Homomorphic Encryption for Confidential Statistical Computation: Feasibility and Challenges

1. Introduction

Statistical confidentiality refers to safeguarding data to ensure it remains useful for statistical analysis while minimizing the risk of identifying individuals [1,2]. It ensures that information collected for research or statistical purposes is used solely for those intended purposes and not in ways that could compromise personal privacy. While techniques such as encryption, access control, anonymization, and differential privacy provide some level of statistical privacy, they often have limitations [3].

Statistical confidentiality is a central concern in the operations of the US Census Bureau[4]. This is true for its counterparts all over the world as well as other institutions that deal with data collected from users [[1,5,6]. The US Census Bureau, in 2020, emphasized the limitations of the traditional methods to protect the privacy of users and introduced differential privacy to quantify the level of privacy that is provided with various methods [7] . For the 2030 census, the Census Bureau has published a research agenda to identify improvements to the current disclosure avoidance methods. According to the planning and development timeline published on their website, after a two-year research, feedback, and development phase, the final system will be selected in 2027-2028 to get ready for production in the next census year of 2030[8].

Homomorphic encryption (HE), which relies on deep mathematical theories allows operations on encrypted data. Unlike traditional mechanisms for confidentiality where the focus is on hiding the association between the data points and users, HE hides the plaintext data itself. As such it is a powerful tool to protect not just the associations or relations between data points, but the data itself. Combined with other protection mechanisms such as strong access control, HE can provide ultimate security of data not only at rest and in transit but also in use. With statistical confidentiality becoming increasingly critical with the data-centric world we live in, this is a great time to explore the viability of homomorphic encryption for statistical confidentiality for various use cases.

Two major challenges of homomorphic encryption are the computational intensity of operations resulting in high time complexity and the difficulty of adapting traditional algorithms designed for plaintext data, to operate on encrypted data. Sorting is one such example. In this study, we use ZAMA’s Concrete compiler [9], which implements Fully Homomorphic Encryption over the Torus (TFHE) [10] to implement and evaluate the performance of three sorting algorithms on homomorphically encrypted data. In addition, we provide implementations of traditional algorithms for basic statistical computations on encrypted datasets, including the five-number summary, mean, variance, and mode, and record the time required for each operation. While our findings support the theoretical feasibility of fully homomorphic encryption (FHE) for statistical analysis, significant optimization is needed to make its practical use in real-world applications more efficient.

This paper is organized as follows. Section 2 provides background information on homomorphic encryption and ZAMA’s Concrete complier. Section 3 summarizes the literature on the use of homomorphic encryption for statistical calculations. Section 4 explains our methodology, and Section 5 provides implementation details. Section 6 reports the results, and section 7 concludes the paper with a discussion of the results.

2. Background

Homomorphic encryption (HE) allows computations on encrypted data without revealing it to anyone other than an owner or an authorized collector. When combined with other techniques, homomorphic encryption offers an ideal solution for ensuring statistical confidentiality.

HE schemes are categorized into three families based on the main operations they involve and how they achieve homomorphic encryption: Partially Homomorphic Encryption (PHE), Somewhat Homomorphic Encryption (SWHE) and Fully Homomorphic Encryption (FHE). PHE schemes allow only one type of operation with no limits on the number of times the operation can be performed. PHE schemes support evaluation of either addition or multiplication, but not both. SWHE schemes allow both addition and multiplication with a limit on the number of operations that can be carried out. FHE schemes allow computations with no bounds on the type of operations and number of times they are performed.

The first FHE scheme was proposed by Craig Gentry in 2009[11]. The study included not just an FHE scheme but a broad framework for designing new schemes. Several researchers have tried to build a safe and useful FHE scheme based on Gentry’s work.

A major leap forward came with the work of Chillotti, Gama, Georgieva, and Izabachène in 2016 who introduced a method for bootstrapping in under 0.1 seconds [12]. Their approach reimagined FHE in the context of Boolean logic, focusing on evaluating one logic gate at a time rather than full arithmetic circuits. By leveraging a representation of ciphertexts over the torus (real numbers mod 1), they achieved a dramatic speedup, making homomorphic operations viable for real-time applications.

