SAFE-AI brings together researchers and practitioners working at the intersection of encrypted computation, computer systems, and AI. The workshop focuses on the systems and architectural challenges behind practical privacy-preserving AI, with an emphasis on Fully Homomorphic Encryption (FHE), Secure Multi-party Computation (MPC), and Zero-Knowledge Proofs (ZKP).
The program features invited talks, contributed submissions, and technical discussions from academia and industry, highlighting recent advances, real-world deployments, and open problems in scaling encrypted AI. The SAFE-AI workshop is a focused venue to present new ideas, share early results, and get feedback from a community working on building encrypted computation. Topics span the full computing stack, including hardware acceleration, system design, compilers, programming models, DSLs, tooling, and applications for encrypted computation.
This workshop is ideal for researchers, engineers, students, and industry professionals interested in making encrypted AI practical: faster, easier to program, and deployable in realistic settings.
| 8:50 AM - 9:00 AM | Welcome Remarks |
| 9:00 AM - 10:00 AM |
Keynote Talk
Accelerating Modern Cryptography on Commodity Hardware
Srini Devadas, Massachusetts Institute of Technology
AbstractAccelerating modern cryptography on commodity hardware requires designing algorithms that natively match the structure of vector cores, tensor cores, and distributed execution models. We show that modular arithmetic can be reshaped into wide-vector Residue Number System pipelines that eliminate carry chains and permutation overhead, letting CPUs and GPUs deliver large speedups on signatures and other number-theoretic kernels. ZKP provers can be similarly re-architected: by converting high-precision modular operations into dense low-precision General Matrix-Matrix Multiplications and adopting shuffle-free dataflows, tensor-core hardware such as TPUs achieves order-of-magnitude gains on multi-scalar multiplications and number-theoretic transforms. At cluster scale, verifiable computation can be decomposed into parallel proof tasks aligned with the structure of distributed systems, replacing monolithic proofs with horizontally scalable, independently verifiable components. Together, these results argue that cryptographic performance hinges less on exotic hardware and more on algorithm–hardware co‑design: when cryptographic kernels are reformulated to fit vectorized, tensorized, and distributed execution, commodity platforms can deliver significant improvements in latency and throughput.
Speaker BioSrini Devadas is the Webster Professor of EECS at the Massachusetts Institute of Technology, where he has been on the faculty since 1988. Devadas has worked in the fields of Computer-Aided Design, computer architecture, computer security, and applied cryptography. His work in these fields has resulted in eight “test-of-time” awards, given to papers at least ten years after publication, and resulted in deployments in several commercial secure hardware devices and processors, and popular messaging applications. |
| 10:00 AM - 10:30 AM | Coffee |
| 10:30 AM - 10:45 AM |
Zero-knowledge proofs (ZKPs) are increasingly important for privacy-preserving and encrypted computation, including federated learning, verifiable inference, and secure data analytics. However, most existing ZKP accelerators target ZKP protocols based on arithmetic circuits over large prime fields. These are often rendered inefficient for Boolean-heavy computations, where native operations are bit-level AND and XOR gates rather than large-field additions and multiplications. As encrypted-AI systems increasingly incorporate quantized, Boolean, and cryptographic components, this Boolean-to-arithmetic mismatch becomes a key obstacle to efficient proof generation. This paper explores Vector Oblivious Linear Evaluation-in-the-Head (VOLEitH) as an alternative protocol substrate for publicly