Understanding the Error Sensitivity of Privacy-Aware Computing

(2) IBM T. J. Watson Research Center); Augusto Vega (2); Esteban Mocskos (1); Mat\'ias Mazzanti (1); Pradip Bose (2) ((1) University of Buenos Aires

REVIEW 4 major objections 5 minor 10 references

Understanding the Error Sensitivity of Privacy-Aware Computing

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that CKKS homomorphic encryption is silently vulnerable to single-bit flips, and that the RNS and NTT optimizations used to make it practical greatly amplify that vulnerability.

desk verdict Useful first-cut fault-injection study of CKKS, but the central RNS/NTT amplification claim rests on a single confounded experiment and needs revision or reframing before it can carry the paper's warning about silent data corruption. read the letter →

arxiv 2506.07957 v1 pith:E6QILO5T submitted 2025-06-09 cs.AR cs.CR

Matías Mazzanti (1) , Esteban Mocskos (1) , Augusto Vega (2) , Pradip Bose (2) ((1) University of Buenos Aires , (2) IBM T. J. Watson Research Center) This is my paper

classification cs.ARcs.CR

keywords CKKShomomorphicencryptionsilentdatacorruptionfaultinjectionerrorsensitivityresiduenumbersystemtheoretictransformscalefactor

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that bit-level faults, the kind produced by flaky hardware or software, can pass through a CKKS homomorphic encryption pipeline without detection and corrupt the recovered data. By injecting one bit flip at a time into plaintext and ciphertext coefficients and measuring the $\mathrm{L}^2$ error after decoding, the authors find that error impact grows with the flipped bit's significance and that the ciphertext polynomial $c_1(X)$ is more sensitive because decryption multiplies it by the secret key. They also report that increasing the scale factor $\Delta$ reduces error, because scaling shifts data into higher-up bits, and that the RNS and NTT optimizations amplify single-bit errors: RNS reconstruction multiplies a flipped remainder by a large factor, and NTT butterflies spread one error across many outputs. The work's point is that silent data corruption is a realistic threat in HE systems and that robustness deserves a seat alongside performance and security when configuring CKKS.

What carries the argument

The central mechanism is the fault-injection campaign itself: a single-bit error model that flips, one at a time, every bit of every 64-bit coefficient in the CKKS plaintext and ciphertext, then runs the full encode-encrypt-decrypt-decode pipeline and compares the recovered message with the original using the $\mathrm{L}^2$ norm. The paper's explanations for the observed sensitivity rest on the CKKS decryption formula $m' = [c_0 + c_1 \times s]_Q$, the scale factor $\Delta$ that shifts coefficient values left, RNS residue reconstruction via $p = \left(\sum_{k=1}^{L} r_k \left[\left(1/Q_k\right) \bmod q_k\right] Q_k\right) \bmod Q$, and the Cooley-Tukey NTT butterfly that propagates one input error to all outputs. Together these pieces account for bit-position dependence, scale-factor resilience, and optimization-induced amplification.

What would settle it

Run the same single-bit fault-injection campaign on a production-scale CKKS setup (for example, $N = 4096$ or $8192$ with several MNIST or CIFAR images) and inject flips during homomorphic multiplications; if higher-order bit flips no longer track $\mathrm{L}^2$ error growth, or if disabling RNS and NTT no longer removes the image distortion, the paper's central sensitivity claims fall.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that error sensitivity in CKKS is governed by three knobs: bit position, scale factor, and the optimization stack. A single flipped bit in a 64-bit coefficient produces negligible output error if it sits in the lower roughly 50 bits, but error grows sharply for higher bits; $c_1(X)$ flips yield larger peaks than $c_0(X)$ flips because the decryption equation $m' = [c_0 + c_1 \times s]_Q$ multiplies $c_1$ by the secret key, dispersing the fault. Larger scale factors ($2^{40}$ and $2^{50}$ versus $2^{20}$) shrink the recovered $\mathrm{L}^2$ error, which the authors interpret as a "right shift" that increases the number of bits untouched by a given flip. Most strikingly, a bit error in the encoding stage distorts a MNIST image completely when RNS and NTT are enabled, while the same flip leaves a recognizable image when these optimizations are off; the paper explains this through the large multiplicative factor in RNS coefficient reconstruction and the all-to-all spreading of an error through a Cooley-Tukey butterfly. The intended upshot is that the very optimizations that make CKKS tractable also make it more brittle under faults.

