Secure Multi-Party Computation Hides the Inputs, Not the Answer

Andrew Yao posed the problem in 1982 and Goldreich, Micali and Wigderson gave the general construction for any number of parties in 1987. Secure multi-party computation lets several parties compute a function over their combined data while each keeps its own input secret. Hospitals train on pooled records without any hospital sending records anywhere. Banks compute a shared fraud signal without showing each other their customer lists.

The privacy property is defined in terms of the output, and in machine learning the output is a trained model or a prediction. Both leak information about the data that produced them. MPC protects the inputs and the messages exchanged between the servers, and it places no constraint on whatever the function was specified to reveal, so every attack that operates on the answer works exactly as well after the deployment as before it.

The evidence for that claim follows, along with the questions I would put to anyone selling MPC as a privacy control for machine learning.

The guarantee, stated precisely

MPC protocols promise correctness and privacy, and the first of those is weaker than the marketing suggests. Many maliciously secure protocols provide security with abort: a corrupt party cannot make an honest participant accept a wrong answer, and it can halt the protocol so that nobody receives one. Falcon, the three-party framework from Wagh and colleagues at PoPETs 2021, says so in its own abstract, and guaranteed output delivery is a separate and stronger property that costs more again. A vendor who says “MPC guarantees you get the right result” has described one of three or four distinct security notions and picked the one that sounds best.

The adversary model matters as much. Under semi-honest security the parties follow the protocol and try to learn what they can from the messages they see. Under malicious security they can deviate arbitrarily. Covert security detects misbehaviour with some probability instead of preventing it. A fourth choice applies across all three: whether the protocol assumes an honest majority of computing parties or tolerates a dishonest one. Malicious security costs substantially more than semi-honest on identical workloads, which a 2023 study in Procedia Computer Science measured as a significant increase in computation time without putting a headline multiplier on it.

Ask which model a quoted latency assumed. Almost every published machine-learning benchmark assumes semi-honest, and almost every buyer hears “secure”.

The trust model, and who signs it

Threshold secret sharing gives t-privacy across n servers: any t of them learn nothing, and t+1 reconstruct. The common two-server deployment sets t = 1, so the privacy guarantee requires that the two servers never combine their shares. If one vendor runs both servers in the same cloud account, the protocol still computes correctly and that vendor has both shares, which is enough to reconstruct every input. The precise risk is common administrative control, and a shared cloud account is only its most visible form.

Mozilla answers that question in the open. Mozilla operates one aggregation server for Firefox telemetry and Divvi Up, run by the Internet Security Research Group, operates the other on its own infrastructure under different legal control. ISRG is the nonprofit behind Let’s Encrypt, which makes the separation checkable by anyone.

Estonia went further and wrote the assumption into the arrangement. In the 2015 Sharemind study described by Bogdanov and colleagues at PoPETs 2016, the Tax and Customs Board, the Ministry of Education and Research and Cybernetica acted as the three computing parties. Each took a contractual obligation to run only the agreed functions and to refrain from collusion and from declassifying personal data.

Three institutions with separate incentives signed the non-collusion assumption into their arrangement. A single vendor offering two servers has signed nothing.

Relaxing the assumption altogether was an open problem until recently. The Pencil authors, at NDSS 2024, write that current MPC frameworks rely on a critical non-collusion assumption. In most of the published multi-server proposals, two colluding servers suffice to break the protocol.

Pencil answers it by reducing multi-party training to a two-party protocol run between the model owner and a single data provider at a time, combining homomorphic encryption for linear layers with two-party computation for non-linear ones, and reports 10 to 260 times higher throughput and two orders of magnitude less communication than prior art. The result is real and the trade is explicit: the model owner sees the weights after every training step, which is exactly the property that lets it switch data owners for free.

What the output still gives away

Wanrong Zhang, Shruti Tople and Olga Ohrimenko showed at USENIX Security 2021 that a party to an MPC training run can infer the distribution of a sensitive attribute in the other parties’ data with high accuracy, using only black-box access to the final model. The leakage held for tabular, text and graph data. Zhang and colleagues observed the same leakage when the sensitive attribute was excluded from the training data entirely.

Xinqian Wang and colleagues showed the inference-time equivalent at NDSS 2025. Membership inference attacks against MPC-based secure inference steal membership information at rates comparable to attacks on plaintext models, despite the perturbation that polynomial approximations of softmax introduce into the predictions. Their defence, SIGuard, crafts noise for the encrypted prediction before it is revealed, reduces attack accuracy to around a random guess, and costs 1.1 seconds on top of a 3.29 second secure inference of ResNet34 over CIFAR-10, which is 24.8% overhead on a defence the base protocol does not include.

Zhang’s attack reads the trained model and Wang’s reads the predictions. Model inversion, membership inference and query-based extraction and model stealing all work on what a computation returns, and MPC constrains only the messages the parties exchange while computing it.

