Skip to content

Release Notes

2.0.0 | 2026/10/15

2.0.0 is the first major release since April 2025. It introduces exciting new features that make FHE applications easier to develop and faster to run. This release is the result of six months of development and over 1,500 pull requests.

As a major release, 2.0.0 includes breaking changes that would not be introduced in a regular minor (feature) release. To migrate to 2.0, please refer to link in addition to these release notes.

Highlights

  • Unified CKKS and GL Backend: CKKS and GL now share the same data structures and computation backend. This allows future improvements to benefit both schemes simultaneously. Previously, most optimizations were applied only to CKKS operations.
  • Compact Representation Only: compact is now the default and only supported representation for CKKS. Support for compact in GL is under development and will be available soon.
  • Async GPU Mode by Default: async gpu mode is now the default and only supported option for NVIDIA GPUs. This change also significantly improves GL performance.
  • Evaluation Key: A new unified key, the Evaluation Key, can be used for all operations that require a key, except encryption and decryption. This greatly simplifies operations such as bootstrapping, which previously required three to four separate keys as arguments.

New Features

  • Multi-GPU Support: Engines in gpu mode with different device IDs can now coexist within the same process. This makes it easier to develop applications that use multiple GPUs.
  • Overlapping GPU Transfers and Computation: GPU data transfers and computations can now overlap when using two or more separate engines in gpu mode. If engine A attempts to access a data structure that engine B is still transferring to the GPU, engine A automatically waits for engine B's data transfer to complete before proceeding. No additional synchronization is required. Finer-grained synchronization will be introduced in the future.
  • Bootstrap Key Reuse: Bootstrap keys can now be used for roll, roll_many, and rotate, eliminating the need for separate roll or rotation keys and reducing memory requirements. Support for rotate_many will be added soon.
  • More Multiparty Levels: CKKS multiparty operations now support significantly more multiplicative levels.
  • GL Parallel Mode: GL now supports parallel mode, allowing multiple CPU threads to accelerate all operations.
  • GL Serialization: GL data structures can now be serialized and deserialized, making it easier to develop distributed applications.
  • GL CPU/GPU Data Transfers: GL now supports to_cpu and to_cuda, allowing data structures to move between CPU and GPU memory. This is particularly useful for applications where not all data structures can fit in GPU memory simultaneously.
  • GL Memory Size Properties: GL data structures now provide nbytes and serialized_nbytes properties. Representative sizes are available in link.
  • GL Public Key: GL now supports public keys, allowing messages to be encrypted without exposing the secret key.
  • GL Constant Arithmetic: GL now supports addition, subtraction, and multiplication between ciphertexts and constant values.
  • GL Polynomial Operations: make_power_basis and weighted_sum are now available for GL.
  • Public Security Parameters: The library's security parameters are now publicly documented. Please refer to link for details.

Optimizations

  • Faster Bootstrapping: Bootstrapping is approximately 15% faster.
  • Optimized Key Switching and Rescaling: Key switching and rescale operations have been optimized.
  • GL Performance Improvements: All GL operations have been rewritten and optimized to the same level as CKKS operations.
  • Faster Multiparty Operations: Multiparty operations are now up to twice as fast at a given level.
  • Reduced Key Memory Usage: Memory usage has been reduced by approximately 3% for all keys except secret keys, public keys, relinearization keys, and small bootstrap keys.
  • Faster Random Number Generation: Random number generation has been optimized. It is used internally during all key generation, encryption, and multiparty decryption operations.

Breaking Changes

This major release introduces several breaking changes. In general, the removed features and configurations offered limited practical value or saw little actual use, while significantly increasing maintenance and testing costs.

Serialization Format

  • New Serialization Format: The serialization format has been completely redesigned to accommodate the many new features and optimizations planned for future releases.
  • No Backward Compatibility: The new format is not backward-compatible with previous releases. The extensive changes made maintaining backward compatibility impractically complex. Breaking changes of this kind will not be introduced in regular minor (feature) releases.

Engine Construction

  • Keyword-Only Arguments: All arguments to the Engine constructor must now be passed as keyword arguments. This prevents accidentally passing values to the wrong parameters.
  • Renamed Arguments: use_bootstrap and use_multiparty have been renamed to bootstrap and multiparty, respectively.
  • Default Engine Configuration: Creating an engine without arguments is still supported. The default configuration is a CKKS engine with seven multiplicative levels.

