Trust That You Can Compute.
Five hospitals compare stroke length-of-stay without any of them exposing their absolute numbers. Each one learns only its relative position.
The Scenario
Five reference hospitals want a quality benchmark. Metric: average length of stay for ischemic stroke.
The Problem
No hospital wants to expose absolute numbers — PR risk. Under traditional architecture, honest benchmarking among competitors is impossible.
The Guarantee
The aggregator computes mean, variance and standard deviation over ciphertexts. Each hospital only decrypts its relative position. RLWE mathematical guarantee.
Define the parameters.
Before encrypting the length-of-stay values, we choose CKKS parameters. Each parameter is a trade-off between security, speed and computational capacity.
Parameters · CKKS
What each term means
CKKS ("approximate" scheme) — Homomorphic encryption family that operates over real numbers. It has controlled approximation noise (error ~10⁻⁹). It is the standard scheme for machine learning, descriptive statistics and signal processing — exactly what inter-hospital benchmarking needs.
8 192 slots — An FHE ciphertext is not a single value: it is a vector of 8 192 packed values. You operate on all 8 192 at once. In real benchmarking production, thousands of hospitals fit in a handful of ciphertexts.
Multiplicative depth — How many chained multiplications a ciphertext supports. CKKS lets you tune it via LogQ. For mean + variance (which needs squares), 4-5 levels are enough.
~128 bits of security — Industry standard. Brute-forcing the key would require ~2128 operations — an astronomical number, infeasible even on foreseeable quantum hardware.
RLWE base — Ring Learning With Errors. The mathematical problem that underpins the security. It is the same problem over which NIST standardized post-quantum cryptography (ML-KEM, ML-DSA).
Generate collaborative keys.
In production, threshold cryptography splits the key among the 5 hospitals. Here we simplify with a single key for didactic clarity.
Generated Keys
Galois Keys
We additionally generate Galois keys to support rotation operations (needed for InnerSum over vectors of many slots). These keys are the heaviest — several MB in total.
Encrypt adjusted data.
Each hospital computes its case-mix adjusted average length of stay over its internal cohort. It encrypts that value and sends it. The aggregator NEVER sees the cleartext value.
Local data (case-mix adjusted)
Clinical note · case-mix adjustment
Comparing raw averages is invalid — Albert Einstein receives more severe stroke cases than HCor, not because of worse quality but because of case-mix (age, comorbidities, severity). Comparing raw length of stay distorts the evaluation.
Industry-standard adjustment — Serious hospital benchmarking uses the Elixhauser Comorbidity Index or Charlson Index to adjust average length of stay by cohort severity, before comparing. The adjustment is performed locally at each hospital.
In this demo — The values already represent adjusted times computed locally. FHE enters afterwards: it aggregates the adjusted values without exposing the absolute numbers.
The aggregator receives.
The 5 ciphertexts travel to a neutral aggregator (medical society, IBGE, academic consortium). The aggregator has no secret key — it cannot see any value.
Real Ciphertext Sample (first 32 bytes)
74 65 78 74 4d 65 74 61
44 61 74 61 22 3a 7b 22
53 63 61 6c 65 22 3a 7b
...
Each ciphertext has ~1.25 MB of pseudo-random bytes. Without the key, recovering 72.4h would require solving Ring-LWE at N=16384 → ~2128 operations.
Total Transferred
Statistics under encryption.
The aggregator adds the ciphertexts, multiplies by 1/N for the mean, and computes the second moment for variance. All under encryption. The aggregator never sees individual values.
The Algorithm
Real Performance
Statistics revealed.
The encrypted result is decrypted collectively. Only the aggregated statistics come out — mean, variance, standard deviation. No individual value.
Aggregated Result
Relative Position
Each hospital learns only ITS z-score:
Einstein: -0.73 ↓ below average
Sírio: +1.42 ↑ above average
HCor: -1.37 ↓ best in the group
Oswaldo: +0.76 ↑ slightly above
Moinhos: -0.07 ≈ average
Mathematical validation.
Direct comparison between the FHE computation and the plaintext computation. The CKKS approximation error is controlled and negligible for clinical analysis.
FHE vs Plaintext
| Metric | FHE | Cleartext | Error |
|---|---|---|---|
| Mean | 75.400000 | 75.400000 | 7.0e-11 |
| Variance | 16.740000 | 16.740000 | 2.0e-08 |
| Std. dev. | 4.091455 | 4.091455 | 2.5e-09 |
Result
For clinical statistical analysis, 9 decimal places of precision is dramatically more than enough.
The dishonest aggregator.
What can a dishonest aggregator extract?
Attack Attempts
- 1 — Read one hospital's ciphertextPseudo-random bytes. Nothing recoverable.
- 2 — Invert the mean to obtain individuals5 unknowns, 1 equation. Under-determined system. Individual values remain mathematically protected.
- 3 — Recover sk from pkRing-LWE at N=16384, ~2128 operations. Infeasible.
What comes out
ONLY the aggregated statistics (mean, variance, standard deviation). Each hospital learns only its relative position. The absolute numbers of the others remain mathematically impossible to recover.
What happened.
In under 1 second, five hospitals discovered their relative positions on a quality metric — without any of them exposing their absolute numbers.
The Flow
- Five hospitals locally encrypted their mean length of stay
- They sent only the ciphertexts to the neutral aggregator
- The aggregator computed mean and variance under encryption (85 ms)
- The decrypted result revealed the aggregated statistics
- Each hospital learned only its relative position