An End-to-End Encrypted Control Pipeline for Multi-Agent Coordination via CKKS Homomorphic Encryption
arXiv:2606.07375v1 [eess.SY] 5 Jun 2026
Sai Sandeep Damera, Maria Charitidou, Asim Zoulkarni and John S. Baras Abstract— Cloud-based coordination of multi-agent systems requires sharing state with a central server, creating a conflict between coordination and privacy. Fully homomorphic encryption (FHE) resolves this in principle, but its severe arithmetic constraints demand that every stage of the control loop be redesigned from first principles. We present an end-to-end encrypted control pipeline in which sensing, state estimation, state propagation, and consensus control all operate on CKKSencrypted data using only addition, multiplication, and cyclic rotation. In order to overcome the computational challenges of FHE, we employ steady-state Kalman gains instead of solving for the matrices online and graph Laplacians are applied via the diagonal method at a cost proportional to the number of nonzero cyclic diagonals, accommodating ring, torus, and complete-graph topologies within a unified framework. To quantify the cumulative effect of encryption noise, we use the separation principle to decouple controller and observer error dynamics and derive a periodic bootstrapping bound in which CKKS bootstrapping acts as an impulsive disturbance; the resulting steady-state error ball depends on the bootstrapping precision and the closed-loop spectral radius, providing a direct design equation for the privacy-accuracy tradeoff. The pipeline is validated on a multi-agent formation control scenario, confirming stable closed-loop operation under encryption with bounded tracking error.
I. I NTRODUCTION Cloud-based coordination of multi-agent systems offers compelling computational advantages: a central server can fuse sensor data from all agents, propagate a joint dynamical model, and compute globally optimal control inputs. Yet this architecture demands that every agent transmit its state to the coordinator in the clear. In settings where the agents belong to competing organizations, operate under privacy regulations, or traverse adversarial communication channels as for example in coalition military operations and commercial fleet coordination, exposing raw positions, velocities, and sensor readings is unacceptable. Fully homomorphic encryption (FHE) resolves this tension in principle. Under FHE, arbitrary computations can be carried out on ciphertext without ever revealing the underlying plaintext, providing information-theoretic security without trusting the coordinator. The CKKS scheme [1] is particularly suited to control applications because it operates natively on vectors of approximate real numbers, supporting element-wise addition, element-wise multiplication, and cyclic rotation as its three primitive operations. Recent work has shown that these three primitives suffice for meaningful numerical simulation: Kholod et al. [2] solve the linear advection equation on CKKS-encrypted grids, demonstrating The authors are with the University of Maryland, College Park, USA. Emails: {sdamera, mchar, asimz, baras}@umd.edu.
Fig. 1: Overview of the encrypted control pipeline. that finite-difference stencils map directly onto the rotationand-masking pattern of CKKS vector arithmetic. Despite this progress, existing work treats individual building blocks of the control loop in isolation. Encrypted controllers have been proposed for linear systems [3], encrypted state estimation has been studied under partially homomorphic schemes [4], and encrypted optimization has been explored for distributed settings [5]. Nevertheless, a fully encrypted framework encompassing the complete control cycle from sensing to actuation is still not available. Addressing this problem, this paper presents a complete encrypted control pipeline for multi-agent formation control that allows the designer to quantify the steady-state tracking error introduced by encryption. More specifically, we construct an end-to-end FHE-compatible control chain for linear time-invariant (LTI) multi-agent systems where every part is realized using only the three native CKKS primitives. To overcome the computational challenges related to matrix inversion we use pre-computed Kalman gains, an encrypted state propagator via precomputed matrix exponential, and an encrypted consensus controller whose cost is determined by the number of nonzero cyclic diagonals in the graph Laplacian. For ring topologies this yields two rotations at zero multiplicative depth; for torus and other sparse topologies the same diagonal-method primitive applies at modest additional cost. A formal stability analysis of the closedloop encrypted system is performed and a steady state error bound is derived that depends on the bootstrapping precision and the closed-loop spectral radius. Finally, the framework is validated on a multi-agent scenario with various graph topologies via OpenFHE.jl [2] revealing the importance of the graph topology in the design of a computationally efficient encrypted control scheme. The framework is therefore best suited to supervisory coordination with updates on the order of seconds, although ongoing FHE acceleration efforts suggest that faster encrypted control may become practical
