{"id":"c7adb240-cbc3-41c6-8725-8d60e5f779cc","arxiv_id":"2412.16537","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"FASTLMPI accelerates private transformer inference by splitting matrix multiplications and non-linear layers across HE and secret sharing, and by fitting GeLU with inflection-point-selected polynomials, though the reported end-to-end speedups are aggregates of component benchmarks.","lead":"FASTLMPI is a new two-party secure computation system that mixes homomorphic encryption and secret sharing inside individual operations of a transformer model, reporting 54% to 64% faster private inference and 72% less communication than the BOLT baseline. The gains are claimed for BERT-scale models on GLUE tasks, but the headline numbers come from summed microbenchmarks, not a full end-to-end run.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"End-to-end runtime and communication claims rest on summed microbenchmarks (Sec. IV-C), not a full execution; missing conversion and subprotocol costs could change the reported 54–64% speedup.","rationale":"The reader's weakest assumption—that end-to-end performance is estimated by summing microbenchmarks without executing the full protocol—is precisely the load-bearing weakness. The paper explicitly states in Section IV-C that end-to-end performance is the aggregation of the microbenchmarks, and the contribution claiming an implemented end-to-end system is not backed by a reported full run. This matters because the four protocols are not self-contained: they invoke SIRNN's ΠrExp, CrypTFlow2's ΠLT and ΠB2A, SCI's Πinvsqrt, and BFV operations that include ciphertext-ciphertext multiplications and squarings. Each of these carries rounds, communication, and computation that are easy to undercount when summing per-operator timings. Additionally, Zp↔Z2k share conversions appear throughout and are described only informally; their cost is not separately reported. The accuracy tables are produced on plaintext floating-point models, so the true fixed-point, encrypted-pipeline accuracy is unknown, and the RTE result is already far below BOLT. Because the central quantitative claims depend on this unverified aggregation, the concern is real and decisive for accepting the paper. I agree with the reader's identification of the same weakest assumption, and I would keep the REJECT verdict: the headline numbers require a full end-to-end measurement before they can be trusted.","tokens_in":35562,"tokens_out":3488,"duration_ms":33275,"concrete_test":"Run a single complete BERTbase layer through the full FASTLMPI pipeline on two machines with the specified LAN/WAN settings, including all Zp↔Z2k conversions, ΠrExp, ΠLT, ΠB2A, Πinvsqrt, BFV.Square/HMult with relinearization, and fixed-point truncation; then extrapolate to 12 layers and compare wall-clock time and total bytes against the microbenchmark sums in Table VI. If the measured end-to-end figures differ by more than 10%, the reported 54–64% runtime reduction and 72.2% communication reduction are not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central performance claim—54–64% lower runtime and 72.2% lower communication than BOLT—is derived, by the paper's own statement in Section IV-C, as 'the aggregation of the microbenchmarks,' not as a measured full-protocol run. This is load-bearing because the proposed protocols rely on expensive subprotocols whose costs are not itemized in the reported totals: Πsoftmax calls ΠrExp from SIRNN, Πgelu calls ΠLT and ΠB2A from CrypTFlow2, Πln calls Πinvsqrt from SCI, and fixed-point arithmetic requires Zp↔Z2k conversions plus truncation after multiplications. The contribution list claims 'We implemented the end-to-end private TBM inference,' but no end-to-end execution is reported; Table VI is a sum. If inter-operator conversions, relinearization inside BFV.Square/HMult, or the rounds/communication of the SIRNN and CrypTFlow2 subprotocols are omitted or underestimated, the headline speedups over BOLT are unsupported. Accuracy is also evaluated in plaintext (Table V), so the secure fixed-point pipeline's true accuracy is unmeasured; RTE already shows a drop to 54.5 versus BOLT's 65.0. These gaps make the central quantitative claim unverified as stated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents FASTLMPI, a two-party secure computation framework for private transformer inference, built around four new protocols (Πmatmul, Πsoftmax, Πln, Πgelu) that combine homomorphic encryption (BFV) and additive secret sharing at a finer granularity than prior work, plus a piecewise polynomial approximation method for differentiable non-linear functions such as