4 ms·
One thing I noticed in Gboard is it uses homeomorphic encryption to do federated learning of common words used amongst public to do encrypted suggestions. E.g.
by nthingtohide 2y ago
One thing I noticed in Gboard is it uses homeomorphic encryption to do federated learning of common words used amongst public to do encrypted suggestions.
E.g. there are two common spelling of bizarre which are popular on Gboard : bizzare and bizarre.
Can something similar help in model encryption?
- antman 2y agoHad to look it up, this seems to be the paper https://research.google/pubs/federated-learning-for-mobile-keyboard-prediction-2/ https://research.google/pubs/federated-learning-for-mobile-k...
- 1oooqooq 2y agothey have a very "interesting" definition of private data on the paper. it's so outlandish that if you buy their definition, there's zero value on the trained data. heh. they also claim unsuppervisioned users typing away is better than tagged training data, which explain the wild grammar suggestions on the top comment. guess the age of quantity over quality is finally peaking. in the end it's the same as grammarly but without any verification of the interested data, and calling the collection of user data "federation"
- nthingtohide 2y agoactually letting users type whatever they want is good because they are many dialects of english : chinglish, thailish, singlish, hinglish and so on. they have made the system so general that it can handle any quirk users throw at it.
- umeshunni 2y agoHomomorphic, not homeomorphic
- hyperbovine 2y ago`enc(coffee cup) == enc(donut)` would be an interesting guarantee.
- vlovich123 2y agoIn theory yes, in practice right now no. Homomorphic encryption is too computationally expensive.
- biosboiii 2y agoAuthor here, no clue about homeomorphic (or whatever) encryption, what could certainly be done is some sort of encryption of the model into the inference engine. So e.g.: Apple CoreML issues a Public Key, the model is encrypted with that Public Key, and somewhere in a trusted computing environment the model is decrypted using a private key, and then inferred. They should of course use multiple keypairs etc. but in the end this is just another obstacle in your way. When you own the device, root it or even gain JTAG access to it, you can access and control everything. And matrix-multiplication is a computationally expensive process, in which I guess they won't add some sort of encryption technique for each and every cycle.
- miki123211 2y agoIn principle, device manufacturers could make hardware DRM work for ML models. You usually inference those on GPUs anyway, and they usually have some kind of hardware DRM support for video already. The way hardware DRM works is that you pass some encrypted content to the GPU and get a blob containing the content key from somewhere, encrypted in a way that only this GPU can decrypt. This way, even if the OS is fully compromised, it never sees the decrypted content.
- biosboiii 2y agoBut then you could compromise the GPU, probably :) Look at the bootloader, can you open a console? If not, can you desolder the flash and read the key? If not, can you access the bootloader when the flash is not detected anymore? ... Can you solder off the capacitors and glitch the power line, to do a [Voltage Fault Injection](https://www.synacktiv.com/en/publications/how-to-voltage-fault-injection https://www.synacktiv.com/en/publications/how-to-voltage-fau...)? Can you solder a shunt resistor to the power line, observe the fluctuations and do [Power analysis](https://en.wikipedia.org/wiki/Power_analysis https://en.wikipedia.org/wiki/Power_analysis)? There are a lot of doors and every time someone closes them a window remains tilted.
- bangaladore 2y agoAny company serious about building silicon that has keys, wouldn't just be storing them in flash. Try getting a private key off a TPM. There have been novel attacks, but they are few and far between. Try getting a key from Apple's trusted enclave (or whatever buzz-word they call it).