What is secure multiparty computation, and can it keep AI chats private?

The Morse teamPublished November 4, 202611 min read

Secure multiparty computation (MPC) is a branch of cryptography that lets several parties compute a result from their combined data while each party's own input stays hidden from the others, so they learn the answer and nothing about what anyone else put in. NIST's privacy-enhancing cryptography project describes it as letting "multiple parties, often mutually distrustful, to compute some property of their joint inputs," with the same result as if "a trusted third party" had done it, but with no such party (NIST PEC). As of November 2026, secure multi-party computation runs real wage-gap studies and ad measurement, but no AI chat app we know of runs a language model under it, because the research systems still take seconds to minutes per word.

We read NIST's MPC and threshold pages, the Boston Women's Workforce Council's and Boston University's own pages on their wage study, the researchers' write-up of the Danish sugar beet auction, Google's, Meta's, and Coinbase's MPC code repositories, the Internet Security Research Group's pages on the COVID exposure notification analytics, and seven papers on MPC for language models, all on November 4, 2026. Each number below links to the page it came from.

How does secure multiparty computation work?

It splits each secret into pieces that are meaningless alone, lets each party compute on the pieces it holds, and combines only the final results. The two classic ways to do that are secret sharing and garbled circuits.

Secret sharing is the easier one to picture. Say three coworkers want their average salary without telling each other what they earn. You earn $80,000, so you pick two random numbers and a third that makes them add up: 51,312, minus 9,104, and 37,792. You hand one piece to each of three servers. Every coworker does the same. Each server adds up the pieces it received, which is a meaningless number, and the three servers' totals add up to the true sum of all three salaries. Divide by three and you have the average. No server ever saw a salary, and no single piece says anything about one.

Adding is free in this scheme. Multiplying shared numbers takes a round of messages between the servers, and a neural network does billions of multiplications. That traffic is where MPC's cost comes from.

Garbled circuits handle two parties. One party writes the computation as a circuit of logic gates and encrypts every gate's table of inputs and outputs. The other party gets the encrypted circuit and, through a step called oblivious transfer, the keys for its own input bits, without the first party learning which keys it took. The second party runs the circuit gate by gate and can decrypt only the final output.

Both work only if the parties holding the pieces don't pool them. The Internet Security Research Group, which ran an MPC system for the US exposure notification apps, put that as the design rule that "no single organization controls both of the aggregator servers" (Divvi Up, May 2022).

Where is secure multiparty computation used today?

In a handful of places where several organizations want one statistic and none will hand over its records. Each row below is read on the deployer's own page or the researchers' own write-up:

The sugar beet auction ran every year until 2015, "when it was no longer needed," according to Partisia (Partisia). The researchers, Ivan Damgård and Tomas Toft, reported that 80% of bidders who answered a survey said the confidentiality of their bids was important to them.

The Boston study started from a 2013 pledge by Mayor Tom Menino's office, which required signing employers to give "anonymized wage data to a neutral third party" (Boston University, April 2015). Boston University's method is the salary example above at city scale. Each company masks its pay totals with large random numbers, sends the masked totals to a BU server and the random numbers to an independent third party, and the two sums are combined so BU learns the aggregate without "any single company's totals" (Boston University, June 2025). The December 2023 report found the gender gap in base pay fell "from 30¢ to 21¢," with over 250 employers signed up (Hariri Institute). In May 2025 the university debuted a platform built the same way for Massachusetts, whose pay equity law requires employers with 100 or more employees to submit wage data reports.

Meta's tools are winding down. Its Private Computation Solutions repository "was archived by the owner on Jun 20, 2025" and says only critical bug fixes will be applied, and its CrypTen machine-learning framework was archived on May 13, 2025 (CrypTen). Guides that still cite them as Meta's current MPC work are out of date.

What does NIST say about MPC?

NIST treats MPC as a core privacy tool but hasn't standardized it. Its privacy-enhancing cryptography page, updated October 26, 2026, says "MPC is one of the main techniques of interest to the PEC project" (NIST PEC). As an example of where it could help, NIST points to a bill in the US Congress that "proposes the use of SMPC to calculate, on behalf of students, the expected monetary return" on a degree, because the data needed "is held by multiple sources" (NIST PEC).

