FHE is traditionally horrifically slow, so it's hard to imagine running anything beyond toy models with it. They list some applications on the original article page, but (presumably) they must be dramatically stripped down in order to run within any reasonable time budget. This is not going to run anything like a Sol/Opus any time soon.

[1]: https://heir.dev/

The basic idea of of the project is to remove the need for trust.

I want that too, but you gotta ask yourself the question how efficient that is compared to running it in a datacenter shared with everybody else.

> Holding two opposing views in the mind means accepting two contradictory ideas at the same time without needing to pick one side or rush to a simple answer

I continue to use Apple products because they are top class even though everytime I think of Tim Cook in the Oval Office presenting the gold plaque to the current president, it makes me wanna puke. World isnt black or white.

People are giving them everything. Their thoughts, feelings, intentions, company IP... It's a fucking gold mine.

There's just too much value in retraining on that data and even if there wasn't, the feds lean so heavily on Google search histories to get convictions I am certain there will be pressure to prevent any mass market services from adopting this.

"We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively, on a single-threaded CPU."

There don't seem to be any direct comparisons available, probably because nobody else has any reason to limit themselves to one single-threaded CPU with normal techniques, but for reference the AI seems to expect that normal times for conventional setups are in the milliseconds range, fairly comfortably, even on CPU. I didn't find a clean primary source to link to for this claim, but clicking through various things that don't cleanly state the situation it did seem plausible. So we seem to still be in the range of single-digit orders of magnitude slower, possibly as much as 5 or 6, which is to say, we're still talking the range where we need to take the log of the difference to get sensible numbers, we're not using percentages.

(To run it yourself, I basically just fed the URL from the HN link, mentioned that FHE is known to be slow, and asked if anything linked in the blog post gave concrete times.)

update: also see [2] for some primitive unsigned 64-bit integer operation benchmarks with the TFHE-rs library (winner in the sorting performance comparison of [1]). Equality at 80ms, addition and subtraction at 100ms, division at 8 seconds, etc.

[1] https://eprint.iacr.org/2026/1495.pdf Oblivious Sorting under Fully Homomorphic Encryption: A Comprehensive Survey and Performance Analysis, Omar Ahmed and Rostin Shokri and Nektarios Georgios Tsoutsos, 2026

[2] https://docs.zama.org/tfhe-rs/tfhe-rs/1.0/get-started/benchm...

Using regular encryption and secure enclaves, there are already providers that are roughly 2x the cost of normal providers. For example, https://tinfoil.sh/

I'd expect this to be something like the Google Ad ID: technically separated from what Google considers personal information, but trivially easy to tie back to an individual person and to other information about that person.

They're continually breaking trust by illegally scraping up the internet to feed to their plagiarism machine, which they are now asking us to trust with more data. It's not a compelling arguement.

There are some instances of hand-built cryptographic protocols used in production at Google that use FHE in small doses (e.g., computing a single dot product as part of an interactive protocol), so the big question is whether having a general-purpose tool will expand the feasibility of applying these to other, maybe less critical projects that still want some privacy guarantees but can't afford to hire cryptographers.

But yeah, for hot path traffic it's probably going to be swamped by the input data rate. But I expected identity tables and cached lookup data will need to be a core component so duplicate checks is avoided in every way available.

It's very useful for things like healthcare data for example but also for products like "home assistants", and it's one of the use cases that the team hiring internally was giving in their job req. I tried to apply too but didn't get it unfortunately, this was a very interesting product to work on imho, congrats to whoever got my job :)

as a general rule multiplication is the difficult part.

it's hard to accurately quantify what "nontrivial" cost overheads are because they're very application dependent. for example, things that require encrypted control flow are very hard under FHE. so an encrypted hashmap sounds roughly unimplemnetable. but things that do not require encrypted control flow (e.g. many ML applications) are less bad. this can still be quite bad though. for example, relu is trivial in plaintext. it is hard homomorphically, because the trivial way to write it uses private control flow.

1. generate a 512 x 512 random (u32) matrix A, and

2. generate a 512-dimensional rounded (to the nearest integer) Gaussian, say of standard deviation 10, e.

The ciphertext is then [A, b :=As + e + 2^8 m].

To decrypt, you compute b - As to recover 2^8 m + e. You can then recover m, as e << 2^8 with high probability.

Anyway, if you have two of these ciphertexts, you can sum them together to get

[A1 + A2, (A1 + A2)s + (e1 + e2) + 2^8 (m1 + m2)]

this decrypts to m1 + m2, so you can recover homomorphic sums (or scalings by small integers).

Multiplication is more complex, so I won't get into it here. But the high level from the above example is that you could have someone compute arbitrary linear functions of your data without them knowing what your data is.

[1] https://sgx.fail/

Then there’s a second tier of things that just make those wheels turn and if they do or don’t make ads revenue is nominally immaterial.

The teams doing this stuff at Google are purely for show, none of this makes it into any real products.

