Masked Compute Deletes the Cleartext Moment
Splitting the Data Across Servers Means No One Can See It
Last week’s article was about what an agent is allowed to do. This week is about the data underneath it — and what it takes to compute on something nobody is allowed to read.
This is the third stop on a three-part tech tour of the OpenMatter trust layer. Datavizor secures the secrets, QuantumGuard governs the actions, and beneath both sits the computation itself: the layer that runs a model over data no single machine is able to read.
This is Masked Compute.
Stay up to date as we build the infrastructure layer for secure AI collaboration:
OpenMatter is chairing the Decentralized AI Agent Alliance’s Agentic Privacy & Security subgroup. The next meeting will be held on August 12, 2026 at 1pm EDT, and continuing every other Wednesday thereafter. Please join us.
Masked Compute Deletes the Cleartext Moment
Five Servers Compute the Answer Without Ever Seeing the Question
Computing on sensitive data has always meant accepting a moment where the data is whole. Inside a trusted enclave, ciphertext is decrypted, operated on, and re-sealed. For the length of that computation the plaintext exists in one place, and whoever controls that place must be trusted.
A clean room moves the data somewhere neutral, but it still moves it. A trusted third party relocates the moment onto someone else’s machine. Each of these is an argument about the same cleartext moment: where it happens, who is present for it, and what you have to believe about them.
Masked Compute deletes the moment. Not guards it better — arranges the computation so the data is never whole anywhere, not even for the microsecond a chip would spend on it.
Split Before It’s Seen
The primitive enabling Masked Compute is secret-sharing multi-party computation, implemented as SPDZ2k — a variant that computes over rings modulo 2^k rather than over a prime field, which lets the arithmetic ride the same 64-bit integer operations a CPU already natively performs.
Before a value is ever computed on, it is split into shares and distributed across five independent servers. That five is a property of the protocol, not the number of collaborators: a session might have a single contributor or several, and the computation still runs across five servers either way. The split happens on each contributor’s own machine, so what leaves it are secret shares — random-looking values that mean nothing alone and reconstruct the original only in combination. Who operates the servers stops mattering, because none of them ever holds anything meaningful.
Any single share is cryptographically meaningless, and so is any set of four: reconstruction requires all five. That is exactly what makes a coalition of four servers powerless, and the protocol is built so the inputs are never reconstructed at all.
The servers compute on the shares directly. Addition is local, requiring no communication. Multiplication spends material prepared in advance. At the end, only the agreed output is reassembled, for the authorized party and nothing else.
Front-Loading the Hard Part
SPDZ-family protocols split their work in two. An offline phase does input-independent preprocessing, manufacturing the correlated randomness — Beaver triples — that makes secure multiplication possible. All of it happens before there is any data to protect. A fast online phase then spends that material computing over the actual private inputs.
The offline phase uses Multipars, whose preprocessing rests on the R-LWE hardness assumption — the same lattice family anchoring the post-quantum standards NIST selected in 2024. Durability against a future quantum adversary sits in the preprocessing that everything else consumes. The online phase uses Turbospeedz, a function-dependent optimization that roughly halves online cost.
The effect: the heavy cryptography runs before the sensitive data arrives, so the moment that actually touches your inputs is the cheap one.
What Four Colluding Servers Can’t Do
The threat model is dishonest majority. With five servers, the guarantees hold even if four collude against the fifth. You do not have to trust a majority to be honest, or any particular machine at all.
Two properties fall out of the SPDZ2k machinery:
Privacy: a coalition of corrupted servers learns nothing beyond the output itself.
Correctness: every share carries a message authentication code (MAC) under a global key no coalition of four can recover. If anyone tampers with the computation, the check fails and the protocol aborts.
The second property has a sharp edge. A tampered computation does not return a wrong answer — it returns nothing. A masked computation can refuse to finish, but it cannot hand you a corrupted result that looks clean.
Why Not an Enclave
The natural alternative is a trusted execution environment. A TEE decrypts inside hardware, computes at close to native speed, re-seals, and integrates with far less ceremony than a five-server protocol. By our own measurements, Masked Compute runs its online phase roughly a third slower — the cost of coordinating machines that never see what they’re working on.
But a TEE is disqualified by a single requirement: it asks you to trust the chip. The enclave’s assurance is that the manufacturer built the silicon as specified, that the firmware is what it claims to be, and that the attestation chain is sound.
For cross-institution work, regulated data, and anything where two organizations are contributing inputs neither is permitted to show the other, a TEE relocates the trust problem rather than solving it. You’ve replaced trusting your counterparty with trusting a hardware vendor.
Masked Compute removes the dependency entirely. There is no chip to trust, because there is no moment at which any single machine holds anything worth stealing.
What the Run Leaves Behind
When a computation completes, the parties to the run attest onchain that they received the identical output. That shared attestation is the record.
Two mechanisms combine to make that record mean something. The MACs establish that the computation wasn’t tampered with — any interference aborts the run. The onchain agreement establishes that everyone arrived at the same answer. Together they mean the collaborators cannot be handed a corrupted result without the protocol failing, and the agreement is on record afterward.
This is integrity backed by cryptography and by agreement among the machines that ran the job. The attestation is written to MatterChain, where anyone can read it.
Nothing Worth Stealing
The mask, in the end, is not on the data. It’s on the computation. For thirty years, computing on data you couldn’t expose meant finding somewhere safe to expose it — a clean room or an enclave. Those answers accept the cleartext moment and argue about where to put it.
Masked Compute is the recognition that the moment itself is the problem, and that the most valuable work is precisely the work no one should be trusted to watch: cross-institution research, regulated datasets, or the analysis two competitors both need and neither will hand over.
The cleartext moment isn’t guarded, or relocated, or made shorter. It never arrives. But the output still does.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact our team to learn how Masked Compute can help.