Ilmu Komputer & AI editorial
Open AccessOA2026
Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference
How d+1 admissible queries defeat shuffle-model differential privacy in hybrid FHE inference
Jiseung Kim; Hyung Tae Lee· 2026· DOI 10.48550/arXiv.2609.12911
The core problem
Hybrid fully homomorphic encryption (FHE) inference aims to make private inference practical by splitting computation: the server evaluates linear layers homomorphically, while the client decrypts intermediate results and applies nonlinearities. To protect model confidentiality, recent schemes return noisy, output-permuted responses and invoke shuffle-model differential privacy (DP). This paper challenges that approach, showing that such protection fails in the correctness regime required by hybrid FHE systems. The authors demonstrate that for a -input linear layer, admissible queries are sufficient for exact recovery of a permutation-invariant layer summary, leading to perfect model distinguishability. They further establish that input DP is orthogonal to model confidentiality and that the local-DP premise for shuffle amplification cannot hold under correctness-bounded noise. The work provides both theoretical analysis and concrete attacks on real models, including a SAFHIRE-style ResNet-20, ImageNet-scale CNNs, and ViT-B/16.
Innovation
The authors successfully recover all linear layers of a SAFHIRE-style ResNet-20 end-to-end from TFHE transcripts with zero error, using queries per layer for a total of 5,712 direct queries. Under the same query model, they confirm exact per-layer recovery on pretrained ImageNet-scale CNNs and ViT-B/16. The leaked spectra enable fingerprinting, lineage attribution, and improved logit-based extraction. Suppressing these leaks destroys inference utility, highlighting a fundamental trade-off. The results demonstrate that permutation-based confidentiality is insufficient in the correctness regime, as the attack achieves perfect model distinguishability. The empirical validation covers multiple architectures, showing the generality of the vulnerability.
Hybrid fully homomorphic encryption (FHE) inference aims to make private inference practical by splitting computation: the server evaluates linear layers homomorphically, while the client decrypts intermediate results and applies nonlinearities. To protect model confidentiality, recent schemes return noisy, output-permuted responses and invoke shuffle-model differential privacy (DP). This paper challenges that approach, showing that such protection fails in the correctness regime required by hybrid FHE systems. The authors demonstrate that for a -input linear layer, admissible queries are sufficient for exact recovery of a permutation-invariant layer summary, leading to perfect model distinguishability. They further establish that input DP is orthogonal to model confidentiality and that the local-DP premise for shuffle amplification cannot hold under correctness-bounded noise. The work provides both theoretical analysis and concrete attacks on real models, including a SAFHIRE-style ResNet-20, ImageNet-scale CNNs, and ViT-B/16.
The attack model assumes a client who can issue admissible queries to the server and observe the returned noisy, permuted outputs. The authors formalize the notion of a permutation-invariant layer summary and prove that queries suffice to recover it exactly for a -input linear layer. They show that the noise required for differential privacy must be bounded to maintain correctness, which prevents the local-DP premise needed for shuffle amplification. The attack is evaluated on TFHE transcripts of a SAFHIRE-style ResNet-20, using queries per layer, totaling 5,712 direct queries. The same query model is applied to pretrained ImageNet-scale CNNs and ViT-B/16 to confirm exact per-layer recovery. The leaked spectra enable fingerprinting, lineage attribution, and improved logit-based extraction. The methodology includes both theoretical proofs and empirical validation on standard architectures.
Why it matters
The paper's analysis reveals that input differential privacy is orthogonal to model confidentiality, meaning that protecting inputs does not protect the model. The local-DP premise required for shuffle amplification cannot hold when noise is bounded to maintain correctness, which is essential for hybrid FHE inference. This creates a tension: adding enough noise to prevent the attack would degrade inference accuracy below acceptable levels. The authors discuss implications for the design of hybrid FHE systems, suggesting that permutation-based approaches are fundamentally flawed for model confidentiality. They also note that the leaked spectra can be used for model fingerprinting and lineage attribution, which may have legal and ethical implications. The work calls for new approaches that provide model confidentiality without sacrificing utility, possibly combining FHE with other cryptographic techniques or secure hardware.
Who should read this
CS practitioners and researchers
Opening member content…