Building on this, the same team formalized and refined their method in the “TFHE: Fast Fully Homomorphic Encryption over the Torus” paper [10]. This work presented a complete, well-optimized system for fast homomorphic encryption over the torus, including security proofs and performance benchmarks. Following this, an open-source library was released that made TFHE one of the most practical FHE schemes available, particularly for applications involving encrypted decision-making and control flow. For an excellent overview of TFHE we refer the reader to the 2023 thesis by Paolo Tassoni [13].

ZAMA is a French cryptography company that specializes in building open-source homomorphic encryption solutions with a focus on development of applications in the field of Artificial Intelligence and Blockchain [14]. It aims to simplify the use of homomorphic encryption for developers and helps with the “complexity of FHE operations, managing noise, choosing appropriate crypto parameters, and finding the best set and order of operations for a specific computation” [13].

The core product of ZAMA is a compiler called Concrete written in C++ and developed with Multi-Level Intermediate Representation (MLIR), an open-source project for building reusable and extensible compiler infrastructure[15]. In April 2023 ZAMA released a version of Concrete that converts Python programs into their FHE equivalents. The conversion process includes representing each function as a “circuit”, a direct acyclic graph of operations on variables, where each variable can be encrypted or in plaintext. The circuit is compiled with parameters producing a dynamic library with FHE operations and a JSON file with the cryptographic configuration called Client Specs. The circuit can perform the homomorphic evaluation of the desired function, and these operations can be used in the context of a Client-Server interactions.

3. Related Work

Homomorphic encryption has emerged as a transformative technique in privacy-preserving computation, allowing mathematical operations on encrypted data without decryption. This capability is particularly valuable in fields requiring secure data processing, such as statistical analysis of sensitive information, cloud computing, and artificial intelligence. Fully homomorphic encryption algorithms have been around more than a decade and have recently evolved from a theoretical concept to a practical tool. In addition to Zama, major tech companies including Microsoft and IBM have contributed to the field. Microsoft’s SEAL (Simple Encrypted Arithmetic Library) supports both BFV and CKKS encryption schemes to enable secure arithmetic and approximate computations on encrypted data [16]. Likewise, IBM has been a major contributor in the development of HElib, a library that implements the BGV scheme [17].

In this study we focus on preserving privacy in statistical computations. Two main tasks that are needed for statistical computations are comparison and sorting. In this section we present recent studies that have proposed innovative approaches to enhance the efficiency and practicality of sorting and comparison.

The study “Homomorphic Comparison Method Based on Dynamically Polynomial Composite Approximating Sign Function” introduces a polynomial approximation method for the sign function, enabling effective comparison of encrypted values[18] The dynamically composed polynomials adapt to the encrypted domain’s constraints, improving accuracy and maintaining acceptable computational costs.

In “Efficient Sorting of Homomorphic Encrypted Data With k-Way Sorting Network” authors propose a scalable and parallelizable sorting mechanism using k-way sorting networks [19]. Unlike traditional binary sort networks, k-way networks reduce the number of comparisons and depth of computation, making them well-suited for homomorphic environments. The method is compatible with leveled homomorphic encryption schemes, optimizing for both depth and ciphertext noise. Experimental results show significant performance gains compared to earlier sorting methods in HE, particularly in terms of latency and computational overhead.

The paper “Innovative Homomorphic Sorting of Environmental Data in Area Monitoring Wireless Sensor Networks” explores a practical application of HE in wireless sensor networks (WSNs) for environmental data monitoring [20]. The authors employ an additive homomorphic encryption scheme to enable secure sorting of sensor data without compromising data confidentiality. Their approach integrates a modified bubble sort algorithm that operates directly on ciphertexts, optimized for low-power devices in WSNs. The results demonstrate a feasible balance between computational efficiency and data security, showcasing the potential of HE in real-time environmental analytics.

In “An Efficient Fully Homomorphic Encryption Sorting Algorithm Using Addition Over TFHE”, the authors leverage the TFHE scheme’s capabilities, particularly its fast gate bootstrapping and efficient binary circuit evaluation [21]. They design a sorting algorithm that primarily uses addition operations to minimize expensive multiplications. The approach is tailored for the TFHE framework, which supports bit-level operations efficiently.

The 2024 paper “Practical solutions in fully homomorphic encryption: a survey analyzing existing acceleration methods” systematically compares and analyzes the strengths and weaknesses of FHE acceleration schemes [22]. The authors classify existing acceleration schemes from algorithmic and hardware perspectives and propose evaluation metrics to conduct a detailed comparison of various methods.

