Private computation. Verified execution. Decentralized inference.
Poly is a polyglot compiler and private AI infrastructure. Write multi-language programs, compile to any target, and run AI inference where the server computes on encrypted data it cannot see.
The stack: CKKS lattice-based homomorphic encryption, zero-knowledge execution proofs, QUIC-based peer-to-peer compute network, and a polyglot compiler that targets native executables, WASM, browser apps, and Android APKs from a single .poly file.
// Separate sections for each language
#[rust] {
fn main() {
println!("Hello from Poly!");
}
}
#[js] {
const greet = (name) => `Hello, ${name}!`;
}
#[python] {
def add(a, b):
return a + b
}
#[rust] {
fn main() {
// Call JavaScript inline
let doubled: Vec<i32> = js!{ [1,2,3].map(x => x * 2) };
// Call Python inline
let sum: i32 = py!{ sum([1, 2, 3, 4, 5]) };
println!("Doubled: {:?}, Sum: {}", doubled, sum);
}
}
Both approaches work together — use blocks to organize code, macros to call across languages inline.
Build for any target:
polyglot build hello.poly --target windows # → hello.exe
polyglot build hello.poly --target linux # → hello (ELF)
polyglot build hello.poly --target browser # → hello.wasm + HTML
polyglot build hello.poly --target apk # → hello.apkPeople need to talk to AI about things they can't talk to anyone else about. Medical questions they're afraid to ask a doctor. Mental health crises they can't afford to have on record. Legal questions where the question itself is incriminating.
Right now, every one of those conversations lives on a corporate server in plaintext. One subpoena, one breach, one policy change, and the most vulnerable conversations a person has ever had are exposed.
Poly makes it so the server literally cannot see what you asked or what it answered. Not "we promise not to look" -- the math makes it impossible. The computation happens on encrypted data, the result comes back encrypted, and only the person who asked can decrypt it.
The mental health system has a problem it cannot talk about honestly, and people who try to research alternatives face real consequences for having that search history.
What antipsychotics do to people:
- People with schizophrenia die 14.5-25 years earlier than the general population
- 32-68% of patients on second-generation antipsychotics develop metabolic syndrome (obesity, type 2 diabetes, dyslipidemia)
- Sudden cardiac death rate doubles: ~1 in 340 person-years on antipsychotics vs ~1 in 700 for nonusers
- Long-term use causes progressive brain volume loss -- primate studies show ~10% reduction at human-equivalent doses, mostly from loss of glial cells
- 1 in 5 patients on SGAs long-term develop tardive dyskinesia (permanent involuntary movements)
- The drugs impair cellular glucose uptake in the liver, dysregulate fatty acid metabolism, and increase mitochondrial oxidative stress
What Open Dialogue achieves (Western Lapland, Finland, 30 years of data):
| Metric | Open Dialogue | Standard Treatment |
|---|---|---|
| Full recovery (no symptoms) | 81-85% | ~15-20% |
| Return to work/school within 2 years | 84% | ~20-30% |
| Still on antipsychotics at 2 years | 17-33% | ~100% |
| Needed neuroleptics at all | 3% | 100% (comparison group) |
| Schizophrenia incidence (regional) | 7/100,000 (down from 35) | Unchanged elsewhere |
Open Dialogue was developed by Jaakko Seikkula's team at Keropudas Hospital. It works by responding to psychotic crises within 24 hours, meeting in the person's home instead of a hospital, including family and social network in transparent dialogue, and treating medication as a last resort instead of first-line. The 19-year follow-up confirmed these outcomes are stable.
The standard system creates chronic patients. Open Dialogue creates recovered people. 85% go back to their lives.
The privacy problem: Someone researching this -- questioning whether their medication is helping or harming them, looking into alternatives their doctor never mentioned -- is generating exactly the kind of search history that can be used against them in custody hearings, insurance decisions, and involuntary commitment proceedings.
That is why private AI inference is not a feature. It is infrastructure.
Sources: PMC meta-analysis on antipsychotic mortality | FIN20 20-year follow-up | AAFP adverse effects review | Brain volume loss (Psychiatric Times) | Brain volume loss (PMC) | Metabolic syndrome (Frontiers) | Open Dialogue 19-year outcomes | Western Lapland long-term stability | Psychology Today overview
cargo run --release -p poly-inference --bin poly-demo-rns-fhe
Network: 4x4 linear + SiLU activation
Input: [1.0, -0.5, 2.0, 0.8]
Primes: 10 (9 multiplication levels)
Slot Expected Decrypted Error
0 0.164612 0.164660 4.75e-5
1 0.062747 0.062742 4.58e-6
2 1.143877 1.143867 1.01e-5
3 0.515547 0.515546 2.47e-7
RESULT: Private inference SUCCEEDED (max error < 0.5)
The server performed a neural network forward pass (matrix multiply + SiLU activation) on encrypted data using CKKS homomorphic encryption with 10 NTT primes and 2048 SIMD slots. It never saw the input, never saw the output, and the result is mathematically correct to 5 decimal places.
