alt.hn

8/14/2026 at 3:43:10 PM

Google is making private AI practical with homomorphic encryption

 https://blog.google/security/how-google-is-making-private-ai-practical-with-homomorphic-encryption/

by u1hcw9nx

8/14/2026 at 4:55:17 PM

My master's thesis is on a topic in this field (Privacy Preserving ML) and from my understanding HE and other techniques have very high overheads(~10^3) on inference tasks and thus aren't very commercially viable.

by sabretooth1405

8/14/2026 at 6:10:22 PM

To throw out some real and up-to-date numbers from [1] for FHE at "128-bit security level", to sort 8x 8-bit unsigned integers on the most ordinary of desktop PCs, wait 3 seconds for the result. Want to sort 32x 8-bit unsigned integers instead? Come back 34 seconds later for the result.

update: also see [2] for some primitive unsigned 64-bit integer operation benchmarks with the TFHE-rs library (winner in the sorting performance comparison of [1]). Equality at 80ms, addition and subtraction at 100ms, division at 8 seconds, etc.

[1] https://eprint.iacr.org/2026/1495.pdf Oblivious Sorting under Fully Homomorphic Encryption: A Comprehensive Survey and Performance Analysis, Omar Ahmed and Rostin Shokri and Nektarios Georgios Tsoutsos, 2026

[2] https://docs.zama.org/tfhe-rs/tfhe-rs/1.0/get-started/benchm...

by dhx

8/14/2026 at 10:00:01 PM

It’s slightly better for LLMs because FHE is really bad at branches (it ends up essentially having to try both branches), making sorts nearly the worst possible thing to try since it’s all branches. In the case of AI most things are just addition and multiplication which can make some things faster since there aren’t as many branches. But we’re still nowhere near viability.

by odo1242

8/15/2026 at 2:39:51 AM

The flip is also true: LLM inference is very nearly maximally optimal for FHE. Thee costly bit, multiplication of a bunch of compressed floating point numbers, translates 1:1. The only bit I’m not sure about is the softmax sampling at the end, but that’s just once per token.

On the other hand, each FHE step is a LOT more costly (e.g. elliptic curve exponentiation) than a vectorized BF8 multiply on GPU.

Unlike the sorting number case, it is probably same complexity. But no hardware support AND a massive slow down constant even if you were comparing apples to apples on hardware.

Disclaimer: I spent a decade working on crypto systems but I am not familiar with TFA’s research.

by adastra22

8/15/2026 at 5:57:21 AM

Softmax is once per token per a layer, and growing linearly with context window size (therefore quadratic over full input).

by skew-aberration

8/15/2026 at 9:10:01 AM

That's softmax dot-product attention. It's quadratic even without fully-homomorphic encryption, but at least it's not inherently branchy, so won't necessarily slow down much more than other floating point operations under encryption.

But softmax sampling, where you pick a single output token at the end and feed it back in to generate the next one, is branchy, so you need to do some extra encrypted computation to avoid leaking which token was sampled.

by yorwba

8/15/2026 at 2:34:17 PM

Assuming the client is online, you could offload the costly FHE sampling by handing them the raw logits.

by covoeus

8/15/2026 at 4:54:45 AM

I found [1] which appears to offer state-of-the-art performance of ~1000s latency for a FHE GPT-2 transformer block, equating I think to 3.33h inter-token latency (0.00008 token/s) for GPT-2(small) which has 12 transformer blocks. This result is using optimised packed arithmetic operations on a GPU as well--so seemingly is unlikely to have much performance upside from further optimisation.

I'm not sure I've interpreted [1] correctly though, and would appreciate correction if necessary.

[1] https://arxiv.org/pdf/2604.04783 -- GPU Acceleration of TFHE-Based High-Precision Nonlinear Layers for Encrypted LLM Inference -- Guoci Chen, Xiurui Pan, Qiao Li, Bo Mao, Congming Gao, Chengying Huan, Mingzhe Zhang, Jie Zhang -- Apr 2026

by dhx

8/15/2026 at 9:55:36 AM

Sorting doesn't need any branches. For FHE you need to think like a circuit designer without indexing operations. In that situation your default sort is a sorting network, made out of nlogn conditional swaps.

by Dylan16807

8/15/2026 at 9:59:39 AM

can you build a conditional swap in FHE in a small size though? FHE is always circuit like, ie no dynamic control flow anyway I think?

by justincormack

8/15/2026 at 10:12:03 AM

Once you calculate which value is smaller, the conditional swap itself is trivial. Let's say inputs A and B, comparison result is a boolean C. Outputs X and Y.

Bitwise: X = A&C | B&¬C, Y = A&¬C | B&C

Arithmetic: X = A*C + B*(1-C), Y = A*(1-C) + B*C

Edit: Or to put it another way, one of the most basic things you can make in a circuit is a multiplexer, and a conditional swap is two minimum size multiplexers next to each other.

by Dylan16807

8/15/2026 at 1:11:27 AM

I’m genuinely not an expert, but isn’t the beauty of MoE models the fact that we explicitly don’t evaluate every parameter on inference? We evaluate exactly the subset that are needed to evaluate a prompt. Seems like this will bring back data-dependent branches again.

by matthewdgreen

8/15/2026 at 1:32:57 AM

It would also kill speculative decoding. You would have to run a full inference pass for every token instead of being able to generate multiple tokens with a single pass.

by charcircuit

8/15/2026 at 3:22:14 PM

Pretty much, and this does a good job of illustrating the fundamental issue with branching. You could use an encryption scheme that allows the server to determine what MoE expert to load (the simplest would be to have the client decode the value and send it back to the server, though this can sometimes be possible to do without the round trip), but then it’s not fully homeomorphic because the server has some info about the computation that could be used to recover stuff about the original text.

Taking the above point to the extreme, a very simple yet mildly effective “homeomorphic encryption” scheme would be to run the first layer(s) of the ML model on-device, run the majority of the model in cloud, then run the remainder of the model on the device. But then you leak a lot of information that can essentially be used to get back the original text. (Usually in this type of scheme, to defend against this, the provider of cloud services doesn’t have access to the full model, it’s been used before on vision applications involving medical data)

by odo1242

8/14/2026 at 9:15:46 PM

That is sobering for sure, I wonder what the theoretical bounds are on what is possible if known. Would be such a dream to use a Frontier LLM one day with homomorphic encryption, but this sounds wildly implausible based on where things are today.

by tbenst

8/14/2026 at 11:20:29 PM

they would never allow it, atleast not for regular plebs such as you or I, consider if you made it say something politically incorrect? cant have that

by redeeman

8/14/2026 at 9:56:39 PM

We’re not even close to the limits of AI optimization so finding the theoretical bounds is going to have to wait

by joshspankit

8/14/2026 at 11:30:35 PM

This seems a fine tradeoff to me, depending on the context. There are datasets and operations on them where speed being sacrificed for privacy/security seems appropriate.

Ideally, give me a dial, to ask for encrypted intelligence when I need it. Kind of like a private chat, but with deeper privacy protections.

by randomImmigrant

8/14/2026 at 11:48:00 PM

Except that's for pathetically small datasets.

What real datasets exist where this would be a worthwhile trade off versus simply owning the hardware?

The numbers are so bad that underpowered local hardware would still beat it.

by XorNot

8/15/2026 at 9:29:55 AM

yep I can beat 0.0008 tokens/s on GLM-5.2 on my CPU

by inigyou

8/14/2026 at 5:37:39 PM

The article conspicuously fails to go into much detail about that. I poked around with an AI a bit (to rapidly cover all the linked pages) and it seems the best numbers we can get are from this arxiv paper: https://arxiv.org/html/2506.18150v4 Which says:

"We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively, on a single-threaded CPU."

There don't seem to be any direct comparisons available, probably because nobody else has any reason to limit themselves to one single-threaded CPU with normal techniques, but for reference the AI seems to expect that normal times for conventional setups are in the milliseconds range, fairly comfortably, even on CPU. I didn't find a clean primary source to link to for this claim, but clicking through various things that don't cleanly state the situation it did seem plausible. So we seem to still be in the range of single-digit orders of magnitude slower, possibly as much as 5 or 6, which is to say, we're still talking the range where we need to take the log of the difference to get sensible numbers, we're not using percentages.

(To run it yourself, I basically just fed the URL from the HN link, mentioned that FHE is known to be slow, and asked if anything linked in the blog post gave concrete times.)

by jerf

8/14/2026 at 6:50:37 PM

The linked repository has demos you can run (though you have to install bazel), and some of the smaller models run inference in about a second, while the larger ones take minutes.

That said, there is a lot of ongoing work on GPU acceleration. Cf. the recent FHE-based CIFAR demo that runs in 200ms: https://sofar.belfortlabs.cloud/

Still maybe 1000x slower than cleartext, but progress!

by j2kun

8/14/2026 at 5:35:46 PM

1000x slowdown is bad but not a complete deal breaker. Do you have a sense of what a reasonable achievable factor is? Do you have sense for how long before we get to that achievable factor?

by abetusk

8/14/2026 at 8:10:09 PM

It's a ridiculous waste of energy, just use local compute.

by jacquesm

8/15/2026 at 9:20:04 AM

Local compute is preferable where possible. There are cases where computation needs to be performed remotely. For example, when collecting data from remote entities while preserving privacy by allowing each entity to retain ownership of the encryption keys used to protect its data. At Belfort, we are exploring such applications, such as

- https://belfortlabs.com/blog/belfort-partners-with-lg-on-enc... - https://belfortlabs.com/blog/encrypted-fraud-detection-with-...

by furkanturan

8/15/2026 at 9:38:26 AM

For me it is the simplest reasons of all: privacy / confidentiality. There is absolutely no way any of this data leaves my systems.

by jacquesm

8/15/2026 at 4:36:55 AM

Good point, but if we can advance research on this via the AI bubble, it could improve privacy in other areas.

by joquarky

8/14/2026 at 5:59:01 PM

Commercially viable for Google boils down to can they attribute ads behaviors to it or not.

Then there’s a second tier of things that just make those wheels turn and if they do or don’t make ads revenue is nominally immaterial.

The teams doing this stuff at Google are purely for show, none of this makes it into any real products.

There’s the narrow exception of stuff like gboard, that does use privacy preserving ML/fed learning, but this stuff isn’t in the same zone.

I find it a bit embarrassing when Google publishes this stuff to be honest.

by bevekspldnw

8/14/2026 at 8:16:45 PM

GCP exists, friend. Right now industries are locked out of AI tools due to privacy laws.

If Google Cloud can offer FHE-powered tools, a hospital can run Google’s AI diagnostic models on encrypted brain scans without violating privacy laws.

