Today, “private” usually means “promised”
When you send a prompt to a hosted model, at least three parties can usually read it: the service you use, any router or gateway in between, and the cloud provider running the model.
Privacy policies and contracts limit what those parties may do with your data. They don’t limit what they can do. Our research asks how much of that trust can be replaced with something you can check, and what it costs in speed, price and model quality to do so.
We write the threat model down first, name who must still be trusted, and measure the result in a way someone else can reproduce.
Five ways to protect inference
No approach removes trust entirely. The useful question is what each one hides, from whom, and who you still rely on.
| Approach | What it hides | Who you still trust | Main cost |
|---|---|---|---|
| Trusted execution environmentsOur research focus | Data in use, from the host operating system and the cloud operator. | The chip vendor, the firmware and the attestation chain. | Specific hardware, exposure to side channels and some performance overhead. |
| Anonymised API access | Who sent a request, plus identifiers removed by redaction or pseudonymisation. | The relay operator. The model provider still sees the remaining content. | Low. Residual identity and metadata leakage has to be tested case by case. |
| Fully homomorphic encryption | Data from everyone who performs the computation. | The cryptography, and whoever holds the decryption key. | High latency, large ciphertexts and limits on model size and operations. |
| Multi-party computationOur research focus | Data from each individual party taking part in the computation. | That the parties do not collude, and the correctness of the protocol. | Communication between parties, and engineering work to run fast on GPUs. |
| On-premises and local inference, with data partitioningOur research focus | Sensitive data from every outside provider. It stays on your own servers or devices, and only partitioned, less sensitive parts are sent out. | Your own operators and facilities, and the rules that decide which data may leave. | Buying and running the hardware, and limits on model size where it runs locally. |
Our research combines the highlighted rows
Data is partitioned so that the most sensitive parts never leave on-premises or local hardware. What does leave is processed with multi-party computation, so that no single party ever holds readable data, and trusted execution environments keep each party’s share isolated on standard GPU servers. The aim is the speed, scale and cost of ordinary cloud inference, with a cloud operator that cannot see the data short of physically breaking into the hardware.
What we’re working on
Current lines of research we support.
MPC on GPUs
Driving GPU computation through multi-party computation, so encoded data can be processed at practical speed.
Hardware isolation
Isolated execution, remote attestation and key control, with the trust placed in vendors, firmware and software written down.
Anonymised API access
Redaction, pseudonymisation and relay designs, tested for what identity and metadata still leak and what providers can still observe.
Encrypted inference
Fully homomorphic encryption prototypes that measure latency, ciphertext expansion, model constraints and output quality.
On-premises and local inference
Partitioning data so the most sensitive parts stay on your own servers or devices, and only what is safe to share goes to the cloud.
Research project: IPRC. An early-stage project exploring private inference on encoded data. It isn’t a product yet.
Visit iprc.aiResearch feed. 88 papers, reference documents and cases on private AI, ranked by relevance, each with a summary and its limits.
Open the research feedDirectories. 76 European machine-learning research groups and funders, and 20 cryptography audit firms with 170 of their key public works, each linked to its evidence.
Browse the directoriesWhat the work can produce
Depending on the collaboration, research work can produce any of the following.
Threat models
What a design protects, from whom, and which assumptions it rests on.
Comparisons
Architectures side by side, with trust boundaries drawn explicitly.
Benchmarks
Latency, cost and output quality, with the setup needed to rerun them.
Prototypes
Working private-inference systems that can be tested on real tasks.
Bring us a question worth checking.
Research collaborations
Discuss researchThreat models, benchmarks and private-inference prototypes.
Clients
Request a demoDemos of regulatory and market intelligence monitoring, and workflow projects.