Episode 44 of The Security Podcast of Silicon Valley aired on May 20, 2024, with Jon McLachlan hosting. The guest was Benoit Chevallier-Mames, then VP of Privacy Preserving Cloud and Machine Learning at Zama (Podbean, LinkedIn). The episode is called “Benoit Chevallier-Mames, VP Privacy Preserving Cloud and ML at Zama, Unlocking the Potential of Privacy with Fully Homomorphic Encryption.” It was his second time on the show.
Jon asked why anyone should care about fully homomorphic encryption. Benoit’s answer was a company that keeps your data encrypted on its servers the whole time, so that
“even if there is some security breach, nothing can really leak.”
Benoit Chevallier-Mames, at 8:07
Fully homomorphic encryption, or FHE, lets a server compute on data it can’t read. Wikipedia describes homomorphic encryption as a form of encryption that “allows computations to be performed on encrypted data without first having to decrypt it.” The results stay encrypted, and once decrypted they match what the same operations would give on the unencrypted data (Wikipedia). Zama, in Benoit’s words, is a French startup that makes open source tools for developers to build FHE into their applications. The rest of this page sticks to what Benoit and Jon said on the tape, with the sources beside it, and what happened after it.
This page follows the conversation in order: a section for each part of it, seventeen figures, sixteen clips from the tape, the full transcript, and five tools: a quiz, a scorecard for where your sensitive data gets decrypted, a calculator for how much faster encrypted computation needs to get, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words. Every pass of the recognizer hears Benoit’s “FHE” as other letters, so the transcript writes FHE, and the page quotes none of those lines.
A second visit
Jon welcomed Benoit back, and Benoit picked up where the two of them had left off.
“We already had one episode, like one year and a half ago”
Benoit Chevallier-Mames, at 0:22
That first visit was episode 20, published September 2, 2022, as “Benoit Chevallier-Mames, Team Lead of Machine Learning at Zama, On Open Source Homomorphic Encryption.” The show notes for episode 44 call him the show’s first returning guest, and the episode list on this site agrees: nobody before him had been on twice.
By this episode his title was VP of Privacy Preserving Cloud and Machine Learning. His LinkedIn lists the role as VP Privacy-Preserving Machine Learning from May 2023, “formerly VP Privacy-Preserving Cloud and ML” (LinkedIn).
Open source tools for developers
Jon handed Benoit the pitch. Zama is a French startup, Benoit said, that works on fully homomorphic encryption.
“the idea is that we make open source tools for developers”
Benoit Chevallier-Mames, at 1:12
The tools help developers build FHE into their applications and add privacy to them. One of them, Concrete ML, describes itself on GitHub as a privacy-preserving machine learning “open-source set of tools built on top of Concrete by Zama” (GitHub).
Jon said why it matters to him. All of this data is being uploaded into models, and once it’s up there, nothing protects it. FHE would let you upload it encrypted, run inference on it, and maybe train on it, all while it stays encrypted.
Never in the clear
Benoit gave the history in a few lines. For a long time, he said, FHE was a dream and an impossible tool to build. It was made possible ten or fifteen years ago, and now it’s being made practical.
The problem was first proposed in 1978, within a year of the RSA scheme, and for more than 30 years it was unclear whether a solution existed. Craig Gentry described the first plausible construction of a fully homomorphic scheme in 2009 (Wikipedia). His dissertation that year, “A Fully Homomorphic Encryption Scheme,” won the ACM Doctoral Dissertation Award (Wikipedia).
With FHE, Benoit said, you can run a computation on a company’s server without trusting the company. The server works on the encrypted data and never holds the key.
“but never they will have the private key, so never they will see this data in the clear.”
Benoit Chevallier-Mames, at 2:25
Jon said that was music to his ears, from a security perspective, a consumer perspective and an investor perspective. On episode 39, Steve Orrin of Intel described three states of data: disk encryption protects data at rest, TLS protects data in transit, and data in use is the third. FHE keeps that third state encrypted too.
Keys inside the program
Jon and Benoit go back to Apple. Jon said they worked together for five or six years, with Benoit on the cryptography team under iTunes and Jon on the compiler team.
“I was on the obfuscating compiler team.”
