---
title: 'Agentic-PPML: Modular Privacy-Preserving ML'
url: https://www.emergentmind.com/topics/agentic-ppml
type: topic
---

# Agentic-PPML: Modular Privacy-Preserving ML

Agentic-PPML denotes a family of architectures that combine agentic orchestration with privacy-preserving machine learning by separating high-level language understanding from privacy-critical computation. In the systems formulation, a general-purpose LLM operates in the clear for intent understanding and orchestration, while compact domain-specific models execute the sensitive numerical workload under cryptographic protection [2508.02836]. Subsequent work applies the same separation principle to local process-mining analytics through cooperating Engineer and Analyst agents [2603.15351], and a separate theoretical treatment uses the label for a probabilistic framework of latent subagents, logarithmic pooling, and alignment [2509.06701]. Taken together, these works suggest that Agentic-PPML is best understood as a modular design pattern in which agentic decomposition is used to localize where privacy guarantees, deterministic computation, or alignment interventions must be enforced.

## 1. Conceptual framing

The motivating claim behind Agentic-PPML is that direct privacy-preserving execution of large language models is computationally prohibitive. The systems position paper states that state-of-the-art “fully private” LLM inference incurs **10,000×** (and higher) slowdown over plaintext, with costs growing with both model size and context length; it attributes this to encrypted matrix multiplications, larger attention circuits, and substantial communication overhead for non-linear layers [2508.02836]. Agentic-PPML responds by decoupling two roles that monolithic private LLM pipelines conflate: natural-language intent parsing and privacy-critical inference.

That decoupling reappears in later work, but with different emphases. In PMAx, the split is between deterministic local computation over event logs and semantic interpretation of the resulting artifacts. In the probabilistic modeling paper, the split is internalized: agentic structure is represented as compositions of latent subagents whose aggregation and suppression are analyzed mathematically. The literature therefore uses the term across system architecture, analytical workflow design, and alignment theory.

| Paper | Main conception | Representative mechanism |
|---|---|---|
| [2508.02836] | Practical PPML for LLM-centric services | LLM in the clear; encrypted domain inference |
| [2603.15351] | Agentic-PPML in process mining | Engineer/Analyst split with local pm4py execution |
| [2509.06701] | Probabilistic agentic composition | Weighted logarithmic pooling and Waluigi suppression |

A recurring principle is separation of computation versus interpretation. In the inference architecture, the LLM never performs the privacy-critical numerical inference. In PMAx, the Analyst never computes metrics directly. In the probabilistic treatment, aggregation is specified by an optimization criterion rather than by unconstrained generative reasoning. This suggests that Agentic-PPML is organized around constrained delegation: each agentic component is assigned a sharply delimited computational or semantic role.

## 2. Secure orchestration architecture

The canonical systems architecture consists of three actors and four phases: **User (U)**, **LLM Agent**, and **MCP Servers**. The user remains in plaintext, the LLM agent operates in clear-text, and the MCP servers execute encrypted computation [2508.02836]. The first phase is session setup and secret sharing. The user generates a random symmetric session key \(k\), encrypts \(k\) under the cloud MCP server’s public key, and splits the private input \(x\) into additive shares
\[
x = x_0 + x_1 \pmod p.
\]
The user keeps \(x_0\) in the clear and encrypts \(x_1\) under \(k\).

The second phase is intent parsing and orchestration. The LLM receives the natural-language request together with \((x_0,\mathrm{Enc}_k(x_1))\), identifies the relevant MCP server from a registry, and emits structured function calls. The crucial architectural claim is that the LLM processes only the natural-language intent and opaque share handles; it does not process raw pixel data, medical numbers, or model weights.

