The stakes are enormous. Fully homomorphic encryption enables end-to-end encrypted data processing in untrusted environments, meaning a hospital could outsource genome analysis or a bank could delegate fraud detection to a cloud provider without exposing any sensitive records. Schemes such as BGV, BFV, GSW, CKKS, and TFHE have matured steadily over the past decade, and libraries like HElib, SEAL, HEAAN, Lattigo, OpenFHE, and PALISADE now implement their underlying arithmetic. But even with these libraries, the survey reports, encrypted computations on CPUs run four to five orders of magnitude slower than their plaintext equivalents. Well-optimized programs can be hundreds of times faster than naive ones, which makes efficient programming not a nicety but a necessity.

The difficulty begins with the extremely restricted set of primitive operations. Homomorphic programs can only perform vector element-wise addition, element-wise multiplication, and rotation shifts over long ciphertext vectors containing thousands to tens of thousands of slots. Operations that are trivial on a CPU, such as accessing a single array element or shuffling a vector, can require dozens or even hundreds of rotations and consume precious computational budget. Sophisticated tricks, like the single-input single-output convolution scheme that needs only kernel-squared rotations instead of a naive avalanche of masks and shifts, can improve efficiency by orders of magnitude, but designing such non-intuitive implementations demands years of cryptographic and numerical expertise.

A second layer of complexity comes from ciphertext maintenance. In the CKKS scheme, which the survey focuses on because of its dominance in machine learning workloads, every multiplication roughly squares a ciphertext’s scaling factor, and Rescale operations must be strategically inserted to keep scales and noise from growing exponentially. Binary operations also impose strict constraints: their operands must sit at the same level and, for additions, share the same scaling factor. Even seemingly obvious strategies backfire. The survey’s authors walk through a simple computation of x squared plus x to show that the always-rescale approach wastes a level, and a ResNet-style example demonstrates that naively bootstrapping ciphertexts the moment they run out of levels can nullify most of bootstrapping’s benefit, an operation that alone can consume over 80 percent of total runtime in deep inference workloads.

Parameter selection forms a third minefield. The polynomial degree N, the initial level budget L, and the small-prime bit width B interact in complicated ways that determine correctness, security, and speed simultaneously. The approximate nature of CKKS makes this worse: unlike exact schemes such as BFV and BGV, CKKS decryption always carries error, and bootstrapping merely restores multiplication capacity without cleaning the noise. The survey cites a striking case where a ResNet-20 inference program achieves 89.53 percent accuracy with a prime width of 33 bits but collapses to 10.87 percent, essentially random guessing, when that width drops to 31 bits.

Fully homomorphic encryption compilers attack these problems by translating ordinary programs, whether tensor code resembling PyTorch or plain scalar programs with loops, into optimized ciphertext programs. The survey describes a typical workflow: parse the input into an internal graph representation, optionally rewrite primitive operations, insert scale management and bootstrapping operations, choose evaluation keys and cryptographic parameters, and finally emit source code targeting a backend library or a standalone executable. Crucially, these compilers are device-agnostic, introducing minimal overhead compared with dedicated hardware accelerators, and they often generate code that outperforms expert hand-tuned implementations.

The heart of the survey is a systematic dissection of scale-management techniques. EVA, the first compiler to prioritize this problem, introduced watermark-based rescaling and eager level matching, delivering a 2.3-times average speedup over earlier approaches. Hecate extended that framework with a new Downscale operation and a search procedure driven by a cost model, gaining a further 27.85 percent on average but at the price of compilation times that can stretch to hundreds of seconds. ELASM added a scale-to-noise-ratio concept with noise-aware waterlines, letting users trade accuracy against latency, cutting output error by tens to hundreds of times at equal latency. The newest entrant, Reserve, replaces search with a backward static analysis that nearly matches Hecate’s performance while compiling in seconds rather than minutes.

Bootstrapping insertion has undergone a parallel revolution. DaCapo uses liveness analysis, bypass edge detection, and dynamic programming to find cost-minimizing insertion points, achieving a 1.21-times speedup over manual implementations on networks up to ResNet-40 and MobileNet. Fhelipe streamlines the same idea with depth boundaries and shortcut edges, and additionally supports hundreds of tensor data layouts, producing an 18.5-times speedup over the earlier layout compiler CHET. HALO specializes in dynamic loops whose trip counts depend on encrypted values, packing loop-carried variables into a single bootstrapped ciphertext and reducing code size by up to 11 times compared with DaCapo. Orion, tailored to private neural inference, models bootstrapping placement as a shortest-path problem on a level digraph, reducing ResNet-20 compilation to under two seconds, an 8.14-times speedup over DaCapo, and trimming inserted bootstraps by 36.2 percent relative to Fhelipe.