in future systems [6]. The remainder of the paper is organized as follows. Section II surveys prior work on encrypted control and positions our contribution. Section III reviews the CKKS scheme, multi-agent LTI consensus, and ISS cascade theory. Section IV presents the five-stage encrypted control pipeline. Section V derives the end-to-end error bound. Section VI reports numerical results, and Section VII concludes. II. R ELATED W ORK We organize the literature into three threads: encrypted control systems, encrypted state estimation, and FHE-based numerical computation. Our contribution draws on all three but is, to our knowledge, the first to unify them into a single pipeline with an end-to-end error guarantee. a) Encrypted control: The idea of executing control algorithms on encrypted data originates with Kogiso and Fujita [3], who demonstrated encrypted state feedback for a single-input single-output plant using the ElGamal cryptosystem. Subsequent work generalized this to multi-input systems and explored the tradeoff between encryption overhead and control performance. Kim et al. [7] provided a systematic comparison of partially homomorphic (Paillier, ElGamal) and fully homomorphic (BFV, CKKS) schemes for encrypted linear controllers, showing that CKKS offers the most favorable precision-to-overhead ratio for real-valued control signals. A complementary tutorial by Schlüter et al. [8] supplies reference implementations. These contributions focus on a single encrypted controller block; the observer, state propagator, and multi-agent coordination layer are outside their scope. b) Encrypted optimization and distributed control: For constrained problems, Alexandru et al. [9] proposed encrypted model predictive control (MPC) by running a fixed number of projected gradient iterations on CKKS-encrypted data, accepting suboptimality from the fixed iteration count in exchange for FHE compatibility. More recently, Binfet et al. [5] studied encrypted distributed optimization via ADMM, demonstrating that the alternating-direction structure maps naturally onto CKKS arithmetic. Both approaches handle the control computation stage but assume that the coordinator already holds encrypted state estimates; the estimation and propagation stages are not addressed. c) Encrypted state estimation: Farokhi et al. [4] analyzed encrypted Kalman filtering under the Paillier scheme, which supports only addition on ciphertexts. Because the Kalman prediction step requires matrix-vector multiplication (which is not a native Paillier operation), their approach is restricted to the measurement update. Under CKKS, the full predict-update cycle becomes tractable because multiplication is available. We exploit this by running a fully encrypted steady-state Kalman filter. d) FHE-compatible numerical methods: The most direct precursor to our work is Kholod et al. [2], who demonstrated that CKKS can support full PDE time-stepping by implementing first-order upwind and second-order LaxWendroff schemes for the scalar advection equation. Their key algorithmic contribution is a circshift construction that
implements neighbor access in an encrypted vector via two cyclic rotations and a pair of plaintext masks. We observe that the graph Laplacian of a ring communication topology has exactly the same stencil structure as the one-dimensional advection operator, so the circshift primitive transfers directly to the consensus setting. Gap addressed by this work: Each of the above threads addresses one stage of an encrypted control loop in isolation. This paper closes the loop: we connect sensing, estimation, propagation, and consensus into a single CKKS pipeline and provide the first end-to-end error analysis that tracks encryption noise through the entire cascade. Two contributions are, to our knowledge, new. First, we apply the diagonal method [10] to graph Laplacians under FHE, showing that sparsity in the cyclic-diagonal basis (not circulancy) determines the cost of encrypted multi-agent coordination; this accommodates non-circulant topologies such as the torus within the same framework. Second, we model periodic CKKS bootstrapping as a discrete-time impulsive disturbance and derive a closed-form steady-state error ball, providing a direct design equation linking CKKS parameters, communication topology, and tracking accuracy. III. P ROBLEM S ETUP A. CKKS Arithmetic Model We treat the CKKS fully homomorphic encryption scheme purely as an arithmetic constraint: a small set of primitive operations that any algorithm must be expressed in terms of. No knowledge of the underlying lattice cryptography is required; we refer the reader to [1] for the construction. A CKKS ciphertext ct encodes a vector of approximate real numbers. The scheme provides exactly three primitive operations on ciphertexts: (i) element-wise addition, producing ct(aa + b ); (ii) element-wise (Hadamard) multiplication, producing ct(aa ⊙ b ); and (iii) cyclic rotation by an integer shift s, producing ct(rots (aa)) with [rots (aa)]i = a(i+s) mod n . Each operation also admits a plaintext variant, where a ciphertext is combined with an unencrypted operand at lower cost and with less noise. In particular, comparisons, branches, divisions, and transcendental functions are not natively available. This is the central design constraint of the present work. Each operation introduces a small additive error. Multiplication is the most expensive: every ciphertext-ciphertext multiply consumes one multiplicative level, with a finite level budget dmult determined by the encryption parameters. Bootstrapping refreshes the ciphertext to a higher level, restoring the ability to perform further multiplications, but introduces an error impulse of magnitude δboot ≈ 10−6 , several orders of magnitude larger than a single arithmetic operation (∼10−14 for a ciphertext-plaintext multiply). The bootstrapping period Tboot (how many control cycles elapse between refreshes) is a key design parameter. Cost asymmetry: Ciphertext-plaintext operations are far cheaper than ciphertext-ciphertext operations, both in time (∼25×) and in noise (∼60×). This asymmetry motivates a
Ring 1
9
Torus 2
8
3
7
4 6
5
Complete
D. The Encrypted Coordination Problem
1
2
3
1
2
3
4
5
6
4
5
6
7
8
9
7
8
9
