Privacy-Enhancing Computation

Privacy-enhancing computation is the engineering answer to a question the law asks badly: how do you compute on data you are not allowed to see? Six technology families are routinely sold as one category — differential privacy, federated learning, secure multi-party computation, fully homomorphic encryption, zero-knowledge proofs and trusted execution environments. They are not substitutes for one another, and treating them as one category is the most common and most expensive error in procurement.

Established Each family answers a different question about a different adversary. Differential privacy bounds what a published output reveals about any one contributor, and says nothing about who holds the input. Multi-party computation and homomorphic encryption hide the inputs from the parties doing the arithmetic, and say nothing about what the agreed output leaks. Zero-knowledge proofs let a party prove a statement about data it holds without disclosing the data, and say nothing about whether the statement is the right statement to prove. Trusted execution environments hide nothing mathematically; they relocate trust into a chip vendor’s attestation service and a microarchitecture. Federated learning is not a guarantee at all — it is a deployment architecture that changes where data sits, and it leaks unless one of the others is bolted onto it.

Frontier The binding constraint on deployment is not cryptography. The mathematics of the two oldest families has been settled for fifteen to forty years. What is missing is a parameter a regulator will accept: no data-protection authority anywhere has stated an epsilon it treats as anonymous, which means the one family with a rigorous guarantee cannot be used to discharge a legal obligation, only to reduce a risk nobody has priced. That gap — between a proof about a distribution and a statute written in binary terms about identifiability — is what this brief is about.

Scope. AI Governance owns the audit-access problem these tools are proposed to solve and this brief does not restate it. Digital Citizenship owns identity systems and their inclusion record; this brief owns only the cryptographic disclosure question inside them. Digital Economies owns the data-as-asset economics. Cognitive Liberty owns what happens when the data in question is neural.

Established A note on sourcing. This brief was commissioned in September 2026 from the Institute’s research base. Reading-list entries without links are cited from the bibliographic record rather than re-fetched, and claims are dated no later than early 2026 unless carried by a linked source.

Established Ad hoc de-identification fails, and the failure has been measured repeatedly for twenty-five years. Sweeney’s 1997 estimate that 87% of the United States population is uniquely identified by five-digit postal code, sex and date of birth was later re-estimated at about 63% against 2000 census data by Golle — the disagreement is about which census year and which postal geography, not about the direction. Rocher, Hendrickx and de Montjoye estimated in 2019 that 99.98% of Americans would be correctly re-identified in any dataset using fifteen demographic attributes. The consistent finding is that uniqueness in high-dimensional data is the normal case, not the exception, which is why every serious proposal since has been about bounding disclosure rather than removing identifiers.

Established Differential privacy is the only member of the family with a guarantee that composes. Dwork, McSherry, Nissim and Smith defined it in 2006: a mechanism is epsilon-differentially private if the probability of any output changes by at most a factor of e to the epsilon when one record is added or removed. The guarantee holds against an adversary with arbitrary side information, which is the property ad hoc de-identification never had, and it degrades predictably under repeated queries, which is the property that lets an operator run a budget.

Established The largest deployment is the 2020 United States Census, and its parameters are public. The Bureau replaced household swapping with the TopDown Algorithm and published a privacy-loss budget of 19.61 for the person tables of the redistricting file, at a delta of ten to the minus ten. Frontier That number is very large. An epsilon of 19.61 bounds the adversary’s likelihood ratio at about three hundred million to one, which is a formal guarantee in the same sense that a speed limit of the speed of light is a speed limit. The Bureau’s defence is that the counterfactual was swapping, whose disclosure risk was never published at all and whose accuracy loss was also never published — a comparison between a measured weak guarantee and an unmeasured unknown one.

Established The attack that motivated the change was run by the Bureau on itself. Internal reconstruction of the 2010 tabulations produced person-level records; the Bureau reported putative re-identification of roughly 45% of the population on block, sex, age, race and ethnicity, of which about 38% were confirmed against commercial data — the widely quoted 17% figure is the product of those two. Frontier Ruggles and Van Riper dispute the precision, arguing the confirmation rate is close to what naive guessing achieves on the same attributes, and the argument has not been settled because the Bureau has not released the attack data. This is the cleanest example in the field of a decisive measurement that exists and cannot be checked.

