Hacker News

The article conspicuously fails to go into much detail about that. I poked around with an AI a bit (to rapidly cover all the linked pages) and it seems the best numbers we can get are from this arxiv paper: https://arxiv.org/html/2506.18150v4 Which says:

"We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively, on a single-threaded CPU."

There don't seem to be any direct comparisons available, probably because nobody else has any reason to limit themselves to one single-threaded CPU with normal techniques, but for reference the AI seems to expect that normal times for conventional setups are in the milliseconds range, fairly comfortably, even on CPU. I didn't find a clean primary source to link to for this claim, but clicking through various things that don't cleanly state the situation it did seem plausible. So we seem to still be in the range of single-digit orders of magnitude slower, possibly as much as 5 or 6, which is to say, we're still talking the range where we need to take the log of the difference to get sensible numbers, we're not using percentages.

(To run it yourself, I basically just fed the URL from the HN link, mentioned that FHE is known to be slow, and asked if anything linked in the blog post gave concrete times.)

Do you think that’s like a fundamental limit or something that will improve with time and new algorithms?

That's the reason for HEIR like optimization and parameter selection.

It narrows the 10^3 - 10^6 penalty to 10x - 100x.

1000x slowdown is bad but not a complete deal breaker. Do you have a sense of what a reasonable achievable factor is? Do you have sense for how long before we get to that achievable factor?

Exactly my concern, and worse overhead that what I recalled.

Cost-wise the only viable private compute is local compute. It's more expensive than cloud, but true private compute in the cloud is definitely pricier.

F. Scott Fitzgerald's test of top-tier intelligence -

> Holding two opposing views in the mind means accepting two contradictory ideas at the same time without needing to pick one side or rush to a simple answer

I continue to use Apple products because they are top class even though everytime I think of Tim Cook in the Oval Office presenting the gold plaque to the current president, it makes me wanna puke. World isnt black or white.

If you think about it for a moment you will realize the average user does not want that.

Secure Enclaves are broken all the time though [1]. They’re also not secure against attacks from a quantum computer (including store now decrypt later attacks). At least with symmetric FHE, anything that happens after encryption requires zero trust.

[1] https://sgx.fail/

I guess I'm curious from your perspective what and why makes the tech from being commercially viable, and the concerns of big players adopting this (which was always going to happen I imagine, but when shapes a lot of the future of the field).

This kind of attitude is really disrespectful of decades of progress in cryptography. Without even considering homomorphic encryption, classic encryption is specifically designed to make intermediate nodes such as ISP dumb pipes that do not know the contents of communication. The ISP can store your communications on their server however they want.

If you don’t agree with this model, I’m afraid modern cryptography doesn’t have anything to offer.

With Fully Homomorphic Encryption it's nobody elses.

The basic idea of of the project is to remove the need for trust.

It can give you confidentiality without availability. Not sure about integrity? Anyways, still useful.

It's FHE for "cryptographically-secure private AI inference" not for every other service where they snoop into your behavioral information.

The linked project page [1] claims to be fully homomorphic. Assuming the claim holds (I haven't verified it), then there is provably no way for Google or anyone else to obtain any information from the encrypted data or computation performed on them.

FHE is traditionally horrifically slow, so it's hard to imagine running anything beyond toy models with it. They list some applications on the original article page, but (presumably) they must be dramatically stripped down in order to run within any reasonable time budget. This is not going to run anything like a Sol/Opus any time soon.

[1]: https://heir.dev/

Related, I'd seen this blog [0] posted on HN a few years back that gave a nice run down on the "programmable cryptography" space which introduce FHE and a few other neat concepts. Really enjoyed the read and learned some new terms.

[0] https://0xparc.org/blog/programmable-cryptography-1

100% not an expert but my understanding was that part of what you are proving by signing the computation is that the computation itself was performed specifically as agreed to. I may be mixing this up with zero knowledge proofs.

This is actually the magic of FHE. The ciphertext is indistinguishable from noise AND can be computed on, it just looks like different noise.

If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.

they could have gone with an oblivious transfer approach (where it's working on what looks like multiple problems at once, you don't know which)

Eh? With secret sharing one can do computation on a shared secret where it is provable that no individual party can recover any information about the data with their share alone.

I don’t see why you conclude that FHE couldn’t be close to as secure as that. (Like, not information theoretically, but with computationally bounded adversaries.)

No, that’s not what proper encryption means. Security for encryption means that cipher texts encrypting distinct messages are indistinguishable. This is called IND-CPA, and FHE satisfies this.