There’s the narrow exception of stuff like gboard, that does use privacy preserving ML/fed learning, but this stuff isn’t in the same zone.

I find it a bit embarrassing when Google publishes this stuff to be honest.

It narrows the 10^3 - 10^6 penalty to 10x - 100x.

But at the same time HE is classic Google promotion fodder. Really difficult technical problem! That’s what gets people promoted at Google. Nobody actually cares about it or will use it? That also is what gets people promoted at Google. Because Google only employs “the smartest people on earth” which means people who solve difficult problems. Difficult problems - not problems that need solving.

That said, there is a lot of ongoing work on GPU acceleration. Cf. the recent FHE-based CIFAR demo that runs in 200ms: https://sofar.belfortlabs.cloud/

Still maybe 1000x slower than cleartext, but progress!

> Fourth, there is a bandwidth concern. FHE encryption schemes generally increase the size of the data being encrypted, and the user must send the server a special set of encryption keys to enable the computation, which are relatively large as well. The special keys need only be generated and sent once and can be used for all future computations, but they can easily be gigabytes in size. In one example FHE scheme with lightweight keys, a ciphertext encrypting a single integer is on the order of 25 KB, and the special keys are about 0.5 GB. In others, 16,000 or more integers are packed into a single ciphertext of similar size, but the keys can be 10s of GiBs.

There is no reason to believe it should be lower than that - or even that low. Or do you have access to research claiming such achievements?

Heh yes absolutely, but there is some nuance.

Secure Enclave still requires you to trust the operator and also trust that it’s configured properly, supply chain is secure, etc.

The beauty of FHE is that it doesn’t rely on the compute being secure. All you need to secure are things you already have control over as a client.

I agree with you it’s still way too slow to be generally useful. (By general, I mean practical for arbitrary computation — you can relax the requirement and have fast homomorphic encryption if you only do specific kinds of operations).

This is the same kind of thing. The crazy overhead of FHE means it's not practical for almost any kind of real world computational work. But having it available at all is undeniably technically impressive, and some of that sense of technical refinement bleeds over into your opinion of Google as a whole.

Incidentally, being a business client of Google's who actually uses this (or, say, quantum computing) for $BUSINESS_FEATURE would garner the same kind of positive attention, independently of whether it's technically a good idea.

Finally, if the overheads come down to the level where they are still significant but not insane, GCP is in a great position.

Using this other encryption, the provider has neither need nor capability to decrypt it on their end, so the user gets extra security.

Ideally, give me a dial, to ask for encrypted intelligence when I need it. Kind of like a private chat, but with deeper privacy protections.

Project intro talk from 2023: https://www.youtube.com/watch?v=kqDFdKUTNA4

Homomorphic encryption got significantly efficient with the first few iterations, but I don't really see the necessary orders of magnitude savings coming soon. You could reduce this by some partial encryption schemes (e.g., for LLMs you need a handful of basic operations) but a better alternative already exists: multi-party computation.

Source: I did research in this area in the past.

Even in that case, they see data they are getting to be worthwhile enough for their other lines of business.

and now this.

Part of changing the world involves imagining a changed-world.

I'm glad people fund things that are only of interest to nerds but this will never be useful.

If Google Cloud can offer FHE-powered tools, a hospital can run Google’s AI diagnostic models on encrypted brain scans without violating privacy laws.

FHE effectively removes the primary regulatory barrier keeping enterprise customers off the cloud.

Sibling comment estimates lower bounds of current research at minimun 10^6 overhead which sounds more realistic.

Most people who use Google trust them. And if you do not trust them then why are you using their password manager? You see? Hence why they do not bother.

Of course one might read this and say, multi device e2ee is possible! Sure, but can you allow for recovery when people inevitably lose their recovery codes at scale? If you really care about this it is not necessary to go with Google.

I stand by my original comment:

The average user does not want it.

I was very much surprised and asked. give me demerits for the way of asking.

but the question stays: how come an encryption scheme inflates data by this order of magnitude and needs GB sized keys?

where can I learn about this? not the nutty gritty details proofs and all but an overview. assume I did my CS masters in the 1990s and worked as SW eng ever since.

NVM, I asked Gemini

https://share.google/aimode/pqZO1VF3cGTeetamq

What real datasets exist where this would be a worthwhile trade off versus simply owning the hardware?

The numbers are so bad that underpowered local hardware would still beat it.

I agree, a password manager without E2EE is unusable in my eyes. However, I can also understand the institutional reasons this might be the case. I don't think it reflects an organizational aversion to E2EE.

> You can separate Cook is a garbage person

We've banned this account.

We've asked you politely, several times over the years to observe the guidelines. In recent times you've been acting more than ever like they don't apply to you. They do apply to you just as they apply to everyone and it's time we made that clear.