Jon McLachlan, at 3:01
Jon’s team took Benoit’s work and ran it through a compiler. Benoit described the job without revealing secrets. People were trying to break the DRM, digital rights management, and the goal was to protect private keys that sat inside the program, with what he called crazy implementations and with what Jon’s team built.
FairPlay is Apple’s family of DRM technologies, and its first version protected music on the iTunes Store (Wikipedia). White-box cryptography works in the most extreme attack model, where the attacker has full, unrestricted access to the cryptographic implementation (Wikipedia). Obfuscation makes code intentionally difficult for humans or computers to understand, among other reasons to prevent tampering (Wikipedia).
Jon remembered iTunes as the place to get your music, movies and books, delivered encrypted to iPhones, Apple TVs and tablets.
“And we were the team that helped decrypt that so that everyone could enjoy their stuff that they bought.”
Jon McLachlan, at 4:08
Jon told his side of the same story on episode 39, where he described a cryptographer at Apple who later joined Zama.
Eight or nine, then 80
Jon said Benoit stayed at Apple a lot longer than he did. His RSA Conference speaker page says he designed and developed white-box implementations at Apple for 12 years, after seven years at Gemplus and one at ANSSI, the French government’s cybersecurity agency (RSAC). His LinkedIn dates Apple from November 2008 to April 2020 (LinkedIn).
Then a startup came along that was just starting. Benoit knew its CTO, Pascal Paillier, as a famous cryptographer, and he knew he had to try a startup at some point. He took the risk.
“I don’t regret it at all.”
Benoit Chevallier-Mames, at 4:56
Paillier invented the Paillier cryptosystem in 1999, a probabilistic asymmetric algorithm for public key cryptography (Wikipedia).
“It is a very funny experience to see the startup from almost the beginning.”
Benoit Chevallier-Mames, at 4:58
His LinkedIn says he started as employee number seven, as compiler team lead, in April 2020. On the tape he counted the company then and now:
“when I joined, we were like eight or nine. And today, I told you, we are like 80.”
Benoit Chevallier-Mames, at 5:06
TechCrunch put Zama at 75 people in March 2024 (TechCrunch).
Seventy million
Zama had signed customers and was starting to make money, Benoit said. Jon called it a huge success for any startup. Then Benoit got to the funding.
“And we have had a lot of money from investors, so 70 million, which is a lot”
Benoit Chevallier-Mames, at 5:23
He took it as a sign that investors see a large business opportunity in FHE. Jon asked him to say the number again. Benoit said rounds are smaller in France.
“Usually the money that you get from investors is much smaller.”
Benoit Chevallier-Mames, at 5:49
On March 7, 2024, TechCrunch reported a $73 million Series A co-led by Multicoin Capital and Protocol Labs, for $81 million raised in total. Unnamed sources put the valuation near $400 million, and chief executive Rand Hindi declined to give a figure. Hindi said Zama had signed more than $50 million in contract value, and TechCrunch wrote that its customers so far came mostly from blockchain (TechCrunch).
Time to build the right products
Money isn’t the goal, Benoit said. It buys time:
“we have the time to build the right products.”
Benoit Chevallier-Mames, at 6:15
Zama keeps its products open source, free for researchers and students, and for companies building a prototype.
“make them open source so that anyone can try them and see if it fits”
Benoit Chevallier-Mames, at 6:19
The money also lets Zama wait for hardware accelerators, which take longer: GPUs, FPGAs and ASICs, from small companies and from large ones like Intel. An FPGA is an integrated circuit that can be programmed again after manufacturing (Wikipedia). An ASIC is a chip customized for one use (Wikipedia). The accelerators matter
“because speed is one of the current challenges”
Benoit Chevallier-Mames, at 6:58
On episode 39, which aired in March 2024, Steve Orrin of Intel said homomorphic encryption was slow on performance, with hardware accelerators and software optimizations coming.
Why should we care
Jon asked the basic question.
“What is fully homomorphic encryption, and why do people, especially in AI, why should we care?”
Jon McLachlan, at 7:14
AI does a lot for us, Benoit said, in health among other fields.
“AI is taking some data which are very personal to you.”
