A hospital can use AI without ever sending the patient's image outside the hospital

The 17 programmable bootstraps recorded in order for the selected case — 16 learned regional-intensity thresholds, then the class decision. Each does required model work; none is ceremonial.

Verify it yourself, engine-independent:
rad-verify evidence/rad_image_canonical.json --anchor 197f6b23e16c8532c6abc838facd5ea789be0c76b2920334039bfa8b3d368d61

What this demonstration proves. A real, trained classifier runs entirely over encrypted, hospital-derived inputs; the external evaluator never receives the image, the patient's identity, or the decryption key; the hospital alone decrypts the result; and the full run is independently verifiable from a signed artifact.

What is specific to this example. The model here is intentionally small — a quantized classifier over 16 image-derived features, trained on the public, de-identified PneumoniaMNIST set (balanced accuracy 77.95%). It performs classification (normal vs pneumonia-associated pattern) — not lesion detection, localization, or segmentation. Its small size is a deliberate fit to the exact-precision budget of the programmable bootstrap used here.

What adapting to another model would involve. Larger or deeper models can run under encryption, but they cost more programmable bootstraps and compute and must be expressed in an FHE-compatible (e.g. quantized) form; richer inputs and architectures increase runtime. The privacy architecture is unchanged — encrypt inside the hospital, compute on ciphertext, decrypt only inside the hospital, verify independently. Whether a specific model fits is an engineering assessment against accuracy and latency targets; it does not change the privacy guarantee.

Research demonstration, not a clinical device.