Fig. 2: Communication topologies analyzed (M = 9 agents). design principle that pervades the pipeline: precompute everything possible in plaintext. Gains, system matrices, graph weights, and reference trajectories are all known offline and are never encrypted; only the agents’ states, measurements, and control inputs traverse the pipeline as ciphertexts. B. Multi-Agent System Model Consider M agents, each modeled as a discrete-time linear time-invariant (LTI) system: xi (k + 1) = A xi (k) + B ui (k),
yi (k) = C xi (k) + vi (k), (1)
where xi (k) ∈ Rn is the state, ui (k) ∈ Rm the control input, yi (k) ∈ R p the measurement, and vi (k) is bounded sensor noise with ∥vi (k)∥ ≤ v̄ for all i, k. The matrices (A, B,C) are identical across agents and known in plaintext. Assumption 1 (Stabilizability and detectability). The pair (A, B) is stabilizable and the pair (A,C) is detectable. Assumption 1 guarantees the existence of a stabilizing feedback gain K (used in the control law below) and a steadystate Kalman gain Kss (used in the encrypted observer of Section IV-B). The agents communicate over a graph G = (V , E ) with |V | = M. The ring (M agents on a cycle) is the primary topology studied here; extensions to torus and completegraph topologies are analyzed in Section IV-D. The property exploited under FHE is that the block Laplacian L ⊗ In can be decomposed into a small number of cyclic diagonals, each applied via a single CKKS rotation (Section IV-D). The number of nonzero cyclic diagonals determines the computational cost of the consensus stage. C. Consensus and Formation Control Law Each agent applies a standard consensus-plus-tracking control law [11], combining local state feedback with a consensus coupling term and a formation reference: ui (k) = K x̂i (k) + ε ∑ x̂ j (k)− x̂i (k) + Kr ri − x̂i (k) , (2)
The agents do not trust the cloud coordinator with their plaintext states. Each agent encrypts its measurement yi (k) using CKKS and transmits ct(yi (k)) to the coordinator. The coordinator must execute the observer, state propagator, and consensus controller entirely on encrypted data, producing ct(ui (k)) for each agent. Each agent then decrypts its control input locally and actuates. The design problem has three requirements: 1) FHE compatibility. Every operation on the coordinator must decompose into CKKS additions, multiplications, and rotations. No comparisons, divisions, or branches are permitted. 2) Closed-loop stability. The encrypted pipeline must preserve the stability of the plaintext closed-loop system. 3) Quantifiable accuracy. The steady-state tracking error attributable to encryption noise must be bounded by a computable function of the CKKS parameters and the system’s spectral radius. Section IV addresses requirement 1 by constructing the pipeline. Section V addresses requirements 2 and 3 by deriving the end-to-end error bound. IV. T HE E NCRYPTED C ONTROL P IPELINE We now show how to realize the control law (2) entirely within the CKKS arithmetic model of Section III-A. The pipeline has five stages, executed once per control cycle on the cloud coordinator; Figure 1 provides an overview. All matrices and gains are precomputed offline in plaintext; only the agents’ states and measurements are encrypted. This ensures that the dominant arithmetic is ciphertext-plaintext, exploiting the cost asymmetry described in Section III-A. A. Stage 1: Encrypted Sensing Each agent i samples its measurement yi (k) = C xi (k) + vi (k), encodes it as a CKKS plaintext vector, encrypts it, and transmits ct(yi (k)) to the coordinator. No homomorphic computation occurs at this stage; the cost is one Enc(·) operation per agent. The M measurement vectors are packed into a single ciphertext of dimension M p: (3) ct(yy(k)) = ct [y1 (k)⊤ , y2 (k)⊤ , . . . , yM (k)⊤ ]⊤ .
j∈Ni
where x̂i (k) is the state estimate of agent i, K is a stabilizing feedback gain (designed offline via LQR or pole placement), ε > 0 is the consensus coupling strength, Ni denotes the neighbors of agent i in G , ri ∈ Rn is the formation reference for agent i, and Kr is a reference tracking gain. Using the stacked estimate vector x̂(k) = [x̂1 (k)⊤ , . . . , x̂M (k)⊤ ]⊤ ∈ RMn , the control law becomes u(k) = (IM ⊗ K) x̂(k) − ε (L ⊗ In ) x̂(k) + (IM ⊗ Kr ) r − x̂(k) , where ⊗ denotes the Kronecker product and r = ⊤ ]⊤ . [r1⊤ , . . . , rM
Packing all agents into one ciphertext enables the coordinator to apply collective operations (the Laplacian, stacked matrixvector products) without inter-ciphertext communication. B. Stage 2: Encrypted State Estimation The coordinator maintains an encrypted state estimate ct(x̂(k)) and updates it using a steady-state Kalman filter. The standard Kalman filter requires online solution of a Riccati equation, which involves matrix inversion, a nonCKKS operation. We avoid this by precomputing the steadystate gain Kss offline (in plaintext) by solving the discrete
algebraic Riccati equation for the pair (A,C) with the known noise covariances. The online update then reduces to
a plaintext indicator vector to zero out entries that would otherwise wrap from the unused portion of the ciphertext. The cost of each circshift call is therefore two rotations, B ct(u(k))+ Kss ct(y(k)) two plaintext-ciphertext multiplications, and one addition. ct(x̂(k+1)) = (A − KssC) ct(x̂(k))+ |{z} |{z} | {z } pt
plaintext
pt
Every term is a plaintext-matrix times encrypted-vector product. The stacked observer matrix (IM ⊗ (A − KssC)) is blockdiagonal (one n × n block per agent), so the effective matvec dimension reduces from Mn to n. FHE decomposition: A plaintext-ciphertext matrixvector product Mct(vv) of dimension n is computed using the diagonal method [10]: represent M by its n diagonals {d0 , d1 , . . . , dn−1 }, then n−1 M ct(vv) = ∑ d j ⊙ rot j ct(vv) ,
(4)
j=0
