Encryption in use: five technologies that protect data while AI works on it

On this page

• 1. Fully homomorphic encryption (FHE)
• 2. Local, on-device processing
• 3. Secure multi-party computation (MPC)
• 4. Confidential computing
• 5. Zero-knowledge proofs (ZKPs)
• What about GPUs?
• The five technologies compared
• Frequently asked questions
• Sources

In part 2 we saw that encryption at rest and in transit are solved, and that the real exposure happens when data is processed. Several technologies attack that problem, each with a different trade-off between privacy, speed and what you have to trust. This part goes through the five that matter, plus the question that decides most of it for AI: what about GPUs?

1. Fully homomorphic encryption (FHE)
2. Local, on-device processing
3. Secure multi-party computation (MPC)
4. Confidential computing
5. Zero-knowledge proofs (ZKPs)

1. Fully homomorphic encryption (FHE)

Fully homomorphic encryption lets you compute directly on encrypted data. The server receives ciphertext, runs the computation on ciphertext and returns an encrypted result that only you can decrypt. At no point does anyone, not even the hardware, see the data in the clear. For personal AI this is the dream.

Explain it like I’m five: You put your crayons in a box and lock it. A friend wants to help sort them into warm and cool colours. FHE is a magic trick that lets your friend sort the crayons while the box stays locked. Your friend helps, but never sees a single crayon.

For a long time FHE worked in theory but not in practice. That is changing, at different speeds for different workloads:

• It is in production for narrow tasks. Apple has used homomorphic encryption since 2024 for private lookups such as Enhanced Visual Search, Live Caller ID and Mail’s business logos, and for Enhanced Visual Search adds differential privacy and a relay that hides the device’s IP address.

• The money and the hardware are arriving. Zama, which develops open-source FHE libraries, became the first FHE company valued at over a billion dollars in June 2025. In February 2026 Intel presented Heracles, an FHE accelerator it reports to be between 1,074 and 5,547 times faster than a 24-core Xeon on core FHE operations. Startups such as Niobium and Optalysys raised new rounds for FHE chips in 2025 and 2026.

• Language models are still out of reach. Research has run GPT-2 and BERT-sized models under FHE, and a December 2025 paper (Cerium) measured encrypted inference through the layers of Llama 3 8B at more than two minutes for a 128-token prompt on eight NVIDIA B200 GPUs. An assistant needs that in well under a second.

• Pros: no need to decrypt data, and no need to trust the hardware or the operator.

• Cons: still several orders of magnitude too slow for large language models; complex to engineer.

2. Local, on-device processing

If all computation runs on your own device, next to your data, you do not have to trust anyone but your device. There is nothing to protect in transit or in use on someone else’s server. Many local-first apps work this way, such as Obsidian, Linear and Logseq, and it is where Kin started.

The big change since 2025 is that devices can now run useful models:

• Apple’s on-device foundation model has about 3 billion parameters, compressed to around 2 bits per weight, and since 2025 apps can call it through the Foundation Models framework.
• Google offers Gemini Nano to Android apps through the ML Kit GenAI Prompt API, released in alpha in October 2025.
• Laptop chips such as Apple’s M5 and phone chips such as the Snapdragon 8 Elite Gen 5 have dedicated AI accelerators, and open models such as gpt-oss-20b run in 16 GB of memory.

You can also add a central sync server that keeps several devices in step while preserving end-to-end encryption.

• Pros: data never leaves your device; no cloud cost or latency.
• Cons: work only happens while the device is on and the app is allowed to run; the largest models still do not fit, and battery and heat set hard limits.

3. Secure multi-party computation (MPC)

Multi-party computation is a branch of cryptography where several parties jointly compute a function over their inputs without revealing those inputs to each other. They can, for example, compute an average salary without anyone learning anyone else’s salary. It is well proven for narrow tasks such as private set intersection, key management and auctions.

