Prashant Dhingrafield notes
Field Guide · Data & Privacy Engineering · No. 02 · June 2026

Encrypted analytics, three ways: TEEs, MPC & FHE

Trusted execution environments, multi-party computation, and fully homomorphic encryption all share a common objective. Perform computations on sensitive data without revealing the raw data to an untrusted entity. however, they cannot be used interchangeably. A practical manual on their individual behaviors, capabilities for analysis, vulnerabilities, and determining when to utilize each.

Abstract · the short version
  • TEEs protect data in use within proven hardware :: extensive support for current SQL, ML, and streaming technologies, paired with top-notch latency performance.
  • MPC spreads trust among all parties to keep inputs confidential: ideal for analytics across mutually distrustful organizations.
  • FHE encryption without a server-side key: ideal for securing sensitive data. never exist server-side, especially private inference.
  • The deciding question is where trust sitswithin the CPU vendor (TEE), there is a non-collusion assumption (MPC) or cryptographic hardness (FHE) present.
  • In production, the strongest answer is often hybrid TEE is utilized for orchestration, MPC is employed for cross-party joins, and FHE is utilized for the most sensitive client-server actions.

01 :: OverviewThe three technologies at a glance

They respond to the identical query using entirely distinct tools. The most efficient method to grasp the variance is by comparing one column at a time.

TEE
Trusted Execution Environment

Isolated hardware execution protects code and data from the OS, hypervisor, and peers, allowing remote verification of running processes before sharing secrets.

Intel SGX/TDX · AMD SEV-SNP · Arm CCA Realms
MPC
Secure Multi-Party Computation

Cryptographic protocols enable parties to compute a shared function using private inputs, while only revealing the output, through secret sharing, garbled circuits, and homomorphic techniques.

MP-SPDZ · ABY3 · SecretFlow · SCQL
FHE
Fully Homomorphic Encryption

A basic feature enabling unrestricted calculations on encrypted data without the secret key :: the untrusted server works with cipher text, with decryption only performed by the client (or a designated endpoint).

OpenFHE · Microsoft SEAL · TFHE-rs · Concrete ML

For encrypted analytics specifically: TEEs enclaves or confidential VMs enable seamless integration of general SQL, joins, ETL, Spark-style batch processing, existing ML training, and streaming without significant software modifications. MPC is most effective when several data owners require combined aggregates, merges, set intersections, or privacy-preserving training without compromising plaintext to a common operator. FHE is most effective for constrained inference, vectorized arithmetic, small tabular models, and specialized encrypted data-frame operations when a client requires an untrusted service to compute on its encrypted data without relying on hardware trust assumptions.

02 :: FoundationsFoundations and the core trade-off

The decisive question is where trust sits:

  • TEEs rely on CPU vendors, firmware, attestation roots, and addressing or mitigating exploitable side channels.
  • MPC diminishes reliance on one infrastructure provider, provided that multiple parties remain honest and adhere to the corruption threshold set by the protocol, as well as ensuring the accuracy of the implementation.
  • FHE Reduces reliance on server trust and limits vulnerability to hardware attacks, but requires meticulous parameter selection, secure key management, side-channel-resistant implementations, and prevention of output and metadata exposure.

Understanding the history of these technologies is valuable. MPC can be traced back to Yao's two-party computation and the GMW extension for multi-party settings with honest majority. FHE originated from Gentry's ideal-lattice construction in 2009 and has evolved to include RLWE/LWE-based schemes with standardized security parameters. TEEs are developed by Intel (SGX, TDX), AMD (SEV-SNP, which adds memory-integrity protection against malicious hypervisors), and Arm (CCA 'Realms' overseen by a Realm Management Monitor).

A useful mental model

TEE
Confidential execution
Plaintext lives inside attested hardware
MPC
Distributed trust
Data split so no one party sees it whole
FHE
Encrypted algebra
Server computes on ciphertext, never decrypts

Core properties side by side

PropertyTEEsMPCFHE
Protection mechanismHardware isolation + attestationSecret sharing / garbled circuits / HE across partiesCiphertext-level computation
Trust anchorCPU vendor, firmware, attestation chainCorruption threshold & non-collusionCryptographic hardness & parameter correctness
Plaintext visible at runtimeYes :: inside enclave/CVM memoryNo single party sees full plaintextNo :: server sees ciphertext only
Best fitGeneral analytics on existing stacksCross-party collaborative analyticsClient-server private compute on narrow circuits/models
Hardware requirementSpecial CPU support (SGX, SEV-SNP, CCA)None intrinsicNone intrinsic; accelerators help

