Episode 20 of The Security Podcast of Silicon Valley aired on September 2, 2022, with Jon McLachlan hosting. The guest was Benoit Chevallier-Mames, then team lead of machine learning at Zama (Podbean, Apple Podcasts, Spotify, LinkedIn). The episode is called “Benoit Chevallier-Mames, Team Lead of Machine Learning at Zama, On Open Source Homomorphic Encryption.” It was his first podcast. He came back in May 2024 for episode 44.
Jon and Benoit had worked on the same team at Apple. Jon couldn’t agree more about Benoit’s new field:
“this is the holy grail.”
Jon McLachlan, at 10:54
The holy grail is a server that computes on data it can’t read. Wikipedia describes homomorphic encryption as encryption that “allows computations to be performed on encrypted data without first having to decrypt it” (Wikipedia). In 2022, Benoit’s team built Concrete ML, an open source library that brings it to data scientists.
This page follows the conversation in order: a section for each part of it, sixteen figures, twenty clips from the tape, two talks by Benoit on YouTube, the full transcript, and five tools: a quiz, a scorecard for whether a model fits encrypted inference, a calculator for what eight bits does to a model’s size, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words. Every pass of the recognizer hears Benoit’s “FHE” as other letters, so the page quotes none of his lines that say it.
Two engineers from the same team
Jon introduced Benoit as a cryptographer with a PhD in cryptography and a career built around it, at Gemplus and then at Apple for twelve years. Jon asked what he could share about Apple. Benoit said he couldn’t share much detail, then gave the outline: the two of them were on the same team, the DRM team, for about five years. The team protected content such as audio and video, with techniques like white-box cryptography and obfuscation.
DRM, or digital rights management, is “the management of legal access to digital content” (Wikipedia). In white-box cryptography, the attacker has full access to the code that does the encryption (Wikipedia). Obfuscation makes code hard to understand on purpose (Wikipedia). For Jon, Apple was his first real career job after graduate school. He added that their work shipped in iTunes, and from there it went into the iPhone, the iPad and the rest of that ecosystem. Benoit said billions of people use it
“without even noticing that we have done it”
Benoit Chevallier-Mames, at 4:00
Benoit’s LinkedIn lists eleven and a half years at Apple, on the DRM technology team and the crypto team, working on white-box cryptography and obfuscation, with about three dozen patents. Before Apple, he spent seven years at Gemplus on public key cryptography for smart cards and one year as a cryptologist at ANSSI (LinkedIn). Episode 44 covers the keys hidden inside programs in more depth.
Now or never
Jon asked why Benoit left a place he loved. Benoit had always wanted to try a startup, and he knew that one day he would jump. Then people he knew closely started a company. He had known its CTO for about 20 years, and the company worked in cryptography, which he knew well, on fully homomorphic encryption. Jon summed it up:
“It was that moment or never.”
Jon McLachlan, at 5:31
Benoit put it his own way: he didn’t leave Apple, he joined Zama. He doesn’t rule out going back one day, and he said this about the move:
“but I don’t regret it.”
Benoit Chevallier-Mames, at 5:38
Jon agreed that Apple was a great place to work:
“they make it incredibly nice to work there.”
Jon McLachlan, at 6:00
Jon’s own move away from Apple was similar:
“I was looking for something to really push the envelope”
Jon McLachlan, at 6:25
That took him to Symphony Communications.
A primitive cryptographers dreamed of
Benoit offered to explain homomorphic encryption, and Jon asked what problem it solves. Benoit called it
“a kind of a grand primitive that we have dreamed of in the cryptography research field”
Benoit Chevallier-Mames, at 7:06
He said cryptographers had chased it for about 40 years. The idea seemed so crazy that people thought it was impossible, until someone did it.
Wikipedia dates the question to 1978, within a year of the RSA scheme. For more than 30 years, no one knew whether a solution existed (Wikipedia).
Benoit started with ordinary encryption, which is built so that no one can change the ciphertext in a meaningful way. Jon put it in his own words:
“you can’t change it without destroying your encryption.”
Jon McLachlan, at 7:43
Change one bit of the ciphertext, Benoit said, and the change is one you can’t predict. Jon asked every listener, three times over, to put authentication on top, so you can detect when someone tampers with the ciphertext. Cryptographers call an encryption scheme malleable when someone can turn one ciphertext into another that decrypts to a related plaintext (Wikipedia). Fully homomorphic encryption makes that a feature, by design.
