Use cases: private ML inference, secure multiparty computation, e-voting

Why this matters

The reason HE matters in 2024 is not the maths — the maths has been settled since 2009 — it's that the cost-benefit ratio finally crossed the line for real applications. Three families dominate. Private ML inference: a hospital sends an encrypted scan to a cloud-hosted classifier; the classifier returns an encrypted prediction; the cloud sees nothing. Secure multiparty computation with HE as the underlying primitive: parties pool data without revealing their inputs (private set intersection, federated analytics, advertising attribution). Verifiable e-voting and tally: votes are encrypted under a public key, tallies are computed homomorphically, and a threshold of trustees decrypts only the aggregate. Each use case puts different demands on the scheme — depth requirements, throughput, ciphertext size, latency tolerance — and the right scheme is rarely the same across the three. Knowing the use case landscape upfront lets you skip the wrong libraries and pick the right rung in the FHE/SHE/PHE hierarchy from the start.

Demo

Three sketches at the same level of abstraction. (1) ML inference: client encrypts $x$, sends to server, server runs $\mathrm{Eval}(W \cdot x + b)$ homomorphically, returns ciphertext. (2) Private set intersection by HE: each party encrypts a polynomial whose roots are their set elements; the parties multiply ciphertexts to find the GCD of polynomials, whose roots are the intersection. (3) E-voting: each voter encrypts $0$ or $1$ under a tally key; the bulletin board sums all ciphertexts; the trustees jointly decrypt only the sum.

Try it yourself

1. Run the snippet. The tallies match. Note that the server never saw any individual ballot — only their encrypted form, and only the encrypted sum.
2. Add a malicious voter who encrypts the value 1000 instead of 0 or 1, then re-run. The tally is wrong by 1000. This is why real e-voting protocols pair HE with zero-knowledge proofs that each ciphertext encrypts a value in $\{0,1\}$.
3. For private ML inference: list three operations a typical neural network uses that cannot be evaluated as polynomial circuits (ReLU, softmax, max-pool). For each, name the standard HE workaround (polynomial approximation, sign-test via Chebyshev, etc.).
4. For private set intersection: assume Alice has a set of size 100 and Bob has a set of size 100,000. Why is the polynomial-roots PSI prohibitively expensive at this asymmetry? Look up labelled PSI and write one sentence explaining what it does differently.
5. Pick the rung — PHE, SHE, or FHE — for each of these three apps: (a) homomorphic vote tally, (b) homomorphic CNN inference, (c) homomorphic SQL COUNT(*) WHERE x > 5. Justify each choice using the multiplicative-depth picture.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain how the same primitive — homomorphic encryption — can power three apparently different use cases (private ML, MPC, e-voting). What's the common abstraction underneath?

2. Why it works (the mechanism)

Walk me through what a real private CNN inference looks like end-to-end with CKKS: how is the image encoded into a ciphertext, what gets bootstrapped, and where do polynomial approximations of ReLU enter the picture?

3. Advanced — application & what's next

Compare HE-based PSI to OPRF-based PSI for two parties of size $n$ and $m$. Where does HE win, where does OPRF win, and at what point does communication cost dominate the choice?

References

• Gilad-Bachrach et al. — CryptoNets (private CNN inference, 2016)
• Chen, Laine, Rindal — Fast Private Set Intersection from HE
• Helios Voting — homomorphic e-voting in production