The nearest thing to a standard is NIST's First Call for Multi-Party Threshold Schemes, NIST IR 8214C, published in final form on January 20, 2026. It asks for threshold schemes that "apply principles of secure multiparty computation (MPC)," and its scope includes fully homomorphic encryption too (NIST). Its 2026 workshop, held January 26 to 29, heard preview talks on planned submissions, with more previews on September 30 and in October 2026.

Can MPC be used for AI?

Yes, for training statistics and for small models, but on language models it is still a research result. MPC already sits inside some AI training, in federated learning's secure aggregation step, which lets a server add up thousands of phones' model updates without seeing any one (IACR ePrint). We cover how that fits with the rest of federated learning in what is federated learning.

Running a chatbot under MPC is much harder. Here is what the papers measured, in their own numbers:

Times have fallen from 14 minutes a token in one design to about 3 seconds in another. The fastest result is on a 6-billion-parameter model, though, much smaller than the models people chat with, and 3 seconds a token still means a 300-word answer takes around 20 minutes.

Why don't AI chat apps use MPC yet?

Speed is the first reason, and the table above shows it. Three more come out of the same papers and deployments:

• The traffic. Every multiplication on shared numbers needs a round of messages, which is how earlier systems reached "gigabytes of data transfer" per token, in the PermLLM authors' words. MPCache and Comet both count cutting that traffic among their main gains.
• The approximations. A model's softmax and GeLU steps are expensive under MPC, so systems swap in approximations. MPCFormer retrains the model to fit; PUMA's selling point is that it matches the original model's accuracy without that.
• The second party. MPC is private only if the parties don't pool their pieces. Either your own device is one party, trading data with the server for every token, or a second organization runs the other server and you trust the two not to compare notes. The exposure notification system put its two aggregators on different public clouds for that reason, and its operators wrote that each cross-cloud misconfiguration could open a security hole (Divvi Up).

So private AI chat went another way. Apple's Private Cloud Compute post says large cloud models need "unencrypted access to the user's request," which "precludes the use of end-to-end encryption," so iPhones talk only to servers that "can cryptographically attest to running publicly listed software" (Apple Security, June 2024). That's a trusted execution environment, and what is a trusted execution environment covers how attestation works and where its limits are.

MPC vs homomorphic encryption vs TEEs: which keeps data private?

They hide different things from different people, at very different speeds. Homomorphic encryption lets one server compute on data it can't decrypt, and what is homomorphic encryption covers its schemes and costs. Here are the five techniques side by side, on the questions that matter for a chat:

NIST's threshold call covers MPC and homomorphic encryption alike. Where they differ for a chat is the trust they ask for. Homomorphic encryption asks you to trust the math alone, while MPC asks you to trust that two organizations won't collude, and a TEE asks you to trust the chip maker's hardware.

How Morse keeps your prompts unreadable without MPC

A model has to read your prompt to answer it, and every technique in this article is a way to keep that reading away from the people who run the servers. MPC does it by splitting the prompt across servers that mustn't collude, at seconds to minutes a token. Morse doesn't use MPC. Its E2EE mode does the reading inside a secure enclave, a trusted execution environment, that your browser checks first.

• E2EE, for prompts no server operator should read. Your browser verifies the enclave's hardware attestation itself and compares what's running against versions pinned in the app. Then it encrypts the message on your device so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the reply is decrypted only in your browser. Open-weight models like GLM, Kimi, and DeepSeek run there, and every reply has a lock you can open to see each check that passed. The guarantee rests on the enclave hardware and attestation working as designed, and the enclaves are run by third-party providers, not by Morse. E2EE chats come with Pro, at $19 a month.
• Private, for prompts a host may read but mustn't keep. Morse has zero data retention agreements with its inference, search, and other providers, so the hosts agreed to keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for GPT, Claude, and Gemini. Morse's proxy removes your account, email, and IP address, so the provider sees the message without knowing it's you. The provider may keep it for a limited time to check for abuse, under its own policy, so leave out names you'd rather not send.

Morse isn't the only app that uses enclaves, and the end-to-end encrypted AI chat guide shows what to check in any of them. In every Morse mode, your chat history is stored in your browser, encrypted, not on Morse's servers, and Morse doesn't train AI on your chats, sell your data, or show ads. Because Morse doesn't store chats, it usually has very little to give authorities.

You can start free with no card, and move to Pro when a chat needs the enclave.