alt Hacker News> they can easily have functions that provide them the plaintext through a separate channel
That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications.
That combined with GPU confidential compute should protect your LLM prompt and output.
They’re not equivalent. One provides a best effort guarantee and is not trivial to implement correctly (it’s the Secure Enclave). I agree that you _could_ do all those things and do them correctly. However there are a lot more points of failure.
E2E encryption (including homomorphic encryption) have the nice property that there are much fewer ways for things to fail.
(Tangentially, attestation is basically trying to ensure that faults are obvious, but that doesn’t reduce the probability of the faults in the first place).