Benoit Chevallier-Mames, at 7:29
His example was a DNA test. He pointed to the 23andMe story and said records of DNA are everywhere now. Wikipedia says that on October 6, 2023, 23andMe confirmed that hackers had accessed data on approximately 6.9 million users (Wikipedia).
With FHE, Benoit said, a company can provide the same kind of services over encrypted data.
“On the servers of this company, things will always be encrypted.”
Benoit Chevallier-Mames, at 7:59
A breach of those servers then leaks nothing readable, the line at the top of this page.
Discriminated against
Jon added what else is at play. Some companies would love to get their hands on your DNA data, he said, and charge you more for markers of disease.
“You could be discriminated against, right?”
Jon McLachlan, at 8:41
Law enforcement processing a crime scene might skip asking you.
“could they just subpoena a company that contains your DNA data with high probability and look for it?”
Jon McLachlan, at 8:54
No trust needed
Benoit said FHE would also help the market grow. As a security person, he doesn’t send his DNA anywhere he doesn’t know.
“I would not send my DNA to some companies that I don’t know.”
Benoit Chevallier-Mames, at 9:18
If he knew the data he sent was encrypted, that would change.
“I don’t need to really trust them.”
Benoit Chevallier-Mames, at 9:28
“So maybe I’m going to pay for something that today I don’t want to pay.”
Benoit Chevallier-Mames, at 9:30
Banks that can’t share
FHE also lets companies work together, Benoit said. Banks hold information on different customers, and for legal or competitive reasons
“they would not want to share their data.”
Benoit Chevallier-Mames, at 9:56
With FHE, he said,
“they can encrypt their individual data, they can make a computation together, and at the end just agree to decrypt the results.”
Benoit Chevallier-Mames, at 10:02
His example was anti-money laundering, checking whether Jon had too much money. Jon said he wished. Wikipedia calls the general field secure multi-party computation, methods for parties to “jointly compute a function over their inputs while keeping those inputs private” (Wikipedia). Most countries run some anti-money-laundering measures (Wikipedia).
A catch-22
Jon brought it back to compliance: SOC 2, GDPR, CCPA. To get a SOC 2 certification you show that you protect customer data, so sensitive data has to stay encrypted, and to work on it you have to decrypt it.
“It sort of represents a catch-22, even for modern-day certifications.”
Jon McLachlan, at 11:08
A catch-22 is a paradoxical situation you can’t escape because of contradictory rules, a term from Joseph Heller’s 1961 novel (Wikipedia). GDPR is the European Union’s regulation on information privacy (Wikipedia). CCPA is a California statute, signed on June 28, 2018 (Wikipedia).
Jon could see FHE opening new business and raising security maturity across the industry, because AI is going to end up everywhere.
Demos on Hugging Face
Benoit said Zama went to Hugging Face, a company he admires, to show what FHE looks like in practice for machine learning. Hugging Face’s platform lets people share machine learning models and datasets (Wikipedia). Zama had four demos running there, he said.
“So, for example, you can apply a filter on an encrypted image.”
Benoit Chevallier-Mames, at 12:10
Another one classified the disease you have. As of November 2026, Zama’s page on Hugging Face lists six of them, all on encrypted data: image filtering, sentiment analysis, health prediction, which predicts diseases from symptoms, anonymization, credit card approval and ancestry DNA testing (Hugging Face). The last one is the DNA example from earlier in the conversation, as a demo you can run.
“And it’s really a nice way to show to people, and especially to our future customers”
Benoit Chevallier-Mames, at 12:23
Jon promised the links in the episode description.
From cryptographers to data scientists
Jon asked about the challenges. Benoit wanted to start with the ones Zama had solved.
“So more or less, you had to be a specialist, like a cryptographer. You had to write things in C or very complicated stuff.”
Benoit Chevallier-Mames, at 13:06
Zama set out to make FHE simple enough to use from Python.
“You can be a data scientist without really knowing what cryptography is about, and still you can make it.”
Benoit Chevallier-Mames, at 13:28
He compared it to the way they made things simple at Apple. The Concrete ML README makes the same promise: data scientists use models with APIs close to the frameworks they know, and the model classes are similar to those in scikit-learn (GitHub). Benoit gave the same argument at RSA Conference on April 25, 2023, with Zama research scientist Jordan Frery. Their abstract says the gap for data scientists only appears huge, and presents an open source library that lets them build models with tools they already know (RSAC).
