Proof > Trust
Confidential computing proved the host can't read your data. No one has proved that about the tenant beside you.
That missing proof decides whether shared AI serving can be affordable. Cittela is an independent research lab working on isolation, erasure, and verification for shared AI infrastructure.
18 filed UK patent applications · 3 papers & proofs · 4 surfaces · machine-checked
[ Agenda ]
Three problems, one primitive underneath.
[ Results — tenant density, v2.4 sweep ]
Scope of this run: tenant-density and cost measurement only. No security property is measured and no security claim is made. The isolation triple is a gate on the density number, not a published isolation result. The adversarial isolation evidence is the separate metric-v2 work and the 1000-tenant paper, on a different surface.
Halving tenant size roughly doubles tenants per instance, at every latency target the registered ladder resolves. That is the finding that transfers to other workloads. The isolation gate passed in all 160 pairs, including at 32 tenants.
| prefix · arm | 0.50 s | 0.75 s | 1.00 s | 1.50 s | 2.00 s |
|---|---|---|---|---|---|
| 2048 · A | 8 [8,8] | 16 [8,16] | 16 [16,16] | ≥32* [16,32] | ≥32* [32,32] |
| 2048 · B | 8 [4,8] | 8 [8,8] | 16 [16,16] | 16 [16,32] | ≥32* [32,32] |
| 4096 · A | 4 | 8 | 8 [8,16] | ≥16* | ≥16* |
| 4096 · B | 4 | 8 | 8 | ≥16* | ≥16* |
| 8192 · A | 2 | 4 | 8 [4,8] | 8 | ≥16* |
| 8192 · B | 1 | 2 | 4 | 8 | ≥16* |
* Passed at the largest N tested: a ladder floor, not a hardware limit. Capacity above the registered ladder is not measured and is never extrapolated. No OOM occurred at any cell, so no memory ceiling was found.
The rotation cost is prefill work
The within-pair gap scales with prefix length: median 0.0573 s at 2048, 0.0891 s at 4096, 0.1836 s at 8192. Ratios 1.56× and 2.06× against 2.00× prefix steps, approximately proportional. It is a fraction of prefill, not a flat number of seconds: the ~0.18 s figure is specific to 8k prefixes, and a 2k-prefix tenant pays ~0.05 s.
Rotation is density-free at most operating points
Both arms land on the same capacity rung at every 4096 combination, at 2048 for the 0.50 s, 1.00 s and 2.00 s targets, and at 8192 for 1.50 s and 2.00 s. At those points rotation costs no capacity and no cost per tenant. It costs one rung at 2048 for 0.75 s and 1.50 s, and at 8192 for the 0.50 s to 1.00 s targets. Cost lands at $0.12–0.25 per tenant-hour at small tenants and moderate latency targets, at the $3.9492/hr H100 rate used for the run.
What failed
P2, the prediction that the rotation arm's p95 exceeds the baseline arm's in every pair, failed in 2 of 160 pairs. Both are at 32 tenants at 2048, the one cell where the gap signal (~0.05 s) is smallest against the queueing noise (~1.5 s p95). As registered it quantified over every pair, so it is failed; no gate was adjusted after the fact.
P4, equal capacity at the 1.00 s target at 8192, failed: the rotation-off arm's N=8 p95 sits almost exactly on the 1.00 s threshold and has flipped across protocol versions, this being the third. The stable statement is that rotation-off is 4-or-8 across boots there while rotation-on is uniformly 4.
Not measured
Enclave overhead: no cell has ever run in a confidential-computing mode. Capacity above the registered ladder: every ≥ entry is a floor. Gap behaviour where the per-boot drifts disagree in sign. Any security property.
Provenance. Bare H100 80GB; no confidential-computing mode. Qwen 2.5 3B Instruct, vLLM, eager execution, max_num_seqs 128, prefix lengths 2048 / 4096 / 8192. Median of five boots on five distinct devices, 160 arm-paired measurements; cross-boot spread 10–21%, growing with N. Pre-registered before any GPU ran, commit 976aefd; report at commit 679ba84.
How figures are reported, pre-registration, and the superseded-figures register →
[ About ]
Cittela is a deep-tech IP and research lab. We solve data problems with one of the oldest branches of mathematics: geometry. Just as biomimicry draws its solutions from biology, ours are drawn from geometric structure, an approach we call geomimicry.
In practice this is a single unified primitive: a lattice basis combined with a rotational orientation, composed into architectures that encode, isolate, and protect data across storage, transit, and computation. Rotation is an isometry, so the properties are exact and machine-checked. The portfolio is backed by 18 filed UK provisional patent applications.
That primitive is being developed into four surfaces: per-tenant isolation for AI inference, confidential multi-tenant retrieval, per-subject cryptographic erasure, and machine-checked verification. The results are published and independently checkable: measured isolation and oversubscription on attested confidential H100s, the at-rest leakage bound, and two machine-checked proof crates, all below. The earlier attacker-tested study at 1000 tenants on a MacBook remains citable as the first version of the isolation paper.
For partnership and investment enquiries: hello@cittela.com
[ Four surfaces ]
Each surface composes with a tool that already works, and secures the layer beneath it that the tool does not reach. trust.band is the first product built on one of them: provenance-aware authorization for AI agents, on the Warrantable core.
[ Papers & Proofs ]
[ Blog ]
Explorations built to understand the primitive, not offerings.