| Feature | Status |
|---|---|
| CKKS homomorphic encryption (RNS, 20 primes) | ✅ Working |
| Private neural network inference | ✅ Working |
| Zero-knowledge execution proofs | ✅ Working |
| PFHE compression (lossless, ~2x) | ✅ Working |
| Entropy validation (IND-CPA monitor) | ✅ Working |
| Decentralized QUIC compute network | ✅ Phase 1 |
| End-to-end encrypted inference (Qwen3, Nanbeige 3B) | ✅ Working |
| Rust blocks | ✅ Full support |
| JavaScript blocks | ✅ Full support |
| Python blocks | ✅ Full support |
| HTML/CSS blocks | ✅ Full support |
Verified execution (#[verified]) |
✅ Working |
| Native executables (Windows/Linux) | ✅ Working |
| WASM compilation | ✅ Working |
| Browser bundling | ✅ Working |
| Android APK | ✅ Working |
Hot reload (watch) |
✅ Working |
| 570+ tests | ✅ Passing |
# Clone and build
git clone https://github.com/user/poly.git
cd poly
cargo build --release
# Add to PATH
export PATH="$PATH:$(pwd)/target/release"// hello.poly
#[rust] {
fn main() {
println!("Hello, Poly!");
}
}
polyglot run hello.poly// app.poly
#[html] {
<div id="app">
<h1>My Poly App</h1>
<button onclick="greet()">Click me</button>
</div>
}
#[css] {
#app {
font-family: system-ui;
padding: 2rem;
}
button {
padding: 0.5rem 1rem;
cursor: pointer;
}
}
#[js] {
function greet() {
alert("Hello from Poly!");
}
}
#[main] {
// Entry point for WASM
}
polyglot bundle app.poly -o app.html
# Open app.html in browser// gui.poly
#[rust] {
use eframe::egui;
fn main() -> eframe::Result<()> {
eframe::run_simple_native("Poly App", Default::default(), |ctx, _| {
egui::CentralPanel::default().show(ctx, |ui| {
ui.heading("Hello from Poly!");
});
})
}
}
polyglot build gui.poly --target windows
./gui.exeMark functions with #[verified] to get mathematical proofs of correct execution:
#[rust] {
use poly_verified::prelude::*;
use polyglot_macros::verified;
#[verified]
fn add_scores(a: u64, b: u64) -> u64 {
a.saturating_add(b)
}
fn main() {
let result = add_scores(42, 58);
println!("Value: {}", result.value()); // 100
println!("Verified: {}", result.is_verified()); // true
}
}
The compiler enforces determinism at compile time -- no floats, IO, unsafe, or randomness allowed inside #[verified] functions. Results are wrapped in Verified<T> which carries a cryptographic proof.
Privacy modes — optional zero-knowledge privacy via blinding factors:
#[verified]— transparent (default)#[verified(private)]— full ZK: verifier learns nothing except validity#[verified(private_inputs)]— selective: verifier sees output but not inputs
See Verified Execution for full documentation.
The primary language. Compiles to native code or WASM.
#[rust] {
use std::collections::HashMap;
pub fn main() {
let mut map = HashMap::new();
map.insert("key", "value");
println!("{:?}", map);
}
}
For frontend logic and browser APIs.
#[js] {
const fetchData = async (url) => {
const res = await fetch(url);
return res.json();
};
document.getElementById("btn").onclick = () => {
console.log("Clicked!");
};
}
For scripting, data processing, ML.
#[python] {
def process_data(items):
return [x * 2 for x in items if x > 0]
result = process_data([1, -2, 3, 4])
print(f"Result: {result}")
}
For document structure. Inlined into the bundle.
#[html] {
<div class="container">
<h1>Welcome</h1>
<p>This is a Poly app.</p>
</div>
}
For styling. Inlined into the bundle.
#[css] {
.container {
max-width: 800px;
margin: 0 auto;
}
}
Import from other .poly files:
use * from "./utils.poly"
use { helper, Config } from "./lib.poly"
# Build
polyglot build file.poly --target <browser|windows|linux|apk>
polyglot build file.poly --release # Optimized build
# Run
polyglot run file.poly # Build and run with wasmtime
polyglot run file.poly -- arg1 arg2 # Pass arguments
# Development
polyglot watch file.poly # Hot reload on changes
polyglot check file.poly # Parse and validate
polyglot test file.poly # Run inline tests
# Bundle
polyglot bundle file.poly -o out.html # Self-contained HTML
# Project
polyglot init # Initialize project
polyglot new --template basic # Create from template
# Advanced
polyglot wit file.poly # Generate WIT interface
polyglot component file.poly # Build WASM component
polyglot compose a.wasm b.wasm # Compose components| Target | Output | Use Case |
|---|---|---|
browser |
.wasm + .html |
Web apps |
windows |
.exe |
Windows desktop |
linux |
ELF binary | Linux desktop/server |
apk |
.apk |
Android apps |
host |
Native binary | Current platform |
Create a poly.toml next to your .poly file to declare dependencies:
[package]
name = "myapp"
version = "0.1.0"
[rust]
serde = { version = "1.0", features = ["derive"] }
tokio = { version = "1", features = ["full"] }
reqwest = "0.11"
[npm]
react = "^18.0.0"
lodash = "^4.17.0"
[pip]
numpy = ">=1.20"
requests = ">=2.25"
[verified]
backend = "hash-ivc" # or "mock" for testing
fold_interval = 32 # auto-fold every N operationsDependencies flow into the appropriate package manager:
[rust]→ Cargo.toml[npm]→ package.json[pip]→ requirements.txt[verified]→ Verified execution configuration
If no poly.toml exists, common dependencies are auto-detected from use statements.
See the examples/ directory:
hello.poly- Basic hello worldweb_app.poly- Full-stack web appcalculator.poly- Interactive calculatornative_test.poly- Native binary test
- Language Specification - Full syntax reference
- Architecture - Compiler internals
- Verified Execution - Provable computation guide
- Android Builds - APK generation guide
- One file, many languages - Write Rust, JS, Python together
- One command, any target - Same source → exe, wasm, apk
- Zero config - Sensible defaults, no boilerplate
- Native performance - Compiles to real machine code
This project is licensed under the GNU Affero General Public License v3.0 - see the LICENSE file for details.