← swipe the table →

03 :: AnalyticsAnalytics coverage by workload

practical implications that matter. shape of analytics each supports without heroic redesignTEE technology allows for the flexibility of the system it is integrated with, whether it be a Gramine 'lift-and-shift' of unmodified Linux applications or Opaque SQL running encrypted Spark SQL in enclaves. MPC offers a wide range of capabilities, tailored to specific workloads through engineering such as MP-SPDZ protocols, ABY3 for PPML, SCQL for compiling SQL to hybrid graphs, and VaultDB and SECRECY for federated SQL. FHE, while initially supporting a limited range of functions at a lower cost, is continuously expanding with developments like OpenFHE's CKKS/BFV/BGV and scheme switching, Concrete ML's encrypted inference and data-frames, and TFHE-rs for integer/Boolean/string operations with GPU bootstrapping

WorkloadTEEsMPCFHE
Aggregationstrong
Arbitrary SQL/Spark aggregation runs naturally
strong
A core secure-computation primitive
good
Arithmetic/vectorized; depends on circuit depth
SQL select / filter / group-bystrong
Closest to plaintext execution
costlier
SCQL, VaultDB, SECRECY, SMCQL
limited
Specialized data-frames, not general SQL
Joinsstrong
Large equi-joins via existing engines
supported
Often the dominant cost center
weak
Replaced by equality circuits, PSI, narrow flows
ML inferenceexcellent
General models
strong
Common PPML settings
strong
Client-server private inference; some hybrid deep models
ML trainingstrong
Enclave XGBoost, broader confidential stacks
good
Linear, trees, collaborative; deep is costly
selective
Only some models; far narrower than inference
Streaming analyticsgood
Existing stream processors in confidential envs
specialized
Aggregate/sketch settings
weak today
Better for narrow encrypted transforms
Private set ops / entity resolutionpossible
But hardware trust stays central
excellent
PSI & private joins are mature
possible
Specialized; less turnkey than MPC

← swipe the table →

A second pattern worth highlighting is the growing role of hybridsSecretFlow integrates multiple privacy-enhancing technologies, including MPC, HE, and other PETs, into a single framework. OpenFHE offers support for threshold and multiparty extensions, while TEEs are playing a growing role in providing attestation and secret-release mechanisms for cryptographic kernels. Teams frequently turn to hybridization to balance trust minimization with acceptable latency.

04 :: SecuritySecurity guarantees and threat models

TEEs provide the most compelling narrative against a vulnerable host OS or malicious hypervisor within the vendor's threat model However, the effectiveness of the guarantees relies solely on the model's limitations and patching strategy. This caveat is not merely hypothetical:

  • Foreshadow broke core SGX confidentiality through speculative execution; Plundervolt compromised enclave integrity via undervolting.
  • Recent confidential-VM research demonstrated interrupt-based attacks against SEV-SNP and TDX.
  • Even in 2026, AMD issued bulletin AMD-SB-3034 due to a routing misconfiguration in SEV-SNP, the integrity could be compromised in privileged attack scenarios.

The conclusion is not that TEEs are unusable, but rather that TEE security is a concern. moving systems-security target, not a one-time cryptographic proof.

MPC The story behind the cleaner against a malicious cloud operator hinges on various factors such as the number of parties involved, the honesty of the majority, the nature of adversaries, and the possibility of collusion. However, it is important to note that the security of the protocol is not solely guaranteed by theorems. A study conducted in 2025 on SPDZ implementations revealed practical security issues despite the malicious-security design, emphasizing the importance of software assurance and concurrency testing.

FHE provides the cleanest server-side confidentiality As the server is never exposed to plaintext, based on the hardness of LWE/RLWE with parameters compliant with HomomorphicEncryption.org standards, it is important to note that while FHE provides strong encryption, it may not completely conceal metadata, access patterns, model structure, and outputs at the application layer. Additionally, there have been instances of implementation side channels targeting FHE libraries. Therefore, supplementary measures such as output filtering, model partitioning, or threshold decryption policies may be necessary to enhance security on top of the cryptographic protection provided by FHE.

