Prashant Dhingrafield notes
Field Guide · Data & Privacy Engineering · No. 02 · June 2026

Encrypted analytics, three ways: TEEs, MPC & FHE

Trusted execution environments, multi-party computation, and fully homomorphic encryption all have a shared goal. Conduct calculations on confidential information without exposing the original data to unauthorized parties. Nonetheless, they are not interchangeable. An informative guide on their unique traits, strengths in analysis, weaknesses, and guidelines for when to deploy each one.

Abstract · the short version
  • TEEs protect data in use With established hardware and robust support for SQL, ML, and streaming technologies, along with exceptional low-latency performance.
  • MPC fosters trust among all stakeholders to maintain confidentiality of inputs, making it perfect for analytics across mutually distrustful organizations.
  • FHE encryption without a server-side key: ideal for securing sensitive data. never exist server-side, especially private inference.
  • The deciding question is where trust sitsIn the CPU vendor's Trusted Execution Environment (TEE), there is a presumption of non-collusion (MPC) or the presence of cryptographic hardness (F
  • In production, the strongest answer is often hybrid TEE is used for orchestration, MPC is used for cross-party joins, and FHE is used for the most sensitive client-server operations.

01 :: OverviewThe three technologies at a glance

They answer the same question with completely different methods. The best way to understand the difference is to analyze one category at a time.

TEE
Trusted Execution Environment

Hardware execution in isolation safeguards code and data from external entities like the OS, hypervisor, and peers, enabling remote verification of processes prior to sharing sensitive information.

Intel SGX/TDX · AMD SEV-SNP · Arm CCA Realms
MPC
Secure Multi-Party Computation

Cryptographic protocols allow parties to jointly compute a function using their private inputs, while only disclosing the output, using secret sharing, garbled circuits, and homomorphic encryption methods.

MP-SPDZ · ABY3 · SecretFlow · SCQL
FHE
Fully Homomorphic Encryption

One key function allows for unlimited computations on encrypted data without the need for the secret key :: the server operates on cipher text, and decryption is exclusively done by the client (or a specified endpoint).

OpenFHE · Microsoft SEAL · TFHE-rs · Concrete ML

For encrypted analytics specifically: TEEs Enclaves or confidential VMs allow for the smooth integration of common SQL, joins, ETL, batch processing similar to Spark, pre-existing ML training, and streaming with minimal software adjustments. MPC Works best when multiple data owners need to combine aggregates, merge sets, intersect sets, or train in a privacy-preserving manner without exposing plaintext to a central operator. FHE is optimal for limited inference, vectorized calculations, compact tabular models, and specialized encrypted data-frame operations when a client needs an untrusted service to perform computations on its encrypted data without depending on hardware trust assumptions.

02 :: FoundationsFoundations and the core trade-off

The decisive question is where trust sits:

  • TEEs Trust in CPU vendors, firmware, attestation roots, and methods to address or prevent exploitable side channels.
  • MPC Lessens dependence on a single infrastructure provider, as long as various parties uphold integrity and comply with the corruption threshold outlined by the protocol, while also verifying the correctness of the execution.
  • FHE Decreases dependence on server trust and minimizes susceptibility to hardware attacks, however, necessitates careful parameter selection, secure key management, side-channel-resistant implementations, and protection against output and metadata disclosure.

The historical background of these technologies is significant. MPC has its roots in Yao's two-party computation and the GMW extension for multi-party scenarios with an honest majority. FHE was first conceptualized by Gentry in 2009 using ideal-lattice constructions and has since advanced to incorporate RLWE/LWE-based schemes with standardized security parameters. TEEs have been created by various companies such as Intel (SGX, TDX), AMD (SEV-SNP, which enhances memory-integrity protection against malicious hypervisors), and Arm (CCA 'Realms' managed by a Realm Management Monitor).

A useful mental model

TEE
Confidential execution
Plaintext lives inside attested hardware
MPC
Distributed trust
Data split so no one party sees it whole
FHE
Encrypted algebra
Server computes on ciphertext, never decrypts

Core properties side by side

PropertyTEEsMPCFHE
Protection mechanismHardware isolation + attestationSecret sharing / garbled circuits / HE across partiesCiphertext-level computation
Trust anchorCPU vendor, firmware, attestation chainCorruption threshold & non-collusionCryptographic hardness & parameter correctness
Plaintext visible at runtimeYes :: inside enclave/CVM memoryNo single party sees full plaintextNo :: server sees ciphertext only
Best fitGeneral analytics on existing stacksCross-party collaborative analyticsClient-server private compute on narrow circuits/models
Hardware requirementSpecial CPU support (SGX, SEV-SNP, CCA)None intrinsicNone intrinsic; accelerators help

