New survey maps how compilers make encrypted computing usable

Fully homomorphic encryption has long been billed as the holy grail of data privacy: a cryptographic technique that lets a cloud server compute on encrypted data without ever seeing a single plaintext value. Yet for all its promise, actually writing a homomorphic encryption program has remained a punishingly specialized art. A new open-access survey in the journal Cybersecurity, led by Zhuoyu Tian of the Institute of Information Engineering at the Chinese Academy of Sciences together with colleagues from the University of Chinese Academy of Sciences and Ant Research, offers the most detailed map yet of the software tools, known as fully homomorphic encryption compilers, that are trying to change that.

The stakes are enormous. Fully homomorphic encryption enables end-to-end encrypted data processing in untrusted environments, meaning a hospital could outsource genome analysis or a bank could delegate fraud detection to a cloud provider without exposing any sensitive records. Schemes such as BGV, BFV, GSW, CKKS, and TFHE have matured steadily over the past decade, and libraries like HElib, SEAL, HEAAN, Lattigo, OpenFHE, and PALISADE now implement their underlying arithmetic. But even with these libraries, the survey reports, encrypted computations on CPUs run four to five orders of magnitude slower than their plaintext equivalents. Well-optimized programs can be hundreds of times faster than naive ones, which makes efficient programming not a nicety but a necessity.

The difficulty begins with the extremely restricted set of primitive operations. Homomorphic programs can only perform vector element-wise addition, element-wise multiplication, and rotation shifts over long ciphertext vectors containing thousands to tens of thousands of slots. Operations that are trivial on a CPU, such as accessing a single array element or shuffling a vector, can require dozens or even hundreds of rotations and consume precious computational budget. Sophisticated tricks, like the single-input single-output convolution scheme that needs only kernel-squared rotations instead of a naive avalanche of masks and shifts, can improve efficiency by orders of magnitude, but designing such non-intuitive implementations demands years of cryptographic and numerical expertise.

A second layer of complexity comes from ciphertext maintenance. In the CKKS scheme, which the survey focuses on because of its dominance in machine learning workloads, every multiplication roughly squares a ciphertext’s scaling factor, and Rescale operations must be strategically inserted to keep scales and noise from growing exponentially. Binary operations also impose strict constraints: their operands must sit at the same level and, for additions, share the same scaling factor. Even seemingly obvious strategies backfire. The survey’s authors walk through a simple computation of x squared plus x to show that the always-rescale approach wastes a level, and a ResNet-style example demonstrates that naively bootstrapping ciphertexts the moment they run out of levels can nullify most of bootstrapping’s benefit, an operation that alone can consume over 80 percent of total runtime in deep inference workloads.

Parameter selection forms a third minefield. The polynomial degree N, the initial level budget L, and the small-prime bit width B interact in complicated ways that determine correctness, security, and speed simultaneously. The approximate nature of CKKS makes this worse: unlike exact schemes such as BFV and BGV, CKKS decryption always carries error, and bootstrapping merely restores multiplication capacity without cleaning the noise. The survey cites a striking case where a ResNet-20 inference program achieves 89.53 percent accuracy with a prime width of 33 bits but collapses to 10.87 percent, essentially random guessing, when that width drops to 31 bits.

Fully homomorphic encryption compilers attack these problems by translating ordinary programs, whether tensor code resembling PyTorch or plain scalar programs with loops, into optimized ciphertext programs. The survey describes a typical workflow: parse the input into an internal graph representation, optionally rewrite primitive operations, insert scale management and bootstrapping operations, choose evaluation keys and cryptographic parameters, and finally emit source code targeting a backend library or a standalone executable. Crucially, these compilers are device-agnostic, introducing minimal overhead compared with dedicated hardware accelerators, and they often generate code that outperforms expert hand-tuned implementations.

The heart of the survey is a systematic dissection of scale-management techniques. EVA, the first compiler to prioritize this problem, introduced watermark-based rescaling and eager level matching, delivering a 2.3-times average speedup over earlier approaches. Hecate extended that framework with a new Downscale operation and a search procedure driven by a cost model, gaining a further 27.85 percent on average but at the price of compilation times that can stretch to hundreds of seconds. ELASM added a scale-to-noise-ratio concept with noise-aware waterlines, letting users trade accuracy against latency, cutting output error by tens to hundreds of times at equal latency. The newest entrant, Reserve, replaces search with a backward static analysis that nearly matches Hecate’s performance while compiling in seconds rather than minutes.

Bootstrapping insertion has undergone a parallel revolution. DaCapo uses liveness analysis, bypass edge detection, and dynamic programming to find cost-minimizing insertion points, achieving a 1.21-times speedup over manual implementations on networks up to ResNet-40 and MobileNet. Fhelipe streamlines the same idea with depth boundaries and shortcut edges, and additionally supports hundreds of tensor data layouts, producing an 18.5-times speedup over the earlier layout compiler CHET. HALO specializes in dynamic loops whose trip counts depend on encrypted values, packing loop-carried variables into a single bootstrapped ciphertext and reducing code size by up to 11 times compared with DaCapo. Orion, tailored to private neural inference, models bootstrapping placement as a shortest-path problem on a level digraph, reducing ResNet-20 compilation to under two seconds, an 8.14-times speedup over DaCapo, and trimming inserted bootstraps by 36.2 percent relative to Fhelipe.

For general scalar programs, the survey contrasts synthesis-based and heuristic-based vectorization. Porcupine uses counter-example-guided program synthesis to discover optimal homomorphic kernels, matching or beating expert code with up to 52 percent improvements, but it can only handle roughly a dozen instructions and needed over 609 seconds for a small image filter. Coyote, building on superword-level parallelism, shows why naive vectorization fails when rotations are expensive, yet its own gains remain modest at 0.74 times expert performance. HECO, by contrast, applies a heuristic batching pipeline that transforms imperative code into efficient vectorized form in under a second, delivering three to four orders of magnitude improvement over naive element-by-element translation while scaling to large programs.

The survey closes with a candid assessment of what remains broken. Most compilers still target only the SEAL library, which lacks bootstrapping support and therefore caps program depth; documentation and user experience lag far behind mainstream compiler infrastructure; and parameter selection often relies on crude fixed defaults rather than precise cost models. The authors call for compilers that integrate state-of-the-art homomorphic algorithms, support general-purpose control flow, span multiple schemes from CKKS to TFHE, and even compile across schemes within a single application, an area where only the HEIR project has made an early start. Their conclusion is unambiguous: just as compilers absorbed the manual optimizations of early CPU programming, fully homomorphic encryption compilers are poised to become the primary gateway through which ordinary programmers, not cryptographers, will unlock computation on encrypted data.

Subject of Research: Compilers for fully homomorphic encryption, the tools that automatically convert ordinary programs into optimized code for computing on encrypted data.

Article Title: A survey on fully homomorphic encryption compilers

Article References: Tian, Z., Fan, S., Deng, X., Hou, R., Meng, D., & Zhang, M. (2026). A survey on fully homomorphic encryption compilers. Cybersecurity, 9(1), Article 218. https://doi.org/10.1186/s42400-026-00641-z

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00641-z

Keywords: fully homomorphic encryption, compilers, CKKS scheme, cryptography, cloud computing privacy, bootstrapping, scale management, SIMD vectorization, machine learning, program synthesis, parameter selection, data privacy