Compute on what you can’t read
Benoit described what that buys you. You encrypt your data on a device you trust. Then you send it to
“a server that you don’t need to trust.”
Benoit Chevallier-Mames, at 8:40
The server runs whatever computation it needs using nothing secret, and it never learns what it’s working on. It sends back a result that only you can decrypt.
A solution came in 2009, Benoit said, from Craig Gentry, and better generations of schemes followed. Wikipedia credits Gentry, using lattice-based cryptography, with the first plausible construction of a fully homomorphic scheme in 2009. In 2014, the FHEW scheme showed that refreshing the ciphertext after every operation cuts bootstrapping to a fraction of a second, and TFHE followed in 2016 (Wikipedia). Jon thanked him
“for dumbing it down a little bit for those of us who are not cryptographers.”
Jon McLachlan, at 9:47
The holy grail for SaaS
Jon took it to the business side. FHE gives the people who build software a new tool to protect customer data: your personal information, or even a diary. Today a company wants to own that data and monetize it. If the data stays encrypted and you hold the only private key, a third party can still work on it:
“now we enable people to build third-party SaaS services that can perform meaningful operations, valuable operations”
Jon McLachlan, at 10:34
All of that happens without you sharing the data itself. Benoit brought up a slogan from an Apple ad: what happens on your iPhone stays on your iPhone. Because Apple cares about privacy, he said, some work stays on the phone and never goes to a server. With FHE, the phone could encrypt the data and send it to any server, and the privacy stays the same. You get both: privacy, and the big computations that need a server.
A DNA test the lab can’t read
Jon asked for an example of something that today means handing sensitive data to a third party. Benoit picked a test for a disease that needs your DNA. You send your DNA to a company you don’t know. You can’t tell whether it keeps the record or sells it for statistics. Then there’s the result:
“Are they going to share it with your employer, with your bank, with your insurance”
Benoit Chevallier-Mames, at 12:56
Lots of people want to know whether they have the disease, he said, and they accept sharing private information to find out. Once your DNA is on the web, there’s no way to erase it.
With FHE, you encrypt your DNA on a device you trust, and the lab runs the same test on the encrypted data:
“So they would not have an access to your DNA. They can’t share it. They can’t do anything with it.”
Benoit Chevallier-Mames, at 13:47
The lab gets an encrypted result back, which means
“they don’t know if you have the disease.”
Benoit Chevallier-Mames, at 13:58
So the lab has nothing to share.
Founders he had known for twenty years
Jon asked whether a DNA testing company could do that with Zama then. Benoit said Zama was founded with that kind of use in mind. Its CTO, Pascal Paillier, had worked with Benoit at Gemplus about 22 years before. Benoit called him a well-known cryptographer, and
“one of the main specialists of homomorphic encryption.”
Benoit Chevallier-Mames, at 14:52
The Paillier cryptosystem, a public key algorithm from 1999, carries his name (Wikipedia). The other founder is the CEO, Rand Hindi, whom Benoit described as an AI scientist and a serial entrepreneur. Rand’s previous company, Snips, was acquired. TechCrunch later reported that the buyer was Sonos (TechCrunch). That track record mattered to Benoit:
“it was less risky to me to jump to Zama”
Benoit Chevallier-Mames, at 15:24
Jon named what made it work:
“you had the trust”
Jon McLachlan, at 15:36
Half the company has a PhD
Half of Zama’s people had a PhD, Benoit said, most of them in cryptography. He said Zama had raised 50 million from investors, in a Series A, and pointed to Crunchbase for the details. Jon saw a long road ahead:
“This is definitely a deep tech endeavor.”
Jon McLachlan, at 17:05
Benoit agreed that it’s a big investment. FHE doesn’t come for free, and Zama’s investors know that finding the fit for a product takes time and trial. Jon named the goal, product-market fit:
“That’s going to be the challenging piece.”
Jon McLachlan, at 17:36
On top of that, the technology is new and not widely adopted. Benoit went further. FHE isn’t even widely designed yet, and it’s still a field of research. That’s why the company has so many PhDs. Our post on what deep tech means covers why that kind of company needs patient capital.
Two markets for FHE
Jon asked whether Benoit ran a team. He did: the machine learning team. Zama saw two sorts of applications for FHE. The first is cloud applications, work you want to run on a server you don’t trust, like the remote DNA test. Machine learning is one of those. The second is blockchain, and a new division was starting on it. On a blockchain built this way, you don’t see the clear values.
