An SEC filing lists nine investors in the fully sold offering. OppyAI is commercializing research that splits an open-source model between the user's device and the cloud.
By RuntimeWire Staff · Published
Primary source: U.S. Securities and Exchange Commission
Why it matters #
OppyAI is turning university security research into a commercial answer to a basic enterprise AI problem: using cloud models without exposing readable prompts, code and responses to the provider.
OppyAI, whose SEC filing identifies Hai Phan as CEO, sold $3.5 million in equity to nine investors, according to a Form D filed with the Securities and Exchange Commission on August 25.
The filing lists August 17 as the first sale date and says the entire offering has been sold, with no commissions or finders' fees. OppyAI used the SEC's Rule 506(b) exemption. It identifies Hai Nhat Phan, Ruoming Jin and My T. Thai as executive officers and directors. Paul Rogers is listed as a director, but not as an executive officer.
NJIT's profile of Phan identifies him as an associate professor of data science whose work spans privacy, federated learning, adversarial AI and trustworthy machine learning. According to the university, he earned his doctorate in computer science and engineering from CNRS and the University of Montpellier 2 in 2013, following degrees from Konkuk University and Ho Chi Minh City University of Technology.
OppyAI's commercial premise is that enterprises want access to cloud-scale models without granting the model provider readable access to their prompts and responses.
Splitting the model in three
OppyAI calls its approach end-to-end neural encryption. Its public products include Noir, a private AI chat service, and an API for application developers. OppyAI says the cloud provider receives encoded neural representations rather than readable prompts and returns representations that are decoded on the client side.
The underlying design is detailed in the NOIR research paper, posted in January 2026 and later recognized as a Distinguished Paper Award runner-up at USENIX Security '26. The paper lists Phan and its other NJIT authors alongside Issa Khalil of Hamad Bin Khalifa University, Jin of Kent State University and Thai of the University of Florida.
NOIR divides an open-source large language model into an encoder, a large middle section and a decoder. The client keeps the first and final blocks. A prompt is encoded locally, processed by the cloud-hosted middle blocks and decoded into readable output back on the client. Raw prompts and generated code are not sent to the cloud under that architecture.
The researchers add client-side token-embedding randomization, a randomized tokenizer and what they call an indistinguishability-preserving vocabulary. These measures are designed to reduce prompt and code reconstruction attacks by preventing the cloud from directly inferring sensitive content from embeddings and gradients.
In experiments using CodeLlama-7B, CodeQwen1.5-7B-Chat and Llama 3 8B Instruct, the paper's authors reported Pass@1 scores of 76.7 on MBPP, 77.4 on HumanEval and 38.7 on BigCodeBench. The BigCodeBench result was 1.77% below the unmodified model, according to the paper.
Those results come from the authors' research environment, rather than an independent production evaluation. Section 4.1 of the paper assumes an "honest-but-curious" cloud that follows the protocol while trying to reconstruct client prompts, training code and generated code. The paper places attacks involving compromised employees at the client organization outside that threat model because those insiders could collude with the cloud and disclose raw inputs, models or related artifacts. That boundary matters for buyers evaluating OppyAI's broader website claims, including its comparison between recovering an encrypted word and cracking a 12-character password.
Three researchers take the work to market
OppyAI gives Phan a commercialization vehicle for work that began inside his university lab. NJIT described OppyAI as a spinout in February and awarded the project $75,000 through its Technology Innovation Translation Acceleration program. The grant supported Neural Crypto, the protocol behind OppyAI's privacy pitch.
Jin brings a separate body of work in data mining, graph databases and cloud computing. His academic resume lists a previous visiting-researcher position at Microsoft Research Asia. The University of Florida's profile of Thai identifies her as a Research Foundation Professor, IEEE Fellow and associate director of the Nelms Institute for the Connected World. Her research covers trustworthy AI, cybersecurity, optimization and large-scale graph analysis.
Those academic backgrounds give OppyAI a technical starting point in privacy-preserving machine learning and large-scale computing. The Form D reports $0 earmarked for payments to the executive officers, directors or promoters named in the filing, but provides no broader narrative explaining how OppyAI intends to use the proceeds. OppyAI still has to turn a paper and working service into infrastructure that developers can deploy without giving up the speed, model quality and familiar APIs they already receive from mainstream providers.
Privacy without running the whole model locally
OppyAI is entering a market with several competing definitions of private AI. Privatemode's security documentation says its system encrypts prompts on the client and processes them inside remotely attested confidential-computing workers before returning encrypted responses.
OppyAI's approach keeps the readable text and the outer portions of an open-source model with the customer while sending neural representations through the cloud-hosted middle. That design could offer a different balance among privacy, computing cost and model performance. It also binds the architecture to models that can be divided and deployed in that form, rather than treating any closed model API as interchangeable.
The financing shows nine investors were willing to back that technical bet before OppyAI had published the usual commercial markers for an enterprise software round. The available public materials do not disclose OppyAI's revenue, customer count or production deployment figures. For Phan and his fellow researchers, the next proof point will come from systems outside their benchmarks: enterprises trusting OppyAI with the sensitive workloads its architecture was built to protect.