DimensionTEEsMPCFHE
Protects vs compromised OS / hypervisorYes, by designYes, if protocol assumptions holdYes :: server runs without plaintext
Side-channel exposureHigh relative concern (microarch, interrupt/fault)Lower hardware dependence; output leakage remainsAvoids TEE boundary; impl & metadata can leak
Trust in hardware vendorHighLowLow
Trust in non-collusionLow to noneCentralUsually none (threshold decryption may add it)
Attestation / proof of environmentCore requirementNot hardware-based; correctness from protocolCircuit & cryptographic evaluation dependent

← swipe the table →

05 :: PerformancePerformance, scalability, and cost

TEEs Regularly coming out on top in terms of raw workload flexibility and often leading in latency, several statistics from existing research support this notion:

7–31%
Opaque / SGX: I/O-encryption (~7.5%) to end-to-end (~31.7%) overhead in the cited setup; oblivious mode adds ~1.2×–46×
~20 min
SECRECY: a 2M-row query on password reuse; takes approximately 1.2 hours for a recurrent C. diff query :: MPC is limited by network
~1 ms
Concrete ML: small linear / GLM models in FHE :: avoid generalizing to ensembles, deep models, or SQL

Confidential-VM TEEs outperform SGX in 'lift-and-shift' analytics due to their avoidance of SGX's per-process enclave model and small protected-memory limits; a study in 2024 found that confidential VMs on streaming workloads (NEXMark) incurred roughly an 8.5% throughput overhead. MPC Batching dramatically reduced communication latency by two to four orders of magnitude, allowing for the exchange of 100 million 64-bit shares in approximately 2 seconds. In an optimized honest-majority scenario, ABY3 showcased the ability to handle billions of AND gates per second. FHE continues to be the slowest, with standardized benchmarks indicating that the best performer varies depending on the type of workload (TFHE excels with binary circuits, while HElib is preferred for batching multiple instances), and the trend in modern fully homomorphic encryption is towards GPU or accelerator execution rather than relying solely on the CPU.

Cost & operational burden

Burden areaTEEsMPCFHE
Compute costLowest premium of the threeHigher :: multiple parties + protocol overheadHighest; acceleration often needed
Network / egressModerateOften high :: protocol messages dominateModerate, but ciphertexts/keys are large
Key managementAttestation-bound secret release + KMSMulti-party key & secret-share lifecycleClient keygen, eval keys, threshold decryption
OrchestrationAttestation, container policy, enclave/CVM schedulingParty coordination, fault handling, sessionsCompilation pipeline, circuit packaging, accelerators
Monitoring / debuggingHard :: introspection breaks trust boundaryHard :: transcripts distributed & sensitiveHard :: compiled, encrypted execution is opaque

← swipe the table →

06 :: EcosystemEcosystem, tooling, and maturity

The maturity timeline is asymmetric: MPC is the oldest in theory, TEEs are the most developed infrastructure, and FHE is the rapidly advancing practical frontier.

  • TEEs Possessing the most advanced platform ecosystem, our framework includes Intel/AMD/Arm hardware stacks, the cross-TEE Open Enclave SDK, Gramine for Linux SGX workloads, Enarx for WebAssembly portability, and Confidential Containers for Kubernetes attestation and secret delivery. The only constraint is the complexity of secure operations, not the absence of tools.
  • MPC The research tooling is well-established and becoming more accessible, with options like MP-SPDZ, ABY3, SecretFlow, and SCQL offering a variety of protocols and security models. Usability is typically achieved through limited workloads or specific policies.
  • FHE requires a fast pace: OpenFHE (wide applicability, FHE threshold, scheme swapping), Microsoft SEAL (BFV/CKKS), TFHE-rs (Boolean/integer emphasis), HEBench (performance evaluation), and Concrete ML (Python API, deployment, mixed execution). It necessitates a deeper understanding of cryptography beyond standard illustrations.
DimensionTEEsMPCFHE
Hardware / platform maturityHighNot hardware-dependentModerate, improving; accelerator ecosystem emerging
Developer abstractionStrong via enclaves/CVMs/containersModerate; improving with SQL/ML frameworksModerate for packaged ML; lower for custom analytics
Production readiness (general analytics)HighestModerateLowest for arbitrary analytics; stronger for focused inference