Benoit’s team was building Concrete ML, a tool for data scientists who don’t know cryptography. He brought a lesson back from Apple:
“It should just work.”
Benoit Chevallier-Mames, at 20:05
There shouldn’t be much to set up or understand, and you shouldn’t need a PhD in crypto. Making things simple is one of the company’s goals, he said.
The day this episode aired, Zama’s YouTube channel posted a talk by Benoit for the Australian Institute for Machine Learning, “Concrete ML: A data-scientist-friendly toolkit for machine learning over encrypted data.” Its notes say the Python package was built to be usable “by any data scientist, even those without prior cryptography knowledge,” with APIs as close as possible to those of scikit-learn and torch (YouTube).
Eight bits, like forty years ago
Then Benoit got to the hard parts. The machine learning his team ran on encrypted data was limited to eight bits. He found that a bit fun:
“40 years ago, computers were very limited in terms of precision”
Benoit Chevallier-Mames, at 20:36
With FHE, he said, the history repeats itself. You’re back to computing in eight bits, and this time privacy is the reason. The challenge is to run machine learning with such small values.
Slow today, faster with hardware
The second constraint was speed. Many things ran on CPUs, so it was quite slow next to the same computation in the clear. Zama was working on hardware accelerators, inside the company and with other companies. Benoit mentioned another company that works with optics, and Jon asked whether that meant fiber. Benoit kept it short:
“So don’t ask me how it works.”
Benoit Chevallier-Mames, at 21:51
With several companies building accelerators for FHE, he said, it will get faster and faster. Zama expected it to be sufficiently fast by 2025. Zama’s YouTube channel now has a tutorial on its own hardware accelerator for FHE, an HPU on an FPGA (YouTube).
The last challenge was that the tools didn’t exist yet:
“nothing exists. So we are just making things from scratch.”
Benoit Chevallier-Mames, at 22:28
He passed on a comparison someone at Zama likes to make. Fifteen or twenty years earlier, people in machine learning had to build everything themselves. Now a student downloads Keras and trains a model fifteen minutes later. Zama hoped to build the same kind of tools for FHE.
Security is never traded
Jon wished for easier and easier, and more and more secure. Benoit drew a line: Zama never trades security. Anything Zama ships has at least 128 bits of security, he said, the security of AES. Wikipedia explains that n-bit security means an attacker would have to perform 2 to the power n operations to break it, and that AES-128 is designed to offer a 128-bit security level (Wikipedia). What Zama does trade is speed, and sometimes memory, since FHE can use a lot of RAM.
What eight bits means for a model
Jon admitted he’s no machine learning expert and asked about the eight bits:
“I know that two raised to the power eight is 256, just like probably all engineers in this world”
Jon McLachlan, at 24:02
His question was whether that limits a model’s results:
“Does that mean that the ML results are limited to 256 different classification categories?”
Jon McLachlan, at 24:11
The answer is quantization. Benoit said people on his team know it better than he does. Quantization is normally used to compress neural networks, which get too large to send over the air. Companies try to run networks on integers of eight bits, which makes them eight times smaller. Zama uses it to go from 64 bits down to eight-bit integers. In signal processing, quantization maps values from a large set to a smaller set (Wikipedia).
One way is post-training quantization, in Benoit’s words:
“you do your training and then you quantize”
Benoit Chevallier-Mames, at 25:21
The other, which he called even more fascinating, is quantization-aware training. You tell the training that the model will be quantized, and it picks weights that hold up once it is. How well it works depends on the model. For one kind of model in wide use, Benoit said it’s smooth for the user, and comparing encrypted and clear results,
“the accuracy are very, very close.”
Benoit Chevallier-Mames, at 26:09
At the other end are neural networks, where the limit was still a challenge. Benoit said it would get better with later releases, and part of Zama’s work is to raise the limit. In June 2023, Benoit and Jordan Frery told a Stanford security seminar that for trees (decision trees, random forests and gradient boosted trees) they get “state-of-the-art solutions over encrypted tabular data,” with promising results for deep learning on some vision tasks (YouTube).
Your key stays with you
Jon summed up what that makes possible. You encrypt your private data and hand it to a model that’s already trained, like a computer vision model:
“it can work now on our encrypted data instead of on the plain text.”
Jon McLachlan, at 27:14
Each user’s key stays on the device, Benoit said, and the server gets an equivalent of it. One compiled model serves many users, and only one part of it changes, depending on who the user is.
