Sekoskeys 1 · 2 · 3

Research · Results · Experiment

One model, many tenants, nothing shared.

Hydra serves many tenants from one copy of a language model. Each tenant owns a lane — private attention and normalization over a frozen shared backbone — and a lane's output is byte-identical whatever its neighbors send, hold or do.

26 September 2026 · Apple M5 Max · Qwen3-8B, Gemma 3 4B and 12B · paper (PDF)

What a Hydra is

One body, many heads.

A Hydra is one language model serving many tenants, each with its own head — a private lane — on a shared body. The body is the model's frozen weights: embeddings, feed-forward layers and output head, loaded once. A lane is everything that makes a tenant's inference its own: private attention (a small low-rank correction to each shared attention projection), private normalization, and the key-value cache of every request that tenant sends. Lanes are small enough that one machine holds many, and their arithmetic is fixed so that nothing another tenant sends, holds or does can change a single bit of a lane's output.

2026-09-26T19:36:25.317970 image/svg+xml Matplotlib v3.10.9, https://matplotlib.org/ Tenants Tenant A capability for lane A Tenant B capability for lane B Tenant C capability for lane C Schemen Gate sidecar verifies the capability signed to the lane's head holds each head's keys; the runtime never sees them issues the lane's mask before a route opens leases every forward; fails closed route Hydra Runtime: one copy of the model × every decoder layer row A lane A attention W A B + A A norm gains KV cache row B lane B attention W A B + B B norm gains KV cache row C lane C attention W A B + C C norm gains KV cache private to each lane (30 MiB on Qwen3-8B); each row attends over its own cache only Shared and frozen: embeddings, feed-forward, LM head one folded GEMM for all rows, each row equal to its one-row product Isolation rule: every kernel that touches row i has a shape fixed by row i's own history and deployment constants, never by another tenant.
Authority is signed to a lane and its full transformer head; a request reaches a lane only through a capability bound to it. The Gate sidecar verifies it, holds the lane keys the runtime never sees, issues the lane's mask and leases every forward. In the runtime every row passes through its own lane's private attention and norms over its own key-value cache, then through the one shared, frozen copy of the rest of the model.

Why build one

Some workloads must keep tenants apart by construction: a law firm's client matters, a hospital's departments, a bank's customers, one user's agent and another's. Today that means a deployment per tenant — a model copy each, mostly idle — or a shared deployment whose caches and batching were never built to keep tenants apart. A Hydra serves isolated tenants from one model's weights, with more throughput than that model serving them one at a time.

How it uses the Schemen Gate

Schemen Gate is the open-source authority layer: AI PKI and enforcement primitives for exact actions, resources, delegation, revocation and gated model computation. Every Hydra lane sits behind it.

  1. Grant. Authority is signed to a lane and its full transformer head, not to a tenant. A request reaches a lane only through a single-use capability bound to that lane, with the request's body digest, the action, the model and runtime, an expiry and a one-time identifier. Replays are refused.
  2. Gate. Before a lane opens, the Gate sidecar — a separate process holding key material the runtime never sees — must issue that lane's Cryptographic Dimension Partitioning mask, and the runtime checks it is the right lane's binary mask. The sidecar also verifies each lane's signed artifacts when they are admitted.
  3. Lane. Only then does the runtime open the lane's route. Every forward re-checks each row's lease and each lane's weight custody, and every result carries a custody receipt of what actually ran.
  4. Fail closed. A missing, replayed, expired or misbound capability is refused before any private lane is touched; if the sidecar is lost, generation stops.

How it relates to CDP

Cryptographic Dimension Partitioning gives each tenant an exact, disjoint share of a model's feed-forward coordinates. Attention cannot be split that way — every query meets every key — so CDP leaves attention shared and names what is missing: a duplicated attention lane per tenant. Hydra is that lane.

Headline

Isolation stopped costing throughput.

2.58×Qwen3-8B throughput with three isolated tenants on one copy of the model, against the same model serving them one at a time (48.5 vs 18.8 tokens/s)
29.8 MiBof private weights per tenant on Qwen3-8B (0.19% of the 15.3 GiB model). Sixteen isolated tenants need 15.7 GiB of weights in total; sixteen model copies would need 244 GiB.
6.1 billionlogits and activations, plus 930,337 generated tokens, compared with their references across 8 models and 5 kinds of device: every one byte-identical, 0 mismatches
byte-exactserial acceptance on every lane of Gemma 3 4B, Qwen3-8B and Gemma 3 12B, including prompts longer than Gemma's sliding window

A model that must keep tenants apart — client matters, patients, customers — is usually deployed once per tenant, or shared on the hope that nothing leaks. Shared-cache serving engines are not an option for such workloads: shared prefix and key-value caches leak across tenants by timing, and batch-dependent arithmetic lets one request change another's output. Hydra gives each tenant a private lane, authorizes every request with a signed single-use capability, and fixes the shape of every kernel that touches a tenant's row by that tenant's own history. On one Apple M5 Max, three lanes on Qwen3-8B serve 1.85× the plain model's throughput at row capacity 3 and 2.58× at 16. Gemma 3 4B and 12B, added in this work with sliding-window attention, reach 2.24× and 2.43×. Every lane matches its reference exactly.

Evidence label: experiment. One machine (Apple M5 Max, MPS, bf16); two to three repetitions per configuration on a 72-instance coding workload; runs contaminated by other GPU work are voided and kept, never averaged in. Throughput is measured against the isolated alternative — the same model serving tenants one at a time. CUDA qualification is open. Timing is not isolated, and the report measures it.

What was measured

On what, and how.

Gemma 3 4Bgoogle/gemma-3-4b-it · revision 093f9f38
Qwen3-8BQwen/Qwen3-8B · revision b968826d
Gemma 3 12Bgoogle/gemma-3-12b-it · revision 96b6f1ec
HardwareApple M5 Max, 128 GB unified memory, PyTorch 2.12.1 on MPS, Transformers 5.9.0, bf16
Workload72 coding instances over a library written for the evaluation (119 tests): bug fixes, implementations and execution-prediction questions at about 1k and 7.5k prompt tokens; all 72 arrive at once; greedy decoding
Armsthe plain model serving one request at a time; three Hydra lanes at row capacity 3, 6 and 16; lanes with private low-rank deltas
Exactnessexact token equality on every instance of every run; SHA-256 of per-step logits in probes; serial acceptance against independently built references
Earlier evidencethe research prototype and earlier Runtime releases on Qwen2.5-0.5B, Qwen3-0.6B and 4B and Whisper tiny.en, on NVIDIA L4, A100 and H200 and on CPU, up to 32 lanes — in the report
Validityfresh process per run; any concurrent model-sized process or model server voids the run; voided runs are kept and labeled

The models are public; no weights are redistributed here. The runtime, harness and data pipeline are in the Schemen Runtime repository.

Read the report