By Takao Takenouchi

One of the highlights of the new iPhone 16 is its generative AI service that enables high-speed data processing in the cloud. But what happens to privacy protection when personal information from your phone is sent to cloud servers?

To address such concerns, Apple has adopted a hardware-based secure computation technology that processes data in an encrypted state. While this technology is rapidly gaining traction in the AI industry, its adoption in Japan has been relatively slow. Takao Takenouchi, Public Affairs Specialist at Acompany (Nagoya, Japan), and Executive Director of the Privacy Tech Association, explains this technology.

Note: This article was originally contributed to Nikkei Digital Governance on September 11. Some images and text have been modified.

You can read the article here. (Japanese)

Generative AI for Large-Scale Data Processing: Privacy Protection as a Key Challenge

Generative AI is expected to streamline corporate activities and deliver personalized services to everyday people. At the same time, concerns are rising over the safety of sensitive corporate trade secrets and personal information input into generative AI systems.

In recent years, among the various security and privacy risks, the risk of memory access through administrator privileges has been a hot topic.

Generally speaking, having administrator privileges allows access to data in memory during processing on a PC or a cloud server. This could happen either intentionally, such as when identifying and fixing errors or bugs, or maliciously, such as through malware infections that compromise administrator privileges, leading to memory data leaks.

With the increasing adoption of generative AI, which potentially handles large volumes of sensitive data, there is a growing potential for attacks aimed at unauthorized memory access.

Secure Computation: Processing Data While Keeping It Encrypted

Amid these challenges, a promising technology for protecting data during processing is secure computation. While there are various definitions and classifications of secure computation, in Japan, it is generally regarded as a collective term for technologies that allow data to be processed while remaining encrypted or anonymized.

Traditional encryption techniques enable data to be encrypted during storage or transmission, but not during processing. This limitation required data to be decrypted back to its original form before processing, which posed security risks. In contrast, secure computation stands out for its ability to protect data even while it is being processed.

For example, it is possible to encrypt personal information on a smartphone, send it to the cloud in an unreadable state (even to administrators), input it into generative AI for processing within the cloud, and then decrypt the results back on the smartphone for use. By processing data in this way, leaks of sensitive personal information can be effectively prevented.

TEE Enables High-Speed Processing

Secure computation is a well-known technology in Japan, but the solutions provided by domestic companies are primarily software-based. While these software-based methods are backed by advanced cryptographic theories proving their safety, they have a significant drawback: slow processing speeds. This makes them difficult to apply to computationally intensive processes, such as those required by generative AI.

In contrast, a hardware-based secure computation method called TEE (Trusted Execution Environment), also known as Confidential Computing, is gaining rapid adoption, particularly outside of Japan. 

Software-based secure computation achieves encrypted processing using specialized cryptographic algorithms. On the other hand, hardware-based secure computation encrypts and anonymizes data in memory during processing using dedicated circuits. However, when data is transferred from memory to a processing circuit, such as a CPU, it’s temporarily decrypted and processed in an unencrypted state.

During this process the data handled by the processing circuits cannot typically be accessed, even by malicious actors with administrator privileges. This approach operates on the practical assumption that as long as data in memory is encrypted, its security can be adequately maintained. Since the processing circuits themselves can handle data without slowing down, this method achieves both secure and high-speed data processing overall.

A hardware-based environment that enables secure data processing is called a TEE, and the practice of protecting data during processing using a TEE is referred to as Confidential Computing.

Google Announces TEE Integration

Previously, TEE was only supported by CPUs from Intel and Arm, though recently it has also gained support by GPUs from Nvidia, which are capable of high-speed AI processing. This has led to a rapid expansion in the use of TEE for AI.

Apple is also likely to accelerate this adoption. Its generative AI feature Apple Intelligence," which gradually began rolling out in October, is confirmed to use TEE. Unlike software-based secure computation, TEE has a feature that verifies whether the programs being executed have been tampered with. Apple has utilized this feature and revealed in its October 10th announcement that it employs a system for independent cryptography researchers to verify the safety of its services.

This method can ensure that data input into generative AI is securely deleted after processing and that sensitive data is not used for training.

In July, Google also announced the application of TEE to its generative AI services that utilize smartphones and the cloud. Lightweight generative AI is run on phones, while servers with superior computational power operate high-performance generative AI models with a large number of parameters within TEE. This ensures that personal data on smartphones cannot be accessed by cloud server administrators.

The spotlight on TEE as a means of privacy protection in the AI era has suddenly intensified, as the successive announcements by two global tech giants regarding the application of TEE to generative AI services have had a tremendous impact on the cryptography industry. 

Japan’s Strength in Software-Based Solutions Poses a Risk

Japan has not been able to immediately respond to these global trends, partly due to its historical strengths in technology. Companies within Japan have long engaged in research and development of software-based secure computation, leading international standardization efforts and earning a reputation for their advanced technological capabilities. Perhaps because of this, the adoption of hardware such as TEE appears limited.

That’s not to say there aren’t any efforts to catch up.

For example, Zeureka, a subsidiary of Mitsui & Co., has announced a partnership with the U.S.-based Fortanix and Nvidia to use TEE in AI processing for pharmaceutical development.

And while not for AI processing, there are cases where TEE has been used for aggregation processing. NTT Docomo and Japan Airlines (JAL) have devised a method that uses TEE to match location information and ticket information without obtaining personal consent, outputting statistical data for use in analyses to ensure on-time departures and address societal challenges.

In the semiconductor field, Fujitsu plans to support Confidential Computing with its low-power CPU scheduled for release in 2027.

As digital strategies become increasingly important in industries, inter-company data collaboration will also grow in significance. While attention is being drawn to the review of Japan’s Privacy law (Act on the Protection of Personal Information), which focuses on safeguarding data through rules, the idea of protecting data through technology is equally important. Ignoring the potential of TEE in this context is not an option.

The AI era is evolving at a breakneck speed. Even Japan’s strong reputation in cryptography is not guaranteed to remain secure. Business leaders should closely monitor the trends in secure computation and actively adopt the necessary technologies.