GeLU, Sigmoid, Tanh, and Mish. The central claims are that these protocols outperform the BOLT baseline by 40×, 14×, 2×, and 2.2× respectively, and that the resulting end-to-end BERTbase inference achieves a 54–64% runtime reduction and a 72.2% communication reduction over BOLT. The evaluation consists of microbenchmarks for individual operators, a plaintext accuracy comparison on GLUE tasks, and an end-to-end table that is explicitly constructed as a sum of microbenchmark timings rather than a full-protocol execution.","tokens_in":35800,"tokens_out":5848,"duration_ms":49430,"significance":"If the claimed end-to-end speedups were verified by a real full-protocol execution and the accuracy were confirmed in the secure fixed-point pipeline, FASTLMPI would represent a valuable step forward in private transformer inference. The core idea of mixing HE and SS inside operators to remove rotations and lower communication is plausible and worth exploring. The paper also ships an anonymous implementation, which aids reproducibility. However, the absence of an end-to-end measurement, the plaintext-only accuracy evaluation, and the in-sample nature of the approximation error analysis mean that the paper's headline quantitative claims are not substantiated as they stand.","major_comments":[{"comment":"The end-to-end performance claim (54–64% runtime reduction and 72.2% communication reduction versus BOLT) is not supported by a full-protocol measurement. Section IV-C states that the end-to-end performance is 'the aggregation of the microbenchmarks.' The protocols invoke subprotocols whose costs are not itemized in the aggregate—concretely, Πsoftmax calls ΠrExp from SIRNN, Πgelu calls ΠLT and ΠB2A from CrypTFlow2, Πln calls Πinvsqrt from SCI, and all protocols require Zp ↔ Z2k conversions and truncation after multiplications. The tables also reuse BOLT's BSGS routine for three of the four feed-forward linear layers without a separate cost breakdown. Without executing the full pipeline and counting these conversion and inter-operator costs, the headline speedup and communication numbers are unverified.","section":"Section IV-C, Table VI"},{"comment":"Accuracy is evaluated in plaintext only, not through the secure fixed-point protocols. Table V compares floating-point plaintext, a BERT baseline, BOLT, and FASTLMPI, but the FASTLMPI row uses the seg5GeLU approximation in plaintext arithmetic. The actual pipeline uses fixed-point representation with s=12, k=37, modular arithmetic over Zp and Z2k, and the approximate subprotocols ΠrExp and Πinvsqrt, all of which can introduce errors not captured by a plaintext simulation. The reported RTE accuracy of 54.5 versus BOLT's 65.0 already indicates a substantial gap, and the paper's note that this may be due to BOLT retraining does not establish that the secure FASTLMPI pipeline preserves accuracy.","section":"Section IV-C.1, Table V"},{"comment":"The MAE evaluation of seg5GeLU is in-sample and therefore not a valid measure of approximation quality. The polynomials are fitted with numpy.polyfit, and the MAE is then computed on 10,000 points spanning the same range (-6 to 6) used for the fit. This measures training error, not generalization error; a comparison with BOLT or Bumblebee would require evaluation on a held-out set or an independent grid. Likewise, the choice of segmentation endpoints such as ±5.075 is justified by inspecting where derivatives become small, which is an ad hoc heuristic; the paper does not demonstrate that these endpoints generalize across input distributions.","section":"Section IV-B.3, Fig. 7"},{"comment":"The conclusion claims that 'all homomorphic operations are transformed into ciphertext-plaintext multiplications,' but this is contradicted by the protocol specifications. In Πln, the implementation uses BFV.Square to compute [ [eA²] ]B, which is a ciphertext-ciphertext operation, and in Πgelu it uses BFV.HMult([ [X²] ]A, [ [X] ]A) to obtain [ [X³] ]A. These are not ciphertext-plaintext multiplications. This inconsistency undermines the stated design rationale and should be corrected or qualified.","section":"Section VII versus Sections III-C and III-E"},{"comment":"The security proofs are incomplete and contain apparent errors. Theorem 3 (LayerNorm) is dismissed with a single sentence: 'The proof process is the same as that of SoftMax.' The proof of Theorem 2 (SoftMax) describes the corrupted-B case as having B receive [ [⟨Y⟩B] ]B, but the protocol specification has A send [ [⟨Y⟩B] ]B to B; the simulator's action of 'receiving' this from the corrupted party does not match the protocol flow. A security paper needs complete, correct simulation-based proofs