Output privacy is therefore a separate layer with its own budget. Differential privacy composes with MPC and bounds what a released model or statistic reveals about any individual record, and the composition has a substantial literature behind it. Model extraction is a different problem that wants query limits, rate limiting and access control, and masking or minimising the fields that enter the computation is a third. Anyone who tells you differential privacy is the answer to output leakage has merged three controls into one.

Validity is not truth

MPC computes correctly on data that no party may inspect, which is the point and also the exposure. A participant who contributes poisoned training records gets them incorporated into the joint model, protected by the same secrecy that protects the honest participants. A backdoor trigger submitted in shares is a backdoor trigger.

The Distributed Aggregation Protocol draws the distinction more clearly than most vendor documentation does. DAP validates inputs using an interactive computation between the two aggregators, and for Prio3 the client’s report carries a zero-knowledge proof that its measurement satisfies the protocol’s constraints, which the aggregators verify without learning anything else about it. The specification then separates validity from correctness in its own words: a user who spent thirty seconds on a task can claim sixty, and DAP verifies only that the number is inside the chosen limits.

Validation inside the circuit costs additional gates, proofs, communication or rounds depending on the construction, and the cost scales with how much you want to prove. I found no evidence that any production MPC training deployment performs in-circuit input validation, which is unsurprising given that I found no production MPC training deployment.

The numbers, and the conditions attached to them

CrypTen, the framework Meta published at NeurIPS 2021, ran text sentiment classification about two and a half to three orders of magnitude slower than PyTorch, varying with the number of parties. Two details belong with that figure. The task was a linear model over embeddings, which is a narrower claim than a statement about deep learning in general. And CrypTen has since been deprecated, with development halted, which the AIT team gave as their reason for excluding it from the benchmark below.

PUMA reported secure inference of LLaMA-7B at around five minutes to generate one token, using three-party replicated secret sharing under semi-honest security with at most one corrupted party. That was the first MPC evaluation of a model at that parameter size, and the figure is measured on an eight-token prompt.

SIGMA runs LLaMA2-13B in 38 seconds and GPT-2 in 1.5 seconds, using function secret sharing on GPUs, a 12.2 to 19 times improvement over the prior GPU state of the art. Those are the numbers in the body of the PoPETs 2024 paper. The abstract of the same paper says 44 and 1.6 seconds, and 11 to 19 times. A paper that disagrees with itself between abstract and results table is a useful reminder that a benchmark quoted in a slide deck has usually travelled through at least one more hop than that.

SIGMA’s trust model is the more important condition. A 2026 systematisation of private transformer inference records that SIGMA achieves the lowest inference latency by relying on a trusted third party and offloading most computations to the offline phase, and the Mosformer authors say the same thing independently: SIGMA depends on a trusted third party to precompute and distribute the function secret sharing keys. The 38 seconds is real and it is not a two-non-colluding-servers number.

Communication dominates the cost. Guang Yan and colleagues, presenting Comet at IEEE S&P 2025, profiled OPT-6.7B and found communication time constituting over 85% of total inference time, 86.4% in their measured breakdown at an input length of 512 tokens, an output length of 16 and 5 Gbps of bandwidth. In that configuration both OPT-6.7B and Llama2-7B took over an hour to generate sixteen tokens.

The bandwidth sensitivity is the number I would put in front of an architect. In Comet’s own comparison, PUMA generates one output token from a prompt of 512 tokens on OPT-6.7B in 16.1 minutes at 5 Gbps and 752.1 minutes at 100 Mbps. The same computation, the same protocol, a factor of forty-seven from the network alone.

A June 2026 benchmarking study in Applied Sciences by Taubert, Skuta and Lorünser at the Austrian Institute of Technology found that MPC scales well to large and complex models and is strongly affected by network latency, while fully homomorphic encryption is easier to deploy and performs better on small models and regression tasks. Their MPC measurements ran on localhost, and adding a 20 millisecond delay pushed CNN inference times past 35 seconds. Cross-organisational MPC turns network latency into a first-order design constraint, which is the general form of the point, and homomorphic encryption trades the other way: far more local computation, far less traffic between parties.

Where it has actually shipped

Danish sugar beet farmers ran the first large-scale MPC deployment in January 2008, a three-server sealed-bid auction that set the market clearing price without revealing any farmer’s bid. The Boston Women’s Workforce Council has computed aggregate gender and racial wage statistics across participating employers using MPC since a Boston University pilot in 2015. Estonia’s Sharemind study analysed ten million tax records and half a million higher-education records in 2015 to test whether working during university study predicted failing to graduate in nominal time. Its authors described it as the largest cryptographically private statistical study conducted on real government data. The result was no relation between working during a degree and graduating late.

Ten million tax records and half a million education records are not a small input by any standard that would let you dismiss these cases as toys. What the three share is a simple function over a fixed set of institutionally separate parties, computed in batch, with no latency requirement and no neural network anywhere.

