## 5 Federated Learning with Homomorphic Encryption
### Discussion and Learned Lessons  
The central challenge when using HE in FL is the computation and communication overhead. Unlike DP, which requires reducing the trade-off between privacy and model performance, in HE, the focus is on reducing the trade-off between privacy and computation overhead.  
Several techniques have been explored to address this challenge, including batching, gradient compression, masking, parameter efficiency, and parameter selection. Batching techniques aim to encode many values within the same ciphertext while ensuring that the result can be obtained using only one operation on the ciphertext. Gradient compression, on the other hand, tries to compress the ciphertext to reduce the communication overhead. Masking is used as a lightweight technique that hides information using a mask seed, with the demasking seed calculated collaboratively using homomorphic encryption. Parameter efficiency and parameter selection techniques select only the efficient parameters and then encrypt only the most significant updates that may reveal much information about the data, rather than encrypting all the parameters. Previous works affirm that encrypting only the significant parameter is sufficient to counter privacy attacks.  
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref** & **Year** & **Scheme** & **Key Idea** & **Trade-offs and Shortcomings** \\ \hline
[63] & 2020 & Additive & Propose a batch additive scheme to reduce communication and computation overhead. & Batchcrypt is not applicable in Vertical FL. \\ \hline
[64] & 2021 & Additive & Hide shared gradients from from the server to protect against membership inference attack. & Scalability issue, computational and communication overhead \\ \hline
[66] & 2021 & Additive & Reduce the number of gradients to be encrypted by filtering insignificant gradients. & Scalability issues, computational and communication overhead \\ \hline
[67] & 2022 & Additive & Use a doubly homomorphic secure aggregation by using homomorphic encryption and masking technique. & Computational and communication overhead \\ \hline
[68] & 2022 & Additive & Additionally to previous work, protect the dataset size by adding interactions between clients using homomorphic encryption. & Computational and communication overhead \\ \hline
[69] & 2023 & Additive & Encrypting only a part of the model instead of the whole model. They showed that encrypting just 10\% of the model parameter using a robust selection mechanism is efficient to counter DLG attack. & Need for theoretical analysis of the trade-offs among privacy guarantee, system overheads and model performance. \\ \hline \hline \end{tabular}
\end{table}
Table 4: Privacy-preserving FL using HE.  
Homomorphic encryption is well suited to counter eavesdropping attacks and the attacks that may exploit the updates coming from the client. It is also a good solution for anonymization, since the server will not access the updates provided by clients. However, the security of HE relies on the chosen scheme and the encryption keys. In addition, if the server accesses the final result, it still has the potential to perform a model inversion attack against the global model.  
One drawback of HE is that the only operations possible are the addition and multiplication. Most research focus only on additive homomorphic encryption. Moreover, the computational complexity poses a challenging in terms of term efficiency and performance when applying HE in FL.