For AI it remains slow because the parties have to exchange large amounts of data for every step. Published systems for private inference on a 7-billion-parameter model, such as BumbleBee and PUMA, still take several minutes per generated token.

• Pros: no single party ever sees the original inputs.
• Cons: needs a trusted network of independent participants; communication adds latency and complexity; impractical for large models today.

4. Confidential computing

What if you could have the flexibility and performance of the cloud without trusting the cloud provider with your unencrypted data? That is the promise of confidential computing. It relies on trusted execution environments (TEEs) built into modern processors, such as Intel TDX and SGX, AMD SEV-SNP and AWS Nitro Enclaves. They provide three properties:

1. Isolation. Code runs in an environment whose memory the host, the hypervisor and the operator cannot read.
2. Hardware-held keys. A key built into the chip at manufacture can only be used inside the TEE, so data can be encrypted for the enclave and will only be decrypted there.
3. Attestation. The hardware signs a measurement of exactly what software is running, so a client can verify the code before it sends anything.

Together they make an execution environment that has become the backbone of private AI in the cloud. Part 4 shows how Apple, Google and Meta use it in practice.

The honest caveat came in 2025. Researchers published a series of physical attacks, including Battering RAM, WireTap and TEE.fail, that used cheap interposers on the memory bus to extract secrets from Intel SGX and TDX and AMD SEV-SNP. In 2026 a further attack, DDRop, read the memory of a TDX virtual machine and forged its attestation, with an interposer that takes minutes to fit. All of them need physical access to the server, and Intel and AMD consider physical attacks out of scope. Confidential computing protects you from a remote attacker and from a curious or compelled operator, but you are trusting the chip maker and the physical security of the data centre.

• Pros: strong isolation and verifiable code; small performance overhead on recent hardware; runs any workload, including frontier models.
• Cons: you trust the hardware manufacturer; vulnerable to attackers with physical access; more complex to develop and operate.

5. Zero-knowledge proofs (ZKPs)

A zero-knowledge proof lets one party (the prover) convince another (the verifier) that a statement is true without revealing anything else. You can prove you are over 18 without revealing your birth date, or prove that a document is signed without showing its content. The computation is expressed as a “circuit”, and proof systems such as zk-SNARKs and zk-STARKs differ in proof size, speed and setup.

ZKPs have moved from blockchains into identity. Google open-sourced its Longfellow ZK libraries for age assurance in July 2025. The EU’s age verification blueprint, updated in October 2025, has since added zero-knowledge proofs, and EU member states must offer a European Digital Identity Wallet by the end of 2026. The selective-disclosure format SD-JWT was published as a standards-track RFC (RFC 9901) in November 2025.

For AI, ZKPs are a complement rather than a solution. They are excellent for proving small facts about you to an AI or a service, and for proving that a computation was done correctly. Generating proofs for something the size of a language model is still far too expensive, and a proof must be regenerated whenever the data changes.

• Pros: reveals nothing beyond the statement; verifiable by anyone.
• Cons: heavy computation; demands deep cryptographic expertise; suited to small, stable facts.

What about GPUs?

To build a personal AI you need large language models, and the best ones need large GPUs. Smaller models run on devices and keep getting better, but there is no way around it: the most capable models run in data centres. That brings us back to confidential computing.

For years TEEs were a CPU feature. As soon as a workload moved to the GPU, it left the protected environment. NVIDIA changed that with the H100, the first GPU with confidential computing, and in April 2025 made multi-GPU confidential computing generally available for eight-GPU H100 and H200 systems. Azure and Google Cloud now offer confidential virtual machines with H100 GPUs. The GPU becomes part of the trusted boundary, with its own attestation, and data travels encrypted between CPU and GPU.

TEE.fail showed that GPU attestation can also be faked by an attacker who controls the host physically, so the same caveat applies. But for the first time it is possible to run a frontier-scale model on data the operator cannot read.

