Encrypted computation lets people perform operations on data without seeing the underlying values.
2
The right privacy technique depends on whether the data, the model, or both need protection.
3
Encrypted machine learning is becoming more practical, but teams still need cryptography knowledge, suitable tools, and regulation that permits its use.
Summary
Théo Ryffel explains how encrypted computation can support machine learning when data or models cannot be exposed. He uses secure multiparty computation to show how parties can split a secret into random shares, operate on those shares, and reconstruct only an agreed result. The choice of technique depends on the use case. A service may run an encrypted prediction on a customer's data with its own unencrypted model, while other situations require both model and data protection. Théo compares encrypted machine learning with federated learning and differential privacy, and describes their different guarantees and levels of adoption. He is clear that encrypted workflows remain slower and require careful security decisions, although the performance gap has narrowed. The discussion also covers healthcare, financial services, Open-Mined, and the difficulty of turning research into usable tools. Théo argues that production examples, regulation, education, and open-source communities will determine how widely these methods are used.
Encrypted computation reveals only the result of an operation
Théo defines encrypted computation as operating on protected values without first exposing them. His salary example has several people encrypt their salaries, compute the mean inside an encrypted space, and decrypt only the average. The same principle can support model evaluation and neural-network training. He describes this as the step from simple encrypted operations to encrypted machine learning, where model parameters can also be treated as protected values.
Secret sharing lets parties compute without holding the whole secret
In Théo's secure multiparty computation example, a secret number is split into two random shares. Alice receives one share and Bob receives the other, so neither can reconstruct the original number alone. They can still perform local operations on their shares. Doubling or adding the shares produces the corresponding operation on the secret when the result is reconstructed. Addition, multiplication, and private comparison provide the building blocks for evaluating a neural network.
The sensitive part of a use case determines what gets encrypted
Théo says teams can encrypt the data, the model, or both. If a service owns a sensitive model and receives sensitive data, encrypted data can be sent to the service while the service keeps its model in plaintext. In secure multiparty computation, the model may also need to be secret-shared because exposing it would defeat the purpose. The choice depends on who owns the data, who owns the model, and what each party is willing to disclose.
Privacy techniques have different guarantees and maturity
Théo compares encrypted machine learning with federated learning and differential privacy. Federated learning keeps data on devices and is already used in smartphone next-word prediction, while encrypted machine learning is less mature. He says awareness remains a problem, and research methods need usable tools before people without deep cryptography expertise can adopt them. The techniques also make different assumptions and provide different privacy guarantees.
Banks and hospitals have a practical reason to use privacy-preserving ML
Théo says organisations with private data are often blocked from cooperating. Banks may want to share information to fight financial crime, and hospitals may want to train stronger models without moving patient data. Hospitals are already comfortable with cooperation and are interested in federated learning because it preserves data sovereignty. Encrypted machine learning becomes more relevant when the hospital also needs to protect its data from the organisation that owns the model.
The code can be simple while the security decision remains difficult
Open-Mined aims to make privacy-preserving workflows accessible through familiar machine-learning tools. Théo gives the example of taking a tensor and calling an encryption method before operating on it. The simple syntax does not remove the need to understand the protocol. He distinguishes protocols that protect against honest-but-curious parties from protocols that protect against malicious parties, which allow an adversary to deviate from the agreed process and are slower.
Encrypted ML is faster than it used to be, but it still costs more
Théo says encrypted machine-learning workflows were once roughly 100 or 1,000 times slower. He cites research reporting private deep learning on CPUs at a factor of six over plain execution. GPU execution remains slower because cryptographic protocols are not well optimised for GPUs. He points to progress from encrypted convolutional networks toward larger models such as ResNet-18, while warning that teams must match the security guarantee to their actual needs.
Open-Mined combines education, open tools, and community work
Théo describes Open-Mined's aim as enabling people to work with data they cannot directly see. The community builds tools for collaboration, runs educational courses and conferences, and connects companies with researchers and contributors. He mentions PySyft for wrappers around machine-learning frameworks and PyGrid for a network of remote workers. These tools can support remote analysis, federated training, and encrypted evaluation or training.
A personal project is a practical way to join an open-source privacy community
Théo says newcomers do not need to be cryptography experts, but they do need time to read changing code and understand the project. He recommends joining through a concrete project. Companies can use existing open-source components and contribute use cases back to the community, which helps maintainers shape libraries for production needs. He also mentions AMAs, project presentations, and local meetups as ways to participate.
"Encrypted computation is really about not only having a secret that you encrypt, but also operating on it to do some operation and transform it into something different."Théo Ryffel03:21
Who should watch
You are building ML systems with data that hospitals, banks, or other organisations cannot legally or practically share.
You need to decide whether to protect a model, its input data, or both, and want a concrete explanation of the trade-offs.
You are considering contributing to or adopting open-source privacy-preserving machine-learning tools.