← swipe the table →

07 :: DispatchWhat's new in 2025–2026

Field dispatch · recently updated

The frontier moved :: especially on hardware and FHE

  • GPU TEEs went mainstream. NVIDIA Confidential Computing extends to Hopper (H100/H200) and Blackwell (B200/B300, RTX Pro 6000) GPUs, securing model parameters, activations, and KV-cache within encrypted VRAM. AWS, Azure, and Google Cloud provide CPU-TEE confidential virtual machines, while Azure also delivers end-to-end NVIDIA-CC GPU confidential virtual machines.
  • Composite attestation arrived. Intel Trust Authority and NVIDIA now verify a secure VM and a confidential-computing GPU in a single workflow, bridging a significant void in confidential AI.
  • GPU-TEE overhead is small for LLM work. Hopper CC benchmarks show that LLM-inference overhead is usually less than 7%, with minimal impact on larger models or longer sequences. The main bottleneck is the transfer between the PCIe CPU and GPU, rather than GPU compute performance. However, a survey conducted in February 2026 warns that certain GPU-TEE hardware components, such as power management and the PCIe bus, are still in early stages of development
  • FHE commercialized fast. Zama became the first FHE "unicorn" (June 2025), reports ~20–100× speedups since inception, and targets 500–1,000 TPS via GPU by end of 2026; TFHE-rs adds CUDA GPU and AMD Alveo FPGA acceleration. Apple shipped a production FHE feature (Live Caller ID Lookup) and specialized accelerators (FPGA, processing-in-memory, ASICs) are tackling the bootstrapping/off-chip-memory bottleneck.
  • Scale-out TEEs are on roadmaps. Current TEEs are limited to a single physical server, but industry trends indicate a shift towards scale-out solutions that could significantly increase deployments for confidential analytics.

The line between 'hardware-trust' and 'no-hardware-trust' privacy is becoming increasingly blurred with the rise of confidential GPUs enabling cost-effective TEE-based private AI, alongside FHE acceleration reducing the cost gap for demanding workloads.

08 :: ComplianceCompliance and operational realities

All three are best viewed as risk-reducing technical measures, not scope-elimination machinesGDPR Article 32 specifies encryption and pseudonymization as safeguards for processing security, while HIPAA's Security Rule focuses on risk-based measures for ensuring the confidentiality, integrity, and availability of ePHI. PCI DSS continues to stress the importance of retention minimization and robust cryptography. However, none of these regulations negate the need for lawful-basis analysis, data-minimization choices, auditing, retention constraints, or output governance.

Operationally, each technology centers on a different discipline:

  • TEEs center on attestation and secret release Monitoring is challenging due to the competition between introspection and confidentiality in tasks such as reference-value management, KMS integration, certificate lifecycle, image signing, and patch-driven re-attestation.
  • MPC centers on party coordination SCQL's column-control list highlights the importance of hosting compute parties, preventing collusion, rotating sessions, managing offline parties, and governing outputs. It emphasizes the necessity of implementing output policies to prevent leakage of data through permissive result policies or repeated queries that are not governed.
  • FHE centers on key and circuit lifecycle Concrete ML architecture separates client-side cryptographic parameters from server-side compiled model artifacts, highlighting that key generation may be slow and keys can be large. Additionally, it cautions that the compiled artifacts are specific to the architecture. The FHE CI/CD system is akin to a compiler toolchain combined with a crypto-parameter pipeline, rather than traditional model serving.
The shared caveat

TEE, MPC, and FHE can enhance a control environment significantly. However, they are not replacements for secure software engineering, and their security levels are still evolving within all three families. View each as a single layer in a comprehensive design, rather than a foolproof solution.

09 :: DecideDecision framework by use case

The strongest overall mapping for most analytics programs:

Use caseFirst choiceWhy · when to differ
Single-org confidential SQL / ETL / BITEEExtensive engine compatibility and optimal latency are achieved with FHE only when "no plaintext on server ever" is a strict requirement and the query set is limited.
Cross-org joins, clean rooms, collaborative aggregatesMPCEach operator has limited visibility of the data; SQL/PSI ecosystems are trustworthy. Incorporate TEE for coordination; integrate FHE for specific client-server interactions.
Private ML inference as a serviceFHE / hybridRobust confidentiality on the server side is ensured with established client/server patterns, with the option to prioritize TEE for improved latency and model flexibility over trust reduction.
Confidential ML training on existing frameworksTEETop software compatibility. MPC for collaborative training among distrusting parties; FHE currently limited to specific model classes.
Streaming analytics on sensitive dataTEETop choice for current stream processors. MPC designed for specific aggregates/sketches; FHE typically limited to narrow transformations.
Regulated sharing where hardware trust is unacceptableMPCMost secure trust reduction for multi-owner analytics. FHE recommended for single client/server scenarios with higher runtime costs.
Lowest operational friction, near-term rolloutTEEChoose MPC/FHE when trust is paramount and adherence to standard infrastructure practices is essential for optimal ecosystem support.

