Consider two integers M1 and M2.

Consider RSA with private key (E), public key (D), and public modulus (N).

Encrypt(M, E, N) = mod(pow(M, E), N).

Decrypt(C, D, N) = mod(pow(C, D), N).

mod(Encrypt(M1, E, N) * Encrypt(M2, E, N), N) = mod(Encrypt(M1 * M2, E, N), N).

So, for all RSA encryption, multiplying the ciphertexts results in a ciphertext that is the multiple of the plaintexts. However, unless you can break RSA, you can not determine what numbers you multiplied or what the final multiplied number is.

This is not a fully homomorphic system as it only allows multiplication, but it is a existence proof that you can do operations on ciphertext that apply to the plaintext without being able to recover the plaintext unless you can break the encryption directly.

that being said, you can construct IND-CPA secure homomorphic encryption schemes from factoring-based assumptions iirc, so this isn't a fundamental obstacle.

If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.

It seems like you strongly believe otherwise, but I suspect you don’t have a good reason to, and just find it unbelievable.

Do you think you can distinguish it from noise, if given an implementation and the information an adversary would have access to?

Of course, you not being able to wouldn’t demonstrate that noöne can. But, it seems like if you had a good reason to believe that an adversary can, that would suggest you might have some idea of how they could do so. And, if you do have such an idea, then, if that idea works, it would be important for others to know, and if it doesn’t, it would presumably benefit your understanding to see why it doesn’t.

That's the oxymoron. If it was indistinguishable nothing could be gained.

It's not about me being able to distinguish it. It's the model provider saying they cant, when they can.

Suppose the plaintext, ciphertext, and key, are each a natural number modulo 5.

The key is selected uniformly at random. The ciphertext is obtained by adding the key to the plaintext (and as a result is also uniform random).

Then the ciphertext is sent to the server. The server only has the ciphertext, which is uniform random. The server then adds some integer mod 5 to the ciphertext, producing a new ciphertext, and sends it back to the user. The user then subtracts their key from the new ciphertext to obtain the new plaintext, which is their original plaintext plus the number the server added.

At no point in this process did the server learn anything about the user’s plaintext.

This is clearly secure.

It is also useless, because just adding a number isn’t a useful thing for a server to do (they may as well just send the user the number and let them add it themselves), but that’s because it is a toy example.

I suppose if mind uploading were possible, then under FHE it would in principle be possible to take the ciphertext and run the computation of “this mind upload of this person reads the data and provides some output”, and then presumably that uploaded person would have the experience of seeing the plaintext? But it wouldn’t be possible to get any information about the plaintext without the key (or enough brute force to find the key, but that’s why we use big enough keys to make this infeasible).

I send this server a question encrypted. It stays encrypted yet the server distinguished my ciphertext enough to produce a coherent reply. That means there was enough information in the ciphertext for the server to perform the inference, even if it was obscured to where it looks indistinguishable, it apparently wasn't.

This doesn't remove trust from the equation, it puts the trust directly on the algorithm. Probably one no one can explain to me like I'm 5. But because it's encrypted I am no longer breaking the law by processing on protected data. I imagine very large contracts await on the other side. Lots of money to be made.

Think about a very simple setting, say a database lookup. I send an index `i` in a database I want to lookup. The server sends back DB[i] or whatever.

In the clear, the server can immediately fetch the correct row. Under FHE, the server does a full scan of the database, and (roughly) for each row will do something like DB[i] * (encrypted selector variable that is 0 or 1 depending on if it is the row you want).

This is actually a baby version of FHE known as "Private Information Retrieval". For it, you (roughly) can design an encryption scheme that supports linear function evaluation. For example, a ciphertext Enc(m) can be paired with a matrix A to produce Enc(Am). You can then encrypt the ith basis vector m := e_i, and view the database as a matrix DB, to get DB * Enc(e_i) = Enc(DB*e_i) = Enc(DB_i). This works, and can be implemented in ~1k LoC, e.g. it is not particularly complicated to practically instantiate (though this basic sketch has some performance issues).