FHE effectively removes the primary regulatory barrier keeping enterprise customers off the cloud.

by asdfman123

8/14/2026 at 8:46:25 PM

At that kind of amount of waste putting 2U server with some GPUs in hospital would be cheaper

by PunchyHamster

8/14/2026 at 8:55:03 PM

Making things 10x more expensive to reduce legal liability is what hospitals are all about

by asdfman123

8/15/2026 at 6:23:04 PM

We're not talking about 10x though, that's off by two orders of magnitude. This isn't a $200 bag of saline water, it's a $20,000 bag of saline water.

by anonym29

8/14/2026 at 8:11:18 PM

Autonomous driving was all show until Waymo happened AI research was all show until transformers happened. Quantum research is all show until ..

and now this.

Part of changing the world involves imagining a changed-world.

by bitpush

8/15/2026 at 4:31:08 AM

Cold fusion and room temperature superconductors (remember LK-99?) were also all show.

by joquarky

8/15/2026 at 2:08:48 PM

You can't prove the theory by providing an agreeing example though.

That for some cases they are still all show doesn't prove everything is all show.

by avmich

8/15/2026 at 9:27:25 AM

Sometimes I feel like 75% of their engineers are working on stuff that is purely for show. If their product doesn't generate enough profit very short term they stop it immediately. They have hunderds of cancelled projects, and those are only the ones which have existed. I wonder how many things they made internally and killed before ever showing it publicly.

by alpaca9

8/14/2026 at 6:00:24 PM

You are very wrong about all of this btw.

by luckydata

8/14/2026 at 6:36:52 PM

You literally don’t know who I am or the roles I had. So unless you can tell me how many steps you were from Kent Walker and what you worked on I’m gonna bet a hell of a lot I know more than you.

Edit to clarify my prior point: some of the technology makes it into the product, but the putative data protections do not.

Why?

Because there is always a work around, and ads legal will approve it every time.

by bevekspldnw

8/14/2026 at 10:01:43 PM

Google is too internally split up to have a single cohesive "maximize ad revenue" mission, especially now that cloud is the new golden goose and the future of search/advertising is hazy.

If cloud can sell compute to enterprise that can only use FHE, then they will not give a fuck if the ad goons are disgruntled about it.

by WarmWash

8/15/2026 at 2:30:47 AM

You have the CEO and the VPs who have final call when there are disputes below.

Ads doesn’t care until something affects them, GCP doesn’t.

by bevekspldnw

8/14/2026 at 11:02:23 PM

you are 100% correct, this product is to enable things like healthcare and generally AI subscription stuff that otherwise people wouldn't touch because of sensitivity to disclosing sensitive data.

by luckydata

8/15/2026 at 12:55:54 AM

Given that Google has a single unit that does $76 billion in annual revenue, $100 billion projected, without ads, raises questions about how relevant your knowledge is.

by antonvs

8/15/2026 at 2:27:57 AM

I should have bracketed out GCP as a theoretical application for this. I was referring to the Google consumer extended universe.

by bevekspldnw

8/15/2026 at 2:45:08 AM

Which is also learning how to monetize their offering via cloud instead of ads. So again your expertise here is questionable.

by surajrmal

8/15/2026 at 5:43:48 PM

Question away, not bothered.

by bevekspldnw

8/15/2026 at 1:51:57 PM

Ads does not have access to GCP data and there is no way legal would approve one

by sumeno

8/15/2026 at 10:23:21 AM

The distance between Kent Walker and Thomas Kurian is what you should be asking.

by fragmede

8/14/2026 at 8:12:07 PM

> You literally don’t know who I am or the roles I had.

I'm now curious. Who are you?

by bitpush

8/15/2026 at 2:26:19 AM

Saying that would make it unable for me to use HN as certain companies monitor my social media comments.

by bevekspldnw

8/14/2026 at 9:12:27 PM

yeah and I'm a Navy seal with over 300 confirmed kills etc.

by trucks-refinish

8/14/2026 at 8:25:43 PM

and you don't know who I am. I might have been closer to that work than you would know.

by luckydata

8/15/2026 at 5:45:10 PM

The work I’m guessing yes you are aware, but not the legal side of how they allow ads to circumvent the dog and pony show you put your life into.

Thats the embarrassing part, you know “don’t be evil” went out the window years ago, yet still think you’re making a difference with your little bit shifting games. As if the moment the work you do bumped against against revenue it would hold.

by bevekspldnw

8/17/2026 at 3:51:01 PM

when I worked at google I was known to be a very effective "legal whisperer". I spent more time in legal reviews in the last decade than you'll ever spend in the entirety of your life as I was working on infrastructure dealing with tons of PII working across the globe. I'm pretty sure I know what I'm talking about here.

by luckydata

8/15/2026 at 11:22:33 AM

Why don't you say what they are wrong about then?

by Chris2048

8/17/2026 at 3:49:21 PM

every single word. this is a project to enable private AI use cases which is a very real concern for a lot of enterprise customers dealing with highly sensitive data (think about healthcare and police work for example) and has nothing to do in any way shape or form with ads. The guy probably used to work or still works at Google but doesn't mean he understands what he's talking about.

by luckydata

8/15/2026 at 1:02:45 AM

I'm Ron Burgundy ?

by Melatonic

8/14/2026 at 11:38:46 PM

I saw a paper about this in early 2020 (pre-COVID shutdowns) at the ScaledML conference. I looked into it and had the same conclusions. At some point, running your own models in the clear is just more practical.

by elgertam

8/15/2026 at 7:18:08 AM

Only 1000x overhead would make some image classification tasks go from 1ms to 1s. That’s viable for some applications!

by petters

8/15/2026 at 9:14:33 AM

Exactly. That is what we have today at Belfort; not enough for making all AI work privacy preserving, but fast enough for many applications, where otherwise unencrypted compute is not acceptable.

by furkanturan

8/14/2026 at 5:39:29 PM

That's the reason for HEIR like optimization and parameter selection.

It narrows the 10^3 - 10^6 penalty to 10x - 100x.

by u1hcw9nx

8/14/2026 at 10:05:57 PM

Thoughts on whether HE could be further hardware accelerated?

by glaslong

8/14/2026 at 7:49:41 PM

Which seems massively worse than a real local device in fact 2x is probably untenable to the point of uselessness because actually privacy sensitive matters need actual privacy that can't be defeated by your government telling Google to serve you compromised js and spy on you anyway and most people don't give 2 shits about privacy so they won't pay 10% more let alone 2x.

I'm glad people fund things that are only of interest to nerds but this will never be useful.

by michaelmrose

8/14/2026 at 9:07:29 PM

I think you have completely wrong use cases in mind. You will not use this for normal compute workloads.

Typical use cases are for doing biometric authentication without giving your biometric information, or sensitive queries using medical information. Apple has homomorphic encryption in image search. You can use your own photos encrypted into the cloud to search for landmarks in the image without revealing photos.

People can also coordinate and compare information without sharing sensitive data.

by u1hcw9nx

8/15/2026 at 8:27:27 PM

Yeah, for simple calculations on medical data or whatnot, FHE is a highly useful tool. I do wonder, will indistinguishability obfuscation or witness encryption ever be a viable scheme?

by cryptographical

8/17/2026 at 10:47:43 PM

But for some fields, almost EVERYTHING they touch is sensitive. I've been reviewing PPML for wildlife management purposes, which my brother is involved in and my other brother, a ML expert, may want to be involved in.

With wildlife management, you're dealing with health issues, like rabies outbreaks. That requires privacy. You want to preserve customer confidentially because it's often embarassing. And private property cameras and sensors can leak information about private citizens or kids in a neighborhood without appropriate social and technical protections.

There are hundreds of fields like this. Not just healthcare and policing.

We are likely to see a lot of the hardware required for this to move out into space data centers for batch jobs at least.

And along with that calls for reduced RF and light pollution like StarLink.

And that is going to be helped by a large number of angry liberal citizens who are being riled up about data centers. And that anti-tech rhetoric is already leading to violent responses and debate.

Which hurts the liberal cause for universal healthcare. Conservatives see angry liberal anti-tech actions and tarnish calls for healthcare reform and other liberal causes.

The people who are going to benefit the most from cheaper PPML in orbiting data centers are in many ways making it harder for the rest of us.

It's not a small issue, and I wish I had had the reputation to reduce the anger.

It seems unrelated to PPML. But PPML is a clever political gas pedal to get space control.

by jgerrish

8/14/2026 at 11:40:03 PM

Is that (LLM) AI, though?

by lupire

8/15/2026 at 11:40:09 AM

One of the biggest problems IMHO is that they aren't trying to usefully accelerate it on anything other than specialty hardware or 64+ core EYPCs so nobody gets to play with it at home.

ex: A 7900XTX barely gets 0.5 TOPS of u/i64 naively w/ hip-direct, 5-10s just to bootstrap!

I needed more throughput for non-crypto i64 diff eqs so I slopped up a lib that uses RNS & CRT w/ Int8 GEMM... it's good for ~3.9 TOPS (~90% theoretical peak of the RDNA3) at prod relevant FHE sizes (2048/4096). This lowers bootstrap time to 200-500ms. It was basically free real estate lol

It isn't done yet (not worth the heat in the summer), going to finish it in the fall. Have been accumulating cloud credits to do CDNA3/4 validation in the meantime (If anyone has some to offer do let me know!)

It's neat but very dry, uses semantic contracts so you tell it what kind of mult you need and it chooses the validated best backend. If you're doing lots of smaller ops (512, 1024) it will use custom WMMA/MFMA kernels, dual issue, and grouped dispatch to land >70x over hip-direct.

https://github.com/doublemover/RNS8/

by monster_truck

8/14/2026 at 8:07:51 PM

The primary path to speed ups appear to be in custom ASICs by startups like Niobium. Combined with the recent Taalas acquisition by AMD, I think I see where this is going.

But yeah, for hot path traffic it's probably going to be swamped by the input data rate. But I expected identity tables and cached lookup data will need to be a core component so duplicate checks is avoided in every way available.

by Fordec

8/15/2026 at 9:22:19 AM

Count Belfort too. In addition to our GPU acceleration efforts, we have ongoing ASIC initiatives to further accelerate encrypted compute.

by furkanturan

8/14/2026 at 5:50:02 PM

Do you think that’s like a fundamental limit or something that will improve with time and new algorithms?

by clayhacks

8/14/2026 at 8:30:45 PM

I wouldn't be very bullish.

Homomorphic encryption got significantly efficient with the first few iterations, but I don't really see the necessary orders of magnitude savings coming soon. You could reduce this by some partial encryption schemes (e.g., for LLMs you need a handful of basic operations) but a better alternative already exists: multi-party computation.

Source: I did research in this area in the past.

by bhu8

8/14/2026 at 5:33:06 PM

Exactly my concern, and worse overhead that what I recalled.