Frontier The accuracy cost of the census deployment falls unevenly, and that is a structural property rather than an implementation defect. Kenny and colleagues found in 2021 that noise injected for disclosure control produced errors large enough to matter for small racial and ethnic minority populations at the block level, with consequences for redistricting compliance, while county-level aggregates were barely affected. Noise added at a fixed absolute scale is a small relative error on a large group and a large one on a small group. Every differentially private release redistributes accuracy from minorities to majorities unless it is deliberately engineered not to, and doing so costs budget elsewhere.

Established Consumer local differential privacy delivers much weaker parameters than its marketing implies. Google’s RAPPOR shipped in Chrome in 2014. Apple shipped local differential privacy in iOS and macOS in 2016. Tang, Korolova, Bai, Wang and Wang reverse-engineered the macOS 10.12 implementation in 2017 and measured a per-day privacy-loss budget of 14, with 6 on iOS 10, and no bound at all across days because the budget reset daily. Apple disputed the interpretation but did not publish an alternative accounting. An unbounded composition across days is, formally, no guarantee about a persistent user at all.

Frontier Federated learning is the most deployed member of the family and the one whose bare form guarantees least. Gboard has trained production language models on device since 2017. Google reported by 2023 that its Gboard neural language models were trained with formal differential-privacy guarantees, with per-model budgets spanning roughly one to fourteen — the operator’s own figures. Established Without that addition, gradients leak training data directly: Zhu, Liu and Han demonstrated pixel-level and token-level recovery of training examples from shared gradients in 2019, and Geiping and colleagues extended it to realistic batch sizes in 2020. Federated learning moves the raw data; it does not by itself stop the data being recovered from what is sent instead.

Established Multi-party computation has an eighteen-year record of small, real, repeated production deployments and no large ones. The Danish sugar-beet auction in January 2008 cleared a national contract market for roughly 1,200 growers using three-party computation that ran in about thirty minutes. Estonia’s Sharemind deployment analysed some ten million tax records against education records to test a claimed link between working during study and dropping out, on data the two agencies were legally barred from pooling. Every one of these works because the number of parties is small, fixed and legally identifiable — which is an institutional precondition, not a cryptographic one.

Established Fully homomorphic encryption works and is slow. Gentry’s 2009 construction was the first to allow unbounded computation on ciphertext; early bootstrapping took on the order of half an hour per elementary operation. Scheme and library work since has brought bootstrapping into the millisecond range for boolean circuits and encrypted inference on small networks into minutes, leaving general-workload overheads in the ten-thousand to million-fold range and far lower for narrow, arithmetic-shaped ones. Frontier DARPA’s DPRIVE programme, launched in 2021, set a target of bringing homomorphic evaluation within about one to two orders of magnitude of unencrypted compute using purpose-built silicon. As of early 2026 no such accelerator was in volume production, and the published academic designs report their speedups against CPU baselines rather than against a deployed alternative.

Frontier Zero-knowledge proofs have moved from cryptographic curiosity to production infrastructure, almost entirely inside cryptocurrency. Succinct systems make verification cheap and proving expensive, with proving overheads for general computation historically ten thousand to a million times native execution and falling fast. Zcash has offered shielded transactions since 2016 and shielded use has stayed a minority of transactions throughout — the field’s most useful natural experiment about what users will pay for optional privacy. Frontier The nearest thing to a civil deployment is identity: cryptographers submitted formal feedback in June 2024 that the European Digital Identity Wallet architecture did not deliver unlinkability, and European Digital Rights was still reporting the gap in 2026.