Load-bearing premise

The experiments use polynomial degree $N = 4$, inject errors only in encoding, encryption, decryption, and decoding (never during homomorphic computation), and compare RNS/NTT on a single MNIST image using an unspecified 'without RNS and NTT' configuration, so the reported sensitivity patterns depend on those choices being representative of real CKKS workloads.

Editorial extensions

If this is right

HE deployments must treat silent data corruption as a first-class risk: a single flipped bit can pass undetected through the entire CKKS pipeline and produce corrupted plaintext.
Choosing a larger scale factor $\Delta$ buys error resilience at the cost of noise budget and computational efficiency, so robustness should enter the CKKS parameter-selection trade-off.
Because RNS reconstruction multiplies a flipped remainder by a large factor, systems using full-RNS CKKS need additional error detection or correction around residue arithmetic.
NTT-based polynomial multiplication spreads a single input fault across all outputs, so fault tolerance should be evaluated at the transform level, not just the coefficient level.
Bit-position sensitivity implies that protecting the most significant bits of coefficients could capture most of the error risk, though low bits still matter for exact recovery.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the amplification mechanism is right, applying error-correcting codes to RNS remainders before reconstruction, or recomputing an NTT with a checksum, would be natural hardening strategies; the paper does not explore these.
The exclusion of errors during homomorphic computation leaves an open gap: multiplications and rotations add their own noise, so a fault during those stages may interact with the noise budget differently than the pre-computation flips studied here.
The $N=4$ toy setting suggests the error-sensitivity curves might shift with polynomial degree and ciphertext modulus; mapping how the 'negligible lower bits' cut moves under realistic parameters would be a direct testable extension.
Because the MNIST comparison uses a single image, a natural next experiment is to measure the fraction of images corrupted beyond a recognition threshold across a full dataset, with and without RNS and NTT.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper is a useful first-cut fault-injection study of CKKS, with clear motivation and a simple, honest methodology. The new measurements show that bit-error impact depends on bit position and scale factor, and the qualitative mechanisms for why RNS and NTT might amplify errors are plausible. The authors also explicitly limit the study to encoding/encryption/decryption/decoding, which is a fair scope statement.

The soft spots are real, though. The experiments use polynomial degree N=4, a handful of hand-picked parameters, and one MNIST image for the RNS/NTT comparison. No code or data is released, and the "no RNS/NTT" condition is not described; OpenFHE natively uses both, so it's unclear what baseline was used. More importantly, Figure 6 varies RNS and NTT simultaneously, so even if the baseline were specified, the observed distortion cannot be attributed to either technique individually. Since the RNS/NTT amplification is the paper's distinctive contribution and the basis for the broader warning about silent data corruption, that weakness is load-bearing. The claim of being the "first work" in this area is also unverified, though relative to the ten cited references the measurements do appear new.

The remaining findings—bit-position and scale-factor dependencies—are more solid, but they align with what one would expect from CKKS's structure, so the paper reads more as a quantified confirmation than a surprising discovery.

Who is this for? Researchers thinking about hardware faults in HE systems who want a starting point and a clear articulation of why SDC is a concern. As a motivation and preliminary study, it has value. But as it stands, the central RNS/NTT conclusion is not yet supported, and the lack of artifacts prevents reproducibility.

I would send it to a serious referee, but with an explicit request to focus on the experimental design of the RNS/NTT comparison and to ask for either an isolated factorial experiment or a major frame change that downgrades the RNS/NTT claim to speculation. The paper deserves revision, not desk rejection.

Referee Report

4 major / 5 minor

Summary. This paper presents an experimental fault-injection study of the CKKS homomorphic encryption scheme using OpenFHE. The authors flip single bits in plaintext and ciphertext polynomial coefficients and measure the L2 norm of the recovered message after the encode-encrypt-decrypt-decode pipeline, examining the effect of bit position, the scale factor Δ, and the RNS and NTT optimizations. They report that bit-flip errors are more pronounced in c1 than in c0, that larger scale factors improve bit-error resilience, and that the use of RNS and NTT amplifies a single bit error enough to visually destroy an MNIST image. The paper concludes that silent data corruption is a serious concern for practical CKKS-based systems.