← swipe the table →

03 :: AnalyticsAnalytics coverage by workload

practical implications that matter. shape of analytics each supports without heroic redesignTEE technology provides flexibility to integrated systems, whether it involves migrating unmodified Linux applications with Gramine's 'lift-and-shift' approach or running encrypted Spark SQL in enclaves. MPC offers a variety of capabilities, customized for specific workloads through protocols like MP-SPDZ, ABY3, SCQL, VaultDB, and SECRECY. FHE, initially limited in function and cost, is expanding with advancements such as OpenFHE's CKKS/BFV/BGV, Concrete ML's encrypted inference and data-frames, and TFHE-rs for integer/Boolean/string operations with GPU bootstrapping.

WorkloadTEEsMPCFHE
Aggregationstrong
Arbitrary SQL/Spark aggregation runs naturally
strong
A core secure-computation primitive
good
Arithmetic/vectorized; depends on circuit depth
SQL select / filter / group-bystrong
Closest to plaintext execution
costlier
SCQL, VaultDB, SECRECY, SMCQL
limited
Specialized data-frames, not general SQL
Joinsstrong
Large equi-joins via existing engines
supported
Often the dominant cost center
weak
Replaced by equality circuits, PSI, narrow flows
ML inferenceexcellent
General models
strong
Common PPML settings
strong
Client-server private inference; some hybrid deep models
ML trainingstrong
Enclave XGBoost, broader confidential stacks
good
Linear, trees, collaborative; deep is costly
selective
Only some models; far narrower than inference
Streaming analyticsgood
Existing stream processors in confidential envs
specialized
Aggregate/sketch settings
weak today
Better for narrow encrypted transforms
Private set ops / entity resolutionpossible
But hardware trust stays central
excellent
PSI & private joins are mature
possible
Specialized; less turnkey than MPC

← swipe the table →

A second pattern worth highlighting is the growing role of hybridsSecretFlow combines various privacy-enhancing technologies, such as MPC, HE, and other PETs, within one platform. OpenFHE provides assistance for threshold and multiparty extensions, with TEEs increasingly used for attestation and secret-release functions in cryptographic kernels. Teams often opt for hybrid approaches to maintain a balance between minimizing trust and ensuring acceptable latency.

04 :: SecuritySecurity guarantees and threat models

TEEs present a strong narrative opposing a vulnerable host operating system or a malicious hypervisor within the vendor's threat model The guarantees' effectiveness depends entirely on the model's limitations and patching strategy, a factor that is not just theoretical, but crucial.

  • Foreshadow broke core SGX confidentiality through speculative execution; Plundervolt compromised enclave integrity via undervolting.
  • Recent confidential-VM research demonstrated interrupt-based attacks against SEV-SNP and TDX.
  • Even in 2026, AMD issued bulletin AMD-SB-3034 A routing misconfiguration in SEV-SNP could potentially compromise integrity in privileged attack scenarios.

The takeaway is not that TEEs are ineffective, but instead that TEE security is a significant worry. moving systems-security target, not a one-time cryptographic proof.

MPC The dispute between the cleaner and the cloud operator depends on factors like the parties involved, their honesty, adversaries, and collusion potential. It's essential to recognize that protocol security isn't completely ensured by theorems. A 2025 study on SPDZ implementations exposed security problems despite the malicious-security design, highlighting the need for software assurance and concurrency testing.

FHE provides the cleanest server-side confidentiality Since the server never sees plaintext, it's crucial to consider that while FHE offers robust encryption, it may not fully hide metadata, access patterns, model structure, and outputs at the application level due to the complexity of LWE/RLWE with HomomorphicEncryption.org standards. Moreover, there have been cases of implementation side channels targeting FHE libraries. Thus, additional precautions like output filtering, model partitioning, or threshold decryption policies may be needed to bolster security beyond FHE's cryptographic safeguards.

