HN

Need help?
<- Back
Google is making private AI practical with homomorphic encryption

Google is making private AI practical with homomorphic encryption

u1hcw9nx

Comments (246)

  • sabretooth1405
    My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.
  • snovv_crash
    So much inefficiency just to run it on someone else's untrusted hardware. Private AI is already possible today with local open-weight models running on hardware you control.Homomorphic encryption is cool technology, but I'm really not sure what problem it solves.
  • never_inline
    I think you folks are reading too much into it. I think the people working on FHE need to publish an AI-oriented pitch to retain funding from AI-pilled execs. Must be the same case with the golang post few days ago.
  • meindnoch
    Great, private AI, at the cost of >1000x the resource usage. Because apparently AI companies weren't already using quite enough energy to cook the planet.The most private AI is the one running on my own hardware, not in some giant data center.
  • HlessClaudesman
    "hotword" detection, is this basically sniffing encrypted data for words the authorities don't want you to speak?Seems counterproductive to their stated aim of privacy.
  • Cider9986
    This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.
  • lsb
    Google is making private AI practical with Gemma4 something that you can run without an Internet connection.All of the proofs of privacy rely on us getting the math right. All of the privacy from unplugging your internet cable is there by default.
  • myshapeprotocol
    Making homomorphic encryption practical for AI workloads is a massive step forward for privacy-preserving architectures. Brilliant milestone.
  • stephen_cagle
    I see a lot of comments here about how private AI is much cheaper than doing this, and that is currently true.But I am curious if anyone can think of any use cases for this as it currently stands? For every idea I can think of, I can think of another solution that would probably be a better solution at current slowdown in cost from using homomorphic encryption.For their two examples...1) For the "will they click the add" one, how would anyone verify that the model I am uploading of myself is remotely accurate? And can't they learn my characteristics by running them against very specific ads that pinpoint my preferences?2) For the "Do you have heart disease" one, why not just generating a billion datapoints (or more). The user can download the compressed data of this huge sample of points and then just enter their data on their own side and find the point that is closest (if not an exact match) to their own data?I'm not pulling apart the idea of homorphic encryption, I'm just curious if anyone can think of a really compelling use case for it given it 10^3 to 10^6 greater compute cost?
  • Frannky
    A homomorphic encryption blogpost without any mention of the computational overhead...
  • magios
    https://fhetextbook.github.io/ which i believe was linked on this website previous is what i used to learn about how this stuff works.
  • senand
    I‘m new to this, but mildly skeptical. In complex agentic engineering, there are lots of intermediate steps that depend on each other. Even if you disregard the significant encryption cost, this makes it impractical. So seems like this will stay a niche.
  • vkaku
    I really want nobody to waste cycles on my AI than me. This is useless because now I need to pay for wasted inference AND encryption cycles on top of wire encryption.
  • r3trohack3r
    Does this also solve provable compute as a side effect? Since the compute is fully encrypted end-to-end, the host wouldn’t be able to modify the program and still give valid results?So a caller could run a program on untrusted hardware and trust that the hardware actually ran the program?
  • bmenrigh
    Has FHE really progressed so far that it's now so efficient that doing computation on an encrypted prompt is feasible? I thought even basic operations like FHE addition were still thousands of times more complex. The only mention in the article I see is:> But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing.Which doesn't spell out exactly hon "nontrivial" the cost overhead still is.
  • sheesdev
    I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.
  • tjpnz
    Sounds like a fantastic waste of compute. The future of private AI is local inference rendering this application of it pointless.
  • drblast
    I did some amount of research into the feasibility of PHE and FHE about 20 years ago, and my conclusion at the time was that the space overhead of the encrypted output was a massive bottleneck, which meant that while it was potentially useful in a small number of niche cases it wasn't ever going to be practical for general-purpose computations without a major breakthrough.The gist was I could do an encrypted (int)x + (int)y = (int)z computation, I could encrypt the inputs and then get a result back that was correct, secure, and decryptable, but was like 1MB in size.So, for someone whose knowledge is 20 years outdated and is about Pallier crypto, has that major breakthrough happened?
  • NyxWulf
    Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needing to decrypt it anymore?
  • maxo133
    Funny to read this, but google is currently number one anti-privacy big tech company. No other company makes it as difficult for its users using anonymization/privacy software to access their services