for each protocol, especially when the protocols combine HE and SS with subprotocol conversions.","section":"Section VIII, Theorems 1–3"}],"minor_comments":[{"comment":"The manuscript contains many typos and inconsistent notations: 'LayrNorm' for LayerNorm, 'DESCIRPTION' in the Section III heading, 'Ret-BOLT' in Table V, 'Modeify' and 'Sid' in the security proofs, and inconsistent use of ∧ versus ♢ for XOR.","section":"Throughout"},{"comment":"The definition of F1(x) for the Sigmoid approximation appears to be missing an x² term: '0.4998102695 + 0.2527736008x − 0.00869807952 − 0.0127621849x³' has a constant term where a quadratic term should likely appear, making the polynomial degree inconsistent with the text.","section":"Section IX-B, Eq. (34)"},{"comment":"Equation (14) uses the symbol ⊠ for a homomorphic multiplication in two terms while the surrounding text and Fig. 3 use ⊡; this should be unified for readability.","section":"Section III-A, Eq. (14)"},{"comment":"The notation section states that XOR is denoted by ∧, but Eq. (28) and the Πgelu text use the diamond symbol ♢ for XOR; the notation should be consistent.","section":"Section II-A"},{"comment":"The GeLU comparison labels BOLT's GeLU as 'the version without preprocessing,' but the main comparison in Table IV and the abstract treats this as the standard BOLT baseline; the distinction should be clarified.","section":"Section IV-B.2"}],"recommendation":"reject","confidential_remarks":"The paper's central claims rest on an aggregated, not executed, end-to-end evaluation and on plaintext accuracy that does not validate the secure fixed-point pipeline. The in-sample MAE analysis and the internal contradiction about ciphertext-ciphertext versus ciphertext-plaintext multiplications further weaken the submission. These are load-bearing issues that would require substantial new experiments and a corrected protocol description to resolve, so a rejection is appropriate. The anonymous code link is not verifiable in this format and could not be used to check the claimed numbers."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is worth a look: instead of the usual split (HE for linear, SS for nonlinear), the paper mixes both primitives inside each operator. The proposed protocols for matmul, Softmax, LayerNorm, and GeLU are a legitimate extension of BOLT and BumbleBee, and the inflection-point-based segmentation for piecewise polynomial approximation is a neat, cheap heuristic that does appear to lower MAE at equal or lower polynomial degree. The microbenchmarks, if taken at face value, show large per-operator gains. That part is real and useful.\n\nBut the headline claims do not hold up as stated. Section IV-C openly says the end-to-end numbers are the aggregation of microbenchmarks, not a measured full-protocol run. That is load-bearing: the pipeline includes Zp-to-Z2k conversions, relinearization inside BFV.Square/HMult, and the rounds and communication of SIRNN and CrypTFlow2 subprotocols. None of those are itemized in the totals, so the 54–64% runtime reduction and 72.2% communication reduction versus BOLT are unsupported. The accuracy evaluation is also plaintext-only; the secure fixed-point pipeline is never measured, and the one reported RTE accuracy (54.5) is far below BOLT's 65.0, which the authors chalk up to model retraining. That is not a fair comparison.\n\nThere are also internal inconsistencies that a careful referee would flag: the text claims all homomorphic operations are ciphertext-plaintext multiplications, but the GeLU and LayerNorm protocols use BFV.Square and BFV.HMult on two ciphertexts; the degree of the GeLU polynomials is described as both 3 and 4 in different places; and there is no dedicated security proof for GeLU—the LayerNorm proof just says \"same as SoftMax\" without the necessary simulator details. The segmentation constants (5.075, 6.48, 4.60) are picked by eyeballing where derivatives get small, and the MAE numbers are in-sample fits. These are fixable, but they make the current version too shaky to accept.\n\nWho is this for? Researchers in private inference who want new protocol components and a plausible approximation trick. They will get ideas from the protocol constructions, but they should not take the end-to-end claims at face value. I would send this to peer review—the novelty is sufficient to warrant referee time—but the verdict should be a major revision, or reject, with the specific demand for a real end-to-end implementation and accuracy measured through the secure pipeline. Without that, the central claims are just arithmetic over optimistic parts.