AI Privacy Researchers Are Solving the Wrong Problem

A Bluesky thread dissecting trusted execution environments — the same technology arXiv researchers are currently celebrating as a privacy breakthrough — made a pointed observation this week: TEEs don't protect your data, they process it. Whatever meaning gets extracted from that processing is governed by Meta's or Google's business model, not by the elegance of the architecture. The thread got traction not because it was technically novel but because it named something people had felt without having language for. Privacy-preserving AI is, increasingly, a phrase that technically literate skeptics read as marketing dressed in cryptography.

The gap between what's being published and what's being believed has rarely been wider. Research circulating this week treats privacy as an engineering problem with engineering solutions: on-device inference, federated learning, differential privacy. The framing is optimistic, almost serene. On Bluesky, the mood is something else entirely — sharpened by a week that included reports of the FBI clarifying it can conduct mass surveillance without AI (rendering AI-specific restrictions somewhat beside the point) and a growing gig economy in which people sell their photos, videos, and location data to model trainers for small cash payments. That last development introduced a figure the conversation has been missing: not the passive victim of surveillance, but the person economically pressured into selling themselves.

Anthropic's public objection to the FBI's surveillance framing got noted on Bluesky, but the response was closer to exhaustion than solidarity. The dominant read was that corporate resistance to government overreach is structurally too weak to matter — that labs objecting to surveillance policy is a gesture, not a constraint. What's striking about this is how it forecloses the usual reassurance. When researchers offer technical fixes and the public is skeptical of technical fixes; when companies push back on government access and the public is skeptical of companies; the conversation has nowhere to go except toward a kind of distributed distrust that no single actor can address.

The people in these threads have read the papers. They understand what federated learning does. Their skepticism isn't ignorance of the technical work — it's a judgment that the technical work is answering a question nobody asked, while the question that matters (who controls what happens after the model runs) stays unanswered. Research will keep advancing privacy-preserving architectures. The public will keep not caring, because the breach they're worried about isn't in the cryptography. It's in the terms of service.