where d j is the j-th diagonal of M (wrapped cyclically) applied as a plaintext Hadamard mask. This uses n rotations, n plaintext-ciphertext multiplications, and n − 1 additions. Since all three are CKKS primitives, the matvec is FHEcompatible. The multiplicative depth is one level (for the Hadamard products), regardless of n. The observer update (IV-B) requires two such matvec products (one for Aobs = A − KssC applied to ct(x̂(k)), and one for Kss applied to ct(y(k)); the exogenous input term B ct(u(k)) vanishes in the consensus formulation since the control is applied directly to the state). Because the two products operate on independent inputs at the same ciphertext level, they consume a single multiplicative level in total. C. Stage 3: Encrypted State Propagation Because the discrete-time system matrix A is known in plaintext (Section III-B), state propagation is simply ct(x̂(k+1)) += A ct(x̂(k)),
(5)
which is a single plaintext-ciphertext matvec, costing one multiplicative level. This is the cheapest pipeline stage. D. Stage 4: Encrypted Consensus Control The consensus coupling law in Section III-C requires applying the graph Laplacian L ⊗In to the encrypted estimate vector. For the ring topology, L is circulant, and the Laplacian application reduces to a circshift construction adapted from Kholod et al. [2]: (L ⊗ In ) ct(x̂) = 2 ct(x̂) − rot+n ct(x̂) − rot−n ct(x̂) , (6) where rot+n and rot−n are cyclic rotations by ±n positions (one full agent block). This uses two rotations, one scalarciphertext multiplication (by 2), and two subtractions, consuming zero multiplicative levels (since all operations are additions or plaintext multiplications). Note that the native CKKS rotation operates on the full ciphertext (all slots), not on the logical sub-vector of length Mn. To obtain a correct cyclic shift over the sub-vector, the circshift construction of Kholod et al. [2] performs two rotations in opposite directions and masks each with
Remark (Generalization via the diagonal method). The circshift construction (6) is a special case of the diagonal method [10] for plaintext-ciphertext matrix-vector products. Any Mn × Mn matrix M can be decomposed into at most Mn cyclic-diagonal matrices, one per diagonal offset k: Mn−1 M ct(vv) = ∑ dk ⊙ rotk ct(vv) ,
(7)
k=0
where dk is a plaintext mask containing the entries of M along cyclic diagonal k, and zero diagonals are skipped. Since each term is a rotation followed by a plaintextciphertext Hadamard product, the total cost is one rotation per nonzero off-diagonal plus one multiplicative level (for the Hadamard products). For the ring Laplacian, the block matrix L ⊗ In has exactly three nonzero cyclic diagonals (the main diagonal and the two neighbor offsets at ±n), and the masks d±n are constant vectors (−1 everywhere). This reduces to two circshift calls at zero depth, (6). √ √ recovering For a M × M torus with periodic boundaries, the block Laplacian decomposes as Ltorus ⊗ In = (Lh√ + Lv ) ⊗ In . The vertical component Lv is circulant (stride M n, two rotations). The horizontal component Lh wraps within each row independently and is not globally circulant: the masks along its off-diagonals contain zeros that block inter-row connections. The diagonal method handles this naturally, because the masks dk need not be constant. A 3 × 3 torus produces seven nonzero cyclic diagonals (six rotations), compared with three for the ring. For a complete graph on M agents, every agent-level offdiagonal is nonzero, yielding M nonzero cyclic diagonals (M − 1 rotations). The block structure (−In off-diagonal blocks) keeps the count at M rather than the Mn diagonals of a fully dense matrix. The cost of the consensus stage is therefore proportional to the number of nonzero cyclic diagonals of L ⊗ In , not the matrix dimension Mn. This provides a unified framework: circulant graphs (rings, k-nearest-neighbor rings) achieve the minimum diagonal count; structured non-circulant graphs (torus, k-regular expanders) remain efficient via sparsity in the cyclic-diagonal basis; and the complete graph represents the upper bound among block-identity Laplacians. We validate this cost model experimentally in Section VI-B. The full encrypted control computation is then: ct(u(k)) = (IM ⊗ K) ct(x̂(k)) − ε (L ⊗ In ) ct(x̂(k)) + (IM ⊗ Kr ) r − ct(x̂(k)) . (8) In the general case, the local gain K and reference gain Kr would require block-diagonal matvec products (one level each). When these gains are scalar multiples of identity (a common design choice for homogeneous fleets), the full control computation reduces to scalar-ciphertext multiplications
plus the Laplacian, consuming zero or one levels depending on whether the Laplacian uses circshift (ring) or a matvec (torus, complete). E. Stage 5: Decryption and Actuation The coordinator returns ct(u(k)) to the agents. Each agent i extracts its block ct(ui (k)) (via a plaintext mask and rotation), decrypts with its private key, and actuates. The coordinator never observes any plaintext quantity. F. Bootstrapping Schedule The total multiplicative depth consumed per control cycle is the sum across stages: + 0 − 1 = 2 − 3 levels. 1 dcycle = |{z} 1 + |{z} | {z } estimation
propagation
(9)
consensus
where the consensus depth is zero for the ring (scalarciphertext operations only) and one for the torus and complete graph (plaintext-ciphertext matvec). With a depth budget dmult = 15, the coordinator bootstraps every Tboot = ⌊dmult /dcycle ⌋ = 5–7 cycles, applying Bootstrap(·) to the encrypted state estimate and injecting an additive noise impulse δboot . The error analysis in Section V uses the conservative value Tboot = 5; in practice, bootstrapping is triggered adaptively when the ciphertext level is exhausted. V. E ND - TO -E ND E RROR A NALYSIS Every CKKS operation injects a small additive perturbation into the encoded plaintext. We now show that, for a stable closed-loop system, these perturbations remain bounded and the encrypted trajectory stays within a quantifiable neighborhood of the true (plaintext) trajectory.
