaries might exploit decryption failures to extract sensitive information. This motivated the introduction of IND-CPA^D security, which considers scenarios where an attacker may submit ciphertexts derived from known plaintexts to a decryption oracle, exposing potential weaknesses.

For perfectly correct FHE schemes (where decryption never fails), IND-CPAD and IND-CPA are equivalent. However, since most practical FHE schemes have a small but nonzero decryption failure probability, new vulnerabilities arise when only IND-CPA security is considered.

Our Contribution: Controlling Ciphertext Drift

Our work introduces ciphertext drift as a key factor affecting decryption errors in FHE schemes like FHEW, TFHE, and FINAL. We observe that the standard modulus switching operation is a major source of error growth, making FHE schemes more susceptible to attacks in the IND-CPA^D security model.

Rather than relying on larger cryptographic parameters to suppress decryption failures (which significantly impacts efficiency), we propose a novel approach that directly mitigates drift at its root.

We present three key insights:

• New Modulus Switching Techniques → Reduce failure probabilities without increasing computational cost.
• Practical Impact → Our methods achieve higher security at no noticeable performance overhead, making FHE safer for real-world applications.
• Improved Security Notions → We introduce sIND-CPA^D, a stronger security model addressing real-world attack scenarios.

Because our drift-mitigation approach avoids drastically changing the cryptographic parameters, the performance overhead is negligible. Benchmarks on typical use cases show that our techniques can seamlessly integrate into existing FHE frameworks with minimal computational costs while significantly strengthening their security against decryption failure-based attacks. The proposed countermeasures against large drift are extensively studied and analyzed. Numerical experiments with real measurements confirm the results and concrete parameters we obtain from our analyses. In particular, it turns out that one of our generic defenses typically doubles the strength of the failure probability, from 2^−κ to 2^−2κ.

Even with IND-CPA^D security, practical attacks may still exist if an adversary has some control over encryption randomness. Our research defines sIND-CPA^D, a security notion that is strictly stronger than IND-CPA^D and therefore ensures resilience against more sophisticated adversarial models. We provide a criterion to convert an IND-CPA^D-secure scheme into an sIND-CPA^D-secure scheme. Several of our newly developed techniques naturally lead to sIND-CPA^D security without additional computational cost.

Why This Matters

Our results show that existing FHE parameter sets can be significantly improved using our new techniques—without requiring impractical trade-offs in efficiency. This work has direct applications to privacy-preserving AI, secure data processing, and cryptographic protocols where strong security guarantees are critical.

Join us at EUROCRYPT 2025

We are thrilled to present this work in Madrid at EUROCRYPT 2025! If you’re working on FHE, cryptographic security, or secure computing, we’d love to discuss how our findings can impact your research and applications.

• Read our full paper at https://ia.cr/2024/1718/
• Conference details at https://eurocrypt.iacr.org/2025/
• Join the Zama Meetup on Monday 5th: "Tapas, Drinks and... Fully Homomorphic Encryption — Zama Meetup & Afterwork", at only 5 minutes walking distance from the Eurocrypt venue.

Stay tuned for more updates, and see you in Madrid!