Ready for production
The remaining challenge is speed, Benoit said. Machine learning with scikit-learn models already works: linear models and tree-based models can already go to production. scikit-learn is a free and open-source machine learning library for Python (Wikipedia).
Jon stopped him there.
“You said a magic word for everybody. You said it could go into production.”
Jon McLachlan, at 14:14
Benoit said he was serious. Jon called it a cornerstone, a sign that the technology had matured. Benoit added that the Hugging Face demos are live, on servers that aren’t specialized for FHE.
Millions of neurons
Deep learning is where it gets slow.
“where you have millions of neurons, that things are a bit complicated.”
Benoit Chevallier-Mames, at 14:50
Too slow for production, he said, and far from real time. So Zama waits for hardware, and works with hardware companies on the accelerators they’re building. Jon asked about GPUs and ASICs. Benoit said he isn’t a specialist, and that Zama works with outside companies to integrate their future accelerators.
“And we expect like 10x, 100x, or even more”
Benoit Chevallier-Mames, at 15:45
“Do you think that those improvements will help make the more complex models production viable?”
Jon McLachlan, at 15:55
Yes, Benoit said. He expected the first generation of this hardware by 2025 or 2026, with several generations after it. The calculator below runs that arithmetic on your own model.
Large language models in FHE
His example was large language models. Zama planned to describe its experiments with LLMs in FHE at RSA Conference in May.
“And we will say that we have been able to show that it’s doable.”
Benoit Chevallier-Mames, at 16:31
“I mean, in terms of accuracy, it works. It’s just too slow.”
Benoit Chevallier-Mames, at 16:36
The first generation of accelerators won’t be enough, he said.
“So what we expect is that certainly not with the first, but second or third generation of hardware accelerators”
Benoit Chevallier-Mames, at 16:40
At that point, he said, you would send your queries to the model encrypted.
RSAC’s library lists the talk on May 6, 2024, two weeks before this episode aired, as “IP Protection and Privacy in LLM: Leveraging Fully Homomorphic Encryption.” Its abstract describes a dilemma between protecting the model owner’s assets and the user’s data privacy, a hybrid method that uses FHE to address both, and a live demonstration (RSAC).
Zama researchers had shown a first step on Hugging Face’s blog on August 2, 2023. They ran one attention head of GPT2 on encrypted data, and 4-bit quantization kept 96% of the original accuracy. Their goal was to protect both the privacy of the user and the intellectual property of the model (Hugging Face). Episode 75 covers another way to keep prompts private, Confident Security’s provably private AI inference.
The third time in a row
Jon joked that RSA is a small security conference. It’s the largest security conference in the world, he added. Benoit had spoken there before.
“So I’ve been there as a speaker in 2022, 2023”
Benoit Chevallier-Mames, at 17:24
This would be the third time in a row. His speaker page lists three sessions: a moderated discussion of public key cryptography papers in 2022, among them one on approximate homomorphic encryption, “Machine Learning over Encrypted Data with Fully Homomorphic Encryption” in 2023, and the LLM talk in 2024 (RSAC).
“but also the company was in the startup contest.”
Benoit Chevallier-Mames, at 17:41
That contest is the RSAC Innovation Sandbox. The ten finalists for April 24, 2023 included Zama, “a cryptography company building open source homomorphic encryption tools for developers,” and Relyance AI, the company Abhi Sharma runs on episode 70 (RSAC).
Benoit also gave a talk at Stanford, he said, in the department where practical FHE was invented. Jon joined on Zoom. Craig Gentry earned his PhD at Stanford, with Dan Boneh as his advisor (Wikipedia).
A paper and a product
Jon called it history unfolding. Benoit gave the researchers credit and drew the line between their work and Zama’s.
“it’s one thing to make a paper, and, I mean, obviously a lot of respect to them, but one thing to make the paper, and it’s another thing to make a product”
Benoit Chevallier-Mames, at 18:34
A product means supporting users, building a company, finding customers and making a market, he said. Jon said he always knew Benoit would do great things, from their time at Apple.
“you took the things that were theory, and you turned them into actual code and products that worked and worked well, and it stopped the attacks inside iTunes.”
