Prompt Cloak: client-side embedding transforms so banks can use hosted open models

The core idea is already sold by Protopia AI. Its Stained Glass Transform runs inside the customer's network and sends transformed embeddings to a hosted model built to accept them, and it is aimed at financial services. Banks that want open models without exposing prompts can also buy confidential-computing services, where prompts are only decrypted inside sealed servers. Privatemode by Edgeless Systems runs this in an EU data centre, and Tinfoil offers the same. These services can prove their servers are unmodified, which a risk team finds easier to sign off than a statistical transform, especially now that 2026 papers show inputs being rebuilt from what the server receives. A new entrant could still win as the EU-native, sovereignty-first option. Protopia's visible partners are AWS, Oracle and Nvidia, and I found no European bank deal or EU-hosted partner network. The best angle would be to pair the transform with EU-hosted sealed servers, so leaks are defended in two independent ways, and to supply independent testing of how hard the vectors are to turn back into text plus regulator-ready model-risk paperwork for DORA and the AI Act. A product that only transforms and sends vectors, without hardware guarantees or independent evidence, would struggle against both Protopia and the confidential-computing vendors.

• Protopia AI (Stained Glass Transform)

  Nearly identical product. A learned, randomised transform of the LLM's input embeddings runs inside the customer's own network, and the hosted model accepts the transformed vectors. Oracle and AWS have published partner blogs about it.

• Protopia SGT-enabled Nemotron on AWS Marketplace

  Shows the cooperating-host model already exists commercially: a hosted Nvidia Nemotron model that accepts SGT-transformed inputs, so plaintext never leaves the data owner's network (vendor claim, not independently verified).

• Protopia AI investor profile (f4.fund)

  Profile positions Protopia as helping financial institutions use LLMs while keeping customer and transaction data private, and pitches secure multi-tenant inference without hardware isolation. I could not confirm any named bank customers.

• Protopia on Oracle Cloud

  Oracle partner blog describing the transform running inside the enterprise's own network, with only transformed data sent to the AI application.

• Privatemode AI (Edgeless Systems)

  German company serving open LLMs with prompts encrypted on the client and decrypted only inside confidential-computing servers (AMD SEV-SNP, Nvidia H100) in an EU data centre. The client checks the backend before sending data. Likely the main alternative a European bank would weigh.

• Tinfoil

  Confidential AI inference for open models on Nvidia GPUs in confidential-computing mode, with open-source code logged publicly and an OpenAI-compatible API. Red Hat collaborates on its upstream community project.

• Nesa (Equivariant Encryption)

  Scrambles the model's internal data so the host never sees plaintext tokens, with claimed near-zero added latency. Requires models retrained under its constraints, and Nesa's own community demo matches the original model only about 92% of the time.

• Split-and-Denoise (ICML 2024)

  Academic design where the client computes the embeddings, adds noise before sending them to the server, then removes the noise from the results. Freely available prior art.

• CONJFORMER: Orthogonally Equivariant Transformers

  2026 research applying a secret rotation to client-side embeddings, with the model built so its outputs are exactly preserved. Close academic analogue of the transform idea.

• What Does the Server See? (split-inference leakage attack)

  2026 attack paper that rebuilds clients' raw inputs from what the server receives. A bank's risk team will use this kind of result to question transform-only privacy claims.

Checked 2026-10-21