Cost-wise the only viable private compute is local compute. It's more expensive than cloud, but true private compute in the cloud is definitely pricier.

by dietr1ch

8/14/2026 at 9:34:18 PM

The one that I'm waiting for is a women's period tracking app that uses FHE on the backend to be fully private.

by fragmede

8/14/2026 at 11:40:44 PM

Why on earth do you need a backend for this? The backend only exists because it leaks the data.

by lupire

8/15/2026 at 7:00:40 AM

because you lose your phone and don't have access to the account anymore.

by fragmede

8/15/2026 at 8:11:02 AM

Then the app can make a bog-standard encrypted-at-rest backup to somewhere and make all the computations on the device on the cleartext data.

I don't see the need to do computations on the encrypted data here, which is what FHE would provide in addition to traditional encryption.

> and don't have access to the account anymore.

This would be trouble with or without FHE. Even if the backend wouldn't need to decrypt the data, the user will - so as soon as you actually want to show something in the app, you have the same key management problems as without FHE.

by xg15

8/15/2026 at 10:52:44 AM

Okay, so the platform becomes valuable to its users when it's able to suggest things like "based on millions of users, people with cycles like yours typically ovulate around day 16."

In order to do the data mining in order to make those kinds of claims, traditionally you'd need to have access to the data.

As you point out, encrypted-at-rest is solved. But what about when it's not at rest?

In-use and in-transit is when FHE kicks in. Sure, you could just do it locally, but then you miss out on the aggregate data mining. Not for advertisers, but because it helps women with their bodies. The compelling product claim is "we literally cannot read your period data." Not "we pinky swear not to" but "we actually really really actually can't!"

by fragmede

8/15/2026 at 11:43:29 AM

If you can trust the app/platform developers to send encrypted anonymised personal data, then how can you trust them to properly use FHE personal data?

> "we literally cannot read your period data."

If the purpose is aggregated data for statistic, then surely the only per-user data they need centrally can already be aggregated (to some degree) on the device, e.g. send back only statistical-distribution variables of the personal data, for distributions over the 3-4 months? And at some point, does the service need to keep collecting data, once the model is good enough (at predicting ovulation etc)?

Another concern would be: If they are building a model, using user data, why should they own the model and thus monetise it (i.e. sell it back to its users) when users get no compensation for supplying that data in the first place.

A flow-tracking app should just stick to that, and purchase the model (for a fee) from a third party. The third party should concern itself with how to get the data without being able to leverage its position as a flow-app maintainer to trick or mislead the majority of its users into giving them free data.

by Chris2048

8/15/2026 at 12:07:03 PM

> Okay, so the platform becomes valuable to its users when it's able to suggest things like "based on millions of users, people with cycles like yours typically ovulate around day 16."

I don't know much about period tracking apps, but is this really the main reason people install those apps? Wouldn't you be able to get similar results by simply monitoring (on-device) the cycle of the person who uses the app for a few months?

How do those apps work before they have millions of users?

All the warnings I've seen about period tracking apps were about unexpected data collection of the entered data. This would be pretty silly if the data collection was integral to what the user expects the app to do.

> Sure, you could just do it locally, but then you miss out on the aggregate data mining.

Ok, a bit of a technical question about FHE here: My understanding of FHE was that you have input data encrypted with some key (plus auxiliary inputs, if needed, that are not encrypted), then you do operations on that data and get a result that is (still) encrypted by that same key.

No questions there as long as you're dealing with a single key.

But the whole point of aggregation and data mining is to combine data from many different users, i.e. inputs that are encrypted by many different keys. Does that work with FHE at all? And if yes, by which key is the aggregation result encrypted?

I don't see how that would work without either "moving" data from one key to another - which would be practically equivalent to decryption - or getting a result that is simultaneously encrypted by all user keys, i.e. practically useless because no one could individually decrypt it.

> The compelling product claim is "we literally cannot read your period data." Not "we pinky swear not to" but "we actually really really actually can't!"

You could obviously read the data enough to do aggregations on it.

If you can do that for "good" purposes, what stops you to use the same aggregation algorithm for advertisers - except pinky promises again?

by xg15

8/14/2026 at 10:01:59 PM

Saving your comment for the Weekend Project idea backlog, if you don't mind :)

by glaslong

8/15/2026 at 12:11:41 PM

Do you mind sharing your master's thesis? oO

Would be interesting to read it (and no judgement!)

by therealmarv

8/15/2026 at 6:41:45 AM

It might still be useful for classification usecases

by Jabrov

8/14/2026 at 10:22:00 PM

Sounds like the start of every journey. With all respect to your thesis, I probably put my chips on Google's research and security teams.

by mrcwinn

8/14/2026 at 7:23:22 PM

Great, private AI, at the cost of >1000x the resource usage. Because apparently AI companies weren't already using quite enough energy to cook the planet.

The most private AI is the one running on my own hardware, not in some giant data center.

by meindnoch

8/14/2026 at 10:34:10 PM

> The most private AI is the one running on my own hardware, not in some giant data center.

I want that too, but you gotta ask yourself the question how efficient that is compared to running it in a datacenter shared with everybody else.

by amelius

8/15/2026 at 11:56:58 AM

Energy efficient, yes, but when you want to keep a query/data private it's maybe worth the extra $ KW. Chicken pie recipes and google AI-search can still go though the datacentres.

As an aside: The computation might also not be the same e.g. ever-changing hidden pre-prompts, security/safety checks blocking or degrading responses, unavoidable verbosity to simple questions, watermarking, collection of prompt data to build user profiles for the purpose of advertising - and we haven't even seen in-response adverts, or sponsor-biased responses yet, but no doubt it's coming.

by Chris2048

8/15/2026 at 9:14:16 AM

it's more efficient than paying 1000x for fhe

by adgjlsfhk1

8/14/2026 at 11:41:47 PM

It doesn't matter how efficient it is because the user base for that workflow is microscopic

by lupire

8/14/2026 at 7:48:14 PM

Aren't there already much more efficient ways to make inference private?

Using regular encryption and secure enclaves, there are already providers that are roughly 2x the cost of normal providers. For example, https://tinfoil.sh/

by Eueudhsbsj32

8/15/2026 at 4:00:29 AM

> aren’t there more efficient ways

Heh yes absolutely, but there is some nuance.

Secure Enclave still requires you to trust the operator and also trust that it’s configured properly, supply chain is secure, etc.

The beauty of FHE is that it doesn’t rely on the compute being secure. All you need to secure are things you already have control over as a client.

I agree with you it’s still way too slow to be generally useful. (By general, I mean practical for arbitrary computation — you can relax the requirement and have fast homomorphic encryption if you only do specific kinds of operations).

by catlifeonmars

8/14/2026 at 8:19:57 PM

If I used regular encryption to send my credit card information to an AI with fraud detection, the provider still needs to decrypt that data on their side at some point before it goes into the AI.

Using this other encryption, the provider has neither need nor capability to decrypt it on their end, so the user gets extra security.

by siddthesquid

8/14/2026 at 9:00:08 PM

this is not entirely true, I think. secure enclaves can provide guarantee such that even the host machine cannot inspect the contents within the VM. so even though the AI model itself needs to see plaintext, all is happening in the enclave which the provider cannot see.

the main difference is where the guarantee comes from. for FHE, it comes from math, which we trust. for secure enclave, the guarantee comes from Intel/AMD's promise that their hardware is bugless/backdoorless, and that your adversary cannot directly inspect bits in the hardware

by llleeeoooh

8/14/2026 at 9:45:28 PM

- If an AI provider has control over the AI algorithm running in the secure enclave, they can easily have functions that provide them the plaintext through a separate channel. secure enclave does not prevent that

- The output can reveal information to the provider, which homomorphic encryption would have protected

- Inference is running on GPUs - so its moreso nvidia than amd/intel, but this is just a nit

So homomorphic encryption exists so the user doesn't need to do work to figure out if the provider could be adversarial.

by siddthesquid

8/15/2026 at 3:24:21 AM

> they can easily have functions that provide them the plaintext through a separate channel

That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications.

That combined with GPU confidential compute should protect your LLM prompt and output.

by Eueudhsbsj32

8/15/2026 at 4:29:09 AM

They’re not equivalent. One provides a best effort guarantee and is not trivial to implement correctly (it’s the Secure Enclave). I agree that you _could_ do all those things and do them correctly. However there are a lot more points of failure.

E2E encryption (including homomorphic encryption) have the nice property that there are much fewer ways for things to fail.

(Tangentially, attestation is basically trying to ensure that faults are obvious, but that doesn’t reduce the probability of the faults in the first place).

by catlifeonmars

8/14/2026 at 11:18:21 PM

yes I agree. although just to nitpick, there are ways to prevent side channel attacks within the enclave using software tricks. and output can remain in ciphertext via diffie hellman with client, etc. etc. but you're right that FHE provides a much more concrete guanrantee.

by llleeeoooh

8/14/2026 at 9:36:57 PM

There's a much more simple and much more efficient way to do it: Policy and Legal contract.

by delusional

8/14/2026 at 10:09:22 PM

A contract doesn't protect your data from government searchs, with or without warrant.

by Eueudhsbsj32

8/15/2026 at 3:25:28 AM

Wouldn’t a zero data retention agreement be pretty close to this?

by epwr

8/15/2026 at 2:58:58 PM

> Wouldn’t a zero data retention agreement be pretty close to this?

1. A ZDR clause is "trust me bro". You have zero way of verifying their pinky-promise.

2. A ZDR clause is still subject to the old-classic "government, court or administrative order" catch-all clause. :)

3. "Even with ZDR enabled, Anthropic may retain data where required by law or to address Usage Policy violations. If a session is flagged for a policy violation, Anthropic may retain the associated inputs and outputs for up to 2 years, consistent with Anthropic’s standard ZDR policy." (I quoted Anthropic, I'm sure all the others have similar).

by traceroute66

8/15/2026 at 6:45:32 AM

Yes, by running models locally

by rahkiin

8/15/2026 at 2:08:44 AM

Check out opaque.co

by whyage

8/14/2026 at 7:43:41 PM

where does this factor "1000x" come from? I have doubts.

by froh

8/14/2026 at 7:47:35 PM

https://www.jeremykun.com/2024/05/04/fhe-overview/#the-highe...

> Fourth, there is a bandwidth concern. FHE encryption schemes generally increase the size of the data being encrypted, and the user must send the server a special set of encryption keys to enable the computation, which are relatively large as well. The special keys need only be generated and sent once and can be used for all future computations, but they can easily be gigabytes in size. In one example FHE scheme with lightweight keys, a ciphertext encrypting a single integer is on the order of 25 KB, and the special keys are about 0.5 GB. In others, 16,000 or more integers are packed into a single ciphertext of similar size, but the keys can be 10s of GiBs.

by raggi

8/14/2026 at 8:09:31 PM

I'm still a bit skeptic - 1000x sounds overly optimistic and only looking at encryption transformation without any operation is already at least 10000x with scheme mentioned in that quote.

Sibling comment estimates lower bounds of current research at minimun 10^6 overhead which sounds more realistic.

by pamcake

8/14/2026 at 8:20:26 PM

Most likely from above in thread.

