The Ultimate Constraint

Fully homomorphic encryption evaluates a computation on encrypted data. A client encrypts its input under its own key, the operator’s hardware computes on the ciphertext, and the result returns as ciphertext only that key opens. The operator reads nothing at any point, and the inability is arithmetic rather than policy, resting on the same lattice hardness family as the post-quantum signature standards, the assumption discipline our security-foundations essay sets out. This is running in demonstration form today: Google’s HEIR compiler has carried recommendation, fraud-detection, network-intrusion, and hotword models to encrypted execution at single-threaded CPU latencies, with an accelerator ecosystem forming underneath.

Encryption is also the strictest constraint regime a model can be asked to run in, and that is the reason it belongs at the end of this section. Every article here argues for a discipline on its own grounds: structural sparsity for hardware economy, bounded recurrence against context rot, structured consultation over token streams, forward-mode adaptation for cheap gradients, per-goal arithmetic for exactness. Under encryption each of those preferences becomes a requirement. The constraints this section chose are the constraints a sealed computation cannot do without, which makes encrypted evaluation the limit case of constrained machine learning, and a natural test of whether the section’s program holds together.

The Circuit Demands

An encrypted evaluation admits only circuits. No branch may depend on what the computation sees, because a data-dependent branch reveals data. No memory access may depend on it either, so a lookup indexed by encrypted data means scanning the table. No loop may run until a computed value says stop, so an unbounded loop pads to its worst case. And no work may be skipped because a value turned out small or a weight turned out zero at runtime, because skipping is telling. A dense token-based model violates all of these at once: its generation loop runs until an unpredictable stop token, its embedding lookup is a data-indexed gather, and its sparsity, where it has any, is discovered at runtime where a sealed computation cannot use it. Sealing such a model means padding every dimension of its behavior to worst case, which is why the demonstrated encrypted workloads are small and why the accelerator ecosystem exists.

The Standing Answers

The section’s disciplines answer these demands item by item, and none was designed with encryption in view.

Sparsity that a sealed computation can use. The utility article distinguishes the absent zero from the learned-near-zero: an ADM carries no parameters for interactions its domain forbids, and the off-block entries of a block-diagonal generator occupy no storage. Under encryption this is the only sparsity that exists at all. A runtime zero still costs a ciphertext operation, because skipping it would reveal it. A structural zero, absent from the compiled computation, costs nothing, and Proposition 5.1 of the ADM pre-print holds that structure fixed through training, so the sealed circuit stays valid across updates.

Consultation instead of gathering. The porous step already bypasses the tokenize, embed, and attend path: a consultation crosses to a domain actor as a structured query over BAREWire, and the answer returns as a StructuredFact whose fields include the Certificate the actor’s own elaboration produced. There is no vocabulary lookup anywhere on that path, so the oblivious-gather problem a token model faces under seal does not arise. Routing among domain actors is by schema, the tag a compile-time case index, never by content inspection, the only routing available when the content is ciphertext.

A recurrence with a bound. The structured recurrence commits to a sheaf Laplacian spectral gap bounded away from zero as its convergence condition, and convergence exponential in that gap yields a round count computable at elaboration from the gap bound and the initial tension the BAREWire contracts already limit. The termination test a sealed loop cannot run becomes an obligation discharged before the loop exists, and the emitted form is a constant-bound loop with no condition inside the circuit. The bounded resonant recurrence also has nothing to evict, so the data-dependent cache management a sealed key-value model would need is absent by construction.

Adaptation that fits inside. Training under encryption is out of reach for the reverse-mode toolkit, whose tape and optimizer state multiply everything a seal makes expensive. The forward-mode path has the signature that survives: no tape, tangents indexed by a rank the adapter carries in its type, and a memory bound at a constant multiple of the serving footprint that transfers to the sealed cost model as a constant multiple of depth. Warm rotation supplies what a sealed model otherwise lacks, an update path for weights nobody can read: the candidate is certified at elaboration inside the organization’s trust boundary, and the version record signs the transition with the post-quantum credential the discipline already uses. The certificate becomes the artifact by which anyone verifies a model nobody can inspect.

Arithmetic per goal. The two-substrate resolution extends by one goal. The training goal binds to b-posit with quire accumulation, where the rate objective demands exactness, and that training runs in the clear inside the trust boundary where warm rotation already certifies candidates. The sealed serving goal binds to the modular arithmetic the encryption schemes evaluate, where the ternary lineage the building article names is the cheapest regime available, weights in a three-valued alphabet turning multiplication into addition. One typed program would derive both artifacts, with the ranges the calibration pass harvests sizing the posit words on one side and the modulus chain on the other. The information-preservation discipline of Information Is Not Discarded makes the second derivation certifiable rather than a lossy export.

The reversible core, repriced. The store-versus-reconstruct placement is a compile-time coeffect resolved against a target’s memory hierarchy, and a sealed target joins that resolution with a new cost model: an anchor is a resident ciphertext, and a backward retreat spends multiplicative depth from the noise budget. The operating point moves accordingly, and the compiler that already places anchors per target would place them per seal. One note on exactness: in the exact modular plaintext spaces the round trip of a reversible transition is exact without any accumulation discipline, since modular arithmetic does not round, while the approximate scheme family keeps the exactness question open.

The Gradient Extended

The adoption gradient measures each rung partly by sovereignty, and its final rung reaches “the data never leaves.” Under the seal the residency half of that requirement is gone: sealed data can leave and still never be read, so the compute no longer has to live where the data does. The constellation already anticipates distribution, with BAREWire carrying meaning across hardware boundaries to wherever a component is best served, and the seal widens that reach past the trust boundary itself. A domain actor could run on rented hardware with its traffic and state as ciphertext, in the custody mode Google’s work demonstrates, or with its weights sealed as well at a higher depth cost, and the elaboration that certifies a rotation would know which mode it is certifying. Sovereignty stops being a constraint on where the constellation runs and becomes a property its messages carry.

The Perimeter

The boundaries hold as they do everywhere in this section. The language node’s open interaction with the unstructured world stays outside the seal, where unbounded things belong, and the porous node’s membrane, the grammar and the contract, is machinery that runs in the clear. Confidentiality rests on a named assumption, Module-LWE hardness, in the taxonomy the security-foundations essay draws, and nothing here is a security theorem of ours. The certificate attests the deployed model and its update provenance, and it is not a per-answer proof that a given evaluation executed correctly, which is verifiable-computation territory this design does not enter. What the seal and the section share is narrower and stronger: a model whose structure is a compile-time fact is the model whose encrypted form can be bounded, certified, and updated, and that class is the one this section has been building all along.

Open questions

Whether the porous relevance gate survives the seal is the first question this reading surfaces. The designated-step check of the porous loop reads the recurrent state, and under encryption a gate that reads sealed state is a branch on secret data. The admissible forms are a consultation schedule fixed at elaboration, or an oblivious gate that always consults and integrates under a mask, and the two price differently in depth and in round trips.

Whether the felt latency of a sealed consultation reaches the envelope a person tolerates for its interaction class, measured as consultation round-trip against the published encrypted-workload latencies, is the empirical bar, and nothing in this article is a measurement.

Whether the packings a grade-typed model derives from its own algebra keep the layout reasoning of a sealed lowering in cheap decidable fragments, or fall into the expensive generality a general-purpose encrypted compiler must manage, is a hypothesis with falsifiers stated and not yet run.

And whether the approximate scheme family’s precision management composes with the exactness this section demands elsewhere, for the iterated linear maps the diffusion and recurrence both are, is open in every toolchain, ours prospectively included.