The growing reliance on cloud computing, data analytics, and artificial intelligence has heightened the need for privacy-preserving computations.

Our study explores the practicality of homomorphic encryption for statistical computations. In particular, we examine the efficiency of the TFHE algorithm as implemented in Zama’s Concrete framework following the optimizations in “Parameter Optimization and Larger Precision for (T)FHE” [23] on a standard computer and provide implementations of traditional algorithms for basic statistical computations on encrypted datasets, including the five-number summary, mean, variance, and mode.

4. Materials and Methods

To explore the viability of homomorphic encryption and computations for statistical calculations, we implement a client-server application that allows the client to send encrypted data to the server for statistical computations. We consider the client the owner of the data, and the server the computational engine and report the time it takes to carry out the homomorphic calculations on the server side.

We follow the client-server model provided by ZAMA as depicted in Figure 1 and use ZAMA’s Concrete compiler to implement calculation of the 5-point summary statistics, mean, variance, and mode. In the application, the data is randomly generated for the desired range and size.

The main points to note of the application are:

• The client possesses the key to encrypt and decrypt the data.
• The client encrypts the dataset and sends the encrypted dataset to the server.
• The server gets the encrypted dataset, calculates the requested statistics, and sends the encrypted result(s) to the client.
• The client then decrypts the encrypted results to get the desired results.

The application allows the calculation of basic statistics: mean, variance, mode, 5-point summary statistics which include the min, max, median, lower quartile, and upper quartile. Among these, the calculation of 5-point summary is straightforward if the data is sorted. For this reason, we placed special emphasis on sorting encrypted data. We implemented three sorting algorithms, namely bubble sort, odd-even sort, and bitonic sort and compared their timing.

To sum up, we collect timing data on these computations:

• Calculation of mean
• Calculation of variance
• Bubble sort
• Odd-even sort
• Bitonic sort
• Calculation of mode
• Five-point summary with bitonic sort if the length of the datasets is a power of 2 and bubble sort otherwise.

4.1. Security of the Application

The data is protected in transit and in use by the application since it is encrypted on the client side before it is transmitted and not decrypted until the encrypted result reaches the client. As such the data is also protected at rest on the server side.

The data is randomly generated on the client side and is not stored in the application. If needed, an additional layer of encryption can be implemented on the client side to provide the security of the data at rest on the client side.

In the system, the only party who can view and manipulate the data in plaintext is the data owner, i.e., the client. The server does not have access to the key that can decrypt the data. All computations are done on encrypted values ensuring user privacy and robust protection against data breaches even if the server is compromised.

In the application, the only information that the server (and hence others) has access to in plaintext is the number of data points. This quantity needs to be shared with the server for the homomorphic computations to be carried out.

5. Implementation

The proposed system is implemented using Zama’s Concrete framework, an open-source framework that simplifies the use of Fully Homomorphic Encryption (FHE) [9]. The main component of the framework is the Concrete compiler which turns Python code into its FHE equivalent in a process called “FHE compilation”. It incorporates the TFHE algorithm for homomorphic computations.

5.1. Limitations

While implementing the system, we came across the following limitations within FHE and Concrete:

• Branching: Concrete does not support branching, which means we cannot use conditional statements such as if-else. This limitation makes it difficult to implement complex algorithms, especially sorting algorithms since they rely on comparisons.
• Data Types: Concrete only supports encrypted Integers along with Boolean data types which means we cannot work with decimal or floating-point numbers. Furthermore, the division of encrypted numbers is not supported. This limitation further restricts the number of analyses that can be performed.

5.2. Calculation of Mean

Mean is calculated by dividing the sum of data points with the total number as shown in Equation (1).

$$\overline{x} =\mathrm{ }{\displaystyle \frac{{\sum }_{i=1}^n{x}_i}{n}}$$

(1)

However, as mentioned in section 5.1, we are unable to perform division on encrypted data. Therefore, only the sum of the encrypted data points is calculated, which is then divided by the total number of data points after decryption to get the result.