Matrix Multiplication and Sparse Encoding

  • CKKS Matrix Multiplication Removed: CKKS matrix multiplication is no longer supported. Without sparse encoding, matrix sizes became too large, making both runtime and memory requirements impractical.
  • Sparse Encoding Removed: Sparse encoding is no longer supported. Although it was introduced to reduce matrix sizes, reducing them too aggressively also decreased throughput.
  • Future Matrix Multiplication Support: Current research increasingly focuses on efficient packing techniques for CKKS matrix multiplication rather than sparse encoding. Although GL is now available, its required shapes may still be too large for smaller applications. We plan to provide example code or a library feature to make CKKS matrix multiplication easier to implement in the future.

Bootstrapping

  • 17-Level Bootstrapping Only: Bootstrapping to 17 levels is now the only supported configuration. Among the three regular bootstrap variants available in previous releases, this variant provides the most levels and the lowest error, with minimal performance degradation.
  • Lossy and Sign Bootstrapping Removed: Lossy bootstrapping is no longer supported because its error was too high for practical use. Sign bootstrapping has also been removed because no compelling use case was identified.
  • Deprecated mod_raise and Custom Secrets: mod_raise and secret keys with custom secret values are now deprecated. These features were originally intended to support custom bootstrapping operations, which are no longer possible with the modulus configuration used for 17-level bootstrapping.
  • Large Bootstrap Key Removed: The large bootstrap key is no longer available. GPU implementations have been optimized to the point where larger keys can actually slow down computation, even when they reduce the total number of operations. Support for larger bootstrap keys may be reintroduced in the future using different optimization techniques.
  • Custom Stage Counts Removed: Specifying bootstrap stage counts is no longer supported. This option was available only for 10-level bootstrapping.

Large CKKS Parameters

  • 32,768 Slots Removed: CKKS configurations with 32,768 slots are no longer supported. Their key sizes were too large for practical use, and encoding and decoding errors were excessive at low levels (approximately levels 0–5).
  • Alternative for Higher Levels: Applications requiring more than the 36 levels provided by the largest CKKS engine can use a bootstrap-enabled engine.

GL Shapes

  • Maximum Innermost Dimension of 256: Some GL keys are larger than others by a factor proportional to the innermost dimension. GL shapes with an innermost dimension greater than 256 are no longer supported because their memory requirements were impractically high.
  • New Batch Counts of 162 and 486: New batch counts of 162 and 486, based on Euler's totient function of powers of 3, are now supported. Additional batch counts based on powers of 5 and 7 are planned. For currently supported shapes, please refer to link.

Rotation and Roll

  • Distinct Shift Directions: roll and rotate now use different shift directions. roll shifts elements to the right, while rotate shifts them to the left. The term rotate is commonly used by FHE experts, whereas roll is more familiar to data scientists. Both directions are now supported to accommodate these conventions. For more details, please refer to link.
  • Migration from rotate to roll: To preserve the previous shift direction, replace existing rotate calls with roll calls. Code already using roll, which was introduced in version 1.15, should continue to work without changes.
  • Unified Roll Keys: Fixed roll keys and roll keys are now available for both CKKS and GL. They provide the same functionality as the fixed rotation keys and rotation keys from previous releases.
  • Fixed Roll Keys for GL: Fixed roll keys are newly available for GL, which previously did not support fixed rotation keys.
  • New axis Property: Fixed roll keys now provide an axis property for GL. For CKKS, this property is None.
  • Keyword-Only level Argument: The level parameter must now be passed as a keyword argument to avoid confusion between the three integer parameters: shift, axis, and level.

CUDA Support

  • CUDA 13.2 and 13.4 Only: Older CUDA versions are no longer supported. The library now supports only CUDA 13.2 and 13.4. This reduces build and maintenance costs, simplifies testing, and allows development to focus on newer CUDA toolchains.
  • CUDA 13.0 Compiler Bug: CUDA 13.0 contains a compiler bug that can silently produce incorrect results in kernels with nested thread divergence. The issue was introduced in CUDA 12.8 and fixed in CUDA 13.2.2, making CUDA 13.2 and 13.4 the preferred supported versions. Although this bug has not been reproduced in the library, CUDA 13.0 support is being dropped as a preventive measure.

