Perseus offers open full-stack system for faster homomorphic encrypted AI inference

A new research preprint is pitching a potentially important step for privacy-preserving AI: a publicly available full-stack system for running models on encrypted data, paired with code and reproducibility materials that outside researchers can inspect.

The paper, “Perseus: A Full-Stack System for Homomorphic Model Inference,” was posted to arXiv on Nov. 3 as preprint arXiv:2611.04488v1. Its authors — Alessandro Zirilli, Davide Marincione, Evgenios M. Kornaropoulos, Giuseppe Ateniese and Emanuele Rodolà, from Sapienza University of Rome, George Mason University and Paradigma — say the system meaningfully reduces one of the biggest obstacles in the field: speed.

Fully homomorphic encryption, or FHE, lets a server compute on encrypted data without decrypting it. In AI, that raises the possibility of a provider processing sensitive prompts, medical records or financial data without ever seeing the plaintext. The catch is that encrypted inference has long been far slower than ordinary model serving, especially for large language models, because operations such as bootstrapping add heavy computational overhead.

Perseus is meant to address that bottleneck across the entire software stack rather than in a single component. In the paper’s abstract, the authors write: “We present Perseus, a free and open Python software library that supports the full stack of encrypted model inference, from the cryptographic backend and data packing, to encrypted nonlinearities and end-to-end model execution.” The accompanying GitHub repository, gladia-research-group/perseus, includes a Python layer and a Rust-plus-CUDA runtime for the cryptographic backend.

According to the paper, Perseus includes three main optimizations: backend-level key-switching-key regeneration performed in-kernel, a packing method that uses complex CKKS slots, and a packing- and magnitude-aware method for deciding where to place bootstrapping steps. Reported workloads include GPT-2 small, Llama-3-8B, ViT-B/16 and BERT-base.

The headline claim is on encrypted text generation. The authors say Perseus is 3.96 times faster at single-token decoding than any other implementation on Llama-3-8B, and reports 7.8 seconds per token at a 512-token context. More broadly, the paper says Perseus achieves “state-of-the-art latency across multiple models and modalities” while staying within 3% of the plaintext models’ accuracy and perplexity. In the conclusions, the authors write: “We presented Perseus, a publicly available Python library for encrypted model inference. Its main contribution is state-of-the-art latency across multiple models and modalities, up to practically useful model sizes.”

Those results come with important caveats. The reported measurements were run on a single NVIDIA RTX PRO 6000 using a 32-bit RNS CKKS configuration with 128-bit security. The paper also notes that some comparison figures for competing systems were assembled from per-block timings or measured on different hardware. That matters because performance in FHE is highly sensitive to hardware and implementation details. No independent third-party benchmark validation of the headline speed claims was identified; for now, the evidence comes from the authors’ paper and their own reproducibility materials.

That reproducibility angle is part of why the release stands out. Research on encrypted inference has advanced steadily through 2025 and 2026, but the benchmarking landscape remains fragmented, and many leading systems have been closed-source or hard to compare directly. Perseus’ repository includes scripts intended to reproduce the reported results, along with a public “Encrypted GPT-2 Speedrun” leaderboard meant to encourage outside verification and iteration.

The code is public, but not unrestricted. It is released under BUSL 1.1 with an additional use grant for noncommercial and research use; commercial use requires permission.

Whether Perseus’ performance numbers hold up under broader outside testing, the release is notable for pairing ambitious speed claims with a public, end-to-end stack in a field where reproducibility has often lagged behind the hype.