The five technologies compared

Technology	How it protects data in use	Trust required	Ready for large AI models in 2026?	Best suited for
Fully homomorphic encryption	Computes on ciphertext	Only the mathematics	No, orders of magnitude too slow	Private lookups, simple analytics, the long-term goal
On-device processing	Data never leaves your device	Your device and its software	Small models only	Everyday tasks, personal data, offline use
Multi-party computation	Splits the computation across parties	That parties do not collude	No, minutes per token	Joint analysis between organisations, key management
Confidential computing	Hardware-isolated, attested enclaves on CPU and GPU	Chip maker and physical security	Yes	Cloud inference, background jobs, frontier models
Zero-knowledge proofs	Proves facts without revealing data	The proof system	No, but useful alongside AI	Identity, age checks, verifiable claims

For a personal AI, the practical answer today is a combination: on-device processing wherever possible, and confidential computing for the rest. In part 4 we look at how the largest platforms have built exactly that.

Frequently asked questions

What is encryption in use? +

Encryption in use is protection for data while it is being processed in memory, the moment where ordinary systems must decrypt it. It is achieved either by computing on encrypted data (homomorphic encryption, multi-party computation) or by isolating the computation so the operator cannot see it (confidential computing, on-device processing).

What is the difference between homomorphic encryption and confidential computing? +

Homomorphic encryption keeps data encrypted during the computation itself, so no one, including the hardware, ever sees plaintext. Confidential computing decrypts data only inside a hardware-isolated enclave and proves which code runs there. Homomorphic encryption needs no trust in hardware but is far slower; confidential computing is fast but relies on the chip maker and on the enclave not being broken.

Can large language models run with fully homomorphic encryption? +

Not at practical speed. Research has demonstrated small transformer models under FHE, but a full-size language model would take orders of magnitude too long per answer. Dedicated FHE hardware is the main hope for closing that gap.

Do GPUs support confidential computing? +

Yes. NVIDIA introduced confidential computing for GPUs with the H100, and since April 2025 it works across eight-GPU H100 and H200 systems, so AI models can run inside an attested trusted execution environment that spans CPU and GPU. Azure and Google Cloud offer confidential GPU virtual machines built on this.

Sources

1. Apple Machine Learning Research: Combining machine learning and homomorphic encryption (October 2024): Apple's production use of homomorphic encryption
2. tech.eu: Zama becomes the first FHE unicorn (June 2025): Zama's funding and valuation
3. Tom's Hardware: Intel Heracles FHE accelerator (March 2026): Intel's reported FHE speed-up
4. Cerium: encrypted transformer inference on GPUs (arXiv, December 2025): Measured FHE latency for BERT and Llama 3 8B
5. Apple Intelligence Foundation Language Models tech report (July 2025): Apple's 3-billion-parameter on-device model and the PCC server model
6. Android Developers: ML Kit GenAI Prompt API (October 2025): Gemini Nano for Android apps
7. NDSS 2025: BumbleBee, secure two-party inference for large transformers: MPC inference speed for 7B models
8. The Hacker News: Battering RAM breaks Intel SGX and AMD SEV-SNP (October 2025): A physical attack with a 50-dollar interposer
9. BleepingComputer: TEE.fail breaks confidential computing on Intel, AMD and NVIDIA (October 2025): DDR5 attack and faked GPU attestation
10. The Hacker News: DDRop breaks Intel TDX (September 2026): Reading TDX memory and forging attestation
11. Google: Opening up zero-knowledge proof technology for age assurance (July 2025): Google's Longfellow ZK libraries
12. European Commission: Blueprint for an age verification solution: Zero-knowledge proofs in the EU age verification app
13. RFC 9901: Selective Disclosure for JWTs (November 2025): SD-JWT as an internet standard
14. NVIDIA: Secure AI general availability (April 2025): Multi-GPU confidential computing on H100 and H200
15. Microsoft Learn: Azure confidential GPU options: Confidential VMs with H100 GPUs