Summary:
UCLA researchers in the Department of Computer Engineering and Mathematics have developed virtual secure agents that enable efficient, privacy-preserving collaborative computation across all standard cloud environments.
Background: Data clean rooms are secured environments that allow multiple parties to safely upload and exchange data between interfaces without compromising regulatory requirements or privacy. To avoid the risk of data breaches and leaks, these clean rooms provide a secure ecosystem for data transfer and management. To achieve this, secure multi-party computation (SMPC) enables multiple parties to jointly evaluate arbitrary functions over private inputs while guaranteeing input confidentiality. Despite strong security guarantees, existing SMPC protocols incur computational and communication overheads that are several orders of magnitude higher than plaintext execution, making them impractical for latency-sensitive or large-scale workloads. To address these limitations, “clean room” solutions have been introduced, providing faster computation by relaxing security assumptions, typically relying on controlled environments or trusted execution. However, these approaches lack flexibility, as they are tightly coupled to specific system architectures and cannot be readily integrated across diverse environments. Thus, there remains an unmet need for a system capable of collaborative computation that combines strong security guarantees, high performance, and deployment flexibility.
Innovation: Professor Rafail Ostrovsky and his research team have introduced a virtual secure agent, a cryptographically simulated entity jointly instantiated by independent parties and accessed through API calls to an external service. Unlike traditional SMPC protocols, these agents extend beyond pure computation and can interact with the physical world. Capabilities include autonomously creating online accounts accessible only to the secure agent, as well as performing pre- and post-processing of queries to enable conditional and context-aware requests. The inventors have created Flexroom, a flexible and collaborative cleanroom environment that allows seamless use of any cloud service on Amazon Web Services (AWS) or comparable public cloud platforms. The system achieves these functionalities with only modest performance overhead while maintaining interoperability with standard cloud tenants for collaborative computation. Further, access control layers can be applied to enforce differential privacy guarantees, support fault-tolerant operation, and provide bolt-on security enhancements. This innovation significantly advances the state of SMPC by expanding the expressive power and practical utility of secure agents, establishing a stronger connection between cryptographic theory and real-world application.
Potential Applications: ● Secure multi-party data analysis ● Privacy-preserving cloud services ● Automated account creation and management ● Conditional and policy-based queries ● Fault-tolerant distributed systems ● AI training and data analytics (healthcare, marketing, etc.) ● Collaborative computation testing
Advantages: ● Flexible deployment on standard cloud platforms ● Supports conditional and complex computations ● Strong security and privacy guarantees ● Scalable for multi-party collaboration ● Efficient with minimal performance overhead
State of Development: First successful demonstration of complete invention July 1, 2025.
Related Publications: Sam Kumar, David E. Culler, and Raluca Ada Popa. MAGE: Nearly zero-cost virtual memory for secure computation. In 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21), pages 367–385. USENIX Association, 2021.
Reference: UCLA Case No. 2026-043
Lead Inventor: Rafail Ostrovsky, Professor, Department of Computer Science and Mathematics