For general scalar programs, the survey contrasts synthesis-based and heuristic-based vectorization. Porcupine uses counter-example-guided program synthesis to discover optimal homomorphic kernels, matching or beating expert code with up to 52 percent improvements, but it can only handle roughly a dozen instructions and needed over 609 seconds for a small image filter. Coyote, building on superword-level parallelism, shows why naive vectorization fails when rotations are expensive, yet its own gains remain modest at 0.74 times expert performance. HECO, by contrast, applies a heuristic batching pipeline that transforms imperative code into efficient vectorized form in under a second, delivering three to four orders of magnitude improvement over naive element-by-element translation while scaling to large programs.

The survey closes with a candid assessment of what remains broken. Most compilers still target only the SEAL library, which lacks bootstrapping support and therefore caps program depth; documentation and user experience lag far behind mainstream compiler infrastructure; and parameter selection often relies on crude fixed defaults rather than precise cost models. The authors call for compilers that integrate state-of-the-art homomorphic algorithms, support general-purpose control flow, span multiple schemes from CKKS to TFHE, and even compile across schemes within a single application, an area where only the HEIR project has made an early start. Their conclusion is unambiguous: just as compilers absorbed the manual optimizations of early CPU programming, fully homomorphic encryption compilers are poised to become the primary gateway through which ordinary programmers, not cryptographers, will unlock computation on encrypted data.

Subject of Research: Compilers for fully homomorphic encryption, the tools that automatically convert ordinary programs into optimized code for computing on encrypted data.

Article Title: A survey on fully homomorphic encryption compilers

Article References: Tian, Z., Fan, S., Deng, X., Hou, R., Meng, D., & Zhang, M. (2026). A survey on fully homomorphic encryption compilers. Cybersecurity, 9(1), Article 218. https://doi.org/10.1186/s42400-026-00641-z

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00641-z

Keywords: fully homomorphic encryption, compilers, CKKS scheme, cryptography, cloud computing privacy, bootstrapping, scale management, SIMD vectorization, machine learning, program synthesis, parameter selection, data privacy

Researchers led by Mahbuba Ferdowsi, Ban-Hoe Kwan, Maw Pin Tan and Choon-Hian Goh, working across Universiti Tunku Abdul Rahman in Malaysia, the University of New South Wales in Australia, Universiti Malaya and Sunway University, have built a machine learning pipeline that trains on sensitive physiological data using differential privacy, produces explanations clinicians can inspect, and even runs its predictions on encrypted data. The work, published in BioMedical Engineering OnLine, analysed records from 137 participants who underwent head-up tilt testing, of whom 54 were classified as vasovagal syncope positive and 83 as negative. From electrocardiogram and blood pressure signals recorded during the tilt protocol, the team extracted 54 features capturing the haemodynamic and autonomic signatures of each patient’s response.

The privacy guarantee at the heart of the training process comes from differentially private stochastic gradient descent, or DP-SGD. In conventional training, a neural model’s gradients are computed from each patient example and used to update the model weights, which creates a risk that memorised details of individual patients could be extracted from the finished model. DP-SGD interrupts this leakage path in two ways. First, it clips the gradient computed from every individual example so that no single patient can exert an outsized influence on the weights. Second, it injects calibrated Gaussian noise into the clipped gradients before they are aggregated, obscuring the contribution of any one record. The strength of this protection is formally quantified by a privacy budget, expressed as epsilon and delta. In this study, the model was trained under a privacy budget of approximately epsilon equal to 16.5 with delta set to 10 to the power of minus 5, a setting that provides a mathematically provable bound on how much any single participant’s information can leak into the model or its outputs.

Crucially, this formal privacy came at a surprisingly modest cost in accuracy. The DP-SGD trained logistic regression model, combined with a feature importance selection step that retained the most informative variables, achieved a cross-validated accuracy of 0.833 plus or minus 0.035 and an area under the receiver operating characteristic curve of 0.888 plus or minus 0.019. The evaluation used a stratified five-fold cross-validation framework in which all pre-processing steps were performed strictly within each training fold, a design choice that prevents subtle data leakage from inflating performance estimates. For comparison, the researchers also trained baseline models including a standard logistic regression, random forest classifiers and artificial neural networks, providing a benchmark for how much predictive power was preserved once the privacy machinery was switched on.

