When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication

When and Where Faults Matter: A Study of Transient Errors in CKKS Multiplication Vattana Chan3 , Matías Mazzanti1 , Karthik Swaminathan2 , Augusto Vega2 , Esteban Mocskos1 , Radha Venkatagiri3

arXiv:2608.11147v1 [cs.AR] 11 Aug 2026

1

University of Buenos Aires, 2 IBM T. J. Watson Research Center, 3 Georgetown University

Abstract—Homomorphic Encryption (HE) is a privacypreserving encryption paradigm that enables computation directly on encrypted data without requiring decryption. In this paper, we study errors in fully homomorphic encryption (FHE) computations, with a particular focus on server-side homomorphic multiplication in the unoptimized CKKS (Cheon–Kim–Kim– Song) scheme. We show that both the timing and the location of errors in the ciphertext components c0 and c1 have a significant impact on the correctness of the final FHE output.

I. I NTRODUCTION AND BACKGROUND In the era of cloud computing [1], [2], security and privacy have become the primary concerns, as users must entrust sensitive data to potentially untrusted servers. Homomorphic Encryption (HE) [3] is a cryptographic technique designed to address these concerns by enabling computation directly on encrypted data without revealing the underlying plaintext. While the growing adoption of HE has driven substantial research into the design of new schemes [4]–[7], parameter optimization [8], and performance improvements [9]–[13], relatively little attention has been paid to the resilience of HE systems. CKKS [4], [14]; in particular, is a Fully Homomorphic Encryption (FHE) scheme that has received considerable attention from the research community due to its support for approximate arithmetic over real and complex numbers, making it especially well suited for privacy-preserving AI and machine learning workloads. message(m1)

plaintext(p1)

Client-Side

plaintext(p2)

message(m3)

ciphertext(c2) ciphertext(c1)

Addition Computation on Encrypted Data Multiplication KeySwitching Relinearization Server-Side Server's Input Data Rotation

Decrypt

Decode plaintext(p3)

c = (c0 , c1 )

(1)

where c0 contains the encrypted message and c1 is a public sampled key-dependent polynomial introduced during encryption. Decryption follows the standard RLWE [15] paradigm: the plaintext is recovered by computing c0 + c1 × sk, where sk is the secret key. Through this operation, the randomness sampled during encryption is canceled, yielding the message together with the approximation error intrinsic to CKKS. Finally, decoding applies the Fast Fourier Transform (FFT) and rescales the decrypted plaintext to recover an approximation of the original input data. A. FHE Multiplication Ciphertext–ciphertext multiplication produces a three-term ciphertext: (1) (2)

(1) (2)

(1) (2)

ciphertext(c3)

Fig. 1: Overview of the end-to-end CKKS computational pipeline. Client-side encoding and encryption produce ciphertexts that are homomorphically evaluated on the server (where the errors studied in this work occur) before clientside decryption and decoding.1 In CKKS, message is encoded using inverse Fast Fourier Transform (iFFT) and scaled by a scaling factor, transforming

(1) (2)

cmult = (c0 c0 , c0 c1 + c1 c0 , c1 c1 ) = (d0 , d1 , d2 )

(2)

CKKS then applies relinearization to convert this three-term ciphertext back into the standard two-term form. Using the evaluation key (evk), the third component is folded back as: (3)

Encrypt

Encoding message(m2)

it into a plaintext (p). During encryption, the plaintext then becomes a ciphertext. A ciphertext is represented as a pair of polynomials:

(3)

cmult relin ≈ (d0 , d1 ) + d2 ∗ evk ≈ (c0 , c1 )

(3)

In this work, we present an in-depth analysis of the resilience of homomorphic multiplication in CKKS in the presence of hardware-induced transient single-bit flip errors. We show that: 1). homomorphic multiplication is highly susceptible to faults, 2). errors affecting ciphertext polynomials c0 and c1 follow distinct fault-propagation paths, and 3). the timing at which c0 and c1 encounter faults significantly influences the final decrypted output. These observations are supported by both theoretical analysis and empirical evaluation. II. E RROR I NJECTION M ETHODOLOGY Transient errors may occur during CKKS operations. These errors can lead to three distinctive outcomes: (i) the homomorphic operation fails and the error is detected, (ii) the operation completes successfully and the output is masked, (iii) the operation completes successfully, but the error propagated and corrupts the final output, which is called Silent Data Corruption (SDC) [16].

