Source-linked AI summary
Fully Homomorphic Encryption for Statistical Modeling
Balasubramanian Narasimhan
TL;DR
Distributed statistical analyses can require collaborating sites to share patient-level records or cleartext summaries. The paper presents R packages that combine OpenFHE with master/worker protocols, then demonstrates encrypted Cox fitting and a threshold fit while identifying security and deployment boundaries.
Problem
Distributed model fitting can avoid sharing patient-level records by aggregating site-level contributions, but cleartext summaries still reveal per-site likelihoods, scores, or coefficients to the aggregator.
Source: §1 · p. 1Method
The paper connects R routines to encrypted site-sum computations through a master/worker protocol, with the analysis arranged around a supported additive boundary.
Source: §1 · p. 2Results
4.0e-07 separates recovered MLE 9.175 from cleartext sample mean 9.175; the threshold fit agrees with the cleartext objective within 1.73 × 10−12 in every coefficient.
Source: §4 · p. 13, §5.4 · p. 17Takeaways & Limitations
An R routine can use an encrypted aggregation channel when its requested quantity decomposes as a sum over sites, while the protocol around the solver must be designed for that boundary.
Source: §1 · p. 2The protocols assume honest-but-curious parties and do not detect incorrect encrypted contributions or malformed partial decryptions.
Source: §8.2 · p. 30, §11.1 · p. 34
Abstract
from arXiv · showhide
Fully homomorphic encryption allows arithmetic to be carried out on encrypted values, so that a party performing a computation need not see the data it operates on. This is useful wherever collaborating parties or sites cannot share data records or computed summaries yet need to do a joint analysis. We demonstrate the protocols needed to perform such analyses reproducibly via two packages in R, a platform widely used for applied statistics. The first, openfhe.R, is an interface to the OpenFHE C++ library, which exposes exact integer arithmetic (BFV, BGV), approximate real-valued arithmetic (CKKS), Boolean circuits, and multiparty key generation. The second is homomorpheR, which builds a small set of master/worker primitives for multi-party protocols on top of the first. Together, the two let an ordinary R statistical routine compose with an encrypted-arithmetic layer at the function-value boundary, provided the quantity crossing that boundary decomposes as a sum over sites. Two validation studies are presented: distributed stratified Cox regression, where stats4::mle() converges through an encrypted channel, and federated Cox-lasso via convex optimization using consensus ADMM, where the cross-site update is the only encrypted step. We also discuss federated similarity retrieval and two-party prediction. Throughout, the parties are assumed honest-but-curious, and threshold key generation removes the assumption that any single party holds a usable secret key.
1. Introduction
The paper presents FHE as a way to protect site-level summaries during distributed statistical analysis, and introduces R packages that connect encrypted arithmetic to statistical routines. It describes supported schemes, threshold decryption, and the honest-but-curious threat model that bounds its security claims.
1. Introduction
- Distributed model fitting can use site-level sums without sharing patient records, but cleartext summaries still expose likelihoods, scores, or coefficients to the aggregator.The packages aim to provide an encrypted aggregation channel for such computations.Source: §1 · p. 1
2. FHE in brief
- FHE lets a computing party perform operations on encrypted data without seeing the data or holding the secret key; decryption recovers the corresponding result, exactly or approximately depending on the scheme.Threshold keys can distribute decryption authority so no single party holds a usable secret key.Source: §1 · pp. 1–2
2.1. BFV and BGV: exact integer arithmetic
- BFV and BGV provide exact arithmetic on integer vectors modulo a prime, suited to integer-valued summaries when approximation error is unacceptable.The paper points to package vignettes for these exact-integer demonstrations.Source: §2.1 · p. 4
2.2. CKKS: approximate real-number arithmetic
- CKKS supports approximate arithmetic on real-valued data, and it is used for the paper’s statistical demonstrations.Its precision depends on computation and encoding parameters; multiplication consumes multiplicative depth, and the statistical aggregation patterns require depth 1.Source: §2.2 · p. 5
2.3. FHEW and TFHE: Boolean operations
- FHEW and TFHE support Boolean gate evaluation, but the paper’s statistical demonstrations use CKKS because their computations are real-valued.The statistical examples do not use the Boolean schemes.Source: §2.3 · pp. 5–6
2.4. Multiparty extensions
- Multiparty key generation gives each party a secret share, and decryption requires every party’s partial decryption, preventing unilateral decryption by a proper subset.The paper uses this construction in the threshold Cox and consensus-ADMM examples.Source: §2.4 · p. 6
2.5. Threat model and scope
- The security discussion assumes honest-but-curious parties and distinguishes single-session R objects from separately controlled endpoints, which the examples do not run.Protocol outputs and, in some cases, missingness or candidate scores are revealed by design; the package ships no transport.Source: §2.5 · pp. 6–7
3. The openfhe.R package
openfhe.R exposes OpenFHE objects and encrypted arithmetic through R, while its binding and operator layers connect R calls to the underlying C++ operations. The paper exercises the subset of this interface needed for its worked protocols.