Custom Parameters

  • Custom Parameters Removed: Manually specifying the logarithm of the coefficient count and the number of special primes is no longer supported. These options were rarely used and offered little practical benefit.

GL Hadamard Multiplication

  • Renamed multiply Method: hadamard_multiply has been renamed to multiply to align with CKKS semantics.
  • Renamed Relinearization Key: The Hadamard multiplication key has been renamed to the relinearization key.
  • Multiplication Without Relinearization: Hadamard multiplication (now simply multiply) can be performed without a relinearization key. The resulting ciphertext contains three polynomials instead of the usual two and can be decrypted directly without relinearization, saving computation time. Additional operations on three-polynomial ciphertexts will be introduced in future releases.

1.17.0 | 2026/09/28

  • Improved the performance of the key switching operation. This applies to conjugation, rotation, relinearization and bootstrap.
  • Fixed bug where the following two parameters were not applied the gpu mode: cuda_ntt_thread_count and cuda_random_thread_count.

1.16.0 | 2026/08/05

  • Improved the performance of the NTT and the INTT operations in the parallel mode.
  • Improved the performance of the compact mode on the gpu and async gpu modes.
  • Added two new tunable parameters for the gpu and async gpu modes: cuda_ntt_thread_count and cuda_random_thread_count. These allow the CUDA thread counts for NTT and random operations to be configured independently of thread_count. The default values are 512 for both parameters in all GPU modes. Additionally, the default value of thread_count for the async gpu mode has been increased to 1024.

1.15.1 | 2026/07/14

  • Improved overall GPU performance.
  • GL ciphertexts can now be multiplied with double or integer constants.
  • Fixed a bug introduced in 1.15.0 that caused bootstrap to have larger errors.
  • Fixed a bug where trying to call encode_matrix a pytorch tensor that is on cpu crashed the engine in the gpu or async gpu mode.

1.15.0 | 2026/07/08

  • Improved overall GPU performance. CKKS Bootstrap in async gpu mode is now 2-3 times faster, depending on the GPU.
  • Added the roll method for CKKS ciphertexts and plaintexts. For now, it is an alias of the existing rotate function. Starting from version 2.0 , which is planned for release later this year, rotate will mean left rotation, as is commonly used in FHE literature, while roll will mean right rotatation, as used in numpy.
  • Fixed a bug where calling multiply_matrix with a CKKS ciphertext in NTT form would produce an incorrect result when the ciphertet level matched the plain matrix level.

1.14.1 | 2026/06/22

  • Fixed bug where the engine in the async gpu mode did not read the bootstrap key or the matrix multiplication key correctly.

1.14.0 | 2026/06/01

  • The bootstrap parameters for the 14-level configuration in compact mode have been updated to improve accuracy. The previous parameters provided insufficient accuracy for practical use. As a result, data structures generated by older versions of the library under this configuration are not compatible with this version and later releases.
  • CUDA 13.2 is now supported.

1.13.0 | 2026/05/06

  • A new parameter set now allows ciphertexts to retain up to 17 levels after bootstrap. Previously, the bootstrap operation could leave at most 14 levels. Lossy and sign bootstrap are not supported with this new parameter set. Please note that this is an experimental implementation, and ciphertexts and keys generated with it may not be compatible with future releases.
  • async gpu mode is now available. This mode handles the FHE operations in an asynchronous manner and is faster by a factor of 1.5 to 2, depending on the GPU architecture. For accurate measurements, sync operation is also available. Please note that this is an experimental implementation and data structures created in this mode should not be used by other engines in the same thread.