B. Separation of Controller and Observer Errors The encrypted pipeline operates on both the plant state x(k) and the observer state x̂(k). The tracking error therefore lives in a 2Mn-dimensional augmented space. The following lemma shows that the separation principle reduces the analysis to a single Mn-dimensional recursion. Lemma 1 (Separation of error dynamics). Define the observer tracking error ê(k) = x̂enc (k) − x̂true (k) and the estimation mismatch ε̃(k) = [xenc (k) − xtrue (k)] − [x̂enc (k) − x̂true (k)]. Under the encrypted pipeline of Section IV, the augmented error [ê(k); ε̃(k)] evolves as wê (k) Acl KssC ê ê (k) + , (10) (k+1) = ε̃ wε̃ (k) 0 A − KssC ε̃ {z } | Aaug where wê and wε̃ collect the CKKS noise in each coordinate. Because Aaug is block lower-triangular, its eigenvalues are σ (Acl ) ∪ σ (A − KssC), and the mismatch ε̃(k) evolves autonomously with the stable observer matrix. Proof. Subtract the plaintext observer update from its encrypted counterpart. Each agent decrypts its control input: uenc (k) = Dec(ct(u(k))). Because all gains are applied as plaintext operands, the control input difference uenc (k) − utrue (k) = (K − εL ⊗ In + Kr ) ê(k) feeds back through B, producing the Acl block. The observer correction difference Kss [yenc (k)−ytrue (k)] = KssC [xenc (k)−xtrue (k)] introduces the off-diagonal coupling. The coordinate change ε̃ = (xenc − xtrue ) − (x̂enc − x̂true ) eliminates the coupling from the (2, 1) block, yielding the block lower-triangular structure. Both diagonal blocks are Schur stable by Assumption 2.
A. Error Model and Assumptions Let xtrue (k) denote the plaintext trajectory produced by exact arithmetic and xenc (k) the trajectory produced by the encrypted pipeline. Each pipeline stage introduces a bounded perturbation: δobs (k) from the observer matvec products, δprop (k) from the propagation matvec, δctrl (k) from the consensus computation, and δboot (k) from bootstrapping, injected every Tboot cycles. Because every inter-bootstrapping operation is a plaintext-ciphertext product, the per-step noise contributions ∥δobs ∥ , δprop , ∥δctrl ∥ remain at machineprecision level (∼10−14 ), while bootstrapping injects noise of magnitude ∥δboot ∥ ≈ 10−6 . Bootstrapping noise therefore dominates by eight orders of magnitude [2].
Lemma 1 implies that ε̃(k) evolves autonomously under Aobs . However, ε̃ is also kicked by a −δboot impulse at each bootstrapping event: the cloud bootstraps ct(x̂), shifting ê by +δboot , while the physical plant state does not jump, so ε̃(kb+ ) = ε̃(kb− ) − δboot . The steady-state ball for ε̃ is Tboot therefore δboot /(1−ρobs ), the same order as δboot itself. The coupling through KssC adds a persistent disturbance to ê(k) that we absorb into an effective noise bound δ̄eff = δ̄boot 1 + Tboot ∥KssC∥ /(1 − ρobs ) . The observer error then evolves as
Assumption 2 (Stability). The closed-loop system matrix Acl = A+B(K −εL⊗In +Kr ) is Schur stable: ρcl := ρ(Acl ) < 1. Let Kss be chosen such that Aobs = A−KssC is Schur stable (existence guaranteed by Assumption 1):
where w(k) absorbs the CKKS arithmetic noise, the periodic bootstrapping impulse, and the bounded coupling from ε̃ via KssC. For readability, we write e(k) := ê(k) in what follows. The aggregate noise satisfies
Assumption 3 (Plaintext operands and bounded noise). All system matrices (A, B,C) and control gains (K, Kr , ε, Kss ) are applied as plaintext operands. Since every homomorphic multiplication in the pipeline is plaintext×ciphertext, the per-step CKKS arithmetic noise satisfies ∥w(k)∥ ≤ δarith independently of the encrypted state magnitude ∥e(k)∥. (For ciphertext×ciphertext products, the noise would scale with the state; the pipeline avoids such products by design.)
∥w(k)∥ ≤ δarith + δ̄eff 1k≡0 mod Tboot .
ê(k + 1) = Acl ê(k) + w(k),
(11)
(12)
C. Periodic Bootstrapping Bound The per-cycle arithmetic noise is bounded by δarith ≤ dcycle · δct×pt ≈ 3 × 3 × 10−15 = 9 × 10−15 . The bootstrapping noise, injected once every Tboot = 5 cycles, satisfies ∥δboot ∥ ≈ 1.2 × 10−6 , dominating arithmetic noise by eight orders of magnitude. This motivates an analysis that exploits the
periodic noise structure rather than applying a worst-case bound at every step. Theorem 1 (Encrypted trajectory bound). Let Assumptions 2 and 3 hold, and let bootstrapping occur every Tboot cycles with effective per-event noise δ̄eff (including observer coupling). Then: (i) Steady-state error ball. The tracking error sampled at bootstrapping instants satisfies, for all m ≥ 0, mT
∥e(mTboot )∥ ≤ ρcl boot ∥e(0)∥ + εss ,
(13)
where εss is the steady-state radius defined as: εss =
δ̄eff T
1 − ρclboot
.
