Google is making private AI practical with homomorphic encryption

FloatArtifact

Encryption or not, if it's on somebody else's server, it isn't yours. I don't believe Google has my best interest.

noident

Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs? I want to read a whitepaper but all I can find is the tl;dw conference presentation

LoganDark

One flaw with FHE is that it guarantees only that you need the key to see the inputs or outputs of the computation, but not necessarily that the computation is the one you want. For example, the computation could be adversarial for certain inputs, or an adversary could insert their own computation first (or last).

Deukhoofd

It sounds neat, but I do wonder how viable this is commercially. How high do we rate the chances that governments around the world will step in before another kind of E2E is rolled out.

filup

Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise. So I take offense to the term FHE. It's a oxymoron. The whole thing immidiatly stands out as a sham to build trust where it's gone.

sabretooth1405

My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.

Cider9986

This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.

jrm4

Correct. I appreciate the theoretical technology here, but I believe a great deal of harm is done by the fact that people are not likely to understand exactly what this means. Which is to say, I believe that google is strongly implying the falsehood of "no one at Google can read your stuff."

oulipo

Zama.ai is also a player in this space

bmenrigh

Has FHE really progressed so far that it's now so efficient that doing computation on an encrypted prompt is feasible? I thought even basic operations like FHE addition were still thousands of times more complex. The only mention in the article I see is: > But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing. Which doesn't spell out exactly hon "nontrivial" the cost overhead still is.

lsb

Google is making private AI practical with Gemma4 something that you can run without an Internet connection. All of the proofs of privacy rely on us getting the math right. All of the privacy from unplugging your internet cable is there by default.

NyxWulf

Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needing to decrypt it anymore?

sheesdev

I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.

traceroute66

Quoted from the blog post: > user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection I think they forgot "or advertising" at the end. I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2] [1] https://tinfoil.sh/ [2] https://www.privatemode.ai/

mohamedkoubaa

Anything to keep people from running local models

nazgulsenpai

Why is the bold letter n lighter than the rest in this page's font?

p0w3n3d

Ideally: we will have private AI Reality: our computers will be used as distributed AI calculators

nullc

Private AI is practical by running the model locally, every much more so than any homomorphic encryption scheme. So essentially the headline sells this as work to keep your data private, but really it's work to keep the AI-- which was trained on your code and your writing-- private.

drblast

I did some amount of research into the feasibility of PHE and FHE about 20 years ago, and my conclusion at the time was that the space overhead of the encrypted output was a massive bottleneck, which meant that while it was potentially useful in a small number of niche cases it wasn't ever going to be practical for general-purpose computations without a major breakthrough. The gist was I could do an encrypted (int)x + (int)y = (int)z computation, I could encrypt the inputs and then get a result back that was correct, secure, and decryptable, but was like 1MB in size. So, for someone whose knowledge is 20 years outdated and is about Pallier crypto, has that major breakthrough happened?

meindnoch

Great, private AI, at the cost of >1000x the resource usage. Because apparently AI companies weren't already using quite enough energy to cook the planet. The most private AI is the one running on my own hardware, not in some giant data center.