Google is making private AI practical with homomorphic encryption

Google 正通过同态加密让私密 AI 成为现实

Today we’re excited to showcase HEIR, the latest powerful tool added to our Private Computing Toolkit. HEIR is an open source compiler that unlocks cryptographically-secure private AI inference. 今天，我们很高兴向大家展示 HEIR，这是我们“私密计算工具包”（Private Computing Toolkit）中新增的最新强大工具。HEIR 是一个开源编译器，旨在解锁加密安全的私密 AI 推理。

Homomorphic encryption

同态加密

As new benefits emerge with the growth of AI, balancing privacy and security is top of mind. Standard protections like end-to-end encryption present a trade-off: user-data can be protected from data breaches, but then the service provider cannot provide features that depend on the data, such as spam or virus detection. Critical sectors like healthcare and finance are even more averse to these risks, and strict regulations limit data sharing across institutions. Alternative mechanisms to provide the same features, like local processing, are limited by the capabilities of the local device and the sensitivity of the service provider’s IP. Shipping proprietary AI to a device risks leaking the model. 随着 AI 的发展带来新的益处，平衡隐私与安全成为了重中之重。诸如端到端加密等标准保护措施存在一种权衡：用户数据虽能免受泄露，但服务提供商却无法提供依赖于这些数据的功能，例如垃圾邮件或病毒检测。医疗和金融等关键领域对这些风险更为敏感，严格的法规也限制了机构间的数据共享。提供相同功能的替代机制（如本地处理）则受限于本地设备的性能以及服务提供商知识产权（IP）的敏感性。将专有 AI 模型部署到设备上存在模型泄露的风险。

A solution to these issues is homomorphic encryption, a rapidly maturing technology that fundamentally alters this trade-off by allowing computations to be performed directly on encrypted data. Servers can process ciphertexts and return encrypted results without exposing any underlying information. For example, a cloud service can provide content recommendations without being able to see the user’s features. This is no exaggeration: one of the demos featured in this post does exactly this. But while homomorphic encryption has a nontrivial cost overhead, it shifts the capability/privacy trade-off to a question of cost. And the cost of homomorphic encryption is rapidly decreasing. 解决这些问题的方案是同态加密。这是一种正在迅速成熟的技术，它允许直接在加密数据上进行计算，从而从根本上改变了上述权衡。服务器可以在不暴露任何底层信息的情况下处理密文并返回加密结果。例如，云服务可以在无法查看用户特征的情况下提供内容推荐。这并非夸大其词：本文展示的演示案例之一正是实现了这一点。虽然同态加密存在不可忽视的成本开销，但它将“能力与隐私”的权衡转化为了“成本”问题。而且，同态加密的成本正在迅速降低。

Google’s history of innovations in privacy technology—from differential privacy and private set membership to private information retrieval and secure enclaves on Google Cloud—has always focused on securing user data. Homomorphic encryption is another powerful tool we’re adding to our private computing toolkit. Like private information retrieval, and in contrast to hardware-based solutions, homomorphic encryption’s strong security and privacy guarantees are purely cryptographic. However, manually converting an existing program to use homomorphic encryption efficiently requires a team of cryptographers. Google 在隐私技术方面的创新历史——从差分隐私、私有集合成员资格，到私有信息检索和 Google Cloud 上的安全隔离区（Secure Enclaves）——始终专注于保护用户数据。同态加密是我们添加到私密计算工具包中的又一强大工具。与私有信息检索类似，且不同于基于硬件的解决方案，同态加密强大的安全和隐私保障完全基于密码学。然而，手动将现有程序转换为高效的同态加密程序需要一支密码学家团队。

About HEIR

关于 HEIR

To overcome the usability challenges and advance the opportunity homomorphic encryption provides, researchers and engineers at Google built the HEIR compiler project. HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for homomorphic encryption. In particular, HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs. Our vision is to make HEIR a one-click solution to enable non-experts to incorporate encrypted inference into production applications. 为了克服可用性挑战并推进同态加密所带来的机遇，Google 的研究人员和工程师构建了 HEIR 编译器项目。HEIR（同态加密中间表示）是一个用于同态加密的开源编译器工具链和开发平台。具体而言，HEIR 可以将运行在未加密数据上的预训练 AI 模型转换为在加密输入上运行的模型。我们的愿景是将 HEIR 打造成一个“一键式”解决方案，使非专业人士也能将加密推理集成到生产应用中。

