the basic encryption scheme used here is fairly straightforward actually, at least the symmetric encryption version. Let s be a uniformly random, 512-dimensional u32 vector. To encrypt a message m (say a 512-dimensional bit vector for simplicity), you

1. generate a 512 x 512 random (u32) matrix A, and

2. generate a 512-dimensional rounded (to the nearest integer) Gaussian, say of standard deviation 10, e.

The ciphertext is then [A, b :=As + e + 2^8 m].

To decrypt, you compute b - As to recover 2^8 m + e. You can then recover m, as e << 2^8 with high probability.

Anyway, if you have two of these ciphertexts, you can sum them together to get

[A1 + A2, (A1 + A2)s + (e1 + e2) + 2^8 (m1 + m2)]

this decrypts to m1 + m2, so you can recover homomorphic sums (or scalings by small integers).

Multiplication is more complex, so I won't get into it here. But the high level from the above example is that you could have someone compute arbitrary linear functions of your data without them knowing what your data is.