The third phase is privacy-preserving inference. The cloud server decrypts \(x_1\), while the selected domain server holds \(x_0\). The servers then run an MPC/FHE-hybrid protocol to evaluate the specialized model on the reconstructed input in secret-shared form. The paper gives the inference pattern for a CNN as
\[
\mathrm{CNN}(W,x)=\mathrm{CNN}(W,x_0+x_1)=\mathrm{Shares}(\mathrm{res}_0,\mathrm{res}_1).
\]
Linear layers such as matrix multiplication and convolution are handled via leveled FHE, whereas non-linear layers such as ReLU and comparison are handled via 2PC with OT. Each server obtains an additive share of the result, with one share returned in the clear and the other returned encrypted under \(k\).

The fourth phase is reconstruction and final response. The user decrypts the encrypted result share, reconstructs
\[
\mathrm{res}=\mathrm{res}_0+\mathrm{res}_1,
\]
and then invokes a **local** LLM on device with the original query and the reconstructed result to generate the user-facing answer. The architecture thus keeps the orchestration LLM outside the trusted path for sensitive numeric inference while also avoiding encrypted execution of the LLM itself.

## 3. Cryptographic substrate, threat model, and performance

Agentic-PPML, in its systems form, is built from additive secret sharing, leveled homomorphic encryption, and two-party computation. The paper specifies the secret-sharing interface as
\[
\langle x\rangle_1=x_0,\;\langle x\rangle_2=x_1,\;x=x_0+x_1\pmod p,
\]
and gives the standard LFHE interface through `KeyGen`, `Enc`, `Eval`, and `Dec` [2508.02836]. For fully connected layers, it decomposes
\[
Y = W X + b = W X_0 + W X_1 + b,
\]
with \(W X_0\) evaluated under HE and \(W X_1+b\) computed locally before secure recombination. For ReLU, it uses a secure positivity test followed by secure multiplication.

The stated security definition is **IND-CPA** for LFHE: no PPT adversary can distinguish \(\mathrm{Enc}(m_0)\) from \(\mathrm{Enc}(m_1)\) with non-negligible advantage. The threat model assumes **semi-honest** MCP servers, authenticated channels, and a trusted LLM that orchestrates but sees no private inputs or model weights. The composition theorem sketch asserts that additive sharing, FHE, and OT together securely realize an ideal secure-inference functionality in the semi-honest model.

The empirical motivation for the framework is its performance gap relative to encrypted LLM inference. In an end-to-end medical use case on ChestX-ray14, the general LLM for intent parsing is DeepSeek-V3 with unmeasured overhead of approximately \(0.2\) s, while encrypted inference with ResNet-50 reaches **Accuracy = 75.6%** and **Latency ≈ 170.7 s per image**. The paper also reports the following microbenchmark:

| Model | Runtime (s) | Comm. (MB) |
|---|---:|---:|
| MLP | 0.005 | 0.296 |
| LeNet-5 | 0.012 | 1.028 |
| AlexNet | 4.472 | 242.2 |
| ResNet-18 | 22.982 | 1653.5 |
| ResNet-34 | 38.414 | 2748.2 |
| ResNet-50 | 121.952 | 8076.7 |

The paper summarizes the slowdown factor as typically **1–2 orders of magnitude** for compact CNNs, in contrast to **10³–10⁴×** for encrypted LLMs. Its experimental setup uses Intel Xeon Gold 6348, NVIDIA A100, 10 Gbps LAN, CUDA 12.1, CrypTFlow2, SIRNN, Microsoft SEAL v4.1, and 128-bit security with RLWE parameters \(N_p=4096,\;q\approx2^{109},\;t=2^{41},\;\phi=12\).

## 4. PMAx as an agentic process-mining instantiation

PMAx presents Agentic-PPML as a privacy-preserving, autonomous process-mining framework functioning as a virtual process analyst [2603.15351]. Its architecture is a 3-tier workflow with two cooperating LLM agents—**Engineer Node** and **Analyst Node**—plus an orchestration and shared-memory layer. The user interface includes a configuration panel for selecting LLM provider and model, API-key entry, file upload for XES or CSV logs, and a conversational pane that shows both real-time code synthesis by the Engineer Node and the final report by the Analyst Node.

