Audrey Woods, MIT CSAIL Alliances | July 20,2026
Most people realize their search history is not private, yet few consider the consequences. We go to Google for medical symptoms or mental health questions. We ask AI models for parenting advice or about private hobbies. We shop online, generally overlooking how much information is given, freely, to advertisers and companies about habits, preferences, household demographics, financial status, and more. This data can be sold, folded into a training set with minimal privacy guarantees, or even leaked in a breach. Most of us have accepted this as the cost of using the web.
Alexandra Henzinger has not. As a PhD student at MIT CSAIL, Henzinger builds search engines, recommendation systems, and cryptographic protocols that function without ever needing to see the data they run on. Working at the intersection of security, systems, and cryptography, she imagines a world where privacy is not only protected but guaranteed.
A SEARCH ENGINE THAT NEVER LEARNS YOUR QUERY
The idea of private information retrieval is not new. The subject was originally introduced in 1998, and computing on encrypted data has been around since 2009 when the first example of a Fully Homomorphic Encryption (FHE) scheme was published. Homomorphic encryption solved a classic cryptography problem by allowing a server to compute on encrypted data without ever needing to decrypt it, and this breakthrough led to a flurry of excitement around the implications for privacy and security. But scaling the idea proved difficult.
“In theory, we no longer need to be revealing all of our secrets to web servers, the apps on our phones, and everything that we use,” Henzinger says. “But, in practice, computing on encrypted versions of our data is still wildly intractable.”
Then came Tiptoe, a private web search engine Henzinger created along with MIT CSAIL Professor Nickolai Zeldovich, Stanford Professor Emma Dauterman, and UC Berkeley Professor Henry Corrigan-Gibbs (previously Henzinger’s advisor at CSAIL). Based on homomorphic encryption, Tiptoe preserves search privacy by encrypting a query before sending it to the server, which then computes directly on the encrypted query and sends back an encrypted result. Only the user can decrypt and read the answer.
Tiptoe’s key insight is that private web search can be reframed as a nearest-neighbor search problem. Instead of matching keywords in the traditional way, Tiptoe uses machine learning to turn both the user’s query and the server’s webpages into vectors. Similar meanings then map to nearby vectors, enabling an accurate and still entirely private search. Even better, the encryption scheme behind Tiptoe is, according to current knowledge, post-quantum secure “in the sense that it's based on a cryptographic assumption that quantum computers are not known to break.” This encryption scheme is based on SimplePIR, another project Henzinger led. SimplePIR is a fast single-server private information retrieval protocol utilizing a lattice-based cryptographic assumption widely studied as a candidate for post-quantum security, developed in MIT CSAIL Professor Vinod Vaikuntanathan’s group.
The protocols Henzinger built for Tiptoe and SimplePIR are already active in industry. Apple’s Enhanced Visual Search, the feature that labels landmarks in your photos, uses private nearest neighbor search to match an image against a database of places without uploading every picture to Apple’s servers. Henzinger says, “It’s pretty cool to see a company out there really pushing the privacy agenda, and showing that it’s possible to defend it in the real world, even at scale.”
While a privacy-preserving alternative to Google is not yet available, Henzinger explains that her research has proven it is possible. “What we're showing is that if you carefully build this whole system and change every level of the stack—the encryption scheme, the algorithm, the system—then we can make this work, and we can protect our users and protect their interests.”
INCENTIVES & FUTURE WORK
One drawback of Tiptoe is that users actually benefit from some amount of personalization, like Netflix learning what movies a customer enjoys or the also-bought section on Amazon. To address this, Henzinger’s recent project Nudge leverages cryptography and differential privacy to train a recommender model without ever exposing individual users’ preferences to the servers, therefore offering a privacy-preserving way to recommend related products and reach customers without needing their private information.
Another challenge is business alignment. Companies like Google have become fantastically wealthy in part due to their ability to use and sell personal data. “A lot of money is generated from personalized advertising, which requires knowing exactly what we’re searching for and clicking on,” Henzinger admits. “It seems almost inherent to this whole ecosystem, where we get digital services for free because the data that we reveal in the process is valuable.”
She offers two reasons to be hopeful. First, she is "optimistic that users will come to care about their privacy, as data generation and data collection become more pervasive yet. For example, today's AI models and chatbots are learning more and more fine-grained information about us, so we had better move towards protecting that information and protecting ourselves.” The companies holding these giant datasets rarely suffer the consequences of a leak, which for Henzinger is a problematic gap in governance. “Users are the ones who have to deal with it if our data was in a breach.” She believes that outreach, policy change, and education will help “the general public to understand some of these trade-offs that we've slid into making, and understand that they're actually not needed at all. There's no technological limitation. We have computer algorithms and systems that can process our data and provably protect it too.”
On the other hand, “this dream of protecting our privacy doesn't even need to be in tension with the business model of selling ads.” With Henzinger’s work, “you can imagine a whole private advertising ecosystem.” The technology is there to do everything under encryption, where a company could show a targeted ad to a user without the search engine or ad provider knowing exactly who that is, and then the user could choose to engage with the ad—and give the ad provider revenue—without ever surrendering their privacy. While there are challenges, like measuring ad conversion rates, Henzinger is excited to see where the field goes next. “Everything that a computer can do today, a computer could also do securely—that is, under encryption. It's just a matter of making the technology fast and scalable enough.”
THE ANCIENT IMPORTANCE OF PRIVACY
For Henzinger, the field of privacy and security are inherently “about putting users in control of their data,” an aspect of her work that she finds particularly fulfilling. “We need to protect our users. We need to make sure they’re in control over their data.” As data and power are concentrated in the hands of big tech companies who are “setting the rules themselves,” she is motivated to give everyday users agency over their information and online activity.
The protection of privacy is far from a new problem. As Henzinger points out, there has always been a tension between asking important legal, medical, or personal questions and revealing sensitive information. That’s why the Hippocratic Oath laid out the importance of confidentiality back in 400 BC. But now, with the emergence of privacy-preserving technology, questions can be asked and answered under encryption, offering “both perfect functionality and total privacy.” In a world where daily life increasingly depends on technology, it’s critical to translate old values like the Hippocratic Oath into the modern age. With technology like TipToe, Nudge, and SimplePIR, it’s even possible to strengthen them. “This is a case where computers can give us more protections than are possible in the physical world, so we ought to be building towards a future that takes advantage of this.” That’s what Henzinger aims to do.
Visit Alexandra Henzinger’s website to learn more.