Using our own CKKS implementation (C-CKKS) 2 in C++ that provides us visibility into error propagation pathways, combined with error injection tool LLTFI [20], we injected single bit transient errors in different ciphertext polynomials during ciphertext-ciphertext multiplication as shown in Eq. 2 and Eq. 3. After injecting each bit error, we run the full homomorphic encryption pipeline and evaluate the decoded output from the final stage by comparing it to the original data using the Maximum Relative Error Percentage (MREP). To build a first-order understanding, we will only focus on homomorphic multiplication without optimizations such as NTT and RNS in this work, and leave other operations for future work. III. E RROR R ESILIENCE A NALYSIS This section introduces preliminary results on CKKS resilience under transient errors during homomorphic multiplication. A. Resiliency Analysis of FHE Multiplication Due to the complexity of homomorphic multiplication, the timing and the location of bit-level faults can lead to remarkably different outcomes. In several cases, bit-flips in ciphertext components result in unexpected behaviors, such as the absence of the scaling factor ∆, the lack of a gap, th or no N2 coefficient resilience (See Fig 2) 3 . To understand these effects, we compared polynomial execution traces from error-free and fault-injected runs and used these comparisons to construct error propagation trees.

Fig. 2: Error characterization of bit-flips occurring on c0 and c1 inside Homomorphic Multiplication (Refer to I-A) with Gaps = 2, log Q = 60, log ∆ = 25, N = 64, ε = 0.1. We model a fault as an error polynomial ei,j ∈ Z[X] whose only non-zero coefficient is the i-th one, corresponding to a bit flip at position j of coefficient i (using 0-based indexing and i ∈ [0, N − 1]): ei,j = 2j X i .

B. Error Propagation

(4)

As shown in Equation 2 and 3, both c0 and c1 from each ciphertext are each used twice in the computation of the final result: c0 contributes to the formation of d0 and d1 , while c1 contributes to d1 and d2 . This inherent reuse induces a symmetric algebraic structure across the partial products, as detailed in Section III-C. We observe that when a bit-flip affects only one of these uses, this symmetry is broken, and the resulting polynomial no longer satisfies the cancellation properties required during decryption and decoding, leading to a silent data corruption (SDC). In contrast, when the same bit-flip is consistently injected into both uses of c0 (or, analogously, both uses of c1 ), the algebraic symmetry is preserved and the masking patterns previously described remain intact.

The sign of this error depends on whether the bit is flipped from 0 to 1 or from 1 to 0; however, this distinction does not affect the following analysis. In particular, we highlight the difference between corrupting (1) c0 in both d0 and d1 , and corrupting it only in d1 . The case (2) of c0 is fully analogous. We inject a fault in c0 , i.e., c0 → c0 + ei,j , and expand the multiplication in Eq. 3:

C. Theoretical Explanation

Thus, the resulting ciphertext corresponds to the correct multiplication outcome plus an additional error term given by the product of the injected fault and a valid ciphertext. If we repeat the same analysis but inject the error only in d1 , the resulting expression is similar, yet it does not form a complete ciphertext. In this case, we obtain:

In order to gain a better understanding of what happens during ciphertext multiplication, and why resiliency is achieved in some cases but not in others, we analytically model the injected faults. 2 C-CKKS is implemented based on OpenFHE [17], HEaaN [4], SEAL [18] and PyFHE [19]. 3 The resilience of the scaling factor ∆, the modulus Q, and the gap/slot structure, including the resilience profiles of state-of-the-art optimizations, is analyzed in detail in [21], [22].