The privacy boundary is established at ingestion. On upload, PMAx extracts an abstraction
\[
\texttt{abstraction}=\{\text{column names},\;\text{types},\;\text{sample values}\},
\]
and only this lightweight snapshot is injected into agent prompts; raw events are never included. The orchestration layer maintains separate conversation histories for the two agents and a shared artifact registry. Agents can read and write only their own history, while finalized artifacts such as code, tables, images, and metrics are appended to the registry.

The **Engineer Node** is prompted as a “Data Engineer / Process-Mining Specialist.” It receives the natural-language query, the event-log abstraction, and an API specification. It outputs Python scripts calling a whitelisted API consisting of `pm4py`, `pandas`, `numpy`, `plotly`, and `seaborn`. Those scripts undergo static verification of imports and API calls, execute in a sandboxed local environment, and enter a self-correction loop whenever an error traceback is captured. On success, artifacts such as Petri nets, DataFrames, and visualizations are persisted through the API.

The **Analyst Node** is prompted as a “Process-Mining Analyst.” It receives the query and a manifest of executed artifacts containing metadata, small DataFrame samples or statistical summaries, and pointers to plot data. It then transforms those artifacts into a typed output schema consisting of entries of the form `{type: text|table|plot, content: …}`. Schema violations or missing artifact references trigger retries. The paper characterizes this as hallucination control through schema enforcement and artifact validation.

PMAx also formalizes the underlying process-mining computations as deterministic `pm4py` calls. Among the metrics it lists are throughput-time distribution statistics, directly-follows graph summaries, and conformance via alignment fitness. For activities \(a,b\), the directly-follows count is
\[
\mathtt{dfg}(a,b)=\bigl|\{\,(e_i,e_{i+1}) : e_i.\mathrm{act}=a,\;e_{i+1}.\mathrm{act}=b\}\bigr|,
\]
with normalization
\[
P(a\rightarrow b)=\frac{\mathtt{dfg}(a,b)}{\sum_x \mathtt{dfg}(a,x)}.
\]
For trace \(\sigma\) and model \(\mathcal M\), alignment-based fitness is defined as
\[
\mathrm{fitness}(\sigma,\mathcal{M})
=1-\frac{l(\gamma)+m(\gamma)}{n(\sigma)+l(\gamma)}.
\]
The paper’s central claim is that metrics are not hallucinated by the LLMs: they are executed locally through established process-mining APIs and only then interpreted narratively.

## 5. Privacy models and boundary conditions

The literature does not use a single privacy mechanism under the label Agentic-PPML. In the secure-inference architecture, privacy is cryptographic: private inputs are secret-shared, encrypted shares are processed under LFHE and OT-based MPC, and the LLM is trusted but excluded from direct access to private values [2508.02836]. In PMAx, privacy is operational and architectural rather than cryptographic: only schema-level abstractions are exposed to the LLMs, execution is on-premises in the user’s controlled environment, and the generated code runs in a confined interpreter with no filesystem or network I/O [2603.15351].

PMAx makes this distinction explicit. It states that there are **No Differential Privacy / Encryption Layers** and that the current version has **no formal \(\epsilon\)-DP guarantee**, although future extensions could integrate local DP on summary statistics. The secure-inference framework, by contrast, foregrounds formal security properties under a semi-honest threat model but assumes a trusted orchestrating LLM and requires domain-specific backend models.

These differences matter for interpretation. “Privacy-preserving” in Agentic-PPML may refer either to cryptographically secure inference or to strict data-access confinement with local execution. A plausible implication is that the term currently denotes a family resemblance among architectures—agentic decomposition plus minimized exposure—rather than a single standardized privacy definition.

