Search papers, labs, and topics across Lattice.
This paper introduces an efficient fault-tolerance scheme for CPU-based CKKS computation, addressing the vulnerability of fully homomorphic encryption to transient hardware faults. By implementing a multi-level approach that includes modulus-aware bucket checks, dataflow-fused in-operator checking, and cross-operator check fusion, the method significantly reduces overhead while ensuring high detection rates of corrupted results. The scheme achieves a 100% detection rate for corrupted outputs with only 6.8% average runtime overhead, outperforming traditional checksum-based protections by a factor of 4.9.
Achieving a 100% detection rate for transient faults in CKKS computation with minimal overhead could revolutionize the reliability of encrypted data processing on standard CPUs.
Fully homomorphic encryption (FHE) enables computation on encrypted data, but its long ciphertext dataflow and high-dimensional modular arithmetic make it vulnerable to silent data corruption caused by transient hardware faults. Existing protection methods either target dedicated accelerators or impose substantial execution, modular-arithmetic, and memory-access overheads on CPUs. This work presents an efficient fault-tolerance scheme for CPU-based CKKS computation. It checks the input-output consistency of polynomial operators while reducing protection overhead at three levels. First, modulus-aware bucket checksum exploits wide CPU accumulators to reduce expensive modular reductions. Second, dataflow-fused in-operator checking embeds checksum accumulation into operator dataflows, avoiding separate scans of long ciphertext polynomials. Third, cross-operator check fusion eliminates redundant checksum computations between adjacent operators while preserving end-to-end checking invariants. We implement the scheme in OpenFHE and evaluate it on representative encrypted applications and ciphertext primitives under random single-bit transient faults. It achieves a 100 percent empirical detection rate across 150,000 non-crashing corrupted-result cases and maintains application accuracy close to the fault-free baseline over a wide range of fault rates. The scheme incurs only 6.0 percent to 8.4 percent runtime overhead, averaging 6.8 percent, and reduces average protection overhead by 4.9 times compared with direct checksum-based protection.
