Generative LLM Inference Directly on Encryption — the model never sees the plaintext.
An end-to-end fully-homomorphic-encryption (CKKS) encrypted-transformer stack, paired with a silicon-proven hardware accelerator — all three compute engines running bit-exact on a real chip (AWS F2 / Xilinx VU47P). This is confidential AI inference for regulated data — not blockchain.
Glide lets you run a transformer model over data that stays encrypted end to end. The data is encrypted before it leaves the owner, the computation happens directly on ciphertexts under FHE, and only the data owner can decrypt the result. The server — and VaultBytes — never see the plaintext. The heavy cryptographic operation (the CKKS key-switch and its number-theoretic transforms) is offloaded to a dedicated hardware accelerator so encrypted inference becomes practical, not just possible.
🔒 The plaintext never leaves the client. The server computes on ciphertext only.
The data owner encrypts inputs under CKKS on their own device. The key never leaves their control.
The transformer runs homomorphically on the server. The CKKS key-switch and NTTs are offloaded to the hardware accelerator. No plaintext is ever materialised.
Only the data owner's key can open the output. The provider sees ciphertext in, ciphertext out — and nothing in between.
Most of the FHE industry is building confidential blockchain — encrypted smart contracts and on-chain privacy, largely on TFHE. Glide targets a different problem: encrypted AI inference for regulated data, on CKKS — the scheme suited to transformer maths. And where most accelerator efforts are still simulation or mid-tape-out, Glide's compute is proven bit-exact on real silicon today, and ships with a conformance standard to certify any implementation is correct.
Every result is checked bit-for-bit against a reference. We report what is measured and flag what is not yet built.
Llama-3.1-8B run under FHE lands within −1.00 MMLU point of plaintext — statistically insignificant. Encrypted attention and softmax in the ciphertext domain, on the real CKKS stack. A real chat-class model, not just an encoder demo.
Key-switch, arithmetic, and bootstrap engines all run bit-exact on a real chip (AWS F2 / Xilinx VU47P), composed for a full encrypted matrix-vector product (43,072 checks, zero error). Not FPGA synthesis — measured silicon, timing closed.
A method to certify an FHE chip computes correctly without ever decrypting the data — the “what is a passing FHE chip” layer, on cross-substrate golden vectors (CPU→GPU→silicon). PCT patent filed.
Aggregate HBM read/write measured on silicon at ~430 GB/s — ~93% of datasheet across all 32 channels, zero errors. Every result is checked bit-for-bit; we report what is measured and flag what is not yet built.
An encrypted transformer layer needs three heavy cryptographic primitives. Glide puts all three on one chip, behind a single standard bus, and proves each one bit-exact on real silicon. A 2-bit address window (addr[15:14]) selects the engine; the host loads operands, pulses start, and reads the result back.
| Metric | Value | Notes |
|---|---|---|
| Key-switch throughput (P=8) | 2,612 KS/s | @100 MHz FPGA shell clock; 3.23× over P=2 |
| Key-switch datapath area | ~22% DSP | of VU47P, at P=8; data-independent cycle count |
| PMM arithmetic engine | 276 MHz | Fmax out-of-context; ~3.5% DSP |
| Three-engine timing | MET | full CL closed on chip (WNS +0.055 / WHS +0.008) |
| Aggregate HBM bandwidth | ~430 GB/s | 426 RD / 434 WR, 32 channels, ~93% of peak, 0 err |
| Full encrypted matvec (y = W·x) | 0 error | composed across all 3 engines, 43,072 bit-exact checks |
| Accuracy under FHE (system) | −1.00 MMLU | Llama-3.1-8B; statistically insignificant vs plaintext |
| Production width (D=4096) | bit-exact | full CKKS transformer block on A100; argmax matches plaintext |
| Multi-GPU scaling | 3.79× | 4× L4 near-linear (giant-step); per-device bit-exact |
| Multi-user batching | 2.55× | @B=8, 2nd user near-free; per-user bit-exact, isolation drift <4e-11 |
Silicon proof is at ring size N=1024. Production width (D=4096) is validated bit-exact on GPU.
Three verified architectural levers collapse the memory-bandwidth demand of encrypted inference by orders of magnitude — turning a physically impossible workload into a memory-bound one an HBM3e ASIC can serve.
Honest framing: the silicon numbers above are measured. The ASIC per-token latency is a projection built on individually-verified components — bandwidth measured on silicon; the three bandwidth-reduction pillars validated by simulation and GPU probes. Node-level area, power and clock require a synthesis run at node selection. The architecture is a go; it is gated on a fabrication partner, not on unproven science.
The encrypted key material is the main memory driver, and it grows gently with model size. The footprint below is calculated from the CKKS parameters — it shows how many commodity GPUs are needed to hold the keyset for a given model, not a latency measurement.
| Model | Keyset footprint | Fits on |
|---|---|---|
| Llama-3.1-8B | ~33 GB | single A100 / H100, or 2× L4 — accuracy measured −1.00 MMLU |
| Llama-3.1-70B | projected | ~3× L4-class GPUs (key-memory sharding, calculated) |
| Llama-3.1-405B | projected | ~4× L4-class GPUs (key-memory sharding, calculated) |
8B is measured end-to-end under FHE today. 70B / 405B footprints are calculated from CKKS parameters; end-to-end accuracy at those sizes is not yet measured.
Organisations that need to run AI over data they are not allowed to expose in plaintext, even to the inference provider.
| Finance | Inference over customer / transaction data without decrypting it on the server. |
|---|---|
| Healthcare | Models over patient records under strict confidentiality and data-residency rules. |
| Defense & government | Sovereign, confidential AI compute on sensitive data; air-gap-friendly trust model. |
Glide is in active development. All three compute engines — key-switch, arithmetic, and bootstrap — run bit-exact on real silicon (AWS F2 / Xilinx VU47P), composed for a full encrypted matrix-vector product; the three-engine design closes timing on the chip. Aggregate HBM bandwidth is measured at ~430 GB/s (~93% of peak). Llama-3.1-8B accuracy under FHE is within −1.00 MMLU of plaintext. The conformance-verification standard is PCT-filed. Next: full encrypted-layer sequencing on silicon, and an HBM3e ASIC — the architecture is a go, gated on a fabrication partner, not on unproven science.
Stated plainly: compute, memory bandwidth, and accuracy are measured on real silicon today; production-scale throughput is batch-oriented and awaits an HBM3e ASIC. Silicon proof is at ring size N=1024; production width is validated bit-exact on GPU. The conformance standard is PCT-filed; a freedom-to-operate opinion and further filings are in progress — not granted patents. We would rather under-claim and show the receipts.
What Glide is, how the encryption works, and what is validated today.
N=1024; production width is validated bit-exact on GPU. Full encrypted-layer sequencing on silicon and production-scale throughput (an HBM3e ASIC) are the next milestones.For NDA evaluations, design partnerships, and pilots on encrypted inference. Tell us the model, the regulated data, and the timeline — we reply within one business day.