Established Trusted execution environments have the best performance and the worst track record. Intel SGX has been broken repeatedly by microarchitectural attack — Foreshadow in 2018, Plundervolt and SGAxe in 2020, AEPIC Leak in 2022, Downfall in 2023 — with several attacks recovering attestation keys, which breaks the guarantee for every enclave rather than one. AMD’s SEV-SNP was defeated in 2024 by BadRAM, a memory-aliasing attack using an interposer costing roughly ten dollars. The pattern is that each attack is fixed in microcode or a subsequent stepping, and the next one arrives. Frontier Confidential computing on accelerators is newer: vendor figures for confidential mode on current datacentre GPUs report overheads under about ten percent for large-model inference, and there is no independent replication of those numbers.

Frontier The most convincing deployment in the whole family is not in advertising or statistics but in biosecurity. The SecureDNA consortium published in February 2026 a system that screens synthetic DNA orders against hazard databases cryptographically, so that the screener learns nothing about the customer’s sequence and the customer learns nothing about the hazard list. It is the clearest existence proof that a privacy-preserving protocol can carry a live regulatory function at global scale, and it works for the same reason the multi-party deployments work: a small number of identifiable parties with a shared interest in the answer and a legal bar on sharing the inputs.

Established Where privacy technology has been deployed against a commercial incentive, the commercial incentive has won. Google’s Privacy Sandbox proposed to replace third-party cookies with aggregated measurement running in enclaves under differentially private noise; in April 2025 Google abandoned third-party-cookie deprecation in Chrome and through late 2025 began retiring parts of the Sandbox. Frontier Aridor, Che and Salz found the General Data Protection Regulation reduced tracked users while improving per-user information on those remaining, with share shifting to the largest vendor. A privacy technology deployed by the party whose revenue it constrains is governed by that party’s revenue.

Frontier What does epsilon mean to a lawyer? No data-protection authority has published a value of epsilon at which a release is treated as anonymous under its statute, and the two regimes disagree about whether such a statement is even possible: European law treats identifiability as a threshold property, differential privacy is a continuous one. Until a regulator writes a number, differentially private releases discharge no legal duty.

Frontier Can composition be accounted across independent operators? Budget accounting works inside one system. Nobody operates a ledger across systems, so a person whose data appears in a census release, a health release and a mobility release has a total exposure that is the sum of three epsilons no institution computes. This is the field’s largest unsolved practical problem and it is a bookkeeping problem, not a mathematical one.

Frontier Can attested computation serve as an audit primitive when the auditor distrusts the attester? The proposal is that a regulator verifies what ran on a developer’s hardware without seeing the weights. The chain of custody terminates in a key held by the chip vendor, and the chip vendor is not a disinterested party in the market it certifies.

Established Overhead is the first-order bottleneck and it is technology-specific, not category-wide. Enclaves cost single-digit to low-double-digit percentages. Local differential privacy costs nothing in compute and a great deal in sample efficiency — noise at a fixed scale means a statistic needs orders of magnitude more contributors to reach the same confidence interval. Two-party computation over garbled circuits costs bandwidth proportional to the circuit; honest-majority protocols are faster and require more parties who will not collude. General homomorphic evaluation and general zero-knowledge proving remain the expensive corner, and the cost is dominated by memory bandwidth and polynomial arithmetic rather than by any missing idea.

Established Parameter selection is a bottleneck that no amount of engineering will clear. Choosing epsilon is a policy judgement about acceptable disclosure dressed as a configuration value, and the people qualified to set it are not in the room when it is set. The census set a number in public and was sued. Everybody else sets one in private.

Frontier Side-channel resistance is not a property anyone knows how to ship. Every deployed enclave technology has been broken by an attack that was not in its threat model, and the fixes are microcode and silicon revisions on multi-year cycles against research cycles of months. An enclave is a good defence against a curious operator and a poor one against a funded adversary with physical access, and most procurement documents do not distinguish the two.

Frontier The field waits on four things, only one of which is a scientific result. First, a stated regulatory parameter: an epsilon, or a family of epsilons by data class, that a supervisory authority will accept as discharging an anonymisation duty. This is a decision, not a discovery, and everything commercial is conditioned on it.

Frontier Second, cross-operator composition accounting. Total exposure is the sum over releases, and the sum is computed nowhere. A workable design requires a registry of releases and their parameters, which is an institution, plus a composition theorem for adaptively chosen mechanisms across untrusted operators, which is partly a research result.