(14)
(ii) Inter-bootstrapping contraction. Between consecutive bootstrapping events, the error decays: ∥e(mTboot + j)∥ ≤ ρclj ∥e(mTboot )∥ +
δarith , (15) 1 − ρcl
for j = 0, 1, . . . , Tboot − 1.
√ Proof. We work in the weighted norm ∥x∥P = x⊤P x where P ≻ 0 solves A⊤ cl P Acl − P = −I, which exists for any Schurm stable Acl . In this norm, Am cl P ≤ ρcl for all m ≥ 0. Part (ii). Between bootstrapping events mTboot and (m + 1)Tboot , no bootstrapping occurs, so ∥w(k)∥ ≤ δarith . Iterating (11) over j steps from mTboot and taking norms: j−1 i ∥e(mTboot + j)∥P ≤ ρclj ∥e(mTboot )∥P + δarith ∑i=0 ρcl ≤ j ρcl ∥e(mTboot )∥P + δarith /(1 − ρcl ). Part (i). At the bootstrapping instant (m+1)Tboot , the impulse adds δ̄eff to the contracted error. Applying part (ii) with j = Tboot and dropping the O(δarith ) term (eight orders of magnitude smaller): T
∥e((m+1)Tboot )∥P ≤ ρclboot ∥e(mTboot )∥P + δ̄eff . This is an affine contraction in m. Iterating and summing the resulting geometric series yields (13). The steady-state error depends on three designercontrolled quantities: the bootstrapping precision δ̄boot (set by the CKKS ring dimension), the observer coupling ∥KssC∥ (set by the observer design), and the closed-loop spectral radius ρcl (set by the control design). The pipeline structure enters only through the bootstrapping period Tboot = ⌊dmult /dcycle ⌋. Part (ii) formalizes the “self-healing” phenomenon observed by Kholod et al. [2]: the error decreases monotonically between bootstrapping events because the stable closed-loop dynamics contract perturbations faster than the (negligible) arithmetic noise can accumulate. The interT bootstrapping contraction factor ρclboot provides a practical guideline for choosing Tboot : effective contraction requires Tboot ≫ 1/|log ρcl |, so that the bootstrapping impulse is largely absorbed before the next refresh. Remark (Sensitivity to spectral radius). Differentiating (14) T −1 with respect to ρcl gives ∂ εss /∂ ρcl = δ̄eff Tboot ρclboot /(1 −
T
ρclboot )2 , which diverges as ρcl → 1. For the present scenario (ρcl = 0.95, Tboot = 5), a 1% increase in ρcl increases εss by approximately 16%, underscoring the importance of robust pole placement in encrypted control design. Remark (Privacy-accuracy-computation tradeoff). The steady-state error εss is a decreasing function of the CKKS ring dimension NR , since a larger ring provides higher bootstrapping precision (smaller δboot ). However, every CKKS primitive’s computation time also scales with NR , increasing the minimum feasible control period. The ring dimension therefore parameterizes a Pareto frontier between tracking accuracy and computational cost, with the closed-loop spectral radius ρcl acting as a lever: a faster-decaying system (smaller ρcl ) tolerates coarser CKKS parameters for the same εss . Remark (Connection to impulsive systems). The periodic bootstrapping every Tboot cycles creates a discrete-time impulsive system: between bootstrapping events, the error T contracts by a factor ρclboot ; at each event, an additive impulse of magnitude δboot is injected. Stability requires the inter-impulse contraction to dominate the impulse, which is automatically satisfied when ρcl < 1. This is a dwelltime condition in the sense of switched systems theory: the bootstrapping period Tboot must be long enough for the system to contract between noise injections. VI. N UMERICAL D EMONSTRATION We validate the encrypted control pipeline on three communication topologies in a formation control scenario implemented in Julia using OpenFHE.jl [12] and SecureArithmetic.jl [2] for CKKS encryption. The implementation can be found here1 . All three topologies use M = 9 doubleintegrator agents (Mn = 36): a ring, a 3 × 3 torus, and the complete graph K9 . Each is run through the full fivestage pipeline (sensing, estimation, propagation, consensus, actuation). All comparison plots show plaintext trajectories (solid) against encrypted trajectories (dotted). In most stages the two overlap, confirming negligible CKKS overhead; the encryption gap is isolated directly in Figure 3. A. Scenario and Parameters We instantiate (1) with M = 9 double-integrator agents in 2D. Each agent has state xi = [px , py , vx , vy ]⊤ ∈ R4 (position and velocity in two axes), so the per-agent dimension is n = 4 and the collective state dimension is Mn = 36. The discretetime system matrices for a sampling period ∆t are 1 2 I2 ∆t I2 ∆t I2 , C = I2 0 . (16) A= , B= 2 0 I2 ∆t I2 Three topologies are compared at M = 9: ring, 3 × 3 torus (periodic boundaries), and complete graph K9 . The torus and complete-graph Laplacians are applied via the diagonal method (Section IV-D). In all cases, the 36-dimensional collective state is packed into a single ciphertext. CKKS parameters use a ring dimension 212 , multiplicative depth 1 https://github.com/sdamera95/EncryptedControl.jl