← swipe the table →

Boiled down: TEE-first for updating internal analytics, compliant BI, confidential feature development, and secure streaming. MPC-first Data clean rooms, federated analytics in healthcare and finance, inter-company joins, and advertising measurement. FHE-first Private inference services, encrypted client-server scoring, and specific arithmetic analytics are utilized in situations where plaintext data must never be stored on the server. Hybrid-first When all three factors of collaboration, trust, and practical performance are essential simultaneously.

10 :: ChecklistAdoption checklist

  1. State the trust requirement What enemy needs to be vanquished (host OS, cloud operator, cooperating party, the server itself)? This one response quickly narrows down the possibilities.
  2. Map the workload shape comparison of general SQL/streaming, cross-party joins, and client-server inference in relation to the analytics-coverage table.
  3. Pin the latency and cost budget, and then verify it against typical benchmarks (TEE near-native; MPC network-bound; FHE accelerator-dependent).
  4. Decide attestation and key management initial: reference values and key management systems for trusted execution environments; party/session setup and secret-sharing lifecycle for secure multi-party computation; key generation and compiled-circuit pipeline for fully homomorphic encryption
  5. Write the output-governance policy :: thresholds, permissible columns, query repetition limits :: as even accurate execution may lead to data leakage.
  6. Complete one narrow workload from start to finish, verify the security review against the actual threat model, and proceed with industrialization.
  7. Plan for hybridsWhen it comes to production, orchestrating TEE around MPC primitives or deploying FHE at the most critical client-server edge is frequently the most practical solution.

11 :: FAQFrequently asked questions

What's the difference between TEEs, MPC, and FHE? +
All three Perform computations on sensitive data without revealing the raw data to an untrusted entity., but they place trust differently. A TEE protects data in use inside attested hardware. MPC distributes trust across parties so no single one sees the inputs. FHE lets an untrusted server compute on ciphertext without the decryption key. TEEs offer the broadest compatibility, MPC fits cross-organization collaboration, and FHE offers the strongest no-plaintext-on-server guarantee for narrow workloads.
Which is best for encrypted analytics? +
Depending on the location of trust requirements, different technologies should be considered. TEEs are ideal for quick adoption over current SQL/ML/streaming stacks, while MPC is recommended for collaborative analytics among organizations with mutual distrust. For outsourced computation without server plaintext or hardware trust, FHE is suitable for specific analytics or private inference. In practice, many production systems incorporate all three technologies.
Is FHE fast enough for production in 2026? +
Although FHE still lags significantly behind plaintext in speed, the difference is quickly decreasing. Simple linear models can now be executed in approximately 1 millisecond, and GPU acceleration (including CUDA and FPGA) is becoming common in libraries such as TFHE-rs. Apple has even introduced a FHE caller-ID feature in a production setting. While FHE shows promise for private inference and arithmetic-heavy analytics, it is not yet ready to fully replace traditional SQL warehouses.
Are TEEs secure given side-channel attacks? +
TEE security should not be viewed as a fixed guarantee, as recent attacks like Foreshadow and Plundervolt have exposed vulnerabilities in interrupt-based attacks targeting SEV-SNP and TDX. Despite protections against compromised OS or hypervisor within the vendor's threat model, TEEs rely heavily on side-channel exclusions and patch posture for their security guarantees. AMD's bulletin AMD-SB-3034 in 2026 serves as a reminder that TEE security is a constantly evolving target, rather than a one-time proof.
Do these technologies remove GDPR or HIPAA obligations? +
None of the three are machines that eliminate scope; they are all risk-reducing technical measures. GDPR Article 32 includes encryption and pseudonymisation as safeguards, HIPAA's Security Rule is based on risk, and PCI DSS mandates retention minimization and strong cryptography. While they enhance control environments, they do not supplant lawful-basis analysis, data minimization, auditing, retention limits, or output governance.
What is a confidential GPU and why does it matter? +
NVIDIA Confidential Computing on Hopper and Blackwell GPUs enhances TEE protections to safeguard GPU memory and execution, ensuring that sensitive data such as model weights, activations, and KV-cache remain encrypted in VRAM, even when accessed by a privileged host. This technology, combined with a CPU TEE, enables secure and efficient private AI inference and training, with minimal overhead of around ~7% for LLM workloads.

12 :: SourcesSources & further reading

Derived from vendor documentation, original research papers, peer-reviewed benchmarks, industry standards, and upcoming announcements for 2025-