---
title: Cheon–Kim–Kim–Song (CKKS) Encryption Scheme
url: https://www.emergentmind.com/topics/cheon-kim-kim-song-ckks
type: topic
---

# Cheon–Kim–Kim–Song (CKKS) Encryption Scheme

Searching arXiv for recent CKKS papers to ground the article.
arXiv Search Query: all:CKKS homomorphic encryption

Cheon–Kim–Kim–Song (CKKS) is an approximate homomorphic encryption scheme used for computation on encrypted real-valued or complex-valued data. In the recent literature, it is consistently treated as the homomorphic substrate for workloads in which approximate arithmetic is acceptable and floating-point-like computation is required, including encrypted neural inference, reinforcement learning updates, biometric similarity scoring, scientific vector and matrix kernels, and numerical aggregation in transportation systems [2507.09860] [2103.11065] [2202.07994] [2306.09189] [2309.07284] [2508.02461]. Across these settings, CKKS is characterized by packed SIMD evaluation, finite multiplicative depth in leveled configurations, and approximate decoding after decryption rather than exact arithmetic semantics [2103.11065].

## 1. Approximate-arithmetic identity

CKKS is repeatedly selected when the target computation is inherently numerical rather than exact-integer. A UAV face-inference system states that it uses CKKS because the scheme “supports encrypted calculation on real (floating-point) numbers, making it suitable to integrate with deep learning models,” and the same work emphasizes approximate arithmetic, SIMD-style batching, and compatibility with polynomialized activations as the main scheme-selection criteria [2507.09860]. In secure reinforcement learning, CKKS is positioned as a middle ground between partially homomorphic encryption, which is too limited for reinforcement-learning updates, and fully homomorphic encryption with bootstrapping, which is more computationally heavy than the intended architecture requires [2103.11065].

This approximate-numerical profile also explains why CKKS appears in speaker verification and scientific computing. Encrypted speaker matching requires matrix-vector products, inner products, and inverse square-root normalization over real-valued embeddings, which the literature treats as a natural fit for CKKS rather than exact schemes [2202.07994]. In scientific computation, CKKS is studied specifically because many workloads operate on floating-point or real-valued vectors and matrices; the reported emphasis is on whether the decrypted outputs remain close enough to plaintext computation to be practically usable [2309.07284].

A common misconception is that CKKS is merely an encrypted transport mechanism. The UAV paper rejects that framing explicitly: CKKS is not used as a generic secure-channel primitive, but as the execution substrate for the neural network itself, so that the edge server evaluates the model directly on ciphertexts and only the key owner decrypts the final result [2507.09860]. Another misconception is that CKKS is an exact floating-point replacement. The literature instead treats it as an approximate HE scheme whose semantics are governed by encoding approximation, encryption noise, arithmetic noise growth, and scale management [2103.11065] [2309.07284].

## 2. Ciphertext model and primitive operations

A concise mathematical summary of CKKS used in encrypted reinforcement learning writes the plaintext space as
\[
\mathcal P=\mathbb Z_{\mathcal Q}[\mathcal X]/(\mathcal X^{\mathcal N}+1),
\]
with \(\mathcal N\) a power of two, and states that CKKS encodes a vector of \(\mathcal N/2\) complex numbers into a plaintext polynomial \(m\in\mathcal P\) [2103.11065]. A V2X-oriented presentation uses the ring
\[
R_q = \mathbb{Z}_q[x]/(x^n+1),
\]
and writes a ciphertext component as
\[
b = -as + m + e \pmod{(x^n+1,q)},
\]
where \(m\) is an encoded approximate plaintext polynomial rather than an exact integer plaintext [2508.02461]. A fault-sensitivity study adopts the complementary operational notation
\[
c = (c_0(X), c_1(X)),
\]
with decryption
\[
m' = [c_0 + c_1 \times s]_Q,
\]
which is then used to explain why corruption in \(c_1(X)\) is more dangerous than corruption in \(c_0(X)\) [2506.07957].

Application papers expose CKKS through standard encryption, decryption, addition, multiplication, plaintext-ciphertext multiplication, and rotation APIs. For example, the UAV system uses
\[
\overline{c} = \mathsf{Enc}(\mathsf{pk}_n, c), \qquad
c = \mathsf{Dec}(\mathsf{sk}_n, \overline{c}),
\]
together with ciphertext addition, plaintext-ciphertext multiplication, and left rotations for packed convolution and linear layers [2507.09860]. The reinforcement-learning paper makes the approximate nature of decryption explicit by modeling
\[
\operatorname{Dec}(c,sk)\equiv m+e \pmod{q_L},
\]
with \(e\) a bounded noise polynomial and \(L\) the remaining multiplicative level [2103.11065].

These descriptions are consistent in one important respect: CKKS supports homomorphic addition and multiplication over packed approximate numbers, but deeper or non-polynomial functionality must be engineered around that core arithmetic. Comparison and maximization are difficult under HE, so secure value iteration decrypts encrypted \(Q\)-values at the client before applying \(\max_a\) [2103.11065]. Division, reciprocal, square root, inverse square root, and non-polynomial activations likewise require approximation or architectural workarounds [2202.07994] [2507.09860].