The largest current production deployment is the Prio-based Distributed Aggregation Protocol, and its status needs stating precisely. DAP remains an IETF Internet-Draft. Revision 19 is dated 6 July 2026 and its working group state is “WG Consensus: Waiting for Write-Up”. The milestone to submit the protocol to the IESG for publication was set for December 2023. Mozilla shipped Privacy-Preserving Attribution, the Firefox feature that put DAP in front of users for advertising measurement, as code in Firefox 128 in July 2024; Mozilla’s support page now describes it as an experimental feature that was never activated and was later removed, and reads as a historical reference to something that no longer exists. Contemporaneous 2024 reporting described the feature as enabled by default in stable Firefox, which is what prompted a GDPR complaint from noyb. “Never activated” is Mozilla’s own retrospective framing, and the 2024 account remains on the record.

Mozilla’s separate use of DAP for Firefox telemetry with Divvi Up is a different deployment, and it is running today. Divvi Up lists Mozilla Firefox as a customer alongside Horizontal and Tinfoil, and reported production environments processing hundreds of millions of reports a month.

I cannot find a production deployment in which the full neural network training computation, meaning forward pass, backpropagation and weight update, runs under general-purpose MPC. Production MPC is auctions, sums, wage statistics and telemetry aggregation. The nearest thing to an exception is a research prototype integrating the Flower federated learning framework with Divvi Up’s aggregation, which is a prototype and is aggregation.

Secure aggregation, and the attack that goes around it

Federated learning uses a narrow form of MPC called secure aggregation, in which the coordinating server receives the sum of the client updates and never sees any of them individually. Dario Pasquini, Danilo Francati and Giuseppe Ateniese showed at ACM CCS 2022 that a malicious server can send each client a model of its own choosing, pick two of those models so that the two clients’ resulting updates cancel inside the sum, and read a third client’s update out of the aggregate. The attack works across secure aggregation protocols because the flaw is in how federated learning uses them: the protocol never checks that every client was sent the same model, and the authors say so explicitly. Franziska Boenisch and colleagues then reconstructed individual training points at IEEE EuroS&P 2023 against a system hardened with both distributed differential privacy and secure aggregation, using sybil clients.

The Flamingo authors published a fix that adds no runtime cost. Each client appends the hash of the global model it was sent to its per-round pseudorandom generator seed, and masks cancel only when every client got the same model.

Ask a federated learning vendor whether each client binds its shares to the model it was sent. A vendor whose clients skip that binding is running secure aggregation that the 2022 attack defeats, against a fix that has been public since 2023.

What Article 4a actually requires

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was approved by the Council on 29 June 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. It inserted a new Article 4a into the AI Act permitting the processing of special categories of personal data where strictly necessary for bias detection and correction, subject to conditions that must all be met.

Two of those conditions matter to this discussion. Condition (b) requires technical limitations on re-use and state-of-the-art security and privacy-preserving measures, including pseudonymisation. Condition (d) requires that the special category data is not transmitted, transferred or otherwise accessed by other parties. Checked against the consolidated AI Act text on 5 September 2026.

Article 4a names no technique. An MPC deployment can help satisfy condition (b), and whether a computing party that holds a share and never sees a plaintext value has “otherwise accessed” the data under condition (d) is a question I have not seen a regulator answer.

Satisfying one cumulative condition is not compliance with Article 4a. The provision is an exception inside the AI Act, it replaces no part of the wider EU data protection regime, and it obliges nobody to run bias detection in the first place.

What I would do with it

I would use MPC where the function is an aggregate over inputs held by parties who will not pool data, who operate under separate legal control, and who can be made to commit to non-collusion in writing. The Danish, Boston and Estonian deployments all had that structure, and the written commitment is the element most vendor architectures leave out. I would budget separately for a control on what the computation returns, since the protocol supplies nothing there.

For mainstream LLM inference in 2026 I would not choose MPC. I would move the trust boundary into confidential computing, where the assumption becomes the chip vendor’s silicon, firmware and attestation chain instead of a cryptographic protocol and its non-collusion assumption, or I would keep the inference local. Homomorphic encryption and MPC remain legitimate where the stronger cryptographic trust model justifies latencies measured in minutes per token, and I have not yet met the commercial deployment where it does.

RAND’s 2024 report Securing AI Model Weights recommends confidential computing among its priority measures and does not list MPC. RAND does not explain the omission and I will: MPC overhead scales with the size of the computation, and frontier training is the largest computation anyone runs. That is my inference from the cost structure, not RAND’s argument.

Five questions to put to a vendor:

• Who operates each party, under whose separate legal control, and what have they signed?
• Which adversary model did the quoted benchmark assume, and does the protocol tolerate a dishonest majority of computing parties?
• Does the offline phase require a trusted dealer, and if so, who is it and how large are the keys?
• What exactly is revealed at the end, and what control applies to that value?
• What happens on abort? Does the protocol fail closed, or does it leak partial state?

A vendor who answers all five without checking has thought about the problem. A vendor who answers the first question and treats the other four as implementation detail is selling the word and not the property.