Introduction

Belfort runs your PyTorch model on data that stays encrypted. Your end client encrypts an input on their own machine, a Belfort GPU runs the model on the ciphertext, and the end client decrypts the result. The secret key never leaves the end client, so neither you nor Belfort can read the input or the result.

The encryption is fully homomorphic encryption (FHE) in the CKKS scheme, which computes additions and multiplications on encrypted real numbers. Any other operation, such as a ReLU, is replaced by a polynomial approximation, which costs time and some accuracy.

Who it is for#

Model providers whose end clients cannot hand over their raw data, such as health records, financial transactions or sensor readings, but want the provider's predictions on it. You never hold the end client's data, and the model runs on Belfort's GPUs.

Which models compile#

A trained nn.Module with one encrypted input of a fixed shape, built from linear layers, convolutions, average pooling, batch normalization and elementwise activations. Depthwise convolutions compile. Max pooling, other grouped convolutions and softmax are not supported yet. What compiles lists the supported and unsupported operations and what each costs.

The path from a model to an encrypted inference#

1. Compile locally: belfort_ml.compile traces your nn.Module and writes it out as MLIR, without a network call.
2. Upload and compile for FHE: provider.models.get(name=..., create_from=artifacts) uploads the MLIR, or returns the model already compiled from it. Belfort's compiler chooses encryption parameters and generates GPU code for the server and C++ for the Belfort ML client (key generation, encryption, decryption).
3. Mint a client token: model.create_client returns a token that lets one end client use this model through the Belfort gateway. Belfort does not deliver it: you pass it to the end client yourself, the same way you already exchange data with them.
4. Deploy: model.deploy starts a GPU instance with your model.
5. Infer: your end client runs the Belfort ML client on the token, as the belfort-ml-client infer command or belfort_ml_client.Client in Python. It downloads the client-side C++ for your model, builds it, generates a key pair, and uploads the public evaluation keys, which the gateway loads onto your deploy. It then encrypts, sends the ciphertext to the deploy, and decrypts the answer. The secret key stays in that process, and neither the input nor the answer passes through your code.

The Quickstart walks through all five steps with a pretrained MNIST classifier, running the Belfort ML client yourself in place of an end client.

A coding agent such as Claude Code can follow these steps once you install the Belfort skill.

Two packages#

Model providers and end clients explains what crosses between them.