Secure Multiparty Computation: Computing a Shared Answer Without Sharing Your Secrets

What MPC Actually Guarantees

At its core, secure multiparty computation lets a group of participants each hold a private input and jointly compute an agreed-upon function of those inputs, such as a sum, an average, a comparison, or something far more complex, without any participant learning anything about anyone else's input beyond what the output itself implies. The guarantee is precise and often formalized mathematically: after the protocol finishes, every party learns only the final result, for example "you are richer" or "the average salary is 74,000," and nothing more. If the output alone lets someone deduce a specific fact about another party's input, that is considered acceptable, because the same deduction would be possible from the output regardless of how it was computed. What MPC prevents is any additional leakage during the computation process itself, meaning no party can peek at intermediate values, network traffic, or another party's raw number. This is fundamentally different from ordinary computation, where whoever runs the calculation necessarily sees all the inputs. MPC protocols achieve this using tools like secret sharing, oblivious transfer, and homomorphic encryption, often combined with cryptographic proofs that participants followed the protocol honestly, so the privacy guarantee holds even against curious or partially misbehaving participants.

Yao's Millionaires' Problem

The canonical motivating example for MPC comes from computer scientist Andrew Yao, who in 1982 posed a deceptively simple puzzle: two millionaires meet on the street and want to know who is richer, but neither wants to reveal their actual net worth to the other, and certainly not to any outside observer. At first glance this seems paradoxical. How can you compare two numbers without at least one party learning something about the other's value? Yao showed that it is indeed possible using cryptographic protocols, and the millionaires' problem became the founding thought experiment for the entire field of secure multiparty computation. The elegance of the example is that it captures the essence of the challenge in the simplest possible setting: a single comparison between two private numbers, with only one bit of output, who is greater. Modern MPC protocols generalize this same idea far beyond two parties and simple comparisons, enabling joint computation of sums, averages, statistical models, auction outcomes, and even complex machine learning tasks across many mutually distrustful participants, all while preserving the same fundamental privacy property that made the millionaires' comparison possible in the first place.

A Building Block: Additive Secret Sharing

One of the simplest and most widely used tools inside MPC protocols is additive secret sharing. Suppose a participant has a private number and wants to contribute it to a joint computation without ever revealing it. Instead of sending the number directly, they split it into several random-looking pieces, called shares, that add up to the original value. For example, a secret number can be split into three shares by picking two random numbers and setting the third share so that all three sum back to the original secret. Each share on its own looks like meaningless random noise and reveals nothing about the original number, even to someone who sees just one or two of the shares below the required threshold. These shares are then distributed among the participants performing the computation. The clever part is that ordinary arithmetic, like addition, can be performed directly on the shares themselves: if everyone adds up the shares they received, the sum of those partial results equals the sum of the original secret numbers, once all the result-shares are combined at the end. Multiplication requires more elaborate techniques, but the same basic principle holds: the computation proceeds on scrambled fragments the entire time, and only the final combination step ever reconstructs a meaningful answer, never the intermediate private inputs.

Why Not Just Use a Trusted Third Party?

A natural question is why go through all this cryptographic complexity when you could simply hire a trusted third party, hand them everyone's raw data, let them compute the answer, and have them report back only the result. In practice, this approach is fragile and often legally or practically impossible. It requires every participant to trust a single entity completely, that entity becomes an enormously attractive target for hackers, insider threats, subpoenas, or simple human error, and in many real settings, such as banks or hospitals, handing over raw customer or patient data to an outside party may violate regulations entirely regardless of how trustworthy that party claims to be. MPC eliminates this single point of failure and single point of trust altogether. With a properly designed protocol, no individual party, and critically, no subset of colluding parties below a defined security threshold, can ever reconstruct another party's original secret input, even if they pool everything they individually observed during the protocol. There is no central server holding the raw data at any point in time, so there is nothing centralized to breach, subpoena, or misuse. The trust assumption shifts from trust this specific organization to trust the mathematics and the honest majority of participants, which is a fundamentally stronger and more auditable guarantee.

Real-World Applications

MPC has moved well beyond academic curiosity into genuine deployment. One prominent use case is private salary and wage-gap benchmarking, where companies in an industry want to compare compensation, such as computing average or median salaries by role and gender, without any single company revealing its individual employees' pay to competitors or even to the organizer of the benchmark. Boston Women's Workforce Council famously used MPC for exactly this purpose. In scientific research, MPC enables privacy-preserving statistics across institutions, letting hospitals or research labs jointly compute aggregate health or genomic statistics without pooling sensitive patient records into one exposed database. Secure auctions are another strong fit: bidders submit encrypted or secret-shared bids, and the protocol determines the winner and clearing price without revealing losing bids to anyone, including the auctioneer. Perhaps most strikingly, financial institutions have begun deploying MPC for collaborative fraud detection, allowing banks that are legally barred from sharing raw customer transaction data to jointly identify suspicious patterns, such as accounts linked across institutions in a fraud ring, by computing only on secret-shared or encrypted representations of their data, satisfying both security needs and strict data-protection regulations simultaneously.

Frequently asked questions

Try it live

Everything above runs in your browser — open Secure Multiparty Computation: Computing a Shared Answer Without Sharing Your Secrets and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.