There is no reason to believe it should be lower than that - or even that low. Or do you have access to research claiming such achievements?

by pamcake

8/15/2026 at 5:50:30 AM

maybe I simply don't know how this works ;-)

I was very much surprised and asked. give me demerits for the way of asking.

but the question stays: how come an encryption scheme inflates data by this order of magnitude and needs GB sized keys?

where can I learn about this? not the nutty gritty details proofs and all but an overview. assume I did my CS masters in the 1990s and worked as SW eng ever since.

NVM, I asked Gemini

https://share.google/aimode/pqZO1VF3cGTeetamq

by froh

8/14/2026 at 9:11:32 PM

Yeah, I have doubts too. It's much higher than that.

by meindnoch

8/15/2026 at 8:39:19 AM

So much inefficiency just to run it on someone else's untrusted hardware. Private AI is already possible today with local open-weight models running on hardware you control.

Homomorphic encryption is cool technology, but I'm really not sure what problem it solves.

by snovv_crash

8/15/2026 at 1:50:27 PM

I bet this would've been ground breaking if this was an announcement from Apple though.

by neya

8/15/2026 at 4:58:10 PM

To be fair, Apple and Google are on opposite sides of the "respects user privacy" spectrum.

by stanmancan

8/15/2026 at 9:12:14 PM

tomato tomato.

by wseqyrku

8/15/2026 at 9:53:21 AM

There are many challenges we need to solve for privacy preserving compute. Legislations, legal matters, key management, HSM like devices that has limited compute capabilities. At Belfort, we are accelerating FHE, besides exploring such uses cases for FHE. Like this one with Google, we also have publishes use cases; https://belfortlabs.com/blog/encrypted-fraud-detection-with-... https://belfortlabs.com/blog/belfort-partners-with-lg-on-enc...

by furkanturan

8/15/2026 at 3:22:23 PM

The advertising case seems to be solved by local models as well, then the data doesn't even need to be sent to the server.

The Swift one is interesting, but I don't understand why the transaction needs to be encrypted, or more specifically why the model can only run in the encrypted part of the pipeline.

Super cool tech, but I guess I just don't see the application yet.

And wow, I worked with Marc a decade ago, small world.

by snovv_crash

8/15/2026 at 6:09:35 PM

Regarding the SWIFT example, transactions between banks across countries go through SWIFT’s infrastructure and are encrypted for regulatory and security reasons. Banks and financial institutions operating at this scale are also required to use HSMs (Hardware Security Modules) to meet security and compliance standards, ensuring that sensitive data is processed securely.

Suggesting alternative approaches to such large corporations is not straightforward. Their IT and security teams cannot afford to risk handling sensitive financial data in plaintext. No manager would readily approve a solution that offers additional functionality at the cost of deviating, even slightly, from well-established compliance practices. Encryption is therefore fundamental to how these systems operate.

The challenge arises when these institutions need to perform computations or checks on such encrypted data. Decrypting the data, even under controlled conditions and with trained personnel, is operationally complex, introduces additional risk, and can create a significant compliance burden.

This is where FHE offers a compelling solution. We demonstrate how a check can be performed directly on encrypted transactions against a known blacklist, without requiring the underlying transaction data to be decrypted.

P.S. It is great to work with Marc :)

by furkanturan

8/15/2026 at 9:35:41 AM

It's so that they can sell more things to enterprise customers

by firtoz

8/15/2026 at 3:35:31 AM

I think you folks are reading too much into it. I think the people working on FHE need to publish an AI-oriented pitch to retain funding from AI-pilled execs. Must be the same case with the golang post few days ago.

by never_inline

8/15/2026 at 4:49:30 AM

Yeah I don't think they actually want this. There's far too much deeply personal and useful data being freely feed to the companies running these models.

People are giving them everything. Their thoughts, feelings, intentions, company IP... It's a fucking gold mine.

There's just too much value in retraining on that data and even if there wasn't, the feds lean so heavily on Google search histories to get convictions I am certain there will be pressure to prevent any mass market services from adopting this.

by fedpost

8/15/2026 at 8:23:58 AM

When McDonalds introduced salads to their menu, purchases shot up -- but ~no one actually bought the salads. They just felt better about buying the same old unhealthy food from McDonalds when they knew that healthier options were available that they could potentially buy.

This is the same kind of thing. The crazy overhead of FHE means it's not practical for almost any kind of real world computational work. But having it available at all is undeniably technically impressive, and some of that sense of technical refinement bleeds over into your opinion of Google as a whole.

Incidentally, being a business client of Google's who actually uses this (or, say, quantum computing) for $BUSINESS_FEATURE would garner the same kind of positive attention, independently of whether it's technically a good idea.

Finally, if the overheads come down to the level where they are still significant but not insane, GCP is in a great position.

by akoboldfrying

8/15/2026 at 9:38:31 AM

I'll have you know I started picking salads instead of fries in combo meals the moment they became available.

Not that I'm a frequent customer, either before or after.

by Aozora7

8/15/2026 at 10:55:41 AM

Good on you and the other four or five people who do this! ;)

by akoboldfrying

8/15/2026 at 5:04:19 AM

All true. HE will never be used for anything real because it’s way to slow and inefficient, meaning you can only run the stupidest models on it. And there’s no commercial incentive to make it work because collecting data is too valuable.

But at the same time HE is classic Google promotion fodder. Really difficult technical problem! That’s what gets people promoted at Google. Nobody actually cares about it or will use it? That also is what gets people promoted at Google. Because Google only employs “the smartest people on earth” which means people who solve difficult problems. Difficult problems - not problems that need solving.

by oofbey

8/15/2026 at 8:27:27 AM

Well, wait until there is the first training algorithm that supports FDE. We promise we won't ever decrypt your data, we'll just train our models with it...

by xg15

8/14/2026 at 4:59:48 PM

This is the same Google that doesn't have e2ee on their password manager by default. Like WTF, it's a password manager.

by Cider9986

8/14/2026 at 5:35:09 PM

F. Scott Fitzgerald's test of top-tier intelligence -

> Holding two opposing views in the mind means accepting two contradictory ideas at the same time without needing to pick one side or rush to a simple answer

I continue to use Apple products because they are top class even though everytime I think of Tim Cook in the Oval Office presenting the gold plaque to the current president, it makes me wanna puke. World isnt black or white.

by bitpush

8/14/2026 at 6:54:46 PM

The reason I mentioned it is because Google seems to have a strange aversion to E2EE. Apple has added the option to iCloud but Google only has one consumer facing E2EE product, Google messages. A password manager is the most obviously important place to use it. I can't name another password manager that isn't.

by Cider9986

8/14/2026 at 7:07:20 PM

How many customers are using Google Password Manager? How much revenue does it generate? What would it cost to add E2EE? How would it affect the UX? How much revenue would it generate? What projects would have to be de-prioritized to fund this work?

I agree, a password manager without E2EE is unusable in my eyes. However, I can also understand the institutional reasons this might be the case. I don't think it reflects an organizational aversion to E2EE.

by rpedroso

8/14/2026 at 7:19:13 PM

Google Password Manager does in fact have E2EE. It's quite straightforward to enable. Your interlocutor is complaining that it's not the default, which I'm quite sure is a deliberate decision made on the grounds that the typical user, the one for whom the default matters because they won't tweak their settings, needs workable account recovery more than they need defense against the specific kinds of security threats that make E2EE relevant.

by ameliaquining

8/14/2026 at 7:47:57 PM

LastPass, designed for regular users and one of the most popular password managers, had a breach of user vaults. If they hadn't implemented E2EE then it would have been more devastating than it was (crypto wallets were found from vaults with weak master passwords).

by Cider9986

8/15/2026 at 1:52:44 AM

Google's security record at avoiding that kind of breach is just about the best in the industry, and their system that handles custody of password manager secrets is designed to withstand even a compromise of their production infrastructure (https://security.googleblog.com/2022/10/SecurityofPasskeysin...). I would advise almost all users to worry more about getting locked out of their password database than about that. Of course, I would also advise almost all users not to self-custody cryptocurrency.

by ameliaquining

8/15/2026 at 8:54:38 PM

Your link is about them using E2EE not that they can be as secure as E2EE for users without it. Users would lose their passkeys if they lost all secrets and devices. Google couldn't recover them.

They can still and should still continue using great security practices while protecting E2EE data.

>Of course, I would also advise almost all users not to self-custody cryptocurrency.

There's no point in crypto if you're not holding your own keys. It's the antithesis of cryptocurrency. People can have highly secure self custody wallets on a modern iPhone or Pixel. And their seeds would have been safe if LastPass didn't have terrible security or they used long passphrases.

by Cider9986

8/14/2026 at 10:17:34 PM

I'm pretty sure I've seen it sometimes in video calls. But it might only be two-way conversations?

by skybrian

8/14/2026 at 10:40:14 PM

That was my bad on the complete statement. If I could still edit I would say "that I know of".

by Cider9986

8/15/2026 at 1:53:10 PM

Why are we citing novelists for appeals to authority on something like intelligence. I thought this might be a figure on developmental psychology to give value to your comment, but it's not even that. Should I be citing George Orwell's doublethink to counter you?

by eventualcomp

8/15/2026 at 1:17:46 PM

Ah, Google must be very intelligent indeed, then.

by phyzome

8/19/2026 at 7:30:33 AM

That must be the most convenient excuse I have seen to avoid taking responsibility.

"I know the raw materials for these clothes come from slavery, but hey, what can I do ? They're the softest."

by agilemonkey

8/14/2026 at 8:03:32 PM

[flagged]

by michaelmrose

8/14/2026 at 9:17:16 PM

> This is generally the test of extreme stupidity because those so adept rarely realize there is even a contradiction because they lack in critical thinking.

> You can separate Cook is a garbage person

We've banned this account.

We've asked you politely, several times over the years to observe the guidelines. In recent times you've been acting more than ever like they don't apply to you. They do apply to you just as they apply to everyone and it's time we made that clear.

In this case, someone has raised the notion that sometimes someone can hold two legitimate positions that are contradictory, which, as the original commenter mentioned, is attributable to F. Scott Fitzgerald but has been noted in different ways by many reputable philosophers and scholars through history. In your reply, you've effectively sneered at anyone who wrestles with such contradictions, including the parent commenter, then gone on to use the term “garbage person” for another human.

Other terms you've used in past months include:

most humans are dumber than a box of rocks

literally not figuratively the 1930s Nazis

fools

idiots

morons

cretins

It's always a challenge for us to fairly moderate political discussions on HN. We want people to be able to discuss important, difficult topics and ideally to work together to develop ways of making the world better. HN is a place for builders, and that can and should include building solutions for the difficult problems the world faces, or at least talking about how we could. Identifying and critiquing flaws in the ideas and actions of one's political or intellectual opponents is fine and healthy.

Continually demeaning individuals or groups with dehumanizing or contemptuous epithets and caricatured characterizations makes this place toxic and drives away people who come here with the expectation of having intellectually gratifying discussions with reasonable people.