Established Third, an attestation root of trust that is not the chip vendor. Confidential computing inherits the vendor’s key hierarchy, its revocation policy and its jurisdiction. Independent attestation services exist as proposals; none is deployed at scale, and the hardware would have to cooperate.

Frontier Fourth, hardware for the expensive corner. Homomorphic and proof workloads are bandwidth-bound; the published accelerator designs promise one to three orders of magnitude, and none of them has shipped in volume. If that silicon arrives, the deployment boundary between enclaves and cryptography moves substantially; if it does not, enclaves keep the volume business by default.

Frontier The decisive experiment is a published re-identification study run against a production release at its production privacy parameter, by a team with no stake in the answer, buying the same commercial data an attacker would buy. The 2020 redistricting file at an epsilon of 19.61 is the obvious target: the release is public, the parameter is public, the reconstruction method is published, and the commercial identity data is on sale. It needs no new hardware, no new mathematics and no access the Census Bureau has not already granted to its own internal attackers. Nobody has funded it. A measured re-identification rate materially below the Bureau’s internal estimate would vindicate the parameter choice and end the loudest dispute in applied disclosure control; a rate at or above it would establish that the largest differentially private deployment in the world is running at a setting that does not protect anybody, which is the result this brief would find most surprising and most consequential.

Frontier The natural experiment already running is the 2030 census round. Several national statistical offices must choose a disclosure method within this decade, and they are choosing in public, under litigation risk, with the American experience as their only precedent. The outcome — how many adopt formal privacy, at what parameters, and whether any publishes an accuracy-loss distribution alongside it — is a policy result that will discipline the field more than any laboratory demonstration.

Established A differentially private system is a budget ledger with an algorithm attached. The engineering that fails in practice is not the noise mechanism; it is tracking which analyst spent what against which population, preventing re-runs, handling the invariants a statistical agency must hold exactly, and post-processing negative counts without destroying the guarantee. The census implementation devoted far more effort to invariants, hierarchy consistency and optimisation than to the privacy mechanism itself.

Established A multi-party deployment is mostly contracts and key ceremonies. Running code exists in several mature libraries. What takes the year is agreeing who the computing parties are, who is liable if they collude, how keys are generated and destroyed with witnesses, and what happens when one party is subpoenaed. The Estonian and Boston deployments are cited for two decades because the institutional scaffolding, not the protocol, is what was hard to build.

Frontier Homomorphic systems are bandwidth machines. Ciphertext expansion of one to three orders of magnitude means the bottleneck is moving polynomials, not multiplying them; practical designs therefore optimise packing and batching and give up generality. The engineering discipline that works is to shape the computation to the scheme, which means homomorphic encryption is a good fit for fixed, repeated, arithmetic-shaped workloads and a poor fit for exploratory analysis.

Established Post-quantum cryptography is the closest adjacent programme and the most useful precedent. It shows that a standards body can run a decade-long open competition, converge on primitives, and drive deployment through browsers and messaging clients within two years of standardisation. The difference is that post-quantum migration replaces an algorithm with an algorithm at the same interface, while privacy-enhancing computation asks an organisation to change what it knows. The first is an engineering substitution; the second is a governance change wearing an engineering costume.

Frontier AI audit is the adjacent application most likely to pull this technology forward. The access problem in AI Governance — regulators need to check claims about systems whose owners will not hand over weights — is exactly the shape these tools fit, and the evaluation literature has converged on the point that black-box access is insufficient for rigorous audit. If a statutory audit regime lands on any frontier developer, privacy-preserving evaluation goes from research to procurement in a single budget cycle.

Frontier Three further adjacencies matter and are usually missed. Content provenance systems rely on attestation in the same silicon and fail in the same way when the enclave boundary is wrong. Municipal sensing in Smart Cities generates the highest-dimensional personal data any public body holds and almost never applies formal disclosure control to it. And the market structure questions in Digital Economies determine whether a privacy technology is adopted by a platform to reduce its own liability or imposed on it to reduce its own revenue, which predicts the outcome better than any technical property.