3. The openfhe.R package
- openfhe.R wraps OpenFHE C++ objects and makes encrypted arithmetic available through ordinary R operators.The package presents an S7 class layer and an operator-dispatch layer.Source: §3 · p. 7
3.1. The S7 class hierarchy
- S7 classes represent OpenFHE object types, while KeyPair is an R-side container holding public and private keys.Contexts can enable additional features such as multiparty operations, Chebyshev evaluation, and bootstrapping.Source: §3.1 · p. 7
3.2. Binding boundary and scope
- The S7 objects hold pointers to OpenFHE C++ handles, and the paper exercises selected operations rather than isolating wrapper overhead in a microbenchmark.The exercised subset includes key and context construction, arithmetic, rotations, Chebyshev evaluation, serialization, and multiparty operations.Source: §3.2 · p. 8
3.3. Operator dispatch
- The Ops group generic dispatches encrypted addition, subtraction, multiplication, and negation to OpenFHE operations, including combinations with plaintext values or numeric scalars.The minimal encrypt–compute–decrypt path underlies the protocols; the package also exposes broader features such as serialization, rotation, bootstrapping, and Boolean contexts.Source: §3.3 · pp. 8–9
4. The homomorpheR class hierarchy
homomorpheR separates site-local computation from master orchestration, while generic encryption methods keep protocols independent of the cryptographic backend. Its runner aggregates encrypted site contributions, and its Poisson example recovers the cleartext estimate.
4. The homomorpheR class hierarchy
- homomorpheR supplies Site and Master classes plus generic methods that keep protocol logic independent of the encryption and decryption backend.LocalSite stores data and a contribution function; CKKSMaster and ThresholdMaster are concrete Master implementations.Source: §4 · p. 9
- Sites receive public parameters at setup and encrypt their local contributions before returning them, while decryption requires secret material or all threshold participants.encrypt() and decrypt() abstract the backend, allowing sites and the runner to avoid scheme-specific handling.Source: §4 · p. 10
- RemoteSite is an abstract integration point, so users must implement transport and the setup and contribute() contract at the remote endpoint.The package supplies no concrete remote transport; a correct implementation encrypts the contribution at that endpoint.Source: §4 · p. 10
- master_aggregate() broadcasts θ, collects encrypted site contributions, and returns their decrypted sum; an undefined objective may return NA for the optimizer to handle.The runner checks encrypted replies and key identity before aggregation.Source: §4 · pp. 10, 12
- The threshold master uses n-of-n partial decryption, so no single party can decrypt; the master_aggregate() runner body is unchanged from the single-decrypter variant.Under threshold keys, sites hold their own secret shares and the aggregator fuses their partial decryptions.Source: Figure 1 · p. 11, §4 · p. 11
- The recovered Poisson MLE is 9.175, matching the cleartext sample mean of 9.175 within 4.0e-07.Each site's negative log-likelihood remained encrypted; only the aggregate was decrypted at each mle() query.Source: §4 · p. 13
5. Distributed Cox regression
Distributed stratified Cox fitting sums site-specific partial log-likelihoods across strata, with the encrypted protocol carrying those contributions. The section demonstrates both single-decrypter and threshold-key fits against the cleartext objective.