When people continue to break the guidelines, even after several appeals from moderators, we have to assume they have no intention to use the site as intended and in fact want to be banned. If that's not the case, you can email us at hn@ycombinator.com to discuss how you can demonstrate that.

by tomhow

8/15/2026 at 4:34:08 AM

I wholeheartedly support moderation to keep a healthy community but this is asinine.

My takeaway is that you were personally offended by the (mild) attack on Cook and Apple products, likely because you use them and associate them with your self worth, and responded in defense of ego.

I say this based on observing casual usage of 'fool' and 'idiot' and other terms a myriad of times in other threads with no action or response.

I'm glad to see a moderator in the wild but JFC not attacking a windmill.

by not_a_bot_4sho

8/15/2026 at 5:11:22 AM

Please don’t imagine my “true” motivation or inner psychological state and attack me for it. You have no idea what devices I use or what I think of Tim Cook. Even if I had any personal affection for him, if I banned accounts just for criticizing a product or individual I personally liked, I would not have lasted more than a few days before being hounded out by top users of the site.

It’s true that this comment alone was not sufficient for a ban; as I explained in my comment, it’s the pattern of comments, particularly in recent days, continuing a pattern over years that we’ve posted several warnings about. And it's the fact that other users who have a solid track record of contributing positively to HN are being driven away by that style of rhetoric from this user, or at least signaling that these comments were beyond the pale.

Our role here is to make HN a place where reasonable people feel they can have intellectually gratifying discussions that are of higher quality than elsewhere online. When we see signs that good contributors are being driven away by an escalating pattern of toxic comments from a user who has been warned many times over a decade, it would be negligent of us not to act.

As we say all the time, we don’t see every guidelines breach, or reply every time we do; there are over 10,000 comments posted each day and only two of us. But when we see an ongoing pattern of abuse, we always issue warnings, then ban the account if it continues. You’re always welcome to email us (hn@ycombinator.com) when you see anything egregious, or at least just flag the comment. That's what people do when they wholeheartedly support moderation.

by tomhow

8/14/2026 at 10:06:35 PM

Ehh, “dumber than a box of rocks” or similar is more hyperbole than dehumanising speech. Dehumanising speech is calling someone something like a cockroach or a rat. Bit of an overreaction here mate

by garbagewoman

8/14/2026 at 10:11:38 PM

Sure, in isolation, you can dismiss that kind of language as hyperbole and let it pass. But we're talking about a pattern of rhetorical style and substance over several years that they have been warned about several times, but with no evidence of any intent to reform. HN is not intended for this style of discussion, and people who continue to engage it are driving away people who do want to use HN as intended.

by tomhow

8/14/2026 at 11:02:46 PM

Its a pattern of rhetorical style that isn't what a reasonable person would call dehumanising language. Their comments might not be something you think is acceptable for HN, but using that word to describe their comments is a real stretch and devalues the word

by garbagewoman

8/14/2026 at 7:31:59 PM

I think that, if you are under the impression that having an administrative back door is an unpopular feature, then you should speak to more of your non-technical friends about their experience of technology. I think you'll find that the people who could most benefit from a password manager often don't have good credential management and would be worse off if they lost all their passwords when they forgot or lost their master password.

by aeturnum

8/14/2026 at 7:44:52 PM

You can have recovery in Bitwarden with the email feature.

by Cider9986

8/14/2026 at 5:13:53 PM

If you think about it for a moment you will realize the average user does not want that.

by amazingamazing

8/14/2026 at 6:31:11 PM

yes, lastpass get $ tens millions because its weak and gets hacked not because its realiable, secure and great.

by kingleopold

8/14/2026 at 5:29:33 PM

I suspect that your one moment of thought follows many years of contemplation. Maybe you can fill us in on some of that background.

by rexpop

8/14/2026 at 5:31:35 PM

E2E encryption means that if the user loses the keys, there is no way to recover that even if they contact support and prove the data belongs to them.

by giovannibonetti

8/14/2026 at 8:22:57 PM

> there is no way to recover that even if they contact support and prove the data belongs to them.

Eh, since Google's support doesn't exist in the first place, none of this really matters, and nothing is lost.

by fg137

8/14/2026 at 5:30:24 PM

How do you make e2e password management work on multiple devices as convenient as not? You cannot.

Most people who use Google trust them. And if you do not trust them then why are you using their password manager? You see? Hence why they do not bother.

Of course one might read this and say, multi device e2ee is possible! Sure, but can you allow for recovery when people inevitably lose their recovery codes at scale? If you really care about this it is not necessary to go with Google.

I stand by my original comment:

The average user does not want it.

by amazingamazing

8/17/2026 at 3:55:26 PM

Literally all major password managers are E2EE except Google's. The UX is fine.

by Cider9986

8/15/2026 at 5:07:21 AM

Former Googler here. E2EE is easy. Nobody gets promoted at Google for solving easy problems. In fact if you set out to solve an easy problem, it looks bad at performance review time.

by oofbey

8/15/2026 at 2:19:16 PM

How is E2EE easy?

by Cider9986

8/15/2026 at 5:39:55 PM

Adding AI slop to everything is hard, though, I guess.

by Cider9986

8/14/2026 at 8:40:51 PM

That doesn't protect their ad targeting in the eyes of regulators, so no point in turning that on by default

by cantalopes

8/15/2026 at 7:08:19 PM

what would e2ee for a password manager even be? This reads like "Whoa, this encryption key isn't encrypted, we should encrypt it for added security"

by TZubiri

8/16/2026 at 4:15:28 PM

Same as any E2EE product. You don't have to trust the server and only the users hold the keys.

by Cider9986

8/14/2026 at 5:24:03 PM

Google is making private AI practical with Gemma4 something that you can run without an Internet connection.

All of the proofs of privacy rely on us getting the math right. All of the privacy from unplugging your internet cable is there by default.

by lsb

8/15/2026 at 7:26:26 AM

"hotword" detection, is this basically sniffing encrypted data for words the authorities don't want you to speak?

Seems counterproductive to their stated aim of privacy.

by HlessClaudesman

8/15/2026 at 8:24:52 AM

Not even just by the authorities. This sounds like the wet dream of Google itself or any other data mining companies. You can just ship the most sensitive data around and extract signals to your hearts content - and even if it would be protected by law, you're good because hey, it's always encrypted, and the signals, ad assignments and profile markers are encrypted too!

This is what I don't like about all this "I'm not touching you" privacy tech, also including the new trend of nonvoluntary on-device processing.

They pretend "privacy" was a primary goal of it's own, completely detached from any reasons why you would want to have it.

Then they go on gloriously holding up the flag of privacy, while at the same time enabling all the things that you wanted to have privacy against in the first place.

by xg15

8/15/2026 at 9:55:39 AM

And if they can detect "words", surely a determined attacker can reconstruct the whole thing.

by HlessClaudesman

8/15/2026 at 10:49:05 AM

from what I understand, only the holder of the private key would be able to see if a hotword was detected or not. even if Google ran hotword detection over your data, they’d only get a encrypted output on if the hotword was detected or not

by hyusap

8/14/2026 at 5:19:05 PM

Has FHE really progressed so far that it's now so efficient that doing computation on an encrypted prompt is feasible? I thought even basic operations like FHE addition were still thousands of times more complex. The only mention in the article I see is:

> But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing.

Which doesn't spell out exactly hon "nontrivial" the cost overhead still is.

by bmenrigh

8/14/2026 at 7:14:05 PM

addition is easy/essentially the same cost as standard (not really, because you have to compute mod p addition rather than mod 2^32, but ignoroing that it's roughly the same).

as a general rule multiplication is the difficult part.

it's hard to accurately quantify what "nontrivial" cost overheads are because they're very application dependent. for example, things that require encrypted control flow are very hard under FHE. so an encrypted hashmap sounds roughly unimplemnetable. but things that do not require encrypted control flow (e.g. many ML applications) are less bad. this can still be quite bad though. for example, relu is trivial in plaintext. it is hard homomorphically, because the trivial way to write it uses private control flow.

by mswphd

8/15/2026 at 1:41:21 AM

It's not running LLMs.

by nl

8/14/2026 at 7:25:13 PM

There are LLM models which compute only using addition no?

by sean_pedersen

8/15/2026 at 3:36:25 AM

I see a lot of comments here about how private AI is much cheaper than doing this, and that is currently true.

But I am curious if anyone can think of any use cases for this as it currently stands? For every idea I can think of, I can think of another solution that would probably be a better solution at current slowdown in cost from using homomorphic encryption.

For their two examples...

1) For the "will they click the add" one, how would anyone verify that the model I am uploading of myself is remotely accurate? And can't they learn my characteristics by running them against very specific ads that pinpoint my preferences?

2) For the "Do you have heart disease" one, why not just generating a billion datapoints (or more). The user can download the compressed data of this huge sample of points and then just enter their data on their own side and find the point that is closest (if not an exact match) to their own data?

I'm not pulling apart the idea of homorphic encryption, I'm just curious if anyone can think of a really compelling use case for it given it 10^3 to 10^6 greater compute cost?

by stephen_cagle

8/15/2026 at 3:52:34 AM

If the bottleneck is data transfer rate or volume, then I think you’ll find more use from today’s FHE. Incidentally there is a fair amount of overlap in the use case space between homomorphisms and oblivious transfer.

by catlifeonmars

8/15/2026 at 6:43:27 PM

Huh, that is an interesting thought. My belief is that a FHE scales at least linearly to the size of the memory. My belief for this is that it if didn't I could "learn" what computation you are doing by analyzing what parts of memory you did not look in.

So, by that logic, we are potentially looking for a problem space where their is a large amount of data that is too large to even be paged through by the client, and where the FHE would actually make financial sense relative to downloading it?

I'll think about that, but nothing immediately comes to mind.

by stephen_cagle

8/14/2026 at 5:28:04 PM

I've published two papers on using HE for ML and it's nice, but also alarming, to see big players like Google and Microsoft making decent tools for performing HE. Although the technology is still much farther out from being commercially viable, it does pose an interesting problem about how these data aggregation companies will utilise a tech that is inherently private.

by sheesdev

8/14/2026 at 6:47:08 PM

One potentially simple answer is: to make things that are otherwise illegal (for regulatory reasons) possible.

There are some instances of hand-built cryptographic protocols used in production at Google that use FHE in small doses (e.g., computing a single dot product as part of an interactive protocol), so the big question is whether having a general-purpose tool will expand the feasibility of applying these to other, maybe less critical projects that still want some privacy guarantees but can't afford to hire cryptographers.

by j2kun

8/14/2026 at 5:32:18 PM

I guess I'm curious from your perspective what and why makes the tech from being commercially viable, and the concerns of big players adopting this (which was always going to happen I imagine, but when shapes a lot of the future of the field).

by tolugenius

8/14/2026 at 7:15:27 PM

Private AI is practical by running the model locally, every much more so than any homomorphic encryption scheme.