DimensionTEEsMPCFHE
Protects vs compromised OS / hypervisorYes, by designYes, if protocol assumptions holdYes :: server runs without plaintext
Side-channel exposureHigh relative concern (microarch, interrupt/fault)Lower hardware dependence; output leakage remainsAvoids TEE boundary; impl & metadata can leak
Trust in hardware vendorHighLowLow
Trust in non-collusionLow to noneCentralUsually none (threshold decryption may add it)
Attestation / proof of environmentCore requirementNot hardware-based; correctness from protocolCircuit & cryptographic evaluation dependent

← swipe the table →

05 :: PerformancePerformance, scalability, and cost

TEEs Consistently excelling in raw workload flexibility and frequently taking the lead in latency, various statistics from current research corroborate this idea:

7–31%
Opaque / SGX: I/O-encryption (~7.5%) to end-to-end (~31.7%) overhead in the cited setup; oblivious mode adds ~1.2×–46×
~20 min
MPC is restricted by network when executing a 2M-row query on password reuse, which typically takes around 1.2 hours for a recurring C. diff query.
~1 ms
Concrete ML focuses on using small linear or GLM models in FHE while explicitly avoiding generalizing to ensembles, deep models, or SQL.

A study conducted in 2024 showed that Confidential-VM TEEs are more efficient than SGX for 'lift-and-shift' analytics, thanks to their avoidance of SGX's per-process enclave model and small protected-memory limits. The study found that confidential VMs running on streaming workloads (NEXMark) experienced approximately an 8.5% throughput overhead. MPC Batch processing significantly decreased communication latency by two to four orders of magnitude, enabling the transfer of 100 million 64-bit shares in about 2 seconds. In an ideal honest-majority setting, ABY3 demonstrated the capacity to process billions of AND gates per second. FHE remains the slowest, as standardized benchmarks show that the top performer varies based on workload type (TFHE is strong with binary circuits, while HElib is favored for batching multiple instances), with a shift in modern fully homomorphic encryption towards GPU or accelerator execution rather than solely relying on the CPU.

Cost & operational burden

Burden areaTEEsMPCFHE
Compute costLowest premium of the threeHigher :: multiple parties + protocol overheadHighest; acceleration often needed
Network / egressModerateOften high :: protocol messages dominateModerate, but ciphertexts/keys are large
Key managementAttestation-bound secret release + KMSMulti-party key & secret-share lifecycleClient keygen, eval keys, threshold decryption
OrchestrationAttestation, container policy, enclave/CVM schedulingParty coordination, fault handling, sessionsCompilation pipeline, circuit packaging, accelerators
Monitoring / debuggingHard :: introspection breaks trust boundaryHard :: transcripts distributed & sensitiveHard :: compiled, encrypted execution is opaque

← swipe the table →

06 :: EcosystemEcosystem, tooling, and maturity

The maturity timeline is asymmetric: MPC is the oldest conceptually, TEEs boast the most advanced infrastructure, and FHE is quickly advancing on the practical frontier.

  • TEEs With the most cutting-edge platform ecosystem, our framework integrates Intel/AMD/Arm hardware stacks, the cross-TEE Open Enclave SDK, Gramine for Linux SGX workloads, Enarx for WebAssembly portability, and Confidential Containers for Kubernetes attestation and secret delivery. The complexity of secure operations is the only limitation, not the lack of available tools.
  • MPC Research tooling such as MP-SPDZ, ABY3, SecretFlow, and SCQL are widely used and increasingly available, providing a range of protocols and security measures. Usability is often achieved through restricted workloads or defined policies.
  • FHE demands a quick tempo: OpenFHE (diverse applications, FHE threshold, scheme interchange), Microsoft SEAL (BFV/CKKS), TFHE-rs (focus on Boolean/integer), HEBench (evaluating performance), and Concrete ML (Python API, deployment, mixed execution). It calls for a more profound comprehension of cryptography beyond conventional examples.
DimensionTEEsMPCFHE
Hardware / platform maturityHighNot hardware-dependentModerate, improving; accelerator ecosystem emerging
Developer abstractionStrong via enclaves/CVMs/containersModerate; improving with SQL/ML frameworksModerate for packaged ML; lower for custom analytics
Production readiness (general analytics)HighestModerateLowest for arbitrary analytics; stronger for focused inference