Jon McLachlan, at 19:00
Benoit said what he kept from Apple was simplicity.
“to make things simple, to make things that work, that are natural.”
Benoit Chevallier-Mames, at 19:27
“I mean, it’s embedded in me today.”
Benoit Chevallier-Mames, at 19:33
His proudest result, he said, is that data scientists can use a technology that’s complicated under the hood almost easily.
Two divisions
Jon asked how many paying customers Zama had.
“So I will not be able to say things which are not public. So, still, we have learned to keep a secret.”
Benoit Chevallier-Mames, at 20:02
What he could say: Zama had two divisions. One is machine learning, where Benoit was VP. The other is blockchain, which makes fhEVM for smart contracts,
“but where some of the data in the blockchain can be encrypted.”
Benoit Chevallier-Mames, at 20:32
Most of the customers so far were on the blockchain side.
“So you will see in the news that we have signed a few contracts with some blockchains”
Benoit Chevallier-Mames, at 20:45
Jon asked which blockchains, and Benoit pointed him to the news. A smart contract is a program meant to execute and document events according to the terms of an agreement (Wikipedia). TechCrunch saw the same split in March 2024: customers mostly from blockchain, with machine learning the larger market over time, in Hindi’s view (TechCrunch).
Start on GitHub
Jon played a curious data scientist. Benoit’s advice: start on Zama’s GitHub, see how it works, and reproduce what’s there first.
“maybe they will start by reproducing some of the examples that we have, and then after that they can build their own examples.”
Benoit Chevallier-Mames, at 22:02
“So maybe start with the machine learning. Don’t go for LLMs for now. It’s going to be too long.”
Benoit Chevallier-Mames, at 22:17
Zama runs a Discord where people can ask questions and get help with bugs, he said. The machine learning library is Concrete ML on GitHub.
Fun and money
Then Benoit got to a program he wanted to talk about,
“which is our bounty and grant program.”
Benoit Chevallier-Mames, at 22:45
Every quarter Zama ran a competition. People built applications with Zama’s products,
“and we have a jury, and we decide who is the winner.”
Benoit Chevallier-Mames, at 23:09
The machine learning competition the quarter before was music recognition. Zama’s bounty repository on GitHub lists it in Season 4 as “Create a privacy preserving version of Shazam,” opened on September 28, 2023, with a deadline of December 17, 2023. Shazam users send queries to Shazam’s servers, the issue explains, so Shazam can learn their private preferences, and the challenge was to build music recognition with FHE (GitHub). Benoit put the prize at ten thousand dollars or something like that, and said to check the numbers. The issue lists up to €10,000 for the best submission, €3,500 for the second and €1,500 for the third.
There’s also a grant program, for anyone who wants to build a company on Concrete ML, Concrete or another Zama product.
“They can say, I’m going to build this health company with privacy first.”
Benoit Chevallier-Mames, at 23:44
If accepted, they get money to get started. It’s a grant for now, Benoit said, and that could change. Jon called it music to founders’ ears, because a grant doesn’t dilute ownership. Benoit added the condition.
“but I think the condition is also to make your application open source. So you have to show how you use the products.”
Benoit Chevallier-Mames, at 24:42
Jon summed up the idea.
“We are a community, and we are trying to bootstrap this and stand on each other’s shoulders”
Jon McLachlan, at 24:58
Free until you make money
Jon listed the business models he has seen behind open source: sell a hosted service, or sell support for on-premises deployments. Benoit added Zama’s, the license. Zama’s products are open source for research, and
“free for researchers, for students, or for companies when they want to prototype things.”
Benoit Chevallier-Mames, at 25:43
“But when someone starts to make money with our product”
Benoit Chevallier-Mames, at 25:48
the company switches to a business license, and
“we are going to charge them depending on the use they make”
Benoit Chevallier-Mames, at 26:00
A company with as many users as Google pays more than a small one. The Concrete ML README puts it in license terms: BSD-3-Clause-Clear “only for development, research, prototyping, and experimentation purposes,” and Zama’s commercial patent license for any commercial use (GitHub).
Billions of users
Jon asked Benoit to compare Apple and Zama.
“No, I would not say that one is better than another.”
