Functional Encryption (FE)

• Functional Encryption is a public-key framework that decrypts only a prescribed function output rather than the entire plaintext.
• It supports fine-grained access control and specialized functionalities, such as inner-product and quadratic evaluations, for secure computations.
• Advanced FE variants enhance capabilities with features like revocation, traceability, key leasing, and applications in privacy-preserving machine learning and federated learning.

Functional Encryption (FE) is a public-key encryption framework in which secret keys are tied to functions, and decryption of a ciphertext of message $x$ under a key for $f$ reveals $f(x)$ rather than the entire plaintext. In this sense, FE expands traditional public-key encryption in two different ways: it supports fine-grained access control and allows learning a function of encrypted data. The framework subsumes predicate-oriented systems such as IBE and ABE, supports richer functionalities such as inner products and quadratic forms, and has been extended to multi-client, revocable, traceable, noisy, quantum, and verifiable settings (Mascia et al., 2021).

1. Formal model and semantic scope

The standard FE syntax is given by four algorithms: $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$ with correctness requiring $y=F(k,x)$ for the underlying functionality $F:K\times X\to Y$. An equivalent presentation uses a function family $\mathcal{F}=\{f_k\mid k\in K\}$, so that $KeyGen$ produces a function-specific key and decryption returns $f_k(x)$. The survey literature also emphasizes the role of a special empty key $\epsilon$, used to formalize intentional leakage such as message length (Mascia et al., 2021).

This syntax supports both public-key and private-key variants. In public-key FE, anyone can encrypt under public parameters; in private-key FE, encryption is restricted to the master-key holder. Several later constructions specialize the syntax further. Inner-product FE ties a ciphertext to a vector $f$0 and a key to a vector $f$1, with decryption revealing $f$2. Quadratic FE replaces the linear form with a quadratic family $f$3 over bounded domains and pairing-based evaluation (Ryffel et al., 2019).

A recurring conceptual distinction places FE between conventional public-key encryption and fully homomorphic encryption. Unlike ordinary encryption, FE does not force all-or-nothing revelation of the plaintext. Unlike FHE, it does not aim at arbitrary computation followed by decryption of a generic ciphertext output; instead, it authorizes only a prescribed output, returned in plaintext to the holder of an appropriate functional key (Panzade et al., 2022).

2. Functional classes and expressiveness

A central organizing principle is the progression from predicate encryption to true function-evaluation systems. In predicate encryption, decryption still behaves as a gate on a payload: if a predicate $f$4 is satisfied, the decryptor learns the entire message $f$5; otherwise it learns $f$6. Public-index predicate encryption includes IBE, HIBE, and ABE. Private-index predicate encryption strengthens privacy by hiding the attribute or index itself and includes anonymous IBE, Hidden Vector Encryption, and inner-product predicate encryption (Mascia et al., 2021).

The transition beyond predicates begins with inner-product encryption. In this setting, the output is the actual arithmetic quantity

$f$7

not merely a yes-or-no authorization result. The survey identifies applications including Hamming distance, biometric identification, support vector machine evaluation, statistical analysis, and variance or quadratic-polynomial computation. Orthogonality FE narrows the output again to a single bit indicating whether $f$8, thereby leaking strictly less than full inner-product FE (Mascia et al., 2021).

Quadratic FE generalizes this line by authorizing bilinear or degree-2 computations. One pairing-based construction defines a family

$f$9

with decryption returning $f(x)$0 and security proved in the Generic Bilinear Group Model. This form has been used to implement semi-encrypted polynomial neural networks in which an encrypted front-end computes a quadratic representation and later layers run in the clear (Ryffel et al., 2019).

More recent work broadens the notion of functionality itself. Multi-client FE for set intersection with non-monotonic access structures allows independently encrypted client-side sets $f(x)$1 to be combined so that the aggregator recovers $f(x)$2 only when an access policy involving AND, OR, NOT, and threshold-like structure is satisfied. In that construction, labels are attached to ciphertexts to resist mix-and-match attacks, and the function key is indexed to a specified client pair $f(x)$3 (Zhang et al., 2024). This marks a shift from numeric function release to access-controlled relational functionality.

3. Security notions, simulation barriers, and bounded-storage exceptions

The dominant security notions are indistinguishability-based security and simulation-based security. In the IND formulation, the adversary may query keys only for functions satisfying $f(x)$4 on the chosen challenge messages, and then must distinguish an encryption of $f(x)$5 from one of $f(x)$6. In the SIM formulation, a simulator given only the allowed function outputs must reproduce the adversary’s view. The survey literature treats SIM security as stronger and notes that SIM implies IND (Mascia et al., 2021).

