Output Policies for Anomaly Detection with Homomorphic Encryption: Threshold Resolution, Decision Preservation, and Numerical Stability

What it is

This paper (IACR eprint 2026/2349) proposes and evaluates "output policies" — rules for how much a CKKS homomorphic-encryption anomaly detector reveals in its scores and decisions — for intrusion-detection systems using autoencoder scoring. Authors: Subeen Cho, Jiwon Bang, Minseo Kim, Seungwon Lee, Hwajeong Seo. The summary already covers the headline numbers (99.86% decision preservation, 0.817 balanced accuracy for surrogate attacks on 128 queries); this adds the specific mechanisms, ranges, and failure modes behind those numbers.

How it works

The paper tests two policy levers: a query cap (limiting how many score/decision responses an attacker can get) and released-score quantization (coarsening the numeric score before output, distinguishing internal-score vs. released-score decisions). Threshold estimation is tested by binary-search-style boundary probing across 45 plaintext experiments (3 datasets × 3 scoring models × 5 seeds) and 45 CKKS experiments (3 datasets × 5 autoencoder seeds × 3 independent keys) — thresholds were recovered in every single run. Decision-prediction leakage is tested separately via surrogate models trained only on decision-only (not score) responses.

Preconditions / Affected

Applies to CKKS-based anomaly/intrusion-detection deployments that expose either raw anomaly scores or binary decisions to a querying party (e.g., a client or adversary probing the service). Results are over three intrusion-detection datasets, including CIC-IDS2017.

What to do

Specific, previously-unstated figures from the page:

• A 16-query cap stopped every plaintext threshold-search baseline, but across 512 separate usage requests it only served 16 of them — i.e., the cap breaks legitimate availability almost entirely while defending against threshold search.
• Surrogate attack accuracy is highly split-dependent: with a CIC-IDS2017 weekday split and training-only preprocessing, model-wise balanced accuracy for predicting decisions was 0.816–0.911; but separating by time and Flow ID across five resampled evaluations dropped model-wise mean accuracy to ~0.5 (chance level). This means the main actionable defense implied is controlling how train/eval data is split/temporally separated, not just limiting query volume.
• Quantization isn't static-safe: threshold-dependent reselection of quantization width changed responses that had matched under fixed widths — i.e., an adaptive quantizer can leak information a fixed one wouldn't.
• Even at CKKS boundary conditions, quantization isn't perfectly decision-preserving: 1 released-decision mismatch occurred in 57 boundary queries.

flowchart TD
    A[Query policy choice] -->|Query cap e.g. 16| B[Blocks threshold search]
    B --> C[But only serves 16 of 512 legit requests]
    A -->|Score quantization| D[Preserves ~99.86% decisions]
    D --> E[Fixed width: stable]
    D --> F[Adaptive/threshold-dependent width: flips responses]
    A -->|Decision-only output| G[Surrogate attack]
    G -->|Random split| H[0.817 balanced accuracy]
    G -->|Time/FlowID-separated split| I[~0.5 balanced accuracy]

Caveats

The paper itself frames numerical-threshold leakage and decision-prediction leakage as requiring separate defenses — a policy tuned against one (e.g., quantization against threshold search) does not necessarily protect against the other, and the authors report the adaptive-quantization and boundary-mismatch cases as evidence that no single policy tested was fully decision-preserving under all conditions.