Benoit Chevallier-Mames, at 26:45
People often have a bad image of big companies, he said, and you can be happy there and work on interesting things, as the two of them did.
“In Apple, what was great is that we were able to have billions of users. So what we did was used by billions of users.”
Benoit Chevallier-Mames, at 27:10
At Zama, which is open source and open to the outside,
“the great thing is that you can discuss with other companies, you can build with other companies.”
Benoit Chevallier-Mames, at 27:30
“I started as an individual contributor, and then I built a few teams, with an S.”
Benoit Chevallier-Mames, at 27:47
Now he’s responsible for divisions and helps find customers, which he couldn’t have done at Apple, where everyone is specialized.
“Remember, at Apple, there was one guy responsible for the plastic for the watch charger, something like that.”
Benoit Chevallier-Mames, at 28:14
Less is more
Jon said a startup with a strong focus still lets you go deep. Benoit said what he loved at Apple was the attention to details, like that specialist of the plastic.
“he was really obsessed by it, and he would make the best plastic in the world for this case.”
Benoit Chevallier-Mames, at 28:47
The goal was that opening an iPhone would be an amazing experience.
“And I really appreciate people that go through that experience and they see the value in simplicity and this idea that less is more.”
Jon McLachlan, at 29:03
For Jon the point is the experience, ahead of the technology and the user interface: the feeling you get when you use it. He brought up the same saying with Avery Pennarun of Tailscale on episode 42. Benoit said it’s something he loves and has copied.
Do something exciting
Jon asked what advice Benoit would give his younger self. Benoit answered a nearby question instead: the advice he gives the young people he meets. It’s about excitement, he said.
“Do something which is exciting”
Benoit Chevallier-Mames, at 30:32
so you find pleasure in your work. There’s room for that:
“machine learning, security, or computer science, it’s really somewhere where there is a lot of jobs and opportunities.”
Benoit Chevallier-Mames, at 30:40
He would also tell a young Benoit to start a company. When he was young, he said, nobody around him started one, and people who did were seen as crazy. Today he sees people try it and fail without minding. He plans to try it himself, with less financial pressure and more experience.
“And I think experience is also very useful there.”
Benoit Chevallier-Mames, at 31:45
Experience means knowing how to take care of the product, the user, testing and good development code, he said.
All about trust
Jon said he looked forward to the company Benoit would start one day. They would decide together, Benoit said. For him, a founding team starts with trust.
“to me it’s really about trust”
Benoit Chevallier-Mames, at 32:24
“So when I’m listing the few people who might work with me, I’m listing the people I have worked a long time with”
Benoit Chevallier-Mames, at 32:33
Jon might be one of them, he said. Jon said the feeling was mutual.
“If you don’t have trust, it makes it really difficult to do anything worthwhile.”
Jon McLachlan, at 33:04
Money shows up in transactional relationships, Jon said.
“But if there’s trust as a foundation, you don’t really have to worry about the money and the transactions”
Jon McLachlan, at 33:16
A third episode
“I can’t wait for the third episode of it.”
Benoit Chevallier-Mames, at 33:42
Jon said whenever Benoit wants, and congratulated him again on the customers.
What happened after the tape
These are the items since the episode, in order.
The LLM talk. On May 6, 2024, RSAC’s library posted Benoit’s session “IP Protection and Privacy in LLM: Leveraging Fully Homomorphic Encryption,” the talk he previewed on the tape (RSAC). See Large language models in FHE.
Product engineering. In October 2024, Benoit became VP Product Engineering, over the division that designs and makes Zama’s user products: fhEVM, which his profile calls “our FHE coprocessor for blockchains,” a threshold key management system, Concrete ML, and from April 2025 the SaaS team (LinkedIn).
A Series B. On June 25, 2025, tech.eu reported that Zama raised a $57 million Series B co-led by Blockchange Ventures and Pantera Capital, at a valuation “north of a billion USD,” for more than $150 million raised to date (tech.eu).
A cross-company role. In January 2026, Benoit became SVP Product & Engineering Operations, a “Cross-company role, helping coordinating across all product and engineering teams” (LinkedIn).
Six demos. As of November 2026, Zama’s Hugging Face page lists six demos on encrypted data, up from the four Benoit counted, among them ancestry DNA testing (Hugging Face).