In this case, someone has raised the notion that sometimes someone can hold two legitimate positions that are contradictory, which, as the original commenter mentioned, is attributable to F. Scott Fitzgerald but has been noted in different ways by many reputable philosophers and scholars through history. In your reply, you've effectively sneered at anyone who wrestles with such contradictions, including the parent commenter, then gone on to use the term “garbage person” for another human.

Other terms you've used in past months include:

most humans are dumber than a box of rocks

literally not figuratively the 1930s Nazis

fools

idiots

morons

cretins

It's always a challenge for us to fairly moderate political discussions on HN. We want people to be able to discuss important, difficult topics and ideally to work together to develop ways of making the world better. HN is a place for builders, and that can and should include building solutions for the difficult problems the world faces, or at least talking about how we could. Identifying and critiquing flaws in the ideas and actions of one's political or intellectual opponents is fine and healthy.

Continually demeaning individuals or groups with dehumanizing or contemptuous epithets and caricatured characterizations makes this place toxic and drives away people who come here with the expectation of having intellectually gratifying discussions with reasonable people.

When people continue to break the guidelines, even after several appeals from moderators, we have to assume they have no intention to use the site as intended and in fact want to be banned. If that's not the case, you can email us at hn@ycombinator.com to discuss how you can demonstrate that.

the main difference is where the guarantee comes from. for FHE, it comes from math, which we trust. for secure enclave, the guarantee comes from Intel/AMD's promise that their hardware is bugless/backdoorless, and that your adversary cannot directly inspect bits in the hardware

https://github.com/google/fully-homomorphic-encryption/tree/...

https://fhe-benchmarking.github.io/

I'm not sure I've interpreted [1] correctly though, and would appreciate correction if necessary.

[1] https://arxiv.org/pdf/2604.04783 -- GPU Acceleration of TFHE-Based High-Precision Nonlinear Layers for Encrypted LLM Inference -- Guoci Chen, Xiurui Pan, Qiao Li, Bo Mao, Congming Gao, Chengying Huan, Mingzhe Zhang, Jie Zhang -- Apr 2026

On the other hand, each FHE step is a LOT more costly (e.g. elliptic curve exponentiation) than a vectorized BF8 multiply on GPU.

Unlike the sorting number case, it is probably same complexity. But no hardware support AND a massive slow down constant even if you were comparing apples to apples on hardware.

Disclaimer: I spent a decade working on crypto systems but I am not familiar with TFA’s research.

Typical use cases are for doing biometric authentication without giving your biometric information, or sensitive queries using medical information. Apple has homomorphic encryption in image search. You can use your own photos encrypted into the cloud to search for landmarks in the image without revealing photos.

People can also coordinate and compare information without sharing sensitive data.

Edit to clarify my prior point: some of the technology makes it into the product, but the putative data protections do not.

Why?

Because there is always a work around, and ads legal will approve it every time.

My takeaway is that you were personally offended by the (mild) attack on Cook and Apple products, likely because you use them and associate them with your self worth, and responded in defense of ego.

I say this based on observing casual usage of 'fool' and 'idiot' and other terms a myriad of times in other threads with no action or response.

I'm glad to see a moderator in the wild but JFC not attacking a windmill.

- The output can reveal information to the provider, which homomorphic encryption would have protected

- Inference is running on GPUs - so its moreso nvidia than amd/intel, but this is just a nit

So homomorphic encryption exists so the user doesn't need to do work to figure out if the provider could be adversarial.

Eh, since Google's support doesn't exist in the first place, none of this really matters, and nothing is lost.

I'm now curious. Who are you?

If cloud can sell compute to enterprise that can only use FHE, then they will not give a fuck if the ad goons are disgruntled about it.

It’s true that this comment alone was not sufficient for a ban; as I explained in my comment, it’s the pattern of comments, particularly in recent days, continuing a pattern over years that we’ve posted several warnings about. And it's the fact that other users who have a solid track record of contributing positively to HN are being driven away by that style of rhetoric from this user, or at least signaling that these comments were beyond the pale.

Our role here is to make HN a place where reasonable people feel they can have intellectually gratifying discussions that are of higher quality than elsewhere online. When we see signs that good contributors are being driven away by an escalating pattern of toxic comments from a user who has been warned many times over a decade, it would be negligent of us not to act.

As we say all the time, we don’t see every guidelines breach, or reply every time we do; there are over 10,000 comments posted each day and only two of us. But when we see an ongoing pattern of abuse, we always issue warnings, then ban the account if it continues. You’re always welcome to email us (hn@ycombinator.com) when you see anything egregious, or at least just flag the comment. That's what people do when they wholeheartedly support moderation.

That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications.

That combined with GPU confidential compute should protect your LLM prompt and output.

Ads doesn’t care until something affects them, GCP doesn’t.

E2E encryption (including homomorphic encryption) have the nice property that there are much fewer ways for things to fail.

(Tangentially, attestation is basically trying to ensure that faults are obvious, but that doesn’t reduce the probability of the faults in the first place).