# Privacy-Preserving Byzantine-Resilient Swarm Learning for E-Healthcare
## 3 Preliminaries
### Threshold Fully Homomorphic Encryption  
To construct distributed FHE, threshold fully homomorphic encryption (TFHE) [52] has been proposed, in which each participant has a share of a secret key corresponding to an FHE public key.  
Let \(P=\{P_{1},\ldots,P_{N}\}\) be a set of parties. Threshold fully homomorphic encryption scheme (TFHE) is tuple of PPT algorithms \(TFHE=(TFHE.Setup,TFHE.Encrypt,TFHE.Eval,TFHE.PartDec,TFHE.FinDec)\) satisfying the following specifications:* \((pk,sk_{1},\ldots,sk_{N})\gets TFHE.Setup(1^{\lambda},1^{d},\mathbb{A})\): The algorithm inputs a security parameter \(\lambda\), a circuit depth \(d\), and an access structure \(\mathbb{A}\), and outputs a public key \(pk\), and secret key shares \(sk_{1},\ldots,sk_{N}\).
* \(ct\gets TFHE.Encrypt(pk,\mu)\): The algorithm inputs a public key \(pk\) and a single-bit plaintext \(\mu\in\{0,1\}\), and outputs a cipher-text \(ct\).
* \(\hat{ct}\gets TFHE.Eval(pk,C,ct_{1},\ldots,ct_{k})\): The algorithm inputs a public key \(pk\), a boolean circuit \(C:\{0,1\}^{k}\rightarrow\{0,1\}\in C_{\lambda}\) of \(depth\leq d\) and cipher-texts \(ct_{1},\ldots,ct_{k}\) encrypted under the same public key, and outputs an evaluation cipher-text \(\hat{ct}\).
* \(p_{i}\gets TFHE.PartDec(pk,ct,sk_{i})\): The algorithm inputs a public key \(pk\), a cipher-text \(ct\) and a secret key share \(sk_{i}\). and outputs a partial decryption \(p_{i}\) related to the party \(P_{i}\).
* \(\hat{\mu}\gets TFHE.FinDec(pk,B)\): The algorithm inputs a public key \(pk\), a set \(B=\{p_{i}\}_{i\in S}\) for some \(S\subseteq\{P_{1},\ldots,P_{N}\}\) where we recall that we identify a party \(P_{i}\) with its index \(i\), and deterministically outputs a plaintext \(\hat{\mu}\{0,1,\bot\}\).  
And we construct \(TFHE\) using the schemes, \(FHE=(FHE.Setup,FHE.Encrypt,FHE.Eval,FHE.Decrypt)\) and \(SS=(SS.Share,SS.Combine)\) as follows:  
* \(TFHE.Setup(1^{\lambda},1^{d},\mathbb{A}_{t})\): The algorithm inputs \(\lambda\), \(d\), and \(\mathbb{A}_{t}\in TAS\), and generates \((fhepk,fhesk)\gets FHE.Setup(1^{\lambda},1^{d})\). Then, \(fhesk\) is divided into shares using \((fhesk_{1},\ldots,fhesk_{N})\gets SS.Share(fhesk,\mathbb{A}_{t})\).
* \(TFHE.Encrypt(pk,\mu)\): The algorithm inputs \(pk\) and \(\mu\in\{0,1\}\), computes \(ct\gets FHE.Encrypt(pk,\mu)\), and output \(ct\).
* \(TFHE.Eval(pk,C,ct_{1},\ldots,ct_{k})\): The algorithm inputs \(pk\), \(C\) and \(ct_{1},\ldots,ct_{k}\), computes \(\hat{ct}\gets FHE.Eval(C,ct_{1},\ldots,ct_{k})\), and outputs \(\hat{ct}\).
* \(TFHE.PartDec(pk,ct,sk_{i})\): The algorithm inputs \(pk\), \(ct\), and \(sk_{i}\in\mathbb{Z}_{q}^{n}\), computes \(p_{i}=FHE.Decode_{0}(sk_{i},ct)+(N!)^{2}\cdot e\in\mathbb{Z}_{p}\), and outputs \(p_{i}\).
* \(TFHE.FinDec(pk,B)\): The algorithm inputs \(pk\) and \(\{p_{i}\}_{i\in S}\), and checks if \(S\in\mathbb{A}\). If this is not the case, then it outputs \(\bot\). Otherwise, it arbitrarily chooses a satisfying set \(S^{\prime}\subseteq S\) of size \(t\) and computes the Lagrange coefficients \(\lambda_{i,0}^{S^{\prime}}\) for all \(i\in S^{\prime}\). Then, it computes \(\mu\gets FHE.Decode_{1}(\sum_{i\in S^{\prime}}\lambda_{i,0}^{S^{\prime}})\), and outputs \(\mu\).