Hardshell has been working with Google and Niobium on a credit card fraud detector that runs entirely on encrypted data. The project was published today as one of four private inference applications built with HEIR, Google's open-source compiler toolchain for homomorphic encryption. In Google's words, "Together with Niobium and hardshell.ai, we compiled a credit card fraud detector."
The application scores transactions without ever decrypting them. Features are encrypted before they leave the client, the model computes directly on the ciphertext, and the score comes back encrypted for the client to open. Nothing in the serving path holds plaintext at any point.
Getting a model into that state is the hard part, and it's why this class of work has mostly stayed in research. Homomorphic encryption itself has been well understood for years, but running a trained model under it has meant a cryptography team rewriting the model by hand. HEIR removes that step, converting pre-trained models that operate on unencrypted data so they operate on encrypted inputs instead. Google describes the vision as making it "a one-click solution to enable non-experts to incorporate encrypted inference into production applications." Niobium works the other half of the problem, building hardware accelerators aimed at the cost overhead that has kept encrypted inference out of production systems.
Fraud detection is a useful proving ground for this. The transaction data is exactly what an institution can't hand to a third party, and the model still has to run on every transaction. The three other applications Google published alongside it were a deep learning recommendation model with Belfort Labs, LG and New York University, the Kitsune anomaly detection system compiled with Niobium for encrypted network traffic, and a hotword detector with Belfort Labs. Google also credits Belfort, Niobium, Cornami and Optalysys among its hardware accelerator partners, along with academic collaborators at Georgia Tech, Carnegie Mellon, UC Santa Barbara, the Illinois Institute of Technology, Purdue, the University of Edinburgh, Tsinghua University and others.
This work sits alongside the rest of what we build rather than replacing it. Encrypted inference protects the data a model computes on at request time. Hardshell's platform profiles and hardens the datasets that go into training, fine-tuning and retrieval, upstream of where a compiled model runs. Both are aimed at the same constraint, which is that the data most worth running AI on is usually the data an organization is least able to expose.