Engineering Secure AI Systems with Lattice-Based Cryptography and Large Language Models

Abstract

Deploying large language models in safety-critical domains while migrating to post-quantum cryptographic standards poses a compounded systems engineering challenge: infrastructure must become privacy-preserving, computa-tionally viable, and quantum-resistant at once. This review examines three frontiers where lattice-based cryptography and large language models converge, applying an evidence-grading scheme that separates established results from conjecture. The first frontier is fully homomorphic encryption for private model training. Ciphertext error does not provide differential privacy: it is not calibrated to query sensitivity, involves no gradient clipping, and is removed by decryption. The two mechanisms defend against disjoint adversaries and must be composed, not substituted. The second frontier is the hypothesis that language models can act as adaptive agents inside lattice reduction. No empirical result supports it. The review further shows that scheduling improvements cannot reduce core security estimates, since these depend on the minimum viable block size rather than the number of reduction tours, and supplies a falsifiable benchmark protocol in place of the parameter-selection guidance of earlier treatments. The third frontier is functional encryption for decentralized inference. Inner-product constructions admit exact reconstruction of hidden states by any node holding a spanning key set, requiring no cryptanalysis, so security rests on key allocation rather than lattice hardness. Attention is bilinear and lies outside the inner-product functionality class. Quantitatively, encrypted inference for a small encoder costs roughly five orders of magnitude more than plaintext, measured on a graphics processing unit; functional key material reaches four tebibytes per attention layer under the parameters the security proof requires, reducible by three orders of magnitude at a stated security cost; and memory capacity, not arithmetic throughput, is the binding constraint. Readiness levels for the three frontiers span one to three. Trusted execution environments remain the only approach in production today.