\n\nFor your reading group: worth a maybe, mainly to discuss the microbenchmark versus system-evaluation problem. I would not cite it in my own work until the claims are backed by a measured system.","headline":"Promising fine-grained HE/SS protocols, but the headline speedups are an aggregation of microbenchmarks, not a real end-to-end system, and accuracy is plaintext-only.","tokens_in":36379,"tokens_out":1715,"would_cite":false,"duration_ms":16828,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that mixing homomorphic encryption and secret sharing at sub-operator granularity makes private transformer inference much faster and cheaper to communicate.","keywords":["secure two-party computation","homomorphic encryption","secret sharing","private transformer inference","piecewise polynomial approximation","BFV","BERT","GLUE"],"falsifier":"Run the complete FASTLMPI BERTbase inference on the described LAN and WAN testbeds and compare wall-clock time and bytes sent against the summed microbenchmarks; a total substantially above the reported 131.36 s, 679.90 s, or 1479.82 s, or communication above 20.49 GB, would invalidate the aggregation. Separately, evaluate MRPC, RTE, and SST-2 accuracy through the full secure pipeline; if F1 and accuracy drop below the reported 89.1, 54.5, and 90.7, the plaintext-accuracy assumption fails.","tokens_in":35327,"feed_emoji":"🔐","tokens_out":8216,"duration_ms":66160,"temperature":0.7,"pith_summary":"FASTLMPI is trying to show that the standard recipe for private transformer inference — homomorphic encryption for linear layers and secret sharing for non-linear ones — leaves large savings on the table. The paper's wager is that switching between the two primitives at a finer granularity, inside each operator rather than between operators, removes the two dominant costs: HE's expensive rotations and SS's heavy interaction. It contributes four two-party protocols for matrix multiplication, SoftMax, LayerNorm, and GeLU, plus a piecewise-fitting rule that places segment boundaries at inflection points. If these claims hold, private BERTbase inference would run about 2.8 times faster on a LAN than the BOLT baseline and move 72.2% less data.","feed_headline":"Mixing two crypto styles cuts private AI inference time by over half","feed_subtitle":"FASTLMPI cuts BERTbase inference from 369 s to 131 s on a LAN and communication by 72%","key_machinery":"The load-bearing mechanism is fine-grained collaborative computation: in each protocol, values move between prime-field BFV ciphertexts ($\\mathbb{Z}_p$) and ring secret shares ($\\mathbb{Z}_{2^k}$), so each sub-step runs in whichever primitive is cheaper. In $\\Pi_{\\text{matmul}}$, Alice sends SIMD-encrypted rows of her matrix and Bob returns the encrypted product minus a random mask, converting an HE rotation into one communication round and yielding additive shares for the next layer. In $\\Pi_{\\text{softmax}}$, the expensive exponential is computed over ring shares with an existing subprotocol, then packed into a SIMD ciphertext for the denominator sum and modular inverse. The fitting recipe selects piecewise segment endpoints at inflection points, where the second derivative vanishes, and near-zero third-derivative points, producing lower-degree polynomials with smaller endpoint error.","core_discovery":"The paper's central claim is that the cost profile of private transformer inference is governed by where the boundary between HE and SS is drawn, not by the choice of either primitive alone. In FASTLMPI, matrix multiplication avoids all ciphertext rotations: Alice sends SIMD-encrypted copies of her input, Bob multiplies them with his matrix in plaintext and subtracts a random mask, and the result is an additive secret share that feeds the next linear layer. Non-linear operators run the other way, borrowing HE to collapse many secret-sharing interactions into a small number of SIMD ciphertext operations; SoftMax in particular is reported to become 14x faster and 260x cheaper in communication than in BOLT. For GeLU, a five-piece polynomial with breakpoints at the inflection points $\\pm\\sqrt{2}$ and at $\\pm 5.075$ reaches accuracy comparable to degree-6 and degree-7 fits while using at most degree-4 polynomials. The authors report end-to-end BERTbase runtime of 131.36 s on a LAN versus 369.19 s for BOLT, with communication falling from 72.21 GB to 20.49 GB, and GLUE accuracy close to the plaintext baseline without retraining.","pith_inferences":["Because the paper estimates end-to-end time by summing microbenchmarks in the style of NEXUS, the headline speedups should be checked by a full end-to-end secure execution; field conversions and subprotocol rounds may not be fully