OpenMined's PySyft coordinates confidential evaluations in which a model owner keeps its weights from the evaluator and the evaluator keeps its prompts from the model owner.
Both parties check an enclave's attestation, submit code and assets, and approve the code before it runs. In 2026, the AI Verification and Evaluation Research Institute (AVERI) evaluated Gemini 2.5 Flash Lite on private MLCommons prompts in Google Cloud Confidential Space, using PySyft v0.10.x on an NVIDIA H100 with Intel Trust Domain Extensions (TDX). A separate evaluation with the Singapore AI Safety Institute used a private prompt set.
The participants report end-to-end operation, but not all model code could be inspected or allowlisted. The guest operating system's builds were not independently reproducible, and Google's services signed and verified the attestation. The participant report contains no independent security evaluation of this workflow.
A participant report describes an end-to-end evaluation with private assets on commercial GPU hardware; PySyft's double-blind workflow has not been shown as a generally available service.
Assessed use: evaluating a private model on private prompts, neither party seeing the other's inputs
On this page
What it is
PySyft is OpenMined's software for running approved jobs across private assets 2. In its double-blind evaluation workflow, a model owner and an evaluator submit their assets to a confidential GPU enclave after checking its attestation 1. Neither party receives the other's weights or prompts 1.
How it works
Each party first checks a signed measurement of the enclave software 1. The model owner uploads weights and inference code; the evaluator uploads private prompts and evaluation code. Both review and approve the code before the enclave runs it. PySyft coordinates the submissions and approvals 1.