alt Hacker NewsGoogle is making private AI practical with homomorphic encryption
Comments
"hotword" detection, is this basically sniffing encrypted data for words the authorities don't want you to speak?
Seems counterproductive to their stated aim of privacy.
I think you folks are reading too much into it. I think the people working on FHE need to publish an AI-oriented pitch to retain funding from AI-pilled execs. Must be the same case with the golang post few days ago.
Great, private AI, at the cost of >1000x the resource usage. Because apparently AI companies weren't already using quite enough energy to cook the planet.
The most private AI is the one running on my own hardware, not in some giant data center.
I really want nobody to waste cycles on my AI than me. This is useless because now I need to pay for wasted inference AND encryption cycles on top of wire encryption.
This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.
A homomorphic encryption blogpost without any mention of the computational overhead...
I‘m new to this, but mildly skeptical. In complex agentic engineering, there are lots of intermediate steps that depend on each other. Even if you disregard the significant encryption cost, this makes it impractical. So seems like this will stay a niche.
Google is making private AI practical with Gemma4 something that you can run without an Internet connection.
All of the proofs of privacy rely on us getting the math right. All of the privacy from unplugging your internet cable is there by default.
I see a lot of comments here about how private AI is much cheaper than doing this, and that is currently true.
But I am curious if anyone can think of any use cases for this as it currently stands? For every idea I can think of, I can think of another solution that would probably be a better solution at current slowdown in cost from using homomorphic encryption.
For their two examples...
1) For the "will they click the add" one, how would anyone verify that the model I am uploading of myself is remotely accurate? And can't they learn my characteristics by running them against very specific ads that pinpoint my preferences?
2) For the "Do you have heart disease" one, why not just generating a billion datapoints (or more). The user can download the compressed data of this huge sample of points and then just enter their data on their own side and find the point that is closest (if not an exact match) to their own data?
I'm not pulling apart the idea of homorphic encryption, I'm just curious if anyone can think of a really compelling use case for it given it 10^3 to 10^6 greater compute cost?
https://fhetextbook.github.io/ which i believe was linked on this website previous is what i used to learn about how this stuff works.
Does this also solve provable compute as a side effect? Since the compute is fully encrypted end-to-end, the host wouldn’t be able to modify the program and still give valid results?
So a caller could run a program on untrusted hardware and trust that the hardware actually ran the program?
Making homomorphic encryption practical for AI workloads is a massive step forward for privacy-preserving architectures. Brilliant milestone.
Has FHE really progressed so far that it's now so efficient that doing computation on an encrypted prompt is feasible? I thought even basic operations like FHE addition were still thousands of times more complex. The only mention in the article I see is:
> But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing.
Which doesn't spell out exactly hon "nontrivial" the cost overhead still is.
I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.
I did some amount of research into the feasibility of PHE and FHE about 20 years ago, and my conclusion at the time was that the space overhead of the encrypted output was a massive bottleneck, which meant that while it was potentially useful in a small number of niche cases it wasn't ever going to be practical for general-purpose computations without a major breakthrough.
The gist was I could do an encrypted (int)x + (int)y = (int)z computation, I could encrypt the inputs and then get a result back that was correct, secure, and decryptable, but was like 1MB in size.
So, for someone whose knowledge is 20 years outdated and is about Pallier crypto, has that major breakthrough happened?
Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needing to decrypt it anymore?
Funny to read this, but google is currently number one anti-privacy big tech company. No other company makes it as difficult for its users using anonymization/privacy software to access their services
I think at 1000x it's probably way cheaper to do an "AWS outpost" style thing. Although not sure if it's a fundamental constraint or something that could be optimised.
Ideally: we will have private AI
Reality: our computers will be used as distributed AI calculators
The only question is do you trust Google? No…
Why is the bold letter n lighter than the rest in this page's font?
It sounds neat, but I do wonder how viable this is commercially. How high do we rate the chances that governments around the world will step in before another kind of E2E is rolled out.
Man oh man did I read that title wrong and was completely confused
Quoted from the blog post:
> user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection
I think they forgot "or advertising" at the end.
I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2]
Encryption or not, if it's on somebody else's server, it isn't yours. I don't believe Google has my best interest.
Maybe Apple will put its watches behind this and the computational complexity will be solved by some breakthrough.
It's a step to provide targeted advertising with mathematically provable "no sensitive info stored" approach. The google must fight really hard because this is the only source of income that makes sense for their position. And it /is/ quite evil tbh
Have all the skeptics in this thread somehow forgot about Moore's law?
Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?
I want to read a whitepaper but all I can find is the tl;dw conference presentation
Can we slash Google's 1000x FHE cost by 50%+ using a brain-inspired RC router like Project Ares-TCO?
all we need now is indistinguishable obfuscation
> Google’s history of innovations in privacy technology
Ah yes, their history of innovations! Thanks to Gemini for making a list for me over at https://share.gemini.google/vx9lE5dEJ1L7
The list contains more than 6 chapters with multiple entries each.
Google has truly been very innovative in destroying privacy online.
Private AI is practical by running the model locally, every much more so than any homomorphic encryption scheme.
So essentially the headline sells this as work to keep your data private, but really it's work to keep the AI-- which was trained on your code and your writing-- private.
homoerotic fan cryption - after dark.
Why is Homomorphic Encryption necessary at all? The article seems to lose the plot in the process of tooting their own horn.
Zama.ai is also a player in this space
One flaw with FHE is that it guarantees only that you need the key to see the inputs or outputs of the computation, but not necessarily that the computation is the one you want. For example, the computation could be adversarial for certain inputs, or an adversary could insert their own computation first (or last).
gaslighting people by pretending that encrypting reasoning traces between agent and client is a win for "private AI"... the title should be rewritten as it is plainly conceding -- Closed AI providers use encrypted reasoning traces to hide what the model is doing to come to a conclusion. This is not scientific progress, this is molopoly protectionism. No person using these models wants the reasoning traces hidden from them, it prevents the user from learning how conclusions about a question are derived.
I do not want to make Google more powerful than it already is.
Correct. I appreciate the theoretical technology here, but I believe a great deal of harm is done by the fact that people are not likely to understand exactly what this means.
Which is to say, I believe that google is strongly implying the falsehood of "no one at Google can read your stuff."
[dead]
I have an idea for AI companies for tremendous scale, with privacy and all nice things accounted for:
- Unstarve the GPU and RAM consumer market.
- Let enthusiasts and volunteers quickly ramp up local AI.
- Reap the results that the community will most certainly achieve.
Don't repeat Microsoft's earlier mistakes. It flourished when it embraced the community and open source. If it had made that move earlier, it would have been unstoppable.
Yes, if you can control the entire market that's probably awesome. But it's also full of nonsense risks.
Anything to keep people from running local models
Can't say I have much faith in "send it to google it'll be private thanks to crypto magic".
nah bro...the solution here is to not trust google
> Google is making private AI practical with homomorphic encryption
I don't understand why we need to bring LGBTQ+ into everything
Private AI is perfectly practical already and it really doesn't need Google at all. Besides the word 'practical' here is really stretching things.
Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise.
So I take offense to the term FHE. It's a oxymoron.
The whole thing immidiatly stands out as a sham to build trust where it's gone.
My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.