Simplified illustration · invented question and data
Follow one AI question: what protects it, step by step.
To answer a question, an AI service normally decrypts it, so whoever runs the server can read it. Two techniques change that: homomorphic encryption (HE) for small, exact tasks, and a trusted execution environment (TEE) for the model itself. Five steps show where each one fits.
Five steps
The question (invented)Under which rules may we onboard Kestrelmoor Handels AG?
01The question
What protects it: homomorphic encryption (HE)
The company in the question is checked without being revealed.
You write the question in your browser; the company it names is encrypted there and checked against a sanctions list with homomorphic encryption, so the service compares it without decrypting it.
Your browserUnder which rules may we onboard Kestrelmoor Handels AG?9d2a 51f0 7c…Your key stays here.Result: not on the list
9d2a 51f0 7c…30be 8f42 a6…only the encrypted name travels
The screening serviceSanctions list (sample)9d2a 51f0 7c…compares with the list, still encrypted30be 8f42 a6…
Whoever runs the server sees:an encrypted query, and that one check was made
Demo · sample listBlindScreenThis step on its own: check a name against a list under encryption. Exact spelling only.Try BlindScreen
02The search
What protects it: homomorphic encryption (HE)
The model’s document search finds notes without seeing the words.
Before it answers, the model searches its notes for context (retrieval): the keywords are encrypted, and the service finds the matching notes with homomorphic encryption without seeing the words.
Your browseronboardingsanctionse4b7 0a19 6d…Your key stays here.Notes 3 and 7 match
The search serviceNotes (sample)e4b7 0a19 6d…searches the notes, keywords still encrypted51c9 d07e 2f…
Whoever runs the server sees:encrypted keywords, and that one search was made
ComingVaultSearchThis step on its own: find which notes contain a keyword, without the service seeing the keyword. Exact keywords only.
03The answer
What protects it: a trusted execution environment (TEE)
The model writes the answer in hardware-isolated memory.
Homomorphic encryption cannot run a language model today: it is far too slow and suits only small, exact tasks, so this step needs a trusted execution environment, where the model runs in hardware-isolated memory and the machine’s host sees that memory only encrypted.
Your browserThe question + notes 3 and 7
4f9c 0e7a d2…encrypted connection
The machine
Hardware-isolated memoryLanguage modelreads the question and the notes, writes the answer
memory, as the host sees it:7ae1 0c55 f3…
Whoever runs the server sees:encrypted memory
What TAIA can show“Planned: the demo service runs on an AMD SEV confidential node, per GKE’s node label, checked 14:05 UTC.” (example)
What TAIA cannot show yetAn independent check (attestation) of the machine.
A TEE keeps the machine’s host out; it does not hide the question from the model inside. Confidential AI, this step as a service, is not available yet.
ComingConfidential AIThis step as a service: a language model answers your question on a confidential node. Not available yet.
04The return
What protects it: encryption only your browser can open
The answer comes back, and only you open it.
The answer leaves the isolated memory encrypted for your browser alone, travels back that way, and only your browser opens it with your key.
Your browserYour key stays here.Answer: three rules apply, with their sources
c7d0 2e58 b1…only the encrypted answer travels
The machine
Hardware-isolated memoryc7d0 2e58 b1…the answer, encrypted for your browser
Whoever runs the server sees:an encrypted answer on its way back
05The decision and the audit
What protects it: a record of the grounds (Atelier), and homomorphic encryption for the audit (HE)
The decision is recorded; an auditor checks without seeing the data.
When you decide, what the decision rests on is recorded (TAIA Atelier keeps such records); later an auditor can check the encrypted records with homomorphic encryption without seeing the data.
YouDecision: onboard, with conditionsrests on: the list check, notes 3 and 7, the answer
a91f 4c08 e3…the record, encrypted
The recorda91f 4c08 e3…6b2e 90d4 17…an auditor’s check runs over them, still encryptedThe auditor’s key opens the result.Total: 12 decisions recorded
Whoever runs the server sees:encrypted records, and that one audit check was made
TAIA Atelier’s records do not use homomorphic encryption today; the audit under encryption, PrivateAudit, is coming.
ComingPrivateAuditThis step on its own: a total over encrypted records; the service adds them without opening them, and only the key holder reads the total.
Simplified illustration. The locked text is a picture, not real ciphertext; the question, the company, the notes and the answer are invented.
Coming: TAIA Confidential ScreeningStep 1 as a product, being built now: it will check a name against the OFAC and EU sanctions lists without the service seeing the name.
What you can try now, what is coming, and the limits.
Now
BlindScreen (step 1) runs homomorphic encryption in your browser and on TAIA’s service, with a sample list. Exact spelling only.
Coming
TAIA Confidential Screening: the step 1 check against the OFAC and EU sanctions lists. Then VaultSearch (step 2), Confidential AI (step 3) and PrivateAudit (step 5). None of them is available yet.
Limits
No language model under homomorphic encryption: it is far too slow for that today. For the model’s machine, TAIA can show only what GKE’s node label says, not an independent check (attestation). Matching under encryption needs the exact spelling.
Simplified illustration · invented question and data. This page sends nothing and stores nothing.