An Efficient Fault-Tolerance Scheme for CKKS Computation on CPUs

2026-07-21

AI Summary

This work addresses the vulnerability of CKKS homomorphic encryption to transient hardware faults on CPUs, which can cause silent data corruption, while existing fault-tolerance mechanisms incur prohibitive overhead. To mitigate this, the authors propose a three-tiered, low-overhead fault-tolerance scheme comprising modulus-aware bucket checking, intra-operator fused verification, and inter-operator check fusion. This approach ensures end-to-end error detection while substantially reducing overheads associated with modular arithmetic, memory access, and execution. Implemented atop OpenFHE, the solution achieves 100% error detection across 150,000 non-crash fault injections, with runtime overhead ranging from 6.0% to 8.4% (averaging 6.8%)—a 4.9× reduction in protection cost compared to conventional methods.

Abstract

Fully homomorphic encryption (FHE) enables computation on encrypted data, but its long ciphertext dataflow and high-dimensional modular arithmetic make it vulnerable to silent data corruption caused by transient hardware faults. Existing protection methods either target dedicated accelerators or impose substantial execution, modular-arithmetic, and memory-access overheads on CPUs. This work presents an efficient fault-tolerance scheme for CPU-based CKKS computation. It checks the input-output consistency of polynomial operators while reducing protection overhead at three levels. First, modulus-aware bucket checksum exploits wide CPU accumulators to reduce expensive modular reductions. Second, dataflow-fused in-operator checking embeds checksum accumulation into operator dataflows, avoiding separate scans of long ciphertext polynomials. Third, cross-operator check fusion eliminates redundant checksum computations between adjacent operators while preserving end-to-end checking invariants. We implement the scheme in OpenFHE and evaluate it on representative encrypted applications and ciphertext primitives under random single-bit transient faults. It achieves a 100 percent empirical detection rate across 150,000 non-crashing corrupted-result cases and maintains application accuracy close to the fault-free baseline over a wide range of fault rates. The scheme incurs only 6.0 percent to 8.4 percent runtime overhead, averaging 6.8 percent, and reduces average protection overhead by 4.9 times compared with direct checksum-based protection.

Problem

• fault tolerance
• CKKS
• fully homomorphic encryption
• silent data corruption
• transient hardware faults

Innovation

• fault tolerance
• CKKS
• fully homomorphic encryption
• checksum fusion
• CPU-based FHE