Focus, and a second product
Jon liked the focus:
“One of the greatest tricks that entrepreneurs use is focus, right?”
Jon McLachlan, at 27:54
Zama was taking an open problem, fully homomorphic encryption, and pointing it at one application. Benoit agreed. Machine learning was the company’s focus within cloud computation, and if the company succeeds, it will extend from there. Meanwhile the other division was working on blockchain, so a second product was already on the way.
Three lines of products, all open source
Benoit said the core is Zama’s first product. The company planned three lines of products, and the first was the Concrete library, the core, which can be used directly in Rust. Jon stopped him:
“wrote all of this in Rust?”
Jon McLachlan, at 29:04
All of it, and it’s open source. Rust is a general-purpose language built for performance and memory safety (Wikipedia). On top of the core sat two more lines. Concrete Numpy turns a NumPy program into its FHE equivalent. NumPy is the Python library for large arrays and the math on them (Wikipedia). Concrete ML works at a higher level: you take a model like a decision tree and replace it with its equivalent. Jon reacted:
“you just dropped a bomb on us.”
Jon McLachlan, at 29:41
The Rust library was created more than a year before, mainly for people who work in Rust and for cryptographers. The higher layers are for people who aren’t cryptographers and just want it to work. The blockchain division hadn’t opened its product yet. Jon finished the sentence:
“Still baking. Yeah. It’s still in the oven.”
Jon McLachlan, at 30:35
Benoit’s LinkedIn says Concrete Numpy was later renamed Concrete Python (LinkedIn). Wikipedia lists Concrete, with a Python front end, and TFHE-rs, in Rust, among homomorphic encryption libraries (Wikipedia). The code is on Zama’s GitHub.
Free to try, a license to ship
Everything at Zama is open source, Benoit said, by choice of the company:
“it’s free of use for researchers or for students”
Benoit Chevallier-Mames, at 30:46
Companies can also give it a try for free. To ship it in a commercial product, you need another license. People ask him all the time how an open source company makes a living, and the CEO had written a blog post on it. Jon read the strategy:
“I’m gathering that your go-to-market strategy is bottom-up.”
Jon McLachlan, at 31:44
Benoit agreed. The goal for now was as many users as possible:
“our users are the developers.”
Benoit Chevallier-Mames, at 32:02
The products should be so easy to use, and so appealing, that developers try them, build a prototype, and then
“show it to their boss.”
Benoit Chevallier-Mames, at 32:16
If the boss sees a product in it, the company comes back to Zama to change the license. Jon asked whether the target was machine learning engineers who care about privacy. For his team, yes, Benoit said, and
“it’s a niche of millions of developers.”
Benoit Chevallier-Mames, at 32:45
Jon meant it with respect: the aim is to be the biggest fish in the smallest pond, the best thing on offer to everyone in that market.
Wikipedia calls the practice of offering the same software under more than one set of terms multi-licensing (Wikipedia). Concrete ML’s README today puts it this way: the code is free under the BSD-3-Clause Clear license for development, research, prototyping and experimentation, and commercial use needs Zama’s commercial patent license (GitHub).
Results that can wait an hour
Machine learning, Benoit said, is a good first example of the cloud applications Zama wants to serve. Once it works for machine learning, the company can extend to other kinds of applications. It also suits FHE while FHE is slow, because a lot of machine learning doesn’t have to run in real time. He went back to the health test. For a result like that,
“you can wait an hour”
Benoit Chevallier-Mames, at 33:49
and you keep the privacy.
Later, with hardware accelerators, Zama expected to take on more applications. Jon asked about self-driving cars, which keep uploading GPS, lidar and other sensitive data about what you do. Benoit said virtually yes.
Jon then set two business models side by side. One sells devices and protects the user’s privacy, and doesn’t own the data. The other gives services away for free, owns the data, and uses machine learning on it to sell ads. Benoit said FHE should let the second kind still show you an ad without learning where you’re going. He called it the best of both.
On the device or on a server
Jon raised the other way to keep data private: do all the work on the device. That takes a lot of computation, he said. Benoit’s concern was keeping models current. A model gets more accurate as you update it, because
“the data are changing from day to day.”
Benoit Chevallier-Mames, at 38:31
Updating a model on billions of devices could be a nightmare, he said. It’s much easier to update a few servers and still keep things private. Jon added the cost to the user. A feature that drains the battery in a few hours doesn’t last:
“I’m going to turn off that feature.”
