How-To · Secure Query Processing

How-To: Upload Evaluation Key

Before you can query a model, the query client generates a key pair for your User Access Token and uploads the evaluation key to Lattica. This guide shows how, in Python and TypeScript.

How the keys work

The query client generates two keys together:

Stays on your machineSecret keyEncrypts your inputs and decrypts your results. It is never uploaded. Anyone who has it can read your data.

generated together

Uploaded to LatticaEvaluation keyLets the worker compute on your encrypted data. It can't decrypt anything.

Keys belong to one User Access Token and the model it's assigned to. You generate them once and reuse them for every query.

Before you start

A token for the model

You need a User Access Token assigned to the model, and the query client installed.

A running worker (Python)

Generating keys in Python needs a running worker. An upload made while no worker is running is loaded when a worker starts.

Token moved? New key

If the token is assigned to another model, its old key no longer fits. Generate a new one.

Generate and upload the key

Python

client.keys.ensure does what you need in most cases. It loads the key already saved on your machine for this token. If there is none, it generates a key pair and uploads the evaluation key. If an earlier upload was interrupted, it finishes that upload.

upload_key.py

import os

from lattica_query import QueryClient, QueryToken

token = QueryToken(os.environ["LATTICA_QUERY_TOKEN"])

with QueryClient(token) as client:
    key = client.keys.ensure()
    print("Key ready for this token")

Keys are saved under ~/.lattica/keys/<token id>, or under $LATTICA_HOME/keys when LATTICA_HOME is set.

Use client.keys.generate instead when you need a fresh key pair, for example after the token was assigned to a different model. It replaces the saved key and uploads the new evaluation key.

with QueryClient(token) as client:
    key = client.keys.generate()

TypeScript

init() generates the key pair and registers the evaluation key with Lattica. The TypeScript client keeps its keys in memory, so call init() once for each new client before querying.

upload-key.ts

import { initWasm, LatticaQueryClient } from '@lattica-ai/query';

await initWasm();

const client = new LatticaQueryClient(process.env.LATTICA_QUERY_TOKEN!);

// Generate the key pair and register the evaluation key.
await client.init();
console.log('Evaluation key registered');

Keep the secret key private

The secret key decrypts your data. Never share it or commit the key folder to source control. If it may have leaked, generate a new key pair.

Next, run an encrypted query.