Secure Multiparty Computation

Secure multiparty computation (SMPC, sometimes written MPC) lets a group of parties jointly compute a function on their private inputs without any party learning anything about the other parties' inputs beyond what the output itself reveals.

A classic example: three employees want to know whether they all earn above a certain salary threshold, without any of them learning each other's actual salaries. With SMPC, they can compute the answer (yes or no, or even the average salary) while keeping individual salaries completely private from one another.

In AI, SMPC solves a more powerful version of the same problem. Multiple hospitals want to train a diagnostic model on their combined patient data. Multiple banks want to compute a cross-institution fraud signal. Two companies want to find common customers without sharing their full customer lists. SMPC makes all of these possible without any party revealing their raw data.

Two properties must hold simultaneously. Correctness: the output of the protocol is the correct result of the function on the actual inputs. Privacy: each party learns only the output, not any other party's input. In strong versions, privacy holds even if some parties are actively trying to cheat.

Every SMPC protocol is designed to be secure against a specific type of adversary. The adversary model determines how much an attacker can deviate from the protocol and what they can learn. Choosing the wrong model for your deployment scenario can result in a protocol that is theoretically secure but practically broken.

Most production SMPC deployments use semi-honest protocols combined with external trust mechanisms: legal agreements, participant vetting, and audit logging. The SPDZ protocol (Section 08) is one of the few practical protocols that provides security against malicious adversaries with acceptable performance overhead.

Secret sharing is the core building block of most arithmetic SMPC protocols. It allows a secret value to be split into multiple pieces called shares, distributed to different parties, such that no single share reveals anything about the secret, but a sufficient number of shares together can reconstruct it.

Additive secret sharing is the simplest scheme. To share a secret value s among three parties, pick two random values r1 and r2. Set the third share as s minus r1 minus r2. Each party receives one share. Each share looks like a random number. But the sum of all three shares equals the original secret s.

Shamir secret sharing (Shamir 1979) is a more flexible approach that uses polynomial interpolation. A degree k-1 polynomial is constructed with the secret as the constant term and random coefficients for higher terms. The n shares are points on this polynomial. Any k of the n shares can reconstruct the polynomial and thus the secret (via Lagrange interpolation). Fewer than k shares reveal nothing about the secret.

Shamir sharing supports a threshold structure: a secret can be reconstructed by any k of the n parties, not just all of them. This is useful when some parties may be unavailable. The parameter k is called the reconstruction threshold. Setting k equal to n gives all-or-nothing reconstruction (all parties must cooperate). Setting k to the majority gives tolerance to a minority of dropouts or malicious parties.

The power of secret sharing for SMPC comes from the ability to compute on shared values. Two key operations make arbitrary computation possible: addition and multiplication. Addition is free. Multiplication is where the communication cost lives.

Garbled circuits, introduced by Andrew Yao in 1982, solve the two-party computation problem for any Boolean function. They allow two parties to evaluate a circuit jointly in a single round of communication (after setup) with no information leakage about either party's inputs.

The intuition: instead of computing the circuit on real values, the garbler encrypts the entire circuit. Each wire in the circuit gets two random labels instead of the actual values 0 and 1. The garbler produces an encrypted version of each gate's truth table so that an evaluator who holds the correct input labels can compute the output labels, without ever knowing whether a wire carries a 0 or a 1.

Garbled circuits are particularly efficient for Boolean functions with a fixed circuit structure and functions where one party's input is much larger than the other's. For arithmetic circuits (addition, multiplication over integers), secret-sharing approaches like SPDZ are typically more efficient.

Oblivious transfer (OT) is a two-party protocol where a sender holds two messages and a receiver wants exactly one of them. After the protocol, the receiver gets their chosen message, the sender does not learn which message was chosen, and the receiver does not learn the other message. It is a primitive so fundamental that it is called a "complete" primitive for SMPC: any secure two-party computation can be built from OT alone.

OT is used in garbled circuit protocols to give the evaluator their input wire labels without the garbler learning which input was chosen. For each input bit, one OT is run: the garbler is the sender (holding the two possible wire labels for that bit), and the evaluator is the receiver (choosing the label corresponding to their actual input bit).

OT extension (Ishai, Kilian, Nissim, Petrank 2003) makes OT efficient at scale. Running n independent OTs using public-key cryptography is expensive. OT extension uses a small number of public-key OTs (typically 128) to bootstrap millions of cheap symmetric-key OTs. This is what makes garbled circuits and SMPC protocols practical for large inputs like model weights.