5.3. Calculation of Variance

Variance of a set of values is calculated using Equation (2)

$$V = {\displaystyle \frac{{\sum }_{i=1}^n{\left(x_i-\overline{x}\right)}^2}{n-1}}$$

(2)

This equation is not compatible with FHE calculations since it includes calculation of mean and therefore involves division. To overcome this limitation, we use Equation (3) which is derived in [24].

$$V = {\displaystyle \frac{n^2{\sum }_{i=1}^n{x}_i^2-2n{\sum }_{i=1}^n\left(x_i{\sum }_{j=1}^n{x}_j\right)+n\left({\sum }_{j=1}^n{x}_j^2\right)}{n^2\left(n-1\right)}}$$

(3)

With this approach we are able to eliminate mean calculation; however, it was not possible to remove division altogether. Therefore, we are only calculating the numerator on the encrypted data. Once the result is returned, it is decrypted and divided by the denominator.

5.4. Sorting

Except for mean and variance, all statistical operations mentioned in Section 4 can be calculated easily from a sorted dataset. Sorting is not a function provided in the Concrete library. So, we explored ways to implement sorting on encrypted data.

We have implemented three different algorithms for sorting encrypted data: bubble sort, odd-even sort, and bitonic sort. Considering the limitations associated with Concrete, implementing any sorting algorithm becomes a challenge. Essentially sorting works by comparisons and since we were unable to use branching (if-else statements) we had to come up with alternate strategies. To overcome this issue, we used equality:

$$c?t:f=f+c\cdot \left(t-f\right)$$

(4)

In expression (4), the left-hand side is a ternary operator where$c$ is the condition, $t$is the result if$c$ is true, and$f$ is the result if $c$ is false. This logic can be easily implemented in traditional programming. However, since we are unable to implement branching on encrypted data, we took inspiration from the mathematical alternate shown on the right-hand side of Equation (4). The condition$c$ when evaluated would return a boolean value which would either be 0 or 1 in encrypted form. The logic is demonstrated in the following equations:

If $c=0$ then Equation (4) becomes $f+0\cdot \left(t-f\right)=f+0=f$

If $c=1$ then Equation (4) becomes $f+1\cdot \left(t-f\right)=f+t-f=t$

Bubble sort works by repeatedly comparing two adjacent values in an array and swapping the numbers if they are in the wrong order. This is achieved by implementing nested loops. Where the outer loop runs for each element of the array and the inner loop performs comparisons of the adjacent values. With each pass of the inner loop, the largest unsorted value is shifted towards the end, therefore the number of iterations in each pass of the inner loop decreases by one. The implementation of bubble sort is shown in Figure 2.

Like bubble sort, odd-even sort algorithm works by repeatedly comparing two adjacent values in an array and swapping the numbers if they are in the wrong order. However, unlike bubble sort, this algorithm works in two alternating phases: odd and even. Even phase starts at index 0 and compares the element at index 0 with the element at index 1 and moves to index 2 by comparing the element at index 2 with the element at index 3 and so on. Similarly, odd phase starts with index 1 and compares the element at index 1 with the element at index 2 and so on. These phases continue until the array is completely sorted. Figure 3 depicts the implementation of odd-even sort algorithm.

Bitonic Sort is a recursive, divide and conquer sorting algorithm that works by splitting the array into smaller sub arrays and arranging them in a bitonic sequence where the first half is sorted in ascending order and second half is sorted in descending order. These sequences are then merged recursively using compare and swap operations until the entire array is sorted in ascending order. One limitation of bitonic sort is that it only works correctly when the length of array is a power of 2 since the algorithm works by splitting the array in two of each recursive step. A part of the implementation of bitonic sort is shown in Figure 4.

5.5. Five-Point Summary

The five-point summary includes min, max, median, upper quantile, and lower quantile of the data. For a sorted dataset, the task of implementing the 5-point summary is trivial. Once the array is sorted, min and max values are retrieved from the first and last index, respectively. To calculate the median, we return the middle element of the array if the length of the array is an odd number. If the length is an even number, we return the sum of the middle two elements. After decryption, the sum is divided by 2 which results in the median value. Since upper and lower quantiles are essentially the medians of first and second half of a given data set, we split the sorted array into two and calculate the median of these two halves. We are calculating the five-point summary of data using bitonic sort if the number of data points is a power of two and using bubble sort otherwise.