So essentially the headline sells this as work to keep your data private, but really it's work to keep the AI-- which was trained on your code and your writing-- private.

by nullc

8/15/2026 at 5:52:12 AM

A homomorphic encryption blogpost without any mention of the computational overhead...

by Frannky

8/14/2026 at 7:20:31 PM

I did some amount of research into the feasibility of PHE and FHE about 20 years ago, and my conclusion at the time was that the space overhead of the encrypted output was a massive bottleneck, which meant that while it was potentially useful in a small number of niche cases it wasn't ever going to be practical for general-purpose computations without a major breakthrough.

The gist was I could do an encrypted (int)x + (int)y = (int)z computation, I could encrypt the inputs and then get a result back that was correct, secure, and decryptable, but was like 1MB in size.

So, for someone whose knowledge is 20 years outdated and is about Pallier crypto, has that major breakthrough happened?

by drblast

8/15/2026 at 12:22:04 PM

It seems to me this tech still presumes the data sits in data warehouses, which i don't like to start with. The tech succeeds in packing the data in identical black boxes, so they all seem equal to the map-reduce function that runs over them. A separate identification layer knows which of the boxes is yours. But who knows, maybe from the results you can be fingerprinted anyway. As in the game, how many questions before you can guess the thing I'm thinking of? Answer: not that many.

by childintime

8/14/2026 at 5:25:52 PM

Maybe I'm not understanding this, but how is it that you can know enough about the data to process it without undermining the fundamental concept of encryption? Isn't encrypted data supposed to be just random noise without the key? The more you know about the underlying data the easier it gets to decrypt? Does this mean someone can just steal your encrypted data and use that to steal your identity without even needing to decrypt it anymore?

by NyxWulf

8/14/2026 at 6:03:45 PM

you can produce a correct result without knowing what that result means as long as the person you then provide that result to can decrypt it. So the way it works is the server does the job on data it can't read, sends an answer to the device, the device decrypts it.

It's very useful for things like healthcare data for example but also for products like "home assistants", and it's one of the use cases that the team hiring internally was giving in their job req. I tried to apply too but didn't get it unfortunately, this was a very interesting product to work on imho, congrats to whoever got my job :)

by luckydata

8/15/2026 at 4:11:12 AM

the basic encryption scheme used here is fairly straightforward actually, at least the symmetric encryption version. Let s be a uniformly random, 512-dimensional u32 vector. To encrypt a message m (say a 512-dimensional bit vector for simplicity), you

1. generate a 512 x 512 random (u32) matrix A, and

2. generate a 512-dimensional rounded (to the nearest integer) Gaussian, say of standard deviation 10, e.

The ciphertext is then [A, b :=As + e + 2^8 m].

To decrypt, you compute b - As to recover 2^8 m + e. You can then recover m, as e << 2^8 with high probability.

Anyway, if you have two of these ciphertexts, you can sum them together to get

[A1 + A2, (A1 + A2)s + (e1 + e2) + 2^8 (m1 + m2)]

this decrypts to m1 + m2, so you can recover homomorphic sums (or scalings by small integers).

Multiplication is more complex, so I won't get into it here. But the high level from the above example is that you could have someone compute arbitrary linear functions of your data without them knowing what your data is.

by mswphd

8/15/2026 at 1:09:09 PM

Will the new (summed) A, e and b be the same size as the originals, and is m2 + m2 still a 512-dimensional bit vector?

I though (when I tried to understand it) that some part of the HE inflates some component of the result?

by Chris2048

8/16/2026 at 4:38:45 AM

only temporarily, and only for multiplication. At a very high level, the idea is that you view C := [A, b] as satisfying

CS = 2^8 m + e

here, S = [-s, 1] is a padded version of the initial secret. So recast everything as a linear equation (matrix) equation

CS = 2^8m + e

Without getting into too much details, one can define a "product" * such that

(CC)(SS) = (2^8m + e)(2^8m + e)

This becomes a "degree 2" equation. Mildly faking the details for simplicity, one can expand it out not in terms of A, b, but in terms of three components A, b, c, where c is the "degree 2" component. So here things have inflated. But there is also a technique to shrink this back down to a linear equation.

This shrinking process requires some auxiliary data, namely an encryption of SS under S. it is not the problematic part of HE though. Instead, data movement (say a circular rotation by k indices) also requires some "fixing up", though here involving an encryption of rot^i(S) under S.

This is more problematic, as there are many different rotations (often on the order of thousands), and you naively need a piece of auxiliary data for each of them (vs one for multiplication). There are ways to shrink the required number of keys, but in general they're the "heavyweight" part of FHE.

by mswphd

8/15/2026 at 6:46:13 AM

this isnt about the progress of FHE, this is about models hiding reasoning traces (i.e. "thinking") from their paying customers because they dont want them knowing how question A got to answer B.

by jijji

8/14/2026 at 4:42:51 PM

One flaw with FHE is that it guarantees only that you need the key to see the inputs or outputs of the computation, but not necessarily that the computation is the one you want. For example, the computation could be adversarial for certain inputs, or an adversary could insert their own computation first (or last).

by LoganDark

8/14/2026 at 4:58:39 PM

100% not an expert but my understanding was that part of what you are proving by signing the computation is that the computation itself was performed specifically as agreed to. I may be mixing this up with zero knowledge proofs.

by noman-land

8/14/2026 at 5:03:17 PM

If this were the case it would be necessary to send the entire model weights in response to every request which would be a bit inconvenient.

by LoganDark

8/14/2026 at 5:29:06 PM

Hmm, could one instead of sending the model weights, send like, a merkle tree root for them, not exactly specifying the model, but at least demonstrating that the same model is used each time?

by drdeca

8/15/2026 at 5:48:41 AM

I feel like that'd have to be generated as a side effect of the computation somehow?

by LoganDark

8/14/2026 at 7:17:07 PM

note that this is even true for an honest server. Roughly, FHE computations often require certain bounds on the (encrypted) messages for things like tuning polynomial approximation domains etc. If your messages are out of distribution for the tuned polynomial approximations you'll get back garbage as as result.

by mswphd

8/15/2026 at 5:41:22 AM

Does this also solve provable compute as a side effect? Since the compute is fully encrypted end-to-end, the host wouldn’t be able to modify the program and still give valid results?

So a caller could run a program on untrusted hardware and trust that the hardware actually ran the program?

by r3trohack3r

8/15/2026 at 6:08:17 AM

No, with FHE you don't know what program is running on the data, you just know that it can't access your data.

by tsimionescu

8/15/2026 at 6:52:49 AM

I‘m new to this, but mildly skeptical. In complex agentic engineering, there are lots of intermediate steps that depend on each other. Even if you disregard the significant encryption cost, this makes it impractical. So seems like this will stay a niche.

by senand

8/15/2026 at 10:01:27 AM

Thanks a lot. We have some road ahead for using encrypted AI for your agentic work. Today, I would not suggest thinking that as the primary target. Instead, there are many untapped applications (e.g. inter-bank transfers, industry, healthcare) where regulations, privacy laws and compliance requirements restrict institutions from touching data. These will initially be our key enablers, and over time we hope to extend the range of applications. At Belfort we are exploring such use cases that will benefit our FHE acceleration.

by furkanturan

8/15/2026 at 11:36:17 AM

I think this could be an effective privacy preserving approach:

Run the encoding and first and last layer of the LLM on the users machine. They could still get some idea of the content but really couldn’t easily get the actual text back.

Anyone know if that’s viable?

by bilsbie

8/14/2026 at 7:02:43 PM

Ideally: we will have private AI

Reality: our computers will be used as distributed AI calculators

by p0w3n3d

8/14/2026 at 8:29:48 PM

Freenet, but for AI inference.

by hamper653

8/15/2026 at 12:38:28 PM

That's not what I meant. I meant botnet taken over by Google

by p0w3n3d

8/14/2026 at 11:11:12 PM

Funny to read this, but google is currently number one anti-privacy big tech company. No other company makes it as difficult for its users using anonymization/privacy software to access their services

by maxo133

8/15/2026 at 12:04:35 AM

Pure hyperbole. I can’t even browse Facebook or Instagram anonymously for 15 seconds; I get a hard login popup that would require me to be identified in order to continue. Same with X. I’m also starting to see this with Reddit. Google is the tamest of the bunch; I still do all my Google searches while logged out. Occasionally I get a CAPTCHA but that’s about it.

by kccqzy

8/15/2026 at 12:35:55 AM

Google generally doesn't need you logged in unless you are doing heavy privacy cleaning.

Even in that case, they see data they are getting to be worthwhile enough for their other lines of business.

by stackskipton

8/16/2026 at 7:04:10 PM

> Google is making private

(in the voice of George Bush Jr.) And it feels good doing it.

Google doing something private is like Microsoft doing something secure.

by hulitu

8/14/2026 at 6:08:23 PM

Why is the bold letter n lighter than the rest in this page's font?

by nazgulsenpai

8/14/2026 at 8:53:03 PM

I think at 1000x it's probably way cheaper to do an "AWS outpost" style thing. Although not sure if it's a fundamental constraint or something that could be optimised.

by sarjann

8/15/2026 at 7:44:43 AM

I really want nobody to waste cycles on my AI than me. This is useless because now I need to pay for wasted inference AND encryption cycles on top of wire encryption.

by vkaku

8/15/2026 at 10:07:34 AM

While encrypted AI chatbots seem within reach, we don’t see them as the primary target today. There is a set of untapped applications, such as inter-bank transfers, industrial use cases, and healthcare; where regulations, privacy laws, and compliance requirements prevent institutions from directly accessing or processing sensitive data.

This is where we believe Belfort can make a real difference: enabling organizations to compute on sensitive data while preserving strong privacy guarantees. And FHE doesn’t necessarily mean relying on Google, AWS, or Azure for encrypted compute. Companies can run FHE on their own infrastructure, allowing them to process their clients’ data privately while maintaining control over their systems and keys.

These applications are our initial focus, and over time, we aim to expand the range of use cases that FHE can unlock.

by furkanturan

8/16/2026 at 4:03:14 PM

I think that encrypted/homomorphic inference has overstated benefits and won't work as well for financial/ regulatory cases, where explainability is a bigger problem and AI has that accuracy issue.

by vkaku

8/14/2026 at 4:44:12 PM

It sounds neat, but I do wonder how viable this is commercially. How high do we rate the chances that governments around the world will step in before another kind of E2E is rolled out.

by Deukhoofd

8/15/2026 at 10:31:25 AM

Sounds like a fantastic waste of compute. The future of private AI is local inference rendering this application of it pointless.

by tjpnz

8/15/2026 at 9:27:17 PM

It's "private" "cloud" computing all over again, this time brought to you by jensen et al.

by wseqyrku

8/14/2026 at 5:33:26 PM

Quoted from the blog post:

> user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection

I think they forgot "or advertising" at the end.