Function privacy is orthogonal to message privacy. It asks whether the function embedded in a secret key can itself remain hidden. This is important in settings where the function description is sensitive, and it motivates function-hiding inner-product systems and private-key transformations. At the same time, the literature is explicit that strong function privacy is generally delicate, especially in public-key settings where an evaluator may probe function keys on chosen ciphertexts (Mascia et al., 2021).

Recent impossibility results sharpen these boundaries in the quantum setting. For quantum functional encryption, simulation security remains unattainable in several natural regimes. In particular, there is no $f(x)$7 SIM-secure QFE scheme unconditionally; under pseudorandom quantum states there is no succinct $f(x)$8 SIM-secure QFE; and assuming classical public-key encryption there is no $f(x)$9 SIM-secure QFE. These results extend classical barriers rather than circumvent them (Barhoush et al., 24 Jan 2026).

Bounded-storage models constitute a notable exception. In the bounded quantum storage model, non-interactive FE satisfying information-theoretic simulation-based security is achievable with $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$0, and the same work proves the corresponding optimality barrier for smaller $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$1. In the bounded classical storage model, non-interactive FE satisfying information-theoretic subexponential simulation-based security can be obtained under subexponential grey-box obfuscation, and computational interactive FE follows from grey-box obfuscation and one-way functions (Barhoush et al., 2023). These results are significant because they show that the usual plain-model impossibility landscape is not absolute; it depends on adversarial storage assumptions.

4. Advanced variants: revocation, traceability, leasing, deletion, and unclonability

A large part of the FE literature concerns what happens to functional keys after issuance. Traceable FE for inner product binds both a user identity and a function vector into the secret key so that leaked keys can be traced, while privacy-preserving issuance ensures that the key-generating authority need not learn the user identity during key generation. In the privacy-preserving traceable FE-IP construction, only the tracer can recover the embedded identity, and the user can verify the correctness of the generated key (Qiu et al., 2024).

Revocation enriches the same lifecycle problem. Inner-product FE with fine-grained revocation for EHR sharing allows a group manager to revoke a specific function computation of a medical institution rather than all of its computation rights. The same scheme further requires that a revoked institution be unable to compute the function value not only on ciphertexts generated after the revocation, but also on ciphertexts generated before the revocation. Its construction is based on LWE and binds keys issued to the same institution together to prevent collusion (Han et al., 9 Sep 2025).

Quantum-inspired key-control variants go further. Secure key leasing introduces FE schemes in which the decryption key is a quantum object that can be returned and verified. Secret-key FE with secure key leasing is obtained from standard SKFE without additional assumptions, and bounded collusion-resistant SKFE-SKL for $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$2 follows from post-quantum one-way functions. Public-key FE with secure key leasing extends the idea to leased functional keys and a verification procedure that, once acceptance occurs, is intended to imply loss of further decryption capability (Kitagawa et al., 2022, Agrawal et al., 2023).

Certified everlasting FE strengthens the post-return guarantee: after a valid deletion certificate, security is required to hold even if the adversary later becomes computationally unbounded. One line of work constructs certified everlasting FE for all $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$3 circuits with a single key query and extends to $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$4-bounded FE for $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$5 circuits; a later line gives adaptively certified everlasting secure collusion-resistant public-key FE for polynomial-size circuits from indistinguishability obfuscation and one-way functions, and bounded collusion-resistant public-key FE for $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$6 from standard PKE (Hiroka et al., 2022, Hiroka et al., 2023).

Quantum FE also supports unclonability. A recent construction defines QFE for arbitrary quantum messages and polynomial-sized circuits, then shows that any QFE scheme universally achieves unclonable functional encryption in the sense that two parties cannot simultaneously recover the correct function outputs using two independently sampled function keys after splitting a ciphertext (Mehta et al., 2024).

5. Functional encryption in machine learning and federated computation

FE has become an important design pattern in privacy-preserving machine learning because it naturally matches workflows in which encrypted inputs should yield plaintext predictions or aggregates, rather than encrypted intermediate states. A systematization of FE-based PPML distinguishes IPFE-based and QFE-based pipelines, emphasizes that FE outputs are plaintext, and notes that FE-based PPML remains less mature than FHE-based PPML, with most implementations relying on research prototypes rather than production-ready systems (Panzade et al., 2022).