## 6. Probabilistic subagents, logarithmic pooling, and alignment

A separate theoretical treatment generalizes Agentic-PPML from system orchestration to a probabilistic theory of internal agency [2509.06701]. In that framework, an agent is a probability distribution over a finite outcome set \(\mathcal X\), with epistemic utility given by the logarithmic score
\[
U(p,x)=\log p(x).
\]
Equivalently, one may associate a utility function \(U(x)\) to a softmax policy
\[
p(x)=\frac{e^{U(x)}}{\sum_{y\in\mathcal X} e^{U(y)}},
\]
and identify each agent with its logits \(L(x)=\log p(x)\).

Composition is defined through weighted logarithmic pooling. Given agents \(p_1,\dots,p_n\) with nonnegative weights \(w_i\) summing to \(1\), the aggregate \(p_c\) is
\[
p_c=\arg\min_q \sum_{i=1}^n w_i\,\KL(q\|p_i),
\]
which yields
\[
p_c(x)\propto \prod_{i=1}^n p_i(x)^{w_i}.
\]
The paper interprets each agent’s welfare as its own log-score and defines the welfare gap
\[
\Delta_i=\E_{p_c}[\log p_i]-\E_{p_i}[\log p_i]
=H(p_i)-H(p_c)-\KL(p_c\|p_i).
\]
It then proves several structural results: strict unanimity is impossible in binary outcome spaces when \(p_1\neq p_2\), impossible under linear pooling with log-score welfare, but possible for \(|\mathcal X|\ge 3\). Additional results establish cloning invariance, continuity, openness of the set of strictly unanimously compositional pools, and the impossibility of obtaining strict unanimity through infinitesimal duplication of a parent distribution.

The same paper uses these tools to analyze the “Luigi vs. Waluigi” alignment phenomenon. It defines a first-order misalignment metric over a deplorable set \(A\subset\mathcal X\) using the centered indicator
\[
g_A(x)=\mathbf 1_A(x)-\Pr_{p_c}[A],
\]
and measures small-change effects through inner products with a logit perturbation \(\Delta L\). Under a norm budget, the optimal suppression direction is proportional to the projection of \(g_A\) onto the span of available persona directions. The paper states that reinforcing Luigi forces some anti-aligned persona weight to increase, and that “manifest Waluigi then suppress” yields strictly larger first-order reduction of misalignment than pure Luigi reinforcement alone under the same small-change budget. It also presents high-level pseudocode for an Agentic-PPML training regimen based on extracting subagent profiles, identifying anti-aligned directions, and optimizing a KL-constrained alignment update.

## 7. Deployment constraints and open directions

The systems literature emphasizes deployment pragmatics. The secure-inference framework requires a library of compact domain models, each packaged with an MCP server exposing a standard `Infer` RPC, plus a registry advertising capabilities and public keys [2508.02836]. Its stated limitations are that it does not yet support general attention or very large domain networks under encryption. The paper identifies three open challenges: extending to Transformer blocks under MPC/FHE, automating domain-model selection and fallback when no exact match exists, and reducing communication via more aggressive PCG/OT extension.

PMAx emphasizes inspectability and auditability. Its open-source Python code, clear API specification, and self-correction loops produce prompt/code/error traces, while the shared artifact registry preserves intermediate outputs [2603.15351]. At the same time, its privacy guarantee is bounded by local execution and data minimization rather than by formal cryptographic proof. The paper explicitly presents future integration of local DP on summary statistics as an extension rather than a current property.

The probabilistic framework identifies a different frontier: principled modeling of latent subagents and explicit adversarial probing during alignment [2509.06701]. Its architectural insight is that reinforcing a single benevolent persona is insufficient because anti-aligned components may rise under the same intervention. This suggests that future Agentic-PPML research may continue to bifurcate into two streams: externally modular systems that isolate privacy-critical computation, and internally modular theories that analyze how coherent agency and misalignment emerge from compositions of subagents.

Source: https://www.emergentmind.com/topics/agentic-ppml