## 3. Packed SIMD evaluation and linear-algebra structure

The defining systems property of CKKS in these papers is packed SIMD evaluation. In the UAV inference pipeline, CKKS ciphertexts are treated as 1D slot vectors with
\[
B=\frac{R}{2},
\]
where \(B\) is the ciphertext size or batch size and \(R\) is the ring dimension [2507.09860]. The input image is transformed into an HE-oriented im2col representation
\[
I_{(encode)} \in \mathbb{R}^{(k_H \cdot k_W)\times (H_o \cdot W_o)},
\]
then flattened and zero-padded to the slot capacity. The kernel is encoded as a replicated plaintext vector aligned with those slots, so that a single plaintext-ciphertext multiplication computes all local products for all sliding windows in SIMD style [2507.09860].

A broader CNN systems treatment extends this logic to high-resolution data that do not fit in one ciphertext. There, RNS-CKKS ciphertexts encode \(N\) real-valued slots, image channels are packed in row-major order, and tensors that exceed slot capacity are split across multiple ciphertexts called shards [2306.09189]. The work distinguishes image sharding, where full channels fit but the full tensor does not, from channel sharding, where even a single channel exceeds capacity. Convolution is realized through masked rotations and plaintext multiplications; batch normalization is folded into convolution; average pooling is reworked to preserve row-major packing; and polynomial GELU replaces non-polynomial activation functions [2306.09189].

The same packed-arithmetic logic appears in other domains. Speaker verification computes encrypted dot products by elementwise multiplication followed by repeated rotations and additions, with zero-padding when necessary so that vector length is a power of two [2202.07994]. The UAV paper uses the Halevi–Shoup diagonal method for encrypted fully connected layers, while the speaker-verification paper uses diagonal packing of a plaintext scoring matrix \(\mathbf Q\) to implement encrypted-vector/plaintext-matrix multiplication [2507.09860] [2202.07994]. Scientific-computing experiments likewise assume SIMD-style packed vector arithmetic for multidimensional vectors and matrix multiplication, even though they do not provide a detailed slot-layout derivation [2309.07284].

## 4. Levels, scale, parameters, and software ecosystems

CKKS is operationally governed by multiplicative depth, scale, and parameter selection. In a leveled formulation, each ciphertext carries a level \(L\) indicating how many multiplications can be performed before decryption fails; the reinforcement-learning paper identifies this as a key limitation relative to bootstrapped FHE and explicitly avoids bootstrapping by decrypting intermediate results on the client side [2103.11065]. In contrast, deep CNN inference on ImageNet-scale workloads uses bootstrapping to restore ciphertext level, and the reported runtime tables show that bootstrap time is a dominant fraction of total latency [2306.09189].

Scale is equally central. The fault-characterization study treats the scale factor \(\Delta\) as a core CKKS variable and reports that larger values,
\[
\Delta \in \{2^{20},2^{40},2^{50}\},
\]
improve resilience to single-bit coefficient faults [2506.07957]. The V2X paper states that CKKS includes Encode and Decode algorithms that map vectors of floating-point numbers to integer polynomials using a scaling factor \(A\) to preserve some precision accuracy [2508.02461]. In scientific computation, the reported conclusion is that global scale and polynomial modulus degree are the two parameters that matter most for floating-point accuracy, and degree \(8192\) “seems to consistently produce the highest number of matching decimal points” in the reported experiments [2309.07284].

Recent application papers use a range of security and ring-dimension choices rather than a single canonical configuration. The UAV face-detection work experiments with ring dimensions \(8192\), \(16384\), and \(32768\), claims 256-bit security, and notes the trade-off between stronger security and higher computational overhead [2507.09860]. The reinforcement-learning study uses SEAL-generated default 128-bit security parameters, with \(\mathcal N=8192\) or \(16384\) depending on the algorithm [2103.11065]. The V2X study fixes CKKS at ring dimension \(n=16384\) under 128-bit post-quantum security and associates its higher overhead with larger parameters, rescaling, and approximate arithmetic [2508.02461].

Software support is concentrated in a small set of libraries. TenSEAL is used in the UAV system, speaker verification, and scientific-computing experiments [2507.09860] [2202.07994] [2309.07284]. OpenFHE is the implementation basis for high-resolution encrypted CNN inference, the fault-sensitivity study, and the V2X experiments [2306.09189] [2506.07957] [2508.02461]. Microsoft SEAL appears either as the underlying library for TenSEAL-based systems or as the source of default parameter generation in the reinforcement-learning paper [2202.07994] [2103.11065].