(a)
2.5
y (m)
|enc − pt|
10 −5.0
10 −7.5
10
Ring (consensus) Complete (consensus) Torus (pipeline)
−10.0
0
10
20
30
40
Torus (consensus) Ring (pipeline) Complete (pipeline)
50
0.0
−2.5
60
−2.5
Step k
B. Topology and Per-Stage Validation a) Laplacian cost model: Section IV-D predicts that the encrypted Laplacian cost scales linearly with the number of nonzero cyclic diagonals of the block Laplacian L ⊗ In . Table I confirms this: the ring (M =9, three diagonals) costs 945 ms, the torus (seven diagonals) costs 2452 ms (2.6×, closely matching the diagonal-count ratio 7/3 ≈ 2.3), and the complete graph (nine diagonals) costs 3479 ms. All three use only plaintext-ciphertext products, consuming a single multiplicative level (zero for the ring, whose constant masks reduce to scalar multiplications). b) Consensus: The ring Laplacian applied via circshift drives the disagreement ∥(L ⊗ In ) x(k)∥ to machine precision (∼10−13 ) within 60 steps in plaintext. Under encryption, the disagreement decays for approximately 30 steps and then flattens at a noise floor of ∼10−3 , set by accumulated CKKS bootstrapping error. The zero-depth property of the circshift Laplacian is confirmed empirically: consensus steps never trigger bootstrapping, so the noise floor is determined entirely by bootstrapping events inserted for other stages. c) Torus Laplacian decomposition: To validate the generalization of Section IV-D, we benchmark the torus Laplacian on M = 9 agents arranged on a 3 × 3 grid with periodic boundaries (the smallest non-degenerate 2D torus). The per-agent state dimension remains n = 4, giving a 36dimensional packed ciphertext. The block Laplacian decomposes as Ltorus ⊗ In = (Lh + Lv ) ⊗ In . The vertical√component Lv is circulant in the row-major packing (stride M n = 12, two rotations). The horizontal component Lh wraps within each row independently and is not globally circulant; its
2.5
10 1.2
Fig. 3: CKKS-induced gap |enc − pt| for consensus (solid) and closed-loop pipeline (dotted) on various topologies.
Ring Torus Complete
‖x(k) − r‖
budget dmult = 15, with bootstrapping enabled. The local gain K and reference gain Kr are scalar multiples of identity, so the control computation reduces to scalar-ciphertext multiplications plus the Laplacian, which costs zero depth for the ring and one level for the torus and complete graph (Section IV-D). The closed-loop spectral radius for the ring (ε = 0.3; torus 0.3; complete 0.1) is is ρcl = ρ(Acl ) = 0.95, computed offline from Acl = A + B(K − εL ⊗ In + Kr ). With T Tboot = 5, the inter-bootstrapping contraction factor is ρclboot = 5 0.95 ≈ 0.77, and the steady-state error bound (Theorem 1) predicts εss = δ̄eff /(1 − 0.77) ≈ 4.3 δ̄eff .
0.0
(b) Ring (enc) Torus (enc) Complete (enc)
10 1.0
10 0.8
0
10
20
30
40
50
60
Step k
Fig. 4: Formation control validation. (a) Nine agents (ring topology) converge from scattered positions toward the 3 × 3 grid formation (diamonds). Solid: plaintext; dotted: encrypted. Circles mark initial positions; stars mark final. (b) Formation tracking error ∥x − r∥ on various topologies.
cyclic-diagonal masks contain zeros that block inter-row connections. The diagonal method handles both components uniformly: the 36 × 36 block Laplacian has seven nonzero cyclic diagonals (six rotations), compared with three for the nine-agent ring. The measured costs (Table I) confirm linear scaling in the diagonal count. d) Formation control: Figure 4 shows agent trajectories converging to the target 3×3 grid formation from scattered initial positions. The encrypted trajectories are visually indistinguishable from their plaintext counterparts; the CKKS overhead is orders of magnitude below the formation tracking error itself (cf. Figure 3). The formation reference vector r is itself encrypted, so the coordinator never learns the target shape. Figure 4(b) compares the formation tracking error on all three topologies. e) State estimation: The Luenberger observer with precomputed steady-state Kalman gain Kss (ρ(A − KssC) = 0.899) estimates velocities from position-only measurements (C = [I2 0]), converging within ∼40 steps to a floor of ∼0.07 set by measurement noise. The encrypted observer error is indistinguishable from plaintext (gap ∼10−6 ), confirming that the separation principle (Lemma 1) holds: fresh encrypted measurements at each step suppress CKKS noise accumulation in the observer.
TABLE I: Computational cost summary (M = 9, Mn = 36). Timings are medians over five trials. Operation Ring Laplacian (M = 9, Mn = 36) Torus Laplacian (3×3, Mn = 36) Complete Laplacian (M = 9, Mn = 36) ct × pt (observer, block-diag.) ct × pt (propagation, block-diag.) Bootstrap(·)
Diags
Time (ms)
Depth
3 7 9 3 2
945 2,452 3,479 1,043 549 3,431
0 1 1 1 1 –
1,989 5,474
1 2–3
Observer step (Aobs + Kss ) Pipeline step (est. + ctrl. + prop.)