verifiable Boolean ZKPs. VOLEitH transforms efficient designated-verifier VOLE-based ZK protocols into non-interactive, publicly verifiable, post-quantum-secure proofs. We present VOLE-ocity, an FPGA-based accelerator for VOLEitH proof generation. VOLE-ocity decomposes the prover into hardware-optimized modules for GGM-tree vector commitments, streaming VOLE conversion, and gate-by-gate Boolean circuit evaluation. Our prototype, implemented with HLS on a Xilinx Virtex UltraScale+ FPGA, achieves up to 28× speedup over highly optimized CPU baselines on SHA-256 and Keccak-f circuits. Finally, we discuss how hardware-accelerated Boolean ZK can serve as a foundation for future VOLE-based machine-learning proof systems, particularly for quantized and Boolean neural-network workloads. |
| 10:45 AM - 11:00 AM |
Encrypted AI using fully homomorphic encryption (FHE) provides strong privacy guarantees; but its slow performance has limited practical deployment. Recent works proposed ASICs to accelerate FHE, but require expensive advanced manufacturing processes that constrain their accessibility. GPUs are a far more accessible platform, but achieving ASIC-level performance using GPUs has remained elusive. Furthermore, state-of-the-art approaches primarily focus on small models that fit comfortably within a single device. Supporting large models such as LLMs in FHE introduces a dramatic increase in computational complexity that requires optimized GPU kernels, along with managing terabyte-scale memory footprints that far exceed the capacity of a single GPU. This paper presents Cerium, a multi-GPU framework for FHE inference on large models. Cerium integrates a domain-specific language, an optimizing compiler, and a runtime system to automatically generate high-performance GPU kernels, manage terabyte-scale memory footprints, and parallelize computation across multiple GPUs. It introduces new IR constructs, compiler passes, sparse polynomial representations, memory-efficient data layouts, and communication-aware parallelization techniques that together enable encrypted inference for models ranging from small CNNs to Llama3-8B. We build Cerium on NVIDIA GPUs and demonstrate significant performance gains. For small models, Cerium outperforms expert-written hand-optimized GPU libraries by up to 2.25 times. Cerium achieves performance competitive with state-of-the-art FHE ASICs, outright matching prior FHE ASIC CraterLake. It is the first GPU system to execute bootstrapping in under 10 milliseconds, achieving 7.5 milliseconds, and is the first to demonstrate encrypted inference for BERT-Base and Llama3-8B in 8 seconds and 43 seconds, respectively. |
| 11:00 AM - 12:00 PM |
Keynote Talk
A Hardware and Software Architecture to Accelerate Computation on Encrypted Data
Daniel Sanchez, Massachusetts Institute of Technology
AbstractFully Homomorphic Encryption (FHE) enables computing directly on encrypted data, letting clients securely offload computation to untrusted servers. While enticing, FHE suffers from two key challenges. First, it incurs very high overheads: it is about 10,000x slower than native, unencrypted computation on a CPU. Second, FHE is extremely hard to program: translating even simple applications like neural networks takes months of tedious work by FHE experts. In this talk, I will describe a hardware and software stack that tackles these challenges. First, I will present a programmable hardware architecture that accelerates FHE programs by 5,000x vs. a CPU with similar area and power, erasing most of the overheads of FHE. Second, I will introduce a domain-specific compiler that abstracts away the details of FHE. This compiler exposes a simple, numpy-like tensor programming interface, and produces FHE programs that match or outperform painstakingly optimized manual versions. Together, these techniques make FHE fast and easy to use across many domains, including deep learning, tensor algebra, and other analytic tasks.
