By Carla Mascia, Head of Cryptography Research at DataKrypto

Last week, I had the privilege to be a speaker at the Financial Cryptography in Rome 2025 (FCiR25), a dynamic event organized by the De Cifris Association with the support of Banca d’Italia.

Alongside Professor Marco Pedicini from Roma Tre University, I led a tutorial focused on cryptographic techniques and protocols for financial data analysis, a journey into how privacy and analytics can not only coexist but actually empower one another.

When I was first invited to speak, I had to ask myself a simple yet crucial question: as DataKrypto’s Head of Cryptography Research, what message can I offer an audience that deals with financial data, not with cryptography?

The answer came quickly: we need a data analysis toolbox — not a one-size-fits-all solution, but a collection of practical, privacy-preserving techniques that analysts can mix, match, and adapt, depending on the context, the sensitivity of the data, and the available resources, to craft truly tailor-made solutions.

Inside the Toolbox: from Traditional to Malleable Encryption

Beyond traditional encryption methods, the modern cryptographic toolbox includes a new generation of advanced techniques built on a fascinating property of ciphertexts: malleability. This property, malleability, enables certain operations on encrypted data without first decrypting it.

Seen often as a vulnerability, it actually unlocks new classes of secure computation, including:

• Homomorphic Encryption (HE) – allows mathematical operations to be performed directly on encrypted values, and once decrypted, the results match the computations on the plaintext.
• Zero-Knowledge Proofs (ZKPs) – makes it possible to prove that a statement is true without revealing any of the underlying data, ensuring verifiability and privacy at once.
• Secure Multi-Party Computation (SMPC) – allows multiple parties to jointly compute a function over their inputs while keeping those inputs private.

Together, these tools transform encryption from a static shield into a dynamic framework for secure computation, enabling collaboration and analysis without exposure.

Privacy as a Continuous Design Choice

Nowadays, there is no discussion about data analysis that does not involve AI and machine learning.

But one concern arises at every stage of the AI pipeline: privacy.

In finance, privacy isn’t a one-time configuration — it’s a continuous design decision, essential not only to protect sensitive information but also to remain compliant with regulations and supervisory frameworks. And the more we automate and scale analysis with machine learning, the more critical it becomes.

That’s why our tutorial concluded with a deep dive into the three key stages of the AI pipeline where privacy matters most — and the tools available at each stage.

1. Privacy at the Training Stage — Differential Privacy & Federated Learning
   
   It all begins with data.
   
   And in finance, that data often reflects highly sensitive details: transactions, credit histories, trading patterns. Even before a model is trained, you’re already managing risk.

   There are two relevant techniques at this stage:

   • Differential Privacy (DP): adds carefully calibrated statistical noise to data, ensuring that individual records cannot be identified while still preserving global patterns.Think of it like blurring a photograph just enough to hide faces while keeping the whole scene clear.

     Too little noise, and privacy is lost; too much, and the analysis becomes meaningless. The art lies in finding the perfect balance.

   • Federated Learning (FL): takes collaboration a step further. Instead of revealing raw data to each other, participants train a shared model locally and exchange only encrypted or aggregated updates. The result: better collective intelligence, with no data leakage.

2. Privacy at the Model Level — Homomorphic Encryption
   
   Once a model is trained, its weights — the parameters that encode everything it has learned — become both valuable and vulnerable. Here, Homomorphic Encryption (HE) provides a way to perform computations directly on encrypted models. This means that analytics and evaluations can be safely outsourced without revealing proprietary algorithms or sensitive assets.

3. Privacy at the Interaction Level — End-to-End Encryption (E2EE)
   
   AI today doesn’t just compute — it converses.

   From compliance checks to customer support, AI-powered interactions are becoming the norm. But each prompt and response may contain sensitive or regulated information.

   E2EE ensures that only the intended participants – compliance officers, analysts, auditors – can access the content. When combined with HE, ZKPs, and SMPC, it completes the final layer of protection, extending confidentiality from data to model to conversation.

The Real Answer — Combine, Adapt, Optimize

There is no universal solution in cryptography.

The best approach coincides with combining complementary tools with a unified architecture that meets specific requirements, tailoring each layer — from DP and FL to HE, ZKPs, and E2EE — to your use case, balancing performance, security, and usability.

Cryptography isn’t a barrier; it’s a toolbox for building smarter, safer, and more accountable AI in finance. And the sooner we start treating privacy as an engineering discipline and not as an afterthought, the better equipped we’ll be to build a secure and trustworthy digital financial ecosystem.

 

About the Author

Carla Mascia is an innovation-driven mathematician with deep expertise in cryptography, combinatorial commutative algebra, and emerging technology trends. Currently, as Head of Cryptography Research at DataKrypto, she leads cutting-edge initiatives in fully homomorphic encryption, enabling secure computations on encrypted data and pioneering advanced cryptographic solutions.