Jon McLachlan, at 40:07
He needs his phone to last a full day on one charge, and to keep working for at least three years. That’s the case for a service in the cloud. You send up a small piece of data, the cloud does the expensive computation, and it sends back a quick answer. The service stays up to date in one place, and leaves your battery alone. Each application will have to weigh the pros and cons, Jon said.
Privacy as a selling point
Zama was working with early adopters. Benoit said some of them want to do things for the first time, like a DNA test on encrypted data, and the privacy helps their brand too. A company could promise:
“I can do your test very accurately, plus I will not see your data”
Benoit Chevallier-Mames, at 41:43
He expected more users to leave the bigger messaging apps because they care about privacy.
Jon agreed that privacy should be at the center for security professionals. He doesn’t buy the argument that you have nothing to hide:
“everyone does need some sense of privacy.”
Jon McLachlan, at 42:44
You might trust the first company that handles your data. But if it sells the data on and it gets passed around,
“you have absolutely no control”
Jon McLachlan, at 43:05
over who has it.
Benoit added that a company you trust can be bought later by another one, and then things change. Jon said companies do whatever is legal to stay profitable:
“That’s just what a company does, right?”
Jon McLachlan, at 43:35
More than the bare minimum
Then there are the laws. In Europe, Benoit said, the GDPR protects users’ privacy, and it holds some companies back. He pointed to FHE and other privacy-preserving techniques as the answer. Jon listed the American side: the CCPA in California, which he called a little harsher than the GDPR, HIPAA for healthcare, the SEC, and New York DFS, which regulates banks and other financial firms registered in the state. But he doesn’t want to stop at compliance:
“I don’t think that the right thing to do is to do the bare minimum, which is comply with the law.”
Jon McLachlan, at 45:16
You can’t know what will happen, he said, and a big part of security is reducing your exposure to risk. The GDPR is a European Union regulation on information privacy (Wikipedia). The CCPA, signed in June 2018, is a California law meant to strengthen privacy rights and consumer protection (Wikipedia).
Try it, star it, file the bug
Jon sent listeners to Zama’s GitHub to try Concrete, Concrete Numpy and Concrete ML. Benoit wanted them to judge for themselves:
“Don’t take my word for truth.”
Benoit Chevallier-Mames, at 46:18
He brought one more Apple habit to his team: make things that work, that are easy to use, and that are tested. Anything not tested doesn’t work, he said.
For help, he listed the channels. You can reach him on LinkedIn. Zama runs a community forum on Discourse, and the team answers fast and in depth. There’s also FHE.org, an association for all of FHE, beyond Zama’s, with a Discord and a meetup about once a month, recorded for later. And he asked for bugs, because a bug report means someone is using the product. Apple taught him that too. A radar, at Apple, is the equivalent of an issue, and if there’s no radar,
“the bug doesn’t exist.”
Benoit Chevallier-Mames, at 49:01 Jon liked the deal for both sides:
“It’s like having an entire startup ready to go”
Jon McLachlan, at 49:17
Users get a free tool, and Zama gets closer to product-market fit. Benoit asked one small favor: a star on GitHub, which gives the projects exposure and shows people use them. He asked Jon for his star too.
Building his own team
Jon asked the hard question: Apple or Zama? Benoit said they’re hard to compare, and he doesn’t regret the choice. He called it an ethical mission, and he likes the founders’ vision. At Zama he built his own team, and he tries to bring a bit of Apple’s culture into it. He wants the people on his team to be happy and to work on technology at the edge. Jon added the word bleeding. He also wants users to be happy. He was interviewing users at the time, and he’s proud when they tell him
“the documentation is very nice, it’s very clear”
Benoit Chevallier-Mames, at 52:03
One more thing he liked about Zama was talking about his work in public. After twelve years at Apple, this episode was a first:
“It’s the first time I have a podcast.”
Benoit Chevallier-Mames, at 52:36
At Zama, he can exchange directly with developers. Jon was glad Benoit could take part in the wider community now.
Hiring, and last words
Benoit had two recommendations for listeners: try Concrete ML, and ask Jon for an interview of their own, since this one had been so comfortable. Jon said he had learned a ton about cryptography and obfuscation from Benoit, and still has more to learn:
“I still consider myself a novice”
Jon McLachlan, at 55:48
Zama was hiring. Benoit said the goal was to hire 100 people by the end of 2023, and that you could apply even without a matching opening. He offered Jon a spot on his team. Jon said he wasn’t sure he was qualified.