In partially encrypted inference, quadratic FE has been used to evaluate the encrypted front end of a neural network with quadratic activation functions. One such system reports encrypted digit classification in under $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$7 seconds with over $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$8 accuracy on an MNIST-like dataset, while also documenting severe leakage from the plaintext intermediate layer and proposing adversarial training to suppress sensitive-label inference (Ryffel et al., 2019). In a different application, privacy-preserving credit scoring via quadratic FE evaluates a one-hidden-layer square-activation network on encrypted borrower data, with reported encryption times from $$Setup(1^\lambda)\rightarrow({\rm pp},{\rm mk}),\quad KeyGen(\mathrm{mk},k)\rightarrow {\rm sk}_k,\quad Enc({\rm pp},x)\rightarrow c,\quad Dec({\rm sk}_k,c)\rightarrow y,$$9 ms for one borrower with $y=F(k,x)$0 attributes to $y=F(k,x)$1 ms for one borrower with $y=F(k,x)$2 attributes, and FE scoring times reaching $y=F(k,x)$3 s for $y=F(k,x)$4 attributes and $y=F(k,x)$5 borrowers and about $y=F(k,x)$6 s in the worst reported case of $y=F(k,x)$7 attributes and $y=F(k,x)$8 users (Andolfo et al., 2021).

Federated learning has become a major FE application domain. EncCluster makes decentralized multi-client FE practical by clustering model weights so that only $y=F(k,x)$9 centroids are encrypted, encoding assignment structure with Binary Fuse filters, and supporting weighted aggregation directly on ciphertexts. In its main experiments, communication falls to about $F:K\times X\to Y$0–$F:K\times X\to Y$1 FedAvg and encryption is accelerated by more than four times over all baselines while maintaining small accuracy degradation (Tsouvalas et al., 2024). EFU uses decentralized multi-client FE to enforce federated unlearning: the functional decryption key is bound to the aggregation function and round label, so the server can decrypt only the authorized aggregate and cannot cherry-pick or silently omit an unlearning update (Mohammadi et al., 11 Aug 2025).

Other recent designs extend FE with additional privacy or robustness layers. DyNo generalizes noisy multi-input FE to dynamic noisy multi-client FE with labels and client-corruption support, and uses this framework to train privacy-preserving logistic regression under differential privacy (Scheu-Hachtel et al., 9 May 2025). VFEFL combines a decentralized verifiable FE scheme with a robust aggregation rule so that the server learns only prescribed inner products of client updates while verifying ciphertext and key-share correctness and detecting malicious clients (Cai et al., 15 Jun 2025).

The same literature also shows that FE does not automatically solve protocol-level leakage. An attack on FE-based secure neural network training demonstrates that if the server learns both first-layer weights and decrypted first-layer outputs, then the input can often be reconstructed exactly or approximately by solving $F:K\times X\to Y$2, with linear programming substantially improving reconstructions in underdetermined image settings. The critique is not a break of FE itself but of application designs that release an authorized function value from which the underlying input remains algebraically recoverable (Ioniţă et al., 25 Sep 2025).

6. Practical constraints, leakage channels, and research trajectory

Practical FE remains constrained by function class, arithmetic range, and implementation cost. The survey literature emphasizes that many PPML-oriented FE systems support only inner products or quadratic functions, which limits comparison operations, non-polynomial activations, and deep-network expressiveness. Existing FE libraries such as CiFEr, GoFE, FLINT, Charm, and PBC are described as relatively immature compared with FHE ecosystems, with CPU-only computation common and no widespread GPU acceleration identified (Panzade et al., 2022).

Leakage is a structural rather than incidental concern. In semi-encrypted quadratic networks, a collateral adversary using only the plaintext intermediate representation reached $F:K\times X\to Y$3 font accuracy and $F:K\times X\to Y$4 accuracy when the public digit label was fixed, illustrating that revealing the authorized function output can still reveal latent sensitive variables. In FE-based training systems, the same issue appears as direct reconstruction from linear disclosures. These examples show that FE’s guarantee is fundamentally scoped to the authorized function output; it does not imply that the output itself is semantically harmless (Ryffel et al., 2019, Ioniţă et al., 25 Sep 2025).

Scalability mechanisms introduce their own tradeoffs. Weight clustering and probabilistic filters improve FE practicality in federated learning, but Binary Fuse filters are explicitly not cryptographic protection, and clustered representations may still leak some structure. EFU similarly notes that clustering introduces lossy compression and small performance degradation relative to uncompressed federated unlearning baselines, although increasing the number of clusters can reduce this effect (Tsouvalas et al., 2024, Mohammadi et al., 11 Aug 2025).

Recent work suggests a research trajectory defined less by a single canonical FE model than by specialized extensions: post-quantum lattice-based FE with revocation for EHR systems, dynamic noisy multi-client FE with labels and client corruption, verifiable FE for Byzantine-robust federated learning, and quantum FE with unclonability. This suggests that the contemporary FE landscape is being shaped simultaneously by cryptographic hardness assumptions, protocol-level leakage analysis, and application-specific control over who may learn which function of encrypted data, under what lifecycle and trust assumptions (Han et al., 9 Sep 2025, Scheu-Hachtel et al., 9 May 2025, Mehta et al., 2024).