This is actually the magic of FHE. The ciphertext is indistinguishable from noise AND can be computed on, it just looks like different noise.

If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.

▲

filup an hour ago | parent [-]

If it only appears indistinguishable from noise, but it's actually not, then it's just deception.

▲

drdeca 37 minutes ago | parent [-]

They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable.

It seems like you strongly believe otherwise, but I suspect you don’t have a good reason to, and just find it unbelievable.

Do you think you can distinguish it from noise, if given an implementation and the information an adversary would have access to?

Of course, you not being able to wouldn’t demonstrate that noöne can. But, it seems like if you had a good reason to believe that an adversary can, that would suggest you might have some idea of how they could do so. And, if you do have such an idea, then, if that idea works, it would be important for others to know, and if it doesn’t, it would presumably benefit your understanding to see why it doesn’t.

	▲	filup 13 minutes ago \| parent [-]
		>They didn’t say that it “appears” indistinguishable from noise, but that it is indistinguishable. That's the oxymoron. If it was indistinguishable nothing could be gained. It's not about me being able to distinguish it. It's the model provider saying they cant, when they can.