papers/lux-agent-sovereignty/sections/07-private-inference.tex

%% ===================================================================
%% LP-134 canonical naming (2025-12-15):
%% Per LP-134 (Lux Chain Topology), T-Chain has been split into:
%%   M-Chain — MPC ceremonies for bridge custody of EXTERNAL wallets
%%             (CGGMP21, FROST, Pulsar-general)
%%   F-Chain — FHE compute + TFHE bootstrap-key generation (encrypted EVM)
%% The legacy name "T-Chain" is retained ONLY for `teleportvm` (LP-6332).
%% Where this paper says "T-Chain MPC" / "T-Chain threshold governance" /
%% "T-Chain TFHE" / "T-Chain custody", read as M-Chain (MPC) or F-Chain (FHE).
%% ===================================================================

\section{Private Inference}
\label{sec:private-inference}

Sovereign agents must be able to perform model inference without revealing their inputs, outputs, or reasoning to the compute provider. We achieve this through CKKS-encrypted inference with threshold decryption.

\subsection{Encrypted Model Inputs}

The agent encrypts its inference input $x$ using the CKKS scheme with parameters suitable for the model's precision requirements:

\begin{equation}\label{eq:enc-input}
    \tilde{x} = \text{CKKS.Enc}(\text{pk}_{\text{agent}}, x; N, q, \Delta)
\end{equation}

where $N$ is the polynomial degree, $q$ is the ciphertext modulus, and $\Delta$ is the scaling factor. The encrypted input is submitted to a compute node along with a reference to the model and inference parameters.

\subsection{Homomorphic Evaluation}

The compute node evaluates the model $f$ on the encrypted input:

\begin{equation}\label{eq:he-eval}
    \tilde{y} = f(\tilde{x})
\end{equation}

For transformer-based models, this requires approximating non-polynomial activations (GELU, softmax) via polynomial approximations~\cite{lee2022privacy}. The computational overhead is significant (100--1000$\times$ for current FHE schemes) but is amortized across batch inference and is acceptable for high-value reasoning tasks where privacy justifies cost.

\subsection{Threshold Decryption}

The encrypted result $\tilde{y}$ is decrypted via a $(k, n)$-threshold scheme managed by the T-Chain. The agent's FHE secret key is secret-shared among $n$ T-Chain validators using Shamir's Secret Sharing:

\begin{equation}\label{eq:threshold-dec}
    y = \text{CKKS.Dec}\Big(\text{TSS.Reconstruct}\big(\{s_i\}_{i \in S}, |S| \geq k\big), \tilde{y}\Big)
\end{equation}

No single validator can decrypt the result. The agent receives the plaintext output; the compute node and individual validators learn nothing.

\subsection{Inference Receipts}

Every inference produces a verifiable receipt:
\begin{equation}\label{eq:receipt}
    \rho = \big(H(\tilde{x}), H(\tilde{y}), \text{model\_id}, t, \sigma_{\text{compute}}\big)
\end{equation}

The receipt is anchored on-chain and serves as proof that the agent performed inference at time $t$ on model $\text{model\_id}$, without revealing the inputs or outputs. This creates an auditable computational history without sacrificing privacy.