A July 2026 arXiv preprint tackles a tension at the heart of encrypted machine learning: when you replace a neural network's activation functions with polynomials — the only functions homomorphic encryption can evaluate — how wide should you set the approximation window? [S1] Set it too narrow and outlier inputs trigger uncontrolled extrapolation, corrupting results. Too wide, and the approximation error grows under the fixed degree budget that encryption imposes. The paper offers a mathematical framework to find the sweet spot — but stops short of proving it works in practice.

The problem hiding inside encrypted inference

Homomorphic encryption (HE) lets a server run computations on data it cannot read — the data stays encrypted throughout [S1]. For AI inference, that means a hospital could send encrypted patient records to a cloud model and receive encrypted predictions back, without the cloud ever seeing the raw data. HElib, an open-source library with over 3,200 GitHub stars, implements the BGV and CKKS schemes that make this possible [P5].

But there's a catch. HE supports only two operations on encrypted data: addition and multiplication [S1]. Neural networks rely on activation functions like ReLU or sigmoid — curves, not polynomials. Under encryption, those curves must be replaced by polynomial stand-ins [S1].

The standard approach is minimax approximation, typically computed via the Remez algorithm — a method that finds the polynomial minimising the worst-case error over a chosen interval [S1]. Open-source implementations of the Remez algorithm exist, such as the minimaxApprox R package on GitHub [P4]. Related work has explored dynamic programming approaches to optimise polynomial approximation layer by layer for HE inference [P2].

Why the interval width matters

Here's where the trade-off bites. A minimax polynomial is designed to approximate a function over a specific interval — say, inputs between -5 and 5. Make that interval wider, and the polynomial handles larger-magnitude inputs gracefully. But under a fixed degree budget — because higher-degree polynomials cost more multiplications, and each multiplication is expensive in HE — a wider interval means more approximation error across the board [S1].

The preprint's authors frame this as a distribution-aware optimisation problem. Instead of picking the interval by guesswork, they propose choosing it to minimise mean-squared error with respect to the actual distribution of pre-activation values — the numbers feeding into each activation function — that the model sees in practice [S1]. If most of your inputs cluster near zero, a narrow interval with a tight polynomial makes sense. If they're spread out, you need width — and pay for it in accuracy.

The clipping trick

The paper introduces a second idea to handle inputs that fall outside the design interval. Rather than letting the polynomial extrapolate wildly — which can produce catastrophically wrong values — the authors combine minimax polynomials with "domain extension functions" and their HE-realizable counterparts, "domain extension polynomials" [S1]. These approximate a clipping operation: outside the design interval, they gently squash the output instead of letting it run free [S1].

The authors derive an analytically tractable proxy objective — a simplified mathematical stand-in — that captures the trade-off between within-interval approximation error and outside-interval clipping error [S1]. They then connect this idealised objective to HE-realizable constructions through an implementation-error decomposition with an accompanying upper bound [S1]. In plain terms: they build a theory for the ideal case, then show how the gap between ideal and implementable can be bounded.

What it means

For anyone trying to run AI models on encrypted data, this paper names a problem that practitioners have likely been solving by trial and error. The interval-width trade-off is real and unavoidable: you cannot have a polynomial that is both cheap (low degree) and accurate over a wide range. What the authors contribute is a principled way to think about the choice — one that accounts for the actual data distribution rather than relying on a rule of thumb.

The domain extension polynomial idea is particularly practical. Uncontrolled polynomial extrapolation is the kind of silent failure that can corrupt an entire inference pipeline without triggering any error message. A clipping approximation that tames the tails is a defensive measure, not a performance enhancement — but in encrypted inference, where you cannot inspect intermediate values to debug, defensive measures matter disproportionately.

What it means for business

For a two-person AI consultancy building privacy-preserving tools for healthcare or finance clients, this paper is a signal that the field is maturing — but not yet ready for production handoff. The mathematical framework could eventually become part of HE inference libraries, the way the Remez algorithm already has [P4]. But today, no empirical results, benchmarks, or deployment evidence accompany the theoretical claims [S1].

A suburban legal-tech firm exploring encrypted document analysis, or a fintech startup wanting to run credit models on encrypted financial data, would still need significant in-house cryptographic expertise to implement anything like this. The paper provides no code, benchmarks, or integration guidance. It is a theoretical contribution to an active research area — one where related work on layerwise polynomial optimisation is also still in the review stage [P2].

The q-fin.GN category tag on the preprint might suggest financial-market applications [S1], but the abstract describes general HE theory with no specific financial use case. Anyone in financial services should treat the categorisation as an arXiv filing choice, not a domain claim.

What we don't know yet

The preprint is explicitly marked as not peer-reviewed [S1]. Every technical claim — the proxy objective, the upper bound, the error decomposition — is the authors' own unverified contribution. No independent verification exists.

Several critical questions remain open:

  • Does the distribution-aware interval optimisation actually reduce error in practice, or does the theoretical proxy diverge from real-world performance?
  • How do domain extension polynomials behave under the noise budget constraints of real HE schemes like BGV or CKKS [P5]?
  • What is the computational cost of the optimisation itself — cheap enough to run per-model, or per-layer, or too expensive for iterative use?
  • How does this approach compare empirically to the dynamic programming method proposed in related work [P2]?

The next concrete event to watch for is either a peer-reviewed version of this paper or a follow-up with experimental results on a standard HE benchmark. Until then, the framework is a promising blueprint, not a validated tool.

If this kind of deep-dive into the mathematics behind encrypted AI is useful to you, subscribe — we'll be tracking this paper and the broader HE inference space as it moves from preprints to practice.

Sources

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.