🤖 AI

FHAIM: Fully Homomorphic AIM For Private Synthetic Data Generation

FHAIM is a novel framework that enables private synthetic data generation by adapting the AIM algorithm to a fully homomorphic encryption (FHE) setting, allowing a synthesizer to be trained on encrypted tabular data while ensuring privacy through both encryption and differential privacy.

Original authors: Mayank Kumar, Qian Lou, Paulo Barreto, Martine De Cock, Sikha Pentyala

Published 2026-02-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Mayank Kumar, Qian Lou, Paulo Barreto, Martine De Cock, Sikha Pentyala

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a doctor at a prestigious hospital. You have a massive collection of patient records—details about heart rates, blood sugar, and medications. This data is a "gold mine" for scientists who want to train AI to detect diseases early.

However, you have a massive problem: Privacy. You cannot simply email these files to a tech company to train their AI, because if that company gets hacked, or if a rogue employee looks at the files, real people’s private lives are exposed.

Currently, we have two "okay" solutions, but both have flaws:

The "Blurry Photo" Method (Differential Privacy): You send the data, but you add "noise" to it (like making a photo grainy) so individuals can't be identified. The problem? The tech company still sees the "grainy" raw data, which is still a huge security risk.
The "Teamwork" Method (Federated Learning): You and ten other hospitals try to train the AI together. It’s complicated, requires everyone to coordinate perfectly, and if the companies running the math decide to "team up" and cheat, they can figure out your data.

Enter FHAIM: The "Magic Locked Box" Approach.

The researchers created a system called FHAIM. To understand how it works, let’s use a metaphor.

The Metaphor: The Master Chef and the Locked Ingredient Box

Imagine you want a world-class Chef (the AI Service Provider) to create a new secret recipe (the Synthetic Data) based on your unique ingredients (your Private Data). But you don't trust the Chef. You're afraid they might steal your secret spices or see exactly how much salt you use.

1. The Magic Box (Fully Homomorphic Encryption - FHE)
Instead of handing the Chef your ingredients, you put them inside a Magic Locked Box. This box has a special property: the Chef can reach into the box using special gloves and manipulate the ingredients without ever opening the lid. They can stir them, chop them, and mix them, but they can never actually see or touch them directly. They only see the "shape" of the work being done.

2. The "Noisy" Recipe (Differential Privacy - DP)
Even if the Chef can't see the ingredients, if they tell you, "The recipe needs exactly 4.2 grams of salt," you might figure out your secret recipe. To prevent this, FHAIM adds a layer of "mathematical static." Before the Chef tells you what they found, they add a little bit of random "noise" to the result. It’s like the Chef saying, "The recipe needs about 4 grams of salt." It’s accurate enough to make a great meal, but not precise enough to reveal your secrets.

3. The Workflow (How FHAIM actually works)

Step 1 (The Lock): You encrypt your data (put it in the Magic Box).
Step 2 (The Math): The AI provider performs complex math on the encrypted data. They are essentially "tasting" the ingredients through the gloves.
Step 3 (The Reveal): The provider sends the "noisy" results back to a neutral third party (the Key Holder) who unlocks just the results, not the original data.
Step 4 (The Synthetic Data): Now, the provider has a "statistical map" of your data (e.g., "People with high blood sugar often have X symptom"), but they never saw a single real person's name or actual medical record. They use this map to create Synthetic Data—fake data that looks and acts exactly like the real thing but belongs to nobody.

Why is this a big deal?

Before this paper, doing math on encrypted data was so slow it was like trying to cook a gourmet meal using only a toothpick. It would take forever.

The creators of FHAIM found a way to make this "cooking" process incredibly efficient. They proved that you can train an AI on this "locked" data in minutes rather than days, and the "fake" data produced is so high-quality that it works just as well as the real thing for training medical or financial AI.

In short: FHAIM allows us to use the world's most sensitive data to save lives and improve technology, without ever actually having to "show" the data to anyone.

Technical Summary: FHAIM (Fully Homomorphic AIM)

FHAIM is a novel framework designed to enable private Synthetic Data Generation (SDG) for tabular data. It addresses a critical gap in current "SDG-as-a-service" models by providing both input privacy (protecting the raw training data) and output privacy (protecting the released synthetic data).

