COVENANT LABS · THE KERNEL · MODEL ENCRYPTION PROTOCOL
Model Encryption Protocol
The host computes. The host learns nothing.
K.1 · THE PROTOCOL
Encrypted weights, untrusted compute
MEP encrypts model weights under a private key so inference can run on any compute infrastructure without trusting the provider with raw weights or data. The provider hosts and executes the model. It never holds plaintext weights, prompts, or outputs.
The transform is a permutation: reversible, like a deck shuffled in a specific pattern. With the key, the shuffle inverts. Without it, the weights read as random noise.
K.2 · OPERATION
Four stages, one key
Model parameters are permuted under the owner's private key. The encrypted model is uploaded to compute infrastructure; without the key the weights are unusable IP.
The SDK permutes each prompt under the same key before it leaves the owner's environment. The host receives ciphertext, never the original prompt.
Weights and inputs share one permutation, so the permuted input is symmetric with the permuted embedding space. Standard matrix multiplies and attention run unmodified on ciphertext. Nothing is decrypted on the host.
The encrypted output returns to the client, where the SDK inverts the permutation. Plaintext exists only at the edges.
The GPU runs normal inference. The symmetry between the permuted input and the permuted embedding space is what lets the model stay in the scrambled state end to end.
K.3 · SIGNAL PATH
What the host sees
PROMPT What is the capital of France?
|
| encrypt, client side
v
CIPHERTEXT xK9#mP2$vL8@nR5&qT3*wF7!zJ4%hB6
|
| inference in encrypted state, host GPU
v
CIPHERTEXT yN2$kM9@pL4#rQ8&tS6*vW3!xZ7%cF5
|
| decrypt, client side
v
ANSWER The capital of France is Paris.The provider executed the inference and never saw the question or the answer in plaintext.
K.4 · COST PROFILE
The overhead lives at deployment
Negligible. Encrypted models run at effectively the same speed as plaintext models.
Standard compute rates. No per-call premium.
Identical. Outputs are 1-1 with the baseline model.
One-time weight encryption, roughly 10 to 30 minutes depending on model size. Inference is transparent after that.
K.5 · ADJACENT APPROACHES
Where the trust actually sits
| APPROACH | MECHANISM | LIMIT |
|---|---|---|
| Fully homomorphic encryption | Computation on ciphertext, no decryption anywhere | 100-1000x overhead in speed and cost; large models become unusably slow |
| Secure enclaves (TEEs) | Hardware-isolated region decrypts and processes inside | Plaintext exists on the provider's hardware; trust moves to the enclave and its operator |
Homomorphic encryption has stronger theoretical guarantees than MEP; nothing built on it runs neural networks at production speed today. MEP trades some theoretical strength for a system that runs now.
Enclaves relocate the trust rather than removing it: your plaintext exists inside someone else's infrastructure. With MEP nothing is decrypted on the provider's side. The boundary is mathematical, held by the key, not by hardware or an operator.
K.6 · STATUS
Early research, usable now
MEP is in an early research state and already practical in production. The current version has known vulnerabilities we are working through; each iteration raises security and usability. The design goal, unlike homomorphic encryption, was to be practical and scalable from the first version.
The protocol will change, security will strengthen, capabilities will widen. The published record is Output 001.
K.7 · SPECIFICATION NOTES
Private key encryption with structure-preserving permutations
Keys stay with the owner. Never uploaded to Covenant or to compute providers.
Transformer architectures. Text only today; multimodal planned.
Near 1-1 swap for the OpenAI API
will@covenantlabs.ai