Homomorphic encryption — Promises, limits and fiction in CSAM detectionHomomorphic encryption — Promises, limits and fiction in CSAM detection

If you can compute on encrypted data without decrypting it, you have homomorphic encryption. If you can do it at WhatsApp scale, you have a miracle. And miracles are not a solid foundation for legislation.

---

In the Chat Control debate, fully homomorphic encryption (FHE) frequently appears as the technical solution that would reconcile scanning and privacy. The idea is seductive: a server could run a CSAM classifier on encrypted messages without decrypting them, obtaining only a binary result —"suspicious" or "not suspicious"— without accessing the content.

The promise is real. The practical feasibility, however, is another story.

What is homomorphic encryption?

A homomorphic encryption scheme allows arithmetic operations to be performed on encrypted data. Formally:

Given an encryption $E(m_1) = c_1$ and $E(m_2) = c_2$, there exists an operation $\oplus$ such that:

$$c_1 \oplus c_2 = E(m_1 \circ m_2)$$

where $\circ$ is an arithmetic operation (addition or multiplication) on the plaintexts.

Types

The crucial difference between SHE and FHE is bootstrapping: a technique that "refreshes" the accumulated noise in the ciphertext after each operation, allowing arbitrarily deep computations. Without bootstrapping, noise grows with each operation until the message becomes undecipherable.

FHE encryption:   m → E(m) → [initial noise = ε]
Addition:         E(m₁) ⊕ E(m₂) → E(m₁+m₂) → [noise ≈ 2ε]
Multiplication:   E(m₁) ⊗ E(m₂) → E(m₁·m₂) → [noise ≈ ε²]
Bootstrapping:    E(m) → E(E(m)) → homomorphic decryption → clean E(m)

The performance problem

The fundamental obstacle of FHE is performance. Operations on encrypted data are between 6 and 9 orders of magnitude slower than on plaintext. To give an idea:

WhatsApp processes approximately 100 billion messages per day (~1.16 million per second). An FHE classifier for a single image would require, in the best case, hours of computation. At global messaging scale, FHE is several orders of magnitude slower than what would be necessary.

What if the classifier is simple?

An argument sometimes heard is that a CSAM classifier does not need to be a complex neural network. It could be a simple comparison against a perceptual hash database. This would be computable with FHE... in theory.

The problem is that CSAM detection is not a hash comparison. CSAM content is not tagged with a known hash until it is identified and reported. Most of the material that current systems detect is new material not previously classified, which requires content-based classifiers (neural networks) that analyze the image or video to determine whether it contains suspicious material.

A classifier of this type requires:

• Multiple convolutional layers
• Non-linear activation functions (ReLU, sigmoid)
• Pooling layers
• Fully connected layers
• Comparison against embeddings

Each of these operations is orders of magnitude more expensive in FHE. Non-linear functions are particularly problematic because FHE only supports linear arithmetic operations (addition, multiplication), and non-linearities must be approximated through polynomials, which adds even more computation depth and requires more bootstrapping.

The classifier paradox

Even if performance were resolved (say, through specialized hardware or significant cryptographic advances), a deeper conceptual problem would remain:

To classify encrypted content as CSAM, the classifier needs to know what CSAM is. But to define CSAM, the classifier needs to see examples of CSAM.

This means that the classifier —and therefore the entity that trains, updates and deploys it— contains the knowledge of what it is looking for. That knowledge can be:

• A hash database: which can be expanded to include other content
• A neural network model: which can be fine-tuned to detect other categories
• A set of rules: which can be expanded by legal mandate

The door is not a backdoor. It is structural. The mechanism that allows detecting CSAM allows, with the same architecture, detecting anything else that the authority decides to include.

FHE (ideal):      E(m) → [FHE classifier] → yes/no
                  No one sees m. Only the verdict.

FHE (real):       E(m) → [FHE classifier] → yes/no + confidence
                  The confidence reveals information about m.
                  If the classifier is updated, the VERDICT CHANGES.
                  The authority can iterate classifiers on past data.

This last point is critical and rarely discussed. If messages are stored encrypted (and the platform retains them), a future order that updates the classifier would allow retrospectively rescanning the entire communications history. FHE does not prevent this: the classifier runs on the stored encrypted data, and the authority obtains new verdicts without ever having seen the original content.

The state of the art

As of July 2026, FHE has achieved notable advances in the laboratory:

• Small neural networks (~10 layers, ~1000 neurons): inference in minutes per sample
• Hash comparison: feasible for small databases (~10⁶ entries)
• Optimized bootstrapping: TFHE can execute a logic gate in ~10 ms

But the gap between what is feasible in the laboratory and what mass messaging requires remains several orders of magnitude:

Technical conclusion

Homomorphic encryption is not the solution the European Commission is looking for, for three reasons:

1. 
   

   Performance: FHE cannot process global messaging scale with sophisticated classifiers, and there is no indication it will be able to do so in the next decade. Advances in accelerated hardware (FPGA, ASIC) could reduce the gap, but not close it.

   
   
2. 
   

   Retrospective classification: FHE does not prevent historical rescanning of stored communications, creating a risk of deferred surveillance that the proposal does not address.

   
   
3. 
   

   Classifier expandability: the mechanism that allows detecting CSAM allows, with the same design, detecting any classifiable content. FHE does not solve the slippery slope problem; it only moves it to the algorithmic plane.

   
   

FHE is a promising technology for applications where the amount of data is moderate and the computation is simple (encrypted database queries, multiparty computation, privacy in ML models). But as a basis for a mandatory mass surveillance system, it is a solution looking for a problem it cannot solve.

---

Related documents:

• Chat Control — Definition and context
• Cifrado y vigilancia — Why mass scanning breaks E2EE
• Pruebas de conocimiento cero — Applications to the detection problem
• Alternativas al escaneo masivo