---
title: 'GRAFHEN: Noise-Free Group-Based FHE'
url: https://www.emergentmind.com/topics/grafhen
type: topic
---

# GRAFHEN: Noise-Free Group-Based FHE

Searching arXiv for the GRAFHEN paper and closely related homomorphic-encryption/group-theoretic work.
GRAFHEN, short for **Group-based Fully Homomorphic Encryption without Noise**, is a cryptographic scheme that realizes fully homomorphic encryption by encoding plaintext algebra inside a group and representing that group on a machine by a rewriting system. Its defining claim is that homomorphic evaluation can be performed by exact group-word manipulation rather than by approximate arithmetic with accumulated ciphertext noise, so the scheme is presented as **fully homomorphic encryption without bootstrapping and without noise** [2510.21483]. In the formulation proposed in “Introducing GRAFHEN: Group-based Fully Homomorphic Encryption without Noise” [2510.21483], security is tied to hiding a subgroup kernel inside a public group presentation while preserving efficient evaluation and decryption.

## 1. Conceptual framework

GRAFHEN formalizes a homomorphic encryption of a ring \(\K\) through a decryption map
\[
\dec:C\to \K
\]
with public operations
\[
\smbadd,\mul:C\times C\to C
\]
satisfying
\[
\dec(\smbadd(x,y))=\dec(x)+\dec(y),\qquad \dec(\mul(x,y))=\dec(x)\cdot \dec(y).
\]
For bit encryption, where \(\K=F_2\), the scheme is already fully homomorphic because arbitrary Boolean functions can be built from addition and multiplication, equivalently NAND [2510.21483].

The paper reduces this problem to group theory by introducing a homomorphic encoding of \(\K\) into a group \(E\). An injective map
\[
Enc:\K\to E
\]
is required together with polynomial maps \(add,\mul:E^2\to E\) such that
\[
add(Enc(k),Enc(\ell))=Enc(k+\ell),\qquad \mul(Enc(k),Enc(\ell))=Enc(k\ell).
\]
Here “polynomial” means built only from multiplication and constants in the group:
\[
f(x_1,\dots,x_n)=a_0x_{i_0}a_1x_{i_1}\cdots a_kx_{i_k}a_{k+1}.
\]

The encryption scheme then lifts this encoding to a larger group \(L\) via a secret surjection
\[
\pi:L\to E.
\]
From this, the ciphertext space is defined as
\[
C=\pi^{-1}(Enc(\K)),
\]
the zero-cipher subgroup is
\[
Z=\ker(\pi)=\pi^{-1}(Enc(0)),
\]
and decryption is
\[
\dec=Enc^{-1}\circ \pi.
\]
A central interpretation follows directly: encrypting messages is reduced to hiding a subgroup \(Z\) inside a group \(L\), while still allowing efficient computation on word representatives [2510.21483].

## 2. Algebraic realization in groups

The paper gives a concrete encoding of any commutative ring \(\K\) in
\[
E=SL_3(\K).
\]
The encoding is
\[
Enc(x)=
\begin{bmatrix}
1&0&x\\
0&1&0\\
0&0&1
\end{bmatrix}.
\]
Addition is then ordinary matrix multiplication:
\[
Enc(k)\,Enc(\ell)=Enc(k+\ell),
\]
so
\[
add(x_1,x_2)=x_1x_2.
\]

For multiplication, the construction uses the fixed matrices
\[
h=
\begin{bmatrix}
0&1&0\\
1&0&0\\
0&0&-1
\end{bmatrix},
\qquad
g=
\begin{bmatrix}
-1&0&0\\
0&0&1\\
0&1&0
\end{bmatrix}.
\]
They conjugate encoded values into upper-triangular forms:
\[
g\,Enc(k)\,g^{-1}=
\begin{bmatrix}
1&-k&0\\
0&1&0\\
0&0&1
\end{bmatrix},
\qquad
h\,Enc(\ell)\,h^{-1}=
\begin{bmatrix}
1&0&0\\
0&1&-\ell\\
0&0&1
\end{bmatrix}.
\]
Using the commutator
\[
[U,V]=UVU^{-1}V^{-1},
\]
the paper derives
\[
[gEnc(k)g^{-1},\,hEnc(\ell)h^{-1}]=Enc(k\ell),
\]
and therefore
\[
\mul(x_1,x_2)=[gx_1g^{-1},\,hx_2h^{-1}].
\]

A smaller bit-encryption variant is also given in \(S_6\), with
\[
Enc(0)=Id,\qquad Enc(1)=(15)(34),
\]
\[
add(x,y)=xy,
\]
and
\[
\mul(x,y)=a_1xa_1\,a_2ya_2\,a_1xa_1\,a_2ya_2,
\]
where
\[
a_1=(12)(56),\qquad a_2=(35).
\]
This \(S_6\) construction serves as the running example and benchmark target in the paper [2510.21483].

