What's this about?
Google released HEIR, an open-source compiler for homomorphic encryption, as part of its Private Computing Toolkit. The framing: end-to-end encryption protects your data from breaches but prevents the provider offering features that depend on it, like spam detection. Local processing avoids that but is limited by device capability and risks leaking the provider's proprietary model. Homomorphic encryption promises to dissolve the trade-off.
What exactly is homomorphic encryption?
Normally, to compute on data you must decrypt it first — which means whoever computes can read it. Homomorphic encryption allows arithmetic directly on ciphertext, so the server can run your query through a model and return an encrypted answer that only you can decrypt, having never seen your question or its response. The analogy is a locked glovebox: someone reaches in through sealed gloves, manipulates the contents, and never opens the box. It has been theoretically possible since 2009; the obstacle has always been speed.
What's the community saying?
- "Is there any way for the client to verify?" The top practical question: does this rely on trusting Google's claim, or can a user confirm the provider genuinely cannot see the inputs? Commenters looked for a whitepaper and found a conference presentation.
- The most technically substantive objection. FHE guarantees you need the key to see inputs and outputs — but not that the computation performed is the one you wanted. An adversary could run an adversarial computation on certain inputs, or insert their own step before or after.
- The overhead problem is unresolved. Someone whose master's thesis is in privacy-preserving ML reported roughly 1000x overhead on inference, which is the reason this hasn't been commercially viable.
- Trust in the messenger. Several noted the mismatch of Google promoting cryptographic privacy while its own password manager lacks end-to-end encryption by default.
- The marketing-harm argument. A well-received concern: the technology is real, but most people will hear "no one at Google can read your stuff," which is a stronger claim than what's actually being offered.