The bounty program. As of November 2026, the bounty repository on GitHub is archived and points to the Zama Developer Program for new bounties. Its list of past winners runs through Season 8 (GitHub).
More on this show. Steve Orrin of Intel explained data in use and why homomorphic encryption is slow today on episode 39. Sasha Sinkevich called homomorphic encryption right around the corner on episode 70. Jonathan Mortensen of Confident Security described an AI inference service whose provider never holds the private keys, on episode 75. Rod Schultz of Bolster AI pointed to homomorphic encryption for secure data operations, and expected the DRM challenges of the 2000s to come back, on episode 62. Kevin Kane of American Binary came back for a second visit on episode 96.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What does Benoit say Zama makes?
a. "the idea is that we make open source tools for developers" Transcript, 1:12.
-
In Benoit's description, what does the server that runs the computation never have?
c. "but never they will have the private key, so never they will see this data in the clear." Transcript, 2:25.
-
How many people did Zama have when Benoit joined, and at the time of the episode?
b. "when I joined, we were like eight or nine. And today, I told you, we are like 80." Transcript, 5:06.
-
What does Jon call the word production?
a. "You said a magic word for everybody. You said it could go into production." Transcript, 14:14.
-
What does Benoit say about large language models in FHE?
b. "I mean, in terms of accuracy, it works. It's just too slow." Transcript, 16:36.
-
What improvement does Benoit expect from the hardware accelerators?
c. "And we expect like 10x, 100x, or even more" Transcript, 15:45.
-
What does Benoit say a founding team is about?
a. "to me it's really about trust" Transcript, 32:24.
Is your data ever in the clear?
Eight questions on where your sensitive data gets decrypted, from the episode. Each tip quotes the tape or paraphrases it, and links its section.
Scorecard · eight questions
Is your data ever in the clear?
Answer for your most sensitive data, like health, genetic or financial records. If two answers fit, pick the lower one.
-
Where is your most sensitive data decrypted to be processed?
- On a vendor's servers
- On our own servers
- Nowhere: it stays encrypted while it's processed
"but never they will have the private key, so never they will see this data in the clear." See Never in the clear.
-
If the server that processes it is breached, what leaks?
- Readable records
- Everything except the fields we encrypt
- Only ciphertext
"even if there is some security breach, nothing can really leak." See Why should we care.
-
Do you know which of your fields are sensitive?
- No
- Roughly
- Yes, mapped and labeled
"AI is taking some data which are very personal to you." See Why should we care.
-
Who holds the keys to that data?
- The vendor
- The vendor and us
- Only us, or only the user
Benoit: with FHE, the company that runs the computation never holds the private key. See Never in the clear.
-
What keeps your AI vendors from reading your prompts and uploads?
- Nothing written down
- A contract
- Cryptography or hardware we can check
"I don't need to really trust them." See No trust needed.
-
Can you compute with a partner's data without either side handing it over?
- No, one side sends raw data
- Through a trusted third party
- Yes, on encrypted data or with secure computation
"they can encrypt their individual data, they can make a computation together, and at the end just agree to decrypt the results." See Banks that can't share.
-
Have you run one of your models on encrypted data?
- No
- We've read about it
- Yes, a prototype
"So maybe start with the machine learning. Don't go for LLMs for now. It's going to be too long." See Start on GitHub.
-
Can you show an auditor how sensitive data stays protected while you work on it?
- No, we decrypt it to work on it
- For some systems
- Yes, documented end to end
"It sort of represents a catch-22, even for modern-day certifications." See A catch-22.
Your sensitive data is readable where it's processed, often at a vendor. Start by mapping the sensitive fields and every place they're decrypted, and move the keys to your side.
Your data is protected in storage and on the wire. Next, pick one workload that decrypts sensitive data to compute on it, and try it on encrypted data or inside hardware you can check.
Your sensitive data stays encrypted, or verifiably protected, while it's used. Keep the keys on your side, document it for auditors, and time each new workload before you promise it to customers.
How much faster does it need to get?
Benoit expects 10x, 100x or more from the hardware. This calculator shows what that means for one of your own runs.
Calculator
How much faster does it need to get?
