Integrated Quantum’s privacy-preserving machine-learning layer, VEIL, keeps raw records and the protective encoder inside the customer’s governed environment, while downstream models work with compact representations built for an approved task.
AI security starts before the model
Enterprise AI has a data-movement problem.
Long before a model returns a prediction, teams often copy raw or engineered records out of the systems that already govern them and into feature stores, notebooks, training clusters, model-serving environments, caches, logs and third-party platforms. Every additional copy becomes another asset that must be secured, monitored, retained correctly and eventually deleted.
Check Point reported that the average organization experienced 1,968 cyberattacks per week in 2025. That figure describes attacks, not breaches, and it is not specific to AI. Its relevance is more fundamental. When an external training or inference environment receives raw or reconstructable records, a compromise of that environment can expose the data along with the model.
Most enterprise security controls assume those copies will exist. Encryption protects information at rest and in transit. Access controls determine who can reach it. Monitoring may detect suspicious activity. Those safeguards remain essential, but they do not answer an earlier architectural question:
Does the downstream machine-learning system need the raw record in the first place?
VEIL changes what crosses the boundary
VEIL is privacy-preserving machine-learning infrastructure developed by Integrated Quantum Technologies. It places a deterministic, task-aligned encoder inside what the company calls the Source Environment. That may be a data warehouse, private cloud, on-premises system, or another customer-controlled environment where raw data are already authorized to exist.
The encoder transforms the source features into a compact latent representation designed for a defined supervised-learning task. Only that representation is released to downstream training or inference systems. The raw records and encoder remain inside the Source Environment, and no corresponding decoder is deployed downstream.
“Most AI security programs begin by protecting copies of sensitive data after those copies have already been created, VEIL begins one step earlier. We ask whether the downstream model can do its job without receiving the raw record at all.”
That distinction matters. VEIL is not a name-redaction tool, and it should not be understood as simply deleting every sensitive field. A useful machine-learning representation must preserve information relevant to the approved prediction. If a protected characteristic is closely correlated with that task, some statistical signal may remain.
VEIL’s core claim is narrower and more defensible. Its released representation is designed not to function as a recoverable substitute for the complete source record. Under the architecture described in its technical paper, the latent dimension is lower than the effective source dimension, multiple possible source records correspond to the same representation, the encoder is not exposed as a public query service, and no decoder is made available downstream. The technical argument and reported experiments are documented in an arXiv preprint.
Predictions, logs, identifiers, and query interfaces still require governance. A prediction can be sensitive in its own right. A latent vector stored beside a durable customer identifier may become joinable to outside information. A model endpoint that supports large numbers of precise queries may be vulnerable to model extraction.
VEIL reduces raw-input exposure. It does not eliminate every security and privacy obligation around the completed ML system.
A different place in the privacy stack
VEIL does not replace encryption, differential privacy, confidential computing, tokenization, secure multiparty computation, or conventional access control. Those technologies protect different objects and address different threat models.
Differential privacy limits what a released computation can reveal about an individual’s contribution to a dataset. Homomorphic encryption and secure multiparty computation allow defined operations to be performed while inputs remain protected. Confidential-computing systems isolate workloads while data are being processed. Tokenization is useful for selected identifiers, stable joins, and controlled recovery.
VEIL addresses the boundary between the governed source system and the downstream model. Its purpose is to minimize the information released across that boundary while retaining the structure required by the approved prediction task.
In a mature enterprise architecture, these controls can be combined rather than treated as substitutes.
VEIL’s post-quantum position also requires precise language. Its core representation protection comes from information that is discarded before export, rather than from the assumed difficulty of breaking a cryptographic key. Quantum computing therefore does not create a key that restores information that was never released. The rest of the system still needs encryption, authentication, integrity protection and an appropriate transition to post-quantum cryptography wherever those controls are used.
Evidence behind the claim
The current VEIL paper reports reconstruction, attribute-inference, property-inference, membership-inference, prediction-leakage and model-extraction tests across eight model and dataset pairs.
Under the reported protocols, the differential-privacy pipelines produced statistically significant positive reconstruction advantages in four of eight cases. The VEIL pipelines produced none. The paper also reports no statistically significant label-informed or black-box membership-inference success against the VEIL pipelines in the tested cases.
These results support the architecture under defined experimental conditions. They should not be interpreted as a claim that every future attack against every deployment is impossible.
The same paper reports that a VEIL-protected model on the Home Credit Default Risk benchmark achieved a test ROC-AUC of 0.7734, compared with 0.7582 for the raw-data baseline and 0.7426 for the differential-privacy baseline. On the E2006 regression benchmark, VEIL reduced a 150,360-dimensional input to 64 dimensions while matching the raw-data baseline, a reduction of approximately 99.96 percent.
Those results illustrate the intended design. The encoder discards variation that the approved task does not need while preserving, and in some experiments improving, predictive generalization.
Integrated Quantum also opened VEIL to a public challenge on Kaggle. Participants received 4,096 one-dimensional VEIL representations derived from a hidden 300-feature source matrix and were invited to reconstruct the underlying records.
The company reviewed 43 full-reconstruction submissions. No valid submission recovered the hidden source dimensionality and row-aligned source matrix required to establish successful reconstruction. The challenge was a company-administered, latent-only evaluation, so it represents one defined threat model rather than a universal security certification. Integrated Quantum itself acknowledged the limitations of relying on any single evaluation.
From research to enterprise deployment
VEIL has also moved beyond a research architecture. Integrated Quantum launched the product on the Snowflake AI Data Cloud in June 2026.
In the Snowflake Native App implementation, training and encoding take place inside the customer’s Snowflake account. The architecture makes no external network calls, exposes no public service endpoint, and gives the provider no runtime access to customer data. At query time, masking policies replace protected raw features with encoded vectors before those features are returned to non-bypass roles or passed into downstream workflows.
That deployment model matters commercially. Enterprise buyers rarely adopt a privacy technology on mathematics alone. They need to know where the code runs, whether their data leave their account, who can access model artifacts, how the system fits into existing permissions, and whether the protection survives routine MLOps operations.
VEIL is best suited to supervised-learning workflows in which a task-specific representation can replace raw inputs downstream. Likely users include financial institutions, healthcare organizations, insurers, government programs, and other enterprises that need to train or serve models across cloud, partner, regional, or organizational boundaries.
It is less suitable for a downstream workload that genuinely requires unrestricted, full-fidelity access to the original record for arbitrary analysis. That distinction should be made during architecture review rather than after deployment.
What enterprise decision-makers should ask
A CISO, Chief Data Officer, CTO, or Head of AI evaluating VEIL or any comparable approach should ask five questions:
- Do raw records leave the governed source environment at any point?
- Does the protective encoder remain under the customer’s control, or can an outside party query it?
- What information remains in the released representation, and how have reconstruction and sensitive-attribute inference been tested?
- What happens to predictions, logs, identifiers, and latent artifacts after inference?
- What evidence shows that the protection holds without making the business model materially less accurate, slower or harder to operate?
VEIL’s market proposition is straightforward. Enterprise machine learning should not create more raw-data exposure than the approved task requires.
Raw data stays. Task utility moves.
