COVENANT LABS · LAB OUTPUT

Model Encryption Protocol

Only what is meant should be seen.

TYPE: PROTOCOL
STATUS: PUBLISHED
VERSION: 2.6
DATE: JULY 2026
CODENAME: CHINCHILLA

MEP runs end-to-end encrypted inference on standard cloud hardware with less than five percent overhead. Model weights and user data stay ciphered outside the trust boundary, so the host that serves the model never has to be trusted with it. Privacy is enforced by the mathematics, not by the provider's policy.

PROPERTIES

PRIMITIVE	Structure-preserving weight permutation
THREAT MODEL	Untrusted cloud host; model IP and I/O protected
OVERHEAD	< 5% vs. plaintext inference
SCALE PROVEN	LLaMA-class models to 70B parameters
INFRASTRUCTURE	Standard cloud GPUs, no secure enclave required
RUNTIME	vLLM integration
INTERFACE	OpenAI-compatible API
AVAILABILITY	Private enterprise deployments, dedicated hardware

1.0The problem

Every serious approach to private AI inference has forced a trade nobody should accept: cryptographic guarantees at unusable speed, usable speed inside somebody else's hardware, or promises on paper with no mathematics behind them.

APPROACH	BASIS	FAILURE
Homomorphic encryption	Cryptographic	100–1000x inference slowdown
Secure enclaves	Hardware	Vendor lock-in; memory limits near 312MB
Policy-based privacy	Contractual	Soft trust; policies change overnight

2.0Method

MEP applies a secret structure-preserving permutation to the model's weights before they ever leave the owner's custody. The permuted model computes the same function, but its weights, activations, and token stream are meaningless to the host. The permutation and its inverse live only at the trust boundary.

INPUT TEXT

the quick brown fox

PERMUTATION P

applied at the boundary

TOKEN IDS

17 · 7 · 9 · 3

PERMUTED EMBEDDING LAYER

9 · 3 · 17 · 7

MODEL

encrypted weights, standard GPU

PERMUTED LM HEAD

INVERSE PERMUTATION P⁻¹

applied at the boundary

OUTPUT

jumps over the lazy dog

FIG. 01 · PERMUTED INFERENCE PIPELINEP, P⁻¹ HELD AT TRUST BOUNDARY

PLATE I · PROTOCOL STUDY, V2.6FROM THE LAB ARCHIVE

3.0Validation

3.1Integrated with vLLM; serves through OpenAI-compatible endpoints.
3.2Benchmarked on LLaMA-class models to 70B parameters at under 5% overhead.
3.3Deployed for private enterprise inference on dedicated hardware.

4.0Position

Homomorphic encryption pays for its guarantees in three orders of magnitude of compute. Enclaves pay in hardware freedom. MEP pays under five percent and runs anywhere. That is the difference between privacy as a research demo and privacy as infrastructure.

PROVENANCE

R1	Protocol developed and validated internally	2026
R2	Published as Output 001	2026
R3	This edition, document v2.6	07.2026

CITE

@techreport{covenant2026mep,
  title     = {Model Encryption Protocol: Encrypted Inference
               at Native Speed},
  author    = {Covenant Labs},
  year      = {2026},
  number    = {Output 001},
  url       = {https://covenantlabs.ai/research/output-001}
}