5. Distributed Cox regression
- Stratified partial log-likelihood sums site-specific ℓ_s(β), so encryption changes transport of intermediate sums rather than the Cox objective.When strata are sites, each site computes its own contribution and the master sums them.Source: §5 · p. 13
5.1. DLBCL lymphoma cohort
- The DLBCL demonstration models five published expression variables across GCB, ABC, and Type III strata, using subgroups as sites only for this example.After retaining features observed in at least 75% of 240 patients and excluding five with zero follow-up, the cohort has 235 patients, 133 deaths, and 2.8 years’ median follow-up.Source: §5.1 · pp. 13–14
5.2. The local Cox partial log-likelihood
- At β = 0, the three site negative log-likelihoods sum to 516.598551, matching the centralized 516.598551 to 2 × 10^-13.The per-site callback evaluates coxph() at the supplied β and stops without iterating; mle() performs the optimization.Source: §5.2 · pp. 14–15
5.3. Single-decrypter master/worker fit
- Encrypted CKKS fitting matches the cleartext fit within 4.76 × 10^-10 in every coefficient, and unchanged mle() converges through encrypted rounds across three sites.Patient records stay at their sites; each site encrypts its partial log-likelihood scalar.Source: Table 4 · p. 16, §5.3 · p. 16
5.4. Threshold variant: removing the single-decrypter assumption
- Chained multiparty key generation gives each site its own secret share and creates a joint public key for encryption.The make_threshold_master() constructor runs the key-generation chain across the sites.Source: §5.4 · p. 16, Figure 3 · p. 17
- The threshold fit agrees with the same cleartext objective to within 1.73 × 10^-12 in every coefficient, while decryption requires every site’s partial decryption.The aggregator fuses the partial decryptions; no single remote party can decrypt unilaterally.Source: §5.4 · p. 17, Table 5 · p. 18
6. Federated convex optimization with CVXR
This section presents federated convex optimization with CVXR using consensus ADMM, keeping local CVXR work in the clear while applying threshold FHE to cross-site aggregation. Only the consensus update is encrypted; the local ADMM driver remains unchanged, and the encrypted fit matches the unencrypted coefficients closely.
6. Federated convex optimization with CVXR
- Unlike callback-based optimizers, CVXR canonicalizes a symbolic problem once for a numerical solver, so it cannot directly invoke an FHE computation on each function call.The function-call approach works when the objective decomposes as a sum over sites.Source: §6 · p. 18
6.1. The global problem and its consensus split
- The stratified Cox-lasso objective splits into per-site CVXR solves linked by consensus; DPP reuses fixed problem structure as parameters change, and encrypted averaging feeds soft-thresholding (Boyd et al. 2011; Agrawal et al. 2019).The cross-site consensus update averages the per-site (xk + uk) vectors; soft-thresholding after decryption is closed-form and adds no cryptographic depth.Source: §6 · p. 18, §6.1 · pp. 18–19, §6.2 · p. 21
6.2. The federated fit in the clear
- After screening 6,416 probes to 100, clear ADMM converged in 112 iterations and matched centralized CVXR within 0.0026 maximum absolute coefficient difference.The ADMM driver leaves local CVXR solves, soft-thresholding, dual updates, and stopping logic in ordinary R; only the consensus function changes for encrypted execution.Source: §6.2 · pp. 20, 22
6.3. The same fit under threshold FHE
- Encrypted pooled moments agreed with the clear pool to 4.6 × 10^-16 (mean) and 3.2 × 10^-15 (SD), and encrypted screening selected the same probes in the same order.Sites encrypt and sum their contributions under the joint public key; threshold partial decryption recovers totals, while local CVXR work remains unchanged.Source: §6.3 · pp. 23–24
- Only consensus is encrypted: sites encrypt each (x_k + u_k), the aggregator averages the encrypted vectors, then soft-thresholds the decrypted average in the clear.The consensus round uses one multiplication by an unencrypted constant and one multiplicative-depth level; run_admm is unchanged.Source: §6.3 · p. 24
- After 112 iterations, encrypted ADMM matched unencrypted coefficients within 2.4×10−7, the CKKS approximation noise.Table 6 compares the encrypted fit with the centralized fit on standardized and back-transformed scales.Source: §6.3 · p. 25, Table 6 · p. 25
- The encrypted and centralized fits each selected 39 nonzero coefficients, with all 39 centralized probes recovered by the distributed protocol.Source: §6.3 · p. 25
- The encrypted iterates follow ADMM’s trajectory toward the centralized CVXR solution; they are not iterations of the centralized solver.Figure 4 plots trajectories for the eight largest-magnitude coefficients on the standardized scale.Source: §6.3 · p. 25, Figure 4 · p. 26
- At each iteration, the aggregator sees the cross-site average before soft-thresholding and the primal residual, plus pooled screening statistics—not site-level contributions or patient data.All decryptions use n-of-n threshold decryption; the reported aggregated statistics cover 235 patients, and no single party can recover them unilaterally.Source: §6.3 · p. 26
- The comparison fits require all three sites’ data in one place for this demonstration, while real deployments must choose ρ without a centralized fit.A cited vignette chooses ρ and iteration count using a synthetic cohort defined by site counts and sizes, covariate schema, and prespecified nominal effect sizes.Source: §6.3 · p. 26
7. Additional protocol: federated similarity retrieval
Federated similarity retrieval applies threshold-FHE primitives to query private site databases without returning adapters, embeddings, or cleartext scores from those sites. It is an additional protocol example, not a third validation study on the scale of the Cox examples.