5.6. Mode and Frequencies

Mode is defined as the most frequent value in a data set. In traditional programming, it can be easily implemented by using data structures that hold key value pairs (example: a HashMap). However, that approach was not feasible while working with encrypted data. Therefore, we create a separate array which stores the frequency of each element. This is achieved by comparing each element with all the elements using nested loops. After constructing the frequency array, we return the element with the highest frequency.

6. Results

The application is run within a Docker environment with limited resources (8 CPUs, 8 GB memory) on a system with an 11th Gen Intel Core i5 processor and 16 GB RAM.

For each size and range, we ran the application five times and recorded the average of the five5 runs.

6.1. Timing of Mean Calculations

We recorded the time (seconds) it takes to calculate the sum of encrypted data points of 250, 500, 750 and 1000 over the range of 15, 25, 100, 150, 200 and 255.

As Table 1 indicates, the process of calculating the mean takes under 1 second even for a data set containing 1000 data points. However, we were unable to calculate mean for more than 2000 data points. Even though there is no significant difference between the timings, the general trend observed in this data set is that time increases with the number of data points as well as the range of numbers which can be seen in Figure 5.

6.2. Timing of Variance Calculations

For variance, we recorded the time in seconds for 5, 10 and 15 data points with the range of 5, 10, 15 and 25 as shown in Table 2. We were only able to collect limited data since calculation of variance is expensive in terms of resources as it involves a lot of computations on encrypted data.

As Table 2 indicates, there is a significant increase in time as the number of data points increases. The time also increases as the range of numbers increases. Figure 6 provides a visual representation of Table 2.

6.3. Timing of Sorting Algorithms

We have recorded the timing of the three sorting algorithms; namely bubble sort, odd-even sort, and bitonic sort, described in Section 5.4. Table 3 compares the timings of the three sorting algorithms when the number of data points is a power of two. Table 4 shows the comparison between bubble sort and odd-even sort for other cases.

The performance of bitonic sort is significantly better than bubble sort and odd-even sort, especially as the data sets get larger and the range of numbers increases, which can be clearly observed in Figure 7. In comparison there is no significant difference between the timing of bubble sort and odd-even sort as can be seen in Figure 8.

6.4. Timing of Five-Point Summary Calculations

Five-point summary is being calculated on sorted data. Since the performance of bitonic sort algorithm is better than bubble sort and odd-even sort, we are using bitonic sort for sorting the data set if the number of data points is power of two and bubble sort otherwise. The data that we collected includes the time it takes to sort the encrypted data and the calculation of five-point summary which includes; min, max, median, upper quantile and lower quantile. Table 5 shows the time of calculating five-point summary using bitonic sort algorithm whereas Table 6 shows the calculation using bubble sort algorithm.

The results from Table 5 clearly indicate the trend of time increasing with the number of data points as well as the range of numbers which is also illustrated in Figure 9.

Table 6 follows a similar trend of an increase in time with the number of data points and their range which can also be seen in Figure 10. However, as observed in the comparison of sorting algorithms, the calculation of five-point summary is faster with bitonic sort algorithm especially when the number of data points and their range increases.

6.5. Timing of Mode Calculations

For mode calculation we have collected data for 5, 10, and 15 data points with the range of 15, 25, 50 and 100. Table 7 shows the average time to calculate mode for each range and number of data points.

Similar to the trend observed so far, Table 7 also highlights the increase of time with the increase in range and number of data points. This is further demonstrated in Figure 11.

7. Discussion

This study proposed a system that provides security and confidentiality of data by utilizing fully homomorphic encryption. Data is encrypted by the client and sent to the server where the statistical operations are performed, and the result is returned in encrypted form. The encrypted result is then decrypted on the client side to get the results. This ensures that the data remains secure in transit as well as in use.

The results show that for encrypted numbers, simple operations such as addition can be performed quickly for small to large datasets. However, multiplication takes comparatively longer. The time increases with the complexity of the algorithms, which includes nature as well as the number of operations that must be performed, including the number of data points and their range. Limitations such as the inability to divide encrypted numbers and using only integers are major hurdles that restrict the number of algorithms that can be implemented.

Nevertheless, this work reinforces the theoretical promise of Fully Homomorphic Encryption (FHE) for statistical analysis and highlights a clear path forward: the development of optimized, FHE-compatible algorithms. With continued advancements, the practical application of FHE in real-world analytics is well within reach.