  • anon
    undefined
  • sarjann
    I think at 1000x it's probably way cheaper to do an "AWS outpost" style thing. Although not sure if it's a fundamental constraint or something that could be optimised.
  • hellohello2
    Have all the skeptics in this thread somehow forgot about Moore's law?
  • p0w3n3d
    Ideally: we will have private AIReality: our computers will be used as distributed AI calculators
  • Danox
    The only question is do you trust Google? No…
  • nazgulsenpai
    Why is the bold letter n lighter than the rest in this page's font?
  • Deukhoofd
    It sounds neat, but I do wonder how viable this is commercially. How high do we rate the chances that governments around the world will step in before another kind of E2E is rolled out.
  • traceroute66
    Quoted from the blog post:> user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detectionI think they forgot "or advertising" at the end.I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2][1] https://tinfoil.sh/ [2] https://www.privatemode.ai/
  • anon
    undefined
  • chrisan
    Man oh man did I read that title wrong and was completely confused
  • FloatArtifact
    Encryption or not, if it's on somebody else's server, it isn't yours. I don't believe Google has my best interest.
  • cantalopes
    It's a step to provide targeted advertising with mathematically provable "no sensitive info stored" approach. The google must fight really hard because this is the only source of income that makes sense for their position. And it /is/ quite evil tbh
  • noident
    Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?I want to read a whitepaper but all I can find is the tl;dw conference presentation
  • gigatexal
    Maybe Apple will put its watches behind this and the computational complexity will be solved by some breakthrough.
  • cryptographical
    all we need now is indistinguishable obfuscation
  • Watney-0717
    Can we slash Google's 1000x FHE cost by 50%+ using a brain-inspired RC router like Project Ares-TCO?
  • Tepix
    > Google’s history of innovations in privacy technologyAh yes, their history of innovations! Thanks to Gemini for making a list for me over at https://share.gemini.google/vx9lE5dEJ1L7The list contains more than 6 chapters with multiple entries each.Google has truly been very innovative in destroying privacy online.
  • nullc
    Private AI is practical by running the model locally, every much more so than any homomorphic encryption scheme.So essentially the headline sells this as work to keep your data private, but really it's work to keep the AI-- which was trained on your code and your writing-- private.
  • fillihp
    homoerotic fan cryption - after dark.
  • josefritzishere
    Why is Homomorphic Encryption necessary at all? The article seems to lose the plot in the process of tooting their own horn.
  • oulipo
    Zama.ai is also a player in this space
  • LoganDark
    One flaw with FHE is that it guarantees only that you need the key to see the inputs or outputs of the computation, but not necessarily that the computation is the one you want. For example, the computation could be adversarial for certain inputs, or an adversary could insert their own computation first (or last).
  • shevy-java
    I do not want to make Google more powerful than it already is.
  • jrm4
    Correct. I appreciate the theoretical technology here, but I believe a great deal of harm is done by the fact that people are not likely to understand exactly what this means.Which is to say, I believe that google is strongly implying the falsehood of "no one at Google can read your stuff."
  • jijji
    gaslighting people by pretending that encrypting reasoning traces between agent and client is a win for "private AI"... the title should be rewritten as it is plainly conceding -- Closed AI providers use encrypted reasoning traces to hide what the model is doing to come to a conclusion. This is not scientific progress, this is molopoly protectionism. No person using these models wants the reasoning traces hidden from them, it prevents the user from learning how conclusions about a question are derived.
  • CurbStomper
    [dead]
  • gaigalas
    I have an idea for AI companies for tremendous scale, with privacy and all nice things accounted for:- Unstarve the GPU and RAM consumer market.- Let enthusiasts and volunteers quickly ramp up local AI.- Reap the results that the community will most certainly achieve.Don't repeat Microsoft's earlier mistakes. It flourished when it embraced the community and open source. If it had made that move earlier, it would have been unstoppable.Yes, if you can control the entire market that's probably awesome. But it's also full of nonsense risks.
  • mohamedkoubaa
    Anything to keep people from running local models
  • Havoc
    Can't say I have much faith in "send it to google it'll be private thanks to crypto magic".nah bro...the solution here is to not trust google
  • weatherlite
    > Google is making private AI practical with homomorphic encryptionI don't understand why we need to bring LGBTQ+ into everything
  • jacquesm
    Private AI is perfectly practical already and it really doesn't need Google at all. Besides the word 'practical' here is really stretching things.
  • filup
    Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise.So I take offense to the term FHE. It's a oxymoron.The whole thing immidiatly stands out as a sham to build trust where it's gone.