What happened after the tape
Concrete ML grew up. Four days after the episode aired, on September 6, 2022, Concrete ML v0.3.0 let a model run on a remote machine, with encryption and decryption kept on the client. On April 13, 2023, v1.0.0 brought a stable API, better inference performance, tools to deploy models in the cloud, and support for Apple Silicon. The latest release on GitHub is v1.9.0, from April 2025 (GitHub).
Benoit moved up. His LinkedIn shows him as Concrete-ML team lead until April 2023, then VP of privacy-preserving machine learning, over Concrete, Concrete-Python and Concrete-ML. In October 2024 he became VP of product engineering, and in January 2026 SVP of product and engineering operations, a role across all of Zama’s product and engineering teams (LinkedIn).
Two talks. At RSA Conference on April 25, 2023, Benoit and Jordan Frery presented “Machine Learning over Encrypted Data with Fully Homomorphic Encryption,” on a library that lets data scientists use tools they already know (RSAC). On June 5, 2023, Zama posted their talk at Stanford’s security seminar (YouTube).
Money for the long road. On March 7, 2024, Zama announced a $73 million Series A led by Multicoin Capital and Protocol Labs (SecurityWeek). On June 25, 2025, tech.eu reported a $57 million Series B co-led by Blockchange Ventures and Pantera Capital, at a valuation above a billion dollars (tech.eu).
A second visit. Benoit came back on episode 44, in May 2024, as VP of privacy-preserving cloud and machine learning. He talked about Hugging Face demos, models ready for production, and large language models.
More on this site. On episode 39, Steve Orrin of Intel described homomorphic encryption as an absolute dog on performance. On episode 70, it came up as right around the corner. And on episode 75, Jonathan Mortensen of Confident Security described a provably private AI inference service, where the provider can’t see the data.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Jon and Benoit work on together at Apple?
b. They spent about five years on the same DRM team. See Two engineers from the same team.
-
What made the jump to Zama less risky for Benoit?
a. "it was less risky to me to jump to Zama" Transcript, 15:24.
-
In Benoit's DNA test, what does the lab learn about your result?
c. "they don't know if you have the disease." Transcript, 13:58.
-
How many bits did machine learning on encrypted data run on at Zama in 2022?
a. Eight bits, like computers 40 years earlier. See Eight bits, like forty years ago.
-
What does Zama never trade away?
b. Zama keeps at least 128 bits of security, and trades speed and memory. See Security is never traded.
-
Which kind of quantization did Benoit call even more fascinating?
c. The training knows the model will be quantized. See What eight bits means for a model.
-
Who did Benoit say Zama's users are?
a. "our users are the developers." Transcript, 32:02.
Is your model ready for encrypted inference?
Eight questions on whether a model fits machine learning on encrypted data today, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Is your model ready for encrypted inference?
Answer for one model you run today. If two answers fit, pick the lower one.
-
How sensitive is the data the model takes in?
- Public or low risk
- Personal data
- Health, genetic, financial or biometric data
Benoit's example was a DNA test. See A DNA test the lab can't read.
-
What kind of model is it?
- A large neural network
- A small neural network
- A linear model or a tree model
How close the encrypted model gets depends on the model. See What eight bits means for a model.
-
How long can users wait for a result?
- It has to be real time
- A few seconds
- Minutes or more
A health test can wait an hour. See Results that can wait an hour.
-
Have you tested the model at eight bits?
- Not yet
- Yes, with accuracy we haven't measured
- Yes, with accuracy close to the full model
Quantization-aware training trains for the eight bits. See What eight bits means for a model.
-
Can the user's device hold a key and encrypt the input?
- We don't control a client
- A web client only
- An app or SDK on the device
The key stays with the user. See Your key stays with you.
-
Where does the model run today?
- On every user's device
- Partly on devices, partly on servers
- On servers you update in one place
Updating a model on billions of devices is hard. See On the device or on a server.
-
Has your team built a prototype with an open source FHE library?
- No
- We've read the documentation
- Yes, a working prototype
Start on GitHub and file what breaks. See Try it, star it, file the bug.
-
Do you know the license terms for shipping it?
- No
- We know a commercial license is needed
- Reviewed and budgeted
Free to try is not free to ship. See Free to try, a license to ship.