Significance. If fully supported, this would be a useful first characterization of CKKS error sensitivity, with implications for hardware fault tolerance and error detection in HE accelerators. The paper's strengths are its direct measurement approach and the absence of fitted parameters or circular predictions; the findings are genuine measurements of an implemented pipeline. However, the experimental basis is currently too narrow for the strength of the conclusions: the parameter sweep is extremely limited, the RNS/NTT comparison is confounded and unspecified, and the study excludes errors during homomorphic computation, which dominates real workloads. The paper is suitable as a preliminary study, but the central practical warning requires substantially more evidence.

major comments (4)

[Section II-C, Figure 6] The claim that RNS and NTT 'may lead to severe consequences in the presence of bit errors' rests on a comparison that varies RNS and NTT simultaneously against an unspecified baseline. OpenFHE natively uses RNS and NTT, so the manuscript must explain how the 'without the application of RNS and NTT' condition was realized, and it should isolate the two factors in a factorial experiment (none, RNS-only, NTT-only, both). As written, the observed distortion cannot be attributed to either optimization individually, and the result is not reproducible without the implementation details.
[Section II-A and II-B, Figures 4-5] The general claims about bit-position sensitivity and scale-factor resilience are based on a single polynomial degree N=4, one input message, and three hand-picked values of Δ, with no replicates, confidence intervals, or variation of the modulus and security parameters. Since N=4 is far below practical CKKS degrees (typically 2^12 to 2^16), the observed patterns, such as 'the first 50 bits of each coefficient result in negligible effects,' may not transfer to realistic workloads. The authors should either broaden the parameter sweep substantially or explicitly restrict the conclusions to the tested configuration.
[Section II (methodology) and Section III (conclusion)] The paper explicitly limits the study to encoding, encryption, decryption, and decoding and defers errors arising during homomorphic computation to future work, yet the conclusion warns that silent data corruption 'is anticipated to become a prevalent challenge' in HE systems. Since practical CKKS workloads spend most of their time in homomorphic multiplications and rotations, the absence of computation-stage fault injection leaves the practical severity claim unsupported. The conclusions should be reworded to match the experimental scope, or the study should include at least one representative homomorphic computation.
[Section II-C, Equation 2 and Figure 7] The proposed mechanisms for RNS and NTT amplification are plausible but are not quantitatively connected to the shown image. I ask the authors to report a numerical error metric (e.g., L2 or maximum pixel error) for Figure 6, state the polynomial degree and parameter set used for that experiment, and repeat the experiment over several images to demonstrate that the effect is not an artifact of one sample. As it stands, the single-image qualitative illustration is too thin to support the paper's headline claim.

minor comments (5)

[Throughout] The label 'Norm-2' should be written as 'L2 norm' or 'ℓ2 norm', and axis captions should use consistent capitalization, e.g., 'Modified bit index'.
[Equation 2] The displayed formula for RNS reconstruction is garbled in the manuscript; the equation and surrounding text should be typeset cleanly, with all variables (L, qk, Qk, Q) defined at first use.
[Section II] The experimental setup should state the exact OpenFHE version, the CKKS parameters (N, q, Δ, security level), and the slot configuration; 'Arch Linux 257.5-1' appears to be a kernel version rather than a distribution release and should be clarified.
[Figure 6] The caption does not say which stage the bit flip occurred in, which coefficient or bit was flipped, or how the input image was mapped to CKKS slots; these details should be added to make the experiment reproducible.
[Section II-B] The phrase 'shifts right the coefficient' is imprecise: multiplication by the scale factor is not a bit shift in the usual sense, and the statement should be rephrased using the actual fixed-point encoding formula.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are direct fault-injection measurements with no fitted parameters or self-citation load-bearing steps.

full rationale

The paper reports an empirical error characterization of CKKS. It does not fit a parameter to data and then 'predict' a closely related quantity: Figures 4 and 5 are raw L2-norm measurements after single-bit flips, and the scale-factor comparison is an experimental manipulation with stated parameter values, not a fitted result. The RNS/NTT discussion cites prior works [6,7,10] only for background—the CKKS definition, the full-RNS variant, and the OpenFHE library—not as evidence for the paper's own sensitivity claims. No derivation reduces to its inputs by construction: Equation (1) is standard CKKS decryption used to explain the c1 peaks, Equation (2) is standard RNS reconstruction used as a qualitative amplification mechanism, and the Cooley-Tukey butterfly is standard NTT structure. Figure 6's 'without RNS and NTT' baseline is under-specified and the comparison varies two factors at once, but that is a confound/reproducibility limitation, not circularity: the conclusion is not identical to the experimental setup by definition. No self-citations appear (references [6], [7], [9], and [10] are all external prior work), and no uniqueness theorem or ansatz is imported from the authors' own previous publications. The findings are self-contained measurements of a standard scheme, so the appropriate circularity score is 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities, but its conclusions depend on several assumptions about standard CKKS internals and on ad hoc experimental choices (N=4, chosen scale factors, one image). These are not derived from first principles, and the experiments are not sufficient to validate them independently.

