Google open-sources HEIR compiler for encrypted AI inference
- Google released HEIR, an open-source compiler toolchain that converts pre-trained AI models built for plaintext inputs into models that run inference on homomorphically encrypted inputs.
- Homomorphic encryption lets a server compute directly on ciphertexts and return encrypted results without exposing the underlying data; Google cites content recommendations based on user features as a demo use case.
- Google says manually adapting a program for efficient homomorphic encryption normally requires cryptographers, while HEIR aims to make encrypted inference accessible to non-experts and eventually a one-click production option.
- Google places HEIR in its Private Computing Toolkit, alongside work on differential privacy, private set membership, private information retrieval, and secure enclaves; unlike hardware-based methods, its privacy guarantees are cryptographic.
Hacker News opinions
I do not trust a service just because it runs on someone else's server. Google has not earned the assumption that it acts in my interest.
With fully homomorphic encryption, the point is that Google does not need to be trusted with the data. The cryptography is meant to remove that trust requirement.
That only covers private AI inference, though. It does not stop Google from collecting behavioral information through other parts of a service.
Classic encryption already makes intermediaries such as ISPs unable to read traffic. Rejecting that entire model ignores what cryptography is designed to do.
FHE can give confidentiality, but it does not automatically give availability. I am also unsure what integrity guarantees apply here.
I want a whitepaper, not a conference talk. Can the client verify that the provider cannot see its inputs, or is this just a Trust Me Bro claim?
If HEIR is actually fully homomorphic, then nobody can learn the encrypted inputs or computation results without the key, assuming its cryptographic claim holds. My concern is performance: FHE has traditionally been far too slow for anything beyond heavily reduced models, nowhere near Sol or Opus.
FHE protects the input and output, but it does not prove the server ran the computation I wanted. A provider could use an adversarial computation for certain inputs, or insert another computation before or after it.
I thought signing a computation can prove it was performed as agreed, although I may be mixing that up with zero-knowledge proofs.
Even an honest server can return garbage if encrypted inputs fall outside bounds used to tune polynomial approximations in FHE.
I am skeptical that commercial deployment is viable. Governments may intervene before another form of end-to-end encryption gets broadly rolled out.
I do not accept the claim that FHE is an oxymoron. Encryption security is usually indistinguishability between ciphertexts of distinct messages, or IND-CPA, and FHE can satisfy that.
The unusual part of FHE is exactly that ciphertexts still look like noise while computation transforms them into different noise. If LWE or RLWE hardness assumptions hold, Google cannot read the model input or output.
My master's work in privacy-preserving ML suggests HE inference has roughly a 10^3 overhead, which makes commercial use hard to justify.
HEIR-style optimization and parameter selection are meant to reduce the usual 10^3 to 10^6 penalty into something like 10x to 100x. I would still like to know whether that is a fundamental limit or something algorithms can improve.