Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is making private AI practical with homomorphic encryption

blog.google

Post reply on HN
Print view View original

61–70 of 305 posts

Re: Google is making private AI practical with homomorphic encryption

#61

Post by drdeca »

filup wrote: post #53
Ar-Curunir wrote: post #30

Earlier quoted context omitted.

No, that’s not what proper encryption means. Security for encryption means that cipher texts encrypting distinct messages are indistinguishable. This is called IND-CPA, and FHE satisfies this.

How can it possibly pass indcpa. If the model can give me any valuable information about the cipher. Apparently the middle man would know precisely what is contained in the payload.

Here’s a very simple one-time-pad style construction for homeomorphic (but not fully homeomorphic) encryption.

Suppose the plaintext, ciphertext, and key, are each a natural number modulo 5.

The key is selected uniformly at random. The ciphertext is obtained by adding the key to the plaintext (and as a result is also uniform random).

Then the ciphertext is sent to the server. The server only has the ciphertext, which is uniform random. The server then adds some integer mod 5 to the ciphertext, producing a new ciphertext, and sends it back to the user. The user then subtracts their key from the new ciphertext to obtain the new plaintext, which is their original plaintext plus the number the server added.

At no point in this process did the server learn anything about the user’s plaintext.

This is clearly secure.

It is also useless, because just adding a number isn’t a useful thing for a server to do (they may as well just send the user the number and let them add it themselves), but that’s because it is a toy example.

I suppose if mind uploading were possible, then under FHE it would in principle be possible to take the ciphertext and run the computation of “this mind upload of this person reads the data and provides some output”, and then presumably that uploaded person would have the experience of seeing the plaintext? But it wouldn’t be possible to get any information about the plaintext without the key (or enough brute force to find the key, but that’s why we use big enough keys to make this infeasible).

Re: Google is making private AI practical with homomorphic encryption

#63

Post by dhx »

sabretooth1405 wrote: post #16

My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.

To throw out some real and up-to-date numbers from [1] for FHE at "128-bit security level", to sort 8x 8-bit unsigned integers on the most ordinary of desktop PCs, wait 3 seconds for the result. Want to sort 32x 8-bit unsigned integers instead? Come back 34 seconds later for the result.

update: also see [2] for some primitive unsigned 64-bit integer operation benchmarks with the TFHE-rs library (winner in the sorting performance comparison of [1]). Equality at 80ms, addition and subtraction at 100ms, division at 8 seconds, etc.

[1] https://eprint.iacr.org/2026/1495.pdf Oblivious Sorting under Fully Homomorphic Encryption: A Comprehensive Survey and Performance Analysis, Omar Ahmed and Rostin Shokri and Nektarios Georgios Tsoutsos, 2026

[2] https://docs.zama.org/tfhe-rs/tfhe-rs/1.0/get-started/benchm...

Re: Google is making private AI practical with homomorphic encryption

#64

Post by filup »

drdeca wrote: post #55
filup wrote: post #48

Earlier quoted context omitted.

If it only appears indistinguishable from noise, but it's actually not, then it's just deception.

They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable. It seems like you strongly believe otherwise, but I suspect you don’t have a good reason to, and just find it unbelievable. Do you think you can distinguish it from noise, if given an implementation and the information an adversary would have access to? Of course, you not being able to wouldn’t demonstrate that noöne can…

>They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable.

That's the oxymoron. If it was indistinguishable nothing could be gained.

It's not about me being able to distinguish it. It's the model provider saying they cant, when they can.

Re: Google is making private AI practical with homomorphic encryption

#65

Post by kingleopold »

amazingamazing wrote: post #26
Cider9986 wrote: post #22

This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.

If you think about it for a moment you will realize the average user does not want that.

yes, lastpass get $ tens millions because its weak and gets hacked not because its realiable, secure and great.

Re: Google is making private AI practical with homomorphic encryption

#66

Post by filup »

drdeca wrote: post #61
filup wrote: post #53

Earlier quoted context omitted.

