MOSAIC: Masked Outsourcing of Secure AI Computations

2026-07-31

AI Summary

This work addresses the challenge of securely and efficiently outsourcing AI inference to an untrusted yet computationally powerful server while the client retains both its input data and model. The authors propose MOSAIC, a novel framework that uniquely integrates noisy matrix multiplication masking with an error-scaling mechanism and employs randomized Hadamard rotations to control error accumulation. Built upon the decisional Learning With Errors (LWE) and Learning Parity with Noise (LPN) assumptions, MOSAIC enables confidential inference for Transformer models up to 70B parameters with asymptotically optimal client computation overhead. It achieves accuracy on HumanEval comparable to full BF16 precision while accelerating inference by several orders of magnitude over existing approaches, thereby offering a practical pathway toward large-scale confidential AI deployment.

Abstract

We address the challenge of securely and efficiently outsourcing AI computations from a trusted but computationally weak client to an untrusted but powerful server, in the setting where the client holds both the input and the model, and the server must learn neither. We present MOSAIC, whose core is a novel matrix-multiplication masking protocol that scales to far larger matrices than prior work, enabling the safe outsourcing of modern workloads such as large transformer inference. By introducing small amounts of noise to the multiplication result and thereby relaxing correctness, MOSAIC achieves optimal asymptotic client overhead and concrete runtimes orders of magnitude faster than prior work. Its security reduces to the decisional LWE and LPN assumptions. Because this noise accumulates across the many layers of a transformer, a key technical challenge is bounding error growth; MOSAIC addresses this with an error-scaling mechanism based on random Hadamard rotations. On large 70B transformer models, MOSAIC's perplexity is comparable to popular quantization approaches and even matches full-precision BF16 inference on HumanEval. Finally, we present an end-to-end implementation showing how ideas like MOSAIC can promise a path towards large-scale confidential AI in modern data centers. Non-confidential inference is already distributed across phase (prefill/decode), layer, and time to maximize utilization of heterogeneous hardware, using RDMA-like networking to move activations, cached KV values, and weights across nodes. MOSAIC enables scaling of confidential compute by keeping the trusted computing base (TCB) small and outsourcing the bulk of the AI computation to untrusted accelerators.

Problem

• secure outsourcing
• confidential AI
• matrix multiplication masking
• trusted computing base
• transformer inference

Innovation

• secure AI outsourcing
• matrix multiplication masking
• error scaling
• confidential inference
• trusted computing base