Confidential execution without trusted worker hardware.
SyntheticCC separates secret handling from outsourced computation. The customer nucleus keeps plaintext, keys, private state, verification and release authority. Compatible worker CPUs and GPUs receive only the representation admitted for the job.
One authority boundary. Multiple ways to execute.
Owning execution capacity does not confer access to customer plaintext or release authority. Admission selects the profile that covers the named secrets and every operation in the application graph.
Customer
Data, model, recipient, purpose, budget and permitted disclosure.
Nucleus
Admit, bind, verify, commit and release inside the accepted customer boundary.
Swarm
Ordinary silicon, protected hardware, multiparty participants or a hybrid route.
Protection follows the complete computation.
| Profile | Worker representation | Trusted boundary |
|---|---|---|
| Customer-keyed encrypted execution | Encrypted customer inputs and state, with approved public operands. | Keys, verification, decryption and uncovered private stages stay customer-side. |
| Prepared masked execution | Freshly masked values for eligible public-weight linear operations. | Secret preparation and unmasking remain inside an accepted boundary. |
| Secure multiparty execution | Protected shares processed across independently administered participants. | The roster enforces the declared corruption threshold and control domains. |
| Attested protected execution | Private values inside approved hardware-protected components. | Fresh attestation, approved code and recipient binding establish the boundary. |
Public-weight encrypted execution does not provide model secrecy. A workload with private weights must select a profile that protects both the model and customer data.
Assume the operator controls the box.
The model gives the operator root access, host and GPU memory inspection, software replacement, retained traffic and the ability to alter, replay, delay or withhold messages.
Memory inspection
The worker holds protected values, public operands and declared metadata.
Kernel replacement
Bindings and computation checks reject substitution or incorrect evaluation.
Response replay
Session, input, attempt, key period and policy identify the current response.
Service refusal
Failure cannot force a weaker execution route or unchecked release.
Protect the model and the customer input under one admitted graph.
The inference adapter names the boundary for tokenization, embeddings, projections, attention, activations, KV state, sampling, streaming and telemetry. A private stage cannot fall back silently to ordinary plaintext execution.
Model owner
Approves model identity, permitted operation and output policy.
SyntheticCC
Admits the graph, protects weights and state, checks the response and applies release policy.
Customer
Contributes private prompt and context, then receives only the permitted answer.
Exact public-weight scoring on an ordinary GPU.
REF-LIN-01 accepts one private 64-feature signed integer vector and an approved public 192 × 64 matrix. The worker evaluates the linear map under BFV encryption. The customer verifies returned ciphertexts before decryption and receives 192 checked integer scores.
- Customer GPU
- Not required
- Worker
- Compatible ordinary CUDA GPU
- Arithmetic
- Exact bounded integer
- Check bound
- At most 2⁻⁷⁶ per returned component per check
- Visible to worker
- Public weights, dimensions, timing and ciphertext sizes