Thanks to visit codestin.com
Credit goes to vaultbytes.com

In active development FHE inference CKKS Silicon-validated (AWS F2) Conformance PCT filed

Glide: Confidential LLM inference on encrypted data

Generative LLM Inference Directly on Encryption — the model never sees the plaintext.

An end-to-end fully-homomorphic-encryption (CKKS) encrypted-transformer stack, paired with a silicon-proven hardware accelerator — all three compute engines running bit-exact on a real chip (AWS F2 / Xilinx VU47P). This is confidential AI inference for regulated data — not blockchain.

Silicon3 engines bit-exact on AWS F2
Bandwidth~430 GB/s HBM (measured)
AccuracyLlama-3.1-8B −1.00 MMLU
IPConformance standard — PCT filed
SchemeCKKS / RNS

What it is

Glide lets you run a transformer model over data that stays encrypted end to end. The data is encrypted before it leaves the owner, the computation happens directly on ciphertexts under FHE, and only the data owner can decrypt the result. The server — and VaultBytes — never see the plaintext. The heavy cryptographic operation (the CKKS key-switch and its number-theoretic transforms) is offloaded to a dedicated hardware accelerator so encrypted inference becomes practical, not just possible.

Data is encrypted on the client, computed under FHE on a server that never sees plaintext, then decrypted on the client. ciphertext ciphertext CLIENT encrypt SERVER compute under FHE CLIENT decrypt → result

🔒 The plaintext never leaves the client. The server computes on ciphertext only.

1

Encrypt at the source

The data owner encrypts inputs under CKKS on their own device. The key never leaves their control.

2

Compute on ciphertext

The transformer runs homomorphically on the server. The CKKS key-switch and NTTs are offloaded to the hardware accelerator. No plaintext is ever materialised.

3

Decrypt the result

Only the data owner's key can open the output. The provider sees ciphertext in, ciphertext out — and nothing in between.

How it is different

Most of the FHE industry is building confidential blockchain — encrypted smart contracts and on-chain privacy, largely on TFHE. Glide targets a different problem: encrypted AI inference for regulated data, on CKKS — the scheme suited to transformer maths. And where most accelerator efforts are still simulation or mid-tape-out, Glide's compute is proven bit-exact on real silicon today, and ships with a conformance standard to certify any implementation is correct.

What is validated today

Every result is checked bit-for-bit against a reference. We report what is measured and flag what is not yet built.

Chat-class model survives FHE

Llama-3.1-8B run under FHE lands within −1.00 MMLU point of plaintext — statistically insignificant. Encrypted attention and softmax in the ciphertext domain, on the real CKKS stack. A real chat-class model, not just an encoder demo.

Three engines on one chip — silicon

Key-switch, arithmetic, and bootstrap engines all run bit-exact on a real chip (AWS F2 / Xilinx VU47P), composed for a full encrypted matrix-vector product (43,072 checks, zero error). Not FPGA synthesis — measured silicon, timing closed.

Oracle-free conformance standard

A method to certify an FHE chip computes correctly without ever decrypting the data — the “what is a passing FHE chip” layer, on cross-substrate golden vectors (CPU→GPU→silicon). PCT patent filed.

Memory bandwidth, measured

Aggregate HBM read/write measured on silicon at ~430 GB/s — ~93% of datasheet across all 32 channels, zero errors. Every result is checked bit-for-bit; we report what is measured and flag what is not yet built.

Under the hood — the accelerator

An encrypted transformer layer needs three heavy cryptographic primitives. Glide puts all three on one chip, behind a single standard bus, and proves each one bit-exact on real silicon. A 2-bit address window (addr[15:14]) selects the engine; the host loads operands, pulses start, and reads the result back.

A host over AXI4-Lite drives three compute engines — key-switch, arithmetic, and bootstrap — which stream weights and keys from HBM. HOST C driver AXI4 -Lite addr[15:14] Key-switch array rotations / relin · P=8 lanes A55A PMM (arithmetic) mul / add / ct×pt / rescale B66B EvalMod (bootstrap) ciphertext refresh · Chebyshev E3A1 HBM weights + keys ~430 GB/s (measured)

Measured on AWS F2 / Xilinx VU47P silicon — real, not simulated

MetricValueNotes
Key-switch throughput (P=8)2,612 KS/s@100 MHz FPGA shell clock; 3.23× over P=2
Key-switch datapath area~22% DSPof VU47P, at P=8; data-independent cycle count
PMM arithmetic engine276 MHzFmax out-of-context; ~3.5% DSP
Three-engine timingMETfull CL closed on chip (WNS +0.055 / WHS +0.008)
Aggregate HBM bandwidth~430 GB/s426 RD / 434 WR, 32 channels, ~93% of peak, 0 err
Full encrypted matvec (y = W·x)0 errorcomposed across all 3 engines, 43,072 bit-exact checks
Accuracy under FHE (system)−1.00 MMLULlama-3.1-8B; statistically insignificant vs plaintext
Production width (D=4096)bit-exactfull CKKS transformer block on A100; argmax matches plaintext
Multi-GPU scaling3.79×4× L4 near-linear (giant-step); per-device bit-exact
Multi-user batching2.55×@B=8, 2nd user near-free; per-user bit-exact, isolation drift <4e-11

Silicon proof is at ring size N=1024. Production width (D=4096) is validated bit-exact on GPU.

The path to an ASIC

Three verified architectural levers collapse the memory-bandwidth demand of encrypted inference by orders of magnitude — turning a physically impossible workload into a memory-bound one an HBM3e ASIC can serve.

