The appeal of fully homomorphic encryption in genomics is straightforward to state but difficult to achieve in practice. Differential expression analysis, one of the most common first steps in cancer transcriptomics, compares gene expression levels between groups of samples, such as tumor tissue versus healthy tissue, to identify genes whose activity changes with disease. Because expression profiles are inherently identifying, uploading raw count matrices to a third-party cloud service exposes patients to real risk. FHE promises to dissolve that risk: the cloud server performs the statistical computation on ciphertexts, and only the data owner, holding the secret key, can decrypt the results. The catch is cost. Homomorphic operations are orders of magnitude slower than their plaintext equivalents, and the exact penalty depends heavily on which encryption scheme is chosen and how its parameters are configured.

The study focuses on the two most widely deployed FHE schemes, BFV and CKKS, which take philosophically different approaches to arithmetic on encrypted data. BFV operates on exact integers, making it well suited to the raw integer counts that RNA-seq pipelines produce, but it requires careful quantization when computations produce fractional values. CKKS, by contrast, works natively with approximate real numbers, embedding a scaling factor into each plaintext and accepting a small, controlled amount of noise with every operation. That approximation is usually negligible for statistical work, but it accumulates through a process called rescaling, and the new research shows that this accumulation can become measurable under certain parameter settings. Until now, the field has had little empirical guidance on when each scheme’s weaknesses matter more than its strengths.

To settle the question, the author designed a benchmark of unusual thoroughness for the FHE-genomics intersection. Two cancer RNA-seq datasets served as testbeds: the UCI Gene Expression RNA-Seq dataset, comprising 801 samples spanning five cancer types and yielding ten pairwise class comparisons, and the TCGA lung cancer dataset combining lung squamous cell carcinoma and lung adenocarcinoma, with 1,129 samples and a single pairwise comparison. Experiments swept across polynomial modulus degrees of 4,096, 8,192 and 16,384, the parameter that largely determines both security headroom and computational cost, and across three cohort sizes. Every configuration was run ten independent times under parameters compliant with the 128-bit security standard, the widely accepted benchmark for practical cryptographic deployments, for a total of 300 runs. That repetition matters, because FHE timings can be noisy and single-run benchmarks have historically overstated the reliability of performance claims.

The headline result is a decisive speed advantage for BFV. Across every configuration tested, BFV completed the full encrypt-compute-decrypt cycle in 3.5 to 7.5 times less total latency than CKKS. For teams weighing the practicality of encrypted differential expression analysis, that gap is not a rounding error; it can be the difference between a pipeline that finishes overnight and one that stalls for days. Yet the story does not end there. CKKS fought back on a different axis: at the largest polynomial modulus degree of 16,384, its ciphertexts were approximately 2.66 times smaller per sample than BFV’s. In cloud environments where storage and bandwidth are billed by the gigabyte, and where genomic cohorts can involve tens of thousands of samples, that storage advantage translates directly into cost savings and faster data transfer. The study’s central conclusion is that neither scheme is universally dominant; the right choice depends on whether a deployment is latency-bound or storage-bound.

Perhaps the most surprising finding concerns what actually drives computational cost. Intuition suggests that processing more samples should take proportionally longer, but the benchmark showed that execution time scaled primarily with the number of pairwise class comparisons rather than with sample count. In the UCI dataset, with its ten pairwise comparisons, the encrypted computation was far heavier than in the TCGA comparison, despite the latter containing more samples. This is a genuinely counterintuitive result that had received little attention in prior FHE benchmarking studies, and it carries immediate practical implications: analysts designing privacy-preserving pipelines for multi-class cancer studies should budget their computation around the number of group contrasts, not the size of the cohort, and should consider consolidating comparisons wherever the science allows.

Accuracy, the other half of the tradeoff equation, behaved in scheme-specific ways that the author traced to the underlying mathematics. CKKS’s approximation error grew worse at higher polynomial modulus degrees, a consequence of scale-induced rescaling noise accumulating through the computation. BFV, working with exact integers, showed the opposite and rather elegant behavior: its quantization noise decreased as cohort size increased, because averaging over more samples smooths out the rounding error introduced when fractional statistics are mapped onto the integer plaintext space. These opposing error dynamics mean that the accuracy picture changes with both the scheme and the scale of the study, and pipeline designers cannot simply assume that bigger parameters yield better results.

