Encrypted Inference

Homomorphic encryption (HE) is the foundational cryptographic primitive that makes encrypted inference possible. It is a form of encryption that allows computations to be performed directly on ciphertext, generating an encrypted result which, when decrypted, matches the result of the same operations performed on the plaintext.

• Fully Homomorphic Encryption (FHE) supports arbitrary computations (addition and multiplication) an unlimited number of times.
• Partially Homomorphic Encryption supports only one type of operation (e.g., only addition or multiplication).
• Somewhat Homomorphic Encryption (SHE) supports a limited number of sequential operations.

HE enables a client to send encrypted data to a cloud server, have the server run a model (like a neural network) on the encrypted data, and return an encrypted prediction, all without the server ever decrypting the data or accessing the model's plaintext weights.

Secure multi-party computation (MPC or SMPC) is a cryptographic protocol that enables multiple parties to jointly compute a function over their private inputs while keeping those inputs concealed from each other, revealing only the final output.

• In the context of machine learning, MPC can be used for encrypted inference where the model weights are held by one party and the input data by another. They collaboratively compute the prediction without either revealing their secret.
• Common techniques include Garbled Circuits and Secret Sharing.
• Unlike homomorphic encryption, which focuses on computation on encrypted data by a single party, MPC is inherently a multi-party protocol designed for scenarios with mutual distrust between participants.

A Trusted Execution Environment (TEE) is a hardware-based alternative to cryptographic methods for encrypted inference. It is a secure, isolated area of a main processor (an enclave) that provides hardware-level protection for code and data being processed.

• Key Principle: Data and code inside the TEE are encrypted in memory and are inaccessible to the host operating system, hypervisor, or even the cloud provider.
• Inference Flow: Sensitive data is sent into the enclave, decrypted inside the secure hardware, the model runs on plaintext data, and the result is re-encrypted before leaving.
• Examples: Intel SGX, AMD SEV-SNP, and AWS Nitro Enclaves. TEEs offer much lower computational overhead than pure cryptographic methods like FHE but introduce trust in the hardware manufacturer and require careful attestation.

Federated Learning (FL) is a decentralized machine learning paradigm focused on private training, which is complementary to encrypted inference for private prediction. In FL, a global model is trained collaboratively across multiple client devices or data silos.

• Core Mechanism: Clients compute model updates (e.g., gradients) on their local, private data. Only these updates—not the raw data—are sent to a central server for aggregation into an improved global model.
• Relationship to Inference: While FL protects data during training, the resulting model may still be deployed for standard inference, potentially leaking information. Federated Inference extends the concept, where model predictions are computed collaboratively without exposing client data or centralizing the model.
• Secure Aggregation is often used in FL to ensure the server cannot inspect individual client updates, providing an additional layer of privacy.

Differential Privacy (DP) is a rigorous mathematical framework for quantifying and bounding privacy loss. It is often used in conjunction with, or as an alternative to, encrypted inference.

• Core Guarantee: The output of a differentially private algorithm should be nearly indistinguishable whether any single individual's data is included or excluded from the dataset. This is quantified by a privacy budget (ε).
• Application to Inference: DP can be applied to the outputs of a model (e.g., adding calibrated noise to a prediction) to prevent leaking details about the training data. This is different from encrypted inference, which protects the input data during computation.
• Local Differential Privacy randomizes data on the user's device before any processing, offering a stronger client-side guarantee.

Confidential Computing is an industry-wide term and cloud technology category focused on protecting data in use. It encompasses hardware-based TEEs and provides the architectural framework for deploying encrypted inference systems in untrusted environments like public clouds.

• Definition: The protection of data being processed by isolating it within a hardware-based trusted execution environment.
• Key Standards: Governed by the Confidential Computing Consortium (CCC). It ensures data is encrypted not just at rest and in transit, but also during computation.
• Use Case for Inference: A cloud customer can deploy a sensitive model inside a confidential VM or container. The cloud provider's staff, other tenants, and malware cannot access the model's weights or the client's input data during inference, even with root privileges. This is a practical, performance-efficient implementation path for many encrypted inference scenarios.