Naïve ≫1 PB / token Key, weight and NTT traffic streamed from memory — physically infeasible.
With 3 pillars ~20 GB / token NTT-BConv fusion + KSK trio-stack + on-chip diagonals — each probe-verified.
At HBM3e (projected) ~2 ms / token Memory-bound floor; projected on verified components, not yet fabricated.

Honest framing: the silicon numbers above are measured. The ASIC per-token latency is a projection built on individually-verified components — bandwidth measured on silicon; the three bandwidth-reduction pillars validated by simulation and GPU probes. Node-level area, power and clock require a synthesis run at node selection. The architecture is a go; it is gated on a fabrication partner, not on unproven science.

Does it scale to bigger models?

The encrypted key material is the main memory driver, and it grows gently with model size. The footprint below is calculated from the CKKS parameters — it shows how many commodity GPUs are needed to hold the keyset for a given model, not a latency measurement.

ModelKeyset footprintFits on
Llama-3.1-8B~33 GBsingle A100 / H100, or 2× L4 — accuracy measured −1.00 MMLU
Llama-3.1-70Bprojected~3× L4-class GPUs (key-memory sharding, calculated)
Llama-3.1-405Bprojected~4× L4-class GPUs (key-memory sharding, calculated)

8B is measured end-to-end under FHE today. 70B / 405B footprints are calculated from CKKS parameters; end-to-end accuracy at those sizes is not yet measured.

Who it is for

Organisations that need to run AI over data they are not allowed to expose in plaintext, even to the inference provider.

FinanceInference over customer / transaction data without decrypting it on the server.
HealthcareModels over patient records under strict confidentiality and data-residency rules.
Defense & governmentSovereign, confidential AI compute on sensitive data; air-gap-friendly trust model.

Status & roadmap

Glide is in active development. All three compute engines — key-switch, arithmetic, and bootstrap — run bit-exact on real silicon (AWS F2 / Xilinx VU47P), composed for a full encrypted matrix-vector product; the three-engine design closes timing on the chip. Aggregate HBM bandwidth is measured at ~430 GB/s (~93% of peak). Llama-3.1-8B accuracy under FHE is within −1.00 MMLU of plaintext. The conformance-verification standard is PCT-filed. Next: full encrypted-layer sequencing on silicon, and an HBM3e ASIC — the architecture is a go, gated on a fabrication partner, not on unproven science.

Stated plainly: compute, memory bandwidth, and accuracy are measured on real silicon today; production-scale throughput is batch-oriented and awaits an HBM3e ASIC. Silicon proof is at ring size N=1024; production width is validated bit-exact on GPU. The conformance standard is PCT-filed; a freedom-to-operate opinion and further filings are in progress — not granted patents. We would rather under-claim and show the receipts.

Frequently asked questions

What Glide is, how the encryption works, and what is validated today.

What is Glide?
Glide (Generative LLM Inference Directly on Encryption) runs LLM inference on fully encrypted data using fully homomorphic encryption (FHE) under the CKKS scheme. The model computes on ciphertexts, so the inference server never sees the plaintext input or output. It pairs an end-to-end encrypted-transformer software stack with a three-engine hardware accelerator — key-switch, arithmetic and bootstrap — proven bit-exact on real silicon.
How does the server run a model without seeing the data?
Inputs are encrypted on the client under CKKS before they are sent. The server evaluates the transformer homomorphically — arithmetic on ciphertexts produces an encrypted result without ever decrypting. Only the data owner's secret key can open the output. The provider sees ciphertext in and ciphertext out, and nothing in between.
How is Glide different from confidential-computing or TEE-based approaches?
Trusted execution environments (TEEs) decrypt data inside a hardware enclave, so the plaintext exists in memory and the trust rests on the enclave's integrity. Glide never decrypts on the server — security rests on the hardness of the underlying lattice problem, not on hardware attestation. It is also distinct from confidential blockchain: Glide targets encrypted AI inference for regulated data, not on-chain smart contracts.
What is validated today?
All three compute engines — key-switch, arithmetic, and bootstrap — run bit-exact on real silicon (AWS F2 / Xilinx VU47P), composed for a full encrypted matrix-vector product (43,072 checks, zero error); the three-engine design closes timing on the chip. Aggregate HBM bandwidth is measured at ~430 GB/s (~93% of peak). Llama-3.1-8B accuracy under FHE is within −1.00 MMLU of plaintext. Silicon proof is at ring size N=1024; production width is validated bit-exact on GPU. Full encrypted-layer sequencing on silicon and production-scale throughput (an HBM3e ASIC) are the next milestones.
What is the intellectual-property position?
Glide's core moat is an oracle-free conformance standard — a way to certify an FHE chip computes correctly without ever decrypting the data — with an international patent (PCT) filed. The stack is built on a proprietary polynomial ring; a freedom-to-operate opinion and further filings are in progress. These are pending applications, not granted patents.
Who is Glide for?
Organisations that must run AI over data they cannot expose in plaintext — even to the inference provider. Typical fits are finance (inference over customer and transaction data), healthcare (models over patient records under data-residency rules), and defense or government (sovereign, air-gap-friendly confidential compute).
Can I evaluate Glide or run a pilot?
Yes. Glide is in active development and we work with design partners under NDA. Tell us the model, the regulated data in scope, the trust model, and a rough timeline using the form below, and we reply within one business day.

Become a design partner

For NDA evaluations, design partnerships, and pilots on encrypted inference. Tell us the model, the regulated data, and the timeline — we reply within one business day.