Crucially, however, the study delivers a reassuring bottom line for biomedical validity. Across all 300 runs and every configuration tested, both BFV and CKKS preserved the ranking of differentially expressed genes with a Spearman rank correlation above 0.999 relative to the plaintext baseline. In other words, even where numerical errors crept in, the biological conclusions, which genes rise to the top of the differential expression list, remained essentially identical to what an unencrypted analysis would produce. For clinical and research applications, that ranking fidelity is arguably the metric that matters most, and the result suggests that FHE-based privacy protection need not come at the price of scientific correctness.

Beyond the specific numbers, the study establishes a reproducible benchmarking framework that other researchers can extend to additional schemes, datasets, and statistical tasks. The author acknowledges Dr. Sudhakar Theerthagiri of Anna University’s MIT Campus for guidance on cryptography and methodological decisions, and the work received no external funding. Published open access on 15 September 2026, the paper arrives at a moment when privacy regulation and cloud genomics are colliding with growing force. As sequencing costs continue to fall and multi-institutional cancer studies become the norm, the demand for computation on encrypted genomes will only intensify. This benchmark gives the field its clearest map yet of the terrain: BFV for speed, CKKS for storage, class comparisons as the true computational driver, and gene rankings that survive encryption essentially intact. For a discipline wrestling with how to share its most sensitive data without giving it away, that map is a valuable piece of infrastructure in its own right.

Subject of Research: Privacy-preserving differential expression analysis of cancer RNA-seq data using fully homomorphic encryption

Article Title: Privacy-preserving differential expression analysis via fully homomorphic encryption: a systematic tradeoff evaluation of BFV and CKKS on cancer RNA-seq datasets

Article References: Shankar, D. (2026). Privacy-preserving differential expression analysis via fully homomorphic encryption: a systematic tradeoff evaluation of BFV and CKKS on cancer RNA-seq datasets. BMC Bioinformatics. https://doi.org/10.1186/s12859-026-06609-7

Image Credits: AI Generated

DOI: 10.1186/s12859-026-06609-7

Keywords: fully homomorphic encryption, BFV, CKKS, differential expression analysis, RNA-seq, cancer genomics, data privacy, transcriptomics, cloud computing, TCGA, genomic pipelines, cryptography

The core insight behind the Vietnamese team’s design is that federated learning’s privacy guarantees are thinner than they first appear. During each round of training, participating devices compute gradient updates, or weight changes, on their local data and send them to a coordinating server for aggregation. Research on gradient inversion attacks has demonstrated that a sufficiently determined adversary who intercepts these updates can reconstruct recognizable images and text from them, effectively reversing the learning process to expose the very data the scheme was meant to protect. Beyond eavesdropping, federated systems are also vulnerable to poisoning attacks, in which malicious clients submit corrupted updates to degrade the shared model, and to attacks on the aggregation server itself, which represents a single point of failure and a tempting target for anyone seeking to manipulate the final model.

Homomorphic encryption addresses the eavesdropping problem with a mathematical trick that sounds almost paradoxical: it allows arithmetic to be performed directly on encrypted values. In a conventional encrypted system, data must be decrypted before anything useful can be done with it, which means the party doing the computation inevitably sees the plaintext. Homomorphic schemes, by contrast, operate on ciphertexts, producing encrypted results that, when finally decrypted by the key holder, match the outcome of the same operations performed on the underlying data. For federated learning this is a natural fit, because model aggregation is essentially weighted arithmetic, adding and averaging the numerical updates contributed by many clients. If each client encrypts its update before transmission, the server can combine them into a new global model without ever seeing a single plaintext gradient.

Not all homomorphic encryption is created equal, and the choice of scheme has enormous consequences for performance. The researchers evaluated their system under three experimental conditions: no encryption at all, Paillier encryption, and Cheon-Kim-Kim-Song, or CKKS, encryption. Paillier is a classical partially homomorphic scheme that supports additive operations on integers, which is sufficient for averaging model weights but imposes significant computational overhead on the large tensors that modern neural networks use. CKKS, introduced in 2017, takes a different approach, performing approximate arithmetic on real and complex numbers, which aligns far more naturally with the floating-point values that flow through a deep neural network. That alignment lets CKKS pack many values into a single ciphertext and process them in parallel, dramatically reducing the computational burden relative to schemes designed for exact integer arithmetic.

To measure how much this matters in practice, the team built their experiments around a convolutional neural network, the workhorse architecture for image and signal classification, and tested the system on three benchmark datasets chosen to span very different security scenarios. MNIST, the classic dataset of handwritten digits, and CIFAR-10, a more demanding collection of small natural images, represent standard machine learning workloads. The third dataset, CICMalDroid2020, is a collection of Android malware samples, which grounds the evaluation in a domain where privacy and security are not abstract concerns but operational requirements: hospitals, banks, and security vendors cannot share malware samples or user data freely, yet they would all benefit from a jointly trained detection model.

