Google is making private AI practical with homomorphic encryption

Quoted from the blog post:

> user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection

I think they forgot "or advertising" at the end.

I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2]

[1] https://tinfoil.sh/ [2] https://www.privatemode.ai/

My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.

Has FHE really progressed so far that it's now so efficient that doing computation on an encrypted prompt is feasible? I thought even basic operations like FHE addition were still thousands of times more complex. The only mention in the article I see is:

> But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing.

Which doesn't spell out exactly hon "nontrivial" the cost overhead still is.

This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.

I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.

Google is making private AI practical with Gemma4 something that you can run without an Internet connection.

All of the proofs of privacy rely on us getting the math right. All of the privacy from unplugging your internet cable is there by default.

Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needing to decrypt it anymore?

Anything to keep people from running local models

It sounds neat, but I do wonder how viable this is commercially. How high do we rate the chances that governments around the world will step in before another kind of E2E is rolled out.

Encryption or not, if it's on somebody else's server, it isn't yours. I don't believe Google has my best interest.

Zama.ai is also a player in this space

One flaw with FHE is that it guarantees only that you need the key to see the inputs or outputs of the computation, but not necessarily that the computation is the one you want. For example, the computation could be adversarial for certain inputs, or an adversary could insert their own computation first (or last).

Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?

I want to read a whitepaper but all I can find is the tl;dw conference presentation

Correct. I appreciate the theoretical technology here, but I believe a great deal of harm is done by the fact that people are not likely to understand exactly what this means.

Which is to say, I believe that google is strongly implying the falsehood of "no one at Google can read your stuff."

Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise.

So I take offense to the term FHE. It's a oxymoron.

The whole thing immidiatly stands out as a sham to build trust where it's gone.