(2)

(1)

c′mult = ((c0 + ei,j ) × c0 + devk 0 , (1)

(2)

(2)

(1)

c1 × c0 + c1 × (c0 + ei,j ) + devk 1 ) = ··· (1)

(1)

(2)

(5)

(2)

= (c0 m , c1 m ) + ei,j × (c0 ′ , c1 ′ )

c′mult = (c0 × c′0 + devk 0 , c1 × c′0 + c′1 × (c0 + ei,j ) + devk 1 ) = · · · = cmult + ei,j × (0, c′1 ).

(6)

In the first case, the injected fault yields a valid ciphertext. During decryption (Section I), the multiplication by the secret key induces the usual cancellation of terms, resulting in a decrypted value that can be interpreted as the intended product plus the scheme-inherent approximation error, and an additional low-magnitude term corresponding to the unaffected ciphertext. While the explicit expansion involves many subterms (d0, d1, d2, evk, etc.), the overall effect on the decrypted value preserves the structure of the original multiplication. Consequently, the bit-flip fault pattern remains largely consistent with that previously characterized. In contrast, when the fault affects only d1 , this cancellation does not occur, leaving residual randomness terms after decryption and therefore producing a significantly larger error. R EFERENCES [1] C. Reiss, A. Tumanov, G. R. Ganger, R. H. Katz, and M. A. Kozuch, “Heterogeneity and dynamicity of clouds at scale: Google trace analysis,” in Proceedings of the Third ACM Symposium on Cloud Computing, ser. SoCC ’12. New York, NY, USA: Association for Computing Machinery, 2012. [Online]. Available: https://doi.org/10.1145/2391229.2391236 [2] L. A. Barroso, J. Clidaras, and U. Hölzle, The Datacenter as a Computer: An Introduction to the Design of WarehouseScale Machines, Second Edition, 2013. [Online]. Available: http: //dx.doi.org/10.2200/S00516ED2V01Y201306CAC024 [3] C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 169–178. [4] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409– 437. [5] S. Halevi, Y. Polyakov, and V. Shoup, “An improved rns variant of the bfv homomorphic encryption scheme,” in Topics in Cryptology–CT-RSA 2019: The Cryptographers’ Track at the RSA Conference 2019, San Francisco, CA, USA, March 4–8, 2019, Proceedings. Springer, 2019, pp. 83–105. [6] D. Boneh, E.-J. Goh, and K. Nissim, “Evaluating 2-dnf formulas on ciphertexts,” in Proceedings of the Second International Conference on Theory of Cryptography, ser. TCC’05. Berlin, Heidelberg: SpringerVerlag, 2005, p. 325–341. [Online]. Available: https://doi.org/10.1007/ 978-3-540-30576-7_18 [7] Z. Brakerski, C. Gentry, and V. Vaikuntanathan, “(leveled) fully homomorphic encryption without bootstrapping,” ACM Transactions on Computation Theory (TOCT), vol. 6, no. 3, pp. 1–36, 2014. [8] Z. Tian, L. Chen, S. Fan, X. Deng, R. Hou, D. Meng, and M. Zhang, “Lp-henn: fully homomorphic encryption accelerator with high energy efficiency,” Cybersecurity, vol. 8, no. 1, p. 98, 2025. [Online]. Available: https://link.springer.com/article/10.1186/s42400-025-00360-x [9] N. Samardzic, A. Feldmann, A. Krastev, S. Devadas, R. Dreslinski, C. Peikert, and D. Sanchez, “F1: A fast and programmable accelerator for fully homomorphic encryption,” in MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, ser. MICRO ’21. New York, NY, USA: Association for Computing Machinery, 2021, p. 238–252. [Online]. Available: https://doi.org/10.1145/3466752. 3480070 [10] B. Reagen, W.-S. Choi, Y. Ko, V. T. Lee, H.-H. S. Lee, G.-Y. Wei, and D. Brooks, “Cheetah: Optimizing and accelerating homomorphic encryption for private inference,” in 2021 IEEE International Symposium on High-Performance Computer Architecture (HPCA), 2021, pp. 26–39. [11] Y. Yang, H. Zhang, S. Fan, H. Lu, M. Zhang, and X. Li, “Poseidon: Practical homomorphic encryption accelerator,” in 2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), 2023, pp. 870–881.