7. Additional protocol: federated similarity retrieval
- Each site’s compatibility map is fitted from public anchor embeddings, and its usefulness depends on those anchors spanning variation relevant to future queries.The map and local embeddings remain at the site; the adapter is an application assumption, not a privacy mechanism.Source: §7 · p. 27
- The two algebraically equivalent score forms differ for cosine similarity unless the compatibility map is orthogonal, and encrypted division is not implicit in either protocol.One form applies the adapter to the encrypted query; the other folds it into the database offline, reducing online depth but requiring recomputation when the adapter or database changes.Source: §7 · p. 27
- A public-space query is encrypted and sent to sites, which return encrypted similarity scores; the parties partially decrypt and fuse them, while indices and labels remain clear metadata.The aggregator receives the fused scores, and candidate indices and labels require separate governance.Source: §7 · pp. 26–27
- The protocol is not private top-k retrieval: the recipient gets every candidate score in the clear, along with score count and accompanying site or record labels.Repeated adaptive queries may reveal more; hiding non-selected scores would require secure selection, which is not implemented.Source: §7 · pp. 27–28
8. Two-party deployment and model extraction
The section illustrates client–server encrypted prediction, then shows that encrypted transport does not prevent a client from extracting a model through adaptive queries. It discusses layered defenses and limits claims about CKKS security to the paper’s stated setting.
8. Two-party deployment and model extraction
- The hospital encrypts biomarkers for the lab’s encrypted scoring and decrypts the returned score, but adaptive queries can expose the lab’s model.The lab’s coefficients do not leave its machine, and the hospital’s biomarkers do not appear in cleartext on the lab’s machine.Source: §8 · p. 28, Figure 5 · p. 28
- 1.2 × 10−13: five basis-vector queries recover the linear model’s bias and four coefficients to CKKS precision.The five probes comprise one bias probe and one per biomarker.Source: §8 · pp. 28–29
8.1. Layered defenses
- Output noise, query budgets, threshold keys, and nonlinear scoring can layer protections, but nonlinear scoring raises rather than prevents extraction costs.Threshold key generation requires every key-holder to cooperate for each score release; routine approval of every query does not prevent extraction.Source: §8.1 · pp. 29–30
8.2. Security limitations at a glance
- The package primitives control where cleartext appears and who decrypts, but do not by themselves ensure privacy, availability, or robustness to malicious behavior.Table 7 collects principal limitations and their operational consequences.Source: §8.2 · p. 30, Table 7 · p. 30
8.3. Cryptographic security note
- The demonstrations use default CKKS mode under an honest-but-curious model and claim no IND-CPAD security.The cited mitigation can be circumvented when parameters target one computation but another is performed; the vendored OpenFHE release lacks the proposed application-aware validation framework.Source: §8.3 · p. 31
9. Exploratory composition with Gaussian noise
The section explores adding independent Gaussian noise at each site before encryption. The mechanism composes with encrypted aggregation, but the vignettes’ placeholder sensitivity does not support differential-privacy claims, and noise can destabilize fitting.