1.12.0 | 2026/04/29

  • The Gentry-Lee (GL) homomorphic encryption now supports polynomial evaluation. Check out the new evaluate_polynomial function.
  • Light Plaintexts can now be added to or subtracted from a ciphertext.
  • In-place operation is now available for addition and subtraction between a ciphertext and a plaintext or a light plaintexts. In-place operations are generally faster because smaller amount of memory is accessed. More in-place operations will be supported in future releases.
  • The path.Pathlib class can now be used for read and write operations. Previously, pathlib objects had to be cast to string.
  • The NTT operation in the gpu has been optimized.
  • The python GIL (global interpreter lock) has been released for most operations. This allows interleaving calculations in other threads with FHE operations. The following operations still hold the lock:
    • encrypt, decrypt, encode, decode, read, write, serialize, deserialize, to_cpu, to_gpu.
  • Fixed bug for the compact representation where too many additions were causing overflows.
  • Fixed memory leak for the compact representation in the gpu mode.
  • The serialization format has been updated. This update is to prepare for new features in development, so if any data structure is stored, it is recommended to read in the data using the latest version of the library and store them again in the new format. Serialized data structure from older versions of the library can be processed, but the serialized data structure from this version and on cannot be processed by older versions.

1.11.2 | 2026/03/31

  • Fixed bug where trying to subtract a ciphertext in NTT-form by an array of values caused the engine to break down in parallel or gpu mode.

1.11.1 | 2026/03/30

  • Fixed multiple bugs regarding the compact mode.
    • Fixed bug where keys generated below the maximum level for a given parameter were not created properly in the gpu mode.
    • Fixed bug where the level down operation was occasionally malfunctioning in the parallel mode.
    • Fixed bug where multiplication with the light plaintext was not working.
    • Fixed bug where the level down operation of a ciphertext or a plaintext in NTT-form after being rescaled was not working properly.

1.11.0 | 2026/03/25

  • The bootstrapping operation with the small bootstrap key is now 5~10% faster.
  • The size of the bootstrap key, the lossy bootstrap key, the merge bootstrap key, and the matrix multiplication key has been reduced.
  • The engine now supports compact mode, where data is stored in a denser manner, reducing the sizes of the data structures. Multiparty operations and levels above 36 cannot use the compact mode.
  • The maximum level of the matrix multiplication key has been expanded to match that of the ciphertext. In general, this increases the maximum level by 1.

1.10.0 | 2026/02/11

  • Merge bootstrap is now available. This operation efficiently bootstraps two real ciphertexts at once. All three of regular, lossy, and sign bootstrap are supported. For regular bootstrap with the bootstrap key, a merge bootstrap key is required instead. Other bootstrap keys can be used as usual for merge bootstrap.
  • Trying to use None as a data structure input will now raise an error.

1.9.0 | 2026/01/29

  • A new parameter set now allows ciphertexts to retain up to 14 levels after bootstrap. Previously, the bootstrap operation could leave at most 10 levels. Lossy and sign bootstrap are not supported with this new parameter set. Please note that this is an experimental implementation, and ciphertexts and keys generated with it may not be compatible with future releases.
  • Light Plaintext is newly introduced. This light version of the plaintext is much smaller in size, but has a limited expression range. The recommended range of values to encode is [-1, 1]. This data structure is not available for multiparty computation.
  • Light Plain Matrix is newly introduced. This light version of the plain matrix is much smaller in size, but has a limited expression range. The recommended range of values to encode is [-1, 1]. This data structure is not available for multiparty computation.
  • Sparse Plain Matrix is newly introduced. This sparse version of the plain matrix allows the users to encode sparse matrices, making the matrix multiplication operation faster and the memory size smaller. You can also create a Sparse Light Plain Matrix. For multiparty computation, you can create a Sparse Plain Matrix but not a Sparse Light Plain Matrix.
  • Rotation of a ciphertext with bootstrap keys and lossy bootstrap keys are now supported.
  • to_cpu and to_cuda APIs allow the user to manually move data structures in and out of the GPU.

1.8.0 | 2025/12/05

  • The Gentry-Lee (GL) homomorphic encryption is now available. This groundbreaking new scheme natively supports matrix operations. Please note that this is an experimental implementation, and ciphertexts and keys generated with it may not be compatible with future releases.
  • Lossy bootstrap and sign bootstrap for real number ciphertexts is now faster.
  • The level down operation has been optimized. As a consequence, the bootstrapping operation is also slightly faster.
  • Fixed bug where the CKKS engine switched from CPU parallel mode to CPU (single-threaded) mode when encoding or encrypting at level 18 and 19.

