Agentic-PPML: Modular Privacy-Preserving ML

• Agentic-PPML is a modular design pattern that separates natural language intent parsing from privacy-critical numerical computation using cryptographic techniques.
• The architecture leverages LFHE, secret sharing, and MPC/OT to reduce the extreme slowdown of fully private LLMs to a manageable 1–2 orders of magnitude overhead.
• It extends to process mining by employing cooperating Engineer and Analyst agents that execute domain-specific operations locally while protecting sensitive data.

Agentic-PPML denotes a family of architectures that combine agentic orchestration with privacy-preserving machine learning by separating high-level language understanding from privacy-critical computation. In the systems formulation, a general-purpose LLM operates in the clear for intent understanding and orchestration, while compact domain-specific models execute the sensitive numerical workload under cryptographic protection (Zhang et al., 30 Jul 2025). Subsequent work applies the same separation principle to local process-mining analytics through cooperating Engineer and Analyst agents (Antonov et al., 16 Mar 2026), and a separate theoretical treatment uses the label for a probabilistic framework of latent subagents, logarithmic pooling, and alignment (Lee et al., 8 Sep 2025). Taken together, these works suggest that Agentic-PPML is best understood as a modular design pattern in which agentic decomposition is used to localize where privacy guarantees, deterministic computation, or alignment interventions must be enforced.

1. Conceptual framing

The motivating claim behind Agentic-PPML is that direct privacy-preserving execution of LLMs is computationally prohibitive. The systems position paper states that state-of-the-art “fully private” LLM inference incurs 10,000× (and higher) slowdown over plaintext, with costs growing with both model size and context length; it attributes this to encrypted matrix multiplications, larger attention circuits, and substantial communication overhead for non-linear layers (Zhang et al., 30 Jul 2025). Agentic-PPML responds by decoupling two roles that monolithic private LLM pipelines conflate: natural-language intent parsing and privacy-critical inference.

That decoupling reappears in later work, but with different emphases. In PMAx, the split is between deterministic local computation over event logs and semantic interpretation of the resulting artifacts. In the probabilistic modeling paper, the split is internalized: agentic structure is represented as compositions of latent subagents whose aggregation and suppression are analyzed mathematically. The literature therefore uses the term across system architecture, analytical workflow design, and alignment theory.

Paper	Main conception	Representative mechanism
(Zhang et al., 30 Jul 2025)	Practical PPML for LLM-centric services	LLM in the clear; encrypted domain inference
(Antonov et al., 16 Mar 2026)	Agentic-PPML in process mining	Engineer/Analyst split with local pm4py execution
(Lee et al., 8 Sep 2025)	Probabilistic agentic composition	Weighted logarithmic pooling and Waluigi suppression

A recurring principle is separation of computation versus interpretation. In the inference architecture, the LLM never performs the privacy-critical numerical inference. In PMAx, the Analyst never computes metrics directly. In the probabilistic treatment, aggregation is specified by an optimization criterion rather than by unconstrained generative reasoning. This suggests that Agentic-PPML is organized around constrained delegation: each agentic component is assigned a sharply delimited computational or semantic role.

2. Secure orchestration architecture

The canonical systems architecture consists of three actors and four phases: User (U), LLM Agent, and MCP Servers. The user remains in plaintext, the LLM agent operates in clear-text, and the MCP servers execute encrypted computation (Zhang et al., 30 Jul 2025). The first phase is session setup and secret sharing. The user generates a random symmetric session key $k$, encrypts $k$ under the cloud MCP server’s public key, and splits the private input $x$ into additive shares

$x = x_0 + x_1 \pmod p.$

The user keeps $x_0$ in the clear and encrypts $x_1$ under $k$.

The second phase is intent parsing and orchestration. The LLM receives the natural-language request together with $(x_0,\mathrm{Enc}_k(x_1))$, identifies the relevant MCP server from a registry, and emits structured function calls. The crucial architectural claim is that the LLM processes only the natural-language intent and opaque share handles; it does not process raw pixel data, medical numbers, or model weights.

The third phase is privacy-preserving inference. The cloud server decrypts $x_1$, while the selected domain server holds $x_0$. The servers then run an MPC/FHE-hybrid protocol to evaluate the specialized model on the reconstructed input in secret-shared form. The paper gives the inference pattern for a CNN as

$k$0

Linear layers such as matrix multiplication and convolution are handled via leveled FHE, whereas non-linear layers such as ReLU and comparison are handled via 2PC with OT. Each server obtains an additive share of the result, with one share returned in the clear and the other returned encrypted under $k$1.

