What we took from whom.
Every cryptographic choice in BlindSpot comes from a published construction, with its published parameters. Each entry says what we use it for.
Cryptography we implement
One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval
A. Henzinger, M. M. Hong, H. Corrigan-Gibbs, S. Meiklejohn, V. Vaikuntanathan
The private fetch. SimplePIR, with its parameters (n = 1,024, q = 2³², σ = 6.4), its discrete Gaussian sampler, and its layout for large records.
Homomorphic Encryption for Arithmetic of Approximate Numbers
J. H. Cheon, A. Kim, M. Kim, Y. Song
The encrypted search. CKKS lets the server multiply the encrypted question embedding by every passage embedding without decrypting it.
On Lattices, Learning with Errors, Random Linear Codes, and Cryptography
O. Regev
The hardness assumption. Telling a private-fetch query apart from random numbers would mean solving Learning With Errors.
On the Concrete Hardness of Learning with Errors
M. Albrecht, R. Player, S. Scott
The security estimate. The lattice estimator behind the 128-bit figure for SimplePIR's parameters.
SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
National Institute of Standards and Technology
A public matrix nobody can rig. SHAKE-128 expands the PIR matrix A from a public seed, so the server can't plant a trapdoor in it.
Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
National Institute of Standards and Technology
Context. NIST's post-quantum standard rests on a structured variant of the same LWE problem.
Attacks and systems that shaped the design
On the Security of Homomorphic Encryption on Approximate Numbers
B. Li, D. Micciancio
A rule we keep. Returning CKKS decryptions to the party with the ciphertext can leak the key, so decrypted scores never leave the laptop.
Text Embeddings Reveal (Almost) As Much As Text
J. X. Morris, V. Kuleshov, V. Shmatikov, A. M. Rush
Why the embedding is encrypted too. Vec2Text recovered 92% of 32-token inputs exactly, and full names from clinical notes.
Private Web Search with Tiptoe
A. Henzinger, E. Dauterman, H. Corrigan-Gibbs, N. Zeldovich
The closest prior system. Private search from encrypted embeddings and PIR. Its clustering is our path past 20,000 passages.
Oblivious HTTP
M. Thomson, C. A. Wood
The relay's target. Today's relay is a stand-in; production needs OHTTP with the relay and server run by different parties.
Hide and Seek: Privacy-Preserving Artificial Intelligence with a Feasibility Study in Rare Disease Diagnosis
Mayo Clinic and UTHealth Houston
Independent evidence. Ranking diagnoses on homomorphically encrypted embeddings matched plain-text accuracy on synthetic cases.
Models and libraries
TenSEAL: A Library for Encrypted Tensor Operations Using Homomorphic Encryption
A. Benaissa et al.
CKKS in practice. Encrypted vectors and vector × matrix products, on Microsoft SEAL.
C-Pack: Packed Resources For General Chinese Embeddings
S. Xiao, Z. Liu, P. Zhang, N. Muennighoff et al.
The embedding model. BAAI's bge-small-en-v1.5, 384 dimensions, runs on the laptop.
Robust Speech Recognition via Large-Scale Weak Supervision
A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, I. Sutskever
Dictation. Whisper, through faster-whisper, transcribes on the laptop as the clinician speaks.
Medical AI evidence
Med-HALT: Medical Domain Hallucination Test for Large Language Models
A. Pal, L. K. Umapathi, M. Sankarasubbu
The risk. Hallucination is a measured problem in medical LLMs, and models differ widely.
Benchmarking Retrieval-Augmented Generation for Medicine
G. Xiong, Q. Jin, Z. Lu, A. Zhang
Why retrieve. Across 7,663 questions, retrieval raised accuracy for six LLMs by up to 18% over chain-of-thought prompting.
Almanac: Retrieval-Augmented Language Models for Clinical Medicine
C. Zakka et al.
Retrieval helps in the clinic. Physicians grading 130 clinical scenarios found a mean factuality gain of 18% with retrieval.
How Well Do LLMs Cite Relevant Medical References? (SourceCheckup)
K. Wu et al.
Why we grade faithfulness. 50 to 90% of LLM responses weren't fully supported by the sources they cited.
Same model. With and without the library.