The headline security result is striking. Under adversarial attack, the system running without encryption suffered an attack success rate of 83.67 percent, meaning the vast majority of attempted intrusions into the training process succeeded. With CKKS encryption in place, that figure collapsed to 55.63 percent, a reduction of nearly thirty percentage points. The encryption does not make attacks impossible, but it strips attackers of the readable gradients and model parameters they rely on, forcing them to operate blind against ciphertexts whose contents reveal nothing about the data or the model state. Meanwhile, the efficiency numbers suggest the security does not come at an unacceptable price: training efficiency remained above 90 percent across all three datasets in the CKKS-based configuration, indicating that the cryptographic overhead, while real, leaves the bulk of the system’s training throughput intact.

Encryption alone, however, would leave federated learning exposed on a different front: trust in the infrastructure that stores and manages models. This is where the blockchain component of uitPriPreFL enters. A blockchain is a distributed, append-only ledger in which records are bundled into cryptographically linked blocks and validated by consensus among participants, making it computationally infeasible for any single party to silently alter history. In the proposed system, the blockchain serves as the storage and management backbone for model information, creating an auditable record of model versions and updates. Any participant can verify that the global model they are downloading corresponds to a legitimate aggregation of encrypted client contributions, and no central operator can quietly substitute a manipulated model or erase a previous version. The combination is synergistic: homomorphic encryption protects the content of the models, while the blockchain protects their provenance and integrity.

The broader context makes this work part of a fast-moving research wave. Recent years have seen a flurry of systems combining cryptography with decentralized ledgers to harden collaborative machine learning, from blockchain-based auditable federated learning frameworks with incentive mechanisms, to multi-key homomorphic encryption schemes that prevent even the aggregation server from decrypting individual updates, to adaptive segmented CKKS approaches designed to squeeze more efficiency out of approximate homomorphic arithmetic. Surveys of client-server attacks and defenses in federated learning document a threat landscape that includes gradient inversion, membership inference, model poisoning, and Byzantine failures, and the field has increasingly converged on the view that no single defense suffices. Layered architectures, combining encryption for confidentiality, consensus mechanisms for integrity, and aggregation rules for robustness, are emerging as the practical answer.

The Vietnamese team’s contribution to that conversation is a complete, working system rather than a theoretical proposal, and they have released the source code publicly on GitHub, allowing other researchers to reproduce their experiments, probe the implementation for weaknesses, and build on the architecture. Open availability matters in this subfield because security claims are notoriously difficult to verify from papers alone, and adversarial evaluations frequently find gaps between a system’s promised and actual robustness. By publishing code alongside benchmarks spanning handwriting recognition, natural images, and malware detection, the authors have made it possible for the community to test whether the reported attack-resistance and efficiency numbers hold up under independent scrutiny.

The implications reach well beyond the laboratory. Federated learning is already deployed in keyboard prediction on smartphones, in healthcare consortia that train diagnostic models across hospitals, and in financial fraud detection networks where data-sharing agreements make centralization impossible. Every one of those deployments inherits the vulnerabilities that gradient inversion and poisoning research have exposed, and every one of them stands to benefit from encryption that lets a server aggregate without seeing and ledgers that make model history verifiable. The uitPriPreFL results, showing a drop in attack success from nearly 84 percent to under 56 percent while keeping training efficiency above 90 percent, offer a concrete data point that strong cryptographic privacy and practical machine learning performance can coexist. As approximate homomorphic encryption schemes like CKKS continue to mature and hardware acceleration improves, the tax that privacy pays on training speed is likely to shrink further, bringing fully private, auditable, collaborative AI closer to everyday infrastructure.

Subject of Research: Privacy-preserving federated learning using homomorphic encryption and blockchain

Article Title: uitPriPreFL: privacy-preserving federated learning system using homomorphic encryption and blockchain

Article References: Cam, N. T., Anh, H. H., & Long, T. K. (2026). uitPriPreFL: privacy-preserving federated learning system using homomorphic encryption and blockchain. Cluster Computing, 29(13), Article 781. https://doi.org/10.1007/s10586-026-06603-x

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06603-x

Keywords: federated learning, homomorphic encryption, blockchain, CKKS, Paillier, data privacy, machine learning security, gradient inversion, deep learning, model aggregation, cryptography, malware detection