The price that HE is paying is essentially "have to run every possible contributing computation", which means it has to scale extremely badly for anything real world complex

The server doesn’t need any information to perform inference.

Hopefully then it's not too hard to believe you can build an encryption scheme and operations where `dec(enc(X) ⊞ Y) = X + Y` and `dec(enc(X) ⊠ Y) = X × Y`. If these operations can also be composed, i.e. homomorphism, then they're Turing complete! You can turn any function f(X) into a ciphertext version `dec(F(enc(X))) = f(X)`. It can't leak any information about X, because you only ever provided enc(X). For example you transform 'branching' code to something which traverses every path, and paths which do nothing will still appear to randomize the ciphertext, because you can't invent operations that distinguish which path is taken, because it's a secure ciphertext.

Modern homomorphic encryption uses more complex encryption schemes and primitives, to achieve thousands/hundreds rather than millions of times slower than f. Nonetheless it's impossible for the provider to gain a single bit of information about X.

I don’t see why you conclude that FHE couldn’t be close to as secure as that. (Like, not information theoretically, but with computationally bounded adversaries.)

In the secret sharing multi-party computation schemes, the individual shares of the secret are random and have no information about the plaintext.

I see no reason that FHE can’t have ciphertexts indistinguishable from noise.

my prediction was way too far out. 4.6 at home! Woo.

Interesting read thanks.

I dont believe you think the police force could replicate the injest of information these systems allow do you?

The point is, the plain view doctrine means the police don't need a warrant to record observation that are in plain view. The licence plates of cars on the street are in plain view.

I really don't understand how people got this idea in their head that their license plates are private information . How do red light cameras identify cars? How does parking enforcement work? By recording people's license plates. The whole reason why we mandate that cars display license plates to is to facilitate identifying vehicles.

If the precedent was set based on this idea. It will fall apart with further scrutiny.

>I really don't understand how people got this idea in their head that their license plates are private information . How do red light cameras identify cars? How does parking enforcement work? By recording people's license plates. The whole reason why we mandate that cars display license plates to is to facilitate identifying vehicles.

I don't think that is where the crux of the issue lay.

Privacy laws are generally about protecting what you do in private, not in public. In the US, anyone can film you in public, government or otherwise.

See Jones vs USA.

Sufficiently saturated ALPRs across the country give you the same capability of GPS. Without GPS.

By comparison Flock only operates in public, in places that are in plain view.

You're being exposed to a very specific group of people when you read Hacker News or Reddit. Plenty of people are happy to have Flock cameras in their neighborhood on account of the improved ability to investigate crime.

https://ij.org/case/norfolk-virginia-camera-surveillance/

Of course their is no reasonable expectation of privacy here. It's not his car lol. The LEARN db query was auxillary to the precedent here.

I can't see the jump your making at all or how this precedent holds any would hold water in the case of a innocent party. Its probably just a matter of time until the perfect case is presented and new case law established. Precedents change you know?

People generally don't have a reasonable expectation of privacy in public. That's why you can record and photograph people in public whether or not they agree to be recorded. It's the same logic that makes red light cameras and parking license plate scanners legal.

The expectation has been completely eroded by flock safety.

BGP attacks are largely defeated by onionservices.

And while governments have the ability to create exit nodes, so does anybody.

I didn't dive into the reference on why the guy thought our slow data processing is an advantage, but it does seem well tuned that we don't think like these models.

We would go mad and nothing would make sense.

Reminds me of the fun fact about the distance of the sun to the earth. Oddly tuned for our existence. Or when the anesthesiologists knocks out gamma waves and we skip through time in an instant. Why do the gamma waves operate like our lightswitch?

Anyways, since the start of the paper was sure I might use AI to summarize, here is AI's summary response using the personality of fry from futurerama.

https://postimg.cc/fJR1ZHfG

There are so many products on amazon sharing a link to one specific product and having someone else open it shortly after sounds like a high enough confidence.

Again just a hunch.

When I receive a link with a 100 character hash attached I gasp and yell at the person who sent me it (my wife normally)

I don’t necessarily want the people I share the link with to know my potentially pseudonymous user.