Reproduce “Detecting and Understanding Vulnerabilities in Fully Homomorphic Encryption Frameworks” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Yiteng Peng, Dongwei Xiao, Zhibo Liu, Zhenlan JI, Shuai Wang
HERTA, the first automated testing tool for Fully Homomorphic Encryption (FHE) frameworks, identified 21 previously unknown bugs, including 16 silent logic errors and 5 crashes, across leading FHE implementations from Zama, Google, and IBM. The tool's FHE-specific metamorphic testing methodology effectively uncovers vulnerabilities that could corrupt encrypted computations in privacy-sensitive applications.
Key insights
- Silent logic errors, which produce incorrect results without crashes, constitute a significant majority of vulnerabilities in FHE frameworks, far exceeding crashes.
- FHE-specific metamorphic relations are crucial for testing these frameworks, as generic fuzzing techniques prove less effective in detecting deep logic flaws.
- Inconsistent behavior across different FHE schemes, backend libraries, or hardware accelerators, along with complex compilation configurations, are major sources of subtle bugs.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.