Frontier The missing institution is a body that will state a parameter and stand behind it. Data-protection authorities have issued guidance describing the technologies, endorsing their use, and declining to name a value. A supervisory authority that published a schedule — this epsilon for aggregate statistics, this one for microdata, this delta, these composition rules — would create the first legally usable privacy guarantee in history, and would immediately own the consequences of every re-identification that followed. The absence of that schedule is a rational institutional choice and the single largest brake on the field.

Established Standards cover the primitives and not the deployments. There is an international standard for de-identification terminology, a multi-part standard for multi-party computation, national guidance on evaluating differential-privacy guarantees, and a long-running public standardisation programme for post-quantum primitives. None of them tells a procurement officer what to buy, because none of them specifies a required parameter or a comparable benchmark.

Frontier Statistical agencies are the natural first adopters and are institutionally exposed when they adopt. A census bureau that adopts formal privacy publishes its own risk parameter, which is a target; a bureau that keeps swapping publishes nothing and is sued by nobody. The incentive gradient points away from transparency, and until a regulator rewards a published parameter the honest agency is the one that gets litigated.

Established The accuracy cost of formal privacy is not distributed equally, and the people it falls on are the people the statistics exist to protect. Noise of fixed magnitude is a larger relative error for a small population; disclosure control therefore degrades exactly the counts used for minority-language provision, tribal allocation and voting-rights enforcement. This is a real trade-off between two civil-rights goods, not a bug, and it should be argued as such rather than resolved by whichever side owns the algorithm.

Established The same primitives serve surveillance. Client-side scanning proposals are built from the same parts — hashing, private set intersection, attested computation — and are marketed with the same vocabulary: the provider learns nothing unless you match. A technology that can prove a property of private data without revealing it is equally a technology for checking private data against a list somebody else controls, and the list is the governance question the cryptography cannot answer.

Speculative There is a plausible net-negative case and it deserves to be stated. If privacy-enhancing computation mainly makes previously unlawful pooling lawful, and side channels mean the guarantees fail against the adversaries who matter, the field will have increased collection, reduced consent and delivered protection only against adversaries who were never the threat. Nobody has measured the net effect, and the measurement is not hard.

Speculative The civilizational claim worth taking seriously is that these tools make cross-border pooling possible where trust is absent. Pandemic surveillance, financial-crime detection, supply-chain dependency mapping and model audit all have the same shape: several parties hold pieces of a picture, each is legally or commercially barred from sharing its piece, and the aggregate is worth more than any piece. Every one of those problems is currently solved by not solving it.

Frontier The demonstrated version of that claim is small and real. A cryptographic screening system for synthetic DNA orders lets a global hazard list be enforced without the list or the orders being disclosed — a regulatory function that could not exist in plaintext because no state would accept another’s custody of either side. That is the template, and it has been running for one narrow function.

Handwave The strong version — that cryptography can substitute for institutions — is where the argument stops working. Every deployment reviewed here rests on a legal artefact: a non-collusion agreement, a statutory bar on pooling, a regulator willing to accept a parameter, a vendor whose attestation is trusted. Cryptography changes what institutions can safely do. It has never yet removed the need for one.

These horizons track deployment and legal usability, not cryptographic progress, because the mathematics is ahead of both.

• 10 yr: Frontier At least one supervisory authority publishes an accepted epsilon schedule for defined data classes, making formal privacy legally usable somewhere; confidential computing becomes default-on in major cloud regions because it is nearly free; the 2030 census round produces two or three national deployments of formal privacy and, with luck, the first published accuracy-loss distribution alongside one.
• 25 yr: Speculative Homomorphic acceleration reaches volume silicon and moves fixed analytic workloads — fraud scoring, cross-border statistics, genomic queries — off enclaves and onto ciphertext; cross-operator composition accounting exists as a regulated registry in at least one jurisdiction; proof systems are ordinary in identity and rare everywhere else.
• 50 yr: Speculative The default for regulated statistical publication is a formal guarantee with a published parameter, and the argument has moved from whether to publish a parameter to what the parameter should be — which is the argument being had about emissions and capital ratios today.
• 100 / 250+ yr: Handwave Claims that computation on data nobody can read becomes the normal case, dissolving the institutional distinction between holding data and using it, are coherent and rest on assumptions about hardware cost and legal acceptance that no current evidence constrains.

