Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is making private AI practical with homomorphic encryption

blog.google

Post reply on HN
Print view View original

191–200 of 305 posts

Re: Google is making private AI practical with homomorphic encryption

#191

Post by catlifeonmars »

stephen_cagle wrote: post #189

I see a lot of comments here about how private AI is much cheaper than doing this, and that is currently true. But I am curious if anyone can think of any use cases for this as it currently stands? For every idea I can think of, I can think of another solution that would probably be a better solution at current slowdown in cost from using homomorphic encryption. For their two examples... 1) For the "will they click t…

If the bottleneck is data transfer rate or volume, then I think you’ll find more use from today’s FHE. Incidentally there is a fair amount of overlap in the use case space between homomorphisms and oblivious transfer.

Re: Google is making private AI practical with homomorphic encryption

#192

Post by catlifeonmars »

Eueudhsbsj32 wrote: post #90
meindnoch wrote: post #80

Great, private AI, at the cost of >1000x the resource usage. Because apparently AI companies weren't already using quite enough energy to cook the planet. The most private AI is the one running on my own hardware, not in some giant data center.

Aren't there already much more efficient ways to make inference private? Using regular encryption and secure enclaves, there are already providers that are roughly 2x the cost of normal providers. For example, https://tinfoil.sh/

> aren’t there more efficient ways

Heh yes absolutely, but there is some nuance.

Secure Enclave still requires you to trust the operator and also trust that it’s configured properly, supply chain is secure, etc.

The beauty of FHE is that it doesn’t rely on the compute being secure. All you need to secure are things you already have control over as a client.

I agree with you it’s still way too slow to be generally useful. (By general, I mean practical for arbitrary computation — you can relax the requirement and have fast homomorphic encryption if you only do specific kinds of operations).

Re: Google is making private AI practical with homomorphic encryption

#193

Post by mswphd »

Veserv wrote: post #83
filup wrote: post #15

Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise. So I take offense to the term FHE. It's a oxymoron. The whole thing immidiatly stands out as a sham to build trust where it's gone.

You are objectively wrong. The math is straightforward to show that you can operate on a ciphertext securely in some cryptosystems. Consider two integers M1 and M2. Consider RSA with private key (E), public key (D), and public modulus (N). Encrypt(M, E, N) = mod(pow(M, E), N). Decrypt(C, D, N) = mod(pow(C, D), N). mod(Encrypt(M1, E, N) * Encrypt(M2, E, N), N) = mod(Encrypt(M1 * M2, E, N), N). So, for all RSA encrypti…

conceptually your example is fine/good, but it's worth clarifying that the scheme you describe is insecure, as unpadded RSA fails to be IND-CPA secure. this is because Enc(m)Enc(m') = Enc(mm') is a predicate a passive observer can check, to gain information about Enc(m*m').

that being said, you can construct IND-CPA secure homomorphic encryption schemes from factoring-based assumptions iirc, so this isn't a fundamental obstacle.

Re: Google is making private AI practical with homomorphic encryption

#194

Post by mswphd »

NyxWulf wrote: post #35

Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needin…

the basic encryption scheme used here is fairly straightforward actually, at least the symmetric encryption version. Let s be a uniformly random, 512-dimensional u32 vector. To encrypt a message m (say a 512-dimensional bit vector for simplicity), you

1. generate a 512 x 512 random (u32) matrix A, and

2. generate a 512-dimensional rounded (to the nearest integer) Gaussian, say of standard deviation 10, e.

The ciphertext is then [A, b :=As + e + 2^8 m].

To decrypt, you compute b - As to recover 2^8 m + e. You can then recover m, as e Anyway, if you have two of these ciphertexts, you can sum them together to get

[A1 + A2, (A1 + A2)s + (e1 + e2) + 2^8 (m1 + m2)]

this decrypts to m1 + m2, so you can recover homomorphic sums (or scalings by small integers).

Multiplication is more complex, so I won't get into it here. But the high level from the above example is that you could have someone compute arbitrary linear functions of your data without them knowing what your data is.

Re: Google is making private AI practical with homomorphic encryption

#195

Post by catlifeonmars »

Eueudhsbsj32 wrote: post #186
siddthesquid wrote: post #132

Earlier quoted context omitted.