Three numbers: how long one encrypted run takes today, how long you can wait, and the speedup you expect from new hardware.
At 100x, a 600-second run today would take about 6.0 seconds, 6.0 times the 1.0 seconds you can wait. To hit your target, it needs to get about 600 times faster.
The 100x comes from Benoit's "10x, 100x, or even more" on the tape. The 600 seconds and the 1 second are placeholders: time one encrypted run of your own model, and put in how long your users can wait. A result of 1.0 or less in the last box means the hardware gets you there.
From a 1978 question to a unicorn
The history of the problem, Benoit’s path, Zama’s record, and the episodes on this show that pick up the thread. Filter by topic.
Timeline
From a 1978 question to a unicorn
- The question
Fully homomorphic encryption is first proposed, within a year of the RSA scheme (Wikipedia).
- RSA Conference
Founded as a small cryptography conference (Wikipedia).
- The Paillier cryptosystem
Invented by Pascal Paillier, later Zama's CTO (Wikipedia, on this show).
- Gemplus
Benoit joins the public key team, working on smart cards and protections against side-channel attacks (LinkedIn).
- ANSSI
Cryptologist at the French government agency, co-designing the Shabal hash for NIST's competition (LinkedIn).
- Apple
White-box cryptography and obfuscation on the DRM team (LinkedIn, on this show).
- The first construction
Craig Gentry describes the first plausible fully homomorphic scheme (Wikipedia).
- FHEW
The first scheme to show that refreshing ciphertexts after every operation cuts bootstrapping to a fraction of a second (Wikipedia).
- TFHE
Another efficient variant. Zama's TFHE-rs library implements an extended version of it (Wikipedia).
- GDPR
Regulation (EU) 2016/679, the European Union's regulation on information privacy (Wikipedia, on this show).
- CCPA
California's consumer privacy act is signed (Wikipedia).
- Employee number seven
Benoit joins Zama as compiler team lead (LinkedIn).
- Concrete ML
Benoit leads the team building Concrete ML (LinkedIn).
- First RSAC session
A moderated discussion of public key cryptography papers (RSAC).
- Episode 20
Benoit's first visit to the show (episode 20).
- Innovation Sandbox
Zama is one of ten finalists, with Relyance AI (RSAC, on this show).
- Machine learning over encrypted data
Benoit and Jordan Frery at RSA Conference (RSAC).
- An encrypted attention head
Zama researchers run part of GPT2 on encrypted data (Hugging Face).
- A Shazam bounty
Season 4 asks for privacy preserving music recognition (GitHub, on this show).
- The 23andMe breach
The company confirms access to data on about 6.9 million users (Wikipedia, on this show).
- A $73 million Series A
Co-led by Multicoin Capital and Protocol Labs (TechCrunch, on this show).
- Episode 39
Steve Orrin of Intel on data in use (episode 39).
- LLMs at RSAC
IP protection and privacy in LLMs, with a live demonstration (RSAC, on this show).
- Episode 44
Benoit's second visit, this episode.
- VP Product Engineering
fhEVM, key management, Concrete ML, and later the SaaS team (LinkedIn).
- Episode 70
Homomorphic encryption, right around the corner (episode 70).
- A unicorn
A $57 million Series B at a valuation north of a billion dollars (tech.eu).
- Episode 75
Private AI inference where the provider holds no keys (episode 75).
- SVP
Product and engineering operations across the company (LinkedIn).
- Six demos
Zama's Hugging Face page lists six demos on encrypted data (Hugging Face, on this show).
What to do this week
Five things, in the order of the episode.
- Find where data gets decrypted. List every place your sensitive data is decrypted to be processed: your own servers, your vendors and your AI tools. Take the scorecard with your team. Training Data PII & Secret Scrubbing covers what goes into your models.
- Run one demo. Try the image filtering or health prediction demo on Hugging Face to see encrypted inference from end to end.
- Reproduce one example. Start with a linear or tree-based model in Concrete ML, the way Benoit suggests, before anything deep.
- Time it. Put your encrypted run time into the calculator to see how far hardware has to go for your workload.
- Escape a catch-22. Write down how sensitive data stays protected while it’s in use, for your SOC 2 Type 2 auditor. If you want a second pair of eyes, book 15 minutes with us.