Privacy-preserving AI: compute on secrets without seeing them
Privacy-preserving AI is an approach to building machine learning and analytics systems that allows organizations to analyze sensitive data, derive useful insights, and run automated decisions while keeping the underlying records hidden from the people, vendors, and infrastructure operating the system. Homomorphic encryption allows data to be processed while it remains encrypted, protecting sensitive information during computation. This matters because the biggest risk in modern AI is no longer whether models can perform, but whether they turn every data pipeline into a long-term exposure incident waiting to happen. The most important strategic shift is to assume that “no one should see the raw data” and then design AI architectures that live with that constraint. Homomorphic encryption AI, on-device machine learning, and confidential clean rooms are no longer academic toys; they are becoming realistic options for day-to-day encrypted data analysis and data privacy compliance.
Google’s HEIR and the rise of homomorphic encryption AI
Homomorphic encryption has long been the poster child for privacy-preserving analytics: powerful, elegant, and painfully slow. That narrative is starting to crack. Google’s Homomorphic Encryption Intermediate Representation (HEIR) is an open-source compiler toolchain and development platform for homomorphic encryption that can convert pre-trained AI models designed to operate on unencrypted data into models that process encrypted inputs. Developers can write programs in Python, identify sensitive data, and use HEIR to compile the programs into implementations that operate on encrypted data. In plain terms: you bring your existing model, they give you an encrypted twin. HEIR demonstrates the use of homomorphic encryption in private recommendations, credit card fraud detection, network intrusion detection, and hotword recognition. The technology carries significant computational overhead, though Google says the cost of homomorphic encryption is decreasing, making it practical for privacy-preserving data processing in fields such as healthcare and finance. That shift turns homomorphic encryption AI from a compliance talking point into a real design choice for enterprise workflows.
WhatsApp’s on-device machine learning shows privacy-by-architecture
If HEIR represents encrypted data analysis in the cloud, WhatsApp’s Scam Alert is what privacy-preserving AI looks like on your phone. WhatsApp is testing Scam Alert, an optional on-device machine learning feature that warns users when messages from non-contacts match patterns associated with scams. Once enabled, Scam Alert downloads a small machine learning model to the device and evaluates incoming messages from non-contacts using conversational structure and linguistic signals. The limited beta is accompanied by a technical design that keeps message content on the device during classification while using confidential computing, differential privacy, and transparency mechanisms to measure model performance and prevent targeted model delivery. If the model identifies a likely scam, the user sees a warning that is not visible to the sender and can block, report, or continue the conversation. The architecture separates message classification from performance measurement, and the aggregation process applies minimum cohort thresholds and differential privacy before only approximate population-level statistics are made available to WhatsApp. This is privacy-by-architecture, not privacy-by-promise: on-device machine learning first, and privacy-preserving analytics as a separate, carefully constrained path.
Decentriq and the case for verifiable data neutrality
Marketing and AI vendors like to talk about neutrality, but neutrality on a slide deck is no longer enough. Decentriq’s official materials describe its clean rooms as environments where organizations can analyze sensitive data without exposing raw records, using confidential computing to keep data inaccessible during processing. Instead of pooling everything into a central warehouse, their model is to centralize intelligence, not raw data. Confidential computing processes encrypted data inside an isolated trusted execution environment, with attestation that can provide cryptographic evidence that the environment is genuine and running the expected code before data is sent. Client-owned clean rooms shift agency power, and Max sees more brands wanting to own clean room infrastructure themselves rather than leaving it entirely inside an agency. In this view, trust is not about who owns the stack; it is about what the stack can prove. AI systems need a second layer of diligence: what data becomes visible during computation, who can change the code, what outputs can leave, and what evidence proves those controls were enforced. For buyers worried about data privacy compliance, that is a more honest question than “do we like this vendor?”.
The new trust contract: design for zero unnecessary visibility
Taken together, these examples point to a clear conclusion: the only sustainable way to do AI on sensitive data is to design for zero unnecessary visibility. HEIR shows that homomorphic encryption AI can make private recommendations or detect fraud without exposing transaction streams. WhatsApp’s on-device model shows that privacy-preserving analytics can separate classification from measurement, use trusted execution environments, and still ship useful safety features. Decentriq’s client-owned clean rooms show that encrypted data analysis does not have to mean surrendering control to a vendor’s black box. Trust will depend less on who owns the plumbing and more on whether the system can prove what nobody is allowed to see. The practical takeaway for any organization is blunt: if your AI roadmap assumes copying all your raw data into someone else’s system, you are not future-proofing your business—you are stockpiling your next headline incident. Start with the rule that models may compute on secrets but never possess them, and choose technologies that make that rule enforceable in code, not in policy.