Beaver triples (introduced by Donald Beaver in 1992) are the standard technique for handling multiplication in secret-sharing SMPC protocols. They split multiplication into two phases: an expensive offline phase that generates random triples, and a cheap online phase that uses those triples to compute the actual product.

The critical insight: (x minus a) and (y minus b) are safe to reveal. Because a and b are uniformly random, the masked values look uniformly random too. An observer who sees (x minus a) learns nothing about x. But the parties can still use this masked value together with the precomputed triple to get the correct result.

This offline/online separation is what makes protocols like SPDZ fast in practice. The expensive part (generating triples) is done when inputs are unknown and servers are idle. The online phase, which runs on actual sensitive data, uses only cheap local operations and one round of communication per multiplication.

SPDZ (pronounced "Speedz") is the most widely used practical SMPC protocol for arithmetic circuits. It was introduced by Damgard, Pastro, Smart, and Zakarias in 2012. Its key advantage is that it provides security against malicious adversaries, not just semi-honest ones, while keeping the online phase fast.

SPDZ extends Beaver triples with authentication. Each secret-shared value also carries a message authentication code (MAC) that lets parties verify that no one has tampered with their shares during the computation. If any party tries to send incorrect shares (as a malicious adversary would), the MAC check fails and the protocol aborts before any sensitive output is revealed.

Private set intersection (PSI) is one of the most practically deployed applications of SMPC. It lets two parties find the common elements in their respective datasets without either party learning anything about elements that are not in the intersection.

This matters in many AI contexts. Two hospitals want to identify patients who appear in both their databases to share outcomes data for research, without either hospital learning which patients the other has that are not in common. Two companies want to find shared customers for a joint marketing analysis without exposing their full customer lists to each other. A bank and a retailer want to compute a cross-entity fraud signal on shared accounts without sharing all account data.

PSI protocols are efficient enough for very large datasets. Modern PSI based on cuckoo hashing and OT extension can handle tens of millions of records from each party in seconds. Google's private join and compute system, used in their advertising measurement infrastructure, performs PSI on encrypted identifiers to measure ad effectiveness without either party sharing their full user databases.

Private AI inference using SMPC lets a client query a model without the model provider learning the query, and without the client learning the model weights. Both are simultaneously private. This is useful when the query contains sensitive patient data, and the model is a proprietary commercial asset the provider does not want to expose.

The computation is split: the client secret-shares their input, the model provider holds secret shares of the model weights, and both parties run SMPC to evaluate the neural network on the shared values. Neither party needs to reveal their share to the other at any point. The output is revealed only to the authorised party at the end.

Performance reality: Private inference with SMPC is significantly slower than plaintext inference. A ResNet-50 inference that takes 1 millisecond in plaintext may take several hundred milliseconds over SMPC, depending on the number of parties, network latency, and the protocol used. This overhead is narrowing as hardware and protocol efficiency improve, but it remains the main barrier to production adoption for deep networks.

For simpler models, such as linear classifiers, logistic regression, and shallow neural networks, SMPC inference is already practical with latency in the range of a few milliseconds. The VectaX benchmarks from D2 (retrieval p95 under 8ms) show that even for vector search, encryption overhead can be kept production-viable with the right engineering.

FHE and SMPC both provide encryption in use, but they solve different variants of the problem. Choosing between them depends on your trust model, the number of parties, and the performance requirements of your application.

SMPC has moved from theoretical research to production deployment in several industries where multi-party computation on sensitive data is a regulatory or competitive requirement.

Several mature frameworks implement SMPC for machine learning. They differ in their protocol support, ML framework integration, and target use case.

These five modules form a complete toolkit for privacy-preserving AI. Each technique addresses a different part of the attack surface identified in D1. Together they cover the full span from protecting individual training records to securing multi-organisation collaborative computation.

In a typical production AI system, these techniques layer rather than replace each other. Federated learning with DP-FedAvg and secure aggregation trains the model across organisations. The trained model is deployed with VectaX-protected encrypted vector search for the retrieval layer. SMPC handles cross-organisation queries where multiple parties need to jointly interrogate the system. Differential privacy bounds what the model's outputs reveal about any individual training record.

No single technique covers everything. The practitioner's job is to understand which part of the attack surface each technique addresses and combine them appropriately for the threat model of the specific deployment.