I don't trust Google. I would much prefer to use on-prem or - at most - one of the secure-enclave providers like Tinfoil[1] or Private Mode[2]

[1] https://tinfoil.sh/ [2] https://www.privatemode.ai/

by traceroute66

8/14/2026 at 5:40:42 PM

Secure Enclaves are broken all the time though [1]. They’re also not secure against attacks from a quantum computer (including store now decrypt later attacks). At least with symmetric FHE, anything that happens after encryption requires zero trust.

[1] https://sgx.fail/

by flambo

8/14/2026 at 6:48:10 PM

Indeed, Google itself has a large research group that repeatedly breaks TEEs with side-channels and such.

by j2kun

8/14/2026 at 3:47:47 PM

Encryption or not, if it's on somebody else's server, it isn't yours. I don't believe Google has my best interest.

by FloatArtifact

8/14/2026 at 3:49:45 PM

With Fully Homomorphic Encryption it's nobody elses.

The basic idea of of the project is to remove the need for trust.

by u1hcw9nx

8/14/2026 at 4:23:05 PM

It's google. They are good at engineering. Not at creating trust. After the bizillionth time they have broken trust, there is no need for benefit of the doubt.

by unsungNovelty

8/14/2026 at 4:53:00 PM

Yeah. Google is an ad business. Their entire motive for getting invested in AI is ad revenue. We're supposed to believe they just... won't turn on the money fountain? After going into the red for their data center investments? Hell nah.

I'd expect this to be something like the Google Ad ID: technically separated from what Google considers personal information, but trivially easy to tie back to an individual person and to other information about that person.

They're continually breaking trust by illegally scraping up the internet to feed to their plagiarism machine, which they are now asking us to trust with more data. It's not a compelling arguement.

by Plont

8/14/2026 at 7:24:38 PM

This blog post is about an open source project that you can look at for yourself and decide whether it's suitable for your use case.

by ameliaquining

8/17/2026 at 7:36:01 AM

Sure. But it will be trickled down into project by google which will effect us all and we won't have a say.

by unsungNovelty

8/14/2026 at 4:51:57 PM

There's more to life than branding.

by throwaway27448

8/14/2026 at 4:53:16 PM

so what's the option ??? Meta ?? xAi ?? or OpenAI ???

by tonyhart7

8/14/2026 at 5:01:21 PM

Why should there by any reason to look at the above ones? We are talking about this B2C company which effects a lot of our lives. The discussion isn't about that or this. The discussion is about JUST this specific company.

by unsungNovelty

8/16/2026 at 2:39:04 AM

It was not my intent to undercut cryptography as a field or in its use. Consider client side scanning for photos before they're encrypted and uploaded to the cloud. I see no difference AI's future. Content, maybe encrypted, but a form of client-side scanning, or the model itself, will report users.

by FloatArtifact

8/14/2026 at 4:32:09 PM

To what end?

by thih9

8/14/2026 at 6:04:31 PM

Biometric authentication, credential checking, blind auctions, threat matching (search zero-day signatures without revealing the vectors), private dna matching or running queries of medical symptoms and health records against databases.

I think the most immediately useful is checking if a username/password hash appears in a leaked database without revealing which account or password hash is being checked.

by u1hcw9nx

8/15/2026 at 6:33:30 AM

I do like that list and thank you for the explanation.

I still worry about how an ad company is going to approach this. Each of these advancements could be used to put ads in more places.

by thih9

8/14/2026 at 4:58:22 PM

This kind of attitude is really disrespectful of decades of progress in cryptography. Without even considering homomorphic encryption, classic encryption is specifically designed to make intermediate nodes such as ISP dumb pipes that do not know the contents of communication. The ISP can store your communications on their server however they want.

If you don’t agree with this model, I’m afraid modern cryptography doesn’t have anything to offer.

by kccqzy

8/14/2026 at 5:16:38 PM

Even if your files are properly encrypted, if you keep them on, say, Google Drive, then you might lose access to them if your account gets inadvertently blocked.

I think GP is trying to say something along those lines. Not that encryption isn't trustworthy, but that even with homomorphic encryption you still give up autonomy.

by jewel

8/14/2026 at 11:11:17 PM

That’s not a problem solvable by cryptography. Your ISP can’t read your traffic, but can cut off your traffic. You can use end-to-end encryption to encrypt your files to upload to Google Drive, but Google can choose to delete your files.

by kccqzy

8/14/2026 at 4:26:42 PM

It's FHE for "cryptographically-secure private AI inference" not for every other service where they snoop into your behavioral information.

by krunck

8/14/2026 at 8:13:58 PM

Unless all of your money is under your mattress, you're already making such decisions with a far more valuable asset.

by bitpush

8/14/2026 at 5:35:08 PM

It can give you confidentiality without availability. Not sure about integrity? Anyways, still useful.

by yjftsjthsd-h

8/14/2026 at 9:05:28 PM

Why is Homomorphic Encryption necessary at all? The article seems to lose the plot in the process of tooting their own horn.

by josefritzishere

8/14/2026 at 11:25:21 PM

The only question is do you trust Google? No…

by Danox

8/15/2026 at 10:20:02 AM

That is the key advantage of FHE: you encrypt your data locally, using keys that you own, and never need to share the plaintext—or the keys—with anyone.

But there is more to it. Teams like us at Belfort, we are working to make FHE practical for organizations that want to deploy it for their own use cases, including on infrastructure they control themselves. Even in these setups, FHE can enable applications that would otherwise be blocked by regulatory, privacy, or compliance requirements.

by furkanturan

8/15/2026 at 5:42:18 AM

Maybe Apple will put its watches behind this and the computational complexity will be solved by some breakthrough.

by gigatexal

8/15/2026 at 11:26:01 AM

s/watches/war chest/g

by gigatexal

8/14/2026 at 4:28:26 PM

Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?

I want to read a whitepaper but all I can find is the tl;dw conference presentation

by noident

8/14/2026 at 4:35:44 PM

The linked project page [1] claims to be fully homomorphic. Assuming the claim holds (I haven't verified it), then there is provably no way for Google or anyone else to obtain any information from the encrypted data or computation performed on them.

FHE is traditionally horrifically slow, so it's hard to imagine running anything beyond toy models with it. They list some applications on the original article page, but (presumably) they must be dramatically stripped down in order to run within any reasonable time budget. This is not going to run anything like a Sol/Opus any time soon.

[1]: https://heir.dev/

by eslaught

8/14/2026 at 4:59:41 PM

Related, I'd seen this blog [0] posted on HN a few years back that gave a nice run down on the "programmable cryptography" space which introduce FHE and a few other neat concepts. Really enjoyed the read and learned some new terms.

[0] https://0xparc.org/blog/programmable-cryptography-1

by boilerupnc

8/14/2026 at 11:31:46 PM

> Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?

The point of FHE is that you only ever send encrypted data. So if you trust that Google hasn't broken the encryption algorithm entirely, they never access the plaintext.

by joshuamorton

8/14/2026 at 5:06:05 PM

Correct. I appreciate the theoretical technology here, but I believe a great deal of harm is done by the fact that people are not likely to understand exactly what this means.

Which is to say, I believe that google is strongly implying the falsehood of "no one at Google can read your stuff."

by jrm4

8/14/2026 at 7:56:13 PM

Have all the skeptics in this thread somehow forgot about Moore's law?

by hellohello2

8/14/2026 at 8:04:44 PM

What, how is that relevant? the transistors on a microchip double about every two years. That’s descriptive, not prescriptive, so whatever you’re trying to imply about the future is kindof a toss up — there’s no promise the parents hold. And, it doesn’t really have to do with tfa, as far as I can tell? Do you perhaps mean Murphy’s law, “whatever can go wrong will go wrong”?

by pinkmuffinere

8/14/2026 at 8:13:36 PM

The top comment mentions a ~10^3 overhead. Am I crazy (or already old?) for thinking this is not a very large constant?

by hellohello2

8/14/2026 at 8:22:55 PM

Oh I see, you’re arguing that computer growth will make this more attractive. I think it’s a decent argument, although personally I find it unconvincing. More compute will be allocated between all the existing options, and I suspect it will go towards faster/better inference, instead of encryption. For most use cases people just don’t care much about encryption, and when feature prioritization comes around it always gets a back seat

by pinkmuffinere

8/14/2026 at 8:28:38 PM

Yes, I think it really depends on the task. Clearly we won't be willing to spend 1000x on tokens for our everyday needs. But what about for the police monitoring conversations? I'd very much like my chats to stay encrypted, but there have been laws pushing against this. Technology like this provides a real solution i.e. you can scan chats for keywords without actually reading them, and get a warrant if you find something.

by hellohello2

8/14/2026 at 11:51:49 PM

Look at DRAM price on a Moore's Law chart.

by lupire

8/15/2026 at 12:13:57 AM

Now have you met my friend Planck Length?

by pamcake

8/15/2026 at 1:03:08 AM

Haven't seen him no ;)

by hellohello2

8/14/2026 at 8:45:14 PM

It's a step to provide targeted advertising with mathematically provable "no sensitive info stored" approach. The google must fight really hard because this is the only source of income that makes sense for their position. And it /is/ quite evil tbh

by cantalopes

8/15/2026 at 11:18:58 AM

How would advertising be implemented in the scenario of using this technique?

by FartyMcFarter

8/14/2026 at 11:52:10 PM

Man oh man did I read that title wrong and was completely confused

by chrisan

8/14/2026 at 9:19:28 PM

> Google’s history of innovations in privacy technology

Ah yes, their history of innovations! Thanks to Gemini for making a list for me over at https://share.gemini.google/vx9lE5dEJ1L7

The list contains more than 6 chapters with multiple entries each.

Google has truly been very innovative in destroying privacy online.

by Tepix

8/14/2026 at 5:14:51 PM

Zama.ai is also a player in this space

by oulipo

8/15/2026 at 9:37:56 AM

Yes, it is. But it’s important to recognize that there are different FHE schemes. Zama has invested heavily in TFHE and achieved impressive results. However, time has shown that TFHE is not the best fit for encrypted AI workloads, with CKKS and related schemes gaining an advantage with mathematical and algorithmic advances continue. At Belfort we have foot on both sides; FPGA acceleration for integrating to Zama's TFHE-rs, and GPU acceleration for CKKS.

by furkanturan

8/15/2026 at 12:40:33 AM

all we need now is indistinguishable obfuscation

by cryptographical

8/14/2026 at 8:15:26 PM

I do not want to make Google more powerful than it already is.

by shevy-java

8/15/2026 at 3:48:58 AM

homoerotic fan cryption - after dark.

by fillihp

8/15/2026 at 6:42:34 AM

gaslighting people by pretending that encrypting reasoning traces between agent and client is a win for "private AI"... the title should be rewritten as it is plainly conceding -- Closed AI providers use encrypted reasoning traces to hide what the model is doing to come to a conclusion. This is not scientific progress, this is molopoly protectionism. No person using these models wants the reasoning traces hidden from them, it prevents the user from learning how conclusions about a question are derived.

by jijji

8/15/2026 at 5:40:20 AM

Can we slash Google's 1000x FHE cost by 50%+ using a brain-inspired RC router like Project Ares-TCO?

by Watney-0717

8/15/2026 at 5:52:02 AM

[flagged]

by myshapeprotocol

8/15/2026 at 2:28:35 PM

[flagged]

by mmeyerlein

8/15/2026 at 12:03:22 AM

[dead]

by CurbStomper

8/14/2026 at 10:44:34 PM

Can't say I have much faith in "send it to google it'll be private thanks to crypto magic".

nah bro...the solution here is to not trust google

by Havoc

8/14/2026 at 8:07:54 PM

I have an idea for AI companies for tremendous scale, with privacy and all nice things accounted for:

- Unstarve the GPU and RAM consumer market.