1.7.0 | 2025/11/12

  • Matrix multiplication is now available. This can be done in two ways, a faster version with a matrix multiplication key which requires more memory, and a slower version with a rotation key which requires less memory. This feature is not yet available for multiparty computation.
  • PyTorch tensors are now supported as input. PyTorch is not in the requirements to allow the user to choose the version of PyTorch.
  • Sign bootstrap is now available. This special bootstrapping method can bootstrap sign (-1, 1) values more accurately. This requires the lossy bootstrap key.
  • Python versions from 3.10 to 3.14 are now supported. Python 3.9 is no longer supported.
  • CUDA 13.0 is now supported.

1.6.0 | 2025/10/21

  • The sum of a ciphertext is now available as the sum function. You can also choose the axis to perform the sum operation.
  • You can now stack multiple ciphertexts into a larger ciphertext using the vstack function.

1.5.1 | 2025/09/30

  • Fixed bug where CPU parallel secret-key encryption of input longer than slot_count did not work.

1.5.0 | 2025/09/25

  • Sparse encoding is now available. This allows encoding less values in a given plaintext/ciphertext, which makes bootstrapping more efficient.
  • Lossy bootstraping is now available. This bootstrapping method introduces more noise, but is faster. For experts: this lossy bootstrapping does the slot-to-coeff operation before mod-raise.
  • Chebyshev evaluation is now available. This evaluation method is widely used in HE applications to reduce noise in high-order terms.
  • CUDA kernel calls for NTT and INTT has been optimized.
  • Fixed bug where the engine would crash while trying to encrypt inputs of length 0.

1.4.0 | 2025/08/26

  • Encoding and decoding can now be done entirely on the GPU. Previously, the calculation was done on the CPU and then moved to the GPU.
  • The serialization format has been updated. This update is to prepare for new features in development, so if any data structure is stored, it is recommended to read in the data using the latest version of the library and store them again in the new format. Serialized data structure from older versions of the library can be processed, but the serialized data structure from this version and on cannot be processed by older versions.
  • Fixed bug where the engine crashed when trying to rescale a ciphertext or a plaintext in NTT form on the GPU.
  • CUDA 12.9 is now supported.
  • A sample benchmark of the bootstrap function is now released.

1.3.0 | 2025/07/24

  • Secret Key encryption is now available.
  • In-place operation is now available for addition and subtraction. In-place operations are generally faster because smaller amount of memory is accessed. More in-place operations will be supported in future releases.
  • You can now do all operations except decode on a ciphertext or a plaintext that is rescaled. In previous releases, only a subset of operations, such as level down and multiplication, were supported.
  • NTT/INTT is now a public API. These functions can be used to make the calculation faster when a ciphertext or a plaintext is multiplied to several different ciphertexts.

1.2.0 | 2025/06/25

  • Polynomial operations are supported through the following helper functions: evaluate_polynomial, make_power_basis, and weighted_sum
  • A smaller parameter set for multiparty operation for max_level ≤ 1 is now supported.
  • The serialization format has been updated. Serialized data structure from older versions of the library can be processed, but the serialized data structure from this version and on cannot be processed by older versions.
  • Improved the accuracy on ciphertexts that used up a lot of multiplicative levels.

1.1.1 | 2025/06/12

  • Fix bug where NTT was not operating properly on NVIDIA H100 GPUs

1.1.0 | 2025/05/28

  • New features
    • Large bootstrap key that supports faster bootstrapping while using more memory
    • The bootstrapping operation with a rotation key is now about 5% faster
    • Secret key with a custom secret
    • Mod raise function
    • Batch rotate functions to efficiently rotate a ciphertext multiple times
    • Serialize/deserialize functions for data structures
  • Bug fixes
    • Fix bug where segmentation fault occurred on CPU parallel mode with non-power-of-two thread counts

Now that both the mod raise function and the batch rotate functions are here, a naive version of bootstrapping can be implemented.

1.0.3 | 2025/05/21

  • Add error message for trying to exceed the multiplication limit
  • Add nbytes / serialized_nbytes for the data structures
  • Fix bug where bootstrap with a rotation key with stage count set to 4 did not work

1.0.2 | 2025/05/14

  • Reduce error created by the key switching operations
  • Support MacOS 11.0 and up

1.0.1 | 2025/05/08

  • Fix bug where the encrypt function did not use the level parameter
  • Fix bug where the trio ciphertext decrypt function modified the input ciphertext
  • Support CUDA 12.1 / 12.4

1.0.0 | 2025/04/30

  • The first ever public version