This is logical but not obvious until one runs into it. Adding or updating a hash key in a marshaled attr_encrypted doesn't mark the attribute as dirty, so save will not update the database column.
Even calling encrypted_whatever_will_change! and then changing the attribute won't change the encrypted_whatever ciphertext. Turning off partial_updates for the model also makes no difference, presumably because attr_encryptor never receives the chance to update the ciphertext.
The only way I've found to work around this is to assign the model attribute for every change, like:
my_instance.important_stuff = important_stuff.merge(:newkey => newval)