Exploitability of circuit noise in approximate multiparty CKKS decryption

Determine whether an adversary can exploit the circuit-dependent noise in approximate multiparty CKKS decryption when the smudging noise does not dominate the ciphertext noise, thereby resolving the security gap in the HE-OFT semi-honest security proof.

Background

HE-OFT’s semi-honest security theorem assumes that the smudging noise added during collective key switching dominates the noise of the ciphertext being switched. The implementation does not satisfy this assumption: the serving circuit produces ciphertext noise several orders of magnitude larger than the implemented smudging noise. Consequently, the simulator used in the proof may not accurately hide information related to the honest clients’ encrypted displacements.

The paper explains that approximate CKKS decryption exposes the message together with an error term dependent on the secret key and the circuit values. Repeated queries may allow an adversary to average away smudging noise and recover information about the secret key. Establishing whether the unsatisfied smudging condition is exploitable is therefore necessary to close the gap between the formal security theorem and the measured configuration.

References

Whether an adversary can exploit that noise is an open question, and the authors of the scheme record it as open as well.

— HE-OFT: Privacy-Preserving One-Shot Federated Fine-Tuning under Homomorphic Encryption  (2610.08255 - Kanpak et al., 6 Oct 2026) in Section IV, subsection “Approximate Decryption and CPA-D Security” (Section IV-C)