The fourth phase is reconstruction and final response. The user decrypts the encrypted result share, reconstructs

$k$2

and then invokes a local LLM on device with the original query and the reconstructed result to generate the user-facing answer. The architecture thus keeps the orchestration LLM outside the trusted path for sensitive numeric inference while also avoiding encrypted execution of the LLM itself.

3. Cryptographic substrate, threat model, and performance

Agentic-PPML, in its systems form, is built from additive secret sharing, leveled homomorphic encryption, and two-party computation. The paper specifies the secret-sharing interface as

$k$3

and gives the standard LFHE interface through KeyGen, Enc, Eval, and Dec (Zhang et al., 30 Jul 2025). For fully connected layers, it decomposes

$k$4

with $k$5 evaluated under HE and $k$6 computed locally before secure recombination. For ReLU, it uses a secure positivity test followed by secure multiplication.

The stated security definition is IND-CPA for LFHE: no PPT adversary can distinguish $k$7 from $k$8 with non-negligible advantage. The threat model assumes semi-honest MCP servers, authenticated channels, and a trusted LLM that orchestrates but sees no private inputs or model weights. The composition theorem sketch asserts that additive sharing, FHE, and OT together securely realize an ideal secure-inference functionality in the semi-honest model.

The empirical motivation for the framework is its performance gap relative to encrypted LLM inference. In an end-to-end medical use case on ChestX-ray14, the general LLM for intent parsing is DeepSeek-V3 with unmeasured overhead of approximately $k$9 s, while encrypted inference with ResNet-50 reaches Accuracy = 75.6% and Latency ≈ 170.7 s per image. The paper also reports the following microbenchmark:

Model	Runtime (s)	Comm. (MB)
MLP	0.005	0.296
LeNet-5	0.012	1.028
AlexNet	4.472	242.2
ResNet-18	22.982	1653.5
ResNet-34	38.414	2748.2
ResNet-50	121.952	8076.7

The paper summarizes the slowdown factor as typically 1–2 orders of magnitude for compact CNNs, in contrast to 10³–10⁴× for encrypted LLMs. Its experimental setup uses Intel Xeon Gold 6348, NVIDIA A100, 10 Gbps LAN, CUDA 12.1, CrypTFlow2, SIRNN, Microsoft SEAL v4.1, and 128-bit security with RLWE parameters $x$0.

4. PMAx as an agentic process-mining instantiation

PMAx presents Agentic-PPML as a privacy-preserving, autonomous process-mining framework functioning as a virtual process analyst (Antonov et al., 16 Mar 2026). Its architecture is a 3-tier workflow with two cooperating LLM agents—Engineer Node and Analyst Node—plus an orchestration and shared-memory layer. The user interface includes a configuration panel for selecting LLM provider and model, API-key entry, file upload for XES or CSV logs, and a conversational pane that shows both real-time code synthesis by the Engineer Node and the final report by the Analyst Node.

The privacy boundary is established at ingestion. On upload, PMAx extracts an abstraction

$x$1

and only this lightweight snapshot is injected into agent prompts; raw events are never included. The orchestration layer maintains separate conversation histories for the two agents and a shared artifact registry. Agents can read and write only their own history, while finalized artifacts such as code, tables, images, and metrics are appended to the registry.

The Engineer Node is prompted as a “Data Engineer / Process-Mining Specialist.” It receives the natural-language query, the event-log abstraction, and an API specification. It outputs Python scripts calling a whitelisted API consisting of pm4py, pandas, numpy, plotly, and seaborn. Those scripts undergo static verification of imports and API calls, execute in a sandboxed local environment, and enter a self-correction loop whenever an error traceback is captured. On success, artifacts such as Petri nets, DataFrames, and visualizations are persisted through the API.

The Analyst Node is prompted as a “Process-Mining Analyst.” It receives the query and a manifest of executed artifacts containing metadata, small DataFrame samples or statistical summaries, and pointers to plot data. It then transforms those artifacts into a typed output schema consisting of entries of the form {type: text|table|plot, content: …}. Schema violations or missing artifact references trigger retries. The paper characterizes this as hallucination control through schema enforcement and artifact validation.

PMAx also formalizes the underlying process-mining computations as deterministic pm4py calls. Among the metrics it lists are throughput-time distribution statistics, directly-follows graph summaries, and conformance via alignment fitness. For activities $x$2, the directly-follows count is

$x$3

with normalization

$x$4

For trace $x$5 and model $x$6, alignment-based fitness is defined as

$x$7

The paper’s central claim is that metrics are not hallucinated by the LLMs: they are executed locally through established process-mining APIs and only then interpreted narratively.

