To throw out some real and up-to-date numbers from [1] for FHE at "128-bit security level", to sort 8x 8-bit unsigned integers on the most ordinary of desktop PCs, wait 3 seconds for the result. Want to sort 32x 8-bit unsigned integers instead? Come back 34 seconds later for the result.

update: also see [2] for some primitive unsigned 64-bit integer operation benchmarks with the TFHE-rs library (winner in the sorting performance comparison of [1]). Equality at 80ms, addition and subtraction at 100ms, division at 8 seconds, etc.

[1] https://eprint.iacr.org/2026/1495.pdf Oblivious Sorting under Fully Homomorphic Encryption: A Comprehensive Survey and Performance Analysis, Omar Ahmed and Rostin Shokri and Nektarios Georgios Tsoutsos, 2026

[2] https://docs.zama.org/tfhe-rs/tfhe-rs/1.0/get-started/benchm...

The article conspicuously fails to go into much detail about that. I poked around with an AI a bit (to rapidly cover all the linked pages) and it seems the best numbers we can get are from this arxiv paper: https://arxiv.org/html/2506.18150v4 Which says:

"We evaluate HE-LRM on UCI (health prediction) and Criteo (click prediction), achieving inference latencies of 24 seconds on UCI and 228 to 489 seconds, respectively, on a single-threaded CPU."

There don't seem to be any direct comparisons available, probably because nobody else has any reason to limit themselves to one single-threaded CPU with normal techniques, but for reference the AI seems to expect that normal times for conventional setups are in the milliseconds range, fairly comfortably, even on CPU. I didn't find a clean primary source to link to for this claim, but clicking through various things that don't cleanly state the situation it did seem plausible. So we seem to still be in the range of single-digit orders of magnitude slower, possibly as much as 5 or 6, which is to say, we're still talking the range where we need to take the log of the difference to get sensible numbers, we're not using percentages.

(To run it yourself, I basically just fed the URL from the HN link, mentioned that FHE is known to be slow, and asked if anything linked in the blog post gave concrete times.)

Commercially viable for Google boils down to can they attribute ads behaviors to it or not.

Then there’s a second tier of things that just make those wheels turn and if they do or don’t make ads revenue is nominally immaterial.

The teams doing this stuff at Google are purely for show, none of this makes it into any real products.

There’s the narrow exception of stuff like gboard, that does use privacy preserving ML/fed learning, but this stuff isn’t in the same zone.

I find it a bit embarrassing when Google publishes this stuff to be honest.

The primary path to speed ups appear to be in custom ASICs by startups like Niobium. Combined with the recent Taalas acquisition by AMD, I think I see where this is going.

But yeah, for hot path traffic it's probably going to be swamped by the input data rate. But I expected identity tables and cached lookup data will need to be a core component so duplicate checks is avoided in every way available.

1000x slowdown is bad but not a complete deal breaker. Do you have a sense of what a reasonable achievable factor is? Do you have sense for how long before we get to that achievable factor?

That's the reason for HEIR like optimization and parameter selection.

It narrows the 10^3 - 10^6 penalty to 10x - 100x.

The one that I'm waiting for is a women's period tracking app that uses FHE on the backend to be fully private.

Exactly my concern, and worse overhead that what I recalled.

Cost-wise the only viable private compute is local compute. It's more expensive than cloud, but true private compute in the cloud is definitely pricier.

Do you think that’s like a fundamental limit or something that will improve with time and new algorithms?

Aren't there already much more efficient ways to make inference private?

Using regular encryption and secure enclaves, there are already providers that are roughly 2x the cost of normal providers. For example, https://tinfoil.sh/

where does this factor "1000x" come from? I have doubts.

F. Scott Fitzgerald's test of top-tier intelligence -

> Holding two opposing views in the mind means accepting two contradictory ideas at the same time without needing to pick one side or rush to a simple answer

I continue to use Apple products because they are top class even though everytime I think of Tim Cook in the Oval Office presenting the gold plaque to the current president, it makes me wanna puke. World isnt black or white.

I think that, if you are under the impression that having an administrative back door is an unpopular feature, then you should speak to more of your non-technical friends about their experience of technology. I think you'll find that the people who could most benefit from a password manager often don't have good credential management and would be worse off if they lost all their passwords when they forgot or lost their master password.

That doesn't protect their ad targeting in the eyes of regulators, so no point in turning that on by default

If you think about it for a moment you will realize the average user does not want that.

addition is easy/essentially the same cost as standard (not really, because you have to compute mod p addition rather than mod 2^32, but ignoroing that it's roughly the same).

as a general rule multiplication is the difficult part.

it's hard to accurately quantify what "nontrivial" cost overheads are because they're very application dependent. for example, things that require encrypted control flow are very hard under FHE. so an encrypted hashmap sounds roughly unimplemnetable. but things that do not require encrypted control flow (e.g. many ML applications) are less bad. this can still be quite bad though. for example, relu is trivial in plaintext. it is hard homomorphically, because the trivial way to write it uses private control flow.