The paper’s distinction from lattice FHE is explicit. Ciphertexts are not approximate encodings with accumulated error; they are exact group words. Homomorphic evaluation does not add noise because the scheme is based on exact group multiplication. Rewriting is therefore not a correctness-restoration mechanism analogous to bootstrapping, but a compression and normalization mechanism used to keep word lengths manageable [2510.21483].

## 3. Rewriting systems and machine representation

The main engineering mechanism in GRAFHEN is the representation of the public group by a rewriting system. Let \(A=\{x_1,\dots,x_n\}\) be an alphabet and \(A^*\) the monoid of words. A rewriting system is a finite set of rules
\[
\lambda\to \rho
\]
with \(\lambda,\rho\in A^*\), meaning that any occurrence of \(\lambda\) inside a word can be replaced by \(\rho\). The paper defines the standard relations \(w_1\to w_2\), \(w_1\to^* w_2\), and \(w_1\leftrightarrow^* w_2\), and calls a rewriting system compatible with a group \(G\) when two words are equivalent under rewriting if and only if they evaluate to the same group element [2510.21483].

Three properties structure the discussion. A system is **noetherian** if no infinite rewrite chain exists, **confluent** if every word reduces to a unique reduced word, and **bounded** if every word reduces to a word of length at most some fixed \(N\). The paper stresses that boundedness is the practically relevant property because it controls memory growth during evaluation.

Two standard algorithms are discussed. **Knuth–Bendix** is presented as a method that completes a finitely presented system to a reduced confluent one, but it is said to be too expensive for the large examples of interest. **Froidure–Pin** is the practical workhorse: it computes the reduced confluent rewriting system for a finite monoid or group from generators alone by enumerating reduced words by length and discovering rules when two words evaluate to the same group element [2510.21483].

In practice, the paper often stops Froidure–Pin early to obtain a **pseudo-bounded** system rather than a fully confluent one. The heuristic test is described as follows: pick \(10\) random words of length \(10{,}000\), reduce them, concatenate the reduced outputs, reduce again, and if the final length is below \(3\ell\), where \(\ell\) is the average reduced length, accept the system as pseudo-bounded. The paper presents this as a practical criterion for keeping cipher lengths manageable rather than as a formal boundedness proof.

This suggests a distinctive separation of concerns in GRAFHEN: the cryptographic algebra lives in the hidden quotient structure, while the operational efficiency of the public system depends on rewriting quality, especially pseudo-bounded reduction behavior.

## 4. Protocol structure and homomorphic evaluation

The protocol is built from a public group \(G\) with rewriting rules, a secret generating tuple \(x_1,\dots,x_d\) for \(G\), a subgroup \(L\le G\), and a secret surjection \(\pi:L\to E\) [2510.21483].

In key generation, generators \(x_1,\dots,x_d\) for \(G\) are chosen as the private key, and a rewriting system for the resulting presentation is computed. To encrypt \(k\in\K\), one chooses \(x\in L\) such that \(\pi(x)=Enc(k)\), writes \(x\) as a word in the secret generators, and optionally reduces that word. To decrypt a word \(w=x_{i_1}\cdots x_{i_m}\), one computes its product
\[
g=x_{i_1}\cdots x_{i_m}
\]
in \(G\). Because ciphertexts are chosen from \(C\), this element lies in \(L\), so \(\pi(g)\) is defined and
\[
\dec(w)=Enc^{-1}(\pi(g)).
\]

Homomorphic evaluation is obtained by lifting the group-level polynomial formulas to word formulas. If the encoding uses constants \(a_i\), then ciphertext operations substitute chosen representative words \(w_i\) for those constants and concatenate. For the running \(S_6\) example,
\[
\smbadd(x,y)=xy,
\]
and
\[
\mul(x,y)=w_1xw_1w_2yw_2w_1xw_1w_2yw_2.
\]

The paper characterizes this as **FHE without noise** because evaluation does not degrade decryptability through approximation error. Word reduction by rewriting may be postponed if memory is not an issue, and is described as lossless data compression rather than as a mandatory refresh step [2510.21483]. A plausible implication is that the operational bottleneck shifts from noise management to the construction of group presentations and rewrite systems that are simultaneously efficient and resistant to structural attacks.

