Numes, the AI inference marketplace that routes requests across frontier and open-source models, announced today that end-to-end encrypted models are now available on its platform. The company claims that prompts are encrypted on the user's device and decrypted only inside the GPU running the model, making the data invisible even to Numes itself.
The announcement positions Numes against a growing field of privacy-focused inference providers, including Venice, Phala Network, and Proton's Lumo. But where many competitors rely on hardware-based Trusted Execution Environments to isolate data during processing, Numes appears to be taking a different approach: a cryptographic technique that operates without special hardware requirements.
Some prompts are too private to share. End-to-end encrypted models are now on https://t.co/SBRaP4lBJv. Your prompt is encrypted on your device and decrypted only inside the GPU that runs the model. Not even we can read it. https://t.co/UkuF3kh2rN
— Numes (@Numes_ai) November 13, 2026
How Equivariant Encryption Works
The underlying technology comes from Nesa Research, which published a paper describing what it calls Equivariant Encryption. The technique enables large-scale model inference on encrypted data while maintaining near-zero performance overhead, according to the research team. The system exploits the known architecture, layer composition, and input-output mappings of the model to construct a system in which each step of inference operates correctly on encrypted inputs.
Equivariant Encryption allows LLMs to run inference on encrypted tokens so the device running the model never has access to plaintext data. The suggested setup runs an encrypted tokenizer locally while model weights run in an external system like a cloud compute environment. When configured this way, the compute environment never sees the plaintext.
This differs from standard homomorphic encryption, which has historically imposed severe performance penalties. A standard mid-sized language model that returns a result in under a second when running normally can take more than 60 seconds when processed under techniques like Secure Multi-Party Computation. The encryption overhead is that large. Nesa claims its approach avoids this latency penalty.
Benchmark testing showed less than 9% inference latency overhead and output fidelity exceeding 99.99% compared with standard inference, according to documentation. The framework is designed to operate on conventional GPU hardware without trusted execution environments.
The Numes Marketplace
Numes operates as a marketplace where users can turn spare GPU capacity into inference services, from single machines to full data centers. It offers frontier, open source, and specialized models in one platform. The service integrates with tools like OpenCode, Pi, and OMP, letting users access multiple inference sources through one account: frontier APIs, OpenRouter, and independent providers serving Ollama, vLLM, or llama.cpp.
The addition of encrypted inference creates a tiered privacy structure. Users can now choose between standard inference, where prompts are visible to the provider during processing, and encrypted inference, where they are not. The company did not immediately respond to questions about whether encrypted models carry different pricing or availability constraints.
Why It Matters for Regulated Industries
In healthcare, finance, and other regulated domains, data privacy is a central requirement. Users often need to ensure that sensitive data like medical images, personal identifiers, or transaction records are not visible to untrusted nodes in a distributed inference pipeline. Existing methods like secure multiparty computation, homomorphic encryption, and differential privacy each involve trade-offs in communication overhead, computational latency, or accuracy.
If Numes can deliver encrypted inference at near-standard speeds without requiring clients to deploy hardware-based security measures, it would address a persistent gap in enterprise AI adoption. Companies in finance and healthcare have historically faced a choice between running models on expensive on-premises infrastructure or accepting that their prompts pass through third-party servers in plaintext. Nesa's enterprise documentation describes the system as the first encrypted AI inference API, with inputs encrypted 100% of the time, even during AI inference, so no one can see your data.
Independent Verification Remains Sparse
The claims are substantial, and independent security audits of the Equivariant Encryption implementation have not been publicly referenced. The technique itself sits outside the well-studied categories of homomorphic encryption and TEE-based confidential computing, which means the security properties are harder to evaluate against established frameworks.
Hardware attestation systems let users verify that a public key was generated inside an enclave running a known, published hash. The attestation proves a narrower configuration than the phrase private inference might suggest, but it still gives substantially more evidence than an ordinary provider's promise not to log. Whether Numes offers comparable attestation mechanisms for its encrypted models is unclear from available documentation.
In an AI chat context, a named TEE mode means the provider is claiming inference runs inside that enclave, while an E2EE mode means the prompt is encrypted on the device and decrypted only inside the verified enclave. Numes appears to be claiming the latter without relying on hardware enclaves, which would represent a distinct approach if the cryptographic claims hold up to scrutiny.
The feature is live now on numes.ai. Pricing and model availability for encrypted inference have not been disclosed. As AI assistants gain access to more sensitive data, the market for provably private inference is expanding. Whether Numes has solved the underlying cryptographic challenges or merely repackaged them remains to be independently confirmed.
