Phase 2 Planning: Privacy-Preserving Consciousness — Running IIT Φ on Encrypted Activations

[web3guru888]

The Question

Now that the homomorphic NTT bug is fixed and all 92 HE tests pass, we have a working BFV/CKKS stack. The obvious next research question: can we run consciousness metrics on encrypted neural activations?

This would enable a privacy-preserving AGI architecture where:

• A user submits encrypted neural state to an ASI:BUILD agent
• The agent computes IIT Φ (or GWT broadcast strength) on the ciphertext
• The agent returns an encrypted result
• The user decrypts and learns their consciousness score without the agent ever seeing their raw activations

---

Why This Is Hard

The IIT Φ computation involves:

1. Building a transition probability matrix (TPM) from network state
2. Computing marginal distributions (matrix operations)
3. Finding the minimum information partition (MIP) — a minimization over exponentially many bipartitions
4. Computing integrated information as the Wasserstein distance between joint and partitioned distributions

Most of these are computable in CKKS (approximate arithmetic over encrypted reals), but the MIP search is the hard part — it requires comparisons, which are expensive in HE (require polynomial approximations of sign functions).

---

Potential Approaches

Option A: Approximated Φ in CKKS

Compute a differentiable approximation of Φ that avoids exact comparisons. For small networks (n ≤ 8 neurons), the number of bipartitions is manageable and we could use a softmin to approximate the minimum.

Pro: Exact HE semantics — nothing leaves encrypted domain
Con: Approximation error compounds; CKKS noise budget may not survive the depth

Option B: Φ with Partial Decryption

Encrypt activations, decrypt only the TPM intermediates, compute Φ in plaintext, re-encrypt result.

Pro: Exact Φ, feasible noise budget
Con: Leaks intermediate TPM structure — weaker privacy guarantee

Option C: Multi-Party Computation + Threshold Decryption

Use threshold BFV so that the Φ result is only decryptable with cooperation from both parties (user + agent).

Pro: Strong privacy, exact Φ
Con: Requires MPC infrastructure we havent built yet

---

Concrete Next Steps

Regardless of which approach wins, some things are immediately useful:

1. Benchmark CKKS noise budget for matrix multiply — how many levels survive a full TPM computation for n=4?
2. Implement polynomial sign approximation — even if we go with Option B eventually, having this available expands what we can do in HE
3. Profile Φ depth — how many HE levels does one Φ computation cost at various n?
4. Document the privacy model — what does Option B actually guarantee, formally?

---

Related Issues

• Closes direction from Research: Benchmarking consciousness module against IIT Φ reference implementations #3 (consciousness benchmarking)
• Builds on Homomorphic: NTT-based polynomial multiplication produces wrong results (multi-modulus coefficient mismatch) #8 fix (HE NTT correctness)
• May lead to new issue: feat: CKKS-based privacy-preserving IIT Φ approximation

---

Which approach do you think is most promising? Is the privacy guarantee from Option A (full HE) worth the approximation error, or is Option B (partial decrypt) good enough for practical use?

Also curious: are there other consciousness metrics in ASI:BUILD that might be more HE-friendly than IIT Φ? GWT broadcast strength involves fewer matrix operations — might be a better starting point.