This model isn't a good first candidate. Pick one with sensitive inputs, a simpler model and users who can wait.
The fit is there in parts. Quantize a copy, measure the accuracy, and build a small prototype before you plan a launch.
Sensitive data, a model that holds up at eight bits, and users who can wait. Plan the keys, the latency and the license.
What does eight bits do to a model?
Benoit described going from 64 bits to eight-bit integers, eight times smaller. This calculator shows what that does to your model.
Calculator
What does eight bits do to a model?
Two numbers: how many millions of weights your model has, and how many bits each weight gets after quantization.
At 8 bits, 10.0 million weights take 10.0 MB, down from 80.0 MB as 64-bit numbers, 8.0 times smaller. Each weight can take one of 256 values.
The calculator counts the weights alone, at eight bytes each as 64-bit numbers, and rounds the bits to a whole number. It doesn't count encryption. The 10 million weights is a placeholder: put in your own model's count.
The road to machine learning on encrypted data
The math behind FHE, Benoit’s roles, Concrete ML’s releases, Zama, and this show. Filter by topic.
Timeline
The road to machine learning on encrypted data
- The question
Within a year of RSA, cryptographers ask for a fully homomorphic scheme (Wikipedia, on this page).
- The Paillier cryptosystem
A public key scheme named after Zama's future CTO (Wikipedia).
- Gemplus
Public key cryptography on smart cards, and protections against side-channel and fault attacks (LinkedIn).
- ANSSI
Cryptologist, on Shabal, a hash function submitted to NIST's competition (LinkedIn).
- Apple
The DRM technology team and the crypto team, on white-box cryptography and obfuscation (LinkedIn, on this page).
- Gentry's scheme
The first plausible construction of fully homomorphic encryption (Wikipedia, on this page).
- FHEW
Bootstrapping in a fraction of a second (Wikipedia).
- TFHE
The scheme that Zama's libraries extend (Wikipedia).
- Zama
Employee number seven, as compiler team lead (LinkedIn).
- Concrete Numpy
Team lead, and the launch of version 0.2 (LinkedIn).
- Concrete ML team lead
Open source machine learning on encrypted data (LinkedIn).
- Concrete ML v0.1.0
The first release, published from Benoit's GitHub account (GitHub).
- Episode 20
Benoit on the show, and his Concrete ML talk on YouTube (Podbean, transcript).
- Concrete ML v0.3.0
Models run on a remote machine, with encryption and decryption on the client (GitHub).
- Concrete ML v1.0.0
A stable API and tools to deploy in the cloud (GitHub).
- RSA Conference
Benoit and Jordan Frery on machine learning over encrypted data (RSAC).
- VP of privacy-preserving machine learning
Over Concrete, Concrete-Python and Concrete-ML (LinkedIn).
- Stanford
The security seminar talk goes up on YouTube (YouTube, on this page).
- A $73 million Series A
Led by Multicoin Capital and Protocol Labs (SecurityWeek).
- Episode 39
Steve Orrin of Intel on data in use (episode page).
- Episode 44
Benoit's second visit (episode page).
- VP of product engineering
Over the division where Zama's user products are designed and built (LinkedIn).
- Concrete ML v1.9.0
The latest release on GitHub (GitHub).
- Episode 70
Abhi Sharma of Relyance AI on trusting AI (episode page).
- A $57 million Series B
At a valuation above a billion dollars (tech.eu).
- Episode 75
Jonathan Mortensen on private AI inference (episode page).
- SVP of product and engineering operations
A role across all of Zama's product and engineering teams (LinkedIn).
What to do this week
Five things, in the order of the episode.
- Find where models read clear data. List each place a model reads personal data unencrypted, starting with health, genetic and financial data, as in A DNA test the lab can’t read.
- Test one model at eight bits. Quantize a copy and measure its accuracy against the full model, as in What eight bits means for a model. The calculator shows the size side.
- Start where users can wait. Pick a workload that doesn’t need an answer in real time, as in Results that can wait an hour.
- Prototype first, then read the license. Try the open source tools, file what breaks, and check the commercial terms before you ship, as in Free to try, a license to ship.
- Get help with it. Our Product Security team designs privacy into features like these, Training Data PII & Secret Scrubbing finds and removes personal information in the data you train on, and AI & HIPAA covers health data in AI products. Anti-Reverse Engineering protects the keys and models you ship to devices. If you want to talk it through, book 15 minutes with us.