Approach
How it works, and what remains unproven
An explanation of the system in plain terms, with enough detail for a specialist to verify it. Unproven claims are marked as such.
The loop
The server distributes the current model. Each participant trains it on its own data and returns an update: the change to the model, not the data. The server averages the updates, weighted by the amount of data behind each, and distributes the new model. This is standard federated learning. Raw data never moves, but the process is not private on its own.
Why plain federated learning is not enough
Model updates carry information about the data used to compute them. Published attacks have reconstructed individual training examples from shared updates in some settings, mostly images and text. How much could be recovered from a materials model’s updates has not been measured, but the risk warrants protection.
The aggregation step therefore uses secure aggregation. Each pair of participants agrees on a shared secret, and each participant adds a mask derived from it to its update. The masks cancel exactly when all updates are summed, so the server can compute the total but no individual update.
The hard parts
The cryptography is well established; the harder problems lie elsewhere. Participants’ data covers different chemistries, so their updates pull the model in different directions and the average can degrade (non-IID data). Laboratories measure the same property with systematic differences that can exceed the effect being learned. Finally, the software must be something a company’s IT department will install, audit and operate without granting us access.
What secure aggregation does not do
- —With only two participants, each can subtract its own update from the total and recover the other's; a pool requires at least three.
- —Masks can be reconstructed if enough participants collude. We use a simple-majority threshold, trading some protection for resilience to dropouts.
- —It protects updates in transit, not the trained model, which can reveal information about unusual training examples. The standard remedy, differential privacy, adds noise at a cost in accuracy; it is not yet implemented.
- —Because the server cannot inspect individual updates, the standard defences against a participant submitting a corrupted update are also unavailable.
Where the ownership line sits
Many neural models for materials have two parts: an encoder, which converts a material’s composition or structure into a numerical description, and a head, a small final layer that predicts one property from that description.
The encoder benefits most from data across many groups; the head is specific to each participant’s property and instruments. We propose drawing the ownership line there: the encoder held by a neutral custodian, the head and everything it produces owned by the participant.
structure / composition / measurement
|
[ ENCODER ] <- learned across everyone, held in custody
|
embedding
|
[ HEAD ] <- your property and instruments, owned by you
|
your answerArchitecture-neutral by design
The pipeline treats the model architecture as a setting and can train a participant’s preferred architecture. Architectures change every few years, so the value should reside in the pipeline, the cross-laboratory data work and the evaluation, not in any single design.
The core: validation
Pooling and security make private data usable. Validation is its most valuable application: predicting which candidate materials can be synthesised. The information that answers this lies mostly in failed experiments, which are rarely published. Pooled under the same protections, laboratories’ failure records can train a model no single laboratory could.
The design keeps four separate scores (novelty, stability, synthesisability and improvement over existing materials), so a model cannot score well by re-proposing known materials. On public data it outperforms a similarity-only baseline on compounds reported after its training data, where formula size is controlled for. It has not yet been trained on any failure records.
How validation works and what it has shownQuantum computers, and what they change
The key exchange behind secure aggregation is computationally secure: it holds as long as certain mathematical problems remain hard. Traffic recorded today could in principle be decrypted later by a sufficiently large quantum computer. We have tested a NIST-standard post-quantum key exchange in its place, and it works with the masking. Separately, quantum protocols exist for delegated computation whose privacy does not rely on any computational assumption. For data that remains valuable for decades, this may eventually matter.
These protocols require quantum hardware that does not yet exist at the necessary scale; some published roadmaps suggest the end of the decade. Nothing we offer today depends on it.
Limitations
- —The pooling gain has been measured only on public benchmarks with simulated holders, not on any laboratory's real data. For a strong specialist, the pooled model performed worse on its own chemistry.
- —Secure aggregation prevents the server from seeing individual updates, which also rules out the standard defences against a corrupted update. This trade-off has been measured but not resolved.
- —The coordinator does not yet authenticate members, and no run has yet spanned two physical machines.
- —Validation has been tested only on public proxies. No failed-synthesis records have been used, although they are central to its purpose.
- —No real-world advantage for quantum machine learning has been demonstrated as of 2026. We do not claim a quantum model would be more accurate; the potential benefit is a privacy guarantee independent of computational assumptions.
- —Quantum generative models do not outperform classical diffusion and flow models at crystal generation.
- —Quantum hardware able to run those protocols is a roadmap projection, not a commitment.
- —Post-quantum cryptography, which already works in our tests, weakens the case for ever needing the quantum version.
- —Even in the quantum protocols, the server can see the size of the computation, though not its content.
The measurements behind these statements are on the results page.