Approach

How it works, including the parts that don’t work yet

This page is written for someone technical. If a claim here is load-bearing and unproven, it says so — you would find out in ten minutes anyway, and it is better that it comes from us.

The loop

The server broadcasts model weights. Each participant runs local training on its own examples and returns an update. The server averages the updates, weighted by data volume, and broadcasts again. Raw data never moves. That much is standard federated learning, and on its own it is not private.

Why plain federated learning is not enough

Model updates leak. Gradient inversion attacks can reconstruct training examples from shared gradients — which for a materials group means reconstructing the experiments themselves. Anyone selling federated learning as private without addressing this is either not aware of it or hoping you are not.

So the aggregation step uses secure aggregation: every pair of participants agrees a shared seed, and each adds a pseudorandom mask derived from it. The masks cancel exactly in the sum. The aggregator can compute the total and learns nothing about any individual update.

Where the ownership line sits

Nearly all materials ML factorises the same way: a general encoder that turns structure and composition into a representation, and a task-specific head that turns that representation into a prediction about a particular property.

The encoder is learned from everyone and no single group would ever build it — no one lab’s task justifies its generality. The head is different for every participant by nature. So the ownership line goes on that seam: the shared encoder is held by a neutral custodian, and everything above the embedding is yours.

structure / composition / measurement
        |
   [ ENCODER ]   <- learned across everyone, held in custody
        |
    embedding
        |
   [ HEAD ]      <- your property, your instrument. Yours.
        |
   your answer

We deliberately hold no architecture position

The pipeline takes the model family as a parameter. If your group has an architecture it believes in, we will train that one. This is not diplomacy: architectures turn over every couple of years, and any company whose asset is one specific architecture gets obsoleted by a paper. The durable asset is the pipeline, the harmonised representation across labs, and the evaluation.

The layer that arrives later

Secure aggregation is computationally secure: it holds against an adversary with bounded compute. There is a quantum construction that is information-theoretically secure — it holds against unlimited compute, permanently. For experimental data with a thirty-year commercial life, that difference eventually matters, and it is where this ends up.

It needs hardware that does not exist yet, on published roadmaps that put it around 2029. Nothing we offer today depends on it, and we would rather say that plainly than let it decorate a pitch.