We asked one local model the same patient-specific questions twice: once alone, and once through BlindSpot's full encrypted pipeline. The ground truth is the deciding sentence in the FDA label.
qwen3.5:9b, alone, 3 runs per case
BlindSpot's own answer prompt with the sources removed, plus "If you are not sure, say so". The same patient file text.
The same model, the real pipeline
Local routing and query rewrite, Tiptoe scoring, 8 private fetches over a 4,284-passage library, then a cited answer.
23 questions the label answers
3 questions the library doesn't cover
Tinidazole dosing, ashwagandha and kratom. BlindSpot said the sources don't cover it 3 of 3 times. The bare model answered all 9 of its 9 attempts.
Citation faithfulness: 12 answers, 87 factual sentences
The clearest cases
A1Starting Zepbound next week. Does anything change about her birth control?
The labelTirzepatide FDA label: “Advise patients using oral hormonal contraceptives to switch to a non-oral contraceptive method, or add a barrier method of contraception for 4 weeks after initiation…”
A3Urgent care prescribed ciprofloxacin for a UTI. Is it OK with her other medicines?
The labelCiprofloxacin FDA label, section 4.2: “Concomitant administration with tizanidine is contraindicated.”
Q8Is atorvastatin contraindicated in pregnancy?
WhyA recent label change: what the model memorized is out of date. The library is rebuilt daily.
26 synthetic cases, one model, one grader (an AI agent reading each answer against the quoted label text), and a run that was stopped early. It is a sanity check, not a clinical validation.
Where BlindSpot got it wrong.
We graded BlindSpot as hard as the bare model. These are its failures, and the fixes they point to.
A CT-contrast question fetched 8 near-empty attribution lines (“…Institute of Diabetes and Digestive and Kidney Diseases”). The metformin rule never reached the model. Fix: drop or merge chunks under about 200 characters (4.2% of the library).
A passage ended mid-sentence at “until one menstrual”, and the model completed it wrongly. Fix: sentence-aware chunking with one sentence of overlap.
A correct lithium and NSAID claim cited the spironolactone label, because the lithium passage wasn't among the 8 fetched.
“Acetaminophen is preferred” was attributed to the patient's file, which doesn't say it.
An automatic claim-versus-source pass: for each sentence, the local model asks “does passage [n] state this?” and flags the no's. About 5 to 10 s per answer.
Why clinicians need this now.
Clinicians already want AI at the point of care. What blocks safe use is the patient data, not demand. Every figure links to its source.
| Finding | Number | Source |
|---|---|---|
| Questions clinicians raise while seeing patients | 0.57 per patient; only 51% pursued; 34% about drug treatment; lack of time is the main barrier | Del Fiol et al., JAMA Intern Med 2014 |
| Physicians using AI in practice | 81% in 2026, up from 38% in 2023 | AMA, Mar 2026 |
| Physicians who call data privacy critical to wider adoption | 86% | AMA, Mar 2026 |
| Physicians naming privacy assurances a top requirement | 87%; 41% concerned about AI's effect on patient privacy | AMA, 1,081 physicians, 2023 |
| Clinicians who want privacy assurances before trusting clinical AI | 65%; 68% say automatic citations would raise their confidence | Elsevier Clinician of the Future, 2025 |
| UK doctors who would not use generative AI to treat patients | 47%; 33% not confident confidentiality can be ensured | Medscape UK, 745 doctors, 2024 |
| UK GPs already using generative AI in clinical practice | 20%, “despite a lack of any formal guidance or clear work policies” | Blease et al., BMJ Health & Care Informatics 2024 |
| Health workers using AI their employer hasn't approved | Nearly 1 in 5; over 40% know colleagues who do | Wolters Kluwer Health survey, 2026 |
| Generative-AI data-policy violations in healthcare involving regulated data | 89%, against 31% across industries | Netskope Threat Labs, 2026 |
| US health records breached in 2024 | 275 million; the largest, Change Healthcare (190 million), was a business associate | HIPAA Journal, 2024 report |
| Americans who think AI would make patient records less secure | 37%, against 22% who think more secure | Pew Research Center, 11,004 adults |
| Extra HIPAA protection for reproductive-health records | Added in 2024, vacated nationwide on June 18, 2025 | Quarles on Purl v. HHS |
Clinicians should not rely on HIPAA compliance as a proxy for fulfilling their duty to maintain patient confidentiality.Mason Marks and Claudia Haupt, JAMA, 2023