9. Exploratory composition with Gaussian noise
- The vignettes provide no differential-privacy guarantee because they use placeholder sensitivity without the required neighboring-dataset definition, boundedness, and release accounting.They set ∆ = 1 only to study the software path, so their ε calculations are not privacy claims.Source: §9 · p. 31
- Independent site-side Gaussian draws are encrypted with contributions so the decrypted aggregate carries noise of the specified variance.A zCDP accountant composes nominal per-query cost in the vignettes.Source: §9 · p. 31
- At zero variance, the fit agrees with the cleartext stratified Cox fit in one case and the centralized CVXR fit in the other.Larger noise materially destabilizes the fit, while noise small enough for the optimizer to tolerate still yields large nominal privacy losses under the placeholder sensitivity.Source: §9 · p. 31
- In the Cox example, BFGS estimates gradients by finite differences of the noisy objective, whereas Nelder–Mead uses no gradient.Larger noise materially destabilizes the fit.Source: §9 · p. 31
10. Related work
The related work places the paper’s encrypted aggregation channel alongside R-based federated analysis, encrypted optimization, and retrieval systems. The comparisons distinguish the paper’s threshold-FHE focus from prior approaches with different transport, cryptographic, or protocol designs.
10.1. Adjacent work in R
- distcomp runs the same additive-likelihood Cox algorithm but sends site summaries in cleartext; this work replaces that transport with threshold FHE (Narasimhan et al. 2017b,a).DataSHIELD uses output filtering and aggregate-only access rather than encryption (Wolfson et al. 2010; Murtagh et al. 2012; Wallace et al. 2014; Gaye et al. 2014).Source: §10.1 · p. 32
10.2. Cryptographic encrypted distributed optimization
- Prior encrypted optimization spans Paillier and CKKS designs, while the consensus-ADMM example uses n-of-n threshold keys and generic CVXR problems (Lu and Zhu 2018; Alexandru et al. 2021; Binfet et al. 2023).The related malicious-setting work Helen adds zero-knowledge proofs, whereas this paper remains honest-but-curious and provides no malicious-site protection (Zheng et al. 2019).Source: §10.2 · pp. 32–33
10.3. Encrypted retrieval and representation alignment
- The retrieval protocol combines site-private models, adapters fitted on public anchors, threshold CKKS, and two equivalent deployment forms as an integration example, not a systematic novelty claim.Related systems cover encrypted nearest-neighbor search (Zhao 2024), federated retrieval training (Mao et al. 2025), and healthcare entity resolution (Yao et al. 2024).Source: §10.3 · p. 33
11. Discussion
The discussion frames the packages as an encrypted aggregation layer for statistical solvers, with Cox regression and Cox-lasso as the substantial examples. It also identifies production integration and unmeasured performance, deployment, and malicious-behavior concerns as boundaries.
11. Discussion
- The packages expose OpenFHE primitives to R and provide master/worker classes for encrypted aggregation, demonstrated substantially with distributed Cox fitting and Cox-lasso by consensus ADMM.Retrieval and two-party prediction are additional protocols with more limited validation.Source: §11 · pp. 33–34
- Production use requires a federated-analysis platform for governance, audit, communication infrastructure, and identity management; the packages could supply its encrypted aggregation layer.DataSHIELD and OHDSI are identified as potential integration platforms.Source: §11 · p. 34
11.1. Limitations
- The paper makes no performance claims: examples use modest cohorts and reproducible parameters, and do not isolate binding overhead, network cost, or scaling.Real communication is out of scope.Source: §11.1 · p. 34
- The honest-but-curious model does not detect incorrect encrypted contributions or malformed partial decryptions; authentication, replay protection, auditing, and endpoint key storage remain deployment concerns.Commitments, verifiable computation, or zero-knowledge proofs would be additional layers, not package features.Source: §11.1 · p. 34
12. Computational details
The paper reports the software environment used for its results and identifies where the R packages and a Python counterpart are available.
12. Computational details
- Results used R 4.6.1, openfhe.R 1.5.1.2 linked against OpenFHE v1.5.1, and homomorpheR 1.0 on macOS Tahoe 26.6.2.The reported platform is aarch64apple-darwin23; Table 8 lists versions of every package loaded by the examples.Source: §12 · p. 34, Table 8 · p. 34
- R, openfhe.R, and homomorpheR are available from CRAN.Source: §12 · p. 35
- A Python counterpart, homomorphepy, bundling the same examples is available on GitHub.Source: §12 · p. 35
13. Use of AI
AI models assisted package development, literature search, and manuscript formatting under the author’s direction; the author reports responsibility for the content and that results came from actual computation.
13. Use of AI
- AI models were used to develop both packages, search the literature, and format the manuscript.Source: §13 · p. 35
- The author specified the design, reviewed generated output, and is responsible for all content.Source: §13 · p. 35
- All reported results are from actual computation.Source: §13 · p. 35