There are LLM models which compute only using addition no?

One potentially simple answer is: to make things that are otherwise illegal (for regulatory reasons) possible.

There are some instances of hand-built cryptographic protocols used in production at Google that use FHE in small doses (e.g., computing a single dot product as part of an interactive protocol), so the big question is whether having a general-purpose tool will expand the feasibility of applying these to other, maybe less critical projects that still want some privacy guarantees but can't afford to hire cryptographers.

I guess I'm curious from your perspective what and why makes the tech from being commercially viable, and the concerns of big players adopting this (which was always going to happen I imagine, but when shapes a lot of the future of the field).

you can produce a correct result without knowing what that result means as long as the person you then provide that result to can decrypt it. So the way it works is the server does the job on data it can't read, sends an answer to the device, the device decrypts it.

It's very useful for things like healthcare data for example but also for products like "home assistants", and it's one of the use cases that the team hiring internally was giving in their job req. I tried to apply too but didn't get it unfortunately, this was a very interesting product to work on imho, congrats to whoever got my job :)

Freenet, but for AI inference.

What, how is that relevant? the transistors on a microchip double about every two years. That’s descriptive, not prescriptive, so whatever you’re trying to imply about the future is kindof a toss up — there’s no promise the parents hold. And, it doesn’t really have to do with tfa, as far as I can tell? Do you perhaps mean Murphy’s law, “whatever can go wrong will go wrong”?

With Fully Homomorphic Encryption it's nobody elses.

The basic idea of of the project is to remove the need for trust.

This kind of attitude is really disrespectful of decades of progress in cryptography. Without even considering homomorphic encryption, classic encryption is specifically designed to make intermediate nodes such as ISP dumb pipes that do not know the contents of communication. The ISP can store your communications on their server however they want.

If you don’t agree with this model, I’m afraid modern cryptography doesn’t have anything to offer.

Unless all of your money is under your mattress, you're already making such decisions with a far more valuable asset.

It's FHE for "cryptographically-secure private AI inference" not for every other service where they snoop into your behavioral information.

It can give you confidentiality without availability. Not sure about integrity? Anyways, still useful.

The linked project page [1] claims to be fully homomorphic. Assuming the claim holds (I haven't verified it), then there is provably no way for Google or anyone else to obtain any information from the encrypted data or computation performed on them.

FHE is traditionally horrifically slow, so it's hard to imagine running anything beyond toy models with it. They list some applications on the original article page, but (presumably) they must be dramatically stripped down in order to run within any reasonable time budget. This is not going to run anything like a Sol/Opus any time soon.

[1]: https://heir.dev/

Related, I'd seen this blog [0] posted on HN a few years back that gave a nice run down on the "programmable cryptography" space which introduce FHE and a few other neat concepts. Really enjoyed the read and learned some new terms.

[0] https://0xparc.org/blog/programmable-cryptography-1

100% not an expert but my understanding was that part of what you are proving by signing the computation is that the computation itself was performed specifically as agreed to. I may be mixing this up with zero knowledge proofs.

note that this is even true for an honest server. Roughly, FHE computations often require certain bounds on the (encrypted) messages for things like tuning polynomial approximation domains etc. If your messages are out of distribution for the tuned polynomial approximations you'll get back garbage as as result.

Secure Enclaves are broken all the time though [1]. They’re also not secure against attacks from a quantum computer (including store now decrypt later attacks). At least with symmetric FHE, anything that happens after encryption requires zero trust.

[1] https://sgx.fail/

You are objectively wrong. The math is straightforward to show that you can operate on a ciphertext securely in some cryptosystems.

Consider two integers M1 and M2.

Consider RSA with private key (E), public key (D), and public modulus (N).

Encrypt(M, E, N) = mod(pow(M, E), N).

Decrypt(C, D, N) = mod(pow(C, D), N).

mod(Encrypt(M1, E, N) * Encrypt(M2, E, N), N) = mod(Encrypt(M1 * M2, E, N), N).

So, for all RSA encryption, multiplying the ciphertexts results in a ciphertext that is the multiple of the plaintexts. However, unless you can break RSA, you can not determine what numbers you multiplied or what the final multiplied number is.

This is not a fully homomorphic system as it only allows multiplication, but it is a existence proof that you can do operations on ciphertext that apply to the plaintext without being able to recover the plaintext unless you can break the encryption directly.

This is actually the magic of FHE. The ciphertext is indistinguishable from noise AND can be computed on, it just looks like different noise.

If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.

they could have gone with an oblivious transfer approach (where it's working on what looks like multiple problems at once, you don't know which)

Eh? With secret sharing one can do computation on a shared secret where it is provable that no individual party can recover any information about the data with their share alone.

I don’t see why you conclude that FHE couldn’t be close to as secure as that. (Like, not information theoretically, but with computationally bounded adversaries.)

No, that’s not what proper encryption means. Security for encryption means that cipher texts encrypting distinct messages are indistinguishable. This is called IND-CPA, and FHE satisfies this.