• Depends on Two results produced elsewhere on this map, and one nobody owns. From AI Governance, the finding that external assessment fails at the access levels regulators hold — the demand signal that makes privacy-preserving evaluation a procurement item rather than a paper. From Digital Citizenship, the record that identity systems are adopted for administrative reasons and audited late. The third is a measurement nobody on this map produces: what a production privacy parameter buys against a funded attacker.
• Requires (not on this map) Five constraints, of which one is a scientific result and four are facts about the world that do not exist. A published epsilon a supervisory authority accepts as anonymous: without it, formal privacy reduces risk and discharges no duty, and every commercial case rests on a parameter chosen by the seller. Composition accounting across independent data releases: total exposure is the sum across releases, no institution computes the sum, and every per-release guarantee is therefore an underestimate of unknown size. A homomorphic encryption accelerator in volume production: the published designs promise one to three orders of magnitude, a public programme has targeted the gap since 2021, and until silicon ships the expensive corner stays a research topic. A legal status for non-colluding computation parties, with registration, audit and liability, because the central assumption of multi-party computation is currently a contract term between parties who chose each other. And an attestation root of trust independent of the chip vendor, since confidential computing asks a regulator to trust a certificate chain terminating inside a firm with a market position in the thing being certified.
• Enables Pooled analysis wherever the bar to pooling is legal rather than technical: cross-border statistics, financial-crime detection, health research across jurisdictions, supply-chain dependency mapping, and external audit of systems whose owners will not surrender their weights. It also enables an accountability gain that is easy to miss — a published privacy parameter makes a disclosure decision contestable in public, which is why the most-criticised deployment in the field is the only one anybody can criticise precisely.
• Adjacent Applied cryptography and hardware security; official statistics and disclosure-control practice; the audit and assurance professions, which supply the only working model for third-party verification without disclosure; and within this map AI Governance, Digital Citizenship, Digital Economies, Cognitive Liberty and Civic Technology.

Handwave “Differential privacy makes data anonymous.” It bounds how much any single record can change the distribution of an output, at a parameter somebody chose. At the largest deployment’s production setting the bound permits a likelihood ratio around three hundred million to one. Calling that anonymity is a category error; the honest statement is that the release has a published worst-case disclosure bound, which is more than any alternative offers and much less than the word anonymous implies.

Established “The census controversy proves differential privacy does not work.” The controversy is about a parameter and a counterfactual, not a mechanism. The critics’ strongest finding — that block-level noise damages small-population counts used in redistricting — is a finding about the accuracy cost at a chosen epsilon. The Bureau’s strongest reply — that the prior method’s disclosure risk and accuracy cost were never published — remains unrebutted. Both things are true and the argument is a policy argument.

Established “Federated learning means the data never leaves the device, so it is private.” Gradients are a function of the data and can be inverted; pixel-level and token-level recovery from shared gradients was demonstrated in 2019 and extended to realistic batches in 2020. Federated learning without secure aggregation and a formal privacy mechanism is a data-transfer decision, not a privacy guarantee, and production systems that take it seriously say so in their own documentation.

Frontier “Trusted execution environments give hardware-guaranteed security.” The guarantee is conditional on a microarchitecture that has been broken repeatedly, including attacks that recovered attestation keys and therefore broke every enclave rather than one, and on a vendor key hierarchy in a specific jurisdiction. Enclaves are a good answer to a curious cloud operator and a weak answer to a state or a funded competitor with physical access.

Handwave “Privacy-enhancing computation ends the privacy-utility trade-off.” It relocates the trade-off. Cryptographic families trade compute and institutional structure for input secrecy; statistical families trade accuracy for output secrecy; hardware families trade an assumption about a vendor for both. No family removes the trade-off, and any vendor claiming to has changed the subject from the guarantee to the marketing.