A health question can be sensitive even when it is false. Someone asking whether a treatment causes infertility, whether a symptom signals cancer or whether a vaccine is dangerous may not want the query exposed to the server operating a misinformation detector. A new preprint proposes a way to separate the analysis from the reading: the server receives encrypted numerical representations of the text and performs the classification without decrypting them.[1]
The method uses CKKS homomorphic encryption, which supports approximate arithmetic on ciphertext. The client turns text into features, encrypts the vectors and sends them to the server. The server applies the trained classifier or similarity computation to those encrypted values and returns encrypted scores. Only the client holds the decryption key needed to read the result.
What is private, and what is not
The information boundary
| Stage | Plaintext holder | What the server receives |
|---|---|---|
| Model training | The model developer | Training data and fitted model are handled in ordinary plaintext computationSource 1 |
| Query preparation | The client | Text is converted into BioBERT, MPNet and TF-IDF-derived features before encryptionSource 1 |
| Inference | The client keeps the secret key | Encrypted vectors and ciphertext operations, not the raw querySource 1 |
| Result | The client | Encrypted scores that the client decrypts locallySource 1 |
This is an honest-but-curious threat model. The server is assumed to follow the protocol while being prevented from learning the query contents. It is not a general solution to a malicious client, a compromised endpoint, model theft, poisoned training data or metadata leakage through traffic patterns.
Reported classification and retrieval results
| Measure | Value | Context |
|---|---|---|
| Health-classification test set | 1,081 items | 184 labelled fake and 897 labelled real, so accuracy alone would be an incomplete measure.Source 1 |
| Hybrid classifier | 0.971 accuracy; 0.950 macro-F1 | The reported decisions and aggregate metrics were identical for plaintext and encrypted inference.Source 1 |
| Retrieval collection | 7,128 indexed items | The encrypted system compared a query with the reference collection.Source 1 |
| Naive encrypted retrieval | 222.028 seconds; 6.11 GB communication | A direct implementation was technically possible but operationally heavy.Source 1 |
| SIMD-packed encrypted retrieval | 5.168 seconds; 2.13 MB communication | Packing many scores together sharply reduced latency and data transfer.Source 1 |
| Plaintext retrieval | 0.057 seconds | Privacy still carried a large performance cost.Source 1 |
Encryption preserved the arithmetic, not the evidence base
The classifier combines a 768-dimensional BioBERT representation, a 256-dimensional reduced MPNet representation and 300 reduced TF-IDF features. Because the encrypted stage applies compatible numerical operations to those fixed features, the ciphertext calculation can reproduce the plaintext decision closely enough to report identical labels in the experiment.[1]
That does not establish that the labels are correct in every health setting. The classification data came from CoAID, a pandemic-focused dataset. A model trained around one misinformation environment may not transfer cleanly to a new disease, language, jurisdiction or rhetorical style. Encryption can hide the query while preserving the model’s mistakes just as faithfully as its successes.
Retrieval exposes the cost of private computation
Semantic retrieval is more demanding because one encrypted query must be compared with thousands of references. The naive version returned individual encrypted scores and moved gigabytes. SIMD packing placed many calculations into the available ciphertext slots, cutting the reported time from more than three minutes to just over five seconds and communication to about two megabytes.[1]
The result matters because it turns a common privacy promise into an executable architecture. A service does not always need the plaintext question in order to score it. The remaining challenge is to pair that cryptographic boundary with better domain evaluation, robust key management and a clear decision about what happens when a private classifier produces a confident but wrong answer.
Sources & further reading
- Privacy-Preserving Text Inference for Health-Misinformation Classification and Semantic Retrieval arXiv · 14 Oct 2026 · Accessed 16 Oct 2026