Hacker News Reader

Comment by siddthesquid | Hacker News Reader

If I used regular encryption to send my credit card information to an AI with fraud detection, the provider still needs to decrypt that data on their side at some point before it goes into the AI.

Using this other encryption, the provider has neither need nor capability to decrypt it on their end, so the user gets extra security.

View on HN

this is not entirely true, I think. secure enclaves can provide guarantee such that even the host machine cannot inspect the contents within the VM. so even though the AI model itself needs to see plaintext, all is happening in the enclave which the provider cannot see.

the main difference is where the guarantee comes from. for FHE, it comes from math, which we trust. for secure enclave, the guarantee comes from Intel/AMD's promise that their hardware is bugless/backdoorless, and that your adversary cannot directly inspect bits in the hardware

- If an AI provider has control over the AI algorithm running in the secure enclave, they can easily have functions that provide them the plaintext through a separate channel. secure enclave does not prevent that

- The output can reveal information to the provider, which homomorphic encryption would have protected

- Inference is running on GPUs - so its moreso nvidia than amd/intel, but this is just a nit

So homomorphic encryption exists so the user doesn't need to do work to figure out if the provider could be adversarial.

yes I agree. although just to nitpick, there are ways to prevent side channel attacks within the enclave using software tricks. and output can remain in ciphertext via diffie hellman with client, etc. etc. but you're right that FHE provides a much more concrete guanrantee.

> they can easily have functions that provide them the plaintext through a separate channel

That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications.

That combined with GPU confidential compute should protect your LLM prompt and output.

They’re not equivalent. One provides a best effort guarantee and is not trivial to implement correctly (it’s the Secure Enclave). I agree that you _could_ do all those things and do them correctly. However there are a lot more points of failure.

E2E encryption (including homomorphic encryption) have the nice property that there are much fewer ways for things to fail.

(Tangentially, attestation is basically trying to ensure that faults are obvious, but that doesn’t reduce the probability of the faults in the first place).

Reply on news.ycombinator.com