- If an AI provider has control over the AI algorithm running in the secure enclave, they can easily have functions that provide them the plaintext through a separate channel. secure enclave does not prevent that - The output can reveal information to the provider, which homomorphic encryption would have protected - Inference is running on GPUs - so its moreso nvidia than amd/intel, but this is just a nit So homomorp…

> they can easily have functions that provide them the plaintext through a separate channel That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications. That combined with GPU confidential compute should protect your LLM prompt and output.

They’re not equivalent. One provides a best effort guarantee and is not trivial to implement correctly (it’s the Secure Enclave). I agree that you _could_ do all those things and do them correctly. However there are a lot more points of failure.

E2E encryption (including homomorphic encryption) have the nice property that there are much fewer ways for things to fail.

(Tangentially, attestation is basically trying to ensure that faults are obvious, but that doesn’t reduce the probability of the faults in the first place).

Re: Google is making private AI practical with homomorphic encryption

#196

Post by joquarky »

bitpush wrote: post #100
bevekspldnw wrote: post #56

Earlier quoted context omitted.

Commercially viable for Google boils down to can they attribute ads behaviors to it or not. Then there’s a second tier of things that just make those wheels turn and if they do or don’t make ads revenue is nominally immaterial. The teams doing this stuff at Google are purely for show, none of this makes it into any real products. There’s the narrow exception of stuff like gboard, that does use privacy preserving ML/f…

Autonomous driving was all show until Waymo happened AI research was all show until transformers happened. Quantum research is all show until .. and now this. Part of changing the world involves imagining a changed-world.

Cold fusion and room temperature superconductors (remember LK-99?) were also all show.

Re: Google is making private AI practical with homomorphic encryption

#197

Post by not_a_bot_4sho »

tomhow wrote: post #127
michaelmrose wrote: post #94

Earlier quoted context omitted.

[flagged]

> This is generally the test of extreme stupidity because those so adept rarely realize there is even a contradiction because they lack in critical thinking. > You can separate Cook is a garbage person We've banned this account. We've asked you politely, several times over the years to observe the guidelines. In recent times you've been acting more than ever like they don't apply to you. They do apply to you just as…

I wholeheartedly support moderation to keep a healthy community but this is asinine.

My takeaway is that you were personally offended by the (mild) attack on Cook and Apple products, likely because you use them and associate them with your self worth, and responded in defense of ego.

I say this based on observing casual usage of 'fool' and 'idiot' and other terms a myriad of times in other threads with no action or response.

I'm glad to see a moderator in the wild but JFC not attacking a windmill.

Re: Google is making private AI practical with homomorphic encryption

#198

Post by joquarky »

jacquesm wrote: post #99
abetusk wrote: post #49

Earlier quoted context omitted.

1000x slowdown is bad but not a complete deal breaker. Do you have a sense of what a reasonable achievable factor is? Do you have sense for how long before we get to that achievable factor?

It's a ridiculous waste of energy, just use local compute.

Good point, but if we can advance research on this via the AI bubble, it could improve privacy in other areas.

Re: Google is making private AI practical with homomorphic encryption

#199

Post by s20n »

magios wrote: post #155

https://fhetextbook.github.io/ which i believe was linked on this website previous is what i used to learn about how this stuff works.

Also this lecture by Vinod Vaikuntanathan is really helpful if you want to learn about FHE: https://www.youtube.com/watch?v=5LGwaICJ5sw

Re: Google is making private AI practical with homomorphic encryption

#200

Post by fedpost »

never_inline wrote: post #188

I think you folks are reading too much into it. I think the people working on FHE need to publish an AI-oriented pitch to retain funding from AI-pilled execs. Must be the same case with the golang post few days ago.

Yeah I don't think they actually want this. There's far too much deeply personal and useful data being freely feed to the companies running these models.

People are giving them everything. Their thoughts, feelings, intentions, company IP... It's a fucking gold mine.

There's just too much value in retraining on that data and even if there wasn't, the feds lean so heavily on Google search histories to get convictions I am certain there will be pressure to prevent any mass market services from adopting this.

Post reply on HN