New Algebraic Tricks Shrink Verifiable Homomorphic Encryption Proofs by Orders of Magnitude

Four interlocking techniques — BatchFold, packing, SparsePack, and tighter arithmetization — collapse the main scalability bottlenecks in proving CKKS computations honestly happened.

Imagine you're a shipping company that seals every container at the dock, but the seal is so heavy it doubles the shipping cost. That's roughly the state of verifiable homomorphic encryption: you can compute on encrypted data, but proving to someone that you computed correctly — without revealing the data — adds so much overhead that nobody actually does it at scale. This paper is about making the seal lightweight enough that real workloads (like neural network inference on encrypted medical data) become plausible. The committed claim: we remove all three scalability walls from the previous best approach [Cascudo et al., CRYPTO 2025] for verifiable CKKS — proof size, the O(N) overhead in range checks, and the lack of sublinear verification — and demonstrate "several orders of magnitude" improvements on a generic neural network architecture. That predecessor paper was by the same team, so this is self-improvement, but the bottlenecks they're attacking are real and well-known in the lattice-based proof community. Four techniques do the heavy lifting. First, a tighter arithmetization of CKKS computations reduces the number of constraints the prover has to satisfy. Second, BatchFold is a new polynomial commitment scheme for the cyclotomic ring R_q that supports batched evaluations — meaning you can open multiple evaluation points in one proof instead of paying per-point. Third, packing is an algebraic trick that eliminates the need to commit to huge N-dimensional polynomials, collapsing the O(N) blowup in range proofs to something manageable. Fourth, SparsePack handles sparse, circuit-dependent polynomials by combining packing with batched evaluations. These four pieces are mutually reinforcing: packing feeds SparsePack, BatchFold makes SparsePack affordable, and the tighter arithmetization reduces what all of them need to prove. The architectural family here is succinct arguments of knowledge over structured lattice rings — specifically polynomial commitment schemes in R_q = Z_q[Y]/(Y^N+1). This is firmly in the algebraic proof-systems lineage (think Bulletproofs, but over rings instead of prime fields), and it leans on the algebraic structure of cyclotomic rings the way SNARKs lean on elliptic-curve pairings. The compute property the method exploits is the tensor-product structure of polynomial evaluation, which BatchFold uses to compress batched openings. Integrity is mixed. The evaluation is on a "generic neural network architecture," which is the right shape of workload but leaves the specific architecture unnamed in the abstract. The predecessor baseline is the strongest available — the same team's CRYPTO 2025 paper — and the claimed improvement is orders of magnitude, not marginal. But the validation is analytical and proof-based, not an independent benchmark suite. The paper is 92 pages, which usually signals real proofs rather than hand-waving, and the Asiacrypt 2026 acceptance is peer-reviewed. No code release is mentioned. The milestone question: verifiable FHE is useful when the overhead is low enough for real inference workloads — think CKKS-encrypted medical images through a ResNet. The predecessor work made this theoretically possible; this paper makes the proof overhead plausibly practical. The next concrete threshold is a full end-to-end implementation benchmark on a standard encrypted-ML pipeline (e.g., CIFAR-10 inference) with wall-clock prover/verifier times, not just asymptotic improvements. That's probably 1–2 papers away. The obvious experiment not run: an implementation benchmark with wall-clock times on real hardware. The abstract says "we evaluate the efficiency" but the language ("several orders of magnitude smaller and faster") suggests asymptotic or concrete-parameter comparisons, not a deployed system. Honest read: this is a theory paper accepted at a theory venue, and building the implementation is a separate engineering effort — likely (a) out of scope/budget, not (b) or (c).