4 ms·

Consider encrypted AI. You ask a question under encryption. The remote calculates the answer, which is still under encryption. This is the critical point; the r

Consider encrypted AI. You ask a question under encryption. The remote calculates the answer, which is still under encryption. This is the critical point; the remote cannot see the question and answer. It only calculates. Once you receive the answer, you decrypt it and see the answer; only you see the answer.

smalltorch 2mo ago
Ah, that sounds impossible. Good luck, sir...Also, who wants this if you can just run a local model?
- furkanturan 2mo ago
  Thanks a lot. Though encrypted AI chat bot is not far ahead, do not think of that as the primary target of today. Instead, there are many untapped applications (e.g. inter-bank transfers, industry, healthcare) where regulations, privacy laws and compliance requirements restrict institutions from touching data. These will initially be our key enablers, and over time we hope to extend the range of applications.
  - smalltorch 2mo ago
    Have you considered that maybe the computation itself on the private data, no matter how you put it, even if encrypted, was designed to protect the consumer? I.E., gaining any sort of insight a transaction of protected information is what the protections were in place for. So is FHE more about skirting regulations and privacy laws? Or, is it a new frontier of an untapped data source that has some red tape around it? To me, something was simply not encrypted properly if you are able to draw conclusions/learn insights/detect anything about the data. It's in conflict with the idea of what secure encryption means to me.
    - j2kun 2mo ago
      > gaining any sort of insight The server providing the FHE-based service does not gain any sort of insight. This is a key point: only the client can see the output of the computation.
      - smalltorch 2mo ago
        Interesting. I have some homework to do then. Do we have to close our eyes and look away for it to be true or does it really not gain any insight? Where can I find out more about how this could be possible?
        larrygates 2mo ago
        Good primer on FHE here: https://eurocrypt.iacr.org/2021/slides/gentry.pdf https://eurocrypt.iacr.org/2021/slides/gentry.pdf
        furkanturan 2mo ago
        Check this one too: https://openmined.org/blog/ckks-explained-part-1-simple-encoding-and-decoding/ https://openmined.org/blog/ckks-explained-part-1-simple-enco...
      - mswphd 2mo ago
        this is only true in the IND-CPA model for most "practical" FHE work. So a more precise way to describe things is "a server who faithfully performs the task given to them does not gain any sort of insight" (perhaps with an additional caveat about decryption failures).
        Pro7ech 2mo ago
        In the case of single key FHE with server-side processing (the demo setup), the server can never gains any insight, even as an active adversary that can arbitrarily deviate from the protocol because it only has access to public evaluation keys and ciphertexts. The worst it can do is return tempered output to the client, but it doesn't help it learning anything about the client request.
- simcop2387 2mo ago
  It'll be very useful for even local setups when the data needs to be confidential. Look at the research related to medical training of llms (ignore their current lack of direct usefulness/trustworthiness, those are potentially solvable), with a homomorphically encrypted session, the large inference servers never see hipaa protected data in a way that exposes it if the server is compromised even if its an on premises setup in your doctors office processing the data, reducing risk of the data leaking anywhere.
- binary132 2mo ago
  maybe it could be running a much more powerful system than you have access to
  - smalltorch 2mo ago
    I can't tell if your being sarcastic but if you can't prove fhe within ( and I'll be generous) a few 1000 lines of code. Bologna.
- Pro7ech 2mo ago
  A local model works when one party owns everything. But often you'll have more than one party, for example different machine operators, the machine manufacturer, the sensor provider, all involved, each with data they cannot or IP they do not want share. That’s where FHE becomes truly useful and more than an additional layer of protection by enabling collaborations that were simply not possible before.

smalltorch 2mo ago

Ah, that sounds impossible. Good luck, sir...Also, who wants this if you can just run a local model?

furkanturan 2mo ago
Thanks a lot. Though encrypted AI chat bot is not far ahead, do not think of that as the primary target of today. Instead, there are many untapped applications (e.g. inter-bank transfers, industry, healthcare) where regulations, privacy laws and compliance requirements restrict institutions from touching data. These will initially be our key enablers, and over time we hope to extend the range of applications.
- smalltorch 2mo ago
  Have you considered that maybe the computation itself on the private data, no matter how you put it, even if encrypted, was designed to protect the consumer? I.E., gaining any sort of insight a transaction of protected information is what the protections were in place for. So is FHE more about skirting regulations and privacy laws? Or, is it a new frontier of an untapped data source that has some red tape around it? To me, something was simply not encrypted properly if you are able to draw conclusions/learn insights/detect anything about the data. It's in conflict with the idea of what secure encryption means to me.
  - j2kun 2mo ago
    > gaining any sort of insight The server providing the FHE-based service does not gain any sort of insight. This is a key point: only the client can see the output of the computation.
    - smalltorch 2mo ago
      Interesting. I have some homework to do then. Do we have to close our eyes and look away for it to be true or does it really not gain any insight? Where can I find out more about how this could be possible?
      - larrygates 2mo ago
        Good primer on FHE here: https://eurocrypt.iacr.org/2021/slides/gentry.pdf https://eurocrypt.iacr.org/2021/slides/gentry.pdf
      - furkanturan 2mo ago
        Check this one too: https://openmined.org/blog/ckks-explained-part-1-simple-encoding-and-decoding/ https://openmined.org/blog/ckks-explained-part-1-simple-enco...
    - mswphd 2mo ago
      this is only true in the IND-CPA model for most "practical" FHE work. So a more precise way to describe things is "a server who faithfully performs the task given to them does not gain any sort of insight" (perhaps with an additional caveat about decryption failures).
      - Pro7ech 2mo ago
        In the case of single key FHE with server-side processing (the demo setup), the server can never gains any insight, even as an active adversary that can arbitrarily deviate from the protocol because it only has access to public evaluation keys and ciphertexts. The worst it can do is return tempered output to the client, but it doesn't help it learning anything about the client request.
simcop2387 2mo ago
It'll be very useful for even local setups when the data needs to be confidential. Look at the research related to medical training of llms (ignore their current lack of direct usefulness/trustworthiness, those are potentially solvable), with a homomorphically encrypted session, the large inference servers never see hipaa protected data in a way that exposes it if the server is compromised even if its an on premises setup in your doctors office processing the data, reducing risk of the data leaking anywhere.
binary132 2mo ago
maybe it could be running a much more powerful system than you have access to
- smalltorch 2mo ago
  I can't tell if your being sarcastic but if you can't prove fhe within ( and I'll be generous) a few 1000 lines of code. Bologna.
Pro7ech 2mo ago
A local model works when one party owns everything. But often you'll have more than one party, for example different machine operators, the machine manufacturer, the sensor provider, all involved, each with data they cannot or IP they do not want share. That’s where FHE becomes truly useful and more than an additional layer of protection by enabling collaborations that were simply not possible before.