- Let enthusiasts and volunteers quickly ramp up local AI.

- Reap the results that the community will most certainly achieve.

Don't repeat Microsoft's earlier mistakes. It flourished when it embraced the community and open source. If it had made that move earlier, it would have been unstoppable.

Yes, if you can control the entire market that's probably awesome. But it's also full of nonsense risks.

by gaigalas

8/14/2026 at 5:34:02 PM

Anything to keep people from running local models

by mohamedkoubaa

8/14/2026 at 7:43:25 PM

> Google is making private AI practical with homomorphic encryption

I don't understand why we need to bring LGBTQ+ into everything

by weatherlite

8/14/2026 at 10:46:34 PM

Private AI is perfectly practical already and it really doesn't need Google at all. Besides the word 'practical' here is really stretching things.

by jacquesm

8/15/2026 at 9:43:37 AM

FHE doesn’t need Google too. Google research is investing in to it. Like we are at Belfort, various teams work on making FHE practical for organizations that want to run it for their own use cases, including on infrastructure they control themselves. Even in these setups, FHE can enable applications that would otherwise be blocked by regulatory or privacy requirements. Check out; https://belfortlabs.com/blog/belfort-partners-with-lg-on-enc... https://belfortlabs.com/blog/encrypted-fraud-detection-with-...

by furkanturan

8/14/2026 at 4:53:50 PM

Proper encryption means the ciphertext is indistinguishable from noise. So...in order to be able to process on it, you have to make it not indistinguishable from noise.

So I take offense to the term FHE. It's a oxymoron.

The whole thing immidiatly stands out as a sham to build trust where it's gone.

by filup

8/14/2026 at 7:31:36 PM

You are objectively wrong. The math is straightforward to show that you can operate on a ciphertext securely in some cryptosystems.

Consider two integers M1 and M2.

Consider RSA with private key (E), public key (D), and public modulus (N).

Encrypt(M, E, N) = mod(pow(M, E), N).

Decrypt(C, D, N) = mod(pow(C, D), N).

mod(Encrypt(M1, E, N) * Encrypt(M2, E, N), N) = mod(Encrypt(M1 * M2, E, N), N).

So, for all RSA encryption, multiplying the ciphertexts results in a ciphertext that is the multiple of the plaintexts. However, unless you can break RSA, you can not determine what numbers you multiplied or what the final multiplied number is.

This is not a fully homomorphic system as it only allows multiplication, but it is a existence proof that you can do operations on ciphertext that apply to the plaintext without being able to recover the plaintext unless you can break the encryption directly.

by Veserv

8/15/2026 at 4:04:30 AM

conceptually your example is fine/good, but it's worth clarifying that the scheme you describe is insecure, as unpadded RSA fails to be IND-CPA secure. this is because Enc(m)Enc(m') = Enc(mm') is a predicate a passive observer can check, to gain information about Enc(m*m').

that being said, you can construct IND-CPA secure homomorphic encryption schemes from factoring-based assumptions iirc, so this isn't a fundamental obstacle.

by mswphd

8/14/2026 at 5:23:21 PM

This is actually the magic of FHE. The ciphertext is indistinguishable from noise AND can be computed on, it just looks like different noise.

If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.

by flambo

8/14/2026 at 5:35:33 PM

If it only appears indistinguishable from noise, but it's actually not, then it's just deception.

by filup

8/14/2026 at 5:52:58 PM

They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable.

It seems like you strongly believe otherwise, but I suspect you don’t have a good reason to, and just find it unbelievable.

Do you think you can distinguish it from noise, if given an implementation and the information an adversary would have access to?

Of course, you not being able to wouldn’t demonstrate that noöne can. But, it seems like if you had a good reason to believe that an adversary can, that would suggest you might have some idea of how they could do so. And, if you do have such an idea, then, if that idea works, it would be important for others to know, and if it doesn’t, it would presumably benefit your understanding to see why it doesn’t.

by drdeca

8/14/2026 at 6:17:26 PM

>They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable.

That's the oxymoron. If it was indistinguishable nothing could be gained.

It's not about me being able to distinguish it. It's the model provider saying they cant, when they can.

by filup

8/14/2026 at 5:18:55 PM

No, that’s not what proper encryption means. Security for encryption means that cipher texts encrypting distinct messages are indistinguishable. This is called IND-CPA, and FHE satisfies this.

by Ar-Curunir

8/14/2026 at 5:46:38 PM

How can it possibly pass indcpa. If the model can give me any valuable information about the cipher. Apparently the middle man would know precisely what is contained in the payload.

by filup

8/14/2026 at 6:08:21 PM

Here’s a very simple one-time-pad style construction for homeomorphic (but not fully homeomorphic) encryption.

Suppose the plaintext, ciphertext, and key, are each a natural number modulo 5.

The key is selected uniformly at random. The ciphertext is obtained by adding the key to the plaintext (and as a result is also uniform random).

Then the ciphertext is sent to the server. The server only has the ciphertext, which is uniform random. The server then adds some integer mod 5 to the ciphertext, producing a new ciphertext, and sends it back to the user. The user then subtracts their key from the new ciphertext to obtain the new plaintext, which is their original plaintext plus the number the server added.

At no point in this process did the server learn anything about the user’s plaintext.

This is clearly secure.

It is also useless, because just adding a number isn’t a useful thing for a server to do (they may as well just send the user the number and let them add it themselves), but that’s because it is a toy example.

I suppose if mind uploading were possible, then under FHE it would in principle be possible to take the ciphertext and run the computation of “this mind upload of this person reads the data and provides some output”, and then presumably that uploaded person would have the experience of seeing the plaintext? But it wouldn’t be possible to get any information about the plaintext without the key (or enough brute force to find the key, but that’s why we use big enough keys to make this infeasible).

by drdeca

8/14/2026 at 6:34:56 PM

What does that have to do with incpa?

I send this server a question encrypted. It stays encrypted yet the server distinguished my ciphertext enough to produce a coherent reply. That means there was enough information in the ciphertext for the server to perform the inference, even if it was obscured to where it looks indistinguishable, it apparently wasn't.

This doesn't remove trust from the equation, it puts the trust directly on the algorithm. Probably one no one can explain to me like I'm 5. But because it's encrypted I am no longer breaking the law by processing on protected data. I imagine very large contracts await on the other side. Lots of money to be made.

by filup

8/14/2026 at 7:21:47 PM

the server doesn't do what you say. Roughly, the server has a fixed circuit C they run on the ciphertext. They run this same circuit on any ciphertext. They give you back the result. the fact that the result, when decrypted, gives the desired answer isn't something the server can verify though.

Think about a very simple setting, say a database lookup. I send an index `i` in a database I want to lookup. The server sends back DB[i] or whatever.

In the clear, the server can immediately fetch the correct row. Under FHE, the server does a full scan of the database, and (roughly) for each row will do something like DB[i] * (encrypted selector variable that is 0 or 1 depending on if it is the row you want).

This is actually a baby version of FHE known as "Private Information Retrieval". For it, you (roughly) can design an encryption scheme that supports linear function evaluation. For example, a ciphertext Enc(m) can be paired with a matrix A to produce Enc(Am). You can then encrypt the ith basis vector m := e_i, and view the database as a matrix DB, to get DB * Enc(e_i) = Enc(DB*e_i) = Enc(DB_i). This works, and can be implemented in ~1k LoC, e.g. it is not particularly complicated to practically instantiate (though this basic sketch has some performance issues).

by mswphd

8/15/2026 at 7:08:06 AM

I think the term information is misleading here. In any encrypted message there is the original information, it must be because we are able to decrypt it. So from an information theory point of view that the server can "distinguished my ciphertext enough to produce a coherent reply" is always possible. The whole point of encryption is that we have Math that allows the identification of that information only under presence of the (or at least some kind of) secret.

The price that HE is paying is essentially "have to run every possible contributing computation", which means it has to scale extremely badly for anything real world complex

by hnaccount_rng

8/14/2026 at 8:48:45 PM

> That means there was enough information in the ciphertext for the server to perform the inference

The server doesn’t need any information to perform inference.

by hamper653

8/15/2026 at 1:45:42 AM

If you send someone `key xor X`, they can reply with `key xor X xor Y`, and you can recover `X xor Y` – without them having a clue what X is.

Hopefully then it's not too hard to believe you can build an encryption scheme and operations where `dec(enc(X) ⊞ Y) = X + Y` and `dec(enc(X) ⊠ Y) = X × Y`. If these operations can also be composed, i.e. homomorphism, then they're Turing complete! You can turn any function f(X) into a ciphertext version `dec(F(enc(X))) = f(X)`. It can't leak any information about X, because you only ever provided enc(X). For example you transform 'branching' code to something which traverses every path, and paths which do nothing will still appear to randomize the ciphertext, because you can't invent operations that distinguish which path is taken, because it's a secure ciphertext.

Modern homomorphic encryption uses more complex encryption schemes and primitives, to achieve thousands/hundreds rather than millions of times slower than f. Nonetheless it's impossible for the provider to gain a single bit of information about X.

by speedstyle

8/14/2026 at 4:58:02 PM

they could have gone with an oblivious transfer approach (where it's working on what looks like multiple problems at once, you don't know which)

by pluto_modadic

8/14/2026 at 4:58:42 PM

Eh? With secret sharing one can do computation on a shared secret where it is provable that no individual party can recover any information about the data with their share alone.

I don’t see why you conclude that FHE couldn’t be close to as secure as that. (Like, not information theoretically, but with computationally bounded adversaries.)

by drdeca

8/14/2026 at 5:19:45 PM

I'm not saying that you can't design a system for secure cloud computing.

by filup

8/14/2026 at 5:26:51 PM

You said that FHE is an oxymoron, seemingly on the basis that in proper encryption the ciphertext is indistinguishable from noise, and you think this can’t be true of FHE. I am arguing to the contrary.

In the secret sharing multi-party computation schemes, the individual shares of the secret are random and have no information about the plaintext.

I see no reason that FHE can’t have ciphertexts indistinguishable from noise.

by drdeca