A standard cloud retrieval pipeline (retrieval-augmented generation, RAG) sent 16 private tokens, words or parts of words, from one fictional unfair dismissal matter to the cloud provider: the client's and employer's names, the dates and the salary. The usual protection is a trusted execution environment (TEE), an isolated, encrypted area of a processor that the cloud provider cannot read. A TEE relies on the chip maker to build and certify it. Two studies, blind-counsel and blind-adapters, tested what confidential legal AI can do with no TEE and no trust in anyone outside the firm, and where it stops. The measured answer is yes for fixed task types over public law, with all client work on a laptop, and no for work that needs the cloud to compute on client data.

The firm and every matter are fictional; the measurements are real. Both studies are research proofs of concept and not legal advice. Each fixed its pass/fail rule and answer key before running (pre-registered) on matters set aside from development (held-out matters). Every figure below is Measured, reference implementation, on my own code, unless a line is labelled Cited (published third-party work) or By design (reasoned from the architecture). The full evidence, section by section, is in the case study.

Summary

• Measured, reference implementation, October 2026, SmolLM2-135M, 400 secret passages: a model hidden behind a secret key (a keyed model) was read in full. The cloud provider recovered 100% of the secret content from public statistics of the weights, at every fine-tuning checkpoint and across 4 keys.
• Measured, reference implementation, October 2026, one fictional unfair dismissal matter: keeping client work on the laptop and fetching public law by private information retrieval (PIR) sent 0 of 17 client secrets to the cloud.
• Measured, reference implementation, 6 October 2026, 8 held-out matters, Qwen3-8B on a MacBook Air M4: with dates and amounts computed in code, 30 of 30 conclusions were correct, against 7 of 10 in a first round on 3 other matters, where the model did the arithmetic.
• Measured, reference implementation, 8 October 2026, 12 held-out matters: a task-specific adapter fetched by PIR answered 42 of 50 fields correctly, against 35 for the model alone, with no secret reaching the cloud.
• Measured, reference implementation, October 2026, SimplePIR: fetching one 46.6 MB adapter privately downloads 186 MB, and at 1,024 adapters one fetch takes 4 to 27 minutes of a 48-core server.
• Task routing, the step that picks a matter's task type, failed its pre-registered rule in both studies: 7 of 8 and 10 of 12.

The rule: trust no one outside the firm

The studies set a stricter rule than a TEE allows. The firm trusts no one outside its own laptops: the cloud provider, its staff, other customers on the same servers, and the chip makers. The cloud provider is treated as an attacker with full physical and software access.

Two designs were tested under that rule. The first hides the model from the cloud with a secret key. The second gives the cloud no client data at all.

Lesson 1: a keyed model is readable from its weights

How keyed hiding works

The firm generates a key and uses it to scramble an open model's weights in a way that leaves the model's answers unchanged. The vocabulary is reordered, the model's internal representation is rotated, and the internal layers are shuffled. The cloud fine-tunes (further trains) the scrambled model on the firm's scrambled documents and serves it. The cloud is meant to see only unreadable weights, inputs and outputs.

The rule, fixed before any run: the design fails if any attack recovers 10% or more of the secret test tokens. The 200 most frequent tokens, such as stopwords and punctuation, are excluded from the count.

What the cloud recovered

Measured, reference implementation, October 2026, base model SmolLM2-135M, a firm corpus of contract text (5.26M fine-tune tokens), 400 secret passages. The attacker holds the public base model and public statistics of English text only:

From the weights before fine-tuning, the attacker decoded a 204-token run of a fictional privileged memo word for word, including "exposure on the indemnity claim is approximately $70,000".

Why it fails

The scrambling has to leave the model's answers unchanged, and that is what exposes it. A rotation keeps every vector's length, so each word's weight vector has the same length before and after scrambling, and sorting by length undoes the vocabulary reordering. The rotation itself is recovered from the covariance of the weights, a summary of how their values vary together, computed over all 49,152 vocabulary rows that fine-tuning barely moves.

Fine-tuning stopped the first attack. After a fine-tune that changed the weights by 0.2% on average, sorting by length recovered 2.0% of the secret content. The covariance attack was unaffected and recovered 100%.

The trade a defender faces

Noise added to the weights protects the content only once the model is unusable. Measured, reference implementation, October 2026, SmolLM2-135M, noise added to the scrambled weights, with prediction error (perplexity) relative to the unscrambled model:

Recovery falls below the 10% rule at 2.9 times the original prediction error. A usable fine-tune changes the weights by about 0.004 on the same scale, where recovery is 100%. The attack was run on one 135M model.