The second, more ambitious layer of the pipeline attempted to hide patient data even at the moment of prediction, using fully homomorphic encryption. This cryptographic technique allows computation directly on encrypted values, meaning a hospital could send an encrypted feature vector to an untrusted server and receive an encrypted diagnosis without the server ever seeing the underlying physiological measurements. The team implemented the Cheon-Kim-Kim-Song scheme, often abbreviated CKKS, using the TenSEAL library, which is designed for arithmetic on approximate real numbers and is well suited to encrypting continuous biomedical features. Because homomorphic encryption supports only addition and multiplication, non-linear activation functions must be approximated by polynomials, and the researchers used a degree-3 polynomial approximation of the sigmoid function to perform encrypted classification.

Here the study delivered an honest and instructive negative result. While the differentially private model performed well, inference carried out entirely under encryption degraded sharply, with the area under the curve falling to roughly 0.53, barely better than a coin flip. The culprit was approximation error: the polynomial surrogate for the sigmoid, combined with the noise inherent in CKKS arithmetic, distorted the decision boundary enough to destroy much of the model’s discriminative power. The authors are careful to frame this as a feasibility assessment rather than a failure, noting that the encrypted pipeline was applied only at the prediction stage and that optimised homomorphic architectures are a clear direction for future work. The finding matters for the field because it quantifies, in a real clinical setting, the gap between privacy-preserving training and fully secure inference, showing that the former is nearly free in utility terms while the latter remains a genuine engineering challenge.

Interpretability, the third pillar of the framework, was assessed with two widely used explanation techniques, LIME and SHAP, which attribute a model’s predictions back to individual input features. Both methods converged on the same picture of what the model had learned. Tilt-phase haemodynamic measurements, specifically systolic and diastolic blood pressure recorded during the tilt (SBP_T and DBP_T), together with autonomic balance indices derived from heart rate variability and blood pressure variability in the low-frequency to high-frequency bands (LFHF_RRI_T and LFHF_SBP_T), emerged as the key predictors of a positive vasovagal syncope diagnosis. This alignment is clinically reassuring, because these features correspond to the physiological mechanisms physicians already associate with tilt-induced fainting: an exaggerated drop in vascular tone and a shift in autonomic control when the body is tilted upright.

The study’s authors are explicit about the limits of what their results demonstrate. All reported performance figures are internal, cross-validated estimates derived from a single-centre dataset of 137 participants, and the team cautions that they should not be read as evidence of generalizable clinical performance. The relatively modest sample size also meant that subgroup analyses were omitted, a decision consistent with the data minimisation principle that underpins the privacy framework itself. External validation on multi-centre cohorts, and independent confirmation that the identified haemodynamic and autonomic features hold across different populations and tilt-test protocols, remain essential next steps before any deployment in a clinical environment.

Even so, the work arrives at a moment when healthcare systems worldwide are wrestling with how to exploit the predictive power of machine learning without breaching patient trust or privacy law. Differential privacy, homomorphic encryption and explainable AI are usually studied in isolation; this study is notable for assembling all three around a concrete diagnostic problem and reporting exactly where each succeeds and where each breaks down. The demonstration that a formally private model can match conventional baselines with minimal utility loss offers a template for other biomedical prediction tasks, from arrhythmia detection to sepsis early warning, where training data are scarce, sensitive and ethically charged.

The research was funded by the UTAR Research Fund from Universiti Tunku Abdul Rahman and received ethics approval from both the UTAR Scientific and Ethical Review Committee and the UMMC Medical Research Ethics Committee, with written informed consent obtained from all participants. As hospitals move toward federated learning and cloud-based clinical AI, studies of this kind provide the empirical grounding needed to decide which privacy technologies are ready for the clinic today and which still require the next generation of cryptographic engineering. For patients whose fainting spells have defied easy diagnosis, the promise is an AI assistant that reads their tilt test accurately, explains its reasoning, and never exposes their data in the process.

Subject of Research: Privacy-preserving and explainable machine learning for vasovagal syncope detection from head-up tilt test signals

Article Title: Differentially private and explainable machine learning for vasovagal syncope detection: a feasibility study of homomorphic encryption for secure inference

Article References: Ferdowsi, M., Kwan, B.-H., Tan, M. P., & Goh, C.-H. (2026). Differentially private and explainable machine learning for vasovagal syncope detection: a feasibility study of homomorphic encryption for secure inference. BioMedical Engineering OnLine. https://doi.org/10.1186/s12938-026-01626-2

Image Credits: AI Generated

DOI: 10.1186/s12938-026-01626-2

Keywords: vasovagal syncope, head-up tilt test, differential privacy, DP-SGD, homomorphic encryption, CKKS scheme, explainable AI, LIME, SHAP, secure inference, biomedical engineering, electrocardiogram