## 5. Security model, attack surface, and hardening mechanisms

The paper’s central security intuition is that an attacker must not be able to decide whether a fresh ciphertext lies in the zero-cipher subgroup \(Z=\ker(\pi)\). This is framed as the **subgroup membership problem** for a finitely presented group and a subgroup specified by generators [2510.21483]. The paper argues that this is a promising hardness basis because subgroup membership is undecidable in general, and may remain undecidable even when the word problem is decidable. It explicitly rejects permutation groups and matrix groups over finite fields as public attacker-facing representations because subgroup membership is too easy there.

The attack discussion is organized around two broad families: attacks on the representation or key, and attacks on ciphertexts themselves. The paper reviews brute-force key search, Todd–Coxeter attacks that seek a permutation representation, attacks that reduce the effective number of generators, random reduction attacks using many short zero-ciphers, and attacks that infer message values from relations between known and unknown ciphertexts [2510.21483].

To harden the system, the authors introduce **admissible rules**. A rule \(\lambda\to\rho\) is admissible for a parameter \(k\) if both sides use the entire alphabet, both have length at least \(k\), and \(\lambda\) and \(\rho\) have no common prefix or suffix. Froidure–Pin is modified to discard non-admissible rules. According to the paper, this prevents easy reduction to fewer generators, hides algebraic structure, makes random-reduction attacks much less effective, and makes ciphers of \(0\) harder to collapse to very short words [2510.21483].

A further hardening device is the **semidirect-product trick**. Starting from rewriting systems \(R_1\) and \(R_2\), the paper combines them with commutation rules
\[
ba \to wb,\qquad \text{where }w=bab^{-1}\text{ in }G,
\]
to obtain a system compatible with
\[
G\rtimes G.
\]
A key lemma states that
\[
G\rtimes G \cong G\times G
\]
via
\[
(x,y)\mapsto (xy,y),
\]
yielding a homomorphism
\[
f(x,y)=xy
\]
and the projection
\[
p(x,y)=y.
\]
From \(L_0\to E\), the construction defines
\[
L=f^{-1}(L_0),\qquad \pi=\pi_0\circ f.
\]
The stated purpose is to enlarge \(|G|\), the index \([G:L]\), and the size of the attack space while keeping decryption manageable [2510.21483].

The paper also proposes an automorphism-based variant in which one works with
\[
G=Aut(G_0).
\]
An automorphism is stored by the images of the generators, and composition becomes substitution of words. The authors describe subgroup membership in this representation as “exceedingly difficult,” although they do not fully benchmark it [2510.21483].

## 6. Parameters, benchmark claims, and limitations

The recommended practical setup in the paper is: \(E=S_{11}\), \(G=S_{11}\), \(d=5\) random generators, an admissible pseudo-bounded rewriting system, a second independent copy, combination through the semidirect-product trick, and
\[
L=E\rtimes S_8.
\]
Encryption of \(e\in E\) is then performed by choosing \(x\in S_8\) and forming
\[
(ex^{-1},x)\in L.
\]
The paper reports about \(20\) million rules for one system and just under \(40\) million rules for the full combined key, and estimates the number of truly different keys as
\[
11!^4 \approx 2^{101}
\]
[2510.21483].

The benchmark comparison is against OpenFHE on encrypted bits with AND gates. The OpenFHE baseline uses the default bootstrapping method GINX/TFHE at security level \(100\) bits. GRAFHEN is implemented in Rust with the \(S_{11}\) parameter set; homomorphic multiplication on \(F_2\) requires \(5\) group operations in the chosen encoding; and the measured average time for the equivalent AND operation is
\[
7.56\,\mu s,
\]
compared with
\[
26.4\,ms
\]
for OpenFHE. The paper therefore claims that GRAFHEN is about \(3500\) times faster in this proof-of-concept benchmark [2510.21483].

The appendix by James Mitchell provides an independent attack study based on Todd–Coxeter-style methods on monoids and word graphs. For non-semidirect-product schemes based on \(S_n\), the study reports that at least \(90\%\) of challenge words could often be decoded, but runtime and memory usage appeared to grow exponentially with \(n\), and challenges starting at \(n=12\) could not be broken. For the recommended semidirect-product schemes \(S_n\rtimes S_n\), the study reports failure to break cases for \(n>7\), and in particular not for \(n=11\) [2510.21483].

These results should be read together with the paper’s own design assumptions. GRAFHEN depends on the existence of efficient public rewriting systems, secret subgroup structure that remains hidden in the public presentation, and attack resistance of the chosen finitely presented groups. This suggests that the scheme’s significance lies less in a finalized parameter set than in a specific cryptographic paradigm: exact algebraic homomorphic computation by group-word manipulation, with security grounded in subgroup membership over carefully engineered rewriting-system representations.

Source: https://www.emergentmind.com/topics/grafhen