Speaker BioDaniel Sanchez is a Professor of Electrical Engineering and Computer Science at MIT. His research interests include scalable memory hierarchies, architectural support for parallelization, and accelerators for sparse computations and secure computing. |
| 12:00 PM - 1:30 PM | Lunch |
| 1:30 PM - 1:45 PM |
Zero-Knowledge Proofs (ZKPs) enable privacy-preserving verification but remain difficult to deploy due to high proof-generation costs. Recent work has explored hardware and GPU acceleration across diverse ZKP schemes, each with different trade-offs in overhead, proof size, verifier cost, setup, and trust. This work targets a key bottleneck in modern ZKP systems: supporting complex, high-degree custom gates through the SumCheck protocol. We propose a programmable accelerator for arbitrary SumCheck-based gates, achieving over 1000× geomean speedup over CPU SumChecks across multiple gate types. Integrated into zkPHIRE, a full-system programmable accelerator for HyperPlonk, the design achieves 1486× geomean speedup over CPU and 11.87× 11.87× over prior state-of-the-art at iso-area, while scaling beyond 2^30 constraints and maintaining compact 4-5 KB proofs. |
| 1:45 PM - 2:00 PM |
Zero-knowledge proofs of neural-network inference (zkML) can certify model execution, but proving cost remains a central obstacle, especially for transformer-style models. FLOP counts are an incomplete proxy: field additions and multiplications are relatively natural for arithmetic proof systems, while comparisons, lookups, divisions, normalization, and transcendental functions introduce proof-unfriendly overheads. We present ZKTrace, a lightweight backend-agnostic profiler that traces small PyTorch models with torch.fx and reports both a FLOP/MAC baseline and an operator-aware proof-cost score. We validate on six approximately FLOP/MAC-matched model pairs using ezkl. In five of six pairs the higher-scored member proves slower; across all twelve models the proof-aware score ranks measured proving time at Spearman 0.83 versus 0.59 for the baseline. The result is preliminary: ZKTrace is an early-stage design tool, not a proving system or exact prover-time predictor. |
| 2:00 PM - 2:15 PM |
Fully Homomorphic Encryption (FHE) allows computation on encrypted data without decrypting it. In theory, FHE makes privacy-preserving machine learning possible. In practice, however, it remains extremely slow for real workloads. A major source of slowdown is bootstrap operations; in CKKS, a popular FHE scheme for tensor workloads, the slowdown is compounded by scale management and rescale operations. Existing FHE compilers miss crucial optimization opportunities because they overlook a key property of CKKS programs: bootstrap and rescale placement are fundamentally coupled through the level budget. We present ORBIT, an FHE compiler that jointly optimizes bootstrap and rescale placement through a novel Integer Linear Programming (ILP) formulation that reasons about both ciphertext level and scale constraints. To make this formulation tractable for structured tensor workloads, we introduce three techniques that reduce ILP complexity while preserving optimality. Across five convolutional neural networks and multiple cryptographic parameter configurations, ORBIT achieves a geometric mean speedup of up to 19% over DACAPO, 73% over ORION, and 52% over RESBM, keeps compilation under 6 minutes, and retains model accuracy within 0.3% of plaintext execution. |
| 2:15 PM - 3:15 PM |
Keynote Talk
Scaling Encrypted Computing: Realities of Deployment
Asra Ali, Google
AbstractThis talk will explore real world privacy-sensitive applications our group is investigating that can be addressed with encrypted computing solutions. We will detail common deployment obstacles including latency, memory bandwidth, key management, and other organizational and systemic challenges. We examine the role of encrypted computation development platforms, including the HEIR compiler, to overcome these barriers and to provide layers of abstraction to connect components of a production system. Finally, we outline solutions laying the foundation to achieve wider encrypted computation adoption.
Speaker BioAsra Ali is a software engineer at Google actively working on compilers for fully homomorphic encryption. Her track record includes developing and maintaining many open source projects around privacy and security, including Google’s Ring Learning with Errors implementation, the Sigstore ecosystem for zero trust supply chain security, and the open-source network proxy Envoy. She’s also worked on real world privacy preserving applications using FHE, resulting in one patent. Her background is in abstract math, and published research in number theory. |
| 3:15 PM - 3:30 PM | Closing Remarks |
| 3:30 PM - 4:00 PM | Coffee |
Submission URL: https://safeai2026.hotcrp.com/
We invite submissions for contributions to the workshop that specifically address the systems-related challenges and advancements within the domain of encrypted computation. The focus of this call is on innovative research, development, and deployment of systems that enable practical, efficient, and secure computation on encrypted data. Our key areas of interest include, but are certainly not limited to, the following topics:
The 1st Workshop on Systems and Architecrures for Encrypted AI
Co-located with ASPLOS 2025, Rotterdam, Netherlands