← swipe the table →

07 :: DispatchWhat's new in 2025–2026

Field dispatch · recently updated

The frontier moved :: especially on hardware and FHE

  • GPU TEEs went mainstream. NVIDIA Confidential Computing now covers Hopper (H100/H200) and Blackwell (B200/B300, RTX Pro 6000) GPUs, ensuring the encryption of model parameters, activations, and KV-cache stored in VRAM. AWS, Azure, and Google Cloud offer CPU-TEE confidential virtual machines, with Azure also providing end-to-end NVIDIA-CC GPU confidential virtual machines.
  • Composite attestation arrived. Intel Trust Authority and NVIDIA collaborate to validate a secure VM and confidential-computing GPU in one streamlined process, addressing a critical gap in confidential AI.
  • GPU-TEE overhead is small for LLM work. Hopper CC benchmarks indicate that LLM-inference overhead typically remains below 7%, with minimal effect on larger models or extended sequences. The primary bottleneck lies in the data transfer between the PCIe CPU and GPU, rather than the GPU's computational capabilities. Nonetheless, a survey carried out in February 2026 cautions that specific GPU-TEE hardware elements, like power management and the PCIe bus, are still in their initial development phases.
  • FHE commercialized fast. Zama became the first FHE "unicorn" (June 2025), reports ~20–100× speedups since inception, and targets 500–1,000 TPS via GPU by end of 2026; TFHE-rs adds CUDA GPU and AMD Alveo FPGA acceleration. Apple shipped a production FHE feature (Live Caller ID Lookup) along with specialized accelerators (FPGA, processing-in-memory, ASICs) are addressing the bootstrapping/off-chip
  • Scale-out TEEs are on roadmaps. The current trend in the industry is moving away from single physical server TEEs towards scale-out solutions, which could greatly expand the use of confidential analytics.

The distinction between 'hardware-trust' and 'no-hardware-trust' privacy is fading as confidential GPUs make TEE-based private AI more affordable and FHE acceleration narrows the cost difference for complex tasks.

08 :: ComplianceCompliance and operational realities

All three are best viewed as risk-reducing technical measures, not scope-elimination machinesGDPR Article 32 requires encryption and pseudonymization for security during processing, while HIPAA's Security Rule emphasizes risk-based measures to protect ePHI integrity. PCI DSS highlights retention minimization and strong cryptography. However, lawful-basis analysis, data-minimization choices, auditing, retention constraints, and output governance remain essential under these regulations.

Operationally, each technology centers on a different discipline:

  • TEEs center on attestation and secret release Monitoring becomes difficult because of the balance needed between introspection and confidentiality when managing reference values, integrating KMS, managing certificate lifecycles, signing images, and re-attesting patches.
  • MPC centers on party coordination The importance of hosting compute parties, preventing collusion, rotating sessions, managing offline parties, and governing outputs is highlighted in SCQL's column-control list, emphasizing the need to implement output policies to prevent data leakage through permissive result policies or unregulated repeated queries.
  • FHE centers on key and circuit lifecycle Concrete ML architecture distinguishes between client-side cryptographic parameters and server-side compiled model artifacts, emphasizing the potential slowness of key generation and the large size of keys. It also warns that the compiled artifacts are unique to the architecture. The FHE CI/CD system resembles a compiler toolchain integrated with a crypto-parameter pipeline, rather than the usual model serving approach.
The shared caveat

TEE, MPC, and FHE have the potential to greatly improve a control environment. Nevertheless, they should not be seen as substitutes for secure software engineering, as their security capabilities are continuously developing across all three categories. It is advisable to consider them as individual components within a holistic design approach, rather than as foolproof measures.

09 :: DecideDecision framework by use case

The strongest overall mapping for most analytics programs:

Use caseFirst choiceWhy · when to differ
Single-org confidential SQL / ETL / BITEEFor FHE to achieve extensive engine compatibility and optimal latency, it is essential to strictly adhere to the requirement of 'no plaintext on server ever' and limit the query set.
Cross-org joins, clean rooms, collaborative aggregatesMPCOperators are constrained by limited data visibility, but the SQL/PSI ecosystems are deemed reliable. Utilize TEE for coordination and integrate FHE for client-server interactions.
Private ML inference as a serviceFHE / hybridStrong confidentiality is guaranteed on the server side through established client/server patterns, with the choice to prioritize Trusted Execution Environments (TEE) for enhanced speed and flexibility without compromising trust.
Confidential ML training on existing frameworksTEEHigh compatibility with software. MPC enables collaborative training between parties with trust issues; FHE restricted to certain model classes at the moment.
Streaming analytics on sensitive dataTEEPreferred option for present stream processors. MPC tailored for particular aggregates/sketches; FHE generally constrained to specific transformations.
Regulated sharing where hardware trust is unacceptableMPCBest trust reduction method for multi-owner analytics. Fully Homomorphic Encryption (FHE) suggested for single client/server situations with increased runtime expenses.
Lowest operational friction, near-term rolloutTEESelecting MPC/FHE is crucial when trust is of utmost importance and following standard infrastructure practices is necessary for optimal ecosystem support.