Since announcing our intentions in 2023, we’ve seen the homomorphic encryption community embrace HEIR. We have partnered with companies developing hardware accelerators for homomorphic encryption, including Belfort, Niobium, Cornami, and Optalysys. The fruits of those efforts are shown in our demos below, and we plan to demonstrate the latency benefits of these accelerators in the near future. HEIR has also become a productive research platform. By building on HEIR, cryptographers can focus on their specific optimization and use the existing infrastructure for testing, benchmarking, and comparisons. This has resulted in collaborations with Georgia Tech, Carnegie Mellon, UC Santa Barbara, Illinois Institute of Technology, Purdue, the University of Edinburgh, Tsinghua University, and others. To date, four peer-reviewed publications were built on HEIR, with more in preparation, and HEIR has accumulated numerous citations. 自 2023 年宣布我们的计划以来，我们看到同态加密社区积极拥抱 HEIR。我们已与开发同态加密硬件加速器的公司建立了合作，包括 Belfort、Niobium、Cornami 和 Optalysys。这些努力的成果已在下方的演示中展示，我们计划在不久的将来展示这些加速器在延迟方面的优势。HEIR 也已成为一个富有成效的研究平台。通过基于 HEIR 构建，密码学家可以专注于特定的优化，并利用现有的基础设施进行测试、基准测试和比较。这促成了与佐治亚理工学院、卡内基梅隆大学、加州大学圣塔芭芭拉分校、伊利诺伊理工学院、普渡大学、爱丁堡大学、清华大学等机构的合作。迄今为止，已有四篇同行评审论文基于 HEIR 发表，更多论文正在筹备中，HEIR 也已积累了大量引用。

Applications of HEIR

HEIR 的应用

To demonstrate how far homomorphic encryption has come, we’re sharing four private inference applications. Each application was compiled with HEIR, and latency numbers are presented for a single-threaded CPU. The source code for all examples is available in our GitHub repository. 为了展示同态加密的发展程度，我们分享了四个私密推理应用。每个应用均使用 HEIR 编译，延迟数据基于单线程 CPU。所有示例的源代码均可在我们的 GitHub 仓库中获取。

A Deep Learning Recommendation Model unlocks serving private content recommendations, joint work with Belfort Labs, LG, and New York University. 深度学习推荐模型：解锁私密内容推荐服务，这是与 Belfort Labs、LG 和纽约大学的联合研究成果。
Credit card fraud detection: Together with Niobium and hardshell.ai, we compiled a credit card fraud detector. 信用卡欺诈检测：我们与 Niobium 和 hardshell.ai 合作编译了一个信用卡欺诈检测器。
Threat intrusion: Together with Niobium we compiled the Kitsune system for anomaly detection of encrypted network traffic. This allows a service provider to detect anomalies without revealing the contents of network packets to the service provider. 威胁入侵检测：我们与 Niobium 合作编译了用于加密网络流量异常检测的 Kitsune 系统。这使得服务提供商能够在不获知网络数据包内容的情况下检测异常。
Hotword Detector: Together with Belfort Labs we compiled a hotword detection model, which could allow an audio-triggered AI agent to recognize hotwords while protecting the privacy of the audio recordings. 热词检测器：我们与 Belfort Labs 合作编译了一个热词检测模型，它允许语音触发的 AI 代理在识别热词的同时，保护音频录音的隐私。

As the software industry adapts to security and privacy changes amid AI, our research team is working to make homomorphic encryption, easy to develop, fast to run, and ubiquitous across industry. 随着软件行业在 AI 浪潮中不断适应安全与隐私的变化，我们的研究团队正致力于让同态加密变得易于开发、运行迅速，并在整个行业中普及。