C. End-to-End Pipeline Figure 3 shows the headline result: 50 timesteps of closedloop pipeline operation (dotted) alongside 60 steps of openloop consensus (solid) on all three topologies. The pipeline encryption gap (dotted curves) remains flat at ∼10−6 for all topologies, confirming that closed-loop feedback suppresses CKKS noise accumulation. By contrast, the open-loop consensus gap (solid curves) grows to ∼10−4 –10−3 as bootstrapping noise accumulates without corrective measurements. No topology diverges, confirming closed-loop stability under CKKS encryption and validating Theorem 1 on three distinct communication graphs. Each pipeline timestep consumes 2–3 multiplicative levels (topology-dependent; see Equation (9)), with bootstrapping every Tboot = 5 cycles. The per-step computation time is approximately 5.5 s (dominated by the block-diagonal observer matvec products in the estimation stage, plus one in the propagation stage, with bootstrapping amortized over 5 cycles). The consensus stage contributes 945 ms for the ring, 2452 ms for the torus, and 3479 ms for the complete graph; see Table I), confirming the cost advantage of sparse Laplacian application via the diagonal method. D. Cost Profile Table I summarizes the per-operation and per-stage costs. The key observation is that the block-diagonal observer matrices (Aobs , Kss ) have only 3 nonzero cyclic diagonals each, making the observer matvec (∼1,050 ms) comparable in cost to the ring Laplacian (945 ms). A dense 36 × 36 matvec would cost 14,110 ms, so the block-diagonal sparsity yields a 14× speedup , confirming that sparse Laplacian structure provides a substantial computational advantage under encryption. Bootstrapping at 3431 ms per event is amortized over 5 cycles. The full cycle time of 5.5 s yields a maximum update rate of ∼ 0.18 Hz. Production-grade security parameters (larger ring dimension for 128-bit security) increase all wall-clock times by a constant factor without affecting the pipeline structure or error bounds. These rates are viable for the slowdynamics applications motivating this work. VII. C ONCLUSION We presented an end-to-end encrypted control pipeline for multi-agent formation control in which every stage of
the control loop operates on CKKS-encrypted data using only addition, multiplication, and cyclic rotation. The diagonal method provides a unified, topology-agnostic primitive for encrypted Laplacian application whose cost scales with the number of nonzero cyclic diagonals, accommodating ring, torus, and complete-graph topologies within the same framework. A periodic bootstrapping analysis yields the T closed-form steady-state bound εss = δ̄eff /(1 − ρclboot ), giving practitioners a direct design equation linking CKKS parameters to tracking accuracy. Validation on three topologies (M = 9 agents) confirms stable encrypted operation with bounded error. Natural extensions include nonlinear dynamics via polynomial approximation (with Taylor-withscaling-and-squaring and Paterson-Stockmeyer evaluation), encrypted MPC via fixed-iteration ADMM, multi-key CKKS for true multi-party coordination, and encrypted feedback gains via ciphertext-ciphertext products with Lie-Trotter operator splitting. R EFERENCES [1] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in International conference on the theory and application of cryptology and information security, pp. 409–437, Springer, 2017. [2] M. Schlottke-Lakemper and A. Kholod, “Secure numerical computations using fully homomorphic encryption,” 2024. JuliaCon 2024, Eindhoven, 10th July 2024. [3] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked control systems using homomorphic encryption,” in 54th IEEE Conference on Decision and Control (CDC), pp. 6836–6843, IEEE, 2015. [4] F. Farokhi, I. Shames, and N. Batterham, “Secure and private cloud-based control using semi-homomorphic encryption,” IFACPapersOnLine, vol. 49, no. 22, pp. 163–168, 2016. [5] P. Binfet et al., “Towards privacy-preserving cooperative control via encrypted distributed optimization,” at-Automatisierungstechnik, vol. 71, no. 9, pp. 736–747, 2023. [6] DARPA, “Dprive: Data protection in virtual environments.” [7] J. Kim et al., “Encrypting controller using fully homomorphic encryption for security of cyber-physical systems,” IFAC-PapersOnLine, vol. 49, no. 22, pp. 175–180, 2016. [8] N. Schlüter et al., “A code-driven tutorial on encrypted control: From pioneering realizations to modern implementations,” in 2024 European Control Conference (ECC), pp. 914–920, IEEE, 2024. [9] A. B. Alexandru, M. Morari, and G. J. Pappas, “Cloud-based mpc with encrypted data,” in 2018 IEEE conference on decision and control (CDC), pp. 5014–5019, IEEE, 2018. [10] S. Halevi and V. Shoup, “Algorithms in helib,” in Annual Cryptology Conference, pp. 554–571, Springer, 2014. [11] R. Olfati-Saber and R. M. Murray, “Consensus problems in networks of agents with switching topology and time-delays,” IEEE Transactions on automatic control, vol. 49, no. 9, pp. 1520–1533, 2004. [12] M. Schlottke-Lakemper, “OpenFHE.jl: Fully homomorphic encryption in Julia using OpenFHE.” https://github.com/hpsc-lab/ OpenFHE.jl, 2024.