How can it possibly pass indcpa. If the model can give me any valuable information about the cipher. Apparently the middle man would know precisely what is contained in the payload.

Here’s a very simple one-time-pad style construction for homeomorphic (but not fully homeomorphic) encryption. Suppose the plaintext, ciphertext, and key, are each a natural number modulo 5. The key is selected uniformly at random. The ciphertext is obtained by adding the key to the plaintext (and as a result is also uniform random). Then the ciphertext is sent to the server. The server only has the ciphertext, which…

What does that have to do with incpa?

I send this server a question encrypted. It stays encrypted yet the server distinguished my ciphertext enough to produce a coherent reply. That means there was enough information in the ciphertext for the server to perform the inference, even if it was obscured to where it looks indistinguishable, it apparently wasn't.

This doesn't remove trust from the equation, it puts the trust directly on the algorithm. Probably one no one can explain to me like I'm 5. But because it's encrypted I am no longer breaking the law by processing on protected data. I imagine very large contracts await on the other side. Lots of money to be made.

Re: Google is making private AI practical with homomorphic encryption

#67

Post by bevekspldnw »

luckydata wrote: post #57
bevekspldnw wrote: post #56

Earlier quoted context omitted.

Commercially viable for Google boils down to can they attribute ads behaviors to it or not. Then there’s a second tier of things that just make those wheels turn and if they do or don’t make ads revenue is nominally immaterial. The teams doing this stuff at Google are purely for show, none of this makes it into any real products. There’s the narrow exception of stuff like gboard, that does use privacy preserving ML/f…

You are very wrong about all of this btw.

You literally don’t know who I am or the roles I had. So unless you can tell me how many steps you were from Kent Walker and what you worked on I’m gonna bet a hell of a lot I know more than you.

Edit to clarify my prior point: some of the technology makes it into the product, but the putative data protections do not.

Why?

Because there is always a work around, and ads legal will approve it every time.

Re: Google is making private AI practical with homomorphic encryption

#68

Post by j2kun »

sheesdev wrote: post #37

I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.

One potentially simple answer is: to make things that are otherwise illegal (for regulatory reasons) possible.

There are some instances of hand-built cryptographic protocols used in production at Google that use FHE in small doses (e.g., computing a single dot product as part of an interactive protocol), so the big question is whether having a general-purpose tool will expand the feasibility of applying these to other, maybe less critical projects that still want some privacy guarantees but can't afford to hire cryptographers.

Re: Google is making private AI practical with homomorphic encryption

#69

Post by j2kun »

flambo wrote: post #52
traceroute66 wrote: post #44

Quoted from the blog post: > user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection I think they forgot "or advertising" at the end. I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2] [1] https://tinfoil.sh/ [2] https://www.p…

Secure Enclaves are broken all the time though [1]. They’re also not secure against attacks from a quantum computer (including store now decrypt later attacks). At least with symmetric FHE, anything that happens after encryption requires zero trust. [1] https://sgx.fail/

Indeed, Google itself has a large research group that repeatedly breaks TEEs with side-channels and such.

Re: Google is making private AI practical with homomorphic encryption

#70

Post by j2kun »

jerf wrote: post #50
sabretooth1405 wrote: post #16

My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.

The article conspicuously fails to go into much detail about that. I poked around with an AI a bit (to rapidly cover all the linked pages) and it seems the best numbers we can get are from this arxiv paper: https://arxiv.org/html/2506.18150v4 Which says: "We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively…

The linked repository has demos you can run (though you have to install bazel), and some of the smaller models run inference in about a second, while the larger ones take minutes.

That said, there is a lot of ongoing work on GPU acceleration. Cf. the recent FHE-based CIFAR demo that runs in 200ms: https://sofar.belfortlabs.cloud/

Still maybe 1000x slower than cleartext, but progress!

Post reply on HN