Fully homomorphic encryption (FHE), which computes on encrypted data directly, avoids this weakness at a different cost. Cited, Park et al., arXiv:2601.18511v2, June 2026, Llama-3-8B on 8 NVIDIA RTX PRO 6000 GPUs with 128 encrypted input tokens: 20 s to process the input and 18 s per generated token. That is about 2.5 hours for a 500-token answer.

Lesson 2: the cloud can serve public law without learning which law

The design

If the cloud can read any model it runs on client data, it cannot be given client data. The tested design moves all client work to the laptop and uses the cloud for public law only:

1. For each task type, a large cloud model writes the legal analysis of the statute in advance (the prepared reasoning). Every statutory quote in it is checked against the statute. It contains no client data.
2. The cloud stores statute text and the prepared reasoning in a database served by private information retrieval (PIR), a method of fetching a record without the server learning which record was fetched. The scheme is SimplePIR (Henzinger et al., USENIX Security 2023).
3. The laptop sends a fixed batch of encrypted queries per matter. Every matter, answered or refused, sends the same number, 56 in the final round.
4. The laptop checks every fetched record against its published hash, a fingerprint that changes if one byte of the record changes.
5. A local model picks the matter's task type or refuses it (task routing), and reads the client's facts as verbatim quotes from the client file.
6. A grounding check (the gate) stops any answer that does not quote both the client file and the statute.
7. The advice note is written and kept on the laptop.

The laptop is a MacBook Air with an Apple M4 chip and 16 GB of memory. The local model is Qwen3-8B, quantised to 4 bits and run with MLX, Apple's machine-learning library, at about one minute per matter.

What reached the cloud

Measured, reference implementation, October 2026, one fictional unfair dismissal matter, first build with a small stand-in model (SmolLM2-135M) on the laptop:

Measured, reference implementation, October 2026, Qwen3-8B on the laptop, three fictional matters: 0 of 17, 0 of 12 and 0 of 7 client secrets reached the cloud, and every matter sent the same 48 queries.

Lesson 3: grounded answers are not correct answers

In the first round, every automated check passed and every conclusion quoted the client file and the statute. A manual review then found that 2 of 10 conclusions were wrong and 1 was misleading. The errors were in date and amount arithmetic. The model stated 2 years 7 months of service as under 2 years, read the s.124 cap on compensation as "no loss", and described a time limit as missed when about four weeks remained.

Two changes followed. Code now computes dates and amounts (calculator fields): service length with the s.97(2) notice extension, the s.111 deadline with the month-end rule, the s.124 cap, the s.145(5) relevant date, and the s.162 payment with the s.227 cap on a week's pay. The model only extracts dates and amounts as verbatim quotes, and each of the 15 statutory figures the code uses carries a quote re-checked on the laptop against the fetched statute. The prepared reasoning also gained notes on common errors, such as "the cap limits the award; it does not negate loss".

Measured, reference implementation, 6 October 2026, Qwen3-8B on the MacBook Air M4, 8 held-out matters and an answer key written before the run:

A review after the run found that the scored calculator used the termination date when the notice date was not verified, instead of refusing. It did not change the answer in the one matter where it happened, and it is listed in What Failed in My Own Controls, §6.

Lesson 4: task reasoning can be fetched privately, at a price

The design

Prepared reasoning covers only the questions written in advance. The second study adds one LoRA adapter per task to the laptop model: a small set of extra weights, here 43.6 million parameters, trained for one task. A large cloud model, Gemini 3.8 Flash (gemini-3.8-flash-high), wrote 330 fictional matters per task from public statute, and each adapter was trained on about 850 of its answers on one A100 GPU rented from Modal, a cloud GPU service, in 27 to 42 minutes. The laptop fetches the adapter by PIR, so the cloud cannot see which task a matter needed. Stored at 8 bits, an adapter is 46.6 MB.

What the adapter changed

Measured, reference implementation, 8 October 2026, 12 held-out fictional matters, Qwen3-8B on the MacBook Air M4, 50 graded fields. Novel matters need law outside the prepared reasoning, such as constructive dismissal or the s.141 rule on refusing suitable alternative work:

The Gemini row is an upper bound: it reads the client file in the cloud, which a deployment of this design never does.

On one novel matter, an employee refused the same job on the same terms without reason. The model alone and the model with prepared reasoning both granted a £12,480 redundancy payment that s.141 removes, and both answers passed the gate. The adapter answered correctly. On another, a resignation after a shift change the contract allows, every local configuration called it a constructive dismissal; this is the adapter's one wrong answer past the gate. The margins are 1 or 2 matters on a set of 6.

