Architecture

The sealed wire

Activations travelling between nodes are framed without pickle and sealed with authenticated encryption. This secures the path - but deliberately not the endpoints.

What the wire fixes

When hidden states hop from one machine to the next, two classic failure modes have to be closed. First, code execution: naive tensor transport often relies on Python pickle, which is remote code execution waiting to happen. Second, eavesdropping: a passive observer on the network path should learn nothing from the bytes in flight.

The sealed wire closes both.

The frame format

A message is a typed frame, never a pickled object: a JSON header with control fields plus tensor dtype and shape, followed by the raw little-endian tensor bytes.

[ 4-byte length ][ JSON header ][ raw tensor bytes ]
                  |            |
                  |            +-- little-endian, dtype + shape from header
                  +-- control fields, tensor dtype, shape (no code, no pickle)

No pickle, ever

Because the payload is raw numbers described by a JSON header - not a serialized object graph - there is no code path that deserializes untrusted code. Frame size is capped (default 256 MiB via NOVIQ_MAX_FRAME) so a malformed header cannot exhaust memory.

Authenticated encryption

Each frame is sealed with ChaCha20-Poly1305 under a pre-shared swarm key (NOVIQ_PSK), with a fresh 96-bit nonce per frame. That gives confidentiality and integrity: a tampered or forged frame fails the authentication tag and is rejected.

seal(frame)   = ChaCha20-Poly1305(key = NOVIQ_PSK, nonce = random96, header + tensor)
open(frame)   = verify tag, then decrypt   # reject on any mismatch

What it does not fix

The wire is not the endpoint

Sealing the wire protects activations from an observer on the path. It does nothing about the node at the end of that path: a participating node must decrypt to run its layer, so it necessarily sees the activations it processes. Reconstructing the prompt from those activations is a separate, harder problem.

That endpoint problem is exactly what the NoviQ privacy stack attacks. Continue to The reconstruction adversary to see how the leak is measured, then Obfuscation and receipts for how it is driven down.

Roadmap

Today the wire uses a single pre-shared key for the swarm. Per-node identities keyed by worker tokens (a Noise or QUIC-TLS style handshake) are on the roadmap so each hop is mutually authenticated.