[taejo]

The distinction between program and data is not a sharp one, since f(x) = apply(<f, x>) = eval_x(f) (where eval_x takes the description of some program f and runs it on the constant input x). You can use this equivalence to compute f(x) where f is in plaintext and x is encrypted (ordinary HE), f and x are both encrypted (but apply is plaintext), or f is encrypted but x is not (so we can derive eval_x). In every case, however, the output is encrypted.

In general, this is only of theoretical interest, since the interpreter apply and the specialized interpreter eval_x are large, complicated programs.