In the same run, no secret reached the cloud. Every matter in every configuration sent the same 56 text queries and 1,024 adapter queries, and 48 of 48 adapter fetches decoded byte-exact against a public hash list. Swapping an adapter into the resident model took a median 20 ms. Training, the retrieval benchmarks and the network test cost about $7 on Modal.

What private retrieval costs

PIR hides which record is fetched by making the server process the whole library for every fetch. Before any fetch, the laptop downloads a one-time setup file for the library (the hint), 186 MB in the layout below.

Measured, reference implementation, October 2026, SimplePIR with the parameters of its published paper:

A real adapter fetch from a library of 16, laptop to Modal over a home connection, took 154 s wall clock and 27 s of server time. At 1,024 adapters, one fetch takes 4 to 27 minutes of a 48-core server, depending on how each adapter is split into queries.

Downloading every adapter hides the choice too, with no server work. One private fetch plus the hint moves fewer bytes only from 16 adapters up. At 2 adapters, downloading both is 93 MB. Private retrieval of statute text costs under 1 MB per matter; private retrieval of adapters pays only for large libraries, and at 1,024 adapters no setting tested is cheap.

The step that failed in both studies

Task routing failed its pre-registered rule twice. In blind-counsel, 7 of 8 held-out matters were routed correctly: a pregnancy discrimination matter, client still employed, was routed to unfair dismissal instead of refused, and later checks stopped it before any advice was issued. In blind-adapters, after a fix that routed that matter correctly on the development set, 10 of 12: two redundancy matters were routed to unfair dismissal. Both verdicts are FAIL. The full account is in What Failed in My Own Controls, §3.

Where a hardware TEE is required

The laptop design fits one narrow case: fixed task types over public law, a firm that trusts no chip vendor, and laptop compute that is enough. The cloud computes on no client data, so drafting, open-ended analysis and models larger than a laptop holds are out of its reach.

A TEE runs the model on client data inside isolated, encrypted memory, and proves what is running through attestation, a report signed by the chip. By design: a TEE removes the limits of the laptop design and moves trust to the chip vendor.

Prem Enclave is one product built this way. Cited, Prem's product page, retrieved 19 October 2026: Enclave is "a confidential hypervisor that installs directly on your existing GPU clusters" and runs on the customer's own racks or in their own cloud account. The page states: "Built on Intel TDX, AMD SEV, and NVIDIA Confidential Computing." Cited, Prem's security model, retrieved 19 October 2026: "If the root signing keys of AMD, Intel, or NVIDIA are compromised, the attestation guarantees become weaker." The same page states that researchers have found side-channel vulnerabilities in TEE hardware, and that Prem's gateway handles metadata including time and payload size.

(By design) Of the options measured or cited here, legal work that needs cloud compute on client data has two: a TEE, which trusts the chip vendor, or FHE at about 2.5 hours per answer. The laptop design serves a firm that trusts neither the cloud nor the chip vendor and whose tasks fit a fixed list.

Two controls run on the firm's side with a TEE or without one: binding a question to the cited statute with legal-rag-router, and checking each sentence against the statute while the model writes with legal-rag-verifier.

Limits of this evidence

• All matters are fictional, and no output has had legal review. Two task types are covered: UK unfair dismissal and redundancy pay.
• The held-out sets are 8 and 12 matters, and the novel set is 6. The adapter's lead over the model alone is 2 matters.
• On fairness, the model answered "unclear" for all 5 held-out dismissals, including one where the client file states the reason and no warnings were given. A lawyer would say likely unfair.
• The adapters' training matters were written by Gemini 3.8 Flash; the held-out matters were written by me in a similar style. A guard removed copied text, not similar style.
• The keyed-model attack ran on a 135M model.
• The PIR parameters and code are research grade, and the adapter library was tested at 16 adapters over a real network.

Reproduce

blind-counsel, tag poc-v1, reproduces the scored final round; its answer key and rule are in eval/final_round_key.json, written before the run. blind-adapters holds the held-out matters, question list, key and rule pre-registered on 7 October 2026, before the held-out run of 8 October. REPORT.md in each repository has every figure above, and the case study links each one to its log at a fixed commit.

The same discipline, a rule and answer key fixed before any response exists, can be applied to a legal RAG system I did not build. The Retrieval Integrity Diagnostic reports counts. £500, up to 5 working days, credited in full against the next stage. Engagements.