## 5. Application domains and scheme-specific reformulations

The literature describes CKKS less as a monolithic cryptographic primitive than as a design space for approximate encrypted numerical computation. The recurring pattern is to reformulate the target algorithm so that it becomes a shallow circuit of additions, multiplications, rotations, and polynomial approximations.

| Domain | Encrypted workload | CKKS-specific reformulation |
|---|---|---|
| UAV edge inference | CNN-based face detection | 2DCol encoding, plaintext kernel replication, Chebyshev activations |
| Reinforcement learning | Value iteration, TD(0), SARSA(0), Z-learning | Client-side decryption of max, shallow multiply-add updates |
| Speaker verification | Normalized similarity score | Newton–Raphson inverse square root, SIMD dot products |
| High-resolution CNNs | ResNet-style image inference | Row-major packing, sharding, Chebyshev-basis GELU |
| Scientific computation | Matrix multiplication, encrypted ML | Packed vector arithmetic, parameter tuning for precision |
| V2X analytics | Encrypted sums and average speed | Addition-only aggregation or add-then-multiply averaging |

In UAV edge computing, CKKS enables end-to-end encrypted inference: face crops are encoded on the UAV, encrypted with the customer’s public key, processed by an untrusted edge AI server, and decrypted only by the customer, with the best encrypted result reported at \(95.139\%\) accuracy versus \(95.602\%\) for the unencrypted baseline on DroneFace [2507.09860]. In reinforcement learning, the cloud computes encrypted Bellman-style arithmetic while the client decrypts intermediate outputs when unsupported operations such as \(\max\) are needed; the paper derives
\[
\limsup_{k\to\infty}\|V^*-\tilde V_k^\pi\|_\infty \le \frac{\epsilon}{1-\gamma}
\]
for synchronous encrypted value iteration under bounded per-iteration CKKS error [2103.11065].

In biometric matching, CKKS is used to redesign the back-end of speaker verification so that the server operates on encrypted feature vectors and returns only an encrypted score. The critical normalization term is implemented by the Newton–Raphson iteration
\[
x_{n+1} = 1.5x_n - 0.5ax_n^3,
\]
which the authors choose specifically because it uses only additions and multiplications and can fit within the available multiplicative depth [2202.07994]. In large-scale encrypted vision, CKKS supports ResNet-50 inference at ImageNet resolution by combining row-major packing, sharding, bootstrapping, and degree-59 Chebyshev-basis GELU evaluation; the paper reports \(80.2\%\) top-1 accuracy on ImageNet-1k at \(256\times256\) resolution [2306.09189].

Scientific-computing and transportation studies emphasize a different aspect of CKKS: numerical utility under encryption rather than elaborate model architectures. Matrix multiplication under CKKS is reported with marginal Euclidean-distance differences and near-zero mean squared error across the tested matrix sizes [2309.07284]. In V2X communication, CKKS is the only evaluated scheme used for homomorphic average-speed computation because BFV and BGV were excluded from that scenario due to their lack of native support for efficient fixed-point multiplication and ciphertext rescaling [2508.02461].

## 6. Limitations, controversies, and open problems

The central limitation of CKKS is that its approximate semantics are both a strength and a source of engineering difficulty. Non-polynomial functions must be approximated: the UAV paper uses Chebyshev approximations for ReLU and SiLU, while square activation is used directly because \(x^2\) is already polynomial [2507.09860]. Speaker verification must approximate inverse square root with Newton–Raphson, and encrypted Z-learning replaces \(\exp(-l_t)\) with a Taylor-series approximation [2202.07994] [2103.11065]. Scientific-computing experiments state that division was infeasible in the implementation context they studied [2309.07284].

Depth and runtime remain major constraints. The UAV paper motivates efficiency through SIMD packing, plaintext-ciphertext multiplication, and edge offloading, but openly states that it does not report latency, throughput, energy consumption, actual edge-hardware runtime, or stage-wise timing for encryption, transmission, inference, and decryption [2507.09860]. By contrast, the high-resolution CNN paper shows that when CKKS is pushed to deep ImageNet-scale inference, bootstrapping dominates runtime and total latency reaches thousands of seconds [2306.09189]. The V2X study identifies a different bottleneck: communication dominates overall cost because CKKS ciphertexts are large, highly fragmented, and pacing-limited in network transport, yielding end-to-end latencies on the order of tens of seconds for encrypted speed aggregation [2508.02461].

Reliability has also emerged as a distinct concern. A recent error-sensitivity study argues that hardware- and software-induced bit faults can evade traditional error detection in CKKS, causing silent data corruption because fault-induced error can be camouflaged by the scheme’s normal approximation and noise budget [2506.07957]. The same study finds that higher-order bit flips are far more damaging than low-order flips, that faults in \(c_1(X)\) are more harmful than faults in \(c_0(X)\), and that RNS and NTT—essential for efficiency—can amplify and spread faults [2506.07957].

Open problems are correspondingly broad. The reinforcement-learning literature calls for rigorous analytical guarantees for encrypted model-free RL and schemes that avoid periodic decryption [2103.11065]. The UAV work calls for deployment on practical edge platforms and stage-wise latency measurement [2507.09860]. Scientific-computing work highlights missing tooling for noise-budget computation in TenSEAL and points to GPU acceleration as a future direction [2309.07284]. V2X experiments suggest hardware acceleration, better scalability, and real-world trials with C-V2X and mobile edge platforms [2508.02461]. Taken together, these studies portray CKKS as a mature-enough approximate HE substrate for substantial encrypted numerical workloads, but not as a solved systems problem.

Source: https://www.emergentmind.com/topics/cheon-kim-kim-song-ckks