papers/hanzo-ai-cloud/sections/02-the-ai-cloud-problem.tex

\section{The AI Cloud Problem}

\label{sec:problem}
% ============================================================================

The fundamental issue is that inference requires the model to operate on
plaintext. A transformer model computes attention over token embeddings; if
the embeddings are encrypted, standard matrix multiplication does not apply.
This creates an apparent dilemma: either the provider sees the data (plaintext
inference) or the provider cannot run the model (encrypted data).

Three approaches exist to break this dilemma:

\begin{enumerate}[leftmargin=1.4em]
    \item \textbf{Trusted Execution Environments (TEEs)}: Run inference inside
    an enclave (Intel SGX, AMD SEV, ARM TrustZone). The hardware prevents the
    host from reading enclave memory. Limitation: TEEs have small memory
    (256~MB for SGX), side-channel vulnerabilities, and require trusting the
    hardware vendor's attestation.
    \item \textbf{Secure Multi-Party Computation (MPC)}: Split the computation
    across multiple non-colluding parties. No single party sees the full
    input. Limitation: communication overhead scales with model size,
    making MPC impractical for billion-parameter models.
    \item \textbf{Fully Homomorphic Encryption (FHE)}: Encrypt the input and
    evaluate the model on ciphertexts. The provider performs computation
    without decryption. Limitation: computational overhead (10--1000$\times$
    slowdown depending on scheme and circuit depth).
\end{enumerate}

Hanzo AI Cloud uses FHE as the primary confidentiality mechanism, with TEEs as
an optional accelerator for latency-sensitive workloads. MPC is used only for
threshold decryption of FHE outputs, where the communication overhead is
minimal (one round, fixed-size messages).

% ============================================================================