captured by the per-operator tables.","The inflection-point segmentation rule is a general numerical recipe: any differentiable activation whose second and third derivatives vanish at identifiable points should be fit better with lower-degree polynomials, independent of the cryptography.","The paper's WAN/LAN comparison implies a tunable design space: deployments with slow networks should lean on HE-style non-interactive steps, while fast local networks should favor SS, and a cost model could pick the mix automatically.","The accuracy evaluation uses plaintext approximation of seg5GeLU, so the untested claim is whether encrypted fixed-point arithmetic preserves those F1 and accuracy numbers."],"forward_implications":["End-to-end BERTbase inference is reported to drop from 369.19 s to 131.36 s on a LAN, from 1502.12 s to 679.90 s on a 400 Mbps/10 ms WAN, and from 3784.39 s to 1479.82 s on a 200 Mbps/40 ms WAN.","Total communication falls from 72.21 GB to 20.49 GB, a 72.2% reduction, with the Secure SoftMax protocol alone contributing a roughly 260-fold cut.","The GeLU approximation matches the accuracy of degree-6 and degree-7 fits in prior systems while using lower-degree polynomials, and the same inflection-point recipe fits Sigmoid, Tanh, and Mish more accurately than existing piecewise fits.","Because the four protocols cover the operators shared by decoder-only transformers, the paper argues the framework extends to GPT and BERTlarge without new cryptographic machinery."],"supporting_citations":[{"why":"BOLT is the baseline whose per-operator and end-to-end runtime and communication are compared against in every main table.","marker":"[6]"},{"why":"SIRNN supplies the secure exponential and inverse-square-root routines invoked by the SoftMax and LayerNorm protocols.","marker":"[25]"},{"why":"CrypTFlow2 supplies the comparison protocol and boolean-to-arithmetic conversion used for segment selection in the GeLU protocol.","marker":"[12]"},{"why":"The SEAL library provides the BFV implementation used for SIMD ciphertext operations, squaring, and multiplications.","marker":"[26]"},{"why":"The SCI library in EzPC provides the fixed-point numerical routines for the secure computation.","marker":"[28]"},{"why":"The EMP toolkit is used to implement communication between the two parties.","marker":"[27]"},{"why":"BumbleBee is compared for linear operations, GeLU fitting accuracy, and end-to-end inference time.","marker":"[7]"},{"why":"NEXUS supplies the methodology of aggregating microbenchmarks to estimate end-to-end performance.","marker":"[9]"},{"why":"IRON is the transformer-private-inference baseline compared for matrix multiplication, non-linear functions, and end-to-end performance.","marker":"[33]"}],"fun_headline_variants":["Fine-grained crypto mix speeds private transformers by over half","Avoiding rotations and sharing softmax: FASTLMPI speeds private AI","Smart HE-SS split cuts private transformer inference 54-64%","Collaborative crypto cuts private inference cost and communication"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The end-to-end speedups rest on the assumption that adding microbenchmark timings reproduces real end-to-end performance, and the accuracy numbers rest on the assumption that plaintext approximation error carries over unchanged to the encrypted fixed-point pipeline.","fun_headline_variants_meta":{"raw":{"variants":["Fine-grained crypto mix speeds private transformers by over half","Avoiding rotations and sharing softmax: FASTLMPI speeds private AI","Smart HE-SS split cuts private transformer inference 54-64%","Collaborative crypto cuts private inference cost and communication"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000401,"raw_usage":{"total_tokens":2103,"prompt_tokens":964,"completion_tokens":1139,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":580,"completion_tokens_details":{"reasoning_tokens":1068}},"tokens_in":580,"tokens_out":1139,"duration_ms":8385,"temperature":1.0,"reasoning_tokens":1068,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:28:57.072915+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the complete FASTLMPI BERTbase inference on the described LAN and WAN testbeds and compare wall-clock time and bytes sent against the summed microbenchmarks; a total substantially above the reported 131.36 s, 679.90 s, or 1479.82 s, or communication above 20.49 GB, would invalidate the aggregation. Separately, evaluate MRPC, RTE, and SST-2 accuracy through the full secure pipeline; if F1 and accuracy drop below the reported 89.1, 54.5, and 90.7, the plaintext-accuracy assumption fails.","supporting_citations":[],"review_version":1}