free parameters (2)

Polynomial degree N = 4
A toy value; all measured error curves use N=4 with four coefficients, far from practical CKKS values (typically 2^12 to 2^17). The reported sensitivity patterns may not generalize.
Scale factor Delta = 2^20, 2^40, 2^50
Three hand-picked scale factors used to demonstrate the tradeoff; no justification for these values or coverage of the full parameter space.

assumptions (4)

domain assumption CKKS decryption is m' = [c0 + c1*s]_Q (Equation 1) with secret key s.
Standard CKKS definition cited from [6],[7]; used to explain why c1 errors spread.
domain assumption The RNS reconstruction formula in Equation 2 is the exact source of error amplification in the RNS path.
The paper asserts, but does not derive or measure, that a bit error in a residue is amplified by the Qk multiplier; alternative explanations are not ruled out.
domain assumption A bit error spreads across all outputs of an NTT butterfly, and this is the dominant amplification mechanism in the NTT case.
The Cooley-Tukey butterfly diagram is given as an intuitive explanation, but no quantitative analysis ties butterfly fan-out to the observed image corruption.
ad hoc to paper The single MNIST image is representative of typical CKKS workloads.
One image with unspecified preprocessing and encoding parameters is used to draw the strong RNS/NTT conclusion in Figure 6.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Understanding the Error Sensitivity of Privacy-Aware Computing." pith.science (2026). https://pith.science/paper/E6QILO5T

@misc{pith2026250607957,
  author       = {Pith},
  title        = {Pith review of: Understanding the Error Sensitivity of Privacy-Aware Computing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E6QILO5T}},
  note         = {Machine review of arXiv:2506.07957}
}

read the original abstract

Homomorphic Encryption (HE) enables secure computation on encrypted data without decryption, allowing a great opportunity for privacy-preserving computation. In particular, domains such as healthcare, finance, and government, where data privacy and security are of utmost importance, can benefit from HE by enabling third-party computation and services on sensitive data. In other words, HE constitutes the "Holy Grail" of cryptography: data remains encrypted all the time, being protected while in use. HE's security guarantees rely on noise added to data to make relatively simple problems computationally intractable. This error-centric intrinsic HE mechanism generates new challenges related to the fault tolerance and robustness of HE itself: hardware- and software-induced errors during HE operation can easily evade traditional error detection and correction mechanisms, resulting in silent data corruption (SDC). In this work, we motivate a thorough discussion regarding the sensitivity of HE applications to bit faults and provide a detailed error characterization study of CKKS (Cheon-Kim-Kim-Song). This is one of the most popular HE schemes due to its fixed-point arithmetic support for AI and machine learning applications. We also delve into the impact of the residue number system (RNS) and the number theoretic transform (NTT), two widely adopted HE optimization techniques, on CKKS' error sensitivity. To the best of our knowledge, this is the first work that looks into the robustness and error sensitivity of homomorphic encryption and, as such, it can pave the way for critical future work in this area.

Figures

Figures reproduced from arXiv: 2506.07957 by the authors.

**Figure 3.** Error injection methodology. This initial study emphasizes the occurrence of bit errors specifically during the encoding/encryption (and corresponding decoding/decryption) stages. It does not address errors that may arise during computations performed on the encrypted data, which will be the subject of future research. A. Error Position Impact This section examines the impact of a single bit error introduced in the… view at source ↗

**Figure 2.** Illustrative scenario of a SDC case induced by a faulty [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: L2 norm error of a single-bit flip in the ciphertext. The X-axis shows the position of the modified bit. Polynomial degree N = 4. B. Scale Factor (∆) Impact CKKS employs various configuration parameters to guarantee a certain security level (e.g., 128 bits), such as t…

**Figure 6.** Figure 6: Impact of a single bit-flip in CKKS encoding. [PITH_FULL_IMAGE:figures/full_fig_p003_6.png]

**Figure 5.** Figure 5: L2 norm error of a single-bit flip in the ciphertext using different scale factors ∆. The X-axis shows the position of the modified bit. Polynomial degree N = 4. In practical applications, the scale factor ∆ must be carefully adjusted for effective CKKS implementation…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

