ARCHIVES

Two solutions for serving one open-weight language model to many tenants. TEMPLE-KEY-TRUST-HOST. Every tenant speaks to the model in its own secret private language: a per-tenant key 𝜅=(𝜋,𝑄)—a homophonic permutation 𝜋 of the vocabulary and a secret orthogonal rotation 𝑄 of the residual stream. A pretrained transformer is exactly equivariant to 𝑄 once LayerNorm is folded into RMSNorm, so the host runs a rotated copy, computes bit-for-bit the base model’s function, and sees only permuted symbols and rotated vectors. No training, no runtime cost; tenants cannot read one another (0% cross-tenant recovery against an eight-attack suite). Its limit is a theorem: rotated copies of one body are mutually alignable, so the party that executes the model can read. TEMPLE-MASK-TRUST-NOBODY. The host therefore never computes on readable numbers: every linear map runs on the host over fixed-point activations one-time-padded on ℤ264; every nonlinear step, the KV cache and the unembedding run on the tenant; the host returns 𝑊(𝑥+𝑟)+𝑏 and the tenant subtracts a precomputed 𝑊𝑟. The masks are prompt-independent preprocessing, supplied by a second cheap server at another provider (TEMPLE-DEALER-TRUST-NO-TWO) or by the host itself under exact homomorphic encryption when idle, with a stateless clerk parking the batches (TEMPLE-MINT-TRUST-NONE). Verified by eighteen self-checking tests and deployed on a rented GPU, a native C++/CUDA host and tenant answer at 24–25 ms per token (40 tokens/s), token for token the plain model’s answer; with the host minting its own masks, 23 ms per token after 13.6 minutes of idle GPU per 8,192 tokens. Twelve alternatives are recorded with the measurement or theorem that set them aside; a reference implementation reproduces every number.