Fully Homomorphic Encryption and the Right to Think

Start with a question its author needs to keep private

Imagine a researcher, Lin, investigating a finding that challenges her industry’s accepted view. She wants help finding weaknesses in her argument. Her draft is unfinished, and she is not ready to let her employer, a platform operator, or a government see which questions she is exploring.

“Here is my unpublished idea and the evidence behind it. Where might I be wrong?”

In a conventional cloud AI service, the provider’s server processes a readable version of that request. A promise not to retain or misuse it is a policy about access to information the service can already process.

Our proposed use of Fully Homomorphic Encryption changes what the server receives. Lin’s device encrypts the request. A compatible AI computation runs on encrypted values. An encrypted answer comes back, and Lin’s device uses her key to make it readable. Operating the computer need not give the provider a readable copy of the conversation.

That is the AI safety connection: the service has less information it could use to profile Lin, pressure her, or identify a challenging idea before she chooses to share it. Privacy protects the process of thinking, including the time an idea needs to become coherent.

Follow the question, the calculation, and the key

Fully Homomorphic Encryption permits calculations on encrypted data while keeping the results encrypted. Gentry’s work established its general feasibility.^[1] For Lin’s example, the roles would look like this:

In a simple arithmetic example, Lin could encrypt the number 7, ask the server to add 5, and decrypt 12. The server can carry out the addition without reading 7 or 12. A language model is a much larger computation, with more demanding performance and accuracy requirements, but the separation between computation and readable data is the same idea.

The model still computes an answer that depends on Lin’s question. The confidentiality promise concerns who can read the data. It rests on the chosen cryptographic scheme, secure parameters, a correctly implemented protocol, and protection of Lin’s device and key.^[2]

Why the unfinished idea matters

Suppose Lin later publishes her findings. At that point, she chooses to make them public and defend them. Before that point, a powerful observer could act on half-formed questions, mistaken drafts, or an abandoned line of inquiry. Those are different kinds of exposure.

Our concern is that a small number of AI operators could become the place where people do much of their private thinking. If those operators can observe the whole process, their power extends beyond deciding what to publish. They can learn which alternatives people are trying to imagine.

Fully Homomorphic Encryption offers a way to put a limit on that informational power even when the most capable computers remain centralized. Lin could rent computation without automatically handing the operator the contents of her inquiry.

This is why we want privacy built into the service design. It should remain useful when ownership, leadership, or political conditions change. The protection of a new idea should not depend entirely on the current operator’s goodwill.

Now let three organizations ask a question together

Extend the example. Three independent laboratories want AI to compare their unpublished findings. Each has data the others need, but none wants to give all its raw notes to one cloud company—or to a single lead laboratory.

Our proposed design would use a suitable multiparty encryption protocol: the laboratories prepare inputs for a shared computation, the cloud processes them in encrypted form, and the agreed participants jointly authorize release of the result. Published multiparty homomorphic encryption research provides relevant methods for collective keys and distributed decryption.^[3]

A concrete first rule might be: all three laboratories must cooperate to release the joint comparison. Simply encrypting three files with unrelated keys would not establish that rule; the joint protocol and key setup must be designed for it.

The output also needs an agreement. “Compare our findings” might be acceptable, while “reproduce Laboratory A’s entire notebook” would defeat the purpose. The participants should decide what a result may reveal before the cloud computes it.

The new possibility is shared access without a single reader of everything. Local models and private servers remain useful options. Encrypted cloud collaboration adds another: groups can use shared computing resources while distributing authority over their information.

Make privacy ordinary, and test what remains visible

Suppose Lin uses ordinary requests for routine questions and switches to a special encrypted mode only for her controversial work. The provider may not read that work, but the switch itself says that something is sensitive. Our proposal is to make encryption the normal route for ordinary and sensitive conversations alike.

That removes one signal. Other signals need their own treatment. The service may still observe Lin’s account, when she connects, the size of a document, or the number of requested output tokens. A recognizable request pattern can reveal something without revealing the words.

The same distinction answers the question about watching “which neurons activate.” If the internal values are securely encrypted and the execution pattern is fixed, the operator sees encrypted values being processed, not a readable picture of the model’s thoughts. If the implementation exposes which expert was selected, which memory was accessed, or when it stopped, those visible choices may leak information.

We would test this explicitly: choose two categories of private questions, keep the allowed public details matched, and ask an evaluator to distinguish them using only what the server can observe. Reliable success above chance would identify possible leakage to investigate. Such experiments complement the cryptographic analysis; their purpose is to test the whole service around the encryption.

Where post-quantum security fits into Lin’s journey

Lin’s question crosses two places where protection matters. It travels from her device to the service, and it is then used in a calculation. Post-quantum key establishment helps protect communication against future quantum attackers. Fully Homomorphic Encryption protects supported computation while the inputs stay encrypted.

There is a real mathematical connection: NIST’s ML-KEM uses a lattice-based construction, and Learning with Errors—a problem involving noisy mathematical relationships—also supports constructions of Fully Homomorphic Encryption.^[4][5] These are different protocols with different keys and purposes.

For Bay Area Secure, that connection creates a practical extension of our PQC work. An organization planning to protect information for many years should also decide who can read it when an AI service uses it. Our security plan brings communication, computation, key control, and result access into the same discussion.

Give an auditor private questions and independent evidence

Lin’s example can also be an evaluation request. An auditor may want to test a model without letting the provider read every test question in advance.

We propose going further: an independent recorder would capture selected internal calculations during the encrypted run and return encrypted records to the authorized auditor. The auditor could then examine those measurements alongside the answer.

This assigns two clear jobs. Fully Homomorphic Encryption protects the contents of questions and records. Independent capture and verification establish where the records came from. The audit essay follows a model that changes behavior when it encounters an audit cue, showing why each job matters.

Privacy protects association, including association we oppose

The three-laboratory arrangement could also be used by people planning harm. A private group working with capable AI may be harder for an outside observer to understand. That consequence belongs in the argument for encrypted collaboration.

Our position is that the right to private inquiry should survive disagreement with the inquiry. At the same time, access to money, infrastructure, tools, and consequential external actions should have explicit permissions and accountability. A private conversation and permission to act on the world are separate decisions.

For example, a group may privately analyze a proposal while a shared system still requires independent approval before changing equipment or releasing funds. Research should examine both the protection of thought and the controls around action, including how those controls could themselves be abused.

Turn the possibility into a usable conversation

A useful next experiment would give Lin the same research task through an ordinary model and an encrypted version, then compare answer quality, response time, memory, bandwidth, and the information visible to the operator. It should measure a complete interaction, including output generation and key handling.

EncryptedLLM reports a GPU-accelerated encrypted GPT-2 forward pass. It is a concrete result on part of this path.^[6] Our research goal is to find which useful conversations can be supported at an acceptable cost and to publish that cost alongside the privacy conditions.

The existence of Fully Homomorphic Encryption makes progress possible through specific mathematical and engineering work. AI may help improve implementations, approximations, and cryptographic analysis. We would judge that help by measured improvements at a stated security level.

The purpose remains Lin’s original question: can she use powerful intelligence to develop an idea while keeping the decision to disclose it in her own hands?