10 extracted references · 7 canonical work pages

[1]

Cloud computing and economic growth,

K. Konstantinos, M. Persefoni, F. Evangelia, M. Christos, and N. Mara, “Cloud computing and economic growth,” in Proceedings of the 19th Panhellenic Conference on Informatics , 2015, pp. 209–214

work page 2015
[2]

Security and privacy issues in cloud computing,

J. Sen, “Security and privacy issues in cloud computing,” in Cloud technology: concepts, methodologies, tools, and applications . IGI global, 2015, pp. 1585–1630

work page 2015
[3]

A modification of the RSA public-key encryption pro- cedure (corresp.),

H. Williams, “A modification of the RSA public-key encryption pro- cedure (corresp.),” IEEE Transactions on Information Theory , vol. 26, no. 6, pp. 726–729, 1980

work page 1980
[4]

A public key cryptosystem and a signature scheme based on discrete logarithms,

T. Elgamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,” IEEE Transactions on Information Theory , vol. 31, no. 4, pp. 469–472, 1985

work page 1985
[5]

X. Yi, R. Paulet, E. Bertino, X. Yi, R. Paulet, and E. Bertino, Homo- morphic encryption . Springer, 2014

work page 2014
[6]

Homomorphic encryption for arithmetic of approximate numbers,

J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23 . Springer, 2017, pp. 409– 437

2017
[7]

A full RNS variant of approximate homomorphic encryption,

J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full RNS variant of approximate homomorphic encryption,” in Selected Areas in Cryptography–SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15–17, 2018, Revised Selected Papers 25 . Springer, 2019, pp. 347–368

work page 2018
[8]

On lattices, learning with errors, random linear codes, and cryptography,

O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in Proceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing , ser. STOC ’05, 2005, p. 84–93. [Online]. Available: https://doi.org/10.1145/1060590.1060603

arXiv 2005

Show all 10 references

[9]

Silent data corruptions at scale,

H. D. Dixit, S. Pendharkar, M. Beadon, C. Mason, T. Chakravarthy, B. Muthiah, and S. Sankar, “Silent data corruptions at scale,” 2021. [Online]. Available: https://arxiv.org/abs/2102.11245

2021 arXiv
[10]

OpenFHE: Open-source fully homomorphic encryption library,

A. A. Badawi, A. Alexandru, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Lee, Z. Liu, D. Micciancio, C. Pascoe, Y . Polyakov, I. Quah, S. R.V ., K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V . Vaikuntanathan, and V . Z...

2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Cloud computing and economic growth,

K. Konstantinos, M. Persefoni, F. Evangelia, M. Christos, and N. Mara, “Cloud computing and economic growth,” in Proceedings of the 19th Panhellenic Conference on Informatics , 2015, pp. 209–214

work page 2015

[2] [2]

Security and privacy issues in cloud computing,

J. Sen, “Security and privacy issues in cloud computing,” in Cloud technology: concepts, methodologies, tools, and applications . IGI global, 2015, pp. 1585–1630

work page 2015

[3] [3]

A modification of the RSA public-key encryption pro- cedure (corresp.),

H. Williams, “A modification of the RSA public-key encryption pro- cedure (corresp.),” IEEE Transactions on Information Theory , vol. 26, no. 6, pp. 726–729, 1980

work page 1980

[4] [4]

A public key cryptosystem and a signature scheme based on discrete logarithms,

T. Elgamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,” IEEE Transactions on Information Theory , vol. 31, no. 4, pp. 469–472, 1985

work page 1985

[5] [5]

X. Yi, R. Paulet, E. Bertino, X. Yi, R. Paulet, and E. Bertino, Homo- morphic encryption . Springer, 2014

work page 2014

[6] [6]

Homomorphic encryption for arithmetic of approximate numbers,

J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23 . Springer, 2017, pp. 409– 437

2017

[7] [7]

A full RNS variant of approximate homomorphic encryption,

J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full RNS variant of approximate homomorphic encryption,” in Selected Areas in Cryptography–SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15–17, 2018, Revised Selected Papers 25 . Springer, 2019, pp. 347–368

work page 2018

[8] [8]

On lattices, learning with errors, random linear codes, and cryptography,

O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in Proceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing , ser. STOC ’05, 2005, p. 84–93. [Online]. Available: https://doi.org/10.1145/1060590.1060603

arXiv 2005