Kernels

Extracts one byte of an encrypted word at an encrypted position — random access inside a number, with neither the number nor the position visible.

Adds two encrypted integers modulo a third, without the intermediate sum overflowing. Modular arithmetic where every operand, including the modulus, is hidden.

Multiplies two encrypted integers modulo a third, with the full-width product never materializing in the clear or overflowing.

Shifts an encrypted integer left by an encrypted number of positions, which is multiplication by a power of two chosen by data nobody can read.

Shifts an encrypted integer right by an encrypted number of positions — integer division by a power of two, with the discarded bits genuinely discarded.

Extends a shorter signed encrypted integer to full width, preserving its sign. The step that lets narrow encrypted values participate in wide arithmetic.

Signed integer division of encrypted operands, truncating toward zero. Division is the operation encrypted arithmetic lacks outright, and signedness doubles the number of cases.

The remainder of signed encrypted division, taking its sign from the dividend. The companion of signed division, and wrong in a different way if the sign rule is missed.

Bitwise exclusive or over two encrypted integers. Trivial on a bit-level scheme, awkward on an arithmetic one, which is exactly why it is worth measuring.

Returns one when an encrypted value is zero and zero otherwise. The smallest possible predicate, and the one every encrypted branch is eventually built from.

The Gaussian error linear unit evaluated on encrypted values. It is the activation transformer models use, so encrypted inference over modern language models depends on it being cheap.

Reads element i of an array when both the array and the index are encrypted. Random access is the operation encrypted computation lacks, and everything from private databases to encrypted branching is built by faking it.

The inverse of an encrypted non-singular matrix. Solving a linear system without seeing it, which is what regression, calibration and least squares all reduce to.

The product of two encrypted matrices. Almost every encrypted model is a chain of these, so the cost of one multiplication sets the cost of inference.

The largest value in an encrypted collection. A single comparison is already hard under encryption; the maximum needs a whole tournament of them, and how that tournament is arranged decides the depth it costs.

The remainder a mod b where both operands are encrypted. Reduction is trivial when the modulus is public and hard when it is not, and the private-modulus case is what integer arithmetic over encrypted data keeps running into.

Finds the closest entries to an encrypted query vector. Retrieval, recommendation and similarity search all reduce to it, and doing it under encryption means ranking without seeing either the query or the ranking.

The least significant bit of an encrypted integer. Extracting one bit is the hard step of extracting all of them, so this is the entry point to encrypted bit decomposition and everything built on it.

max(0, x) evaluated on encrypted values. The most common activation in neural networks, and the one that decides whether encrypted inference is practical, since a deep model applies it thousands of times.

Answers whether an encrypted element belongs to a set, and nothing more than that. Sanctions screening and blocklist checks are exactly this question, asked about data neither side wants to hand over.

The logistic curve 1/(1+e⁻ˣ) evaluated on encrypted values. It is what turns an encrypted linear model into an encrypted classifier, which makes it the first non-linearity most private machine learning needs.

The sign of an encrypted number, computed without decrypting it: +1 above zero, −1 below, 0 at zero. Encrypted comparison, maximum, sorting and ranking are all built on top of it.

Factors an encrypted matrix into singular vectors and values. The general tool behind compression, denoising and dimensionality reduction, applied to data that stays encrypted throughout.

Turns an encrypted vector of scores into an encrypted probability distribution. Every encrypted classifier ends with it, and unlike an activation it couples all elements together, which is what makes it hard.

Returns the values of an encrypted array in ascending order. Sorting is decision-making made of comparisons, and under encryption no decision can be made — so the order has to be computed rather than chosen.

Finds occurrences of a pattern in a text without revealing the pattern. Searching a public corpus while keeping the query private is the case that motivates it — a patent database where the query would give away what someone is building.

Prepares encrypted raw data for a model — scaling, binning, encoding and aggregation — so the preparation step stops being the place where privacy is quietly lost.

Decides whether a transaction is fraudulent without the classifier ever seeing it. The bank keeps its model, the customer keeps their transactions, and the verdict still gets made.

Classifies an image that stays encrypted from the camera to the answer. The server learns neither the picture nor its label, which is the whole proposition of private inference.

Produces recommendations from a purchase history that stays encrypted. The store learns what to show without learning what was bought.

Predicts a number from encrypted features. Valuation, scoring and forecasting are all this, and doing it under encryption lets a model be offered as a service without either side surrendering its data.

Counts encrypted ballots and reports the outcome without any individual vote becoming visible. The oldest use of homomorphic encryption and still the clearest: adding up numbers nobody is allowed to read.

Assigns a label to text that stays encrypted. Moderation, triage and sentiment scoring performed by a service that never reads the message it is judging.