Teach it.
Give it a text example and a category. The text encoder turns the example into numbers, which are encrypted and added to the model. A cryptographic proof checks the update before it is saved.
Encrypted machine learning
Learning while
encrypted.
This prototype sorts software issues by learning from examples. Its memory stays encrypted while examples are added, old ones are removed, and questions are answered.
You can keep teaching it and restart it without losing the model. The latest version answers across eight categories in one encrypted calculation.
Follow a learning sessionWatch the model change.
Choose a stage to see which examples the model remembers and how it answers the same question. Both versions completed the full session.
Saved learning session
Download the results This page displays a completed run. The learner itself runs locally.
How the app works
The browser sends jobs to a local service. Closing the tab leaves the job running; restarting the service lets it continue from the last completed step.
Ask a question.
The model compares the question with each category’s examples. The service checks the proofs for every category before decrypting the scores and returning an answer.
Keep teaching.
Each category remembers its eight most recent examples. When a ninth arrives, the oldest example’s encrypted contribution is subtracted and the new one is added.
Making the proofs faster
The encryption and the earlier proof system used different arithmetic. We built a new prover that works in the encryption’s own number system, avoiding the translation between them.
Updating the encrypted memory
new=previous+fresh−oldestmod q
The new backend handles a complete memory update and the eleven stages of a linear similarity calculation. In the first full trial, it produced exactly the same encrypted outputs as the original implementation.
The model also uses a simpler score: average similarity instead of average squared similarity. Both versions gave the same aggregate accuracy on our small text test.
Time to prove and check
one complete operation
These measurements come from one worker on a computer running other tasks. The query row covers one category.
| Operation | Make proofs | Check proofs | Proof size |
|---|---|---|---|
| Replace an example 32 proofs | 2.61 s | 1.20 s | 5.72 MB |
| Query one category 352 proofs | 45.05 s | 14.20 s | 64.34 MB |
The two versions
The earlier two-category query took 1,103 seconds. The new one took 113 seconds. Both the scoring rule and the proof settings changed between versions.
Checking is still costly.
Computing the encrypted answer for one category took 0.37 seconds, while checking its proofs took 14.20 seconds. For a model this small, repeating the calculation is still cheaper than verifying the proof.
Technical details
The backend uses the four BFV fields directly, with an 8× low-degree extension, 64 FRI queries, quartic challenges and SHA-256 commitments. Its operands are public ciphertext coefficients. The numerical soundness bound for this profile is still being worked out.
A Lean theorem connects the FIFO update to all eleven linear stages. Proof extraction and the reconstruction of public inputs still need to be connected to the native implementation. Backend code and mathematics ↗
What did more examples change?
We wrote twelve teaching examples and twenty test issues. The model had to decide whether each issue concerned proof integrity or runtime performance.
Correct answers out of 20Calculated without encryption
Initial
20/20
More teaching
19/20
Old examples replaced
18/20
The linear and squared scoring rules got these same totals. Leaving the initial model unchanged kept its score at 20/20.
Accuracy fell as the examples changed.
The initial examples already classified all twenty test issues correctly. Later teaching changed the model, but it made two of those answers worse.
We calculated this twenty-issue comparison directly. The encrypted learning session asked one of those issues four times and returned the same numerical scores as the direct calculation at every stage.
Eight categories
in one calculation
We then changed the way the encrypted memory is arranged. Instead of giving each category its own ciphertext, we fit eight category totals into one ciphertext. A query computes all eight scores together, dividing each total by its number of examples.
A separate nine-category test completed eighteen teachings, three queries and a restart in about 8 minutes 19 seconds. It also replaced two old examples. All the returned scores matched the direct calculation.
The first query covered eight categories in 88 seconds. Adding the ninth required a second encrypted batch; that query took 163 seconds. A fresh query after restart took 120 seconds and returned the same scores and ranking.
After that run, we used the browser to teach it a new network example and ask a new question. It answered network_transport, with all nine category scores matching the direct calculation. Teaching took 14 seconds and the query took 140 seconds.
Removing the master key
Today, the person holding the key can decrypt the whole memory.
The application checks proofs before it decrypts an answer. But the key also works outside the application, so its holder can bypass those checks. The text encoder runs outside encryption too.
Our goal is a system whose remaining keys allow learning and answering, without giving anyone unrestricted access to its internal state. That requires a different cryptographic construction around the working learner.
Encrypted
memory
memory
Check proofs → decrypt scores → answer
Through the applicationUse the key → decrypt the memory
Also possible todayCode and results
The app runs locally in the research workspace. The repository includes setup instructions, the test texts, and the results shown here.