[12] R. Agrawal, A. Chandrakasan, and A. Joshi, “Heap: A fully homomorphic encryption accelerator with parallelized bootstrapping,” in Proceedings of the 51st Annual International Symposium on Computer Architecture, ser. ISCA ’24. IEEE Press, 2025, p. 756–769. [Online]. Available: https://doi.org/10.1109/ISCA59077.2024.00060 [13] D. B. Cousins, Y. Polyakov, A. A. Badawi, M. French, A. Schmidt, A. Jacob, B. Reynwar, K. Canida, A. Jaiswal, C. Mathew, H. Gamil, N. Neda, D. Soni, M. Maniatakos, B. Reagen, N. Zhang, F. Franchetti, P. Brinich, J. Johnson, P. Broderick, M. Franusich, B. Zhang, Z. Cheng, and M. Pedram, “TREBUCHET: Fully homomorphic encryption accelerator for deep computation,” Cryptology ePrint Archive, Paper 2023/521, 2023. [Online]. Available: https://eprint.iacr.org/2023/521 [14] J. H. Cheon, K. Han, A. Kim, M. Kim, and Y. Song, “A full RNS variant of approximate homomorphic encryption,” in Selected Areas in Cryptography–SAC 2018: 25th International Conference, Calgary, AB, Canada, August 15–17, 2018, Revised Selected Papers 25. Springer, 2019, pp. 347–368. [15] M. R. Albrecht, R. Player, and S. Scott, “On the concrete hardness of learning with errors,” Journal of Mathematical Cryptology, vol. 9, no. 3, pp. 169–203, 2015. [16] H. D. Dixit, S. Pendharkar, M. Beadon, C. Mason, T. Chakravarthy, B. Muthiah, and S. Sankar, “Silent data corruptions at scale,” 2021. [Online]. Available: https://arxiv.org/abs/2102.11245 [17] A. A. Badawi, A. Alexandru, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y. Lee, Z. Liu, D. Micciancio, C. Pascoe, Y. Polyakov, I. Quah, S. R.V., K. Rohloff, J. Saylor, D. Suponitsky, M. Triplett, V. Vaikuntanathan, and V. Zucca, “OpenFHE: Open-source fully homomorphic encryption library,” Cryptology ePrint Archive, Paper 2022/915, 2022. [Online]. Available: https://eprint.iacr.org/2022/915 [18] “Microsoft SEAL (release 4.1),” https://github.com/Microsoft/SEAL, Jan. 2023, microsoft Research, Redmond, WA. [19] S. Erabelli, “py-fhe: A Python library for fully homomorphic encryption,” https://github.com/sarojaerabelli/py-fhe, 2020, gitHub repository, implemented BFV, CKKS, and CKKS bootstrapping schemes; MIT license. [20] U. K. Agarwal, A. Chan, and K. Pattabiraman, “Lltfi: Framework agnostic fault injection for machine learning applications (tools and artifact track),” in 2022 IEEE 33rd International Symposium on Software Reliability Engineering (ISSRE), 2022, pp. 286–296. [21] M. Mazzanti, A. Vega, P. Bose, and E. Mocskos, “Characterizing the sensitivity to individual bit flips in client-side operations of the ckks scheme,” 2025. [Online]. Available: https://arxiv.org/abs/2507.20891 [22] A. Vega, M. Mazzanti, and E. Mocskos, “Quantifying the biterror resilience of fhe compute,” in Proceedings of the 31st IEEE International Symposium on High Performance Computer Architecture (HPCA 2025). Las Vegas, NV, USA: IEEE, Mar. 2025, workshop paper. [Online]. Available: https://research.ibm.com/ publications/quantifying-the-bit-error-resilience-of-fhe-compute

Related documents

• Low-Latency Bootstrapping for CKKS using Roots of Unity#414058
• Efficient Mod Approximation and Its Applications to CKKS Ciphertexts#665618
• Efficient Mod Approximation and Its Applications to CKKS Ciphertexts#664118
• Performance analysis of the homomorphic implementation of K-Means using CKKS#331720
• SoK: You Find What You Seek: Rethinking Oracles, Guidance, and Input Generation in Hardware Fuzzing#1063511