1. The Problem: The Privacy Gap in Outsourced SDG

Current SDG-as-a-service platforms typically focus on output privacy using Differential Privacy (DP). This ensures that the generated synthetic data does not leak information about individuals. However, these platforms require the data holder to send plaintext raw data to the service provider.

This creates a significant trust issue:

Input Privacy Risk: Data holders (e.g., hospitals, banks) must trust the third-party provider not to misuse or leak the raw sensitive data.
Regulatory Barriers: Strict laws (like HIPAA or GDPR) often prohibit the disclosure of raw data to third parties, even if the final output is privatized.
Limitations of Alternatives: Existing solutions like Secure Multi-Party Computation (MPC) require multiple non-colluding servers, and Federated Learning (FL) requires the data holder to perform significant local computation, which defeats the purpose of outsourcing.

2. Methodology: DP-in-FHE

The authors propose leveraging Fully Homomorphic Encryption (FHE)—specifically the CKKS scheme, which supports approximate arithmetic on real numbers—to train a marginal-based synthesizer (the AIM algorithm) directly on encrypted data.

The FHAIM framework introduces a four-entity architecture:

Data Entity (DE): Encrypts the data and pre-samples noise.
Computation Entity (CE): Performs the heavy lifting of training on encrypted data.
Generation Entity (GE): Provides the proprietary SDG algorithm.
Crypto-Service Entity (CSE): Manages keys and performs decryption of only the privatized statistics.

Key Technical Innovations in the Protocols:

$\pi$ COMP (Compute): To avoid the high cost of homomorphic comparisons, the authors use One-Hot Encoding (OHE). They implement a column-wise SIMD packing strategy, which allows the CE to compute 1-way and 2-way marginals using efficient additions and multiplications, keeping the multiplicative depth low and independent of the dataset size.
$\pi$ SELECT (Select): This is the most difficult step in FHE. Standard AIM uses the $L_1$ norm, which requires approximating the absolute value function—a process that is computationally expensive and numerically unstable in FHE. The authors propose using a Squared $L_2$ norm instead. This allows the use of native homomorphic squaring, which is stable, efficient, and avoids the accuracy loss associated with polynomial approximations.
$\pi$ MEASURE (Measure): This implements the Gaussian Mechanism entirely within the encrypted domain. The CE adds encrypted noise to the encrypted marginals. Once the noisy marginals are decrypted by the CSE, they are "safe" to be used in the clear for the final generation step.

3. Key Contributions

First FHE-based SDG Framework: The first system to enable training marginal-based generators on fully encrypted tabular data without requiring multiple non-colluding parties.
DP-in-FHE Protocols: Novel protocols for marginal computation, differentially private query selection, and noisy measurement.
Stability via Squared $L_2$ Norm: A mathematical shift from $L_1$ to $L_2$ that makes FHE-based selection computationally feasible and numerically robust.
Efficient Memory Layout: A SIMD-based approach that ensures scalability for large datasets.

4. Results

The authors evaluated FHAIM on three real-world datasets: Breast Cancer, COMPAS (recidivism), and Diabetes.

Utility: FHAIM-L2 (using the squared $L_2$ norm) achieved statistical utility and downstream machine learning accuracy nearly identical to the original plaintext AIM algorithm. In contrast, the $L_1$ approximation method suffered significant accuracy degradation.
Runtime: The system is highly practical. The most intensive part (the one-time "Compute" phase) takes 5–12 minutes. The iterative training loop (Select/Measure) takes roughly 1–2 minutes per iteration. Total training time ranges from 15 to 45 minutes.
Memory: The framework is lightweight, with peak memory usage staying below 32 MB, making it suitable for standard cloud instances.

5. Significance

FHAIM represents a major step forward for Privacy-Preserving Machine Learning (PPML). By solving the "input privacy" problem through FHE, it enables highly regulated industries (healthcare, finance, government) to outsource AI training to the cloud without ever exposing their raw, sensitive datasets. It proves that the combination of FHE and DP can be both mathematically rigorous and computationally efficient enough for real-world deployment.