Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Implementation of Apple's Private Compute Cloud

github.com

Post reply on HN
Print view View original

11–20 of 111 posts

Re: Open Source Implementation of Apple's Private Compute Cloud

#11

Post by Terretta »

ryanMVP wrote: post #10

Reading the whitepaper, the inference provider still has the ability to access the prompt and response plaintext. This scheme does seem to guarantee that plaintext cannot be read for all other parties (e.g. the API router), and that the client's identity is hidden and cannot be associated with their request. Perhaps the precise privacy guarantees and allowances should be summarized in the readme. With that in mind, d…

> the inference provider still has the ability to access the prompt and response plaintext

Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint.

BYOK does cover most of it, but oh look, you brought me and my code your key, thanks… Apple's approach, and certain other systems such as AWS's Nitro Enclaves, aim at this last step of the problem:

- https://security.apple.com/documentation/private-cloud-compu...

- https://aws.amazon.com/confidential-computing/

NCC Group verified AWS's approach and found:

1. There is no mechanism for a cloud service provider employee to log in to the underlying host.

2. No administrative API can access customer content on the underlying host.

3. There is no mechanism for a cloud service provider employee to access customer content stored on instance storage and encrypted EBS volumes.

4. There is no mechanism for a cloud service provider employee to access encrypted data transmitted over the network.

5. Access to administrative APIs always requires authentication and authorization.

6. Access to administrative APIs is always logged.

7. Hosts can only run tested and signed software that is deployed by an authenticated and authorized deployment service. No cloud service provider employee can deploy code directly onto hosts.

- https://aws.amazon.com/blogs/compute/aws-nitro-system-gets-i...

Points 1 and 2 are more unusual than 3 - 7.

Folks who enjoy taking things apart to understand them can hack at Apple's here:

https://security.apple.com/blog/pcc-security-research/

* Except by, say, withdrawing the system (see Apple in UK) so users have to use something less secure, observably changing the system, or other transparency trippers.

Re: Open Source Implementation of Apple's Private Compute Cloud

#12

Post by amelius »

Terretta wrote: post #11
ryanMVP wrote: post #10

Reading the whitepaper, the inference provider still has the ability to access the prompt and response plaintext. This scheme does seem to guarantee that plaintext cannot be read for all other parties (e.g. the API router), and that the client's identity is hidden and cannot be associated with their request. Perhaps the precise privacy guarantees and allowances should be summarized in the readme. With that in mind, d…

> the inference provider still has the ability to access the prompt and response plaintext Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint. BYOK does cover most of it, but oh look, you brought me and my code your key, thanks… Apple's approach, and certain other systems such as AWS's Nitro Enclaves, aim at this last step of the problem: - https:…

> Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint.

It's even harder to do this plus the hard requirement of giving the NSA access.

Or alternatively, give the user a verifiable guarantee that nobody has access.

Re: Open Source Implementation of Apple's Private Compute Cloud

#15

Post by anon721656321 »

ryanMVP wrote: post #10

Reading the whitepaper, the inference provider still has the ability to access the prompt and response plaintext. This scheme does seem to guarantee that plaintext cannot be read for all other parties (e.g. the API router), and that the client's identity is hidden and cannot be associated with their request. Perhaps the precise privacy guarantees and allowances should be summarized in the readme. With that in mind, d…

at that point, it seems easier to run a slightly worse model locally. (or on a rented server)

Re: Open Source Implementation of Apple's Private Compute Cloud

#16

Post by almostgotcaught »

kreetx wrote: post #9
pjmlp wrote: post #4

[flagged]

I read this and your reply to the sibling, you seem to have reputation to be sensible - what are you trying to say? If someone re-implements or reverses a service then it doesn't need to be in the same language.

This dude stays commenting on things he doesn't actually understand anything about. I have run into him multiple times in threads on what I do (compilers) and he's clueless but insistent.

Re: Open Source Implementation of Apple's Private Compute Cloud

#17

Post by m1ghtym0 »

derpsteb wrote: post #13

I was part of a team that does the same thing. Arguably as a paid service, but source availability and meaningful attestation. Service: https://www.privatemode.ai/ Code: https://github.com/edgelesssys/privatemode-public

Exactly, attestation is what matters. Excluding the inference provider from the prompt is the USP here. Privatemode can do that via an attestation chain (source code -> reproducible build -> TEE attestation report) + code/stack that ensures isolation (Kata/CoCo, runtime policy).
Post reply on HN