top | item 45323027

The Beginner's Textbook for Fully Homomorphic Encryption

251 points| Qision | 5 months ago |arxiv.org

Direct link to the book: https://fhetextbook.github.io/

46 comments

order

logannyeMD|5 months ago

FWIW: I created a github repo for compact zero-knowledge proofs that could be useful for privacy-preserving ML models of reasonable size (https://github.com/logannye/space-efficient-zero-knowledge-p...). Unfortunately, FHE's computational overhead is still prohibitive for running ML workloads except on very small models. Hoping to help make ZKML a little more practical.

infimum|5 months ago

This sounds super interesting. Can you elaborate on how you apply ZK to ML? (or can you point me to any resources?)

oulipo2|5 months ago

Did you check Zama.ai's work on FHE?

Hizonner|5 months ago

I was under the impression that, for any FHE scheme with "good" security, (a) there was a finite and not very large limit to the number of operations you could do on encrypted data before the result became undecryptable, and (b) each operation on the encrypted side was a lot more expensive than the corresponding operation on plaintext numbers or whatever.

Am I wrong? I freely admit I don't know how it's supposed to work inside, because I've never taken the time to learn, because I believed those limitations made it unusable for most purposes.

Yet the abstract suggests that FHE is useful for running machine learning models, and I assume that means models of significant size.

benlivengood|5 months ago

The difference between homomorphic schemes and fully homomorphic schemes is that FHE can be bootstrapped; there's a circuit that can be homomorphically evaluated that removes the noise from an encrypted value, allowing any homomorphic calculation's result to have its noise removed for further computation.

Nzen|5 months ago

My understanding is largely ten years old and high level and only for one kind of fully homomorphic encryption. Things have changed and there is more than one kind.

I heard it described as a system that encrypts each bit and then evaluates the "encrypted bit" in a virtual gate-based circuit that implements the desired operations that one wants applied to the plaintext. The key to (de|en)crypt plaintext will be at least one gigabyte. Processing this exponentially larger data is why FHE based on the system I've described is so slow.

So, if you wanted to, say, add numbers, that would involve implementing a full adder [0] circuit in the FHE system.

[0] https://en.wikipedia.org/wiki/Adder_(electronics)#/media/Fil...

For a better overview that is shorter than the linked 250 page paper, I encourage you to consider Jeremy Kun's 2024 overview [1]

[1] https://www.jeremykun.com/2024/05/04/fhe-overview/

pclmulqdq|5 months ago

Both of these are correct-ish. You can do a renornalization that resets the operation counter without decrypting on FHE schemes, so in that sense there is no strict limit on operation count. However, FHE operations are still about 6 orders of magnitude more expensive than normal, so you are not going to be running an LLM, for instance, any time soon. A small classifier maybe.

1oooqooq|5 months ago

the goalpost moved and it's not private anymore, just private enough.

hamburgererror|5 months ago

Let's admit for a second that the problem around computational cost is solved and using FHE is similar to using plaintext data.

My question might be very naive but I'd like to better understand the impact of FHE, discussions here seem to revolve very much around the use of FHE in ML, but are there other uses for FHE?

For example, could it be used for everyday work in an OS or a messaging app?

Also, is it the path for true obsfuscation?

dcminter|5 months ago

That's a big stretch for the premise, but...

There's no value to it in circumstances where you control all the hardware processing data, so "everyday work in an OS" - only if that OS is hosted on someone else's hardware, "a messaging app" - only if you expect some of the messages or metadata to undergo processing on someone else's hardware.

It seems wildly unlikely that the performance characteristics will improve dramatically, so in practice the uses are going to remain somewhat niche.

sandworm101|5 months ago

What is the computational burden of FHE over doing the same operation in plaintext? I realize that many cloud proponants think that FHE may allow them to work with data without security worries (if it is all encrypted, and we dont have the keys, it aint our problem) but if FHE requires a 100x or 1000x increase in processor capacity then i am not sure it will be practical at scale.

layer8|5 months ago

It’s at least a million times slower than non-encrypted computation. 1000x or 100x would be a huge progress.

EGreg|5 months ago

Funny thing is

Since neural networks are differentiable, they can be homomorphically encrypted!

That’s right, your LLM can be made to secretly produce stuff hehe

LeGrosDadai|5 months ago

That's pretty cool, but isn't any computable function can be computed via FHE, so I'm not sure the differentiable part is necessary.

seanhunter|5 months ago

Differentiability isn’t a requirement for homomorphism I don’t think.

Homomorphism just means say I have a bijective function [1] f: A -> B and a binary operator * in A and *’ in B, f is homomorphic if f(a1*a2) = f(a1)*’f(a2). Loosely speaking it “preserves structure”.

So if f is my encryption then I can do *’ outside the encryption and I know because f is homomorphic that the result is identical to doing * inside the encryption. So you need your encryption to be an isomorphism [2]and you need to have ”outside the encryption “ variants of any operation you want to do inside the encryption. That is a different requirement to differentiability.

1: bijective means it’s a one to one correspondence

2: a bijection that has the homomorphism property is called an isomorphism because it makes set A equivalent to set B in our example.

gametorch|5 months ago

ReLU, commonly used in neural networks, is not differentiable at zero but it's still able to be approximated by expressions that are efficiently FHE-evaluable. You don't truly care about differentiability here, if you're being pedantic.

Very insightful comment, though. LLMs run under FHE (or just fully local LLMs) are a great step forwards for mankind. Everyone should have the right to interact with LLMs privately. That is an ideal to strive for.

karolcodes|5 months ago

man, imagine having time to read such papers. genuinly would read it but i know this alone is like 30h study

inasio|5 months ago

I was surprised that for almost 300 pages there were only 26 references listed in the back. Not the end of the world by any means, clearly a ton of work went into this, but I find it useful to see from references how it overlaps with other subjects I may know more about

arjvik|5 months ago

Is the title broken?

I see “Unified Line and Paragraph Detection by Graph Convolutional Networks (2022)”

tomhow|5 months ago

Sorry about this. That was my screwup.

There were (at least) two posts from arxiv.org on the front page at the time, and when I was updating the title on the other one I must have applied it to this one instead. I've fixed it now and re-upped it onto the front page so I can have its full exposure on the front page with its correct title.

fhe|5 months ago

I see the same, and there is a posting of that title (and linking to the correct paper) also on HN frontpage. wondering what's going on.

Qision|5 months ago

Sorry for not responding earlier. This is probably a bug but it's super weird... I just emailed the mods about this.