← swipe the table →

Boiled down: TEE-first to update internal analytics, adhere to BI regulations, work on confidential feature development, and ensure secure streaming. MPC-first Clean rooms for data, federated analytics in healthcare and finance, cross-company joins, and measuring advertising effectiveness. FHE-first Private inference services, encrypted client-server scoring, and specific arithmetic analytics are employed in cases where storing plaintext data on the server is not permissible. Hybrid-first When collaboration, trust, and practical performance are all equally crucial at the same time.

10 :: ChecklistAdoption checklist

  1. State the trust requirement Which adversary must be defeated (host OS, cloud operator, cooperating party, the server itself)? This single answer effectively limits the potential threats.
  2. Map the workload shape Examining the analytics-coverage table reveals the differences between general SQL/streaming, cross-party joins, and client-server inference.
  3. Pin the latency and cost budget, and then confirm it using standard benchmarks (TEE close to native performance; MPC limited by network speed; FHE relies on accelerator).
  4. Decide attestation and key management initial: establishment of reference values and key management systems for trusted execution environments; creation of party/session setup and secret-sharing lifecycle for secure multi-party computation; development of key generation and compiled-circuit pipeline for fully homomorphic encryption
  5. Write the output-governance policy :: thresholds, allowable columns, and query repetition constraints :: as even precise implementation can result in data exposure.
  6. Finish one specific task from beginning to end, confirm security assessment aligns with threat model, then move forward with industrialization.
  7. Plan for hybridsFor production purposes, implementing TEE alongside MPC primitives or utilizing FHE at the crucial client-server edge is often the most feasible approach.

11 :: FAQFrequently asked questions

What's the difference between TEEs, MPC, and FHE? +
All three Conduct calculations on confidential information without exposing the original data to unauthorized parties., but they place trust differently. A TEE protects data in use inside attested hardware. MPC distributes trust across parties so no single one sees the inputs. FHE lets an untrusted server compute on ciphertext without the decryption key. TEEs offer the broadest compatibility, MPC fits cross-organization collaboration, and FHE offers the strongest no-plaintext-on-server guarantee for narrow workloads.
Which is best for encrypted analytics? +
Various technologies should be considered based on where trust requirements are located. Trusted Execution Environments (TEEs) are well-suited for rapid implementation compared to existing SQL/ML/streaming stacks, while Secure Multi-Party Computation (MPC) is preferred for collaborative analytics between organizations with shared distrust. Fully Homomorphic Encryption (FHE) is appropriate for specific analytics or private inference when there is no trust in server plaintext or hardware. In reality, many production systems integrate all three technologies.
Is FHE fast enough for production in 2026? +
While FHE is still slower than plaintext, the gap is narrowing. Basic linear models can now run in about 1 millisecond, and GPU acceleration is becoming more widespread in libraries like TFHE-rs. Apple has even incorporated a FHE caller-ID feature in a real-world application. Although FHE holds potential for private inference and data-heavy analytics, it is not yet prepared to entirely replace conventional SQL warehouses.
Are TEEs secure given side-channel attacks? +
Viewing TEE security as a static guarantee is not advisable, given recent attacks such as Foreshadow and Plundervolt that have revealed vulnerabilities in interrupt-based attacks on SEV-SNP and TDX. Despite defenses against compromised OS or hypervisor within the vendor's threat model, TEEs heavily depend on side-channel mitigations and patch management for security assurances. AMD's bulletin AMD-SB-3034 in 2026 emphasizes that TEE security is an ever-changing objective, not a one-off demonstration.
Do these technologies remove GDPR or HIPAA obligations? +
The three techniques discussed - encryption, pseudonymisation, and retention minimization with strong cryptography - are all risk-reducing measures rather than scope-eliminating machines. They are outlined in GDPR Article 32, HIPAA's Security Rule, and PCI DSS. While they improve control environments, they do not replace the need for lawful-basis analysis, data minimization, auditing, retention limits, or output governance.
What is a confidential GPU and why does it matter? +
By implementing NVIDIA Confidential Computing on Hopper and Blackwell GPUs, TEE protections are enhanced to secure GPU memory and execution. This ensures that confidential data like model weights, activations, and KV-cache are encrypted in VRAM, even when accessed by a privileged host. This innovative technology, when paired with a CPU TEE, enables secure and efficient private AI inference and training, with only a minimal overhead of approximately 7% for LLM workloads.

12 :: SourcesSources & further reading

Sourced from vendor documents, research papers, peer-reviewed benchmarks, industry norms, and future forecasts for 2025-