5. Privacy models and boundary conditions

The literature does not use a single privacy mechanism under the label Agentic-PPML. In the secure-inference architecture, privacy is cryptographic: private inputs are secret-shared, encrypted shares are processed under LFHE and OT-based MPC, and the LLM is trusted but excluded from direct access to private values (Zhang et al., 30 Jul 2025). In PMAx, privacy is operational and architectural rather than cryptographic: only schema-level abstractions are exposed to the LLMs, execution is on-premises in the user’s controlled environment, and the generated code runs in a confined interpreter with no filesystem or network I/O (Antonov et al., 16 Mar 2026).

PMAx makes this distinction explicit. It states that there are No Differential Privacy / Encryption Layers and that the current version has no formal $x$8-DP guarantee, although future extensions could integrate local DP on summary statistics. The secure-inference framework, by contrast, foregrounds formal security properties under a semi-honest threat model but assumes a trusted orchestrating LLM and requires domain-specific backend models.

These differences matter for interpretation. “Privacy-preserving” in Agentic-PPML may refer either to cryptographically secure inference or to strict data-access confinement with local execution. A plausible implication is that the term currently denotes a family resemblance among architectures—agentic decomposition plus minimized exposure—rather than a single standardized privacy definition.

6. Probabilistic subagents, logarithmic pooling, and alignment

A separate theoretical treatment generalizes Agentic-PPML from system orchestration to a probabilistic theory of internal agency (Lee et al., 8 Sep 2025). In that framework, an agent is a probability distribution over a finite outcome set $x$9, with epistemic utility given by the logarithmic score

$x = x_0 + x_1 \pmod p.$0

Equivalently, one may associate a utility function $x = x_0 + x_1 \pmod p.$1 to a softmax policy

$x = x_0 + x_1 \pmod p.$2

and identify each agent with its logits $x = x_0 + x_1 \pmod p.$3.

Composition is defined through weighted logarithmic pooling. Given agents $x = x_0 + x_1 \pmod p.$4 with nonnegative weights $x = x_0 + x_1 \pmod p.$5 summing to $x = x_0 + x_1 \pmod p.$6, the aggregate $x = x_0 + x_1 \pmod p.$7 is

$x = x_0 + x_1 \pmod p.$8

which yields

$x = x_0 + x_1 \pmod p.$9

The paper interprets each agent’s welfare as its own log-score and defines the welfare gap

$x_0$0

It then proves several structural results: strict unanimity is impossible in binary outcome spaces when $x_0$1, impossible under linear pooling with log-score welfare, but possible for $x_0$2. Additional results establish cloning invariance, continuity, openness of the set of strictly unanimously compositional pools, and the impossibility of obtaining strict unanimity through infinitesimal duplication of a parent distribution.

The same paper uses these tools to analyze the “Luigi vs. Waluigi” alignment phenomenon. It defines a first-order misalignment metric over a deplorable set $x_0$3 using the centered indicator

$x_0$4

and measures small-change effects through inner products with a logit perturbation $x_0$5. Under a norm budget, the optimal suppression direction is proportional to the projection of $x_0$6 onto the span of available persona directions. The paper states that reinforcing Luigi forces some anti-aligned persona weight to increase, and that “manifest Waluigi then suppress” yields strictly larger first-order reduction of misalignment than pure Luigi reinforcement alone under the same small-change budget. It also presents high-level pseudocode for an Agentic-PPML training regimen based on extracting subagent profiles, identifying anti-aligned directions, and optimizing a KL-constrained alignment update.

7. Deployment constraints and open directions

The systems literature emphasizes deployment pragmatics. The secure-inference framework requires a library of compact domain models, each packaged with an MCP server exposing a standard Infer RPC, plus a registry advertising capabilities and public keys (Zhang et al., 30 Jul 2025). Its stated limitations are that it does not yet support general attention or very large domain networks under encryption. The paper identifies three open challenges: extending to Transformer blocks under MPC/FHE, automating domain-model selection and fallback when no exact match exists, and reducing communication via more aggressive PCG/OT extension.

PMAx emphasizes inspectability and auditability. Its open-source Python code, clear API specification, and self-correction loops produce prompt/code/error traces, while the shared artifact registry preserves intermediate outputs (Antonov et al., 16 Mar 2026). At the same time, its privacy guarantee is bounded by local execution and data minimization rather than by formal cryptographic proof. The paper explicitly presents future integration of local DP on summary statistics as an extension rather than a current property.

The probabilistic framework identifies a different frontier: principled modeling of latent subagents and explicit adversarial probing during alignment (Lee et al., 8 Sep 2025). Its architectural insight is that reinforcing a single benevolent persona is insufficient because anti-aligned components may rise under the same intervention. This suggests that future Agentic-PPML research may continue to bifurcate into two streams: externally modular systems that isolate privacy-critical computation, and internally modular theories that analyze how coherent agency and misalignment emerge from compositions of subagents.